@runuai/host 0.8.42 → 0.8.43

package/lib/codex-auth.ts

@@ -6,8 +6,10 @@
  * task-up (`scripts/agent/task-up.sh`). When the owner re-logs into Codex —
  * the refresh token gets revoked (a login elsewhere) and `codex login` rewrites
  * `~/.codex/auth.json` — already-running containers keep their stale copy, so a
- * re-login otherwise only helps NEW tasks. This re-copies the fresh `~/.codex`
- * into the running task containers so live tasks self-heal.
+ * re-login otherwise only helps NEW tasks. The live sweep refreshes the
+ * credential-bearing copy while deliberately preserving the container's
+ * `config.toml`: browser/MCP setup owns that live file and serializes its
+ * updates with agent spawning.
  *
  * Three triggers, covering every path:
  *   - {@link watchCodexAuth} — fs.watch on `~/.codex`, for `codex login` run
@@ -40,7 +42,6 @@ import { isNull } from "drizzle-orm";
 
 import { getDb, schema } from "./db";
 import { dockerCli } from "./docker-exec";
-import { provisionEngineAccounts } from "./engine-accounts";
 
 /** The exact set task-up.sh copies into `/home/node/.codex`. */
 const CODEX_ITEMS = [
@@ -51,6 +52,8 @@ const CODEX_ITEMS = [
   "installation_id",
   "rules",
 ] as const;
+/** Live auth refresh must not overwrite MCP configuration in a running task. */
+const LIVE_CODEX_ITEMS = CODEX_ITEMS.filter((item) => item !== "config.toml");
 const EXEC_TIMEOUT_MS = 15_000;
 
 /** Injectable seams (defaults hit the real DB / docker / fs) so the copy logic
@@ -107,7 +110,11 @@ async function dockerRunningNames(
  * 501:20 are unreadable to the container's node). Any nonzero step throws
  * with the step name and docker's stderr — never file contents.
  */
-async function copyCodexInto(container: string, deps: CodexDeps): Promise<void> {
+async function copyCodexInto(
+  container: string,
+  deps: CodexDeps,
+  items: readonly (typeof CODEX_ITEMS)[number][] = CODEX_ITEMS,
+): Promise<void> {
   const exec = deps.exec ?? defaultExec;
   const exists = deps.fileExists ?? existsSync;
   const dir = ownerCodexDir();
@@ -125,7 +132,7 @@ async function copyCodexInto(container: string, deps: CodexDeps): Promise<void>
     ["exec", "-u", "root", container, "mkdir", "-p", "/home/node/.codex"],
     "mkdir /home/node/.codex",
   );
-  for (const item of CODEX_ITEMS) {
+  for (const item of items) {
     const src = join(dir, item);
     if (!exists(src)) continue;
     await must(["cp", src, `${container}:/home/node/.codex/`], `docker cp ${item}`);
@@ -163,11 +170,14 @@ export async function injectCodexIntoContainer(
 }
 
 /**
- * Re-copy the freshly (re)logged-in `~/.codex` into every task container that
- * is both DB-active AND confirmed running by docker. No-op when there is no
- * `~/.codex/auth.json` or no active tasks; skipped entirely (with a warning)
- * when docker doesn't answer. Per-container failures are surfaced and don't
- * stop the sweep.
+ * Refresh the freshly (re)logged-in Codex files in every task container that
+ * is both DB-active AND confirmed running by docker. `config.toml` is excluded:
+ * copying the host's file over a live task races the orchestrator's managed MCP
+ * writer and can erase the browser definition after readiness was established.
+ * Recovery/start injection still uses the full item set above, before agents
+ * can spawn. No-op when there is no `~/.codex/auth.json` or no active tasks;
+ * skipped entirely (with a warning) when docker doesn't answer. Per-container
+ * failures are surfaced and don't stop the sweep.
  */
 export async function reinjectCodexRunningTasks(deps: CodexDeps = {}): Promise<void> {
   const exists = deps.fileExists ?? existsSync;
@@ -189,18 +199,15 @@ export async function reinjectCodexRunningTasks(deps: CodexDeps = {}): Promise<v
     );
   }
   if (targets.length === 0) return;
-  console.log(`[codex] re-copying ~/.codex into ${targets.length} running task(s)`);
+  console.log(`[codex] refreshing auth in ${targets.length} running task(s)`);
   for (const container of targets) {
     try {
-      await copyCodexInto(container, deps);
+      await copyCodexInto(container, deps, LIVE_CODEX_ITEMS);
     } catch (err) {
       console.error(
         `[codex] reinject into ${container} failed: ${err instanceof Error ? err.message : err}`,
       );
     }
-    // ADR-076: also refresh EXTRA config-dir accounts (codex + opencode) so a
-    // newly-added second account reaches running tasks, same as the default.
-    await provisionEngineAccounts(container, ["codex", "opencode"]);
   }
 }
 

