@link-assistant/hive-mind 2.8.0 → 2.8.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @link-assistant/hive-mind
 
+## 2.8.2
+
+### Patch Changes
+
+- 44202ff: Explain invalid pull request base/head conflicts before attempting to retarget the pull request.
+
+## 2.8.1
+
+### Patch Changes
+
+- 23a2187: Provision required Codex plugins and Agent Skills in persistent repository-scoped state before solver execution, including Docker propagation and actionable missing-capability diagnostics.
+
 ## 2.8.0
 
 ### Minor Changes

package/README.hi.md

@@ -210,14 +210,15 @@ docker attach hive-mind
 # --- Persisting auth data across restarts ---
 
 # Extract auth data from a running (or stopped) container to the host:
-mkdir -p ~/.hive-mind
+mkdir -p ~/.hive-mind ~/.hive-mind/agents/skills
 docker cp hive-mind:/home/box/.claude ~/.hive-mind/claude
+docker cp hive-mind:/home/box/.codex ~/.hive-mind/codex
 docker cp hive-mind:/home/box/.claude.json ~/.hive-mind/claude.json
 docker cp hive-mind:/home/box/.config/gh ~/.hive-mind/gh
 
 # Fix ownership to match the box user inside the container:
 BOX_UID=$(docker exec hive-mind id -u box)
-chown -R $BOX_UID:$BOX_UID ~/.hive-mind/claude ~/.hive-mind/gh
+chown -R $BOX_UID:$BOX_UID ~/.hive-mind/claude ~/.hive-mind/codex ~/.hive-mind/agents ~/.hive-mind/gh
 chown $BOX_UID:$BOX_UID ~/.hive-mind/claude.json
 
 # On subsequent runs, mount the auth data to keep it between restarts:
@@ -225,11 +226,15 @@ docker run -dit \
   --name hive-mind \
   --restart unless-stopped \
   -v /root/.hive-mind/claude:/home/box/.claude \
+  -v /root/.hive-mind/codex:/home/box/.codex \
+  -v /root/.hive-mind/agents:/home/box/.agents \
   -v /root/.hive-mind/claude.json:/home/box/.claude.json \
   -v /root/.hive-mind/gh:/home/box/.config/gh \
   konard/hive-mind:latest
 ```
 
+`codex exec` शुरू होने से पहले Hive Mind issue और उसकी comments में स्पष्ट plugin तथा Agent Skill requirements खोजता है। आवश्यक provider `/home/box/.codex/hive-mind/repositories/<owner>/<repo>` में install होता है, इसलिए configuration restart के बाद भी रहती है और दूसरे repositories को प्रभावित नहीं करती। `/home/box/.agents/skills` के user skills भी Docker-isolated tasks में उपलब्ध होते हैं; capability न मिलने पर preflight AI session से पहले exact identifier और remediation command बताता है।
+
 **Docker के लाभ:**
 
 - ✅ पूर्व-कॉन्फ़िगर Ubuntu 24.04 वातावरण

package/README.md

@@ -213,7 +213,7 @@ docker attach hive-mind
 # --- Persisting auth data across restarts ---
 
 # On the host, create the directories used by the current Docker workflow:
-mkdir -p /root/.hive-mind/claude /root/.hive-mind/codex /root/.hive-mind/gh
+mkdir -p /root/.hive-mind/claude /root/.hive-mind/codex /root/.hive-mind/agents/skills /root/.hive-mind/gh
 touch -a /root/.hive-mind/claude.json
 
 # In our Docker images HOME=/home/box, so Codex stores its data in /home/box/.codex.
@@ -221,13 +221,14 @@ touch -a /root/.hive-mind/claude.json
 docker run -dit --user box --name hive-mind --restart unless-stopped \
   -v /root/.hive-mind/claude:/home/box/.claude \
   -v /root/.hive-mind/codex:/home/box/.codex \
+  -v /root/.hive-mind/agents:/home/box/.agents \
   -v /root/.hive-mind/claude.json:/home/box/.claude.json \
   -v /root/.hive-mind/gh:/home/box/.config/gh \
   konard/hive-mind:latest bash -l -c 'bash /home/box/start-bot.sh'
 
 # After the first start, fix ownership to match the box user inside the container:
 BOX_UID=$(docker exec hive-mind id -u box)
-chown -R $BOX_UID:$BOX_UID /root/.hive-mind/claude /root/.hive-mind/codex /root/.hive-mind/gh
+chown -R $BOX_UID:$BOX_UID /root/.hive-mind/claude /root/.hive-mind/codex /root/.hive-mind/agents /root/.hive-mind/gh
 chown $BOX_UID:$BOX_UID /root/.hive-mind/claude.json
 
