@parall/codex-agent 1.29.3 → 1.31.0

package/dist/config.js

@@ -26,9 +26,9 @@ export function resolveCodexAgentConfig(env = process.env) {
         || path.join(env.HOME || os.homedir(), ".codex"));
     // Bridge state lives outside CODEX_HOME to avoid polluting codex's own
     // directory with non-codex files.
-    const stateDir = resolvePath(env.PRLL_CODEX_STATE_DIR?.trim()
+    const stateDir = resolvePath(env.PRLL_STATE_DIR?.trim()
         || path.join(env.HOME || os.homedir(), ".parall-agent"));
-    const workspaceDir = resolvePath(env.PRLL_CODEX_WORKSPACE_DIR?.trim() || path.join(stateDir, "workspace"));
+    const workspaceDir = resolvePath(env.PRLL_WORKSPACE_DIR?.trim() || path.join(stateDir, "workspace"));
     return {
         apiUrl,
         apiKey,

package/dist/dispatch.js

@@ -56,7 +56,7 @@ export class CodexAppServerAdapter {
     setActiveTurn(threadId, sink, log) {
         const existing = this.activeTurns.get(threadId);
         if (existing) {
-            (log ?? this.opts.log)?.warn?.(`codex-agent: thread ${threadId} already had an active turn; failing the previous dispatch`);
+            (log ?? this.opts.log)?.warn?.(`thread ${threadId} already had an active turn; failing the previous dispatch`);
             existing.push({ kind: "error", message: `thread ${threadId} replaced by concurrent turn` });
             existing.close();
         }
@@ -91,7 +91,7 @@ export class CodexAppServerAdapter {
             return true;
         }
         catch (err) {
-            this.opts.log?.warn?.(`codex-agent: turn/steer failed: ${errToString(err)}`);
+            this.opts.log?.warn?.(`turn/steer failed: ${errToString(err)}`);
             return false;
         }
     }
@@ -104,7 +104,7 @@ export class CodexAppServerAdapter {
             this.pendingInjections.delete(sessionKey);
             const threadId = this.opts.sessionManager.getThreadId(sessionKey);
             if (threadId && this.client && !this.client.isDisposed()) {
-                (this.opts.log ?? context.log)?.info?.(`codex-agent[${context.accountId}]: ${pending} steer injection(s) already sent; skipping turn/start`);
+                (this.opts.log ?? context.log)?.info?.(`${pending} steer injection(s) already sent; skipping turn/start`);
                 yield {
                     type: "runtime_session",
                     runtimeSessionId: threadId,
@@ -112,7 +112,7 @@ export class CodexAppServerAdapter {
                 };
                 return;
             }
-            (this.opts.log ?? context.log)?.warn?.(`codex-agent[${context.accountId}]: pending steer invalidated (subprocess died); falling through to normal dispatch`);
+            (this.opts.log ?? context.log)?.warn?.(`pending steer invalidated (subprocess died); falling through to normal dispatch`);
         }
         await this.ensureStarted(context.log);
         // After ensureStarted resolves the subprocess could still die before we
@@ -156,7 +156,7 @@ export class CodexAppServerAdapter {
                 this.resumedThreadIds.add(threadId);
             }
             catch (err) {
-                log?.warn?.(`codex-agent: thread/resume failed (${errToString(err)}); attempting one-shot fresh-thread start`);
+                log?.warn?.(`thread/resume failed (${errToString(err)}); attempting one-shot fresh-thread start`);
                 let freshThreadId;
                 try {
                     freshThreadId = await this.openThread(client, { resumeId: undefined });
@@ -192,7 +192,7 @@ export class CodexAppServerAdapter {
                 releasePreparedAttachments = pinLocalAttachmentPaths(preparedImages);
             }
             catch (err) {
-                log?.warn?.(`codex-agent[${context.accountId}]: failed to prepare local attachments: ${errToString(err)}`);
+                log?.warn?.(`failed to prepare local attachments: ${errToString(err)}`);
             }
             // `localImage` is a first-class variant of `UserInput` in the Codex
