agent-relay-runner 0.129.11 → 0.129.13

package/src/launch-assembly.ts

@@ -1,6 +1,6 @@
-import { existsSync, readdirSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { resolve, join } from "node:path";
-import type { AgentProfile, AgentProfileBase, ProvisioningHookSet, ProvisioningMcpServer, SpawnProvider } from "agent-relay-sdk";
+import { isCodexLeanWorkerProfile, type AgentProfile, type AgentProfileBase, type ProvisioningHookSet, type ProvisioningMcpServer, type SpawnProvider } from "agent-relay-sdk";
 import { shellQuote } from "agent-relay-sdk/shell-utils";
 import {
   profileAllowsRelayFeature,
@@ -35,15 +35,39 @@ import {
   writeClaudeSettingsJson,
 } from "./provisioning";
 import {
+  claudeMcpConfigPayload,
   claudeMcpLaunchArgs,
   codexProvisionedMcpArgs,
+  codexProvisionedMcpTimeoutArgs,
   relayMcpCodexConfigArgs,
   resolveSharedMcpUrl,
   sharedMcpBridgeServer,
+  sharedMcpMetaOnlyServer,
+  writeSharedMcpMetaOnlyConfig,
+  SHARED_MCP_METAONLY_CONFIG_FILENAME,
+  type MetaOnlyRelayDownstream,
   tomlString,
+  upsertTomlTable,
+  writeCodexMcpServersToml,
   RELAY_MCP_SERVER_NAME,
   SHARED_MCP_SERVER_NAME,
 } from "./relay-mcp";
+import {
+  applyNativeMemoryBelt,
+  claudeManagedNativeMemorySettings,
+  resolveClaudeNativeMemoryLever,
+  resolveNativeMemoryLever,
+  writeCodexFeaturesToml,
+  type NativeMemoryLever,
+} from "./native-memory-lever";
+
+// #1565 P5.7 — relay's inline `--settings` actually reaches this launch. Same gate
+// `claudeSettingsArgs` applies below, passed to the lever so its applied/suppressed report cannot
+// claim a settings key the merge then drops.
+const callerSettingsMergeable = (argLists: string[][]): boolean => {
+  const caller = extractCallerSettings(argLists);
+  return !caller || Boolean(caller.settings);
+};
 
 // #557 — THE single launch-assembly contract. Given a resolved AgentProfile (+ its
 // spawn-time ResolvedProvisioning), `assembleLaunch` produces ONE provider-neutral
@@ -111,8 +135,10 @@ export interface AssembledMcp {
    *  the same `--mcp-config` / `-c` channel so it survives strict. `url` is the listener the
    *  bridge connects to. Undefined when projection is OFF (the default). The bridge is opaque
    *  at assembly time — its server SET is owned by the listener config, not enumerated here.
-   *  The identity-bearing relay endpoint is never on the shared listener (#215). */
-  sharedListener?: { url: string };
+   *  The identity-bearing relay endpoint is never on the shared listener (#215). #1450 —
+   *  `relayFronted` marks a metaOnly callmux that ALSO fronts the relay endpoint on-demand as a
+   *  second downstream (via the runner proxy, so identity/#215 hold); the relay stays per-agent. */
+  sharedListener?: { url: string; metaOnly?: boolean; relayFronted?: boolean };
 }
 
