@parall/codex-agent 1.25.0 → 1.26.0

package/dist/config.d.ts

@@ -11,14 +11,14 @@ export type CodexAgentConfig = {
     model?: string;
     reasoningEffort?: string;
     /**
-     * Only set when the user explicitly specified `PRLL_CODEX_SANDBOX`.
-     * When undefined, the bridge deliberately does NOT pass `sandbox` on
-     * `thread/{start,resume}` so codex reads whatever the user configured
-     * in `~/.codex/config.toml` (`sandbox_mode`). This matches the self-
-     * hosted philosophy: user's codex setup is authoritative; bridge only
-     * overrides when the user asks it to.
+     * Sandbox mode passed to codex on `thread/{start,resume}`. Defaults to
+     * `danger-full-access` — same as the hosted container — because codex's
+     * inner bubblewrap sandbox requires unprivileged user namespaces that
+     * most environments lack, and the agent needs unrestricted shell access
+     * (e.g. `parall messages send`). Users can still override via
+     * `PRLL_CODEX_SANDBOX` env var.
      */
-    sandbox?: string;
+    sandbox: string;
     /**
      * Approval policy is forced to `"never"` by default (not configurable
      * via config.toml override): Parall's HITL contract routes approvals
@@ -51,5 +51,6 @@ export declare function normalizeApprovalPolicy(value: string): string;
 export declare function resolveWsUrl(apiUrl: string, explicitWsUrl?: string, swimlaneName?: string): string;
 export declare function buildCodexRuntimeKey(agentUserId: string): string;
 export declare function sessionStateFilePathForRuntime(stateDir: string, runtimeKey: string): string;
+export declare function contextFilePathForSession(stateDir: string, sessionKey: string): string;
 export declare function stepIdFilePathForSession(stateDir: string, sessionKey: string): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAcF,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAwC9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlG;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG3F;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGrF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAcF,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAwC9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlG;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG3F;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGtF;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGrF"}

package/dist/config.js

@@ -41,7 +41,7 @@ export function resolveCodexAgentConfig(env = process.env) {
         workspaceDir,
         model: env.PRLL_CODEX_MODEL?.trim() || undefined,
         reasoningEffort: env.PRLL_CODEX_REASONING_EFFORT?.trim() || undefined,
-        sandbox: env.PRLL_CODEX_SANDBOX?.trim() || undefined,
+        sandbox: env.PRLL_CODEX_SANDBOX?.trim() || "danger-full-access",
         approvalPolicy: env.PRLL_CODEX_APPROVAL?.trim() || "never",
         runtimeKey: env.PRLL_CODEX_RUNTIME_KEY?.trim() || undefined,
     };
@@ -101,6 +101,10 @@ export function sessionStateFilePathForRuntime(stateDir, runtimeKey) {
     const fileName = Buffer.from(runtimeKey).toString("base64url");
     return path.join(stateDir, "threads", `${fileName}.json`);
 }
+export function contextFilePathForSession(stateDir, sessionKey) {
+    const fileName = Buffer.from(sessionKey).toString("base64url");
+    return path.join(stateDir, "dispatch-context", `${fileName}.json`);
+}
 export function stepIdFilePathForSession(stateDir, sessionKey) {
     const fileName = Buffer.from(sessionKey).toString("base64url");
     return path.join(stateDir, "step-ids", `${fileName}.txt`);

package/dist/dispatch.d.ts

@@ -4,6 +4,7 @@ import type { CodexSessionManager } from "./session-manager.js";
 type CodexAppServerAdapterOptions = Pick<CodexAgentConfig, "approvalPolicy" | "codexBin" | "codexHome" | "model" | "reasoningEffort" | "sandbox" | "workspaceDir"> & {
     sessionManager: CodexSessionManager;
     log?: GatewayLogger;
+    contextFilePath?: string;
 };
 /**
  * Bridge driver backed by `codex app-server --listen stdio://`.
@@ -38,6 +39,10 @@ export declare class CodexAppServerAdapter implements DispatchAdapter {
      */
     private setActiveTurn;
     constructor(opts: CodexAppServerAdapterOptions);
+    updateConfig(config: {
+        model?: string | null;
+        reasoningEffort?: string | null;
+    }): void;
     dispatch({ event, bodyForAgent, sessionKey, context }: DispatchOpts): AsyncIterable<RuntimeEvent>;
     forkSession({ sessionKey: parentSessionKey }: ForkOpts): Promise<ForkSessionHandle | null>;
     cleanupFork({ fork }: CleanupForkOpts): void;

