@technomoron/agent-run 0.99.39 → 0.99.41

package/CHANGES

@@ -1,6 +1,28 @@
 CHANGES
 =======
 
+Version 0.99.41 (2026-09-25)
+----------------------------
+* Use a shared Codex home with native named profiles, keeping project
+  instructions, MCP configuration and same-name skills separate. Codex 0.157
+  profile launches avoid the automatic per-project daemon installation and
+  Unix socket path-length failure while using the global executable.
+* Preserve old session rollouts through a non-overwriting migration; retain
+  original project homes and let Codex rebuild its derived session index.
+* Use the native unelevated Windows sandbox by default for generated profiles
+  and start Codex from the source project directory.
+
+Version 0.99.40 (2026-09-24)
+----------------------------
+* Add native Windows agent-brain service and MCP bridging over per-user named
+  pipes, with owner/ACL checks and a hidden sign-in scheduled task installer.
+* Fix recursive Windows command guard resolution after argument scanning and
+  normalize CRLF when checking generated profiles.
+* Preserve the complete generated compression prompt through Windows npm shims
+  and exercise the integration fixtures with native Windows paths.
+* Load Gemini profile settings from its private user home on Windows, retaining
+  shared preferences without requiring administrator-owned system settings.
+
 Version 0.99.39 (2026-09-11)
 ----------------------------
 * Fix the AI tools updater failing under sudo or a root shell with inherited

package/README.md

@@ -61,6 +61,11 @@ Example:
 ```text
 ~/.agent-run/
   agent-run.defaults.jsonc
+  runtime/codex/         # shared, ignored Codex home
+    agent-run-<id>.config.toml
+    skills/agent-run-<id>/
+    sessions/
+    memories/
   org/
     my-api/
       agent-run.jsonc
@@ -77,8 +82,6 @@ Example:
           codex-home/
             AGENTS.md
             config.toml
-            memories/    # native Codex memory, local generated state
-            skills/
         gemini/
           AGENTS.md
           settings.json
@@ -107,8 +110,10 @@ the agent config tree.
 - `overrides/`: optional per-profile template overrides
 - `notes/memory/`: durable project memory shared through the config repository
 - `live/memories/codex-home/AGENTS.md`: generated Codex instructions
-- `live/memories/codex-home/config.toml`: generated Codex config
-- `live/memories/codex-home/skills/`: generated Codex skills
+- `live/memories/codex-home/config.toml`: rendered Codex template for inspection
+- `<config-root>/runtime/codex/`: shared Codex home, authentication and session state
+- `runtime/codex/agent-run-<id>.config.toml`: named Codex profile with project instructions and settings
+- `runtime/codex/skills/agent-run-<id>/`: generated skills, enabled only for that profile
 - `live/CLAUDE.md`: generated Claude instructions
 - `live/.claude/`: generated Claude settings, MCP configuration, and local
   plugin skills
@@ -288,15 +293,30 @@ and `agent-run grok --help` pass `--help` through to the underlying tool.
 For any native agent command, use `--generate` to generate profile files
 without launching the underlying tool.
 
-Codex defaults to `-a on-request -s workspace-write`. `agent-run` sets
-`CODEX_HOME` under the private agent directory, where Codex discovers the
-generated `AGENTS.md`, `config.toml`, and skills natively. It starts Codex from
-that private directory, passes the project root with `-C`, and keeps generated
-guard shims on `PATH`. Use `--network` to enable network access in the
-workspace-write sandbox.
-When `~/.codex/auth.json` exists, profile-specific Codex homes link their
-`auth.json` to that shared login cache so changing profiles does not require a
-new ChatGPT login.
+Codex defaults to `-a on-request -s workspace-write`. `agent-run` uses one
+`CODEX_HOME` at `<config-root>/runtime/codex` and selects a generated named
+profile with `--profile`. Project instructions are added through
+`developer_instructions`; MCP settings and per-skill enablement stay in the
+named profile. The normal global Codex executable is used. Codex 0.157.0 runs
+named-profile sessions with its embedded backend, avoiding automatic daemon
+package copies and the long per-project Unix socket path. Agent-run does not
+add `--no-daemon`. This layout requires Codex with named profile-file support
+(0.134.0 or newer); Windows and Debian are tested with 0.157.0.
+
+Codex starts from the project root, also passed with `-C`, with generated guard
+shims on `PATH`. Use `--network` to enable network access in the workspace-write
+sandbox. Windows profiles default to the native unelevated sandbox unless the
+profile template specifies another mode. When `~/.codex/auth.json` exists, the
+shared home links that login cache (copies it when Windows cannot create file
+symlinks), so changing projects does not require another login.
+
+On first use of each old project home, agent-run copies its `sessions/` and
+`archived_sessions/` rollouts into the shared home without overwriting existing
+files. Codex rebuilds its derived session index. Original files, databases,
+history, native memories and old daemon packages remain untouched in the old
+home; databases and daemon installations are not copied. Close old agent-run
+sessions before upgrading so their final turns are included. New sessions and
+native memories use the shared home; durable project knowledge remains separate.
 
 ### Project Memory
 
@@ -306,7 +326,7 @@ current task. Agents may update project memory when the user explicitly requests
 authorizes a standing workflow, such as saving durable corrections and updating
 affected specs. This authorization does not permit Git or external-service writes.
 
-Codex's native `$CODEX_HOME/memories/` remains under ignored `live/` state. It
+Codex's native `$CODEX_HOME/memories/` lives in the ignored shared home. It
 is generated, machine-local recall data and is not copied into the tracked
 project memory directory. Project memory is plain Markdown so it can be
 reviewed and shared through the Git repository that normally holds the
@@ -334,9 +354,13 @@ Gemini runs from the real project directory with a private
 `GEMINI_CLI_HOME`. Its generated system settings configure `AGENTS.md` as the
 context filename and add the private runtime plus project memory as context
 directories. Generated skills use Gemini's `.agents/skills` alias. Existing
-Gemini user settings, login credentials, commands, and user skills are linked
-into the private home when present; generated system settings remain the
-highest-priority project layer.
+Gemini login credentials, commands, and user skills are linked into the private
+home when present. On Windows, shared user preferences and generated settings
+are merged into the private home's `.gemini/settings.json`; shared settings
+remain untouched. This avoids Gemini's administrator-only system-settings ACL
+requirement. On other platforms, user settings are linked and generated system
+settings remain the highest-priority project layer. Gemini's normal folder-trust
+and sign-in requirements still apply.
 
 Grok runs from the real project directory with `GROK_HOME` set to
 `live/grok/`. Grok natively reads the generated home-level `AGENTS.md`,
@@ -417,7 +441,8 @@ then rewrites generated files:
 - `live/CLAUDE.md`
 - `live/memories/codex-home/AGENTS.md`
 - `live/memories/codex-home/config.toml`
-- `live/memories/codex-home/skills/**`
+- `<config-root>/runtime/codex/agent-run-<id>.config.toml`
+- `<config-root>/runtime/codex/skills/agent-run-<id>/**`
 - `live/.claude/**`
 - `live/gemini/**`
 - `live/grok/**`
@@ -510,7 +535,8 @@ command stages moves but never commits them.
 
 `agent-brain` gives the native agents the same project knowledge, skills, and
 tasks through MCP. It uses the official Node MCP SDK. The persistent
-service runs under `@technomoron/apicore-server` on a private Unix socket.
+service runs under `@technomoron/apicore-server` on a private Unix socket or a
+Windows named pipe restricted to the current user, SYSTEM, and administrators.
 Node 24 or newer is required; SQLite and FTS come from Node, with no database
 package to compile.
 
@@ -978,8 +1004,8 @@ not performed; the service can optionally pull at startup as described below.
 
 ### Persistent service under apicore-server
 
-All native agents connect to the same long-lived service for the Unix user.
-Start it on Linux or macOS:
+All native agents connect to the same long-lived service for the current user.
+Start it on Linux, macOS, or Windows:
 