 export interface AssembledLaunch {
@@ -148,6 +174,12 @@ export interface AssembledLaunch {
    *  consume hooks.json. Drives a LOUD projection warning so a baseline guard is never
    *  SILENTLY absent while the report says "applied". */
   hooksSuppressed?: { reason: string; names: string[] };
+  /** #1565 P5.7 — the provider-NATIVE-memory lever this launch carries. `policy:"default"` means
+   *  the profile declared nothing: no env/arg/settings key was emitted and the launch is
+   *  byte-identical to a pre-P5.7 one. Any other policy renders EXPLICITLY in both directions.
+   *  `suppressed` names a lever that was resolved but could not be delivered on this base — the
+   *  `hooksSuppressed` anti-lie precedent (#1096), so a lever is never silently absent. */
+  nativeMemory: NativeMemoryLever;
   /** #1096 review — Claude only: true when the caller's own `--settings` was folded into the
    *  relay-emitted `--settings` (relay hooks/projectSettings/statusLine merged in). The adapter
    *  must then STRIP the caller's `--settings` from the provider args so exactly one reaches the
@@ -235,12 +267,16 @@ function claudeSettingsArgs(
   provisionedHooks: ProvisioningHookSet,
   hookNames: string[],
   includeStatusLine: boolean,
+  nativeMemorySettings: Record<string, unknown>,
   ...argLists: string[][]
 ): ClaudeSettingsResolution {
   const relaySettings: Record<string, unknown> = {
     ...projectSettings,
     ...(Object.keys(provisionedHooks).length ? { hooks: provisionedHooks } : {}),
     ...(includeStatusLine ? relayStatusLineSettings() : {}),
+    // #1565 P5.7 — LAST, so a project `.claude/settings.json` cannot quietly re-enable a
+    // profile's native memory. (Claude's own env predicate outranks all of this either way.)
+    ...nativeMemorySettings,
   };
   const hasProvisionedHooks = Object.keys(provisionedHooks).length > 0;
   const caller = extractCallerSettings(argLists);
@@ -374,6 +410,123 @@ function assembleInstructions(config: RunnerSpawnConfig): AssembledInstructions
   };
 }
 