 # Important: mounted ~/.codex data overrides the image-baked Codex config.
@@ -246,6 +247,8 @@ docker exec -it hive-mind bash -lc 'codex mcp list && codex mcp add playwright -
 
 The Docker image itself now registers Playwright MCP for both Claude and Codex during build, and CI verifies those registrations in the built container. If `codex mcp list` is still empty in a running container, the usual cause is not the published image itself but a mounted `/home/box/.codex` directory from the host that replaces the image's default Codex configuration.
 
+Before `codex exec`, Hive Mind scans the issue and its comments for explicit required plugin selectors and Agent Skill names. It resolves skill providers from Codex's marketplace catalog and installs them under `/home/box/.codex/hive-mind/repositories/<owner>/<repo>`, so enablement persists across restarts without affecting other repositories. Required user skills placed in `/home/box/.agents/skills` are also propagated to Docker-isolated tasks. An unavailable requirement stops before the AI session with the exact capability and a catalog remediation command.
+
 See [docs/DOCKER.md](./docs/DOCKER.md) for advanced Docker usage.
 
 #### Stoping and removing docker container

package/README.ru.md

@@ -210,14 +210,15 @@ docker attach hive-mind
 # --- Persisting auth data across restarts ---
 
 # Extract auth data from a running (or stopped) container to the host:
-mkdir -p ~/.hive-mind
+mkdir -p ~/.hive-mind ~/.hive-mind/agents/skills
 docker cp hive-mind:/home/box/.claude ~/.hive-mind/claude
+docker cp hive-mind:/home/box/.codex ~/.hive-mind/codex
 docker cp hive-mind:/home/box/.claude.json ~/.hive-mind/claude.json
 docker cp hive-mind:/home/box/.config/gh ~/.hive-mind/gh
 
 # Fix ownership to match the box user inside the container:
 BOX_UID=$(docker exec hive-mind id -u box)
-chown -R $BOX_UID:$BOX_UID ~/.hive-mind/claude ~/.hive-mind/gh
+chown -R $BOX_UID:$BOX_UID ~/.hive-mind/claude ~/.hive-mind/codex ~/.hive-mind/agents ~/.hive-mind/gh
 chown $BOX_UID:$BOX_UID ~/.hive-mind/claude.json
 
 # On subsequent runs, mount the auth data to keep it between restarts:
@@ -225,11 +226,15 @@ docker run -dit \
   --name hive-mind \
   --restart unless-stopped \
   -v /root/.hive-mind/claude:/home/box/.claude \
+  -v /root/.hive-mind/codex:/home/box/.codex \
+  -v /root/.hive-mind/agents:/home/box/.agents \
   -v /root/.hive-mind/claude.json:/home/box/.claude.json \
   -v /root/.hive-mind/gh:/home/box/.config/gh \
   konard/hive-mind:latest
 ```
 
+Перед запуском `codex exec` Hive Mind ищет явные требования к плагинам и Agent Skills в issue и его комментариях. Нужный провайдер устанавливается в `/home/box/.codex/hive-mind/repositories/<owner>/<repo>`, поэтому конфигурация переживает перезапуски, но не влияет на другие репозитории. Пользовательские навыки из `/home/box/.agents/skills` также передаются в Docker-изолированные задачи; если capability недоступна, preflight до запуска ИИ-сессии сообщает точный идентификатор и команду исправления.
