claude-dev-env 8.12.0 → 8.13.0

package/scripts/codex_account_meters.py

@@ -0,0 +1,372 @@
+#!/usr/bin/env python3
+"""Read one Codex account's rate-limit windows from its own Codex home.
+
+Codex reports usage through ``codex app-server`` and the JSON-RPC method
+``account/rateLimits/read``. The reply names up to two windows, a short one
+(5 hours) and a weekly one. The account's room is the smaller of the two::
+
+    5-hour window 30% used, week 85% used  -> 15% left
+    week window only, 40% used             -> 60% left
+    no window, error reply, no reply       -> CodexMeterUnreadError
+
+Every failure raises ``CodexMeterUnreadError``. The caller decides what an
+unread account means; this module never guesses a number.
+"""
+
+from __future__ import annotations
+
+import importlib
+import json
+import math
+import os
+import shutil
+import subprocess
+import sys
+import threading
+from collections.abc import Callable, Mapping, Sequence
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from pathlib import Path
+from typing import IO
+
+from dev_env_scripts_constants.codex_account_constants import (
+    ALL_APP_SERVER_ARGUMENTS,
+    ALL_CODEX_BINARY_CANDIDATE_RELATIVE_PARTS,
+    ALL_WINDOW_KEYS,
+    APP_SERVER_TIMEOUT_SECONDS,
+    CLIENT_NAME,
+    CLIENT_VERSION,
+    CODEX_BINARY_NAME,
+    CODEX_HOME_ENVIRONMENT_VARIABLE,
+    FULL_PERCENT,
+    INITIALIZE_REQUEST_ID,
+    JSONRPC_VERSION,
+    METHOD_INITIALIZE,
+    METHOD_INITIALIZED,
+    METHOD_RATE_LIMITS_READ,
+    PROCESS_WAIT_TIMEOUT_SECONDS,
+    RATE_LIMITS_REQUEST_ID,
+    READER_JOIN_TIMEOUT_SECONDS,
+    TEXT_ENCODING,
+    WEEKLY_WINDOW_MINUTES,
+)
+from shared_tree_paths import resolve_shared_process_tree_scripts_directory
+
+_shared_process_tree_scripts_directory = resolve_shared_process_tree_scripts_directory(
+    __file__,
+    all_environment=os.environ,
+)
+if str(_shared_process_tree_scripts_directory) not in sys.path:
+    sys.path.insert(0, str(_shared_process_tree_scripts_directory))
+
+_process_tree_kill = importlib.import_module("process_tree_kill")
+_subprocess_window_access = importlib.import_module("subprocess_window_access")
+
+ServerExchange = Callable[[Path, Path, Sequence[Mapping[str, object]]], list[str]]
+
+
+class CodexMeterUnreadError(Exception):
+    """Raised when one account's rate-limit windows cannot be read."""
+
+
+@dataclass(frozen=True)
+class UsageWindow:
+    """One rate-limit window: its length, the percent used, and when it resets."""
+
+    duration_minutes: int | None
+    used_percent: float
+    resets_at: datetime | None
+
+
+@dataclass(frozen=True)
+class CodexAccountMeters:
+    """One account's windows, with percent_left, short_window_percent_left and resets_before_room."""
+
+    all_windows: tuple[UsageWindow, ...]
+
+    @property
+    def percent_left(self) -> float:
+        """Room left in the tightest window, from 0 to 100."""
+        most_used = max(each_window.used_percent for each_window in self.all_windows)
+        return max(0.0, FULL_PERCENT - most_used)
+
+    @property
+    def short_window_percent_left(self) -> float | None:
+        """Room left in the windows shorter than a week, or None when the account has none."""
+        all_short_used = [
+            each_window.used_percent
+            for each_window in self.all_windows
+            if each_window.duration_minutes is not None
+            and each_window.duration_minutes < WEEKLY_WINDOW_MINUTES
+        ]
+        if not all_short_used:
+            return None
+        return max(0.0, FULL_PERCENT - max(all_short_used))
+
+    def resets_before_room(self, minimum_percent_left: float) -> datetime | None:
+        """When every window that holds the account at or under a bar has reset.
+
+        Args:
+            minimum_percent_left: The percent left the account must pass.
+
+        Returns:
+            The latest reset among the blocking windows, or None when one
+            carries no reset time or none blocks.