+// ── Per-provider MCP resolution (shared by assemble + materialize) ─────────────────
+
+interface ClaudeMcpResolution {
+  declaredMcp: Record<string, ProvisioningMcpServer>;
+  hostMcp: Record<string, ProvisioningMcpServer>;
+  relayEndpoint: boolean;
+  strictMcp: boolean;
+  mcpServers: string[];
+  projectServers: string[];
+  hostMcpServers: string[];
+  sharedListenerUrl?: string;
+}
+
+// #557/#1292 — a PURE function of `config`, called independently from both `assembleClaude`
+// (decides args/paths) and `materializeClaudeAssets` (writes the mcp-config.json the args
+// reference). Both calls MUST derive the identical `declaredMcp`/`hostMcp` set — a
+// mismatch would mean the launched `--mcp-config <path>` points at a file that doesn't
+// carry what was assembled/reported.
+function resolveClaudeDeclaredMcp(config: RunnerSpawnConfig): ClaudeMcpResolution {
+  const provisionedMcp = profileProvisioning(config).mcpServers;
+  const mcpServers = Object.keys(provisionedMcp).filter((name) => name !== RELAY_MCP_SERVER_NAME);
+  const relayEndpoint = profileAllowsRelayFeature(config, "mcp");
+
+  const projectMcpRaw = resolveProjectMcpServers(config);
+  const projectMcp = Object.fromEntries(
+    Object.entries(projectMcpRaw).filter(
+      ([name]) => name !== RELAY_MCP_SERVER_NAME && !(name in provisionedMcp),
+    ),
+  );
+  const projectServers = Object.keys(projectMcp);
+
+  const sharedListenerOn = Boolean(config.agentProfile?.sharedMcp);
+  const sharedListenerUrl = sharedListenerOn ? resolveSharedMcpUrl(config.sharedMcpUrl) : undefined;
+  const sharedMcp: Record<string, ProvisioningMcpServer> = sharedListenerUrl
+    ? { [SHARED_MCP_SERVER_NAME]: sharedMcpBridgeServer(sharedListenerUrl, config.cwd) }
+    : {};
+  const declaredMcp = { ...projectMcp, ...provisionedMcp, ...sharedMcp };
+
+  const strictMcp = claudeLaunchPromptGateSettings(config).strictMcpConfig;
+  const usesHostMcp = profileUsesProviderHostGlobals(config)
+    && (!config.agentProfile || config.agentProfile.mcp.mode === "host");
+  const hostMcp = usesHostMcp ? hostUserScopeMcpServers() : {};
+  const hostMcpServers = Object.keys(hostMcp).filter(
+    (name) => name !== RELAY_MCP_SERVER_NAME && !(name in declaredMcp),
+  );
+
+  return { declaredMcp, hostMcp, relayEndpoint, strictMcp, mcpServers, projectServers, hostMcpServers, sharedListenerUrl };
+}
+
+interface CodexMcpResolution {
+  declaredMcp: Record<string, ProvisioningMcpServer>;
+  mcpServers: string[];
+  projectServers: string[];
+  sharedListenerUrl?: string;
+  /** #1575 — set when the shared-listener route is served through a per-agent metaOnly callmux
+   *  (Codex worker) rather than the plain flat bridge. Carries the exact config path/url/cwd so
+   *  materializeCodexAssets writes the SAME file assembleCodex's descriptor points at. #1450 —
+   *  `relay` adds the identity-bearing relay endpoint as a SECOND downstream (via the runner proxy)
+   *  when the proxy is active, so the on-demand relay set loads through callmux_call. */
+  metaOnlyCallmux?: { configPath: string; url: string; cwd: string; relay?: MetaOnlyRelayDownstream };
+}
+
+// #1575 — a Codex worker swaps the flat shared-listener bridge for a per-agent metaOnly callmux so
+// the ~40 downstream schemas load on demand. Gated exactly like phase C's relay allowlist (#1570):
+// an explicitly worker-classified profile AND a provider whose manifest eager-loads every tool
+// schema (no client-native deferral). Data-driven from the manifest, never a provider-identity
+// branch — Claude (client-defers) never takes this path, coordinators/reviewers keep the flat
+// bridge. Requires a relay-owned provisioning home to materialize the per-agent config into (never
+// the host ~/.codex); worker profiles are isolated, so this holds.
+function codexMetaOnlyCallmuxConfigPath(config: RunnerSpawnConfig): string | undefined {
+  if (!isCodexLeanWorkerProfile(config.agentProfile?.name)) return undefined;
+  if (getManifest("codex")?.mcpToolManifest?.clientNativeToolDeferral !== false) return undefined;
+  const home = providerProvisioningHomePathFor("codex", config);
+  return home ? join(home, SHARED_MCP_METAONLY_CONFIG_FILENAME) : undefined;
+}
+
+// Codex counterpart to resolveClaudeDeclaredMcp — same purity/consistency contract, shared
+// by assembleCodex and materializeCodexAssets.
+function resolveCodexDeclaredMcp(config: RunnerSpawnConfig): CodexMcpResolution {
+  const provisionedMcp = profileProvisioning(config).mcpServers;
+  const mcpServers = Object.keys(provisionedMcp).filter((name) => name !== RELAY_MCP_SERVER_NAME);
+
+  const projectMcpRaw = resolveProjectMcpServers(config);
+  const projectMcp = Object.fromEntries(
+    Object.entries(projectMcpRaw).filter(
+      ([name]) => name !== RELAY_MCP_SERVER_NAME && !(name in provisionedMcp),
+    ),
+  );
+  const projectServers = Object.keys(projectMcp);
+
+  const sharedListenerOn = Boolean(config.agentProfile?.sharedMcp);
+  const sharedListenerUrl = sharedListenerOn ? resolveSharedMcpUrl(config.sharedMcpUrl) : undefined;
+  const metaOnlyConfigPath = sharedListenerUrl ? codexMetaOnlyCallmuxConfigPath(config) : undefined;
+  // #1450 — front the relay endpoint on-demand through the SAME metaOnly callmux, but ONLY when the
+  // runner proxy is active (config.relayMcpEndpoint = the proxy URL, config.mcpProxySecret = its
+  // secret) AND the profile has the relay endpoint on. Routing through the proxy keeps the live
+  // token off disk (#215). This gate matches runner-core's proxy on-demand-hiding gate exactly, so
+  // the direct client's on-demand tools are hidden ONLY when this front simultaneously exists.
+  const metaOnlyRelay: MetaOnlyRelayDownstream | undefined =
+    metaOnlyConfigPath && profileAllowsRelayFeature(config, "mcp") && config.relayMcpEndpoint && config.mcpProxySecret
+      ? { endpoint: config.relayMcpEndpoint, authSecret: config.mcpProxySecret }
+      : undefined;
+  const metaOnlyCallmux = sharedListenerUrl && metaOnlyConfigPath
+    ? { configPath: metaOnlyConfigPath, url: sharedListenerUrl, cwd: config.cwd, ...(metaOnlyRelay ? { relay: metaOnlyRelay } : {}) }
+    : undefined;
+  const sharedMcp: Record<string, ProvisioningMcpServer> = sharedListenerUrl
+    ? {
+      [SHARED_MCP_SERVER_NAME]: metaOnlyCallmux
+        ? sharedMcpMetaOnlyServer(metaOnlyCallmux.configPath)
+        : sharedMcpBridgeServer(sharedListenerUrl, config.cwd),
+    }
+    : {};
+  const declaredMcp = { ...projectMcp, ...provisionedMcp, ...sharedMcp };
+
+  return { declaredMcp, mcpServers, projectServers, sharedListenerUrl, ...(metaOnlyCallmux ? { metaOnlyCallmux } : {}) };
+}
+
 // ── Per-provider arg assembly ──────────────────────────────────────────────────────
 
