@gotcos/glasses-server 6.79.2 → 6.81.0

package/server/lib/codex-homes.ts

@@ -0,0 +1,134 @@
+// Key lanes K1 P4 (plan v4 8.2): every Codex home a reader must look in.
+//
+// A keyed (Lane B) Codex turn runs in its own home, `data/codex-homes/<profileId>/`, so its
+// rollouts, writer locks and queue database never land in the user's `~/.codex`. Readers that
+// FIND threads (the session list, the native head, the queue counts, occupancy, hook events)
+// look in every home; readers of config, catalog or models stay on the server home.
+//
+//   codexHomes(serverHome)   the server home FIRST, then each profile home. With key lanes off
+//                            or no profile home on disk it is exactly `[serverHome]`, so every
+//                            reader built on it is identical to 963fe25.
+//
+// HARD RULE (zero impact without a key): nothing here creates a file or a directory. A profile
+// home is listed only while key lanes are enabled AND `data/codex-homes/` exists. Importing this
+// module reads nothing.
+import { lstatSync, readdirSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { join, resolve, sep } from 'node:path'
+import { dataPath } from './data-dir.js'
+import { keyLanesEnabled } from './key-lanes.js'
+import { isKeyProfileId } from '../../shared/key-preference.js'
+
+/** The directory under the data dir. P1's Remove all keys deletes it (`routes/key-lanes.ts`). */
+export const CODEX_PROFILE_HOMES_DIR = 'codex-homes'
+/** A bound on how many profile homes one read lists (the profile store caps at 20). */
+export const MAX_CODEX_PROFILE_HOMES = 64
+
+/** The server's own Codex home: `CODEX_HOME`, else `~/.codex` (as the hooks installer reads it). */
+export function serverCodexHome(env: NodeJS.ProcessEnv = process.env): string {
+  const raw = env.CODEX_HOME?.trim()
+  return raw ? resolve(raw) : join(homedir(), '.codex')
+}
+
+export function codexProfileHomesRoot(): string {
+  return dataPath(CODEX_PROFILE_HOMES_DIR)
+}
+
+/** `data/codex-homes/<id>`. Throws on a malformed id (a caller bug, never user input). */
+export function codexProfileHome(profileId: string): string {
+  if (!isKeyProfileId(profileId)) throw new Error('invalid key profile id')
+  return join(codexProfileHomesRoot(), profileId)
+}
+
+export interface CodexProfileHomeEntry {
+  profileId: string
+  home: string
+}
+
+/**
+ * Profile homes on disk, sorted by id. Empty unless key lanes are enabled and the root exists.
+ * A symlink, a file or a badly named entry is skipped, never followed.
+ */
+export function profileCodexHomes(env: NodeJS.ProcessEnv = process.env): CodexProfileHomeEntry[] {
+  if (!keyLanesEnabled(env)) return []
+  const root = codexProfileHomesRoot()
+  let names: string[]
+  try {
+    if (!lstatSync(root).isDirectory()) return []
+    names = readdirSync(root)
+  } catch {
+    return []
+  }
+  const out: CodexProfileHomeEntry[] = []
+  for (const name of names.sort()) {
+    if (!isKeyProfileId(name)) continue
+    const home = join(root, name)
+    try { if (!lstatSync(home).isDirectory()) continue } catch { continue }
+    out.push({ profileId: name, home })
+    if (out.length >= MAX_CODEX_PROFILE_HOMES) break
+  }
+  return out
+}
+
+/**
+ * Every Codex home, the server home first. A reader passes its own server home (some honour
+ * `COS_AGENT_SESSIONS_HOME`, some `CODEX_HOME`) so the first entry is exactly what it read before.
+ */
+export function codexHomes(serverHome: string = serverCodexHome(), env: NodeJS.ProcessEnv = process.env): string[] {
+  return [serverHome, ...profileCodexHomes(env).map(entry => entry.home)]
+}
+
+/** The profile homes only, joined with a subpath (`sessions`, `thread-writer-locks`). */
+export function profileCodexHomeSubdirs(sub: string, env: NodeJS.ProcessEnv = process.env): string[] {
+  return profileCodexHomes(env).map(entry => join(entry.home, sub))
+}
+
+/**
+ * The profile id a path lives under (`data/codex-homes/<id>/...`), or undefined. Prefix-exact on
+ * the real root, so a user folder that happens to be called `codex-homes` never matches.