 ```sh
 agent-brain serve
@@ -1005,7 +1031,27 @@ for a particular service. The bridge verifies the socket's ownership and private
 permissions. A missing or unreachable socket is an error; start the service
 before connecting. There is no standalone stdio server or TCP fallback. Apicore
 supports Unix sockets directly, so localhost binding is unnecessary. The brain
-service currently requires Linux or macOS.
+service supports Linux, macOS, and native Windows.
+
+On Windows the default endpoint is `\\.\pipe\agent-brain-<hash>`, derived from
+the user's home and configuration root. No TCP port is opened. Windows
+PowerShell applies a private pipe ACL before requests are accepted; each bridge
+checks the pipe owner and ACL before connecting. `--socket` can select another
+local named pipe. Windows removes the pipe automatically when its server exits.
+
+To start it automatically at Windows sign-in, initialize the desired config root
+and run the packaged installer in PowerShell:
+
+```powershell
+agent-brain init --configdir "$env:USERPROFILE\.agent-run"
+$prefix = npm.cmd prefix -g
+& "$prefix\node_modules\@technomoron\agent-run\scripts\install-windows-brain.ps1" -ConfigRoot "$env:USERPROFILE\.agent-run"
+```
+
+The `Agent Brain` scheduled task runs hidden as the signed-in user, without
+elevation, and retries failures. Its log is `<config-root>/runtime/service.log`.
+After upgrading the package, restart it with `Stop-ScheduledTask` followed by
+`Start-ScheduledTask` for task name `Agent Brain`.
 
 After a crash, remove a stale socket only after checking that its service is
 stopped. Starting a second service on an existing socket fails without replacing