package/dist/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,aAAa,EACb,YAAY,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,KAAK,4BAA4B,GAAG,IAAI,CACtC,gBAAgB,EACd,gBAAgB,GAChB,UAAU,GACV,WAAW,GACX,OAAO,GACP,iBAAiB,GACjB,SAAS,GACT,cAAc,CACjB,GAAG;IACF,cAAc,EAAE,mBAAmB,CAAC;IACpC,GAAG,CAAC,EAAE,aAAa,CAAC;CACrB,CAAC;AAOF;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IA6B/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IA5BjC,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,IAAI,CAA+C;IAC3D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;gBAYQ,IAAI,EAAE,4BAA4B;IAExD,QAAQ,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;IAgLlG,WAAW,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuBhG,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,eAAe;IAIrC,OAAO,CAAC,cAAc;IAKhB,IAAI;YAaI,aAAa;YAcb,OAAO;IA2DrB,OAAO,CAAC,qBAAqB;YAiCf,UAAU;IAgDxB,OAAO,CAAC,iBAAiB;CA2B1B"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,aAAa,EACb,YAAY,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,KAAK,4BAA4B,GAAG,IAAI,CACtC,gBAAgB,EACd,gBAAgB,GAChB,UAAU,GACV,WAAW,GACX,OAAO,GACP,iBAAiB,GACjB,SAAS,GACT,cAAc,CACjB,GAAG;IACF,cAAc,EAAE,mBAAmB,CAAC;IACpC,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAOF;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IA6B/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IA5BjC,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,IAAI,CAA+C;IAC3D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;gBAYQ,IAAI,EAAE,4BAA4B;IAE/D,YAAY,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAK/E,QAAQ,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;IAgLlG,WAAW,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuBhG,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,eAAe;IAIrC,OAAO,CAAC,cAAc;IAKhB,IAAI;YAaI,aAAa;YAcb,OAAO;IA8DrB,OAAO,CAAC,qBAAqB;YAiCf,UAAU;IAwCxB,OAAO,CAAC,iBAAiB;CA2B1B"}

package/dist/dispatch.js

@@ -49,6 +49,12 @@ export class CodexAppServerAdapter {
     constructor(opts) {
         this.opts = opts;
     }
+    updateConfig(config) {
+        if (config.model !== undefined)
+            this.opts.model = config.model ?? undefined;
+        if (config.reasoningEffort !== undefined)
+            this.opts.reasoningEffort = config.reasoningEffort ?? undefined;
+    }
     async *dispatch({ event, bodyForAgent, sessionKey, context }) {
         await this.ensureStarted(context.log);
         // After ensureStarted resolves the subprocess could still die before we
@@ -304,6 +310,9 @@ export class CodexAppServerAdapter {
             FORCE_COLOR: "0",
             NO_COLOR: "1",
         };
+        if (this.opts.contextFilePath) {
+            env.PRLL_CONTEXT_FILE = this.opts.contextFilePath;
+        }
         const args = ["app-server", "--listen", "stdio://"];
         (log ?? this.opts.log)?.info?.(`codex-agent: spawning ${this.opts.codexBin} ${args.join(" ")}`);
         const proc = spawn(this.opts.codexBin, args, {
@@ -382,15 +391,7 @@ export class CodexAppServerAdapter {
         const commonParams = {
             approvalPolicy: normalizeApprovalPolicy(this.opts.approvalPolicy),
         };
-        // Only override sandbox when the user explicitly set PRLL_CODEX_SANDBOX.
-        // Otherwise let codex read `sandbox_mode` from ~/.codex/config.toml — the
-        // user's own configuration is authoritative for a self-hosted bridge,
-        // and codex 0.120.0's workspace-write mode has a write_stdin bug that
-        // our previous `workspace-write` default tripped for users whose config
-        // had danger-full-access.
-        if (this.opts.sandbox) {
-            commonParams.sandbox = normalizeSandbox(this.opts.sandbox);
-        }
+        commonParams.sandbox = normalizeSandbox(this.opts.sandbox);
         if (this.opts.model)
             commonParams.model = this.opts.model;
         if (this.opts.reasoningEffort) {

