@technomoron/agent-run 0.99.40 → 0.99.41

package/CHANGES

@@ -1,6 +1,17 @@
 CHANGES
 =======
 
+Version 0.99.41 (2026-09-25)
+----------------------------
+* Use a shared Codex home with native named profiles, keeping project
+  instructions, MCP configuration and same-name skills separate. Codex 0.157
+  profile launches avoid the automatic per-project daemon installation and
+  Unix socket path-length failure while using the global executable.
+* Preserve old session rollouts through a non-overwriting migration; retain
+  original project homes and let Codex rebuild its derived session index.
+* Use the native unelevated Windows sandbox by default for generated profiles
+  and start Codex from the source project directory.
+
 Version 0.99.40 (2026-09-24)
 ----------------------------
 * Add native Windows agent-brain service and MCP bridging over per-user named

package/README.md

@@ -61,6 +61,11 @@ Example:
 ```text
 ~/.agent-run/
   agent-run.defaults.jsonc
+  runtime/codex/         # shared, ignored Codex home
+    agent-run-<id>.config.toml
+    skills/agent-run-<id>/
+    sessions/
+    memories/
   org/
     my-api/
       agent-run.jsonc
@@ -77,8 +82,6 @@ Example:
           codex-home/
             AGENTS.md
             config.toml
-            memories/    # native Codex memory, local generated state
-            skills/
         gemini/
           AGENTS.md
           settings.json
@@ -107,8 +110,10 @@ the agent config tree.
 - `overrides/`: optional per-profile template overrides
 - `notes/memory/`: durable project memory shared through the config repository
 - `live/memories/codex-home/AGENTS.md`: generated Codex instructions
-- `live/memories/codex-home/config.toml`: generated Codex config
-- `live/memories/codex-home/skills/`: generated Codex skills
+- `live/memories/codex-home/config.toml`: rendered Codex template for inspection
+- `<config-root>/runtime/codex/`: shared Codex home, authentication and session state
+- `runtime/codex/agent-run-<id>.config.toml`: named Codex profile with project instructions and settings
+- `runtime/codex/skills/agent-run-<id>/`: generated skills, enabled only for that profile
 - `live/CLAUDE.md`: generated Claude instructions
 - `live/.claude/`: generated Claude settings, MCP configuration, and local
   plugin skills
@@ -288,15 +293,30 @@ and `agent-run grok --help` pass `--help` through to the underlying tool.
 For any native agent command, use `--generate` to generate profile files
 without launching the underlying tool.
 
-Codex defaults to `-a on-request -s workspace-write`. `agent-run` sets
-`CODEX_HOME` under the private agent directory, where Codex discovers the
-generated `AGENTS.md`, `config.toml`, and skills natively. It starts Codex from
-that private directory, passes the project root with `-C`, and keeps generated
-guard shims on `PATH`. Use `--network` to enable network access in the
-workspace-write sandbox.
-When `~/.codex/auth.json` exists, profile-specific Codex homes link their
-`auth.json` to that shared login cache so changing profiles does not require a
-new ChatGPT login.
+Codex defaults to `-a on-request -s workspace-write`. `agent-run` uses one
+`CODEX_HOME` at `<config-root>/runtime/codex` and selects a generated named
+profile with `--profile`. Project instructions are added through
+`developer_instructions`; MCP settings and per-skill enablement stay in the
+named profile. The normal global Codex executable is used. Codex 0.157.0 runs
+named-profile sessions with its embedded backend, avoiding automatic daemon
+package copies and the long per-project Unix socket path. Agent-run does not
+add `--no-daemon`. This layout requires Codex with named profile-file support
+(0.134.0 or newer); Windows and Debian are tested with 0.157.0.
+
+Codex starts from the project root, also passed with `-C`, with generated guard
+shims on `PATH`. Use `--network` to enable network access in the workspace-write
+sandbox. Windows profiles default to the native unelevated sandbox unless the
+profile template specifies another mode. When `~/.codex/auth.json` exists, the
+shared home links that login cache (copies it when Windows cannot create file
+symlinks), so changing projects does not require another login.