+ */
+export function profileIdForCodexPath(path: unknown): string | undefined {
+  if (typeof path !== 'string' || !path) return undefined
+  const root = codexProfileHomesRoot() + sep
+  if (!path.startsWith(root)) return undefined
+  const id = path.slice(root.length).split(sep)[0]
+  return isKeyProfileId(id) ? id : undefined
+}
+
+const ROLLOUT_ID_RE = /([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\.jsonl$/i
+const MAX_DIR_ENTRIES = 512
+const MAX_FILES = 20_000
+
+/**
+ * The profile whose home holds this Codex thread's rollout, or undefined. Walks
+ * `sessions/<yyyy>/<mm>/<dd>/rollout-*-<id>.jsonl` in each profile home, bounded like
+ * native-head's walk. With no profile home it returns at once without touching the disk.
+ */
+export function profileForCodexThread(threadId: string, env: NodeJS.ProcessEnv = process.env): string | undefined {
+  const homes = profileCodexHomes(env)
+  if (homes.length === 0) return undefined
+  const needle = typeof threadId === 'string' ? threadId.trim().toLowerCase() : ''
+  if (!/^[0-9a-f-]{36}$/.test(needle)) return undefined
+  const list = (dir: string): string[] => {
+    try {
+      const names = readdirSync(dir)
+      return names.length > MAX_DIR_ENTRIES ? [] : names
+    } catch { return [] }
+  }
+  for (const { profileId, home } of homes) {
+    let scanned = 0
+    const root = join(home, 'sessions')
+    for (const y of list(root)) for (const m of list(join(root, y))) for (const d of list(join(root, y, m))) {
+      for (const name of list(join(root, y, m, d))) {
+        if (++scanned > MAX_FILES) break
+        if (!name.startsWith('rollout-')) continue
+        if (ROLLOUT_ID_RE.exec(name)?.[1]?.toLowerCase() === needle) return profileId
+      }
+    }
+  }
+  return undefined
+}
+
+export function isProfileCodexThread(threadId: string, env: NodeJS.ProcessEnv = process.env): boolean {
+  return profileForCodexThread(threadId, env) !== undefined
+}

package/server/lib/codex-live-queue.ts

@@ -54,6 +54,7 @@
 // sentence into the thread twice. A clap usage error (exit 2) queued nothing.
 
 import { isValidNativeThreadId } from './native-thread-id.js'
+import { isProfileCodexThread } from './codex-homes.js'
 
 export type CodexLiveReason =
   /** The row is in the holder's queue. */
@@ -71,6 +72,11 @@ export type CodexLiveReason =
   | 'refused'
   /** Something may be queued. Hold; never retry, never spawn over it. */
   | 'unverified'
+  /**
+   * Key lanes K1 (plan v4 8.1): the thread lives in a keyed profile home, never the Codex app's
+   * queue. Nothing sent; the steer lands after the running turn (CODEX_KEYED_STEER_NOTICE).
+   */
+  | 'keyed_session'
 
 export interface CodexLiveResult {
   ok: boolean
@@ -100,8 +106,13 @@ export interface CodexLiveDeps {
   run: (binary: string, args: readonly string[], timeoutMs: number) => Promise<CodexQueueRun>
   now: () => number
   log?: (level: 'info' | 'warn', event: string, detail: Record<string, unknown>) => void
+  /** Key lanes: is this thread a keyed profile thread? Defaults to a look in the profile homes. */
+  isKeyedThread?: (threadId: string) => boolean
 }
 
+/** Plan 8.1 lens line for a steer into a keyed Codex session. */
+export const CODEX_KEYED_STEER_NOTICE = 'Steer lands after this turn.'
+
 export interface CodexLiveRequest {
   provider: string
   sessionId: string
@@ -182,6 +193,9 @@ export async function deliverOverCodexQueue(request: CodexLiveRequest, deps: Cod
   })
   if (!request.enabled) return done('disabled')
   if (request.provider !== 'codex' || request.foreignHolder !== true) return done('no_holder')
+  // Key lanes: a keyed profile thread is never the Codex app's, so it never joins its queue.
+  // With no profile home this is one predicate call that touches nothing.