package/dist/agents/codex.js

@@ -9,14 +9,15 @@ const render_settings_1 = require("../config/render-settings");
 const render_skills_1 = require("../config/render-skills");
 const environment_1 = require("../runtime/environment");
 const shared_state_1 = require("../runtime/shared-state");
+const codex_profile_1 = require("../runtime/codex-profile");
 const shared_1 = require("./shared");
 function layout(context) {
     return {
         dir: context.paths.codexHomeDir,
         instructionFile: path.join(context.paths.codexHomeDir, 'AGENTS.md'),
-        configFiles: [path.join(context.paths.codexHomeDir, 'config.toml')],
-        skillsDir: context.paths.codexSkillsDir,
-        requiredDirs: [context.paths.codexHomeDir, context.paths.codexSkillsDir],
+        configFiles: [path.join(context.paths.codexHomeDir, 'config.toml'), path.join((0, codex_profile_1.codexSharedHome)(context), `${(0, codex_profile_1.codexProfileName)(context)}.config.toml`)],
+        skillsDir: (0, codex_profile_1.codexProfileSkills)(context),
+        requiredDirs: [context.paths.codexHomeDir, (0, codex_profile_1.codexProfileSkills)(context)],
         preservedSkillNames: new Set(['.system'])
     };
 }
@@ -24,9 +25,11 @@ function generate(generation) {
     const agentLayout = layout(generation.context);
     const baseConfig = (0, render_settings_1.renderProfileConfig)(generation.env, generation.configRoot, generation.context, 'codex-config.toml.njk', 'global/tool-templates/codex-config.toml.njk', () => (0, defaults_1.defaultCodexConfigContent)(generation.context), 'Codex config.toml', generation.trace);
     const mcp = (0, render_mcp_1.renderCodexMcp)(generation.context);
+    const config = `${baseConfig.trimEnd()}${mcp ? `\n\n${mcp}` : '\n'}`;
     const files = [
         { path: agentLayout.instructionFile, content: generation.agentsMd },
-        { path: agentLayout.configFiles[0] ?? '', content: `${baseConfig.trimEnd()}${mcp ? `\n\n${mcp}` : '\n'}` },
+        { path: agentLayout.configFiles[0] ?? '', content: config },
+        { path: agentLayout.configFiles[1] ?? '', content: (0, codex_profile_1.renderCodexProfile)(generation.context, config, generation.agentsMd), atomic: true },
         ...(0, render_skills_1.renderSkillFiles)(generation.context, agentLayout.skillsDir)
     ];
     return { ...agentLayout, id: 'codex', projectDir: generation.context.projectRoot, files, context: generation.context };
@@ -46,7 +49,16 @@ exports.codexAdapter = {
     layout,
     generate,
     prepare(runtime) {
-        (0, shared_state_1.linkSharedEntry)(path.join(os.homedir(), '.codex', 'auth.json'), path.join(runtime.dir, 'auth.json'), 'profile Codex auth');
+        (0, shared_state_1.linkSharedEntry)(path.join(os.homedir(), '.codex', 'auth.json'), path.join((0, codex_profile_1.codexSharedHome)(runtime.context), 'auth.json'), 'shared Codex auth');
+        (0, codex_profile_1.migrateCodexSessions)(runtime.dir, (0, codex_profile_1.codexSharedHome)(runtime.context));
+        const profile = runtime.files.find((file) => file.path === runtime.configFiles[1]);
+        const base = runtime.files.find((file) => file.path === runtime.configFiles[0]);
+        const instructions = runtime.files.find((file) => file.path === runtime.instructionFile);
+        if (profile && base && instructions) {
+            profile.content = (0, codex_profile_1.renderCodexProfile)(runtime.context, base.content, instructions.content);
+        }
+        // Disable the pending skills in other profiles before making them discoverable.
+        (0, codex_profile_1.refreshCodexProfileSkills)(runtime.context);
     },
     spawn(runtime, options) {
         (0, shared_1.assertRuntimeFile)('codex', runtime.instructionFile, runtime.context.profileDir);
@@ -56,6 +68,7 @@ exports.codexAdapter = {
         return {
             command: options.binary,
             args: [
+                '--profile', (0, codex_profile_1.codexProfileName)(runtime.context),
                 ...runtimeArgs,
                 '--add-dir',
                 runtime.context.paths.projectMemoryDir,
@@ -66,8 +79,8 @@ exports.codexAdapter = {
                     : []),
                 ...options.passthroughArgs
             ],
-            cwd: runtime.dir,
-            env: { ...(0, environment_1.buildAgentEnvironment)(runtime.context), CODEX_HOME: runtime.dir },
+            cwd: runtime.projectDir,
+            env: { ...(0, environment_1.buildAgentEnvironment)(runtime.context), CODEX_HOME: (0, codex_profile_1.codexSharedHome)(runtime.context) },
             onExit: (0, shared_1.withPostflight)(runtime, options.wrapperArgs)
         };
     },

package/dist/agents/gemini.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.geminiAdapter = void 0;
 const os = require("os");
 const path = require("path");
+const fs = require("fs");
 const render_mcp_1 = require("../config/render-mcp");
 const render_settings_1 = require("../config/render-settings");
 const render_skills_1 = require("../config/render-skills");
@@ -63,7 +64,7 @@ exports.geminiAdapter = {
         const sharedGeminiDir = path.join(os.homedir(), '.gemini');
         const privateGeminiDir = path.join(runtime.context.paths.geminiHomeDir, '.gemini');
         for (const name of [
-            'settings.json',
+            ...(process.platform === 'win32' ? [] : ['settings.json']),
             'oauth_creds.json',
             'google_accounts.json',
             'trustedFolders.json',
@@ -76,6 +77,19 @@ exports.geminiAdapter = {
         ]) {
             (0, shared_state_1.linkSharedEntry)(path.join(sharedGeminiDir, name), path.join(privateGeminiDir, name), `Gemini ${name}`);
         }
+        if (process.platform === 'win32') {
+            // Gemini now requires administrator-owned system settings on Windows.
+            // Keep the profile in its private user home, without modifying shared settings.
+            const settings = path.join(privateGeminiDir, 'settings.json');
+            const read = (file) => fs.existsSync(file)
+                ? (0, render_settings_1.parseJsonObject)(fs.readFileSync(file, 'utf8'), 'Gemini user settings') : {};
+            const merged = mergeSettings(mergeSettings(read(path.join(sharedGeminiDir, 'settings.json')), read(settings)), read(runtime.configFiles[0]));
+            fs.mkdirSync(privateGeminiDir, { recursive: true });
+            // Atomic replacement also detaches an older shared-settings symlink.
+            const temporary = `${settings}.${process.pid}.tmp`;
+            fs.writeFileSync(temporary, `${JSON.stringify(merged, null, 2)}\n`, { flag: 'wx' });
+            fs.renameSync(temporary, settings);
+        }
     },
     spawn(runtime, options) {
         (0, shared_1.assertRuntimeFile)('gemini', runtime.instructionFile, runtime.context.profileDir);
@@ -92,7 +106,7 @@ exports.geminiAdapter = {
             env: {
                 ...(0, environment_1.buildAgentEnvironment)(runtime.context),
                 GEMINI_CLI_HOME: runtime.context.paths.geminiHomeDir,
-                GEMINI_CLI_SYSTEM_SETTINGS_PATH: runtime.configFiles[0],
+                ...(process.platform === 'win32' ? {} : { GEMINI_CLI_SYSTEM_SETTINGS_PATH: runtime.configFiles[0] }),
                 GEMINI_CLI_TRUSTED_FOLDERS_PATH: sharedTrustedFolders
             },
             onExit: (0, shared_1.withPostflight)(runtime, options.wrapperArgs)
@@ -105,6 +119,16 @@ exports.geminiAdapter = {
         return wrapperArgs.sandboxMode === 'sandboxed' ? ['--sandbox'] : [];
     }
 };
+function mergeSettings(base, override) {
+    const result = { ...base };
+    for (const [key, value] of Object.entries(override)) {
+        if (['__proto__', 'constructor', 'prototype'].includes(key))
+            continue;
+        result[key] = value && typeof value === 'object' && !Array.isArray(value)
+            ? mergeSettings(asObject(base[key]), value) : value;
+    }
+    return result;
+}
 function asObject(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value)
         ? value