 function assembleClaude(config: RunnerSpawnConfig, providerConfig: ProviderConfig, hostDefaultArgs: string[]): AssembledLaunch {
@@ -403,11 +556,16 @@ function assembleClaude(config: RunnerSpawnConfig, providerConfig: ProviderConfi
   // and caller-`--settings` launches keep inline delivery (see claudeManagedHookSettings).
   const managedHookSettings = claudeManagedHookSettings(config, configHome);
   const inlineHookSet = managedHookSettings ? {} : provisionedHookSet;
+  // #1565 P5.7 — the native-memory lever. Resolved BEFORE the settings args so its keys can ride
+  // relay's inline `--settings` (the only settings channel a host-base launch has); the env var
+  // below is the one that must always be present, and outranks both settings channels.
+  const nativeMemory = resolveClaudeNativeMemoryLever(config, configHome, hostDefaultArgs, callerSettingsMergeable);
   const settings = claudeSettingsArgs(
     projectSettings.settings,
     inlineHookSet,
     provisionedHooks.map((h) => h.name),
     statusLine,
+    nativeMemory.settings,
     hostDefaultArgs,
     config.providerArgs,
   );
@@ -429,56 +587,16 @@ function assembleClaude(config: RunnerSpawnConfig, providerConfig: ProviderConfi
   const hostPluginDirs = profileAllowsHostAssets(config, "plugins") ? providerConfig.pluginDirs : [];
   const pluginDirs = [...new Set([...relayPluginDirs, ...provisionedPluginDirs, ...hostPluginDirs])];
 
-  const provisionedMcp = profileProvisioning(config).mcpServers;
-  const mcpServers = Object.keys(provisionedMcp).filter((name) => name !== RELAY_MCP_SERVER_NAME);
-  const relayEndpoint = profileAllowsRelayFeature(config, "mcp");
+  const { declaredMcp, hostMcp, relayEndpoint, strictMcp, mcpServers, projectServers, hostMcpServers, sharedListenerUrl } =
+    resolveClaudeDeclaredMcp(config);
 