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import * as os from "node:os";
-import { ParallAgentGateway, parseShutdownDeadlineMs } from "@parall/agent-core";
+import { ParallAgentGateway, createPlatformConfigManager, isPlatformManagedProfile, parseShutdownDeadlineMs } from "@parall/agent-core";
 import { ApiError, ParallClient, ParallWs } from "@parall/sdk";
-import { buildCodexRuntimeKey, resolveCodexAgentConfig, resolveWsUrl, sessionStateFilePathForRuntime, stepIdFilePathForSession, } from "./config.js";
+import { buildCodexRuntimeKey, contextFilePathForSession, resolveCodexAgentConfig, resolveWsUrl, sessionStateFilePathForRuntime, stepIdFilePathForSession, } from "./config.js";
 import { CodexAppServerAdapter } from "./dispatch.js";
 import { CodexSessionManager } from "./session-manager.js";
 import { ensureCodexWorkspace } from "./workspace.js";
@@ -41,6 +41,7 @@ async function main() {
         description: me.agent_profile?.description ?? undefined,
     });
     const runtimeKey = config.runtimeKey || buildCodexRuntimeKey(agentUserId);
+    const mainContextFilePath = contextFilePathForSession(config.stateDir, runtimeKey);
     const sessionStateFilePath = sessionStateFilePathForRuntime(config.stateDir, runtimeKey);
     const sessionManager = new CodexSessionManager(runtimeKey, sessionStateFilePath, log);
     const resolvedWsUrl = resolveWsUrl(config.apiUrl, config.wsUrl, config.swimlaneName);
@@ -48,16 +49,26 @@ async function main() {
         getTicket: () => client.getWsTicket(),
         wsUrl: resolvedWsUrl,
     });
+    const configMgr = createPlatformConfigManager({ client, stateDir: config.stateDir, runtimeType: "codex", log });
+    const platformDefaults = await configMgr.fetch();
+    let platformManaged = isPlatformManagedProfile(me.agent_profile);
+    const resolvedModel = platformManaged ? (platformDefaults.model ?? config.model) : config.model;
+    const resolvedEffort = platformManaged ? (platformDefaults.thinkingEffort ?? config.reasoningEffort) : config.reasoningEffort;
+    if (platformDefaults.model)
+        log.info(`platform config: model=${platformDefaults.model} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
+    if (platformDefaults.thinkingEffort)
+        log.info(`platform config: reasoning_effort=${platformDefaults.thinkingEffort} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
     const adapter = new CodexAppServerAdapter({
         codexBin: config.codexBin,
         codexHome: config.codexHome,
         workspaceDir: config.workspaceDir,
-        model: config.model,
-        reasoningEffort: config.reasoningEffort,
+        model: resolvedModel,
+        reasoningEffort: resolvedEffort,
         sandbox: config.sandbox,
         approvalPolicy: config.approvalPolicy,
         sessionManager,
         log,
+        contextFilePath: mainContextFilePath,
     });
     const gateway = new ParallAgentGateway({
         accountId: agentUserId,
@@ -82,7 +93,26 @@ async function main() {
         dispatchAdapter: adapter,
         log,
         shutdownDeadlineMs: parseShutdownDeadlineMs(process.env.PRLL_SHUTDOWN_DEADLINE_MS),
+        contextFilePathForSession: (sessionKey) => contextFilePathForSession(config.stateDir, sessionKey),
         stepIdFilePathForSession: (sessionKey) => stepIdFilePathForSession(config.stateDir, sessionKey),
+        onConfigUpdate: async () => {
+            const refreshed = await getAgentMeWithLegacyFallback(client, config.orgId);
+            platformManaged = isPlatformManagedProfile(refreshed.agent_profile);
+            const updated = await configMgr.fetch();
+            adapter.updateConfig({
+                model: platformManaged ? (updated.model ?? config.model) : (config.model ?? null),
+                reasoningEffort: platformManaged ? (updated.thinkingEffort ?? config.reasoningEffort) : (config.reasoningEffort ?? null),
+            });
+        },
+        onSessionReady: async () => {
+            const refreshed = await getAgentMeWithLegacyFallback(client, config.orgId);
+            platformManaged = isPlatformManagedProfile(refreshed.agent_profile);
+            const updated = await configMgr.fetch();
+            adapter.updateConfig({
+                model: platformManaged ? (updated.model ?? config.model) : (config.model ?? null),
+                reasoningEffort: platformManaged ? (updated.thinkingEffort ?? config.reasoningEffort) : (config.reasoningEffort ?? null),
+            });
+        },
     });
     const abortController = new AbortController();
     const abort = () => abortController.abort();

