@parall/codex-agent 1.25.0 → 1.26.1

package/dist/config.d.ts

@@ -11,14 +11,14 @@ export type CodexAgentConfig = {
     model?: string;
     reasoningEffort?: string;
     /**
-     * Only set when the user explicitly specified `PRLL_CODEX_SANDBOX`.
-     * When undefined, the bridge deliberately does NOT pass `sandbox` on
-     * `thread/{start,resume}` so codex reads whatever the user configured
-     * in `~/.codex/config.toml` (`sandbox_mode`). This matches the self-
-     * hosted philosophy: user's codex setup is authoritative; bridge only
-     * overrides when the user asks it to.
+     * Sandbox mode passed to codex on `thread/{start,resume}`. Defaults to
+     * `danger-full-access` — same as the hosted container — because codex's
+     * inner bubblewrap sandbox requires unprivileged user namespaces that
+     * most environments lack, and the agent needs unrestricted shell access
+     * (e.g. `parall messages send`). Users can still override via
+     * `PRLL_CODEX_SANDBOX` env var.
      */
-    sandbox?: string;
+    sandbox: string;
     /**
      * Approval policy is forced to `"never"` by default (not configurable
      * via config.toml override): Parall's HITL contract routes approvals
@@ -51,5 +51,6 @@ export declare function normalizeApprovalPolicy(value: string): string;
 export declare function resolveWsUrl(apiUrl: string, explicitWsUrl?: string, swimlaneName?: string): string;
 export declare function buildCodexRuntimeKey(agentUserId: string): string;
 export declare function sessionStateFilePathForRuntime(stateDir: string, runtimeKey: string): string;
+export declare function contextFilePathForSession(stateDir: string, sessionKey: string): string;
 export declare function stepIdFilePathForSession(stateDir: string, sessionKey: string): string;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAcF,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAwC9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlG;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG3F;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGrF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,gBAAgB,GAAG;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAcF,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,gBAAgB,CAwC9F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUtD;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAW7D;AAED,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,MAAM,CAMlG;AAED,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAG3F;AAED,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGtF;AAED,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAGrF"}

package/dist/config.js

@@ -41,7 +41,7 @@ export function resolveCodexAgentConfig(env = process.env) {
         workspaceDir,
         model: env.PRLL_CODEX_MODEL?.trim() || undefined,
         reasoningEffort: env.PRLL_CODEX_REASONING_EFFORT?.trim() || undefined,
-        sandbox: env.PRLL_CODEX_SANDBOX?.trim() || undefined,
+        sandbox: env.PRLL_CODEX_SANDBOX?.trim() || "danger-full-access",
         approvalPolicy: env.PRLL_CODEX_APPROVAL?.trim() || "never",
         runtimeKey: env.PRLL_CODEX_RUNTIME_KEY?.trim() || undefined,
     };
@@ -101,6 +101,10 @@ export function sessionStateFilePathForRuntime(stateDir, runtimeKey) {
     const fileName = Buffer.from(runtimeKey).toString("base64url");
     return path.join(stateDir, "threads", `${fileName}.json`);
 }
+export function contextFilePathForSession(stateDir, sessionKey) {
+    const fileName = Buffer.from(sessionKey).toString("base64url");
+    return path.join(stateDir, "dispatch-context", `${fileName}.json`);
+}
 export function stepIdFilePathForSession(stateDir, sessionKey) {
     const fileName = Buffer.from(sessionKey).toString("base64url");
     return path.join(stateDir, "step-ids", `${fileName}.txt`);

package/dist/dispatch.d.ts

@@ -4,6 +4,7 @@ import type { CodexSessionManager } from "./session-manager.js";
 type CodexAppServerAdapterOptions = Pick<CodexAgentConfig, "approvalPolicy" | "codexBin" | "codexHome" | "model" | "reasoningEffort" | "sandbox" | "workspaceDir"> & {
     sessionManager: CodexSessionManager;
     log?: GatewayLogger;
+    contextFilePath?: string;
 };
 /**
  * Bridge driver backed by `codex app-server --listen stdio://`.
@@ -38,7 +39,12 @@ export declare class CodexAppServerAdapter implements DispatchAdapter {
      */
     private setActiveTurn;
     constructor(opts: CodexAppServerAdapterOptions);
+    updateConfig(config: {
+        model?: string | null;
+        reasoningEffort?: string | null;
+    }): void;
     dispatch({ event, bodyForAgent, sessionKey, context }: DispatchOpts): AsyncIterable<RuntimeEvent>;
+    getBranchPoint(_sessionKey: string): string | undefined;
     forkSession({ sessionKey: parentSessionKey }: ForkOpts): Promise<ForkSessionHandle | null>;
     cleanupFork({ fork }: CleanupForkOpts): void;
     private logForkFailure;