             // app-server protocol (codex-rs/app-server-protocol/src/protocol/v2.rs
@@ -229,7 +229,7 @@ export class CodexAppServerAdapter {
                     yield { type: "error", message: `Codex turn/start failed: ${message}` };
                     return;
                 }
-                log?.warn?.(`codex-agent: turn/start on thread ${threadId} failed (${message}); attempting one-shot fresh-thread retry`);
+                log?.warn?.(`turn/start on thread ${threadId} failed (${message}); attempting one-shot fresh-thread retry`);
                 this.activeTurns.delete(threadId);
                 let freshThreadId;
                 try {
@@ -345,7 +345,7 @@ export class CodexAppServerAdapter {
             const result = await client.sendRequest("thread/fork", forkParams);
             const forkedThreadId = extractThreadId(result);
             if (!forkedThreadId) {
-                this.opts.log?.warn?.("codex-agent: thread/fork returned no thread id");
+                this.opts.log?.warn?.("thread/fork returned no thread id");
                 return null;
             }
             this.opts.sessionManager.recordThreadId(handle.sessionKey, forkedThreadId);
@@ -359,7 +359,7 @@ export class CodexAppServerAdapter {
         this.opts.sessionManager.cleanupFork(fork.sessionKey);
     }
     logForkFailure(err) {
-        this.opts.log?.warn?.(`codex-agent: thread/fork failed: ${errToString(err)}`);
+        this.opts.log?.warn?.(`thread/fork failed: ${errToString(err)}`);
         return null;
     }
     async stop() {
@@ -429,7 +429,7 @@ export class CodexAppServerAdapter {
             env.PRLL_CONTEXT_FILE = this.opts.contextFilePath;
         }
         const args = ["app-server", "--listen", "stdio://"];
-        (log ?? this.opts.log)?.info?.(`codex-agent: spawning ${this.opts.codexBin} ${args.join(" ")}`);
+        (log ?? this.opts.log)?.info?.(`spawning ${this.opts.codexBin} ${args.join(" ")}`);
         const proc = spawn(IS_WIN32 ? quoteWin32Arg(this.opts.codexBin) : this.opts.codexBin, IS_WIN32 ? args.map(quoteWin32Arg) : args, {
             cwd: this.opts.workspaceDir,
             env,
@@ -438,7 +438,7 @@ export class CodexAppServerAdapter {
         });
         proc.stderr.setEncoding("utf8");
         proc.stderr.on("data", (chunk) => {
-            (log ?? this.opts.log)?.warn?.(`codex-agent[stderr]: ${chunk.trim()}`);
+            (log ?? this.opts.log)?.warn?.(`[stderr] ${chunk.trim()}`);
         });
         // Don't publish proc/client until the initialize handshake succeeds. If
         // initialize rejects (timeout, malformed handshake, app-server crash on
@@ -485,10 +485,10 @@ export class CodexAppServerAdapter {
             : `exited (code=${code ?? "null"}${signal ? `, signal=${signal}` : ""})`;
         const logger = log ?? this.opts.log;
         if (this.stopping) {
-            logger?.info?.(`codex-agent: app-server subprocess ${reason} during graceful stop`);
+            logger?.info?.(`app-server subprocess ${reason} during graceful stop`);
         }
         else {
-            logger?.warn?.(`codex-agent: app-server subprocess ${reason}; resetting adapter`);
+            logger?.warn?.(`app-server subprocess ${reason}; resetting adapter`);
         }
         this.client?.dispose(err ?? new Error(`app-server ${reason}`));
         for (const activeSink of this.activeTurns.values()) {
@@ -611,7 +611,7 @@ function ensureGitRepo(workingDirectory) {
     fs.mkdirSync(workingDirectory, { recursive: true });
     // Only `git init` if the workspace isn't already inside any git repo. A
     // bare existsSync(.git) check would miss the common case of a user pointing
-    // PRLL_CODEX_WORKSPACE_DIR at a subdirectory of their existing project,
+    // PRLL_WORKSPACE_DIR at a subdirectory of their existing project,
     // and silently creating a nested repo there would mangle their layout.
     try {
         execSync("git rev-parse --is-inside-work-tree", { cwd: workingDirectory, stdio: "pipe" });