+
 **Преимущества Docker:**
 
 - ✅ Предварительно настроенная среда Ubuntu 24.04

package/README.zh.md

@@ -210,14 +210,15 @@ docker attach hive-mind
 # --- Persisting auth data across restarts ---
 
 # Extract auth data from a running (or stopped) container to the host:
-mkdir -p ~/.hive-mind
+mkdir -p ~/.hive-mind ~/.hive-mind/agents/skills
 docker cp hive-mind:/home/box/.claude ~/.hive-mind/claude
+docker cp hive-mind:/home/box/.codex ~/.hive-mind/codex
 docker cp hive-mind:/home/box/.claude.json ~/.hive-mind/claude.json
 docker cp hive-mind:/home/box/.config/gh ~/.hive-mind/gh
 
 # Fix ownership to match the box user inside the container:
 BOX_UID=$(docker exec hive-mind id -u box)
-chown -R $BOX_UID:$BOX_UID ~/.hive-mind/claude ~/.hive-mind/gh
+chown -R $BOX_UID:$BOX_UID ~/.hive-mind/claude ~/.hive-mind/codex ~/.hive-mind/agents ~/.hive-mind/gh
 chown $BOX_UID:$BOX_UID ~/.hive-mind/claude.json
 
 # On subsequent runs, mount the auth data to keep it between restarts:
@@ -225,11 +226,15 @@ docker run -dit \
   --name hive-mind \
   --restart unless-stopped \
   -v /root/.hive-mind/claude:/home/box/.claude \
+  -v /root/.hive-mind/codex:/home/box/.codex \
+  -v /root/.hive-mind/agents:/home/box/.agents \
   -v /root/.hive-mind/claude.json:/home/box/.claude.json \
   -v /root/.hive-mind/gh:/home/box/.config/gh \
   konard/hive-mind:latest
 ```
 
+在启动 `codex exec` 之前，Hive Mind 会扫描 issue 及其评论中的显式插件和 Agent Skill 要求。它将所需提供程序安装到 `/home/box/.codex/hive-mind/repositories/<owner>/<repo>`，因此配置可跨重启持久化，但不会影响其他仓库。`/home/box/.agents/skills` 中的用户技能也会传入 Docker 隔离任务；若能力不可用，预检会在 AI 会话启动前报告确切标识符和修复命令。
+
 **Docker 的优势：**
 
 - ✅ 预配置的 Ubuntu 24.04 环境

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.8.0",
+  "version": "2.8.2",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/codex-capability-preflight.lib.mjs

@@ -0,0 +1,274 @@
+/**
+ * Repository-scoped Codex capability preflight (issue #2074).
+ *
+ * Explicit plugin and Agent Skill requirements are discovered from the issue
+ * before `codex exec`. Required marketplace plugins are installed into a
+ * persistent CODEX_HOME scoped by repository, leaving the operator's global
+ * plugin enablement and the target repository untouched.
+ */
+
+import { execFile } from 'node:child_process';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { promisify } from 'node:util';
+
+const execFileAsync = promisify(execFile);
+const REQUIREMENT_WORDS = /\b(?:depend(?:s|ency)?|install|invoke|mandatory|must|need(?:ed|s)?|preflight|required?|requires|use)\b/i;
+const NEGATED_REQUIREMENT = /\b(?:does\s+not\s+require|not\s+required|optional)\b/i;
+const PLUGIN_SELECTOR = /\b([a-z0-9][a-z0-9-]*@[a-z0-9][a-z0-9-]*(?:-remote)?)\b/gi;
+const NAMESPACED_SKILL = /\b([a-z0-9][a-z0-9-]*:[a-z0-9][a-z0-9-]*)\b/gi;
+const EXPLICIT_BARE_SKILL = /\$([a-z0-9][a-z0-9-]*)|`([a-z0-9][a-z0-9-]*)`\s+(?:agent\s+)?skill/gi;
+
+export class CodexCapabilityPreflightError extends Error {
+  constructor(message, details = {}) {
+    super(message);
+    this.name = 'CodexCapabilityPreflightError';
+    this.details = details;
+  }
+}
+
+export function normalizePluginSelector(selector) {
+  return String(selector || '')
+    .trim()
+    .toLowerCase()
+    .replace(/@openai-curated-remote$/u, '@openai-curated');
+}
+
+export function detectRequiredCodexCapabilities(text) {
+  const plugins = new Set();
+  const skills = new Set();
+
+  for (const rawLine of String(text || '').split(/\r?\n/u)) {
+    const line = rawLine.trim();
+    if (!line || !REQUIREMENT_WORDS.test(line) || NEGATED_REQUIREMENT.test(line)) continue;
+
+    for (const match of line.matchAll(PLUGIN_SELECTOR)) plugins.add(normalizePluginSelector(match[1]));
+    for (const match of line.matchAll(NAMESPACED_SKILL)) skills.add(match[1].toLowerCase());
+
+    for (const match of line.matchAll(EXPLICIT_BARE_SKILL)) {
+      const name = (match[1] || match[2]).toLowerCase();
+      if (!['agent', 'codex', 'required', 'the'].includes(name)) skills.add(name);
+    }
+  }
+
+  return { plugins: [...plugins].sort(), skills: [...skills].sort() };
+}