package/dist/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,aAAa,EACb,YAAY,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,KAAK,4BAA4B,GAAG,IAAI,CACtC,gBAAgB,EACd,gBAAgB,GAChB,UAAU,GACV,WAAW,GACX,OAAO,GACP,iBAAiB,GACjB,SAAS,GACT,cAAc,CACjB,GAAG;IACF,cAAc,EAAE,mBAAmB,CAAC;IACpC,GAAG,CAAC,EAAE,aAAa,CAAC;CACrB,CAAC;AAOF;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IA6B/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IA5BjC,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,IAAI,CAA+C;IAC3D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;gBAYQ,IAAI,EAAE,4BAA4B;IAExD,QAAQ,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;IAgLlG,WAAW,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuBhG,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,eAAe;IAIrC,OAAO,CAAC,cAAc;IAKhB,IAAI;YAaI,aAAa;YAcb,OAAO;IA2DrB,OAAO,CAAC,qBAAqB;YAiCf,UAAU;IAgDxB,OAAO,CAAC,iBAAiB;CA2B1B"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../src/dispatch.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EACV,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,iBAAiB,EACjB,aAAa,EACb,YAAY,EACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,KAAK,4BAA4B,GAAG,IAAI,CACtC,gBAAgB,EACd,gBAAgB,GAChB,UAAU,GACV,WAAW,GACX,OAAO,GACP,iBAAiB,GACjB,SAAS,GACT,cAAc,CACjB,GAAG;IACF,cAAc,EAAE,mBAAmB,CAAC;IACpC,GAAG,CAAC,EAAE,aAAa,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAOF;;;;;;;;;;;;;GAaG;AACH,qBAAa,qBAAsB,YAAW,eAAe;IA6B/C,OAAO,CAAC,QAAQ,CAAC,IAAI;IA5BjC,OAAO,CAAC,MAAM,CAAmC;IACjD,OAAO,CAAC,IAAI,CAA+C;IAC3D,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,YAAY,CAA8B;IAClD,OAAO,CAAC,QAAQ,CAAC,WAAW,CAA+B;IAC3D,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAqB;IACtD,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;;;OAOG;IACH,OAAO,CAAC,aAAa;gBAYQ,IAAI,EAAE,4BAA4B;IAE/D,YAAY,CAAC,MAAM,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI;IAK/E,QAAQ,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,YAAY,GAAG,aAAa,CAAC,YAAY,CAAC;IAgLxG,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMjD,WAAW,CAAC,EAAE,UAAU,EAAE,gBAAgB,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAuBhG,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,eAAe;IAIrC,OAAO,CAAC,cAAc;IAKhB,IAAI;YAaI,aAAa;YAcb,OAAO;IA8DrB,OAAO,CAAC,qBAAqB;YAiCf,UAAU;IAwCxB,OAAO,CAAC,iBAAiB;CA2B1B"}

package/dist/dispatch.js

@@ -49,6 +49,12 @@ export class CodexAppServerAdapter {
     constructor(opts) {
         this.opts = opts;
     }
+    updateConfig(config) {
+        if (config.model !== undefined)
+            this.opts.model = config.model ?? undefined;
+        if (config.reasoningEffort !== undefined)
+            this.opts.reasoningEffort = config.reasoningEffort ?? undefined;
+    }
     async *dispatch({ event, bodyForAgent, sessionKey, context }) {
         await this.ensureStarted(context.log);
         // After ensureStarted resolves the subprocess could still die before we
@@ -226,6 +232,11 @@ export class CodexAppServerAdapter {
             }
         }
     }
+    getBranchPoint(_sessionKey) {
+        // Codex app-server does not expose a branch-point API; fork scope prefix
+        // provides the behavioral fallback for this runtime.
+        return undefined;
+    }
     async forkSession({ sessionKey: parentSessionKey }) {
         const client = this.client;
         if (!client)
@@ -304,6 +315,9 @@ export class CodexAppServerAdapter {
             FORCE_COLOR: "0",
             NO_COLOR: "1",
         };
+        if (this.opts.contextFilePath) {
+            env.PRLL_CONTEXT_FILE = this.opts.contextFilePath;
+        }
         const args = ["app-server", "--listen", "stdio://"];
         (log ?? this.opts.log)?.info?.(`codex-agent: spawning ${this.opts.codexBin} ${args.join(" ")}`);
         const proc = spawn(this.opts.codexBin, args, {
@@ -382,15 +396,7 @@ export class CodexAppServerAdapter {
         const commonParams = {
             approvalPolicy: normalizeApprovalPolicy(this.opts.approvalPolicy),
         };
-        // Only override sandbox when the user explicitly set PRLL_CODEX_SANDBOX.
-        // Otherwise let codex read `sandbox_mode` from ~/.codex/config.toml — the
-        // user's own configuration is authoritative for a self-hosted bridge,
-        // and codex 0.120.0's workspace-write mode has a write_stdin bug that
-        // our previous `workspace-write` default tripped for users whose config
-        // had danger-full-access.
-        if (this.opts.sandbox) {
-            commonParams.sandbox = normalizeSandbox(this.opts.sandbox);
-        }
+        commonParams.sandbox = normalizeSandbox(this.opts.sandbox);
         if (this.opts.model)
             commonParams.model = this.opts.model;
         if (this.opts.reasoningEffort) {