package/lib/engine-accounts.ts

@@ -380,29 +380,47 @@ async function copyDirInto(
 /**
  * Copy every EXTRA config-dir account (for the given kinds) into its per-account
  * container dir + chown. The DEFAULT account is copied by task-up.sh, so it is
- * skipped here. Best-effort per account — a failure is logged (no secrets) and
- * that account simply won't authenticate in this container.
+ * skipped here. Best-effort per account — failures are logged (no secrets) and
+ * reported in aggregate so the orchestrator can retry without hot-looping.
  */
+export interface ProvisionEngineAccountsResult {
+  copied: number;
+  failed: number;
+  mayHaveMutated: boolean;
+}
+
 export async function provisionEngineAccounts(
   container: string,
   kinds: Iterable<string>,
   seams: Partial<AccountSeams> = {},
-): Promise<void> {
+): Promise<ProvisionEngineAccountsResult> {
   const s = withDefaults(seams);
   const seen = new Set<string>();
+  let copied = 0;
+  let failed = 0;
+  let mayHaveMutated = false;
   for (const kind of kinds) {
     if (seen.has(kind)) continue;
     seen.add(kind);
     for (const account of resolveEngineAccounts(kind, s)) {
       if (account.isDefault || !account.configDir) continue;
-      if (!s.fileExists(account.configDir.hostDir)) continue;
+      if (!s.fileExists(account.configDir.hostDir)) {
+        failed += 1;
+        continue;
+      }
       try {
         await copyDirInto(
           account.configDir.hostDir,
           account.configDir.containerDir,
           container,
         );
+        copied += 1;
       } catch (err) {
+        failed += 1;
+        // copyDirInto performs more than one external operation. A non-zero
+        // result can therefore mean the destination changed before the
+        // failure surfaced; callers must fence/reassert managed config.
+        mayHaveMutated = true;
         console.error(
           `[engine-accounts] provision ${kind}/${account.id} into ${container}: ` +
             `${err instanceof Error ? err.message : err} — this account won't authenticate in the task`,
@@ -410,6 +428,7 @@ export async function provisionEngineAccounts(
       }
     }
   }
+  return { copied, failed, mayHaveMutated };
 }
 
 // ---------------------------------------------------------------------------

package/lib/mcp-config-lock.ts

@@ -0,0 +1,2 @@
+/** Serializes Uai's in-container writers for managed Claude/Codex MCP files. */
+export const MCP_CONFIG_LOCK_PATH = "/tmp/.uai-mcp-config.lock";

package/lib/mcp-gateway.ts

@@ -24,6 +24,7 @@ import { resolve } from "node:path";
 
 import { env } from "./env";
 import { dockerCli } from "./docker-exec";
+import { MCP_CONFIG_LOCK_PATH } from "./mcp-config-lock";
 import { authHeaderFor, getConnection } from "./mcp-connections";
 