package/dist/workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EACrC,aAAa,CAAC,EAAE,aAAa,QA+B9B"}
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EACrC,aAAa,CAAC,EAAE,aAAa,GAC5B,IAAI,CAqBN"}

package/dist/workspace.js

@@ -1,32 +1,21 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { BRIDGE_WORKSPACE_INSTRUCTIONS, PRLL_BEHAVIOR, PRLL_REFERENCE_GUIDE, buildIdentity, } from "@parall/agent-core";
+import { BRIDGE_WORKSPACE_INSTRUCTIONS, PRLL_BEHAVIOR, PRLL_REFERENCE_GUIDE, buildIdentity, buildSkillReferences, writeSkillFiles, } from "@parall/agent-core";
 export function ensureCodexWorkspace(workspaceDir, log, agentIdentity) {
-    const AGENTS_MD = [
+    const systemPrompt = [
         buildIdentity(agentIdentity),
         BRIDGE_WORKSPACE_INSTRUCTIONS,
         PRLL_BEHAVIOR,
         PRLL_REFERENCE_GUIDE,
+        buildSkillReferences(workspaceDir),
     ].join("\n\n");
     fs.mkdirSync(workspaceDir, { recursive: true });
-    // AGENTS.md is bridge-managed: always overwrite so the workspace picks up
-    // updated guardrails / command templates on upgrade. Operators must not
-    // hand-edit this file — workspace customisations should go elsewhere in
-    // the Codex home dir. Surface a warning when we replace divergent content
-    // so an operator who did edit it locally sees a signal instead of silently
-    // losing changes. Mirrors the Claude bridge behaviour.
-    const agentsMdPath = path.join(workspaceDir, "AGENTS.md");
-    if (log) {
-        try {
-            const existing = fs.readFileSync(agentsMdPath, "utf8");
-            if (existing !== AGENTS_MD) {
-                log.warn(`codex-agent: overwriting divergent ${agentsMdPath} with bridge-managed template ` +
-                    `(local edits to AGENTS.md are not preserved — customize other files in the workspace instead)`);
-            }
-        }
-        catch {
-            // file missing or unreadable — first-boot case, no warning needed
-        }
-    }
-    fs.writeFileSync(agentsMdPath, AGENTS_MD, "utf8");
+    const parallDir = path.join(workspaceDir, ".parall");
+    fs.mkdirSync(parallDir, { recursive: true });
+    fs.writeFileSync(path.join(parallDir, "system-prompt.md"), systemPrompt, "utf8");
+    writeSkillFiles(path.join(parallDir, "skills"));
+    const codexConfigDir = path.join(workspaceDir, ".codex");
+    fs.mkdirSync(codexConfigDir, { recursive: true });
+    const toml = `developer_instructions = """\n${systemPrompt.replace(/\\/g, "\\\\").replace(/"""/g, '\\"""')}\n"""\n`;
+    fs.writeFileSync(path.join(codexConfigDir, "config.toml"), toml, "utf8");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/codex-agent",
-  "version": "1.25.0",
+  "version": "1.26.0",
   "description": "Codex CLI bridge runtime for self-hosted Parall agents",
   "license": "MIT",
   "repository": {
@@ -25,9 +25,9 @@
     "src"
   ],
   "dependencies": {
-    "@parall/agent-core": "1.25.0",
-    "@parall/cli": "1.25.0",
-    "@parall/sdk": "1.25.0"
+    "@parall/agent-core": "1.26.0",
+    "@parall/cli": "1.26.0",
+    "@parall/sdk": "1.26.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/src/config.ts