package/dist/brain/config.js

@@ -9,11 +9,17 @@ exports.registeredBrainProfile = registeredBrainProfile;
 exports.registeredBrainProject = registeredBrainProject;
 const fs = require("node:fs");
 const path = require("node:path");
+const os = require("node:os");
+const node_crypto_1 = require("node:crypto");
 const jsonc_parser_1 = require("jsonc-parser");
 const yaml_1 = require("yaml");
 const zod_1 = require("zod");
 const utils_1 = require("../utils");
 function defaultSocketPath(configRoot) {
+    if (process.platform === 'win32') {
+        const identity = `${os.homedir().toLowerCase()}\0${path.resolve(configRoot).toLowerCase()}`;
+        return `\\\\.\\pipe\\agent-brain-${(0, node_crypto_1.createHash)('sha256').update(identity).digest('hex').slice(0, 32)}`;
+    }
     return path.join(configRoot, 'runtime', 'agent-brain.sock');
 }
 exports.brainConfigSchema = zod_1.z.object({

package/dist/brain/server.js

@@ -20,6 +20,7 @@ const skills_1 = require("./skills");
 const todos_1 = require("./todos");
 const connectors_1 = require("./connectors");
 const git_1 = require("./git");
+const windows_pipe_1 = require("./windows-pipe");
 var config_1 = require("./config");
 Object.defineProperty(exports, "defaultSocketPath", { enumerable: true, get: function () { return config_1.defaultSocketPath; } });
 function createBrainServer(store) {
@@ -113,20 +114,26 @@ function createBrainServer(store) {
     return server;
 }
 function requirePrivateSocketDirectory(socketPath) {
-    if (process.platform === 'win32')
-        throw new Error('The agent-brain Unix-socket service requires Linux or macOS.');
     const stat = fs.lstatSync(path.dirname(socketPath));
     if (!stat.isDirectory() || stat.uid !== process.getuid() || (stat.mode & 0o077) !== 0)
         throw new Error('The socket directory must be owned by the current user with mode 0700.');
 }
 async function serveApiCore(configRoot, socketPath) {
-    const directory = path.dirname(socketPath);
-    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
-    requirePrivateSocketDirectory(socketPath);
-    if (fs.existsSync(socketPath))
-        throw new Error(`Socket already exists: ${socketPath}. Stop the running service, or remove the socket after confirming it is stale.`);
+    if (process.platform !== 'win32') {
+        const directory = path.dirname(socketPath);
+        fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+        requirePrivateSocketDirectory(socketPath);
+        if (fs.existsSync(socketPath))
+            throw new Error(`Socket already exists: ${socketPath}. Stop the running service, or remove the socket after confirming it is stale.`);
+    }
+    else if (!/^\\\\\.\\pipe\\[a-zA-Z0-9._-]+$/.test(socketPath)) {
+        throw new Error('On Windows, --socket must be a local named pipe (\\\\.\\pipe\\name).');
+    }
+    let ready = false;
     const api = new apicore_server_1.ApiServer({ authApi: false, origins: [], devMode: false });
     api.fastify.post('/mcp', async (request, reply) => {
+        if (!ready)
+            return reply.code(503).send();
         if (request.headers.origin)
             return reply.code(403).send({ error: 'Browser requests are not supported' });
         if (request.headers['x-agent-brain-root'] !== encodeURIComponent(path.resolve(configRoot)))
@@ -158,16 +165,36 @@ async function serveApiCore(configRoot, socketPath) {
     });
     api.fastify.route({ method: ['GET', 'DELETE'], url: '/mcp', handler: async (_request, reply) => reply.code(405).send() });
     await api.fastify.listen({ path: socketPath });
-    fs.chmodSync(socketPath, 0o600);
+    try {
+        if (process.platform === 'win32')
+            await (0, windows_pipe_1.checkWindowsPipe)(socketPath, true);
+        else
+            fs.chmodSync(socketPath, 0o600);
+        ready = true;
+    }
+    catch (error) {
+        await api.fastify.close();
+        throw error;
+    }
     return { close: () => api.fastify.close() };
 }
 async function proxyStdio(socketPath, cwd, configRoot) {
-    const socket = fs.lstatSync(socketPath, { throwIfNoEntry: false });
-    if (!socket)
-        throw new Error(`Agent-brain service is not running at ${socketPath}. Start agent-brain serve with the same --configdir and --socket, or enable its systemd user service.`);
-    requirePrivateSocketDirectory(socketPath);
-    if (!socket.isSocket() || socket.uid !== process.getuid() || (socket.mode & 0o077) !== 0)
-        throw new Error('The brain socket must belong to the current user with mode 0600.');
+    if (process.platform === 'win32') {
+        try {
+            await (0, windows_pipe_1.checkWindowsPipe)(socketPath);
+        }
+        catch (error) {
+            throw new Error(`Agent-brain service is not running or its pipe is not private at ${socketPath}. Start agent-brain serve with the same --configdir and --socket. ${String(error)}`);
+        }
+    }
+    else {
+        const socket = fs.lstatSync(socketPath, { throwIfNoEntry: false });
+        if (!socket)
+            throw new Error(`Agent-brain service is not running at ${socketPath}. Start agent-brain serve with the same --configdir and --socket, or enable its systemd user service.`);
+        requirePrivateSocketDirectory(socketPath);
+        if (!socket.isSocket() || socket.uid !== process.getuid() || (socket.mode & 0o077) !== 0)
+            throw new Error('The brain socket must belong to the current user with mode 0600.');
+    }
     const stdio = new stdio_js_1.StdioServerTransport();
     let protocolVersion;
     async function send(message) {