-  // #667 — project `.mcp.json` projection (opt-in). The spawn cwd's committed servers are
-  // injected through the SAME `--mcp-config` channel as relay-provisioned servers, so they
-  // survive `--strict-mcp-config` without the ambient project-discovery modal. A relay-
-  // provisioned server of the same name wins (the profile is the explicit, relay-owned
-  // source); the relay endpoint name is reserved. `declaredMcp` is the union relay injects.
-  const projectMcpRaw = resolveProjectMcpServers(config);
-  const projectMcp = Object.fromEntries(
-    Object.entries(projectMcpRaw).filter(
-      ([name]) => name !== RELAY_MCP_SERVER_NAME && !(name in provisionedMcp),
-    ),
-  );
-  const projectServers = Object.keys(projectMcp);
-
-  // #672 — shared host-listener MCP (opt-in, default OFF). When on, route the agent's
-  // NON-IDENTITY MCP (tokenlean, github) through ONE orchestrator-owned shared `callmux`
-  // listener via a per-agent `callmux bridge --url <listener> --cwd "$WORKTREE"` stdio entry:
-  // the MCP session survives a listener/downstream restart, and --cwd gives each isolated
-  // worktree session-cwd isolation. It's a plain stdio server descriptor, so it rides the same
-  // controlled --mcp-config channel as provisioned servers (survives --strict-mcp-config) — no
-  // ambient discovery, no modal. Relay-owned infra → authoritative on its name (spread last);
-  // the relay endpoint stays per-agent (#215), NEVER on the shared listener.
-  const sharedListenerOn = Boolean(config.agentProfile?.sharedMcp);
-  const sharedListenerUrl = sharedListenerOn ? resolveSharedMcpUrl(config.sharedMcpUrl) : undefined;
-  const sharedMcp: Record<string, ProvisioningMcpServer> = sharedListenerUrl
-    ? { [SHARED_MCP_SERVER_NAME]: sharedMcpBridgeServer(sharedListenerUrl, config.cwd) }
-    : {};
-  const declaredMcp = { ...projectMcp, ...provisionedMcp, ...sharedMcp };
-
-  // #662/#663 — strict controlled MCP is a Claude prompt-gate prevention entry, not a
-  // launch-assembly special case. It prevents the blocking "N new MCP servers found in
-  // this project" modal while preserving every relay-declared server in --mcp-config.
-  const strictMcp = claudeLaunchPromptGateSettings(config).strictMcpConfig;
-
-  // #662 follow-up — strict drops ALL on-disk config, including the host user-scope
-  // `~/.claude.json` MCP that a host-base agent loaded ambiently before strict. That
-  // over-reached: it stopped honoring `mcp.mode:"host"`, so default-relay workers/reviewers
-  // lost callmux/qmd/gh. Re-inject the host USER-scope servers (NOT the project `.mcp.json`,
-  // still excluded) when the launch both uses the host config home AND its mcp mode is host.
-  // An isolated/minimal base has its own config home and never had the real host's user MCP,
-  // so it stays relay+provisioned only even if a profile sets mode:"host".
-  const usesHostMcp = profileUsesProviderHostGlobals(config)
-    && (!config.agentProfile || config.agentProfile.mcp.mode === "host");
-  const hostMcp = usesHostMcp ? hostUserScopeMcpServers() : {};
-  const hostMcpServers = Object.keys(hostMcp).filter(
-    (name) => name !== RELAY_MCP_SERVER_NAME && !(name in declaredMcp),
-  );
+  // #1292 — a provisioned/host server's env/headers can carry a literal secret; inline JSON
+  // in --mcp-config lands verbatim in argv (world-readable via ps/proc). Whenever there's a
+  // relay-owned scratch dir to write into (any launch with an agentProfile — see
+  // providerProvisioningHomePathFor, which gives even host-base profiles a relay-owned dir
+  // distinct from the real ~/.claude), route through a 0600 file instead. materializeClaudeAssets
+  // writes the file this path points at, from the SAME resolveClaudeDeclaredMcp(config) inputs.
+  const mcpConfigFilePath = assetHome ? join(assetHome, "mcp-config.json") : undefined;
 
   const instructions = assembleInstructions(config);
 