+
+On first use of each old project home, agent-run copies its `sessions/` and
+`archived_sessions/` rollouts into the shared home without overwriting existing
+files. Codex rebuilds its derived session index. Original files, databases,
+history, native memories and old daemon packages remain untouched in the old
+home; databases and daemon installations are not copied. Close old agent-run
+sessions before upgrading so their final turns are included. New sessions and
+native memories use the shared home; durable project knowledge remains separate.
 
 ### Project Memory
 
@@ -306,7 +326,7 @@ current task. Agents may update project memory when the user explicitly requests
 authorizes a standing workflow, such as saving durable corrections and updating
 affected specs. This authorization does not permit Git or external-service writes.
 
-Codex's native `$CODEX_HOME/memories/` remains under ignored `live/` state. It
+Codex's native `$CODEX_HOME/memories/` lives in the ignored shared home. It
 is generated, machine-local recall data and is not copied into the tracked
 project memory directory. Project memory is plain Markdown so it can be
 reviewed and shared through the Git repository that normally holds the
@@ -421,7 +441,8 @@ then rewrites generated files:
 - `live/CLAUDE.md`
 - `live/memories/codex-home/AGENTS.md`
 - `live/memories/codex-home/config.toml`
-- `live/memories/codex-home/skills/**`
+- `<config-root>/runtime/codex/agent-run-<id>.config.toml`
+- `<config-root>/runtime/codex/skills/agent-run-<id>/**`
 - `live/.claude/**`
 - `live/gemini/**`
 - `live/grok/**`

package/dist/agents/codex.js

@@ -9,14 +9,15 @@ const render_settings_1 = require("../config/render-settings");
 const render_skills_1 = require("../config/render-skills");
 const environment_1 = require("../runtime/environment");
 const shared_state_1 = require("../runtime/shared-state");
+const codex_profile_1 = require("../runtime/codex-profile");
 const shared_1 = require("./shared");
 function layout(context) {
     return {
         dir: context.paths.codexHomeDir,
         instructionFile: path.join(context.paths.codexHomeDir, 'AGENTS.md'),
-        configFiles: [path.join(context.paths.codexHomeDir, 'config.toml')],
-        skillsDir: context.paths.codexSkillsDir,
-        requiredDirs: [context.paths.codexHomeDir, context.paths.codexSkillsDir],
+        configFiles: [path.join(context.paths.codexHomeDir, 'config.toml'), path.join((0, codex_profile_1.codexSharedHome)(context), `${(0, codex_profile_1.codexProfileName)(context)}.config.toml`)],
+        skillsDir: (0, codex_profile_1.codexProfileSkills)(context),
+        requiredDirs: [context.paths.codexHomeDir, (0, codex_profile_1.codexProfileSkills)(context)],
         preservedSkillNames: new Set(['.system'])
     };
 }
@@ -24,9 +25,11 @@ function generate(generation) {
     const agentLayout = layout(generation.context);
     const baseConfig = (0, render_settings_1.renderProfileConfig)(generation.env, generation.configRoot, generation.context, 'codex-config.toml.njk', 'global/tool-templates/codex-config.toml.njk', () => (0, defaults_1.defaultCodexConfigContent)(generation.context), 'Codex config.toml', generation.trace);
     const mcp = (0, render_mcp_1.renderCodexMcp)(generation.context);
+    const config = `${baseConfig.trimEnd()}${mcp ? `\n\n${mcp}` : '\n'}`;
     const files = [
         { path: agentLayout.instructionFile, content: generation.agentsMd },
-        { path: agentLayout.configFiles[0] ?? '', content: `${baseConfig.trimEnd()}${mcp ? `\n\n${mcp}` : '\n'}` },
+        { path: agentLayout.configFiles[0] ?? '', content: config },
+        { path: agentLayout.configFiles[1] ?? '', content: (0, codex_profile_1.renderCodexProfile)(generation.context, config, generation.agentsMd), atomic: true },
         ...(0, render_skills_1.renderSkillFiles)(generation.context, agentLayout.skillsDir)
     ];