package/dist/brain/windows-pipe.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkWindowsPipe = checkWindowsPipe;
+const path = require("node:path");
+const node_child_process_1 = require("node:child_process");
+const node_util_1 = require("node:util");
+async function checkWindowsPipe(pipePath, secure = false) {
+    if (!/^\\\\\.\\pipe\\[a-zA-Z0-9._-]+$/.test(pipePath))
+        throw new Error('Expected a local Windows named pipe (\\\\.\\pipe\\name).');
+    const powershell = path.join(process.env.SystemRoot ?? 'C:\\Windows', 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe');
+    const helper = path.resolve(__dirname, '../../scripts/brain-pipe-security.ps1');
+    try {
+        await (0, node_util_1.promisify)(node_child_process_1.execFile)(powershell, ['-NoProfile', '-NonInteractive', '-ExecutionPolicy', 'Bypass', '-File', helper,
+            '-PipePath', pipePath, ...(secure ? ['-Secure'] : [])], { encoding: 'utf8', windowsHide: true, timeout: 15000 });
+    }
+    catch (error) {
+        throw new Error(`Cannot ${secure ? 'secure' : 'verify'} the brain pipe: ${String(error)}`);
+    }
+}

package/dist/commands.js

@@ -85,6 +85,10 @@ async function runCompress(command) {
     finally {
         store.close();
     }
+    // cmd.exe terminates a .cmd launch at a literal newline, even inside quotes.
+    // Keep this generated prose prompt in one argument through Windows npm shims.
+    if (process.platform === 'win32')
+        prompt = prompt.replace(/\r?\n/g, ' ');
     // Use the normal adapters, configuration and permission modes. The prompt is one argv value.
     runTool({ command: agent, args: agent === 'gemini' ? ['-i', prompt] : [prompt], wrapperArgs: {
             none: false, create: false, local: false, show: false, generate: false, sandboxMode: null, codexNetwork: false

package/dist/constants.js

@@ -33,6 +33,8 @@ exports.BRAIN_GITIGNORE_ENTRIES = [
     ''
 ];
 exports.GENERATED_GITIGNORE_ENTRIES = [
+    '# Shared machine-local Codex state',
+    '/runtime/codex/',
     '# Generated agent-run live profiles',
     '**/live/',
     '',

package/dist/guards.js

@@ -140,9 +140,10 @@ function windowsShim(name) {
     return [
         '@echo off',
         'setlocal DisableDelayedExpansion',
+        'set "AGENT_RUN_GUARD_SELF=%~f0"',
+        'for %%D in ("%~dp0.") do set "AGENT_RUN_GUARD_DIR=%%~fD"',
         ...guard,
         ':run',
-        'for %%D in ("%~dp0.") do set "AGENT_RUN_GUARD_DIR=%%~fD"',
         'if defined AGENT_RUN_REAL_PATH (',
         '  set "PATH=%AGENT_RUN_REAL_PATH%"',
         ') else (',
@@ -154,7 +155,7 @@ function windowsShim(name) {
         `  echo agent-run: cannot find the real ${name} command outside the guard directory. 1>&2`,
         '  exit /b 127',
         ')',
-        'if /I "%AGENT_RUN_COMMAND%"=="%~f0" (',
+        'if /I "%AGENT_RUN_COMMAND%"=="%AGENT_RUN_GUARD_SELF%" (',
         `  echo agent-run: refused recursive ${name} guard resolution. 1>&2`,
         '  exit /b 127',
         ')',

package/dist/renderer.js

@@ -18,6 +18,7 @@ const project_1 = require("./project");
 const templates_1 = require("./templates");
 const utils_1 = require("./utils");
 const config_1 = require("./brain/config");
+const codex_profile_1 = require("./runtime/codex-profile");
 function renderProfile(projectRoot, agentDir, checkOnly = false, targetTool = null, trace, options) {
     const configRoot = options?.configRoot ?? (0, project_1.defaultConfigRoot)(projectRoot);
     const profile = options?.profile ?? (0, project_1.resolveProfile)(projectRoot);
@@ -92,11 +93,14 @@ function syncAgentProfile(projectRoot, agentDir, options) {
     return syncRenderedProfile(rendered);
 }
 function syncRenderedProfile(rendered) {
+    return (0, codex_profile_1.withCodexProfileLock)(rendered.context, () => writeRenderedProfile(rendered));
+}
+function writeRenderedProfile(rendered) {
     (0, config_tree_1.ensureConfigRootGitignore)(rendered.configRoot);
     syncRuntimeDirs(rendered);
     removeStaleGeneratedEntries(rendered);
     for (const file of rendered.files) {
-        writeGeneratedFile(file.path, file.content, file.executable ?? false);
+        writeGeneratedFile(file.path, file.content, file.executable ?? false, file.atomic ?? false);
     }
     removeLegacyGeneratedCodexFiles(rendered.context);
     removeLegacyGeneratedClaudeSettings(rendered.context);
@@ -129,11 +133,14 @@ function syncRuntimeDirs(rendered) {
         }
     }
 }
-function writeGeneratedFile(filePath, content, executable) {
+function writeGeneratedFile(filePath, content, executable, atomic) {
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
     const unchanged = fs.existsSync(filePath) && fs.readFileSync(filePath, 'utf8') === content;
     if (!unchanged) {
-        fs.writeFileSync(filePath, content, 'utf8');
+        if (atomic)
+            (0, codex_profile_1.writeCodexProfileFile)(filePath, content);
+        else
+            fs.writeFileSync(filePath, content, 'utf8');
         (0, utils_1.verbose)(`write ${filePath}`);
     }
     if (executable && !constants_1.IS_WINDOWS) {
@@ -229,7 +236,7 @@ function checkRenderedFiles(rendered, findings) {
             continue;
         }
         const actual = fs.readFileSync(file.path, 'utf8').replace(/\r\n/g, '\n');
-        if (actual !== file.content) {
+        if (actual !== file.content.replace(/\r\n/g, '\n')) {
             findings.push({ message: `generated file is out of date: ${file.path}`, severity: 'ERROR' });
         }
     }