package/dist/index.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import * as os from "node:os";
-import { ParallAgentGateway, createPlatformConfigManager, createLogger, isPlatformManagedProfile, parseShutdownDeadlineMs } from "@parall/agent-core";
+import { ParallAgentGateway, createPlatformConfigManager, createLogger, childLogger, isPlatformManagedProfile, parseShutdownDeadlineMs, parseProviderConfig, clearAllProviderCreds, llmSource } from "@parall/agent-core";
 import { ApiError, ParallClient, ParallWs } from "@parall/sdk";
 import { buildCodexRuntimeKey, contextFilePathForSession, resolveCodexAgentConfig, resolveWsUrl, sessionStateFilePathForRuntime, stepIdFilePathForSession, } from "./config.js";
 import { CodexAppServerAdapter } from "./dispatch.js";
 import { CodexSessionManager } from "./session-manager.js";
 import { ensureCodexWorkspace, ensureParallProvider, ensureWorkspaceTrusted, isParallProxyMode } from "./workspace.js";
 const log = createLogger("codex-agent");
+let activeLog = log;
 async function getAgentMeWithLegacyFallback(client, orgId) {
     try {
         return await client.getAgentMe(orgId);
@@ -19,7 +20,25 @@ async function getAgentMeWithLegacyFallback(client, orgId) {
         return { ...user, agent_profile: null };
     }
 }
+function resolveProviderEnv() {
+    const pc = parseProviderConfig(process.env);
+    if (!pc)
+        return;
+    clearAllProviderCreds(process.env);
+    const source = llmSource(pc);
+    if (source === "parall") {
+        process.env.OPENAI_API_KEY = process.env.PRLL_API_KEY;
+        process.env.OPENAI_BASE_URL = `${process.env.PRLL_API_URL}/api/llm/v1`;
+    }
+    else if (source === "custom") {
+        if (pc.openai_api_key)
+            process.env.OPENAI_API_KEY = pc.openai_api_key;
+        if (pc.openai_base_url)
+            process.env.OPENAI_BASE_URL = pc.openai_base_url;
+    }
+}
 async function main() {
+    resolveProviderEnv();
     const config = resolveCodexAgentConfig(process.env);
     const client = new ParallClient({
         baseUrl: config.apiUrl,
@@ -28,13 +47,15 @@ async function main() {
     });
     const me = await getAgentMeWithLegacyFallback(client, config.orgId);
     const agentUserId = me.id;
-    ensureWorkspaceTrusted(config.codexHome, config.workspaceDir, log);
+    const agentLog = childLogger(log, agentUserId);
+    activeLog = agentLog;
+    ensureWorkspaceTrusted(config.codexHome, config.workspaceDir, agentLog);
     const useParallProvider = isParallProxyMode();
     if (useParallProvider) {
-        ensureParallProvider(config.codexHome, config.apiUrl, log);
-        log.info("parall custom provider configured (Responses API HTTP/SSE mode)");
+        ensureParallProvider(config.codexHome, config.apiUrl, agentLog);
+        agentLog.info("parall custom provider configured (Responses API HTTP/SSE mode)");
     }
-    ensureCodexWorkspace(config.workspaceDir, log, {
+    ensureCodexWorkspace(config.workspaceDir, agentLog, {
         userId: agentUserId,
         displayName: me.display_name,
         description: me.agent_profile?.description ?? undefined,
@@ -42,21 +63,21 @@ async function main() {
     const runtimeKey = config.runtimeKey || buildCodexRuntimeKey(agentUserId);
     const mainContextFilePath = contextFilePathForSession(config.stateDir, runtimeKey);
     const sessionStateFilePath = sessionStateFilePathForRuntime(config.stateDir, runtimeKey);
-    const sessionManager = new CodexSessionManager(runtimeKey, sessionStateFilePath, log);