package/dist/index.js

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
 import * as os from "node:os";
-import { ParallAgentGateway, parseShutdownDeadlineMs } from "@parall/agent-core";
+import { ParallAgentGateway, createPlatformConfigManager, isPlatformManagedProfile, parseShutdownDeadlineMs } from "@parall/agent-core";
 import { ApiError, ParallClient, ParallWs } from "@parall/sdk";
-import { buildCodexRuntimeKey, resolveCodexAgentConfig, resolveWsUrl, sessionStateFilePathForRuntime, stepIdFilePathForSession, } from "./config.js";
+import { buildCodexRuntimeKey, contextFilePathForSession, resolveCodexAgentConfig, resolveWsUrl, sessionStateFilePathForRuntime, stepIdFilePathForSession, } from "./config.js";
 import { CodexAppServerAdapter } from "./dispatch.js";
 import { CodexSessionManager } from "./session-manager.js";
-import { ensureCodexWorkspace } from "./workspace.js";
+import { ensureCodexWorkspace, ensureWorkspaceTrusted } from "./workspace.js";
 function createLogger(prefix) {
     return {
         info: (msg) => console.log(`[${prefix}] ${msg}`),
@@ -35,12 +35,14 @@ async function main() {
     });
     const me = await getAgentMeWithLegacyFallback(client, config.orgId);
     const agentUserId = me.id;
+    ensureWorkspaceTrusted(config.codexHome, config.workspaceDir, log);
     ensureCodexWorkspace(config.workspaceDir, log, {
         userId: agentUserId,
         displayName: me.display_name,
         description: me.agent_profile?.description ?? undefined,
     });
     const runtimeKey = config.runtimeKey || buildCodexRuntimeKey(agentUserId);
+    const mainContextFilePath = contextFilePathForSession(config.stateDir, runtimeKey);
     const sessionStateFilePath = sessionStateFilePathForRuntime(config.stateDir, runtimeKey);
     const sessionManager = new CodexSessionManager(runtimeKey, sessionStateFilePath, log);
     const resolvedWsUrl = resolveWsUrl(config.apiUrl, config.wsUrl, config.swimlaneName);
@@ -48,16 +50,26 @@ async function main() {
         getTicket: () => client.getWsTicket(),
         wsUrl: resolvedWsUrl,
     });
+    const configMgr = createPlatformConfigManager({ client, stateDir: config.stateDir, runtimeType: "codex", log });
+    const platformDefaults = await configMgr.fetch();
+    let platformManaged = isPlatformManagedProfile(me.agent_profile);
+    const resolvedModel = platformManaged ? (platformDefaults.model ?? config.model) : config.model;
+    const resolvedEffort = platformManaged ? (platformDefaults.thinkingEffort ?? config.reasoningEffort) : config.reasoningEffort;
+    if (platformDefaults.model)
+        log.info(`platform config: model=${platformDefaults.model} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
+    if (platformDefaults.thinkingEffort)
+        log.info(`platform config: reasoning_effort=${platformDefaults.thinkingEffort} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
     const adapter = new CodexAppServerAdapter({
         codexBin: config.codexBin,
         codexHome: config.codexHome,
         workspaceDir: config.workspaceDir,
-        model: config.model,
-        reasoningEffort: config.reasoningEffort,
+        model: resolvedModel,
+        reasoningEffort: resolvedEffort,
         sandbox: config.sandbox,
         approvalPolicy: config.approvalPolicy,
         sessionManager,
         log,
+        contextFilePath: mainContextFilePath,
     });
     const gateway = new ParallAgentGateway({
         accountId: agentUserId,
@@ -82,7 +94,26 @@ async function main() {
         dispatchAdapter: adapter,
         log,
         shutdownDeadlineMs: parseShutdownDeadlineMs(process.env.PRLL_SHUTDOWN_DEADLINE_MS),
+        contextFilePathForSession: (sessionKey) => contextFilePathForSession(config.stateDir, sessionKey),
         stepIdFilePathForSession: (sessionKey) => stepIdFilePathForSession(config.stateDir, sessionKey),
+        onConfigUpdate: async () => {
+            const refreshed = await getAgentMeWithLegacyFallback(client, config.orgId);
+            platformManaged = isPlatformManagedProfile(refreshed.agent_profile);
+            const updated = await configMgr.fetch();
+            adapter.updateConfig({
+                model: platformManaged ? (updated.model ?? config.model) : (config.model ?? null),
+                reasoningEffort: platformManaged ? (updated.thinkingEffort ?? config.reasoningEffort) : (config.reasoningEffort ?? null),
+            });
+        },
+        onSessionReady: async () => {
+            const refreshed = await getAgentMeWithLegacyFallback(client, config.orgId);
+            platformManaged = isPlatformManagedProfile(refreshed.agent_profile);
+            const updated = await configMgr.fetch();
+            adapter.updateConfig({
+                model: platformManaged ? (updated.model ?? config.model) : (config.model ?? null),
+                reasoningEffort: platformManaged ? (updated.thinkingEffort ?? config.reasoningEffort) : (config.reasoningEffort ?? null),
+            });
+        },
     });
     const abortController = new AbortController();
     const abort = () => abortController.abort();

package/dist/workspace.d.ts

@@ -1,4 +1,17 @@
 import type { AgentIdentity } from "@parall/agent-core";
+/**
+ * Ensure the workspace directory is marked as trusted in the global Codex
+ * config so that project-level `developer_instructions` are loaded at
+ * app-server startup.
+ *
+ * Uses smol-toml for structured reads (avoids substring false-positives),
+ * but writes via raw text manipulation (preserves comments and formatting).
+ * Failures are swallowed (warn-only) so a trust write issue never blocks
+ * the bridge from starting.
+ */
+export declare function ensureWorkspaceTrusted(codexHome: string, workspaceDir: string, log?: {
+    warn: (msg: string) => void;
+}): void;
 export declare function ensureCodexWorkspace(workspaceDir: string, log?: {
     warn: (msg: string) => void;
 }, agentIdentity?: AgentIdentity): void;

