@triflux/remote 10.42.0 → 10.44.0

package/hub/team/claude-daemon-control.mjs

@@ -464,25 +464,46 @@ export function sendClaudeControlRequest(
 
 // claude daemon 은 control.sock 의 mutating op(dispatch 등)에 control-key
 // 인증을 강제한다 (미제시 시 EAUTH "didn't present the daemon control key").
-// key 는 <configDir>/daemon/control.key (configDir 스코프별). 파일이 없으면
-// 인증 미강제 daemon 으로 보고 auth 필드를 생략한다 (fail-open — 구버전 호환).
+// OMC runtime config 는 .omc-launch-profile.json 의 sourceConfigDir 에서 key 를
+// 발급한다. control.sock 은 runtime config hash 를 쓰더라도 auth 는 발급 config
+// 에서 읽어야 한다. 일반 daemon 은 <configDir>/daemon/control.key 를 사용한다.
+// 어느 경로에도 파일이 없으면 인증 미강제 daemon 으로 보고 auth 를 생략한다
+// (fail-open — 구버전 호환).
 export async function readDaemonControlKey(
   configDir = resolveClaudeConfigDir(),
+  { diagnostics } = {},
 ) {
-  try {
-    const key = await fs.readFile(
-      path.join(configDir, "daemon", "control.key"),
-      "utf8",
-    );
-    return key.trim() || undefined;
-  } catch {
-    return undefined;
+  if (!configDir) return undefined;
+
+  const runtimeConfigDir = path.resolve(configDir);
+  const omcProfile = await readOmcLaunchProfile(runtimeConfigDir);
+  const keyConfigDirs = [omcProfile?.sourceConfigDir, runtimeConfigDir].filter(
+    (candidate, index, entries) =>
+      candidate && entries.indexOf(candidate) === index,
+  );
+
+  for (const keyConfigDir of keyConfigDirs) {
+    const keyPath = path.join(keyConfigDir, "daemon", "control.key");
+    try {
+      const key = await fs.readFile(keyPath, "utf8");
+      if (key.trim()) return key.trim();
+    } catch (error) {
+      if (error?.code === "ENOENT") continue;
+      if (Array.isArray(diagnostics)) {
+        diagnostics.push({
+          code: error?.code || "UNKNOWN",
+          path: keyPath,
+          message: error?.message || String(error),
+        });
+      }
+    }
   }
+  return undefined;
 }
 
-export async function buildDaemonControlAuth(configDir) {
+export async function buildDaemonControlAuth(configDir, opts = {}) {
   if (!configDir) return {};
-  const auth = await readDaemonControlKey(configDir);
+  const auth = await readDaemonControlKey(configDir, opts);
   return auth ? { auth } : {};
 }
 

package/hub/team/cli/commands/start/parse-args.mjs

@@ -74,7 +74,7 @@ export function parseTeamArgs(args = []) {
   const assigns = []; // --assign "codex:프롬프트:역할" 형식
   let autoAttach = true;
   let progressive = true;
-  let timeoutSec = 300;
+  let timeoutSec = 0;
   let verbose = false;
   let dashboard = true;
   let dashboardLayout = "lite";
@@ -130,7 +130,7 @@ export function parseTeamArgs(args = []) {
     } else if (current === "--no-progressive") {
       progressive = false;
     } else if (current === "--timeout" && args[index + 1]) {
-      timeoutSec = Number(args[++index]) || 300;
+      timeoutSec = Number(args[++index]) || 0;
     } else if (current === "--mcp-profile" && args[index + 1]) {
       mcpProfile = args[++index].trim();
     } else if ((current === "--model" || current === "-m") && args[index + 1]) {

package/hub/team/conductor.mjs

@@ -19,6 +19,8 @@ import {
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { createRegistry } from "@triflux/core/mesh/mesh-registry.mjs";
+import { resolveNestedCodexAgentProfile } from "../../scripts/lib/cli-codex.mjs";
+import { codexProfileConfigOverrides } from "../../scripts/lib/codex-profile-config.mjs";
 import { broker } from "@triflux/core/hub/account-broker.mjs";
 import { runPreflight as runCodexPreflight } from "@triflux/core/hub/codex-preflight.mjs";
 import {
@@ -608,7 +610,9 @@ export function createConductor(opts = {}) {
       cli: session.config.agent,
       prompt: session.config.prompt,
       profile: session.config.profile,
+      role: session.config.role,
       model: session.config.model,
+      env: session.config.env,
       mcpServers: session.config.mcpServers,
       excludeMcpServers,
       resolveCommand: opts.deps?.resolveCliExecutable,
@@ -902,8 +906,25 @@ export function createConductor(opts = {}) {
     } else if (agent === "gemini") {
       remoteBin = "gemini -y";
     } else {
-      remoteBin =
-        "codex exec -s danger-full-access --dangerously-bypass-approvals-and-sandbox";
+      const codexHome = session.config.env?.CODEX_HOME;
+      const profile = resolveNestedCodexAgentProfile(
+        session.config.role || "executor",
+        {
+          profileOverride: session.config.profile ?? "auto",
+          globalProfile:
+            session.config.env?.TFX_CODEX_PROFILE ??
+            process.env.TFX_CODEX_PROFILE,
+          codexHome,
+        },
+      );
+      const configArgs = codexProfileConfigOverrides(profile, {
+        codexHome,
+        disallowUltra: true,
+        enforceCanonicalProfile: true,
+      })
+        .map((override) => `-c '${override.replace(/'/g, `'\\''`)}'`)
+        .join(" ");
+      remoteBin = `codex exec${configArgs ? ` ${configArgs}` : ""} -s danger-full-access --dangerously-bypass-approvals-and-sandbox`;
     }
 
     // prompt는 stdin으로 전달 — 셸 이스케이프 문제 완전 회피

package/hub/team/execution-mode.mjs

@@ -2,12 +2,7 @@
 
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, resolve as pathResolve } from "node:path";
-
-// scripts/lib is bundled into @triflux/remote itself (package.json files), so
-// import the local mirror relatively rather than via @triflux/core. The core
-// peer range (^10.0.0-alpha.1) could resolve to a build that predates this
-// export, which would fail at import time; the bundled copy is version-skew
-// safe and always carries the matching codexProfileConfigOverrides.
+import { resolveNestedCodexAgentProfile } from "../../scripts/lib/cli-codex.mjs";
 import { codexProfileConfigOverrides } from "../../scripts/lib/codex-profile-config.mjs";
 import { whichCommand } from "@triflux/core/hub/platform.mjs";
 
@@ -165,7 +160,17 @@ export function buildSpawnSpecForMode(mode, opts = {}) {
   // still contains an inline [profiles.X] table (which codex re-injects on
   // config rewrite). These go straight to spawn argv (shell: false), so push
   // the raw TOML-scalar overrides without shell-quoting.
-  for (const override of codexProfileConfigOverrides(opts.profile)) {
+  const codexHome = opts.env?.CODEX_HOME;
+  const codexProfile = resolveNestedCodexAgentProfile(opts.role || "executor", {
+    profileOverride: opts.profile ?? "auto",
+    globalProfile: opts.env?.TFX_CODEX_PROFILE ?? process.env.TFX_CODEX_PROFILE,
+    codexHome,
+  });
+  for (const override of codexProfileConfigOverrides(codexProfile, {
+    codexHome,
+    disallowUltra: true,
+    enforceCanonicalProfile: true,
+  })) {
     args.push("-c", override);
   }
   if (Array.isArray(opts.mcpServers)) {