+    const sessionManager = new CodexSessionManager(runtimeKey, sessionStateFilePath, agentLog);
     const resolvedWsUrl = resolveWsUrl(config.apiUrl, config.wsUrl, config.swimlaneName);
     const ws = new ParallWs({
         getTicket: () => client.getWsTicket(),
         wsUrl: resolvedWsUrl,
     });
-    const configMgr = createPlatformConfigManager({ client, stateDir: config.stateDir, runtimeType: "codex", log });
+    const configMgr = createPlatformConfigManager({ client, stateDir: config.stateDir, runtimeType: "codex", log: agentLog });
     const platformDefaults = await configMgr.fetch();
     let platformManaged = isPlatformManagedProfile(me.agent_profile);
     const resolvedModel = platformManaged ? (platformDefaults.model ?? config.model) : config.model;
     const resolvedEffort = platformManaged ? (platformDefaults.thinkingEffort ?? config.reasoningEffort) : config.reasoningEffort;
     if (platformDefaults.model)
-        log.info(`platform config: model=${platformDefaults.model} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
+        agentLog.info(`platform config: model=${platformDefaults.model} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
     if (platformDefaults.thinkingEffort)
-        log.info(`platform config: reasoning_effort=${platformDefaults.thinkingEffort} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
+        agentLog.info(`platform config: reasoning_effort=${platformDefaults.thinkingEffort} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
     const adapter = new CodexAppServerAdapter({
         codexBin: config.codexBin,
         codexHome: config.codexHome,
@@ -66,7 +87,7 @@ async function main() {
         sandbox: config.sandbox,
         approvalPolicy: config.approvalPolicy,
         sessionManager,
-        log,
+        log: agentLog,
         contextFilePath: mainContextFilePath,
         useParallProvider,
     });
@@ -91,7 +112,7 @@ async function main() {
             driver: "app-server",
         },
         dispatchAdapter: adapter,
-        log,
+        log: agentLog,
         shutdownDeadlineMs: parseShutdownDeadlineMs(process.env.PRLL_SHUTDOWN_DEADLINE_MS),
         contextFilePathForSession: (sessionKey) => contextFilePathForSession(config.stateDir, sessionKey),
         stepIdFilePathForSession: (sessionKey) => stepIdFilePathForSession(config.stateDir, sessionKey),
@@ -113,13 +134,15 @@ async function main() {
                 reasoningEffort: platformManaged ? (updated.thinkingEffort ?? config.reasoningEffort) : (config.reasoningEffort ?? null),
             });
         },
+        onNewSession: () => { sessionManager.clearMainThread(); },
+        onSessionStale: () => { sessionManager.clearMainThread(); },
     });
     const abortController = new AbortController();
     const abort = () => abortController.abort();
     process.on("SIGINT", abort);
     process.on("SIGTERM", abort);
     try {
-        log.info(`starting self-hosted Codex runtime (app-server driver) for ${me.display_name} (${agentUserId})`);
+        agentLog.info(`starting self-hosted Codex runtime (app-server driver) for ${me.display_name} (${agentUserId})`);
         await gateway.run(abortController.signal);
     }
     finally {
@@ -129,6 +152,6 @@ async function main() {
     }
 }
 main().catch((err) => {
-    log.error(`fatal: ${String(err)}`);
+    activeLog.error(`fatal: ${String(err)}`);
     process.exitCode = 1;
 });