+  if ((deps.isKeyedThread ?? isProfileCodexThread)(request.sessionId)) return done('keyed_session')
   let args: string[]
   try {
     args = buildCodexQueueArgs(request.sessionId, request.prompt)

package/server/lib/codex-profile-home.ts

@@ -0,0 +1,452 @@
+// Key lanes K1 P4 (plan v4 8.1, D9): the generated Codex home a keyed (Lane B) Codex turn runs in.
+//
+// A keyed Codex turn never runs in the user's `~/.codex`. Canary C2d (2026-10-19): even with
+// `-c` overrides on the real home, Codex rewrote `auth.json` (a ChatGPT token refresh) during a
+// key run. So each profile gets `data/codex-homes/<id>/` (0700), regenerated before every turn:
+//
+//   config.toml  the loopback relay as the ONLY provider (`wire_api = "responses"`, C2a/C2b; the
+//                chat wire is refused at config load), retries 2, plus these tables copied
+//                read-only from the server home's config: `[mcp_servers.*]` (D9), `[projects.*]`
+//                (folder trust, so project hooks and config load as they do on Lane A),
+//                `[shell_environment_policy*]`, `[sandbox_workspace_write]`, and the hook trust
+//                entries that still describe the hooks written here.
+//   hooks.json   the COS hook blocks, from the installer's own writer, for exactly the events the
+//                user's `~/.codex/hooks.json` carries ours for (mirror, never more).
+//   auth.json    NEVER. One found there is removed before the turn: the key reaches Codex only as
+//                a turn nonce in `COS_RELAY_TOKEN`, and the real key only ever lives in the relay.
+//
+// The user's `~/.codex` is read, never written. HARD RULE: nothing here runs unless a caller has
+// a key profile in hand; importing this module reads no file, opens no socket and starts no timer.
+import { createHash } from 'node:crypto'
+import { chmodSync, lstatSync, mkdirSync, readFileSync, unlinkSync } from 'node:fs'
+import { dirname, join, resolve as resolvePath } from 'node:path'
+import { homedir } from 'node:os'
+import { durableAtomicWriteFileSync } from './atomic-fs.js'
+import { currentHookPaths, type HookPaths } from './claude-hooks-installer.js'
+import { codexSubscribedEvents, mergeCodexHooks, stableCodexHookScriptPath } from './codex-hooks-installer.js'
+import { codexProfileHome, codexProfileHomesRoot, serverCodexHome } from './codex-homes.js'
+import { CODEX_KEYED_STEER_NOTICE } from './codex-live-queue.js'
+import { keyLanesActive } from './key-lanes.js'
+import { KEY_LANE_REFUSAL_COPY } from './key-notices.js'
+import { isLaneBStrippedName, LANE_B_STRIPPED_NAMES } from './lane-b-env.js'
+import { engineModelProblem } from './key-profiles.js'
+import { KEY_LANE_CHILD_ENV, RELAY_BASE_PATHS } from './key-relay-contract.js'
+import type { KeyKind, KeyProfile, KeyRelay } from './key-relay-contract.js'
+import { getPublicKey } from './key-store.js'
+
+/** The provider id the generated config defines and argv selects. */
+export const CODEX_RELAY_PROVIDER_ID = 'cos-relay'
+/** Plan 4.6: the child retries a 429 or 5xx twice; the relay never retries itself. R15 checks the names. */
+export const CODEX_RELAY_RETRIES = 2
+/**
+ * Canary R14 / R15: Codex multiplies the two (each stream reconnect runs its own request retries:
+ * 7 to 9 upstream calls per failure). Stream reconnects are off, so one failure costs at most
+ * 1 + CODEX_RELAY_RETRIES = 3 attempts, the plan 4.6 budget.
+ */
+export const CODEX_RELAY_STREAM_RETRIES = 0
+/** Top-level config tables copied from the server home (first key segment). */
+export const CODEX_COPIED_TABLES: readonly string[] = ['mcp_servers', 'projects', 'shell_environment_policy', 'sandbox_workspace_write']
+
+/** Call options a keyed Codex turn adds. Same field name and type P3 adds to CallOptions. */
+export interface CodexKeyLaneCallOptions {
+  keyProfile?: KeyProfile
+}
+
+// ── Child environment (plan 7.2 base, 8.1 additions) ────────────────────────
+
+/**
+ * Provider-credential names a Lane B child never inherits: P3's one list (lane-b-env.ts, deduped by
+ * P11), plus `CODEX_HOME`, which the profile home replaces. Every other name is kept.