 export const MCP_GATEWAY_PORT = Number(process.env.UAI_MCP_GATEWAY_PORT ?? 5877);
@@ -275,27 +276,373 @@ export function startMcpGateway(): void {
  *  Claude's /workspace/.mcp.json + Cursor's ~/.cursor/mcp.json (mcpServers)
  *  and OpenCode's ~/.config/opencode/opencode.json (mcp). Creates the parent
  *  dir when missing. */
-const MERGE_MCP_JSON = `
+export const MERGE_MCP_JSON = `
 const fs = require("fs");
 const path = require("path");
+const crypto = require("crypto");
 const p = process.argv[1];
 const key = process.argv[3] || "mcpServers";
-try { fs.mkdirSync(path.dirname(p), { recursive: true }); } catch {}
+const plainObject = (value) =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
+fs.mkdirSync(path.dirname(p), { recursive: true });
+let original = null;
 let j = {};
-let existed = true;
-try { j = JSON.parse(fs.readFileSync(p, "utf8")); } catch { existed = false; }
-j[key] = j[key] || {};
+try {
+  original = fs.readFileSync(p, "utf8");
+  j = JSON.parse(original);
+} catch (error) {
+  if (!error || error.code !== "ENOENT") throw error;
+}
+if (!plainObject(j)) throw new Error("MCP config root must be an object");
+if (j[key] === undefined) j[key] = {};
+if (!plainObject(j[key])) {
+  throw new Error("MCP config " + key + " must be an object");
+}
 let changed = false;
 for (const [k, v] of Object.entries(JSON.parse(process.argv[2]))) {
   if (JSON.stringify(j[key][k]) !== JSON.stringify(v)) { j[key][k] = v; changed = true; }
 }
-if (changed || !existed) fs.writeFileSync(p, JSON.stringify(j, null, 2) + "\\n");
+if (changed || original === null) {
+  const mode = original === null ? 0o644 : fs.statSync(p).mode & 0o777;
+  const tmp = path.join(
+    path.dirname(p),
+    "." + path.basename(p) + "." + process.pid + "." +
+      crypto.randomBytes(8).toString("hex") + ".tmp"
+  );
+  try {
+    fs.writeFileSync(tmp, JSON.stringify(j, null, 2) + "\\n", {
+      encoding: "utf8",
+      flag: "wx",
+      mode,
+    });
+    let current = null;
+    try {
+      current = fs.readFileSync(p, "utf8");
+    } catch (error) {
+      if (!error || error.code !== "ENOENT") throw error;
+    }
+    if (current !== original) {
+      throw new Error("MCP config changed concurrently");
+    }
+    fs.renameSync(tmp, p);
+  } finally {
+    try { fs.unlinkSync(tmp); } catch {}
+  }
+}
+`.trim();
+
+/**
+ * Ensure the host-gateway MCP definitions in one Codex home.
+ *
+ * Codex itself is the TOML parser. This matters because a text search cannot
+ * distinguish `[mcp_servers.foo]` from a comment/string, and quoted or spaced
+ * spellings name the same TOML table. A same-name definition is accepted only
+ * when Codex reports the exact shape Uai writes; foreign definitions and
+ * malformed configs fail without being modified.
+ */
+export const ENSURE_CODEX_MCP_TOML = String.raw`
+const fs = require("fs");
+const path = require("path");
+const crypto = require("crypto");
+const child = require("child_process");
+
+const home = process.argv[1];
+const desired = JSON.parse(process.argv[2]);
+const codexBin = process.argv[3] || "codex";
+const plainObject = (value) =>
+  value !== null && typeof value === "object" && !Array.isArray(value);
+if (typeof home !== "string" || !path.isAbsolute(home)) {
+  throw new Error("Codex home must be an absolute path");
+}
+if (!plainObject(desired)) {
+  throw new Error("Codex MCP definitions must be an object");
+}
+for (const [slug, url] of Object.entries(desired)) {
+  if (!/^[a-z0-9][a-z0-9-]{0,63}$/.test(slug)) {
+    throw new Error("invalid Codex MCP slug");
+  }
+  if (typeof url !== "string") {
+    throw new Error("invalid Codex MCP URL");
+  }
+}
+
+fs.mkdirSync(home, { recursive: true });
+const file = path.join(home, "config.toml");
+let original = null;
+try {
+  original = fs.readFileSync(file, "utf8");
+} catch (error) {
+  if (!error || error.code !== "ENOENT") throw error;
+}
+
+function runCodex(args) {
+  return child.spawnSync(codexBin, args, {
+    encoding: "utf8",
+    env: Object.assign({}, process.env, { CODEX_HOME: home }),
+    maxBuffer: 1024 * 1024,
+    timeout: 5000,
+    killSignal: "SIGKILL",
+  });
+}
+
+function detail(result) {