+
+const sanitizePathSegment = value => String(value || '').replace(/[^a-zA-Z0-9._-]/gu, '_');
+
+export function buildCodexCapabilityStatePath({ baseCodexHome, owner, repo }) {
+  return path.join(baseCodexHome, 'hive-mind', 'repositories', sanitizePathSegment(owner), sanitizePathSegment(repo));
+}
+
+export function applyCodexCapabilityEnv(env, { codexHome, baseCodexHome } = {}) {
+  if (!codexHome) return env;
+  return { ...env, CODEX_HOME: codexHome, HIVE_MIND_PARENT_CODEX_HOME: baseCodexHome };
+}
+
+const defaultRunCommand = async ({ command, args, env = process.env, cwd }) => {
+  try {
+    const result = await execFileAsync(command, args, { cwd, env, encoding: 'utf8', maxBuffer: 20 * 1024 * 1024 });
+    return { stdout: result.stdout || '', stderr: result.stderr || '', code: 0 };
+  } catch (error) {
+    return { stdout: error.stdout || '', stderr: error.stderr || error.message, code: Number.isInteger(error.code) ? error.code : 1 };
+  }
+};
+
+const parseJsonCommand = (result, label) => {
+  if (result.code !== 0) throw new CodexCapabilityPreflightError(`${label} failed: ${String(result.stderr || result.stdout).trim()}`);
+  try {
+    return JSON.parse(result.stdout || 'null');
+  } catch (error) {
+    throw new CodexCapabilityPreflightError(`${label} returned invalid JSON: ${error.message}`);
+  }
+};
+
+const catalogEntries = catalog => [...(catalog?.installed || []), ...(catalog?.available || [])];
+
+const skillParts = skill => {
+  const separator = skill.indexOf(':');
+  return separator === -1 ? { namespace: null, name: skill } : { namespace: skill.slice(0, separator), name: skill.slice(separator + 1) };
+};
+
+const pluginProvidesSkill = async (plugin, skill) => {
+  const sourcePath = plugin?.source?.path;
+  if (!sourcePath) return false;
+  const { name } = skillParts(skill);
+  try {
+    await fs.access(path.join(sourcePath, 'skills', name, 'SKILL.md'));
+    return true;
+  } catch {
+    return false;
+  }
+};
+
+const skillExistsInDirectories = async (skill, skillDirectories) => {
+  const { name } = skillParts(skill);
+  for (const directory of skillDirectories || []) {
+    try {
+      await fs.access(path.join(directory, name, 'SKILL.md'));
+      return true;
+    } catch {
+      // Keep searching the remaining standard skill locations.
+    }
+  }
+  return false;
+};
+
+export async function resolveRequiredPlugins({ requirements, catalog, skillDirectories = [] }) {
+  const entries = catalogEntries(catalog);
+  const byId = new Map(entries.map(entry => [normalizePluginSelector(entry.pluginId), entry]));
+  const selected = new Map();
+  const missing = [];
+
+  for (const selector of requirements.plugins || []) {
+    const normalized = normalizePluginSelector(selector);
+    const entry = byId.get(normalized);
+    if (!entry) missing.push(normalized);
+    else selected.set(normalized, entry);
+  }
+
+  for (const skill of requirements.skills || []) {
+    const { namespace } = skillParts(skill);
+    if (!namespace && (await skillExistsInDirectories(skill, skillDirectories))) continue;
+    let candidates = entries;
+    if (namespace) candidates = entries.filter(entry => entry.name === namespace || String(entry.pluginId || '').startsWith(`${namespace}@`));
+
+    let provider = null;
+    for (const entry of candidates) {
+      if (await pluginProvidesSkill(entry, skill)) {
+        provider = entry;
+        break;
+      }
+    }
+    if (provider) selected.set(normalizePluginSelector(provider.pluginId), provider);
+    else missing.push(skill);
+  }
+
+  if (missing.length > 0) {
+    throw new CodexCapabilityPreflightError(`Required Codex capability unavailable: ${missing.join(', ')}. ` + `Run 'codex plugin list --available --json' in the operator container and configure a marketplace that provides it. ` + `Hive Mind installs discovered capabilities into repository-scoped CODEX_HOME state; it does not enable plugins globally.`, { missing });
+  }
+
+  return [...selected.keys()].sort();
+}
+
+const readIssueRequirementText = async ({ owner, repo, issueNumber, runCommand }) => {