package/dist/runtime/codex-profile.js

@@ -0,0 +1,184 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexSharedHome = codexSharedHome;
+exports.codexProfileName = codexProfileName;
+exports.codexProfileSkills = codexProfileSkills;
+exports.renderCodexProfile = renderCodexProfile;
+exports.refreshCodexProfileSkills = refreshCodexProfileSkills;
+exports.writeCodexProfileFile = writeCodexProfileFile;
+exports.withCodexProfileLock = withCodexProfileLock;
+exports.migrateCodexSessions = migrateCodexSessions;
+const fs = require("fs");
+const path = require("path");
+const crypto_1 = require("crypto");
+const smol_toml_1 = require("smol-toml");
+function codexSharedHome(context) {
+    return path.join(context.configRoot, 'runtime', 'codex');
+}
+function codexProfileName(context) {
+    const identity = path.resolve(context.profileDir);
+    const canonical = process.platform === 'win32' ? identity.toLowerCase() : identity;
+    return `agent-run-${(0, crypto_1.createHash)('sha256').update(canonical).digest('hex').slice(0, 20)}`;
+}
+function codexProfileSkills(context) {
+    return path.join(codexSharedHome(context), 'skills', codexProfileName(context));
+}
+// Only scan agent-run's generated skills. Personal/system skills keep their native settings.
+function generatedSkills(home) {
+    const root = path.join(home, 'skills');
+    if (!fs.existsSync(root))
+        return [];
+    const files = [];
+    for (const profile of fs.readdirSync(root, { withFileTypes: true })) {
+        if (!profile.isDirectory() || !/^agent-run-[a-f0-9]{20}$/.test(profile.name))
+            continue;
+        const dir = path.join(root, profile.name);
+        for (const skill of fs.readdirSync(dir, { withFileTypes: true })) {
+            const file = path.join(dir, skill.name, 'SKILL.md');
+            if (skill.isDirectory() && fs.existsSync(file))
+                files.push(file);
+        }
+    }
+    return files.sort();
+}
+function configureSkills(config, home, profile, files) {
+    const settings = (config.skills ?? {});
+    const existing = (settings.config ?? []);
+    const generatedRoot = path.join(home, 'skills') + path.sep;
+    const isGenerated = (file) => {
+        const relative = path.resolve(file).slice(generatedRoot.length);
+        return path.resolve(file).startsWith(generatedRoot) && /^agent-run-[a-f0-9]{20}[\\/]/.test(relative);
+    };
+    settings.config = [
+        ...existing.filter((entry) => !isGenerated(entry.path)),
+        ...files.map((file) => ({
+            path: file,
+            enabled: path.dirname(path.dirname(file)) === path.join(home, 'skills', profile)
+                && (existing.find((entry) => entry.path === file)?.enabled ?? true)
+        }))
+    ];
+    config.skills = settings;
+}
+function renderCodexProfile(context, base, instructions) {
+    const config = (0, smol_toml_1.parse)(base);
+    config.developer_instructions = [config.developer_instructions, instructions].filter(Boolean).join('\n\n');
+    if (process.platform === 'win32') {
+        // A fresh home otherwise silently downgrades workspace-write to read-only.
+        config.windows = { sandbox: 'unelevated', ...(config.windows ?? {}) };
+    }
+    configureSkills(config, codexSharedHome(context), codexProfileName(context), pendingSkills(context));
+    return (0, smol_toml_1.stringify)(config) + '\n';
+}
+function pendingSkills(context) {
+    const ownDir = codexProfileSkills(context);
+    const others = generatedSkills(codexSharedHome(context)).filter((file) => path.dirname(path.dirname(file)) !== ownDir);
+    const own = context.skills.map((skill) => path.join(ownDir, skill.name, 'SKILL.md'));
+    return [...new Set([...others, ...own])].sort();
+}
+// Refresh older generated profiles too: newly generated project skills must not
+// become enabled in another profile merely because they share a discovery root.
+function refreshCodexProfileSkills(context) {
+    const home = codexSharedHome(context);
+    const files = pendingSkills(context);
+    for (const entry of fs.readdirSync(home)) {
+        if (!/^agent-run-[a-f0-9]{20}\.config\.toml$/.test(entry))
+            continue;
+        const file = path.join(home, entry);
+        const original = fs.readFileSync(file, 'utf8');
+        const config = (0, smol_toml_1.parse)(original);
+        configureSkills(config, home, entry.replace('.config.toml', ''), files);
+        const content = (0, smol_toml_1.stringify)(config) + '\n';
+        if (content !== original)
+            writeCodexProfileFile(file, content);
+    }
+}
+function writeCodexProfileFile(file, content) {
+    const temporary = `${file}.${(0, crypto_1.randomUUID)()}.tmp`;
+    try {
+        fs.writeFileSync(temporary, content, { encoding: 'utf8', mode: 0o600 });
+        fs.renameSync(temporary, file);
+    }
+    finally {
+        fs.rmSync(temporary, { force: true });
+    }
+}
+// Profile refresh, skill publication and session migration share one writer.
+// Codex readers see complete profile files through atomic rename.
+function withCodexProfileLock(context, run) {
+    const home = codexSharedHome(context);
+    fs.mkdirSync(home, { recursive: true });
+    const lock = path.join(home, '.agent-run-sync.lock');
+    const deadline = Date.now() + 30000;
+    let descriptor;
+    for (;;) {
+        try {
+            descriptor = fs.openSync(lock, 'wx', 0o600);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            try {
+                const owner = Number(fs.readFileSync(lock, 'utf8'));
+                if (Number.isInteger(owner) && owner > 0) {
+                    try {
+                        process.kill(owner, 0);
+                    }
+                    catch (probe) {
+                        if (probe.code === 'ESRCH') {
+                            fs.rmSync(lock, { force: true });
+                            continue;
+                        }
+                    }
+                }
+            }
+            catch (readError) {
+                if (readError.code === 'ENOENT')
+                    continue;
+                throw readError;
+            }
+            if (Date.now() >= deadline)
+                throw new Error(`Timed out waiting for Codex profile generation: ${lock}`);
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+        }
+    }
+    try {
+        fs.writeFileSync(descriptor, String(process.pid));
+        return run();
+    }
+    finally {
+        fs.closeSync(descriptor);
+        fs.rmSync(lock, { force: true });
+    }
+}
+function migrateCodexSessions(legacyHome, sharedHome) {
+    const marker = path.join(sharedHome, 'agent-run-migrations', `${(0, crypto_1.createHash)('sha256').update(path.resolve(legacyHome)).digest('hex')}.json`);
+    if (fs.existsSync(marker))
+        return;
+    // Rollouts are Codex's durable session source. Let Codex rebuild its derived
+    // database; never merge SQLite files or copy daemon installs, sockets or locks.
+    function copyMissing(source, target) {
+        if (!fs.existsSync(source))
+            return;
+        for (const entry of fs.readdirSync(source, { withFileTypes: true })) {
+            const from = path.join(source, entry.name);
+            const to = path.join(target, entry.name);
+            if (entry.isDirectory())
+                copyMissing(from, to);
+            else if (entry.isFile() && entry.name.endsWith('.jsonl')) {
+                fs.mkdirSync(target, { recursive: true });
+                try {
+                    fs.copyFileSync(from, to, fs.constants.COPYFILE_EXCL);
+                }
+                catch (error) {
+                    if (error.code !== 'EEXIST')
+                        throw error;
+                }
+            }
+        }
+    }
+    for (const dir of ['sessions', 'archived_sessions'])
+        copyMissing(path.join(legacyHome, dir), path.join(sharedHome, dir));
+    fs.mkdirSync(path.dirname(marker), { recursive: true });
+    fs.writeFileSync(marker, JSON.stringify({ source: legacyHome, migrated: new Date().toISOString() }) + '\n');
+}