+ */
+export const CODEX_LANE_B_STRIPPED_NAMES: readonly string[] = [...LANE_B_STRIPPED_NAMES, 'CODEX_HOME']
+
+export function isCodexLaneBStrippedName(name: string): boolean {
+  return name === 'CODEX_HOME' || isLaneBStrippedName(name)
+}
+
+/** The names applyCodexLaneBEnv sets. With the stripped names this is the whole A-vs-B difference. */
+export const CODEX_LANE_B_ADDED_NAMES: readonly string[] = [
+  'CODEX_HOME',
+  KEY_LANE_CHILD_ENV.codexToken,
+  KEY_LANE_CHILD_ENV.profileMarker,
+]
+
+/** Point a child env copy (never process.env) at the profile home and the relay nonce. */
+export function applyCodexLaneBEnv(env: NodeJS.ProcessEnv, spec: { home: string; nonce: string; profileId: string }): void {
+  if (env === process.env) throw new Error('codex-profile-home: refusing to write process.env')
+  if (!spec.home || !spec.nonce || !spec.profileId) throw new Error('codex-profile-home: incomplete spec')
+  for (const name of Object.keys(env)) {
+    if (isCodexLaneBStrippedName(name)) delete env[name]
+  }
+  env.CODEX_HOME = spec.home
+  env[KEY_LANE_CHILD_ENV.codexToken] = spec.nonce
+  env[KEY_LANE_CHILD_ENV.profileMarker] = spec.profileId
+}
+
+// ── Seams (P2 relay, P3 keyed-session record). P11 wires both. ───────────────
+
+type RelayResolver = () => KeyRelay | Promise<KeyRelay>
+let relayResolver: RelayResolver | null = null
+
+export function registerCodexKeyRelay(resolver: RelayResolver | null): void {
+  relayResolver = resolver
+}
+export function codexKeyRelayRegistered(): boolean {
+  return relayResolver !== null
+}
+export async function codexKeyRelay(): Promise<KeyRelay> {
+  if (!relayResolver) throw new Error('codex-profile-home: no key relay registered')
+  return await relayResolver()
+}
+
+export interface KeyedCodexThread {
+  id: string
+  engine: 'codex'
+  profileId: string
+  cosSessionId: string
+}
+type KeyedThreadRecorder = (thread: KeyedCodexThread) => void
+let keyedThreadRecorder: KeyedThreadRecorder | null = null
+
+/** Plan 7.3: P11 points this at P3's `recordKeyedSession`. */
+export function registerCodexKeyedThreadRecorder(recorder: KeyedThreadRecorder | null): void {
+  keyedThreadRecorder = recorder
+}
+export function recordKeyedCodexThread(thread: KeyedCodexThread): void {
+  try { keyedThreadRecorder?.(thread) } catch (err) {
+    console.error(`[codex-profile-home] keyed thread record failed: ${err instanceof Error ? err.message.slice(0, 120) : 'unknown'}`)
+  }
+}
+
+/** Tests only. */
+export function __resetCodexProfileSeamsForTests(): void {
+  relayResolver = null
+  keyedThreadRecorder = null
+}
+
+// ── Lens copy (plan 11.3). P8's key-notices.ts is the single source once merged. ─────────────
+
+export const CODEX_LANE_B_COPY = {
+  lanesOff: KEY_LANE_REFUSAL_COPY.lanesOff,
+  profileOff: KEY_LANE_REFUSAL_COPY.profileOff,
+  wrongEngine: KEY_LANE_REFUSAL_COPY.wrongEngineCodex,
+  keyMissing: KEY_LANE_REFUSAL_COPY.keyMissing,
+  modelNotAllowed: KEY_LANE_REFUSAL_COPY.codexModelNotAllowed,
+  scheduled: KEY_LANE_REFUSAL_COPY.scheduled,
+  relayUnavailable: KEY_LANE_REFUSAL_COPY.relayUnavailable,
+  /** Plan 8.1: a keyed Codex session never joins the Codex app queue. */
+  steerAfterTurn: CODEX_KEYED_STEER_NOTICE,
+} as const
+
+export type CodexProfilePreflight = { ok: true; keyKind: KeyKind } | { ok: false; message: string }
+
+/** Project-config names that could point a keyed Codex turn at a provider other than the relay. */
+const CODEX_PROJECT_PROVIDER_RE = /^\s*(?:\[\s*model_providers\b|(?:model_provider|model_providers|openai_base_url|chatgpt_base_url)\s*[=.])/m
+
+/**
+ * QA W4: a trusted project's `.codex/config.toml` is merged over the profile home's config, so
+ * one that sets a provider (or redefines `cos-relay`) could send a keyed turn around the meter.