package/dist/workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EACrC,aAAa,CAAC,EAAE,aAAa,QA+B9B"}
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACpC,IAAI,CAyEN;AASD,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EACrC,aAAa,CAAC,EAAE,aAAa,GAC5B,IAAI,CAqBN"}

package/dist/workspace.js

@@ -1,32 +1,117 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
-import { BRIDGE_WORKSPACE_INSTRUCTIONS, PRLL_BEHAVIOR, PRLL_REFERENCE_GUIDE, buildIdentity, } from "@parall/agent-core";
+import { parse as parseToml } from "smol-toml";
+import { BRIDGE_WORKSPACE_INSTRUCTIONS, PRLL_BEHAVIOR, PRLL_REFERENCE_GUIDE, buildIdentity, buildSkillReferences, writeSkillFiles, } from "@parall/agent-core";
+/**
+ * Ensure the workspace directory is marked as trusted in the global Codex
+ * config so that project-level `developer_instructions` are loaded at
+ * app-server startup.
+ *
+ * Uses smol-toml for structured reads (avoids substring false-positives),
+ * but writes via raw text manipulation (preserves comments and formatting).
+ * Failures are swallowed (warn-only) so a trust write issue never blocks
+ * the bridge from starting.
+ */
+export function ensureWorkspaceTrusted(codexHome, workspaceDir, log) {
+    const configPath = path.join(codexHome, "config.toml");
+    const normalizedPath = path.resolve(workspaceDir);
+    try {
+        let content = "";
+        try {
+            content = fs.readFileSync(configPath, "utf8");
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+        // Structured read — know exactly what state we're in.
+        let parsed;
+        if (content) {
+            try {
+                parsed = parseToml(content);
+            }
+            catch {
+                // File is already broken TOML — don't make it worse.
+                log?.warn(`Codex config.toml is not valid TOML; skipping trust write for ${normalizedPath}`);
+                return;
+            }
+        }
+        const projects = parsed?.projects;
+        if (projects?.[normalizedPath]?.trust_level === "trusted")
+            return;
+        // TOML basic-string keys require backslash and double-quote escaping.
+        const escapedPath = normalizedPath.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+        const sectionHeader = `[projects."${escapedPath}"]`;
+        const trustLine = 'trust_level = "trusted"';
+        const headerIdx = content.indexOf(sectionHeader);
+        if (headerIdx !== -1) {
+            // Section exists but trust_level isn't "trusted". Scan all lines
+            // within the section (up to the next `[` header or EOF) for an
+            // existing trust_level key — it may not be the first line after
+            // the header if the user added comments or other keys.
+            const headerLineEnd = content.indexOf("\n", headerIdx);
+            if (headerLineEnd === -1) {
+                content = `${content}\n${trustLine}\n`;
+            }
+            else {
+                const afterHeader = headerLineEnd + 1;
+                const sectionEnd = findSectionEnd(content, afterHeader);
+                const sectionBody = content.substring(afterHeader, sectionEnd);
+                const trustMatch = sectionBody.match(/^[ \t]*trust_level[ \t]*=.*$/m);
+                if (trustMatch) {
+                    const matchStart = afterHeader + trustMatch.index;
+                    const matchEnd = matchStart + trustMatch[0].length;
+                    content = content.substring(0, matchStart) + trustLine + content.substring(matchEnd);
+                }
+                else {
+                    content = content.substring(0, afterHeader) + trustLine + "\n" + content.substring(afterHeader);
+                }
+            }
+            fs.writeFileSync(configPath, content, "utf8");
+        }
+        else if (projects?.[normalizedPath] !== undefined) {
+            // smol-toml found the section but indexOf missed it — the header
+            // uses non-canonical TOML formatting. Appending would create a
+            // duplicate table. Skip rather than corrupt the file.
+            log?.warn(`Codex config.toml has non-canonical header for ${normalizedPath}; skipping trust write`);
+        }
+        else if (projects && !content.includes("[projects.")) {
+            // `projects` exists in parsed output but no `[projects.` table
+            // headers in the raw text — it's an inline table. Appending a
+            // standard table header would produce invalid TOML.
+            log?.warn(`Codex config.toml uses inline table for projects; skipping trust write for ${normalizedPath}`);
+        }
+        else {
+            // Section doesn't exist — append.
+            fs.mkdirSync(codexHome, { recursive: true });
+            fs.appendFileSync(configPath, `\n${sectionHeader}\n${trustLine}\n`, "utf8");
+        }
+    }
+    catch (err) {
+        log?.warn(`failed to write Codex project trust for ${normalizedPath}: ${String(err)}`);
+    }
+}
+function findSectionEnd(content, fromIndex) {
+    // A TOML section ends at the next `[` that starts a new table header.
+    // Match `[` at the beginning of a line (not inside a value).
+    const nextHeader = content.indexOf("\n[", fromIndex);
+    return nextHeader === -1 ? content.length : nextHeader;
+}
 export function ensureCodexWorkspace(workspaceDir, log, agentIdentity) {
-    const AGENTS_MD = [
+    const systemPrompt = [
         buildIdentity(agentIdentity),
         BRIDGE_WORKSPACE_INSTRUCTIONS,
         PRLL_BEHAVIOR,
         PRLL_REFERENCE_GUIDE,
+        buildSkillReferences(workspaceDir),
     ].join("\n\n");
     fs.mkdirSync(workspaceDir, { recursive: true });
-    // AGENTS.md is bridge-managed: always overwrite so the workspace picks up
-    // updated guardrails / command templates on upgrade. Operators must not
-    // hand-edit this file — workspace customisations should go elsewhere in
-    // the Codex home dir. Surface a warning when we replace divergent content
-    // so an operator who did edit it locally sees a signal instead of silently
-    // losing changes. Mirrors the Claude bridge behaviour.
-    const agentsMdPath = path.join(workspaceDir, "AGENTS.md");
-    if (log) {
-        try {
-            const existing = fs.readFileSync(agentsMdPath, "utf8");
-            if (existing !== AGENTS_MD) {
-                log.warn(`codex-agent: overwriting divergent ${agentsMdPath} with bridge-managed template ` +
-                    `(local edits to AGENTS.md are not preserved — customize other files in the workspace instead)`);
-            }
-        }
-        catch {
-            // file missing or unreadable — first-boot case, no warning needed
-        }
-    }
-    fs.writeFileSync(agentsMdPath, AGENTS_MD, "utf8");
+    const parallDir = path.join(workspaceDir, ".parall");
+    fs.mkdirSync(parallDir, { recursive: true });
+    fs.writeFileSync(path.join(parallDir, "system-prompt.md"), systemPrompt, "utf8");
+    writeSkillFiles(path.join(parallDir, "skills"));
+    const codexConfigDir = path.join(workspaceDir, ".codex");
+    fs.mkdirSync(codexConfigDir, { recursive: true });
+    const toml = `developer_instructions = """\n${systemPrompt.replace(/\\/g, "\\\\").replace(/"""/g, '\\"""')}\n"""\n`;
+    fs.writeFileSync(path.join(codexConfigDir, "config.toml"), toml, "utf8");
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/codex-agent",
-  "version": "1.25.0",
+  "version": "1.26.1",
   "description": "Codex CLI bridge runtime for self-hosted Parall agents",
   "license": "MIT",
   "repository": {
@@ -25,9 +25,10 @@
     "src"
   ],
   "dependencies": {
-    "@parall/agent-core": "1.25.0",
-    "@parall/cli": "1.25.0",
-    "@parall/sdk": "1.25.0"
+    "smol-toml": "^1.6.1",
+    "@parall/agent-core": "1.26.1",
+    "@parall/cli": "1.26.1",
+    "@parall/sdk": "1.26.1"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/src/config.ts