+  const issueResult = await runCommand({ command: 'gh', args: ['api', `repos/${owner}/${repo}/issues/${issueNumber}`], env: process.env });
+  const issue = parseJsonCommand(issueResult, 'Codex capability issue discovery');
+  const commentsResult = await runCommand({ command: 'gh', args: ['api', `repos/${owner}/${repo}/issues/${issueNumber}/comments`, '--paginate'], env: process.env });
+  const comments = parseJsonCommand(commentsResult, 'Codex capability comment discovery');
+  return [issue?.title, issue?.body, ...(Array.isArray(comments) ? comments.map(comment => comment?.body) : [])].filter(Boolean).join('\n');
+};
+
+const replaceWithRelativeSymlink = async ({ source, target }) => {
+  try {
+    const current = await fs.readlink(target);
+    if (path.resolve(path.dirname(target), current) === path.resolve(source)) return;
+  } catch {
+    // Missing path or a non-symlink is reconciled below.
+  }
+  await fs.rm(target, { recursive: true, force: true });
+  await fs.mkdir(path.dirname(target), { recursive: true });
+  await fs.symlink(path.relative(path.dirname(target), source), target, 'dir');
+};
+
+const syncFileIfPresent = async (source, target) => {
+  try {
+    await fs.copyFile(source, target);
+    return true;
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      await fs.rm(target, { force: true });
+      return false;
+    }
+    throw error;
+  }
+};
+
+const readIfPresent = async filePath => {
+  try {
+    return await fs.readFile(filePath, 'utf8');
+  } catch (error) {
+    if (error.code === 'ENOENT') return '';
+    throw error;
+  }
+};
+
+// Runtime settings follow the operator config while plugin enablement remains
+// persistent and isolated to this repository.
+const syncScopedConfig = async ({ baseConfigPath, scopedConfigPath }) => {
+  const baseConfig = await readIfPresent(baseConfigPath);
+  const scopedConfig = await readIfPresent(scopedConfigPath);
+  const pluginPattern = /^\[plugins\."[^"]+"\][^\n]*(?:\n(?!\[)[^\n]*)*/gmu;
+  const pluginBlocks = scopedConfig.match(pluginPattern) || [];
+  const baseWithoutPlugins = baseConfig.replace(pluginPattern, '').trimEnd();
+  const nextConfig = [baseWithoutPlugins, ...pluginBlocks.map(block => block.trim())].filter(Boolean).join('\n\n');
+  if (nextConfig) await fs.writeFile(scopedConfigPath, `${nextConfig}\n`);
+};
+
+const prepareScopedCodexHome = async ({ baseCodexHome, codexHome }) => {
+  await fs.mkdir(codexHome, { recursive: true });
+  await syncScopedConfig({ baseConfigPath: path.join(baseCodexHome, 'config.toml'), scopedConfigPath: path.join(codexHome, 'config.toml') });
+  await syncFileIfPresent(path.join(baseCodexHome, 'auth.json'), path.join(codexHome, 'auth.json'));
+  await syncFileIfPresent(path.join(baseCodexHome, 'installation_id'), path.join(codexHome, 'installation_id'));
+
+  const marketplaceSource = path.join(baseCodexHome, '.tmp', 'plugins');
+  const marketplaceSha = path.join(baseCodexHome, '.tmp', 'plugins.sha');
+  try {
+    await fs.access(marketplaceSource);
+    await fs.access(marketplaceSha);
+    await replaceWithRelativeSymlink({ source: marketplaceSource, target: path.join(codexHome, '.tmp', 'plugins') });
+    await fs.copyFile(marketplaceSha, path.join(codexHome, '.tmp', 'plugins.sha'));
+  } catch {
+    throw new CodexCapabilityPreflightError(`The operator Codex marketplace snapshot is unavailable at ${marketplaceSource}. ` + `Run 'codex plugin list --available --json' once in the operator container, then retry.`);
+  }
+};
+
+export async function runCodexCapabilityPreflight({ owner, repo, issueNumber, projectDir, baseCodexHome = process.env.HIVE_MIND_PARENT_CODEX_HOME || process.env.CODEX_HOME || path.join(os.homedir(), '.codex'), codexPath = 'codex', runCommand = defaultRunCommand, log = async () => {} } = {}) {
+  if (!owner || !repo || !issueNumber) return { required: false, plugins: [], codexHome: null };
+
+  // `executeToolWithBun` uses a shell expression for execution. Preflight uses
+  // execFile and therefore selects the installed Codex binary directly.