@@ -14,14 +14,14 @@ export type CodexAgentConfig = {
   model?: string;
   reasoningEffort?: string;
   /**
-   * Only set when the user explicitly specified `PRLL_CODEX_SANDBOX`.
-   * When undefined, the bridge deliberately does NOT pass `sandbox` on
-   * `thread/{start,resume}` so codex reads whatever the user configured
-   * in `~/.codex/config.toml` (`sandbox_mode`). This matches the self-
-   * hosted philosophy: user's codex setup is authoritative; bridge only
-   * overrides when the user asks it to.
+   * Sandbox mode passed to codex on `thread/{start,resume}`. Defaults to
+   * `danger-full-access` — same as the hosted container — because codex's
+   * inner bubblewrap sandbox requires unprivileged user namespaces that
+   * most environments lack, and the agent needs unrestricted shell access
+   * (e.g. `parall messages send`). Users can still override via
+   * `PRLL_CODEX_SANDBOX` env var.
    */
-  sandbox?: string;
+  sandbox: string;
   /**
    * Approval policy is forced to `"never"` by default (not configurable
    * via config.toml override): Parall's HITL contract routes approvals
@@ -80,7 +80,7 @@ export function resolveCodexAgentConfig(env: NodeJS.ProcessEnv = process.env): C
     workspaceDir,
     model: env.PRLL_CODEX_MODEL?.trim() || undefined,
     reasoningEffort: env.PRLL_CODEX_REASONING_EFFORT?.trim() || undefined,
-    sandbox: env.PRLL_CODEX_SANDBOX?.trim() || undefined,
+    sandbox: env.PRLL_CODEX_SANDBOX?.trim() || "danger-full-access",
     approvalPolicy: env.PRLL_CODEX_APPROVAL?.trim() || "never",
     runtimeKey: env.PRLL_CODEX_RUNTIME_KEY?.trim() || undefined,
   };
@@ -145,6 +145,11 @@ export function sessionStateFilePathForRuntime(stateDir: string, runtimeKey: str
   return path.join(stateDir, "threads", `${fileName}.json`);
 }
 
+export function contextFilePathForSession(stateDir: string, sessionKey: string): string {
+  const fileName = Buffer.from(sessionKey).toString("base64url");
+  return path.join(stateDir, "dispatch-context", `${fileName}.json`);
+}
+
 export function stepIdFilePathForSession(stateDir: string, sessionKey: string): string {
   const fileName = Buffer.from(sessionKey).toString("base64url");
   return path.join(stateDir, "step-ids", `${fileName}.txt`);

package/src/dispatch.ts

@@ -35,6 +35,7 @@ type CodexAppServerAdapterOptions = Pick<
 > & {
   sessionManager: CodexSessionManager;
   log?: GatewayLogger;
+  contextFilePath?: string;
 };
 
 type TurnEventEnvelope =
@@ -87,6 +88,11 @@ export class CodexAppServerAdapter implements DispatchAdapter {
 