package/dist/templates.js

@@ -12,6 +12,7 @@ const nunjucks = require("nunjucks");
 const constants_1 = require("./constants");
 const utils_1 = require("./utils");
 const config_1 = require("./brain/config");
+const codex_profile_1 = require("./runtime/codex-profile");
 function createNunjucksEnv(configRoot) {
     return new nunjucks.Environment(new nunjucks.FileSystemLoader(configRoot, { noCache: true }), {
         autoescape: false,
@@ -82,10 +83,10 @@ function buildRenderContext(projectRoot, profileDir, configRoot, manifest, env)
         memoriesDir,
         globalMemoryDir: (0, config_1.readBrainConfig)(configRoot)?.enabled ? path.join(configRoot, 'global', 'memory') : path.join(configRoot, 'notes', 'memory'),
         projectMemoryDir,
-        nativeMemoryDir: path.join(codexHomeDir, 'memories'),
+        nativeMemoryDir: path.join(configRoot, 'runtime', 'codex', 'memories'),
         codexHomeDir,
         overridesDir: path.join(profileDir, 'overrides'),
-        codexSkillsDir: path.join(codexHomeDir, 'skills'),
+        codexSkillsDir: (0, codex_profile_1.codexProfileSkills)(baseContext),
         claudeSkillsDir: path.join(liveDir, '.claude', 'skills'),
         geminiRuntimeDir,
         geminiHomeDir,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@technomoron/agent-run",
-  "version": "0.99.39",
+  "version": "0.99.41",
   "packageManager": "pnpm@10.34.5",
   "bin": {
     "agent-run": "dist/agent-run.js",
@@ -17,6 +17,10 @@
     "scripts/install-systemd-jobs.sh",
     "scripts/update-ai-tools.sh",
     "scripts/ensure-agent-brain.sh",
+    "scripts/brain-pipe-security.ps1",
+    "scripts/install-windows-brain.ps1",
+    "scripts/run-windows-brain.ps1",
+    "scripts/run-hidden.vbs",
     "README.md",
     "LICENSE",
     "CHANGES"
@@ -31,7 +35,8 @@
     "clean:dist": "rimraf ./dist/",
     "cleanbuild": "run-s clean:dist build",
     "prepack": "run-s build",
-    "test": "run-s build test:integration test:release",
+    "test": "run-s build test:codex-profiles test:integration test:release",
+    "test:codex-profiles": "node --test scripts/test-codex-profiles.cjs",
     "test:brain": "node --test scripts/test-brain.cjs",
     "test:integration": "bash ./scripts/test.sh",
     "test:release": "bash ./scripts/test-release.sh",
@@ -61,6 +66,7 @@
     "cross-spawn": "^7.0.6",
     "jsonc-parser": "^3.3.1",
     "nunjucks": "^3.2.4",
+    "smol-toml": "^1.9.0",
     "yaml": "^2.9.0",
     "zod": "^4.5.4"
   }