package/dist/workspace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACpC,IAAI,CAyEN;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAK/E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACpC,IAAI,CA+CN;AASD,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EACrC,aAAa,CAAC,EAAE,aAAa,GAC5B,IAAI,CAqBN"}
+{"version":3,"file":"workspace.d.ts","sourceRoot":"","sources":["../src/workspace.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACpC,IAAI,CAyEN;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAK/E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GACpC,IAAI,CA6CN;AASD,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,GAAG,CAAC,EAAE;IAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,EACrC,aAAa,CAAC,EAAE,aAAa,GAC5B,IAAI,CAqBN"}

package/dist/workspace.js

@@ -145,14 +145,12 @@ export function ensureParallProvider(codexHome, apiUrl, log) {
         ].join("\n");
         const headerIdx = content.indexOf(sectionHeader);
         if (headerIdx !== -1) {
-            const sectionEnd = findSectionEnd(content, headerIdx + sectionHeader.length + 1);
-            // Only consume a contiguous [model_providers.parall.auth] subtable —
-            // one that sits within the provider's own section, not after unrelated
-            // tables that happen to appear between provider and auth.
-            const authIdx = content.indexOf(authHeader, headerIdx);
-            const blockEnd = authIdx !== -1 && authIdx < sectionEnd
-                ? findSectionEnd(content, authIdx + authHeader.length + 1)
-                : sectionEnd;
+            let blockEnd = findSectionEnd(content, headerIdx + sectionHeader.length + 1);
+            let authIdx = content.indexOf(authHeader, blockEnd);
+            while (authIdx !== -1 && content.substring(blockEnd, authIdx).trim() === "") {
+                blockEnd = findSectionEnd(content, authIdx + authHeader.length + 1);
+                authIdx = content.indexOf(authHeader, blockEnd);
+            }
             content = content.substring(0, headerIdx) + providerBlock + content.substring(blockEnd);
         }
         else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@parall/codex-agent",
-  "version": "1.29.3",
+  "version": "1.31.0",
   "description": "Codex CLI bridge runtime for self-hosted Parall agents",
   "license": "MIT",
   "repository": {
@@ -26,9 +26,9 @@
   ],
   "dependencies": {
     "smol-toml": "^1.6.1",
-    "@parall/agent-core": "1.29.3",
-    "@parall/cli": "1.29.3",
-    "@parall/sdk": "1.29.3"
+    "@parall/cli": "1.31.0",
+    "@parall/agent-core": "1.31.0",
+    "@parall/sdk": "1.31.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",

package/src/config.ts

@@ -63,10 +63,10 @@ export function resolveCodexAgentConfig(env: NodeJS.ProcessEnv = process.env): C
   // Bridge state lives outside CODEX_HOME to avoid polluting codex's own
   // directory with non-codex files.
   const stateDir = resolvePath(
-    env.PRLL_CODEX_STATE_DIR?.trim()
+    env.PRLL_STATE_DIR?.trim()
       || path.join(env.HOME || os.homedir(), ".parall-agent"),
   );
-  const workspaceDir = resolvePath(env.PRLL_CODEX_WORKSPACE_DIR?.trim() || path.join(stateDir, "workspace"));
+  const workspaceDir = resolvePath(env.PRLL_WORKSPACE_DIR?.trim() || path.join(stateDir, "workspace"));
 
   return {
     apiUrl,

package/src/dispatch.ts

@@ -94,7 +94,7 @@ export class CodexAppServerAdapter implements DispatchAdapter {
     const existing = this.activeTurns.get(threadId);
     if (existing) {
       (log ?? this.opts.log)?.warn?.(
-        `codex-agent: thread ${threadId} already had an active turn; failing the previous dispatch`,
+        `thread ${threadId} already had an active turn; failing the previous dispatch`,
       );
       existing.push({ kind: "error", message: `thread ${threadId} replaced by concurrent turn` });
       existing.close();
@@ -125,7 +125,7 @@ export class CodexAppServerAdapter implements DispatchAdapter {
       this.pendingInjections.set(sessionKey, (this.pendingInjections.get(sessionKey) ?? 0) + 1);
       return true;
     } catch (err) {
-      this.opts.log?.warn?.(`codex-agent: turn/steer failed: ${errToString(err)}`);
+      this.opts.log?.warn?.(`turn/steer failed: ${errToString(err)}`);
       return false;
     }
   }
@@ -141,7 +141,7 @@ export class CodexAppServerAdapter implements DispatchAdapter {
       const threadId = this.opts.sessionManager.getThreadId(sessionKey);
       if (threadId && this.client && !this.client.isDisposed()) {
         (this.opts.log ?? context.log)?.info?.(
-          `codex-agent[${context.accountId}]: ${pending} steer injection(s) already sent; skipping turn/start`,
+          `${pending} steer injection(s) already sent; skipping turn/start`,
         );
         yield {
           type: "runtime_session",
@@ -151,7 +151,7 @@ export class CodexAppServerAdapter implements DispatchAdapter {
         return;
       }
       (this.opts.log ?? context.log)?.warn?.(
-        `codex-agent[${context.accountId}]: pending steer invalidated (subprocess died); falling through to normal dispatch`,
+        `pending steer invalidated (subprocess died); falling through to normal dispatch`,
       );
     }
 