+ * Walks from the working directory up to the repository root (a `.git` entry) or the filesystem
+ * root, never into the user's home itself (that `.codex` is the global config the profile home
+ * replaces). Returns the file and the name it sets, or null. Read only on a keyed turn.
+ */
+export function codexProjectConfigRefusal(cwd: string, home: string = homedir()): { file: string; name: string } | null {
+  let dir = resolvePath(cwd)
+  for (let i = 0; i < 32; i++) {
+    if (dir !== home) {
+      const file = join(dir, '.codex', 'config.toml')
+      try {
+        if (lstatSync(file).isFile()) {
+          const m = CODEX_PROJECT_PROVIDER_RE.exec(readFileSync(file, 'utf8'))
+          if (m) return { file, name: m[0].replace(/[\s\[=.]/g, '') || 'model_provider' }
+        }
+      } catch { /* none here */ }
+      try { if (lstatSync(join(dir, '.git'))) break } catch { /* not the repo root */ }
+    }
+    const up = dirname(dir)
+    if (up === dir) break
+    dir = up
+  }
+  return null
+}
+
+/** Everything a keyed Codex turn passes before history, the run ledger or a process. Fails closed. */
+export function codexProfilePreflight(input: { profile: KeyProfile; dispatch: boolean; cwd?: string }): CodexProfilePreflight {
+  const { profile } = input
+  if (!keyLanesActive()) return { ok: false, message: CODEX_LANE_B_COPY.lanesOff }
+  if (profile.engine !== 'codex') return { ok: false, message: CODEX_LANE_B_COPY.wrongEngine(profile.label) }
+  if (!profile.enabled) return { ok: false, message: CODEX_LANE_B_COPY.profileOff(profile.label) }
+  if (input.dispatch) return { ok: false, message: CODEX_LANE_B_COPY.scheduled }
+  const key = getPublicKey(profile.keyRef)
+  if (!key) return { ok: false, message: CODEX_LANE_B_COPY.keyMissing(profile.label) }
+  if (engineModelProblem('codex', profile.model, key.kind)) return { ok: false, message: CODEX_LANE_B_COPY.modelNotAllowed(profile.label) }
+  const project = input.cwd ? codexProjectConfigRefusal(input.cwd) : null
+  if (project) return { ok: false, message: KEY_LANE_REFUSAL_COPY.codexProjectConfig(project.name) }
+  if (!codexKeyRelayRegistered()) return { ok: false, message: CODEX_LANE_B_COPY.relayUnavailable }
+  return { ok: true, keyKind: key.kind }
+}
+
+// ── TOML, just enough (the server has no TOML dependency) ───────────────────
+
+const BARE_KEY_RE = /^[A-Za-z0-9_-]+$/
+
+/** A dotted table key (`a."b c".d`) to its segments, or null when it is not a key. */
+export function parseTomlKeyPath(inner: string): string[] | null {
+  const segs: string[] = []
+  let i = 0
+  const s = inner.trim()
+  const skipWs = () => { while (i < s.length && (s[i] === ' ' || s[i] === '\t')) i++ }
+  while (i < s.length) {
+    skipWs()
+    if (s[i] === '"') {
+      let out = ''
+      i++
+      for (;;) {
+        if (i >= s.length) return null
+        const ch = s[i]
+        if (ch === '"') { i++; break }
+        if (ch === '\\') {
+          const nx = s[i + 1]
+          const map: Record<string, string> = { '"': '"', '\\': '\\', n: '\n', t: '\t', r: '\r', b: '\b', f: '\f' }
+          if (nx && nx in map) { out += map[nx]; i += 2; continue }
+          if (nx === 'u' || nx === 'U') {
+            const len = nx === 'u' ? 4 : 8
+            const hex = s.slice(i + 2, i + 2 + len)
+            if (!/^[0-9a-fA-F]+$/.test(hex) || hex.length !== len) return null
+            out += String.fromCodePoint(parseInt(hex, 16))
+            i += 2 + len
+            continue
+          }
+          return null
+        }
+        out += ch
+        i++
+      }
+      segs.push(out)
+    } else if (s[i] === "'") {
+      const end = s.indexOf("'", i + 1)
+      if (end < 0) return null
+      segs.push(s.slice(i + 1, end))
+      i = end + 1
+    } else {
+      const m = /^[A-Za-z0-9_-]+/.exec(s.slice(i))
+      if (!m) return null
+      segs.push(m[0])
+      i += m[0].length
+    }
+    skipWs()
+    if (i >= s.length) break
+    if (s[i] !== '.') return null
+    i++
+  }
+  return segs.length ? segs : null
+}
+
+export function encodeTomlKeySegment(seg: string): string {
+  return BARE_KEY_RE.test(seg) ? seg : tomlBasicString(seg)
+}
+
+/** A TOML basic string, always quoted. */
+export function tomlBasicString(seg: string): string {
+  let out = '"'
+  for (const ch of seg) {
+    const cp = ch.codePointAt(0)!