@@ -494,6 +612,7 @@ function assembleClaude(config: RunnerSpawnConfig, providerConfig: ProviderConfi
       servers: declaredMcp,
       hostServers: hostMcp,
       strict: strictMcp,
+      ...(mcpConfigFilePath ? { configFilePath: mcpConfigFilePath } : {}),
     }),
     ...settings.args,
     ...(config.systemPromptAppend ? ["--append-system-prompt", config.systemPromptAppend] : []),
@@ -520,6 +639,7 @@ function assembleClaude(config: RunnerSpawnConfig, providerConfig: ProviderConfi
     },
     hooks: deliveredHooks.map((h) => ({ name: h.name, dir: h.dir })),
     ...(hooksSuppressed ? { hooksSuppressed } : {}),
+    nativeMemory,
     callerSettingsConsumed: settings.callerSettingsConsumed,
     plugins: provisionedPlugins.map((p) => ({ name: p.name, dir: p.dir })),
     hostPluginDirs,
@@ -529,7 +649,7 @@ function assembleClaude(config: RunnerSpawnConfig, providerConfig: ProviderConfi
     },
     instructions,
     args,
-    env: configHomeEnv("claude", configHome),
+    env: { ...configHomeEnv("claude", configHome), ...nativeMemory.env },
   };
 }
 
@@ -560,41 +680,33 @@ function assembleCodex(config: RunnerSpawnConfig, providerConfig: ProviderConfig
   const bundledSkillDirs = !config.agentProfile && relaySkills ? bundledCodexSkillDirs() : [];
   const skillDirs = [...bundledSkillDirs, ...provisionedSkills.map((s) => s.dir)];
 
-  const provisionedMcp = profileProvisioning(config).mcpServers;
-  const mcpServers = Object.keys(provisionedMcp).filter((name) => name !== RELAY_MCP_SERVER_NAME);
-
-  // #667 — project `.mcp.json` projection (opt-in), same union rule as Claude: a relay-
-  // provisioned server of the same name wins; the relay endpoint name is reserved. Codex has
-  // no `.mcp.json` discovery of its own, so this is purely additive (no strict/modal concern).
-  const projectMcpRaw = resolveProjectMcpServers(config);
-  const projectMcp = Object.fromEntries(
-    Object.entries(projectMcpRaw).filter(
-      ([name]) => name !== RELAY_MCP_SERVER_NAME && !(name in provisionedMcp),
-    ),
-  );
-  const projectServers = Object.keys(projectMcp);
-
-  // #672 — shared host-listener MCP (opt-in, default OFF), same as Claude: a per-agent
-  // `callmux bridge --url <listener> --cwd "$WORKTREE"` stdio entry routes the agent's
-  // NON-IDENTITY MCP (tokenlean, github) through the shared listener (session survives a
-  // restart; --cwd gives session-cwd isolation). Emitted via the same `-c mcp_servers.*`
-  // overrides as provisioned servers. The relay endpoint stays per-agent (#215).
-  const sharedListenerOn = Boolean(config.agentProfile?.sharedMcp);
-  const sharedListenerUrl = sharedListenerOn ? resolveSharedMcpUrl(config.sharedMcpUrl) : undefined;
-  const sharedMcp: Record<string, ProvisioningMcpServer> = sharedListenerUrl
-    ? { [SHARED_MCP_SERVER_NAME]: sharedMcpBridgeServer(sharedListenerUrl, config.cwd) }
-    : {};
-  const declaredMcp = { ...projectMcp, ...provisionedMcp, ...sharedMcp };
+  const { declaredMcp, mcpServers, projectServers, sharedListenerUrl, metaOnlyCallmux } = resolveCodexDeclaredMcp(config);
 
   const instructions = assembleInstructions(config);
 