+  const lines = String(result.stderr || "")
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter(Boolean);
+  return String(lines.pop() || result.error || result.status);
+}
+
+function exactKeys(value, keys) {
+  return plainObject(value) &&
+    Object.keys(value).sort().join("\0") === keys.slice().sort().join("\0");
+}
+
+function managedDefinitionUrl(value, slug) {
+  const topKeys = [
+    "disabled_reason", "disabled_tools", "enabled", "enabled_tools", "name",
+    "startup_timeout_sec", "tool_timeout_sec", "transport"
+  ];
+  const transportKeys = ["args", "command", "cwd", "env", "env_vars", "type"];
+  if (!(exactKeys(value, topKeys) &&
+    value.name === slug &&
+    value.enabled === true &&
+    value.disabled_reason === null &&
+    value.enabled_tools === null &&
+    value.disabled_tools === null &&
+    value.startup_timeout_sec === null &&
+    value.tool_timeout_sec === null &&
+    exactKeys(value.transport, transportKeys) &&
+    value.transport.type === "stdio" &&
+    value.transport.command === "npx" &&
+    Array.isArray(value.transport.args) &&
+    value.transport.args.length === 4 &&
+    value.transport.args[0] === "-y" &&
+    value.transport.args[1] === "mcp-remote" &&
+    typeof value.transport.args[2] === "string" &&
+    value.transport.args[3] === "--allow-http" &&
+    value.transport.cwd === null &&
+    value.transport.env === null &&
+    Array.isArray(value.transport.env_vars) &&
+    value.transport.env_vars.length === 0)) {
+    return null;
+  }
+  return value.transport.args[2];
+}
+
+function exactDefinition(value, slug, url) {
+  return managedDefinitionUrl(value, slug) === url;
+}
+
+function gatewayIdentity(value, slug) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    return null;
+  }
+  if (parsed.username || parsed.password || parsed.search || parsed.hash) {
+    return null;
+  }
+  const segments = parsed.pathname.split("/").filter(Boolean);
+  if (segments.length !== 3 || segments[0] !== "t" || segments[2] !== slug) {
+    return null;
+  }
+  const token = /^([A-Za-z0-9_-]+)\.([A-Za-z0-9_-]+)$/.exec(segments[1]);
+  if (!token) return null;
+  return { origin: parsed.origin, taskId: token[1] };
+}
+
+function sameTaskGateway(oldUrl, desiredUrl, slug) {
+  const oldIdentity = gatewayIdentity(oldUrl, slug);
+  const desiredIdentity = gatewayIdentity(desiredUrl, slug);
+  return oldIdentity !== null &&
+    desiredIdentity !== null &&
+    oldIdentity.origin === desiredIdentity.origin &&
+    oldIdentity.taskId === desiredIdentity.taskId;
+}
+
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^$(){}|[\]\\]/g, "\\$&");
+}
+
+/**
+ * Replace only the URL token inside a raw block Uai can prove it authored.
+ * The exact legacy three-line shape predates the marker. New blocks carry the
+ * ADR-057 marker. A quoted/spaced header, extra field, or neighboring body
+ * text is deliberately foreign even if Codex normalizes it to the same JSON.
+ */
+function rewriteManagedRawBlock(text, slug, oldUrl, desiredUrl) {
+  const prefix =
+    "(^|\\r?\\n)\\[mcp_servers\\." + escapeRegExp(slug) + "\\]\\r?\\n" +
+    "command = \\\"npx\\\"\\r?\\n";
+  const legacyPattern = new RegExp(
+    prefix +
+      "args = \\[\\\"-y\\\", \\\"mcp-remote\\\", " +
+      escapeRegExp(JSON.stringify(oldUrl)) +
+      ", \\\"--allow-http\\\"\\](?=\\r?\\n|$)",
+    "g"
+  );
+  const markedPattern = new RegExp(
+    "(^|\\r?\\n)# uai ADR-057: host MCP gateway\\r?\\n" +
+      "\\[mcp_servers\\." + escapeRegExp(slug) + "\\]\\r?\\n" +
+      "command = \\\"npx\\\"\\r?\\n" +
+      "args = " +
+      escapeRegExp(JSON.stringify([
+        "-y", "mcp-remote", oldUrl, "--allow-http"
+      ])) +
+      "(?=\\r?\\n|$)",
+    "g"
+  );
+  const matches = [
+    ...Array.from(text.matchAll(legacyPattern)),
+    ...Array.from(text.matchAll(markedPattern)),
+  ].filter((match) => {
+    const after = (match.index || 0) + match[0].length;
+    const remainder = text.slice(after);
+    const nextHeader = remainder.search(
+      /^[ \t]*\[\[?.+\]\]?[ \t]*(?:#.*)?\r?$/m
+    );
+    const gap = nextHeader === -1 ? remainder : remainder.slice(0, nextHeader);