+    if (ch === '"') out += '\\"'
+    else if (ch === '\\') out += '\\\\'
+    else if (cp < 0x20 || cp === 0x7f) out += `\\u${cp.toString(16).padStart(4, '0')}`
+    else out += ch
+  }
+  return out + '"'
+}
+
+export interface TomlSection {
+  /** Null for the leading top-level keys, before any header. */
+  path: string[] | null
+  arrayTable: boolean
+  header: string
+  body: string[]
+}
+
+const HEADER_RE = /^\s*(\[\[?)\s*(.+?)\s*(\]\]?)\s*(#.*)?$/
+
+/** Split TOML text into sections at table headers. Multi-line strings never split a section. */
+export function splitTomlSections(text: string): TomlSection[] {
+  const sections: TomlSection[] = [{ path: null, arrayTable: false, header: '', body: [] }]
+  let inMulti: '"""' | "'''" | null = null
+  for (const line of text.split(/\r?\n/)) {
+    if (inMulti) {
+      sections[sections.length - 1]!.body.push(line)
+      if ((line.split(inMulti).length - 1) % 2 === 1) inMulti = null
+      continue
+    }
+    const m = HEADER_RE.exec(line)
+    const open = m?.[1], close = m?.[3]
+    const path = m && ((open === '[' && close === ']') || (open === '[[' && close === ']]')) ? parseTomlKeyPath(m[2]!) : null
+    if (m && path) {
+      sections.push({ path, arrayTable: open === '[[', header: line, body: [] })
+      continue
+    }
+    sections[sections.length - 1]!.body.push(line)
+    for (const q of ['"""', "'''"] as const) {
+      if ((line.split(q).length - 1) % 2 === 1) { inMulti = q; break }
+    }
+  }
+  return sections
+}
+
+function headerFor(path: string[], arrayTable: boolean): string {
+  const name = path.map(encodeTomlKeySegment).join('.')
+  return arrayTable ? `[[${name}]]` : `[${name}]`
+}
+
+function camelToSnake(event: string): string {
+  return event.replace(/([a-z0-9])([A-Z])/g, '$1_$2').toLowerCase()
+}
+
+const HOOK_TRUST_KEY_RE = /^(.*):([a-z_]+):(\d+):(\d+)$/
+
+// ── The generated home ───────────────────────────────────────────────────────
+
+export interface CodexProfileHomeSources {
+  /** The server's Codex home, read only. Default `CODEX_HOME` or `~/.codex`. */
+  serverHome?: string
+  scriptPath?: string
+  hookPaths?: HookPaths
+}
+
+export interface RenderedCodexProfileHome {
+  profileId: string
+  home: string
+  /** config.toml with the relay origin still a placeholder. */
+  configTemplate: string
+  hooksText: string
+  /** Plan 8.1 resume binding: `profile:<id>:<sha>` over the template and hooks (never the port). */
+  engineFingerprint: string
+  copiedTables: string[]
+  mirroredHookEvents: string[]
+}
+
+const ORIGIN_PLACEHOLDER = '__COS_RELAY_ORIGIN__'
+
+function readTextOrNull(path: string): string | null {
+  try {
+    if (lstatSync(path).isSymbolicLink()) return null
+    return readFileSync(path, 'utf8')
+  } catch { return null }
+}
+
+/** Pure apart from READING the server home's config.toml and hooks.json. Writes nothing. */
+export function renderCodexProfileHome(profile: KeyProfile, sources: CodexProfileHomeSources = {}): RenderedCodexProfileHome {
+  const serverHome = sources.serverHome ?? serverCodexHome()
+  const home = codexProfileHome(profile.id)
+  const scriptPath = sources.scriptPath ?? stableCodexHookScriptPath()
+  const hookPaths = sources.hookPaths ?? currentHookPaths()
+  const serverHooksPath = join(serverHome, 'hooks.json')
+  const profileHooksPath = join(home, 'hooks.json')
+
+  // hooks.json: our canonical blocks, for exactly the events the user's file has ours for.