@@ -195,7 +195,7 @@ export class CodexAppServerAdapter implements DispatchAdapter {
         this.opts.sessionManager.recordThreadId(sessionKey, threadId);
         this.resumedThreadIds.add(threadId);
       } catch (err) {
-        log?.warn?.(`codex-agent: thread/resume failed (${errToString(err)}); attempting one-shot fresh-thread start`);
+        log?.warn?.(`thread/resume failed (${errToString(err)}); attempting one-shot fresh-thread start`);
         let freshThreadId: string;
         try {
           freshThreadId = await this.openThread(client, { resumeId: undefined });
@@ -231,7 +231,7 @@ export class CodexAppServerAdapter implements DispatchAdapter {
         preparedImages = prepared.attachments.images;
         releasePreparedAttachments = pinLocalAttachmentPaths(preparedImages);
       } catch (err) {
-        log?.warn?.(`codex-agent[${context.accountId}]: failed to prepare local attachments: ${errToString(err)}`);
+        log?.warn?.(`failed to prepare local attachments: ${errToString(err)}`);
       }
       // `localImage` is a first-class variant of `UserInput` in the Codex
       // app-server protocol (codex-rs/app-server-protocol/src/protocol/v2.rs
@@ -269,7 +269,7 @@ export class CodexAppServerAdapter implements DispatchAdapter {
           yield { type: "error", message: `Codex turn/start failed: ${message}` };
           return;
         }
-        log?.warn?.(`codex-agent: turn/start on thread ${threadId} failed (${message}); attempting one-shot fresh-thread retry`);
+        log?.warn?.(`turn/start on thread ${threadId} failed (${message}); attempting one-shot fresh-thread retry`);
         this.activeTurns.delete(threadId);
         let freshThreadId: string;
         try {
@@ -382,7 +382,7 @@ export class CodexAppServerAdapter implements DispatchAdapter {
       const result = await client.sendRequest("thread/fork", forkParams);
       const forkedThreadId = extractThreadId(result);
       if (!forkedThreadId) {
-        this.opts.log?.warn?.("codex-agent: thread/fork returned no thread id");
+        this.opts.log?.warn?.("thread/fork returned no thread id");
         return null;
       }
       this.opts.sessionManager.recordThreadId(handle.sessionKey, forkedThreadId);
@@ -397,7 +397,7 @@ export class CodexAppServerAdapter implements DispatchAdapter {
   }
 
   private logForkFailure(err: unknown): null {
-    this.opts.log?.warn?.(`codex-agent: thread/fork failed: ${errToString(err)}`);
+    this.opts.log?.warn?.(`thread/fork failed: ${errToString(err)}`);
     return null;
   }
 
@@ -467,7 +467,7 @@ export class CodexAppServerAdapter implements DispatchAdapter {
       env.PRLL_CONTEXT_FILE = this.opts.contextFilePath;
     }
     const args = ["app-server", "--listen", "stdio://"];
-    (log ?? this.opts.log)?.info?.(`codex-agent: spawning ${this.opts.codexBin} ${args.join(" ")}`);
+    (log ?? this.opts.log)?.info?.(`spawning ${this.opts.codexBin} ${args.join(" ")}`);
     const proc = spawn(
       IS_WIN32 ? quoteWin32Arg(this.opts.codexBin) : this.opts.codexBin,
       IS_WIN32 ? args.map(quoteWin32Arg) : args, {
@@ -479,7 +479,7 @@ export class CodexAppServerAdapter implements DispatchAdapter {
 
     proc.stderr.setEncoding("utf8");
     proc.stderr.on("data", (chunk: string) => {
-      (log ?? this.opts.log)?.warn?.(`codex-agent[stderr]: ${chunk.trim()}`);
+      (log ?? this.opts.log)?.warn?.(`[stderr] ${chunk.trim()}`);
     });
 
     // Don't publish proc/client until the initialize handshake succeeds. If
@@ -535,9 +535,9 @@ export class CodexAppServerAdapter implements DispatchAdapter {
       : `exited (code=${code ?? "null"}${signal ? `, signal=${signal}` : ""})`;
     const logger = log ?? this.opts.log;
     if (this.stopping) {
-      logger?.info?.(`codex-agent: app-server subprocess ${reason} during graceful stop`);
+      logger?.info?.(`app-server subprocess ${reason} during graceful stop`);
     } else {
-      logger?.warn?.(`codex-agent: app-server subprocess ${reason}; resetting adapter`);
+      logger?.warn?.(`app-server subprocess ${reason}; resetting adapter`);
     }
     this.client?.dispose(err ?? new Error(`app-server ${reason}`));
     for (const activeSink of this.activeTurns.values()) {
@@ -671,7 +671,7 @@ function ensureGitRepo(workingDirectory: string): void {
   fs.mkdirSync(workingDirectory, { recursive: true });
   // Only `git init` if the workspace isn't already inside any git repo. A
   // bare existsSync(.git) check would miss the common case of a user pointing
-  // PRLL_CODEX_WORKSPACE_DIR at a subdirectory of their existing project,
+  // PRLL_WORKSPACE_DIR at a subdirectory of their existing project,
   // and silently creating a nested repo there would mangle their layout.
   try {
     execSync("git rev-parse --is-inside-work-tree", { cwd: workingDirectory, stdio: "pipe" });