@@ -14,14 +14,14 @@ export type CodexAgentConfig = {
   model?: string;
   reasoningEffort?: string;
   /**
-   * Only set when the user explicitly specified `PRLL_CODEX_SANDBOX`.
-   * When undefined, the bridge deliberately does NOT pass `sandbox` on
-   * `thread/{start,resume}` so codex reads whatever the user configured
-   * in `~/.codex/config.toml` (`sandbox_mode`). This matches the self-
-   * hosted philosophy: user's codex setup is authoritative; bridge only
-   * overrides when the user asks it to.
+   * Sandbox mode passed to codex on `thread/{start,resume}`. Defaults to
+   * `danger-full-access` — same as the hosted container — because codex's
+   * inner bubblewrap sandbox requires unprivileged user namespaces that
+   * most environments lack, and the agent needs unrestricted shell access
+   * (e.g. `parall messages send`). Users can still override via
+   * `PRLL_CODEX_SANDBOX` env var.
    */
-  sandbox?: string;
+  sandbox: string;
   /**
    * Approval policy is forced to `"never"` by default (not configurable
    * via config.toml override): Parall's HITL contract routes approvals
@@ -80,7 +80,7 @@ export function resolveCodexAgentConfig(env: NodeJS.ProcessEnv = process.env): C
     workspaceDir,
     model: env.PRLL_CODEX_MODEL?.trim() || undefined,
     reasoningEffort: env.PRLL_CODEX_REASONING_EFFORT?.trim() || undefined,
-    sandbox: env.PRLL_CODEX_SANDBOX?.trim() || undefined,
+    sandbox: env.PRLL_CODEX_SANDBOX?.trim() || "danger-full-access",
     approvalPolicy: env.PRLL_CODEX_APPROVAL?.trim() || "never",
     runtimeKey: env.PRLL_CODEX_RUNTIME_KEY?.trim() || undefined,
   };
@@ -145,6 +145,11 @@ export function sessionStateFilePathForRuntime(stateDir: string, runtimeKey: str
   return path.join(stateDir, "threads", `${fileName}.json`);
 }
 