+  // #1292 — a provisioned/project server's env can carry a literal secret; `-c
+  // mcp_servers.<name>.env.<K>=<V>` lands verbatim in argv (world-readable via ps/proc).
+  // An ISOLATED CODEX_HOME is a relay-owned per-instance dir Codex actually reads as its
+  // config home, so route command/args/url/env through CODEX_HOME/config.toml instead
+  // (materializeCodexAssets writes it) and keep only the non-secret timeout overrides in
+  // argv. Host-base Codex has no isolated CODEX_HOME to write into (it reuses the real
+  // ~/.codex, which relay must not persist provisioned secrets into) — same accepted gap as
+  // the hooksSuppressed carve-out above, unchanged from prior behavior.
+  const mcpArgs = configHome ? codexProvisionedMcpTimeoutArgs(declaredMcp) : codexProvisionedMcpArgs(declaredMcp);
+
   // The skills/MCP/project-doc block; core launch config (model/approval/listen) stays
   // in the adapter. -c overrides are order-independent, so the assembled block is contiguous.
+  // #1565 P5.7 — Codex's native-memory lever rides the same `-c` argv precedent as the
+  // project-doc suppressor above it (`-c project_doc_max_bytes=0`). Argv outranks config.toml, so
+  // this is the portable/authoritative half; the isolated CODEX_HOME config.toml is the belt.
+  const nativeMemory = resolveNativeMemoryLever({ provider: "codex", config, isolatedHome: Boolean(configHome) });
+
   const args = [
     ...bundledSkillConfigArgs(skillDirs),
     ...(relayEndpoint ? relayMcpCodexConfigArgs(config.relayUrl, config.relayMcpEndpoint) : []),
-    ...codexProvisionedMcpArgs(declaredMcp),
+    ...mcpArgs,
     ...codexProjectDocSuppressionArgs(config),
+    ...nativeMemory.args,
   ];
 
   return {
@@ -613,12 +725,13 @@ function assembleCodex(config: RunnerSpawnConfig, providerConfig: ProviderConfig
     projectSettings: { applied: false, keys: [], ignoredKeys: [] },
     hooks: provisionedHooks.map((h) => ({ name: h.name, dir: h.dir })),
     ...(hooksSuppressed ? { hooksSuppressed } : {}),
+    nativeMemory,
     callerSettingsConsumed: false,
     plugins: [],
     hostPluginDirs: [],
     mcp: {
       relayEndpoint, strict: false, servers: mcpServers, projectServers, hostServers: [],
-      ...(sharedListenerUrl ? { sharedListener: { url: sharedListenerUrl } } : {}),
+      ...(sharedListenerUrl ? { sharedListener: { url: sharedListenerUrl, ...(metaOnlyCallmux ? { metaOnly: true } : {}), ...(metaOnlyCallmux?.relay ? { relayFronted: true } : {}) } } : {}),
     },
     instructions,
     args,
@@ -660,11 +773,44 @@ function materializeClaudeAssets(config: RunnerSpawnConfig): void {
     materializeResolvedAssets(resolveProvisionedHooks(configHome, config));
     // #1096 — land the provisioned hooks in the managed home's settings.json (the documented
     // hook source), matching the assembler's decision to keep them out of the inline --settings.
+    // #1565 P5.7 — the native-memory keys ride the SAME file (the isolated-home belt behind the
+    // env lever). Composed here rather than written separately so one write owns the file.
     const managedHookSettings = claudeManagedHookSettings(config, configHome);
-    if (managedHookSettings) writeClaudeSettingsJson(configHome, managedHookSettings);
+    const managedSettings: Record<string, unknown> = {
+      ...(managedHookSettings ?? {}),
+      ...claudeManagedNativeMemorySettings(config, configHome, callerSettingsMergeable),
+    };
+    if (Object.keys(managedSettings).length) {
+      // The hook half of this file is NOT best-effort (a missing baseline guard is a real
+      // regression, #1096), so only the native-memory contribution is guarded: on a write
+      // failure, retry with the hooks alone so P5.7 can never cost a launch its safety hooks.
+      if (applyNativeMemoryBelt("the Claude managed settings.json", () => writeClaudeSettingsJson(configHome, managedSettings)) && managedHookSettings) {
+        writeClaudeSettingsJson(configHome, managedHookSettings);
+      }
+    }
   }
   if (assetHome) materializeResolvedAssets(resolveClaudeProvisionedPlugins(assetHome, config));
   if (!configHome && assetHome) materializeResolvedAssets(resolveProvisionedHooks(assetHome, config));
+  // #1292 — write the file assembleClaude's --mcp-config <path> points at, from the SAME
+  // resolveClaudeDeclaredMcp(config) inputs (see the purity/consistency note there). Keeps
+  // provisioned/host-server env/headers secrets out of argv.
+  if (assetHome) {
+    const { declaredMcp, hostMcp, relayEndpoint, strictMcp } = resolveClaudeDeclaredMcp(config);
+    const mcpServers = claudeMcpConfigPayload({
+      relayUrl: config.relayUrl,
+      ...(config.relayMcpEndpoint ? { endpoint: config.relayMcpEndpoint } : {}),
+      includeRelay: relayEndpoint,
+      servers: declaredMcp,
+      hostServers: hostMcp,
+    });
+    const mcpConfigPath = join(assetHome, "mcp-config.json");
+    if (Object.keys(mcpServers).length || strictMcp) {
+      mkdirSync(assetHome, { recursive: true });
+      writeFileSync(mcpConfigPath, JSON.stringify({ mcpServers }, null, 2), { mode: 0o600 });
+    } else {
+      rmSync(mcpConfigPath, { force: true });
+    }
+  }
 }
 