package/src/index.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 import * as os from "node:os";
-import { ParallAgentGateway, createPlatformConfigManager, createLogger, isPlatformManagedProfile, parseShutdownDeadlineMs } from "@parall/agent-core";
+import { ParallAgentGateway, createPlatformConfigManager, createLogger, childLogger, isPlatformManagedProfile, parseShutdownDeadlineMs, parseProviderConfig, clearAllProviderCreds, llmSource } from "@parall/agent-core";
 import { ApiError, ParallClient, ParallWs } from "@parall/sdk";
 import {
   buildCodexRuntimeKey,
@@ -16,6 +16,7 @@ import { CodexSessionManager } from "./session-manager.js";
 import { ensureCodexWorkspace, ensureParallProvider, ensureWorkspaceTrusted, isParallProxyMode } from "./workspace.js";
 
 const log = createLogger("codex-agent");
+let activeLog = log;
 
 async function getAgentMeWithLegacyFallback(client: ParallClient, orgId: string) {
   try {
@@ -29,7 +30,22 @@ async function getAgentMeWithLegacyFallback(client: ParallClient, orgId: string)
   }
 }
 
+function resolveProviderEnv(): void {
+  const pc = parseProviderConfig(process.env);
+  if (!pc) return;
+  clearAllProviderCreds(process.env);
+  const source = llmSource(pc);
+  if (source === "parall") {
+    process.env.OPENAI_API_KEY = process.env.PRLL_API_KEY;
+    process.env.OPENAI_BASE_URL = `${process.env.PRLL_API_URL}/api/llm/v1`;
+  } else if (source === "custom") {
+    if (pc.openai_api_key) process.env.OPENAI_API_KEY = pc.openai_api_key;
+    if (pc.openai_base_url) process.env.OPENAI_BASE_URL = pc.openai_base_url;
+  }
+}
+
 async function main() {
+  resolveProviderEnv();
   const config = resolveCodexAgentConfig(process.env);
 
   const client = new ParallClient({
@@ -40,13 +56,15 @@ async function main() {
 
   const me = await getAgentMeWithLegacyFallback(client, config.orgId);
   const agentUserId = me.id;
-  ensureWorkspaceTrusted(config.codexHome, config.workspaceDir, log);
+  const agentLog = childLogger(log, agentUserId);
+  activeLog = agentLog;
+  ensureWorkspaceTrusted(config.codexHome, config.workspaceDir, agentLog);
   const useParallProvider = isParallProxyMode();
   if (useParallProvider) {
-    ensureParallProvider(config.codexHome, config.apiUrl, log);
-    log.info("parall custom provider configured (Responses API HTTP/SSE mode)");
+    ensureParallProvider(config.codexHome, config.apiUrl, agentLog);
+    agentLog.info("parall custom provider configured (Responses API HTTP/SSE mode)");
   }
-  ensureCodexWorkspace(config.workspaceDir, log, {
+  ensureCodexWorkspace(config.workspaceDir, agentLog, {
     userId: agentUserId,
     displayName: me.display_name,
     description: me.agent_profile?.description ?? undefined,
@@ -57,7 +75,7 @@ async function main() {
   const sessionManager = new CodexSessionManager(
     runtimeKey,
     sessionStateFilePath,
-    log,
+    agentLog,
   );
 
   const resolvedWsUrl = resolveWsUrl(config.apiUrl, config.wsUrl, config.swimlaneName);
@@ -66,13 +84,13 @@ async function main() {
     wsUrl: resolvedWsUrl,
   });
 