package/scripts/brain-pipe-security.ps1

@@ -0,0 +1,40 @@
+param(
+    [Parameter(Mandatory = $true)][string]$PipePath,
+    [switch]$Secure
+)
+$ErrorActionPreference = 'Stop'
+if ($PipePath -notmatch '^\\\\\.\\pipe\\[a-zA-Z0-9._-]+$') { throw 'Expected a local Windows named pipe.' }
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent().User
+$trusted = @($identity.Value, 'S-1-5-18', 'S-1-5-32-544')
+$rights = [System.IO.Pipes.PipeAccessRights]::ReadWrite -bor [System.IO.Pipes.PipeAccessRights]::ReadPermissions
+if ($Secure) { $rights = $rights -bor [System.IO.Pipes.PipeAccessRights]::ChangePermissions }
+# Anonymous impersonation prevents a substituted server from impersonating this client.
+$pipe = [System.IO.Pipes.NamedPipeClientStream]::new('.', $PipePath.Substring(9), $rights,
+    [System.IO.Pipes.PipeOptions]::None, [System.Security.Principal.TokenImpersonationLevel]::Anonymous,
+    [System.IO.HandleInheritability]::None)
+try {
+    $pipe.Connect(5000)
+    if ($PSVersionTable.PSEdition -eq 'Desktop') { $acl = $pipe.GetAccessControl() }
+    else { $acl = [System.IO.Pipes.PipesAclExtensions]::GetAccessControl($pipe) }
+    if ($acl.GetOwner([System.Security.Principal.SecurityIdentifier]).Value -ne $identity.Value) {
+        throw 'The brain pipe must be owned by the current Windows user.'
+    }
+    if ($Secure) {
+        $acl = [System.IO.Pipes.PipeSecurity]::new()
+        $acl.SetAccessRuleProtection($true, $false)
+        foreach ($sid in $trusted) {
+            $acl.AddAccessRule([System.IO.Pipes.PipeAccessRule]::new(
+                [System.Security.Principal.SecurityIdentifier]::new($sid),
+                [System.IO.Pipes.PipeAccessRights]::FullControl,
+                [System.Security.AccessControl.AccessControlType]::Allow))
+        }
+        if ($PSVersionTable.PSEdition -eq 'Desktop') { $pipe.SetAccessControl($acl) }
+        else { [System.IO.Pipes.PipesAclExtensions]::SetAccessControl($pipe, $acl) }
+    } else {
+        foreach ($rule in $acl.GetAccessRules($true, $true, [System.Security.Principal.SecurityIdentifier])) {
+            if ($rule.AccessControlType -eq 'Allow' -and $trusted -notcontains $rule.IdentityReference.Value) {
+                throw 'The brain pipe grants access to another Windows account.'
+            }
+        }
+    }
+} finally { $pipe.Dispose() }

package/scripts/install-windows-brain.ps1

@@ -0,0 +1,14 @@
+param([string]$ConfigRoot = (Join-Path $env:USERPROFILE '.agent-run'))
+$ErrorActionPreference = 'Stop'
+$ConfigRoot = [System.IO.Path]::GetFullPath($ConfigRoot)
+$runner = Join-Path $PSScriptRoot 'run-windows-brain.ps1'
+if ($ConfigRoot.Contains('"') -or $runner.Contains('"')) { throw 'Paths cannot contain quotes.' }
+$launcher = Join-Path $PSScriptRoot 'run-hidden.vbs'
+$wscript = Join-Path $env:SystemRoot 'System32\wscript.exe'
+$action = New-ScheduledTaskAction -Execute $wscript -Argument "//B //NoLogo `"$launcher`" `"$runner`" -ConfigRoot `"$ConfigRoot`"" -WorkingDirectory $env:USERPROFILE
+$principal = New-ScheduledTaskPrincipal -UserId ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name) -LogonType Interactive -RunLevel Limited
+$trigger = New-ScheduledTaskTrigger -AtLogOn -User ([System.Security.Principal.WindowsIdentity]::GetCurrent().Name)
+$settings = New-ScheduledTaskSettingsSet -StartWhenAvailable -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -ExecutionTimeLimit ([TimeSpan]::Zero) -RestartCount 3 -RestartInterval (New-TimeSpan -Minutes 1) -MultipleInstances IgnoreNew
+Register-ScheduledTask -TaskName 'Agent Brain' -Action $action -Principal $principal -Trigger $trigger -Settings $settings -Description 'Private local MCP brain server for agent-run.' -Force | Out-Null
+Start-ScheduledTask -TaskName 'Agent Brain'
+Write-Host "Agent Brain registered for sign-in and started. Log: $ConfigRoot\runtime\service.log"

package/scripts/run-hidden.vbs

@@ -0,0 +1,15 @@
+Option Explicit
+Dim shell, command, argument, i
+Set shell = CreateObject("WScript.Shell")
+If WScript.Arguments.Count < 1 Then WScript.Quit 2
+command = Quote(shell.ExpandEnvironmentStrings("%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe")) & " -NoProfile -NonInteractive -ExecutionPolicy Bypass -File"
+For i = 0 To WScript.Arguments.Count - 1
+    argument = WScript.Arguments(i)
+    If InStr(argument, Chr(34)) > 0 Then WScript.Quit 2
+    command = command & " " & Quote(argument)
+Next
+WScript.Quit shell.Run(command, 0, True)
+
+Function Quote(value)
+    Quote = Chr(34) & value & Chr(34)
+End Function

package/scripts/run-windows-brain.ps1

@@ -0,0 +1,23 @@
+param([Parameter(Mandatory = $true)][string]$ConfigRoot)
+$ErrorActionPreference = 'Stop'
+$env:Path = [Environment]::GetEnvironmentVariable('Path', 'Machine') + ';' + [Environment]::GetEnvironmentVariable('Path', 'User')
+$brain = Join-Path $PSScriptRoot '..\dist\agent-brain.js'
+$runtime = Join-Path $ConfigRoot 'runtime'
+New-Item -ItemType Directory -Path $runtime -Force | Out-Null
+$log = Join-Path $runtime 'service.log'
+$node = (Get-Command node.exe -ErrorAction Stop).Source
+# WScript prevents console flashes. Watch that launcher so stopping the task
+# also stops the server, even when Windows detaches the launcher's descendants.
+$launcherId = (Get-CimInstance Win32_Process -Filter "ProcessId=$PID").ParentProcessId
+$launcher = Get-Process -Id $launcherId -ErrorAction Stop
+$process = Start-Process -FilePath $node -ArgumentList @("`"$brain`"", 'serve', '--configdir', "`"$ConfigRoot`"") -WindowStyle Hidden -PassThru -RedirectStandardError $log -RedirectStandardOutput (Join-Path $runtime 'service-output.log')
+try {
+    while (-not $process.WaitForExit(1000)) {
+        if ($launcher.HasExited) { Stop-Process -Id $process.Id -ErrorAction SilentlyContinue; exit 0 }
+    }
+    exit $process.ExitCode
+} finally {
+    if (-not $process.HasExited) { Stop-Process -Id $process.Id -ErrorAction SilentlyContinue }
+    $process.Dispose()
+    $launcher.Dispose()
+}