   constructor(private readonly opts: CodexAppServerAdapterOptions) {}
 
+  updateConfig(config: { model?: string | null; reasoningEffort?: string | null }): void {
+    if (config.model !== undefined) this.opts.model = config.model ?? undefined;
+    if (config.reasoningEffort !== undefined) this.opts.reasoningEffort = config.reasoningEffort ?? undefined;
+  }
+
   async *dispatch({ event, bodyForAgent, sessionKey, context }: DispatchOpts): AsyncIterable<RuntimeEvent> {
     await this.ensureStarted(context.log);
     // After ensureStarted resolves the subprocess could still die before we
@@ -334,12 +340,15 @@ export class CodexAppServerAdapter implements DispatchAdapter {
     // (git/ssh/npm/etc.). Earlier versions also rewrote HOME, which broke
     // tooling for users who set a custom CODEX_HOME pointing somewhere
     // other than their shell home.
-    const env = {
+    const env: Record<string, string | undefined> = {
       ...process.env,
       CODEX_HOME: this.opts.codexHome,
       FORCE_COLOR: "0",
       NO_COLOR: "1",
     };
+    if (this.opts.contextFilePath) {
+      env.PRLL_CONTEXT_FILE = this.opts.contextFilePath;
+    }
     const args = ["app-server", "--listen", "stdio://"];
     (log ?? this.opts.log)?.info?.(`codex-agent: spawning ${this.opts.codexBin} ${args.join(" ")}`);
     const proc = spawn(this.opts.codexBin, args, {
@@ -430,15 +439,7 @@ export class CodexAppServerAdapter implements DispatchAdapter {
     const commonParams: Record<string, unknown> = {
       approvalPolicy: normalizeApprovalPolicy(this.opts.approvalPolicy),
     };
-    // Only override sandbox when the user explicitly set PRLL_CODEX_SANDBOX.
-    // Otherwise let codex read `sandbox_mode` from ~/.codex/config.toml — the
-    // user's own configuration is authoritative for a self-hosted bridge,
-    // and codex 0.120.0's workspace-write mode has a write_stdin bug that
-    // our previous `workspace-write` default tripped for users whose config
-    // had danger-full-access.
-    if (this.opts.sandbox) {
-      commonParams.sandbox = normalizeSandbox(this.opts.sandbox);
-    }
+    commonParams.sandbox = normalizeSandbox(this.opts.sandbox);
     if (this.opts.model) commonParams.model = this.opts.model;
     if (this.opts.reasoningEffort) {
       // The app-server JSON-RPC surface uses camelCase for overrides —

package/src/index.ts

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 
 import * as os from "node:os";
-import { ParallAgentGateway, parseShutdownDeadlineMs } from "@parall/agent-core";
+import { ParallAgentGateway, createPlatformConfigManager, isPlatformManagedProfile, parseShutdownDeadlineMs } from "@parall/agent-core";
 import { ApiError, ParallClient, ParallWs } from "@parall/sdk";
 import {
   buildCodexRuntimeKey,
+  contextFilePathForSession,
   resolveCodexAgentConfig,
   resolveWsUrl,
   sessionStateFilePathForRuntime,
@@ -52,6 +53,7 @@ async function main() {
     description: me.agent_profile?.description ?? undefined,
   });
   const runtimeKey = config.runtimeKey || buildCodexRuntimeKey(agentUserId);
+  const mainContextFilePath = contextFilePathForSession(config.stateDir, runtimeKey);
   const sessionStateFilePath = sessionStateFilePathForRuntime(config.stateDir, runtimeKey);
   const sessionManager = new CodexSessionManager(
     runtimeKey,
@@ -65,16 +67,25 @@ async function main() {
     wsUrl: resolvedWsUrl,
   });
 
+  const configMgr = createPlatformConfigManager({ client, stateDir: config.stateDir, runtimeType: "codex", log });
+  const platformDefaults = await configMgr.fetch();
+  let platformManaged = isPlatformManagedProfile(me.agent_profile);
+  const resolvedModel = platformManaged ? (platformDefaults.model ?? config.model) : config.model;
+  const resolvedEffort = platformManaged ? (platformDefaults.thinkingEffort ?? config.reasoningEffort) : config.reasoningEffort;
+  if (platformDefaults.model) log.info(`platform config: model=${platformDefaults.model} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
+  if (platformDefaults.thinkingEffort) log.info(`platform config: reasoning_effort=${platformDefaults.thinkingEffort} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
+
   const adapter = new CodexAppServerAdapter({
     codexBin: config.codexBin,
     codexHome: config.codexHome,
     workspaceDir: config.workspaceDir,
-    model: config.model,
-    reasoningEffort: config.reasoningEffort,
+    model: resolvedModel,
+    reasoningEffort: resolvedEffort,
     sandbox: config.sandbox,
     approvalPolicy: config.approvalPolicy,
     sessionManager,
     log,
+    contextFilePath: mainContextFilePath,
   });
 