     return { ...agentLayout, id: 'codex', projectDir: generation.context.projectRoot, files, context: generation.context };
@@ -46,7 +49,16 @@ exports.codexAdapter = {
     layout,
     generate,
     prepare(runtime) {
-        (0, shared_state_1.linkSharedEntry)(path.join(os.homedir(), '.codex', 'auth.json'), path.join(runtime.dir, 'auth.json'), 'profile Codex auth');
+        (0, shared_state_1.linkSharedEntry)(path.join(os.homedir(), '.codex', 'auth.json'), path.join((0, codex_profile_1.codexSharedHome)(runtime.context), 'auth.json'), 'shared Codex auth');
+        (0, codex_profile_1.migrateCodexSessions)(runtime.dir, (0, codex_profile_1.codexSharedHome)(runtime.context));
+        const profile = runtime.files.find((file) => file.path === runtime.configFiles[1]);
+        const base = runtime.files.find((file) => file.path === runtime.configFiles[0]);
+        const instructions = runtime.files.find((file) => file.path === runtime.instructionFile);
+        if (profile && base && instructions) {
+            profile.content = (0, codex_profile_1.renderCodexProfile)(runtime.context, base.content, instructions.content);
+        }
+        // Disable the pending skills in other profiles before making them discoverable.
+        (0, codex_profile_1.refreshCodexProfileSkills)(runtime.context);
     },
     spawn(runtime, options) {
         (0, shared_1.assertRuntimeFile)('codex', runtime.instructionFile, runtime.context.profileDir);
@@ -56,6 +68,7 @@ exports.codexAdapter = {
         return {
             command: options.binary,
             args: [
+                '--profile', (0, codex_profile_1.codexProfileName)(runtime.context),
                 ...runtimeArgs,
                 '--add-dir',
                 runtime.context.paths.projectMemoryDir,
@@ -66,8 +79,8 @@ exports.codexAdapter = {
                     : []),
                 ...options.passthroughArgs
             ],
-            cwd: runtime.dir,
-            env: { ...(0, environment_1.buildAgentEnvironment)(runtime.context), CODEX_HOME: runtime.dir },
+            cwd: runtime.projectDir,
+            env: { ...(0, environment_1.buildAgentEnvironment)(runtime.context), CODEX_HOME: (0, codex_profile_1.codexSharedHome)(runtime.context) },
             onExit: (0, shared_1.withPostflight)(runtime, options.wrapperArgs)
         };
     },

package/dist/constants.js

@@ -33,6 +33,8 @@ exports.BRAIN_GITIGNORE_ENTRIES = [
     ''
 ];
 exports.GENERATED_GITIGNORE_ENTRIES = [
+    '# Shared machine-local Codex state',
+    '/runtime/codex/',
     '# Generated agent-run live profiles',
     '**/live/',
     '',

package/dist/renderer.js

@@ -18,6 +18,7 @@ const project_1 = require("./project");
 const templates_1 = require("./templates");
 const utils_1 = require("./utils");
 const config_1 = require("./brain/config");
+const codex_profile_1 = require("./runtime/codex-profile");
 function renderProfile(projectRoot, agentDir, checkOnly = false, targetTool = null, trace, options) {
     const configRoot = options?.configRoot ?? (0, project_1.defaultConfigRoot)(projectRoot);
     const profile = options?.profile ?? (0, project_1.resolveProfile)(projectRoot);
@@ -92,11 +93,14 @@ function syncAgentProfile(projectRoot, agentDir, options) {
     return syncRenderedProfile(rendered);
 }
 function syncRenderedProfile(rendered) {
+    return (0, codex_profile_1.withCodexProfileLock)(rendered.context, () => writeRenderedProfile(rendered));
+}
+function writeRenderedProfile(rendered) {
     (0, config_tree_1.ensureConfigRootGitignore)(rendered.configRoot);
     syncRuntimeDirs(rendered);
     removeStaleGeneratedEntries(rendered);
     for (const file of rendered.files) {
-        writeGeneratedFile(file.path, file.content, file.executable ?? false);
+        writeGeneratedFile(file.path, file.content, file.executable ?? false, file.atomic ?? false);
     }
     removeLegacyGeneratedCodexFiles(rendered.context);