+  const command = /\s/u.test(codexPath) ? 'codex' : codexPath;
+  const requirementText = await readIssueRequirementText({ owner, repo, issueNumber, runCommand });
+  const requirements = detectRequiredCodexCapabilities(requirementText);
+  if (requirements.plugins.length === 0 && requirements.skills.length === 0) return { required: false, plugins: [], codexHome: null };
+
+  await log(`🔌 Codex capability preflight: detected ${requirements.plugins.length} plugin and ${requirements.skills.length} skill requirement(s)`);
+  const baseEnv = { ...process.env, CODEX_HOME: baseCodexHome, HIVE_MIND_PARENT_CODEX_HOME: baseCodexHome };
+  const baseCatalogResult = await runCommand({ command, args: ['plugin', 'list', '--available', '--json'], env: baseEnv });
+  const baseCatalog = parseJsonCommand(baseCatalogResult, 'Codex plugin catalog discovery');
+  const skillDirectories = [path.join(os.homedir(), '.agents', 'skills'), projectDir && path.join(projectDir, '.agents', 'skills')].filter(Boolean);
+  const plugins = await resolveRequiredPlugins({ requirements, catalog: baseCatalog, skillDirectories });
+  if (plugins.length === 0) {
+    await log('   ✅ Required Agent Skills are already available from standard skill directories');
+    return { required: true, plugins, skills: requirements.skills, codexHome: null, baseCodexHome };
+  }
+
+  const codexHome = buildCodexCapabilityStatePath({ baseCodexHome, owner, repo });
+  await prepareScopedCodexHome({ baseCodexHome, codexHome });
+  const scopedEnv = { ...process.env, CODEX_HOME: codexHome, HIVE_MIND_PARENT_CODEX_HOME: baseCodexHome };
+
+  const scopedCatalogResult = await runCommand({ command, args: ['plugin', 'list', '--json'], env: scopedEnv });
+  const scopedCatalog = parseJsonCommand(scopedCatalogResult, 'Repository-scoped Codex plugin discovery');
+  const installed = new Set((scopedCatalog.installed || []).filter(plugin => plugin.installed && plugin.enabled).map(plugin => normalizePluginSelector(plugin.pluginId)));
+
+  for (const plugin of plugins) {
+    if (installed.has(plugin)) continue;
+    const installResult = await runCommand({ command, args: ['plugin', 'add', plugin, '--json'], env: scopedEnv });
+    parseJsonCommand(installResult, `Installing required Codex plugin ${plugin}`);
+    await log(`   ✅ Provisioned ${plugin} in repository-scoped Codex state`);
+  }
+
+  const verifyResult = await runCommand({ command, args: ['plugin', 'list', '--json'], env: scopedEnv });
+  const verifiedCatalog = parseJsonCommand(verifyResult, 'Codex capability verification');
+  const verified = new Set((verifiedCatalog.installed || []).filter(plugin => plugin.installed && plugin.enabled).map(plugin => normalizePluginSelector(plugin.pluginId)));
+  const unverified = plugins.filter(plugin => !verified.has(plugin));
+  if (unverified.length > 0) throw new CodexCapabilityPreflightError(`Codex capability installation did not verify successfully: ${unverified.join(', ')}`, { missing: unverified });
+
+  await log(`   Codex capability state: ${codexHome}`, { verbose: true });
+  return { required: true, plugins, skills: requirements.skills, codexHome, baseCodexHome };
+}
+
+export default { applyCodexCapabilityEnv, detectRequiredCodexCapabilities, runCodexCapabilityPreflight };

package/src/codex.lib.mjs

@@ -35,6 +35,7 @@ import { classifyRetryableError, prepareRetryAfterError, waitWithCountdown } fro
 import { parseSubSessionSize, buildCodexSubSessionSizeConfigArgs, buildCodexDisable1mContextConfigArgs } from './sub-session-size.lib.mjs'; // Issue #1706
 import { getCumulativeContextInputTokens } from './context-fill.lib.mjs';
 import { deployHandoffSkill } from './handoff-skill.lib.mjs'; // Issue #1877
+import { applyCodexCapabilityEnv, runCodexCapabilityPreflight } from './codex-capability-preflight.lib.mjs'; // Issue #2074
 import { createPullRequestBaseBranchCommandIntervention } from './solve.pr-base-command-intervention.lib.mjs';
 import Decimal from 'decimal.js-light';
 
@@ -744,6 +745,7 @@ export const executeCodex = async params => {
   // it natively from .agents/skills/handoff/SKILL.md (no-op unless --use-handoff).