+export function contextFilePathForSession(stateDir: string, sessionKey: string): string {
+  const fileName = Buffer.from(sessionKey).toString("base64url");
+  return path.join(stateDir, "dispatch-context", `${fileName}.json`);
+}
+
 export function stepIdFilePathForSession(stateDir: string, sessionKey: string): string {
   const fileName = Buffer.from(sessionKey).toString("base64url");
   return path.join(stateDir, "step-ids", `${fileName}.txt`);

package/src/dispatch.ts

@@ -35,6 +35,7 @@ type CodexAppServerAdapterOptions = Pick<
 > & {
   sessionManager: CodexSessionManager;
   log?: GatewayLogger;
+  contextFilePath?: string;
 };
 
 type TurnEventEnvelope =
@@ -87,6 +88,11 @@ export class CodexAppServerAdapter implements DispatchAdapter {
 
   constructor(private readonly opts: CodexAppServerAdapterOptions) {}
 
+  updateConfig(config: { model?: string | null; reasoningEffort?: string | null }): void {
+    if (config.model !== undefined) this.opts.model = config.model ?? undefined;
+    if (config.reasoningEffort !== undefined) this.opts.reasoningEffort = config.reasoningEffort ?? undefined;
+  }
+
   async *dispatch({ event, bodyForAgent, sessionKey, context }: DispatchOpts): AsyncIterable<RuntimeEvent> {
     await this.ensureStarted(context.log);
     // After ensureStarted resolves the subprocess could still die before we
@@ -263,6 +269,12 @@ export class CodexAppServerAdapter implements DispatchAdapter {
     }
   }
 
+  getBranchPoint(_sessionKey: string): string | undefined {
+    // Codex app-server does not expose a branch-point API; fork scope prefix
+    // provides the behavioral fallback for this runtime.
+    return undefined;
+  }
+
   async forkSession({ sessionKey: parentSessionKey }: ForkOpts): Promise<ForkSessionHandle | null> {
     const client = this.client;
     if (!client) return null;
@@ -334,12 +346,15 @@ export class CodexAppServerAdapter implements DispatchAdapter {
     // (git/ssh/npm/etc.). Earlier versions also rewrote HOME, which broke
     // tooling for users who set a custom CODEX_HOME pointing somewhere
     // other than their shell home.
-    const env = {
+    const env: Record<string, string | undefined> = {
       ...process.env,
       CODEX_HOME: this.opts.codexHome,
       FORCE_COLOR: "0",
       NO_COLOR: "1",
     };
+    if (this.opts.contextFilePath) {
+      env.PRLL_CONTEXT_FILE = this.opts.contextFilePath;
+    }
     const args = ["app-server", "--listen", "stdio://"];
     (log ?? this.opts.log)?.info?.(`codex-agent: spawning ${this.opts.codexBin} ${args.join(" ")}`);
     const proc = spawn(this.opts.codexBin, args, {
@@ -430,15 +445,7 @@ export class CodexAppServerAdapter implements DispatchAdapter {
     const commonParams: Record<string, unknown> = {
       approvalPolicy: normalizeApprovalPolicy(this.opts.approvalPolicy),
     };
-    // Only override sandbox when the user explicitly set PRLL_CODEX_SANDBOX.
-    // Otherwise let codex read `sandbox_mode` from ~/.codex/config.toml — the
-    // user's own configuration is authoritative for a self-hosted bridge,
-    // and codex 0.120.0's workspace-write mode has a write_stdin bug that
-    // our previous `workspace-write` default tripped for users whose config
-    // had danger-full-access.
-    if (this.opts.sandbox) {
-      commonParams.sandbox = normalizeSandbox(this.opts.sandbox);
-    }
+    commonParams.sandbox = normalizeSandbox(this.opts.sandbox);
     if (this.opts.model) commonParams.model = this.opts.model;
     if (this.opts.reasoningEffort) {
       // The app-server JSON-RPC surface uses camelCase for overrides —

package/src/index.ts

@@ -1,10 +1,11 @@
 #!/usr/bin/env node
 
 import * as os from "node:os";
-import { ParallAgentGateway, parseShutdownDeadlineMs } from "@parall/agent-core";
+import { ParallAgentGateway, createPlatformConfigManager, isPlatformManagedProfile, parseShutdownDeadlineMs } from "@parall/agent-core";
 import { ApiError, ParallClient, ParallWs } from "@parall/sdk";
 import {
   buildCodexRuntimeKey,
+  contextFilePathForSession,
   resolveCodexAgentConfig,
   resolveWsUrl,
   sessionStateFilePathForRuntime,
@@ -12,7 +13,7 @@ import {
 } from "./config.js";
 import { CodexAppServerAdapter } from "./dispatch.js";
 import { CodexSessionManager } from "./session-manager.js";
-import { ensureCodexWorkspace } from "./workspace.js";
+import { ensureCodexWorkspace, ensureWorkspaceTrusted } from "./workspace.js";
 
 function createLogger(prefix: string) {
   return {
@@ -46,12 +47,14 @@ async function main() {
 
   const me = await getAgentMeWithLegacyFallback(client, config.orgId);
   const agentUserId = me.id;
+  ensureWorkspaceTrusted(config.codexHome, config.workspaceDir, log);
   ensureCodexWorkspace(config.workspaceDir, log, {
     userId: agentUserId,
     displayName: me.display_name,
     description: me.agent_profile?.description ?? undefined,
   });
   const runtimeKey = config.runtimeKey || buildCodexRuntimeKey(agentUserId);
+  const mainContextFilePath = contextFilePathForSession(config.stateDir, runtimeKey);
   const sessionStateFilePath = sessionStateFilePathForRuntime(config.stateDir, runtimeKey);
   const sessionManager = new CodexSessionManager(
     runtimeKey,
@@ -65,16 +68,25 @@ async function main() {
     wsUrl: resolvedWsUrl,
   });
 