   const gateway = new ParallAgentGateway({
@@ -100,7 +111,26 @@ async function main() {
     dispatchAdapter: adapter,
     log,
     shutdownDeadlineMs: parseShutdownDeadlineMs(process.env.PRLL_SHUTDOWN_DEADLINE_MS),
+    contextFilePathForSession: (sessionKey) => contextFilePathForSession(config.stateDir, sessionKey),
     stepIdFilePathForSession: (sessionKey) => stepIdFilePathForSession(config.stateDir, sessionKey),
+    onConfigUpdate: async () => {
+      const refreshed = await getAgentMeWithLegacyFallback(client, config.orgId);
+      platformManaged = isPlatformManagedProfile(refreshed.agent_profile);
+      const updated = await configMgr.fetch();
+      adapter.updateConfig({
+        model: platformManaged ? (updated.model ?? config.model) : (config.model ?? null),
+        reasoningEffort: platformManaged ? (updated.thinkingEffort ?? config.reasoningEffort) : (config.reasoningEffort ?? null),
+      });
+    },
+    onSessionReady: async () => {
+      const refreshed = await getAgentMeWithLegacyFallback(client, config.orgId);
+      platformManaged = isPlatformManagedProfile(refreshed.agent_profile);
+      const updated = await configMgr.fetch();
+      adapter.updateConfig({
+        model: platformManaged ? (updated.model ?? config.model) : (config.model ?? null),
+        reasoningEffort: platformManaged ? (updated.thinkingEffort ?? config.reasoningEffort) : (config.reasoningEffort ?? null),
+      });
+    },
   });
 
   const abortController = new AbortController();

package/src/workspace.ts

@@ -5,6 +5,8 @@ import {
   PRLL_BEHAVIOR,
   PRLL_REFERENCE_GUIDE,
   buildIdentity,
+  buildSkillReferences,
+  writeSkillFiles,
 } from "@parall/agent-core";
 import type { AgentIdentity } from "@parall/agent-core";
 
@@ -12,34 +14,25 @@ export function ensureCodexWorkspace(
   workspaceDir: string,
   log?: { warn: (msg: string) => void },
   agentIdentity?: AgentIdentity,
-) {
-  const AGENTS_MD = [
+): void {
+  const systemPrompt = [
     buildIdentity(agentIdentity),
     BRIDGE_WORKSPACE_INSTRUCTIONS,
     PRLL_BEHAVIOR,
     PRLL_REFERENCE_GUIDE,
+    buildSkillReferences(workspaceDir),
   ].join("\n\n");
+
   fs.mkdirSync(workspaceDir, { recursive: true });
 
-  // AGENTS.md is bridge-managed: always overwrite so the workspace picks up
-  // updated guardrails / command templates on upgrade. Operators must not
-  // hand-edit this file — workspace customisations should go elsewhere in
-  // the Codex home dir. Surface a warning when we replace divergent content
-  // so an operator who did edit it locally sees a signal instead of silently
-  // losing changes. Mirrors the Claude bridge behaviour.
-  const agentsMdPath = path.join(workspaceDir, "AGENTS.md");
-  if (log) {
-    try {
-      const existing = fs.readFileSync(agentsMdPath, "utf8");
-      if (existing !== AGENTS_MD) {
-        log.warn(
-          `codex-agent: overwriting divergent ${agentsMdPath} with bridge-managed template ` +
-            `(local edits to AGENTS.md are not preserved — customize other files in the workspace instead)`,
-        );
-      }
-    } catch {
-      // file missing or unreadable — first-boot case, no warning needed
-    }
-  }
-  fs.writeFileSync(agentsMdPath, AGENTS_MD, "utf8");
+  const parallDir = path.join(workspaceDir, ".parall");
+  fs.mkdirSync(parallDir, { recursive: true });
+  fs.writeFileSync(path.join(parallDir, "system-prompt.md"), systemPrompt, "utf8");
+
+  writeSkillFiles(path.join(parallDir, "skills"));
+
+  const codexConfigDir = path.join(workspaceDir, ".codex");
+  fs.mkdirSync(codexConfigDir, { recursive: true });
+  const toml = `developer_instructions = """\n${systemPrompt.replace(/\\/g, "\\\\").replace(/"""/g, '\\"""')}\n"""\n`;
+  fs.writeFileSync(path.join(codexConfigDir, "config.toml"), toml, "utf8");
 }