+    return gap.split(/\r?\n/).every((line) => {
+      const trimmed = line.trim();
+      return trimmed === "" || trimmed.startsWith("#");
+    });
+  });
+  if (matches.length !== 1) return null;
+  const match = matches[0];
+  const start = match.index || 0;
+  const replacement = match[0].replace(
+    JSON.stringify(oldUrl),
+    JSON.stringify(desiredUrl)
+  );
+  return text.slice(0, start) + replacement + text.slice(start + match[0].length);
+}
+
+function getDefinition(slug) {
+  const result = runCodex(["mcp", "get", slug, "--json"]);
+  if (result.status !== 0) {
+    throw new Error("codex mcp get " + slug + " failed: " + detail(result));
+  }
+  let value;
+  try {
+    value = JSON.parse(result.stdout);
+  } catch {
+    throw new Error("codex mcp get " + slug + " returned invalid JSON");
+  }
+  return value;
+}
+
+// One list call validates the whole TOML document and identifies truly absent
+// servers. A malformed document therefore fails before any append.
+const listedResult = runCodex(["mcp", "list", "--json"]);
+if (listedResult.status !== 0) {
+  throw new Error("Codex config is invalid: " + detail(listedResult));
+}
+let listed;
+try {
+  listed = JSON.parse(listedResult.stdout);
+} catch {
+  throw new Error("codex mcp list returned invalid JSON");
+}
+if (!Array.isArray(listed) ||
+    !listed.every((entry) => plainObject(entry) && typeof entry.name === "string")) {
+  throw new Error("codex mcp list returned an invalid server list");
+}
+
+const missing = [];
+const rewrites = [];
+for (const [slug, url] of Object.entries(desired)) {
+  const matches = listed.filter((entry) => entry.name === slug);
+  if (matches.length === 0) {
+    missing.push([slug, url]);
+    continue;
+  }
+  if (matches.length !== 1) {
+    throw new Error("Codex MCP server " + slug + " is foreign - left unchanged");
+  }
+  const definition = getDefinition(slug);
+  if (exactDefinition(definition, slug, url)) continue;
+  const oldUrl = managedDefinitionUrl(definition, slug);
+  if (oldUrl === null || !sameTaskGateway(oldUrl, url, slug)) {
+    throw new Error("Codex MCP server " + slug + " is foreign - left unchanged");
+  }
+  rewrites.push([slug, oldUrl, url]);
+}
+if (missing.length === 0 && rewrites.length === 0) process.exit(0);
+
+const newline = original && original.includes("\r\n") ? "\r\n" : "\n";
+const blocks = missing.map(([slug, url]) => [
+  "# uai ADR-057: host MCP gateway",
+  "[mcp_servers." + slug + "]",
+  'command = "npx"',
+  "args = " + JSON.stringify(["-y", "mcp-remote", url, "--allow-http"]),
+  "",
+].join(newline)).join(newline);
+let next = original || "";
+for (const [slug, oldUrl, desiredUrl] of rewrites) {
+  const rewritten = rewriteManagedRawBlock(next, slug, oldUrl, desiredUrl);
+  if (rewritten === null) {
+    throw new Error("Codex MCP server " + slug + " has foreign TOML text - left unchanged");
+  }
+  next = rewritten;
+}
+if (next.length > 0 && !next.endsWith("\n")) next += newline;
+if (blocks.length > 0) {
+  if (next.length > 0 && !next.endsWith(newline + newline)) next += newline;
+  next += blocks;
+}
+
+const mode = original === null ? 0o644 : fs.statSync(file).mode & 0o777;
+const tmp = path.join(
+  home,
+  "." + path.basename(file) + "." + process.pid + "." +
+    crypto.randomBytes(8).toString("hex") + ".tmp"
+);
+try {
+  fs.writeFileSync(tmp, next, {
+    encoding: "utf8",
+    flag: "wx",
+    mode,
+  });
+  let current = null;
+  try {
+    current = fs.readFileSync(file, "utf8");
+  } catch (error) {
+    if (!error || error.code !== "ENOENT") throw error;
+  }
+  if (current !== original) {
+    throw new Error("Codex config changed concurrently");
+  }
+  fs.renameSync(tmp, file);
+} finally {
+  try { fs.unlinkSync(tmp); } catch {}
+}
+
+// Do not memoize a syntactically bad append/rewrite as success. Codex is again
+// the authority, and every changed definition must normalize exactly.
+for (const [slug, url] of [
+  ...missing,
+  ...rewrites.map(([slug, _oldUrl, url]) => [slug, url]),
+]) {
+  if (!exactDefinition(getDefinition(slug), slug, url)) {
+    throw new Error("Codex MCP server " + slug + " failed verification");
+  }
+}
 `.trim();
 