   await deployHandoffSkill({ tempDir, argv, log, $ });
 
+  const capabilityPreflight = await runCodexCapabilityPreflight({ owner, repo, issueNumber, projectDir: tempDir, codexPath, log });
   // Execute the Codex command
   return await executeCodexCommand({
     tempDir,
@@ -761,11 +763,12 @@ export const executeCodex = async params => {
     owner,
     repo,
     prNumber,
+    capabilityPreflight,
   });
 };
 
 export const executeCodexCommand = async params => {
-  const { tempDir, branchName, prompt, systemPrompt, argv, log, formatAligned, getResourceSnapshot, forkedRepo, feedbackLines, codexPath, $, owner, repo, prNumber, calculatePricing = calculateCodexPricing, waitForRetryDelay = waitWithCountdown } = params;
+  const { tempDir, branchName, prompt, systemPrompt, argv, log, formatAligned, getResourceSnapshot, forkedRepo, feedbackLines, codexPath, $, owner, repo, prNumber, capabilityPreflight, calculatePricing = calculateCodexPricing, waitForRetryDelay = waitWithCountdown } = params;
 
   const shellQuote = value => `"${String(value).replaceAll('\\', '\\\\').replaceAll('"', '\\"')}"`;
   const expectedBaseBranch = String(argv?.baseBranch || '').trim();
@@ -806,7 +809,10 @@ export const executeCodexCommand = async params => {
     const mappedModel = mapModelToId(argv.model);
     const { reasoningEffort, source: reasoningEffortSource, rolloutTokenBudget } = resolveCodexReasoningEffort(argv);
     const isResumeMode = !!argv.resume;
-    const codexEnv = getCodexExecEnv(argv.verbose);
+    const codexEnv = applyCodexCapabilityEnv(getCodexExecEnv(argv.verbose), {
+      codexHome: capabilityPreflight?.codexHome,
+      baseCodexHome: capabilityPreflight?.baseCodexHome,
+    });
 
     // For Codex, we combine system and user prompts into a single message
     // Codex doesn't have separate system prompt support in CLI mode

package/src/isolation-runner.lib.mjs

@@ -206,6 +206,10 @@ export function getDockerIsolationAuthMounts({ tool = 'claude', env = process.en
 
   if (normalizedTool === 'codex') {
     maybeAddMount(mounts, path.join(homeDir, '.codex'), path.join(DOCKER_CONTAINER_HOME, '.codex'), existsSync);
+    // Issue #2074: Codex also discovers persistent user Agent Skills from
+    // ~/.agents/skills. Propagate that standard location alongside .codex so
+    // direct and Docker-isolated solver sessions expose the same capabilities.