 function materializeCodexAssets(config: RunnerSpawnConfig): void {
@@ -678,6 +824,29 @@ function materializeCodexAssets(config: RunnerSpawnConfig): void {
     materializeResolvedAssets(hooks);
     writeCodexHooksJson(configHome, renderProvisionedHookSet(hooks));
   }
+  // #1292 — write the CODEX_HOME/config.toml sections assembleCodex's non-secret -c
+  // timeout-only overrides expect to find command/args/url/env in (see the mcpArgs branch
+  // there). Same resolveCodexDeclaredMcp(config) inputs, so disk == launch. No-op for
+  // host-base (no isolated CODEX_HOME) — assembleCodex falls back to the unchanged
+  // codexProvisionedMcpArgs(...) argv path for that case instead.
+  const { declaredMcp, metaOnlyCallmux } = resolveCodexDeclaredMcp(config);
+  if (configHome) {
+    writeCodexMcpServersToml(configHome, declaredMcp);
+    // #1565 P5.7 — the isolated-home belt behind the `-c features.memories=…` argv lever. Same
+    // resolveNativeMemoryLever inputs assembleCodex used, so disk == launch. No-op for host base
+    // (no isolated CODEX_HOME; relay must not write the real ~/.codex) and for an undeclared
+    // profile (`configToml` is empty, so nothing is written). Guarded: never fails the spawn.
+    applyNativeMemoryBelt("the Codex CODEX_HOME/config.toml [features] table", () => {
+      writeCodexFeaturesToml(configHome, resolveNativeMemoryLever({ provider: "codex", config, isolatedHome: true }).configToml);
+    });
+  }
+  // #1575/#1450 — write the per-agent metaOnly config the shared-listener descriptor points at
+  // (`callmux --config <path>`), from the SAME resolveCodexDeclaredMcp inputs so disk == launch.
+  // The optional relay downstream (#1450) rides here too, so the on-demand relay front and the
+  // agent's stdio callmux descriptor come from one resolution.
+  if (metaOnlyCallmux) {
+    writeSharedMcpMetaOnlyConfig(metaOnlyCallmux.configPath, metaOnlyCallmux.url, metaOnlyCallmux.cwd, metaOnlyCallmux.relay);
+  }
 }
 
 /**