 function shellQuote(value: string): string {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 
+// The host must never win this timeout race: killing the local `docker exec`
+// client does not kill its in-container child. The full writer (including its
+// 10s lock wait and every engine-specific command) gets 25s before TERM and
+// 5s more before KILL, below the 40s host backstop.
+const MCP_CONFIG_WRITE_TIMEOUT_S = 25;
+const MCP_CONFIG_WRITE_KILL_AFTER_S = 5;
+const MCP_CONFIG_HOST_TIMEOUT_MS = 40_000;
+
 /**
  * Write the task's MCP configs inside the container, one shape per engine on
  * the roster — all pointing at the same host gateway URLs:
@@ -315,21 +662,33 @@ export async function setupMcpTaskConfig(
   containerName: string,
   connections: TaskMcpConnection[],
   engineKinds: string[],
-): Promise<void> {
+  codexHomes: readonly string[] = ["/home/node/.codex"],
+): Promise<boolean> {
   // No early return on empty: the claude adapter passes
   // `--mcp-config /workspace/.mcp.json` unconditionally (ADR-057), so the
   // file must exist — an empty mcpServers map — even with no connections.
   try {
+    const has = (kind: string): boolean => engineKinds.includes(kind);
+    if (
+      has("codex") &&
+      connections.some(
+        (connection) =>
+          !/^[a-z0-9][a-z0-9-]{0,63}$/.test(connection.slug),
+      )
+    ) {
+      throw new Error("invalid Codex MCP connection slug");
+    }
     const acl = ensureTaskGatewayAcl(taskId, connections);
     const urlFor = (slug: string): string =>
       `http://host.docker.internal:${MCP_GATEWAY_PORT}/t/${acl.token}/${slug}`;
-    const has = (kind: string): boolean => engineKinds.includes(kind);
 