+  let userHooks: unknown = {}
+  const userHooksText = readTextOrNull(serverHooksPath)
+  if (userHooksText !== null) { try { userHooks = JSON.parse(userHooksText) } catch { userHooks = {} } }
+  const subscribed = codexSubscribedEvents(userHooks, scriptPath, hookPaths).subscribed
+  const merged = mergeCodexHooks({}, scriptPath, hookPaths)
+  const allBlocks = merged.ok ? (merged.settings.hooks as Record<string, unknown>) : {}
+  const hooks: Record<string, unknown> = {}
+  for (const event of subscribed) if (allBlocks[event] !== undefined) hooks[event] = allBlocks[event]
+  const hooksText = JSON.stringify({ hooks }, null, 2) + '\n'
+
+  // Where our block sits in the user's file, per event (snake name), for the trust remap.
+  const userTable = userHooks && typeof userHooks === 'object' ? (userHooks as { hooks?: Record<string, unknown> }).hooks ?? {} : {}
+  const ourIndex = new Map<string, number>()
+  for (const event of subscribed) {
+    const blocks = Array.isArray(userTable[event]) ? userTable[event] as unknown[] : []
+    const canonical = JSON.stringify((allBlocks[event] as unknown[] | undefined)?.[0])
+    const at = blocks.findIndex(b => JSON.stringify(b) === canonical)
+    if (at >= 0) ourIndex.set(camelToSnake(event), at)
+  }
+
+  const copied: string[] = []
+  const out: string[] = []
+  const configText = readTextOrNull(join(serverHome, 'config.toml'))
+  if (configText !== null) {
+    for (const section of splitTomlSections(configText)) {
+      const path = section.path
+      if (!path) continue
+      if (CODEX_COPIED_TABLES.includes(path[0]!)) {
+        out.push(section.header, ...section.body)
+        copied.push(path.join('.'))
+        continue
+      }
+      // Hook trust: Codex keys each hook by `<file>:<event>:<block>:<hook>`. A project file's key
+      // names the same file on both lanes and is copied as it stands. A key on the user's own
+      // hooks.json is moved to this home's hooks.json, only where our block is the one trusted.
+      if (path[0] === 'hooks' && path[1] === 'state' && path.length === 3) {
+        const key = path[2]!
+        const parsed = HOOK_TRUST_KEY_RE.exec(key)
+        if (parsed && parsed[1] === serverHooksPath) {
+          const at = ourIndex.get(parsed[2]!)
+          if (at === undefined || Number(parsed[3]) !== at) continue
+          const remapped = `${profileHooksPath}:${parsed[2]}:0:${parsed[4]}`
+          out.push(headerFor(['hooks', 'state', remapped], false), ...section.body)
+          copied.push(`hooks.state.${parsed[2]}`)
+          continue
+        }
+        if (parsed && parsed[1]!.startsWith(home)) continue
+        out.push(section.header, ...section.body)
+        copied.push('hooks.state')
+      }
+    }
+  }
+
+  const head = [
+    `# Generated by COS for key profile ${profile.id} before every keyed turn. COS rewrites it; do not edit.`,
+    `model = ${tomlBasicString(profile.model)}`,
+    `model_provider = "${CODEX_RELAY_PROVIDER_ID}"`,
+    '',
+    `[model_providers.${CODEX_RELAY_PROVIDER_ID}]`,
+    'name = "COS key relay"',
+    `base_url = "${ORIGIN_PLACEHOLDER}${RELAY_BASE_PATHS.codex}"`,
+    `env_key = "${KEY_LANE_CHILD_ENV.codexToken}"`,
+    'wire_api = "responses"',
+    `request_max_retries = ${CODEX_RELAY_RETRIES}`,
+    `stream_max_retries = ${CODEX_RELAY_STREAM_RETRIES}`,
+    '',
+  ]
+  const tail = out.length ? [`# Copied read-only from ${join(serverHome, 'config.toml')} (plan D9).`, ...out] : []
+  const configTemplate = [...head, ...tail].join('\n').replace(/\n*$/, '\n')
+  const sha = createHash('sha256').update(configTemplate).update('\0').update(hooksText).digest('hex').slice(0, 16)
+  return {
+    profileId: profile.id,
+    home,
+    configTemplate,
+    hooksText,
+    engineFingerprint: `profile:${profile.id}:${sha}`,
+    copiedTables: [...new Set(copied)],
+    mirroredHookEvents: Object.keys(hooks),
+  }
+}
+
+const LOOPBACK_ORIGIN_RE = /^http:\/\/127\.0\.0\.1:\d{1,5}$/
+
+/**
+ * Write the rendered home with the relay origin filled in: dirs 0700, files 0600, atomic. Refuses
+ * a symlinked root or home. Any `auth.json` in the home is removed: a keyed home never holds one.