     removeLegacyGeneratedClaudeSettings(rendered.context);
@@ -129,11 +133,14 @@ function syncRuntimeDirs(rendered) {
         }
     }
 }
-function writeGeneratedFile(filePath, content, executable) {
+function writeGeneratedFile(filePath, content, executable, atomic) {
     fs.mkdirSync(path.dirname(filePath), { recursive: true });
     const unchanged = fs.existsSync(filePath) && fs.readFileSync(filePath, 'utf8') === content;
     if (!unchanged) {
-        fs.writeFileSync(filePath, content, 'utf8');
+        if (atomic)
+            (0, codex_profile_1.writeCodexProfileFile)(filePath, content);
+        else
+            fs.writeFileSync(filePath, content, 'utf8');
         (0, utils_1.verbose)(`write ${filePath}`);
     }
     if (executable && !constants_1.IS_WINDOWS) {

package/dist/runtime/codex-profile.js

@@ -0,0 +1,184 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.codexSharedHome = codexSharedHome;
+exports.codexProfileName = codexProfileName;
+exports.codexProfileSkills = codexProfileSkills;
+exports.renderCodexProfile = renderCodexProfile;
+exports.refreshCodexProfileSkills = refreshCodexProfileSkills;
+exports.writeCodexProfileFile = writeCodexProfileFile;
+exports.withCodexProfileLock = withCodexProfileLock;
+exports.migrateCodexSessions = migrateCodexSessions;
+const fs = require("fs");
+const path = require("path");
+const crypto_1 = require("crypto");
+const smol_toml_1 = require("smol-toml");
+function codexSharedHome(context) {
+    return path.join(context.configRoot, 'runtime', 'codex');
+}
+function codexProfileName(context) {
+    const identity = path.resolve(context.profileDir);
+    const canonical = process.platform === 'win32' ? identity.toLowerCase() : identity;
+    return `agent-run-${(0, crypto_1.createHash)('sha256').update(canonical).digest('hex').slice(0, 20)}`;
+}
+function codexProfileSkills(context) {
+    return path.join(codexSharedHome(context), 'skills', codexProfileName(context));
+}
+// Only scan agent-run's generated skills. Personal/system skills keep their native settings.
+function generatedSkills(home) {
+    const root = path.join(home, 'skills');
+    if (!fs.existsSync(root))
+        return [];
+    const files = [];
+    for (const profile of fs.readdirSync(root, { withFileTypes: true })) {
+        if (!profile.isDirectory() || !/^agent-run-[a-f0-9]{20}$/.test(profile.name))
+            continue;
+        const dir = path.join(root, profile.name);
+        for (const skill of fs.readdirSync(dir, { withFileTypes: true })) {
+            const file = path.join(dir, skill.name, 'SKILL.md');
+            if (skill.isDirectory() && fs.existsSync(file))
+                files.push(file);
+        }
+    }
+    return files.sort();
+}
+function configureSkills(config, home, profile, files) {
+    const settings = (config.skills ?? {});
+    const existing = (settings.config ?? []);
+    const generatedRoot = path.join(home, 'skills') + path.sep;
+    const isGenerated = (file) => {
+        const relative = path.resolve(file).slice(generatedRoot.length);
+        return path.resolve(file).startsWith(generatedRoot) && /^agent-run-[a-f0-9]{20}[\\/]/.test(relative);
+    };
+    settings.config = [
+        ...existing.filter((entry) => !isGenerated(entry.path)),
+        ...files.map((file) => ({
+            path: file,
+            enabled: path.dirname(path.dirname(file)) === path.join(home, 'skills', profile)
+                && (existing.find((entry) => entry.path === file)?.enabled ?? true)
+        }))
+    ];
+    config.skills = settings;
+}
+function renderCodexProfile(context, base, instructions) {
+    const config = (0, smol_toml_1.parse)(base);
+    config.developer_instructions = [config.developer_instructions, instructions].filter(Boolean).join('\n\n');
+    if (process.platform === 'win32') {
+        // A fresh home otherwise silently downgrades workspace-write to read-only.