     const claudeEntries: Record<string, unknown> = {};
+    const codexEntries: Record<string, string> = {};
     const cursorEntries: Record<string, unknown> = {};
     const opencodeEntries: Record<string, unknown> = {};
     for (const c of connections) {
       claudeEntries[c.slug] = { type: "http", url: urlFor(c.slug) };
+      codexEntries[c.slug] = urlFor(c.slug);
       // Cursor's mcp.json wants a bare { url } for remote (http/sse) servers.
       cursorEntries[c.slug] = { url: urlFor(c.slug) };
       // OpenCode: type:"remote" + oauth:false — the gateway needs no client
@@ -342,23 +701,30 @@ export async function setupMcpTaskConfig(
         oauth: false,
       };
     }
-    const steps = [
-      "mkdir -p /workspace/.claude",
+    // Browser migration touches these same Claude/Codex files. Keep every Uai
+    // writer in one critical section so neither side can erase the other's
+    // update between a read and its replacement/append.
+    const lockedWrites = [
       `[ -f /workspace/.claude/settings.json ] || printf '%s\\n' ${shellQuote(
         JSON.stringify({ enableAllProjectMcpServers: true }, null, 2),
       )} > /workspace/.claude/settings.json`,
-      `node -e ${shellQuote(MERGE_MCP_JSON)} /workspace/.mcp.json ${shellQuote(
-        JSON.stringify(claudeEntries),
-      )}`,
-      // Codex: stdio-only, so each connection is an mcp-remote shim.
-      ...(has("codex")
-        ? connections.map(
-            (c) =>
-              `grep -q "mcp_servers.${c.slug}]" /home/node/.codex/config.toml 2>/dev/null || printf '%s' ${shellQuote(
-                `\n[mcp_servers.${c.slug}]\ncommand = "npx"\nargs = ["-y", "mcp-remote", "${urlFor(c.slug)}", "--allow-http"]\n`,
-              )} >> /home/node/.codex/config.toml`,
+      `node -e ${shellQuote(
+        MERGE_MCP_JSON,
+      )} /workspace/.mcp.json ${shellQuote(JSON.stringify(claudeEntries))}`,
+      // Codex is stdio-only. Ask Codex itself to classify the TOML before
+      // atomically appending any missing mcp-remote shims.
+      ...(has("codex") && connections.length > 0
+        ? codexHomes.map(
+            (home) =>
+              `node -e ${shellQuote(ENSURE_CODEX_MCP_TOML)} ${shellQuote(home)} ${shellQuote(
+                JSON.stringify(codexEntries),
+              )}`,
           )
         : []),
+    ].join(" && ");
+    const writes = [
+      "mkdir -p /workspace/.claude",
+      `flock -w 10 ${MCP_CONFIG_LOCK_PATH} sh -lc ${shellQuote(lockedWrites)}`,
       // Cursor: reads ~/.cursor/mcp.json (the adapter passes --approve-mcps).
       ...(has("cursor") && connections.length > 0
         ? [
@@ -386,18 +752,24 @@ export async function setupMcpTaskConfig(
           ]
         : []),
     ].join(" && ");
+    const steps =
+      `timeout --kill-after=${MCP_CONFIG_WRITE_KILL_AFTER_S} ` +
+      `${MCP_CONFIG_WRITE_TIMEOUT_S} sh -lc ${shellQuote(writes)}`;
     const result = await dockerCli(
       ["exec", containerName, "sh", "-lc", steps],
-      { timeoutMs: 20_000 },
+      { timeoutMs: MCP_CONFIG_HOST_TIMEOUT_MS },
     );
     if (result.status !== 0) {
       console.warn(
         `[mcp-gateway] task ${taskId}: config write failed: ${result.stderr.slice(0, 300)}`,
       );
+      return false;
     }
+    return true;
   } catch (err) {
     console.warn(
       `[mcp-gateway] task ${taskId}: setup failed: ${err instanceof Error ? err.message : err}`,
     );
+    return false;
   }
 }