+    maybeAddMount(mounts, path.join(homeDir, '.agents'), path.join(DOCKER_CONTAINER_HOME, '.agents'), existsSync);
   } else if (normalizedTool === 'claude') {
     maybeAddMount(mounts, path.join(homeDir, '.claude'), path.join(DOCKER_CONTAINER_HOME, '.claude'), existsSync);
     maybeAddMount(mounts, path.join(homeDir, '.claude.json'), path.join(DOCKER_CONTAINER_HOME, '.claude.json'), existsSync);

package/src/solve.pr-base-guard.lib.mjs

@@ -204,6 +204,40 @@ export async function getPullRequestBaseBranch({ owner, repo, prNumber, $, log }
   return baseBranch;
 }
 
+async function getPullRequestBranchRange({ owner, repo, prNumber, $, log }) {
+  if (typeof $ !== 'function') {
+    throw new Error('Cannot verify pull request branches without a command runner');
+  }
+
+  const result = await ghWithRateLimitRetry(() => $`gh pr view ${prNumber} --repo ${owner}/${repo} --json baseRefName,headRefName`, {
+    label: 'gh pr view baseRefName,headRefName',
+    log,
+  });
+  if (result.code !== 0) {
+    const details = commandOutput(result) || 'unknown error';
+    throw new Error(`Could not verify pull request branches for #${prNumber}: ${details}`);
+  }
+
+  let branchRange;
+  try {
+    branchRange = JSON.parse(String(result.stdout || '').trim());
+  } catch {
+    throw new Error(`Could not verify pull request branches for #${prNumber}: gh returned invalid JSON`);
+  }
+
+  const baseBranch = normalizeBranchName(branchRange?.baseRefName);
+  const headBranch = normalizeBranchName(branchRange?.headRefName);
+  if (!baseBranch || !headBranch) {
+    throw new Error(`Could not verify pull request branches for #${prNumber}: gh returned an empty baseRefName or headRefName`);
+  }
+
+  return { baseBranch, headBranch };
+}
+
+function buildBaseEqualsHeadBranchMessage({ prNumber, expectedBaseBranch, currentBaseBranch }) {
+  return `Invalid --base-branch '${expectedBaseBranch}' for PR #${prNumber}: it is the pull request's head branch (the source/work branch), so it cannot also be the base branch (the target branch). The pull request currently targets '${currentBaseBranch}'. Rerun with --base-branch ${currentBaseBranch} to preserve that target, choose another target branch, or omit --base-branch to keep the existing pull request target. Manual intervention is required; no pull request changes were made.`;
+}
+
 export async function ensurePullRequestBaseBranch({ owner, repo, prNumber, argv = {}, log = async () => {}, formatAligned = fallbackFormatAligned, $, onMismatch = 'restore', operation = 'verify' }) {
   const expectedBaseBranch = getExpectedPullRequestBaseBranch({ argv });
   if (!expectedBaseBranch) {
@@ -214,7 +248,7 @@ export async function ensurePullRequestBaseBranch({ owner, repo, prNumber, argv
     return { checked: false, restored: false, reason: 'missing_pull_request_context' };
   }
 
-  const currentBaseBranch = await getPullRequestBaseBranch({ owner, repo, prNumber, $, log });
+  const { baseBranch: currentBaseBranch, headBranch } = await getPullRequestBranchRange({ owner, repo, prNumber, $, log });
   if (currentBaseBranch === expectedBaseBranch) {
     await log(formatAligned('🎯', 'Base branch locked:', `${expectedBaseBranch} (verified)`, 2), { verbose: true });
     return {
@@ -227,6 +261,16 @@ export async function ensurePullRequestBaseBranch({ owner, repo, prNumber, argv
 
   await log(formatAligned('⚠️', 'Base branch changed:', `PR #${prNumber} targets ${currentBaseBranch}, expected ${expectedBaseBranch}`, 2), { level: 'warning' });
 
+  if (headBranch === expectedBaseBranch) {
+    throw new Error(
+      buildBaseEqualsHeadBranchMessage({
+        prNumber,
+        expectedBaseBranch,
+        currentBaseBranch,
+      })
+    );
+  }
+
   if (onMismatch === 'throw' || onMismatch === 'fail') {
     throw new Error(
       buildPullRequestBaseBranchMismatchMessage({
@@ -249,7 +293,7 @@ export async function ensurePullRequestBaseBranch({ owner, repo, prNumber, argv
     throw new Error(`Could not restore pull request #${prNumber} base branch to ${expectedBaseBranch}: ${details}`);
   }
 
-  const restoredBaseBranch = await getPullRequestBaseBranch({ owner, repo, prNumber, $, log });
+  const { baseBranch: restoredBaseBranch } = await getPullRequestBranchRange({ owner, repo, prNumber, $, log });
   if (restoredBaseBranch !== expectedBaseBranch) {
     throw new Error(`Pull request #${prNumber} still targets ${restoredBaseBranch} after attempting to restore ${expectedBaseBranch}`);
   }