-  const configMgr = createPlatformConfigManager({ client, stateDir: config.stateDir, runtimeType: "codex", log });
+  const configMgr = createPlatformConfigManager({ client, stateDir: config.stateDir, runtimeType: "codex", log: agentLog });
   const platformDefaults = await configMgr.fetch();
   let platformManaged = isPlatformManagedProfile(me.agent_profile);
   const resolvedModel = platformManaged ? (platformDefaults.model ?? config.model) : config.model;
   const resolvedEffort = platformManaged ? (platformDefaults.thinkingEffort ?? config.reasoningEffort) : config.reasoningEffort;
-  if (platformDefaults.model) log.info(`platform config: model=${platformDefaults.model} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
-  if (platformDefaults.thinkingEffort) log.info(`platform config: reasoning_effort=${platformDefaults.thinkingEffort} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
+  if (platformDefaults.model) agentLog.info(`platform config: model=${platformDefaults.model} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
+  if (platformDefaults.thinkingEffort) agentLog.info(`platform config: reasoning_effort=${platformDefaults.thinkingEffort} (${platformManaged ? "applied" : "ignored, model_management=self"})`);
 
   const adapter = new CodexAppServerAdapter({
     codexBin: config.codexBin,
@@ -83,7 +101,7 @@ async function main() {
     sandbox: config.sandbox,
     approvalPolicy: config.approvalPolicy,
     sessionManager,
-    log,
+    log: agentLog,
     contextFilePath: mainContextFilePath,
     useParallProvider,
   });
@@ -109,7 +127,7 @@ async function main() {
       driver: "app-server",
     },
     dispatchAdapter: adapter,
-    log,
+    log: agentLog,
     shutdownDeadlineMs: parseShutdownDeadlineMs(process.env.PRLL_SHUTDOWN_DEADLINE_MS),
     contextFilePathForSession: (sessionKey) => contextFilePathForSession(config.stateDir, sessionKey),
     stepIdFilePathForSession: (sessionKey) => stepIdFilePathForSession(config.stateDir, sessionKey),
@@ -131,6 +149,8 @@ async function main() {
         reasoningEffort: platformManaged ? (updated.thinkingEffort ?? config.reasoningEffort) : (config.reasoningEffort ?? null),
       });
     },
+    onNewSession: () => { sessionManager.clearMainThread(); },
+    onSessionStale: () => { sessionManager.clearMainThread(); },
   });
 
   const abortController = new AbortController();
@@ -139,7 +159,7 @@ async function main() {
   process.on("SIGTERM", abort);
 
   try {
-    log.info(`starting self-hosted Codex runtime (app-server driver) for ${me.display_name} (${agentUserId})`);
+    agentLog.info(`starting self-hosted Codex runtime (app-server driver) for ${me.display_name} (${agentUserId})`);
     await gateway.run(abortController.signal);
   } finally {
     await adapter.stop();
@@ -149,6 +169,6 @@ async function main() {
 }
 
 main().catch((err) => {
-  log.error(`fatal: ${String(err)}`);
+  activeLog.error(`fatal: ${String(err)}`);
   process.exitCode = 1;
 });

package/src/workspace.ts

@@ -159,14 +159,12 @@ export function ensureParallProvider(
 
     const headerIdx = content.indexOf(sectionHeader);
     if (headerIdx !== -1) {
-      const sectionEnd = findSectionEnd(content, headerIdx + sectionHeader.length + 1);
-      // Only consume a contiguous [model_providers.parall.auth] subtable —
-      // one that sits within the provider's own section, not after unrelated
-      // tables that happen to appear between provider and auth.
-      const authIdx = content.indexOf(authHeader, headerIdx);
-      const blockEnd = authIdx !== -1 && authIdx < sectionEnd
-        ? findSectionEnd(content, authIdx + authHeader.length + 1)
-        : sectionEnd;
+      let blockEnd = findSectionEnd(content, headerIdx + sectionHeader.length + 1);
+      let authIdx = content.indexOf(authHeader, blockEnd);
+      while (authIdx !== -1 && content.substring(blockEnd, authIdx).trim() === "") {
+        blockEnd = findSectionEnd(content, authIdx + authHeader.length + 1);
+        authIdx = content.indexOf(authHeader, blockEnd);
+      }
       content = content.substring(0, headerIdx) + providerBlock + content.substring(blockEnd);
     } else {
       content = content.trimEnd() + "\n\n" + providerBlock + "\n";