+  const configMgr = createPlatformConfigManager({ client, stateDir: config.stateDir, runtimeType: "codex", log });
+  const platformDefaults = await configMgr.fetch();
+  let platformManaged = isPlatformManagedProfile(me.agent_profile);
+  const resolvedModel = platformManaged ? (platformDefaults.model ?? config.model) : config.model;
+  const resolvedEffort = platformManaged ? (platformDefaults.thinkingEffort ?? config.reasoningEffort) : config.reasoningEffort;
+  if (platformDefaults.model) log.info(`platform config: model=${platformDefaults.model} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
+  if (platformDefaults.thinkingEffort) log.info(`platform config: reasoning_effort=${platformDefaults.thinkingEffort} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
+
   const adapter = new CodexAppServerAdapter({
     codexBin: config.codexBin,
     codexHome: config.codexHome,
     workspaceDir: config.workspaceDir,
-    model: config.model,
-    reasoningEffort: config.reasoningEffort,
+    model: resolvedModel,
+    reasoningEffort: resolvedEffort,
     sandbox: config.sandbox,
     approvalPolicy: config.approvalPolicy,
     sessionManager,
     log,
+    contextFilePath: mainContextFilePath,
   });
 
   const gateway = new ParallAgentGateway({
@@ -100,7 +112,26 @@ async function main() {
     dispatchAdapter: adapter,
     log,
     shutdownDeadlineMs: parseShutdownDeadlineMs(process.env.PRLL_SHUTDOWN_DEADLINE_MS),
+    contextFilePathForSession: (sessionKey) => contextFilePathForSession(config.stateDir, sessionKey),
     stepIdFilePathForSession: (sessionKey) => stepIdFilePathForSession(config.stateDir, sessionKey),
+    onConfigUpdate: async () => {
+      const refreshed = await getAgentMeWithLegacyFallback(client, config.orgId);
+      platformManaged = isPlatformManagedProfile(refreshed.agent_profile);
+      const updated = await configMgr.fetch();
+      adapter.updateConfig({
+        model: platformManaged ? (updated.model ?? config.model) : (config.model ?? null),
+        reasoningEffort: platformManaged ? (updated.thinkingEffort ?? config.reasoningEffort) : (config.reasoningEffort ?? null),
+      });
+    },
+    onSessionReady: async () => {
+      const refreshed = await getAgentMeWithLegacyFallback(client, config.orgId);
+      platformManaged = isPlatformManagedProfile(refreshed.agent_profile);
+      const updated = await configMgr.fetch();
+      adapter.updateConfig({
+        model: platformManaged ? (updated.model ?? config.model) : (config.model ?? null),
+        reasoningEffort: platformManaged ? (updated.thinkingEffort ?? config.reasoningEffort) : (config.reasoningEffort ?? null),
+      });
+    },
   });
 
   const abortController = new AbortController();

package/src/workspace.ts

@@ -1,45 +1,135 @@
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { parse as parseToml } from "smol-toml";
 import {
   BRIDGE_WORKSPACE_INSTRUCTIONS,
   PRLL_BEHAVIOR,
   PRLL_REFERENCE_GUIDE,
   buildIdentity,
+  buildSkillReferences,
+  writeSkillFiles,
 } from "@parall/agent-core";
 import type { AgentIdentity } from "@parall/agent-core";
 