+        config.windows = { sandbox: 'unelevated', ...(config.windows ?? {}) };
+    }
+    configureSkills(config, codexSharedHome(context), codexProfileName(context), pendingSkills(context));
+    return (0, smol_toml_1.stringify)(config) + '\n';
+}
+function pendingSkills(context) {
+    const ownDir = codexProfileSkills(context);
+    const others = generatedSkills(codexSharedHome(context)).filter((file) => path.dirname(path.dirname(file)) !== ownDir);
+    const own = context.skills.map((skill) => path.join(ownDir, skill.name, 'SKILL.md'));
+    return [...new Set([...others, ...own])].sort();
+}
+// Refresh older generated profiles too: newly generated project skills must not
+// become enabled in another profile merely because they share a discovery root.
+function refreshCodexProfileSkills(context) {
+    const home = codexSharedHome(context);
+    const files = pendingSkills(context);
+    for (const entry of fs.readdirSync(home)) {
+        if (!/^agent-run-[a-f0-9]{20}\.config\.toml$/.test(entry))
+            continue;
+        const file = path.join(home, entry);
+        const original = fs.readFileSync(file, 'utf8');
+        const config = (0, smol_toml_1.parse)(original);
+        configureSkills(config, home, entry.replace('.config.toml', ''), files);
+        const content = (0, smol_toml_1.stringify)(config) + '\n';
+        if (content !== original)
+            writeCodexProfileFile(file, content);
+    }
+}
+function writeCodexProfileFile(file, content) {
+    const temporary = `${file}.${(0, crypto_1.randomUUID)()}.tmp`;
+    try {
+        fs.writeFileSync(temporary, content, { encoding: 'utf8', mode: 0o600 });
+        fs.renameSync(temporary, file);
+    }
+    finally {
+        fs.rmSync(temporary, { force: true });
+    }
+}
+// Profile refresh, skill publication and session migration share one writer.
+// Codex readers see complete profile files through atomic rename.
+function withCodexProfileLock(context, run) {
+    const home = codexSharedHome(context);
+    fs.mkdirSync(home, { recursive: true });
+    const lock = path.join(home, '.agent-run-sync.lock');
+    const deadline = Date.now() + 30000;
+    let descriptor;
+    for (;;) {
+        try {
+            descriptor = fs.openSync(lock, 'wx', 0o600);
+            break;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            try {
+                const owner = Number(fs.readFileSync(lock, 'utf8'));
+                if (Number.isInteger(owner) && owner > 0) {
+                    try {
+                        process.kill(owner, 0);
+                    }
+                    catch (probe) {
+                        if (probe.code === 'ESRCH') {
+                            fs.rmSync(lock, { force: true });
+                            continue;
+                        }
+                    }
+                }
+            }
+            catch (readError) {
+                if (readError.code === 'ENOENT')
+                    continue;
+                throw readError;
+            }
+            if (Date.now() >= deadline)
+                throw new Error(`Timed out waiting for Codex profile generation: ${lock}`);
+            Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
+        }
+    }
+    try {
+        fs.writeFileSync(descriptor, String(process.pid));
+        return run();
+    }
+    finally {
+        fs.closeSync(descriptor);
+        fs.rmSync(lock, { force: true });
+    }
+}
+function migrateCodexSessions(legacyHome, sharedHome) {
+    const marker = path.join(sharedHome, 'agent-run-migrations', `${(0, crypto_1.createHash)('sha256').update(path.resolve(legacyHome)).digest('hex')}.json`);
+    if (fs.existsSync(marker))
+        return;
+    // Rollouts are Codex's durable session source. Let Codex rebuild its derived
+    // database; never merge SQLite files or copy daemon installs, sockets or locks.