+ */
+export function writeCodexProfileHome(rendered: RenderedCodexProfileHome, relayOrigin: string): { configPath: string; hooksPath: string } {
+  if (!LOOPBACK_ORIGIN_RE.test(relayOrigin)) throw new Error('codex-profile-home: the relay origin is not loopback')
+  const root = codexProfileHomesRoot()
+  for (const dir of [root, rendered.home]) {
+    let st: ReturnType<typeof lstatSync> | null = null
+    try { st = lstatSync(dir) } catch { /* created below */ }
+    if (st && (st.isSymbolicLink() || !st.isDirectory())) throw new Error('codex-profile-home: refusing a symlinked or non-directory home')
+    mkdirSync(dir, { recursive: true, mode: 0o700 })
+    chmodSync(dir, 0o700)
+  }
+  const auth = join(rendered.home, 'auth.json')
+  try { lstatSync(auth); unlinkSync(auth) } catch { /* none, as it should be */ }
+  const configPath = join(rendered.home, 'config.toml')
+  const hooksPath = join(rendered.home, 'hooks.json')
+  durableAtomicWriteFileSync(configPath, rendered.configTemplate.split(ORIGIN_PLACEHOLDER).join(relayOrigin), { mode: 0o600 })
+  durableAtomicWriteFileSync(hooksPath, rendered.hooksText, { mode: 0o600 })
+  return { configPath, hooksPath }
+}

package/server/lib/codex-queue-control.ts

@@ -6,6 +6,7 @@ import { existsSync } from 'node:fs'
 import { homedir } from 'node:os'
 import { join } from 'node:path'
 import { resolveProviderBinary } from './provider-binary.js'
+import { codexHomes } from './codex-homes.js'
 
 export interface NativeQueuedSubmission { id: string; input: Array<{ type: string; text?: string; text_elements?: unknown[] }>; clientUserMessageId: string }
 export interface NativeQueueControl {
@@ -89,7 +90,22 @@ export const nativeQueueControl: NativeQueueControl = {
 // One read-only aggregate per session-list request, not 80 protocol processes.
 // No queue file is ever edited via SQL; mutations use Codex's own protocol above.
 export async function nativeQueuedCounts(): Promise<Map<string, number> | null> {
-  const db = join(process.env.CODEX_HOME || join(homedir(), '.codex'), 'queue_1.sqlite')
+  // Key lanes K1 (plan v4 8.2): the server home first, then each keyed profile home. With no
+  // profile home this is exactly the one read it always was.
+  const homes = codexHomes(process.env.CODEX_HOME || join(homedir(), '.codex'))
+  if (homes.length === 1) return queuedCountsIn(homes[0]!)
+  const total = new Map<string, number>()
+  for (const home of homes) {
+    const counts = await queuedCountsIn(home)
+    // An unreadable keyed home never degrades the server home's answer.
+    if (counts === null) { if (home === homes[0]) return null; continue }
+    for (const [thread, n] of counts) total.set(thread, (total.get(thread) ?? 0) + n)
+  }
+  return total
+}
+
+async function queuedCountsIn(home: string): Promise<Map<string, number> | null> {
+  const db = join(home, 'queue_1.sqlite')
   if (!existsSync(db)) return new Map()
   try {
     const { stdout } = await promisify(execFile)('/usr/bin/sqlite3', ['-readonly', '-json', db, 'SELECT thread_id, count(*) AS n FROM queued_items GROUP BY thread_id'], { timeout: 2000, maxBuffer: 1024 * 1024 })