+/**
+ * Ensure the workspace directory is marked as trusted in the global Codex
+ * config so that project-level `developer_instructions` are loaded at
+ * app-server startup.
+ *
+ * Uses smol-toml for structured reads (avoids substring false-positives),
+ * but writes via raw text manipulation (preserves comments and formatting).
+ * Failures are swallowed (warn-only) so a trust write issue never blocks
+ * the bridge from starting.
+ */
+export function ensureWorkspaceTrusted(
+  codexHome: string,
+  workspaceDir: string,
+  log?: { warn: (msg: string) => void },
+): void {
+  const configPath = path.join(codexHome, "config.toml");
+  const normalizedPath = path.resolve(workspaceDir);
+
+  try {
+    let content = "";
+    try {
+      content = fs.readFileSync(configPath, "utf8");
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
+    }
+
+    // Structured read — know exactly what state we're in.
+    let parsed: Record<string, unknown> | undefined;
+    if (content) {
+      try {
+        parsed = parseToml(content) as Record<string, unknown>;
+      } catch {
+        // File is already broken TOML — don't make it worse.
+        log?.warn(`Codex config.toml is not valid TOML; skipping trust write for ${normalizedPath}`);
+        return;
+      }
+    }
+
+    const projects = parsed?.projects as Record<string, Record<string, unknown>> | undefined;
+    if (projects?.[normalizedPath]?.trust_level === "trusted") return;
+
+    // TOML basic-string keys require backslash and double-quote escaping.
+    const escapedPath = normalizedPath.replace(/\\/g, "\\\\").replace(/"/g, '\\"');
+    const sectionHeader = `[projects."${escapedPath}"]`;
+    const trustLine = 'trust_level = "trusted"';
+
+    const headerIdx = content.indexOf(sectionHeader);
+    if (headerIdx !== -1) {
+      // Section exists but trust_level isn't "trusted". Scan all lines
+      // within the section (up to the next `[` header or EOF) for an
+      // existing trust_level key — it may not be the first line after
+      // the header if the user added comments or other keys.
+      const headerLineEnd = content.indexOf("\n", headerIdx);
+      if (headerLineEnd === -1) {
+        content = `${content}\n${trustLine}\n`;
+      } else {
+        const afterHeader = headerLineEnd + 1;
+        const sectionEnd = findSectionEnd(content, afterHeader);
+        const sectionBody = content.substring(afterHeader, sectionEnd);
+        const trustMatch = sectionBody.match(/^[ \t]*trust_level[ \t]*=.*$/m);
+        if (trustMatch) {
+          const matchStart = afterHeader + trustMatch.index!;
+          const matchEnd = matchStart + trustMatch[0].length;
+          content = content.substring(0, matchStart) + trustLine + content.substring(matchEnd);
+        } else {
+          content = content.substring(0, afterHeader) + trustLine + "\n" + content.substring(afterHeader);
+        }
+      }
+      fs.writeFileSync(configPath, content, "utf8");
+    } else if (projects?.[normalizedPath] !== undefined) {
+      // smol-toml found the section but indexOf missed it — the header
+      // uses non-canonical TOML formatting. Appending would create a
+      // duplicate table. Skip rather than corrupt the file.
+      log?.warn(`Codex config.toml has non-canonical header for ${normalizedPath}; skipping trust write`);
+    } else if (projects && !content.includes("[projects.")) {
+      // `projects` exists in parsed output but no `[projects.` table
+      // headers in the raw text — it's an inline table. Appending a
+      // standard table header would produce invalid TOML.
+      log?.warn(`Codex config.toml uses inline table for projects; skipping trust write for ${normalizedPath}`);
+    } else {
+      // Section doesn't exist — append.
+      fs.mkdirSync(codexHome, { recursive: true });
+      fs.appendFileSync(configPath, `\n${sectionHeader}\n${trustLine}\n`, "utf8");
+    }
+  } catch (err) {
+    log?.warn(`failed to write Codex project trust for ${normalizedPath}: ${String(err)}`);
+  }
+}
+
+function findSectionEnd(content: string, fromIndex: number): number {
+  // A TOML section ends at the next `[` that starts a new table header.
+  // Match `[` at the beginning of a line (not inside a value).
+  const nextHeader = content.indexOf("\n[", fromIndex);
+  return nextHeader === -1 ? content.length : nextHeader;
+}
+
 export function ensureCodexWorkspace(
   workspaceDir: string,
   log?: { warn: (msg: string) => void },
   agentIdentity?: AgentIdentity,
-) {
-  const AGENTS_MD = [
+): void {
+  const systemPrompt = [
     buildIdentity(agentIdentity),
     BRIDGE_WORKSPACE_INSTRUCTIONS,
     PRLL_BEHAVIOR,
     PRLL_REFERENCE_GUIDE,
+    buildSkillReferences(workspaceDir),
   ].join("\n\n");
+
   fs.mkdirSync(workspaceDir, { recursive: true });
 
-  // AGENTS.md is bridge-managed: always overwrite so the workspace picks up
-  // updated guardrails / command templates on upgrade. Operators must not
-  // hand-edit this file — workspace customisations should go elsewhere in
-  // the Codex home dir. Surface a warning when we replace divergent content
-  // so an operator who did edit it locally sees a signal instead of silently
-  // losing changes. Mirrors the Claude bridge behaviour.
-  const agentsMdPath = path.join(workspaceDir, "AGENTS.md");
-  if (log) {
-    try {
-      const existing = fs.readFileSync(agentsMdPath, "utf8");
-      if (existing !== AGENTS_MD) {
-        log.warn(
-          `codex-agent: overwriting divergent ${agentsMdPath} with bridge-managed template ` +
-            `(local edits to AGENTS.md are not preserved — customize other files in the workspace instead)`,
-        );
-      }
-    } catch {
-      // file missing or unreadable — first-boot case, no warning needed
-    }
-  }
-  fs.writeFileSync(agentsMdPath, AGENTS_MD, "utf8");
+  const parallDir = path.join(workspaceDir, ".parall");
+  fs.mkdirSync(parallDir, { recursive: true });
+  fs.writeFileSync(path.join(parallDir, "system-prompt.md"), systemPrompt, "utf8");
+
+  writeSkillFiles(path.join(parallDir, "skills"));
+
+  const codexConfigDir = path.join(workspaceDir, ".codex");
+  fs.mkdirSync(codexConfigDir, { recursive: true });
+  const toml = `developer_instructions = """\n${systemPrompt.replace(/\\/g, "\\\\").replace(/"""/g, '\\"""')}\n"""\n`;
+  fs.writeFileSync(path.join(codexConfigDir, "config.toml"), toml, "utf8");
 }