+    function copyMissing(source, target) {
+        if (!fs.existsSync(source))
+            return;
+        for (const entry of fs.readdirSync(source, { withFileTypes: true })) {
+            const from = path.join(source, entry.name);
+            const to = path.join(target, entry.name);
+            if (entry.isDirectory())
+                copyMissing(from, to);
+            else if (entry.isFile() && entry.name.endsWith('.jsonl')) {
+                fs.mkdirSync(target, { recursive: true });
+                try {
+                    fs.copyFileSync(from, to, fs.constants.COPYFILE_EXCL);
+                }
+                catch (error) {
+                    if (error.code !== 'EEXIST')
+                        throw error;
+                }
+            }
+        }
+    }
+    for (const dir of ['sessions', 'archived_sessions'])
+        copyMissing(path.join(legacyHome, dir), path.join(sharedHome, dir));
+    fs.mkdirSync(path.dirname(marker), { recursive: true });
+    fs.writeFileSync(marker, JSON.stringify({ source: legacyHome, migrated: new Date().toISOString() }) + '\n');
+}

package/dist/templates.js

@@ -12,6 +12,7 @@ const nunjucks = require("nunjucks");
 const constants_1 = require("./constants");
 const utils_1 = require("./utils");
 const config_1 = require("./brain/config");
+const codex_profile_1 = require("./runtime/codex-profile");
 function createNunjucksEnv(configRoot) {
     return new nunjucks.Environment(new nunjucks.FileSystemLoader(configRoot, { noCache: true }), {
         autoescape: false,
@@ -82,10 +83,10 @@ function buildRenderContext(projectRoot, profileDir, configRoot, manifest, env)
         memoriesDir,
         globalMemoryDir: (0, config_1.readBrainConfig)(configRoot)?.enabled ? path.join(configRoot, 'global', 'memory') : path.join(configRoot, 'notes', 'memory'),
         projectMemoryDir,
-        nativeMemoryDir: path.join(codexHomeDir, 'memories'),
+        nativeMemoryDir: path.join(configRoot, 'runtime', 'codex', 'memories'),
         codexHomeDir,
         overridesDir: path.join(profileDir, 'overrides'),
-        codexSkillsDir: path.join(codexHomeDir, 'skills'),
+        codexSkillsDir: (0, codex_profile_1.codexProfileSkills)(baseContext),
         claudeSkillsDir: path.join(liveDir, '.claude', 'skills'),
         geminiRuntimeDir,
         geminiHomeDir,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@technomoron/agent-run",
-  "version": "0.99.40",
+  "version": "0.99.41",
   "packageManager": "pnpm@10.34.5",
   "bin": {
     "agent-run": "dist/agent-run.js",
@@ -35,7 +35,8 @@
     "clean:dist": "rimraf ./dist/",
     "cleanbuild": "run-s clean:dist build",
     "prepack": "run-s build",
-    "test": "run-s build test:integration test:release",
+    "test": "run-s build test:codex-profiles test:integration test:release",
+    "test:codex-profiles": "node --test scripts/test-codex-profiles.cjs",
     "test:brain": "node --test scripts/test-brain.cjs",
     "test:integration": "bash ./scripts/test.sh",
     "test:release": "bash ./scripts/test-release.sh",
@@ -65,6 +66,7 @@
     "cross-spawn": "^7.0.6",
     "jsonc-parser": "^3.3.1",
     "nunjucks": "^3.2.4",
+    "smol-toml": "^1.9.0",
     "yaml": "^2.9.0",
     "zod": "^4.5.4"
   }