+        """
+        all_blocking = [
+            each_window
+            for each_window in self.all_windows
+            if FULL_PERCENT - each_window.used_percent <= minimum_percent_left
+        ]
+        if not all_blocking or any(
+            each_window.resets_at is None for each_window in all_blocking
+        ):
+            return None
+        return max(
+            each_window.resets_at
+            for each_window in all_blocking
+            if each_window.resets_at is not None
+        )
+
+
+def _finite_number(raw_number: object) -> float | None:
+    if isinstance(raw_number, bool) or not isinstance(raw_number, (int, float)):
+        return None
+    if not math.isfinite(raw_number):
+        return None
+    return float(raw_number)
+
+
+def _parse_resets_at(raw_resets_at: object) -> datetime | None:
+    seconds = _finite_number(raw_resets_at)
+    if seconds is None:
+        return None
+    try:
+        return datetime.fromtimestamp(seconds, tz=timezone.utc)
+    except (OverflowError, OSError, ValueError):
+        return None
+
+
+def _parse_window(raw_window: object) -> UsageWindow | None:
+    if not isinstance(raw_window, Mapping):
+        return None
+    used_percent = _finite_number(raw_window.get("usedPercent"))
+    if used_percent is None:
+        return None
+    duration = _finite_number(raw_window.get("windowDurationMins"))
+    return UsageWindow(
+        duration_minutes=None if duration is None else int(duration),
+        used_percent=min(FULL_PERCENT, max(0.0, used_percent)),
+        resets_at=_parse_resets_at(raw_window.get("resetsAt")),
+    )
+
+
+def _rate_limits_mapping(reply_text: str) -> Mapping[str, object]:
+    try:
+        reply = json.loads(reply_text)
+    except json.JSONDecodeError as error:
+        raise CodexMeterUnreadError("rate-limit reply is not JSON") from error
+    if not isinstance(reply, dict):
+        raise CodexMeterUnreadError("rate-limit reply is not an object")
+    if reply.get("error") is not None:
+        raise CodexMeterUnreadError(f"rate-limit read failed: {reply['error']}")
+    body = reply.get("result")
+    rate_limits = body.get("rateLimits") if isinstance(body, dict) else None
+    if not isinstance(rate_limits, dict):
+        raise CodexMeterUnreadError("rate-limit reply names no rateLimits")
+    return rate_limits
+
+
+def parse_rate_limits_reply(reply_text: str) -> CodexAccountMeters:
+    """Parse the server's reply to the rate-limit read.
+
+    ::
+
+        {"id": 2, "result": {"rateLimits": {"primary": {"usedPercent": 30, ...},
+                                            "secondary": {"usedPercent": 85, ...}}}}
+        -> CodexAccountMeters with two windows, 15% left
+
+    Args:
+        reply_text: One line the ``codex app-server`` process wrote.
+
+    Returns:
+        The windows the reply carries.
+
+    Raises:
+        CodexMeterUnreadError: The line is no reply, an error reply, or names
+            no window with a used percent.
+    """
+    rate_limits = _rate_limits_mapping(reply_text)
+    all_windows = tuple(
+        each_window
+        for each_key in ALL_WINDOW_KEYS
+        if (each_window := _parse_window(rate_limits.get(each_key))) is not None
+    )
+    if not all_windows:
+        raise CodexMeterUnreadError("rate-limit reply names no usage window")
+    return CodexAccountMeters(all_windows=all_windows)
+
+
+def request_messages() -> list[dict[str, object]]:
+    """Build the handshake and the rate-limit read, in send order.
+
+    Returns:
+        The initialize request, the initialized notice, and the read request.
+    """
+    return [
+        {
+            "jsonrpc": JSONRPC_VERSION,
+            "id": INITIALIZE_REQUEST_ID,
+            "method": METHOD_INITIALIZE,
+            "params": {
+                "clientInfo": {"name": CLIENT_NAME, "version": CLIENT_VERSION},
+                "capabilities": {"experimentalApi": True},
+            },
+        },
+        {"jsonrpc": JSONRPC_VERSION, "method": METHOD_INITIALIZED, "params": {}},
+        {
+            "jsonrpc": JSONRPC_VERSION,
+            "id": RATE_LIMITS_REQUEST_ID,
+            "method": METHOD_RATE_LIMITS_READ,
+            "params": {},
+        },
+    ]
+
+
+def _is_rate_limits_reply(line: str) -> bool:
+    try:
+        message = json.loads(line)
+    except json.JSONDecodeError:
+        return False
+    return isinstance(message, dict) and message.get("id") == RATE_LIMITS_REQUEST_ID
+
+
+def _read_until_reply(server_stdout: IO[str], all_lines: list[str]) -> None:
+    for each_line in server_stdout:
+        stripped = each_line.strip()
+        if stripped:
+            all_lines.append(stripped)
+        if _is_rate_limits_reply(stripped):
+            return
+
+
+def _collect_lines(
+    server_stdout: IO[str], all_lines: list[str], is_done: threading.Event
+) -> None:
+    try:
+        _read_until_reply(server_stdout, all_lines)
+    except (OSError, ValueError):
+        pass
+    is_done.set()
+
+
+def _stop_server(server: subprocess.Popen[str]) -> None:
+    _process_tree_kill.terminate_process_tree(server)
+    try:
+        server.wait(timeout=PROCESS_WAIT_TIMEOUT_SECONDS)
+    except subprocess.TimeoutExpired:
+        return
+
+
+def _send_and_collect(server: subprocess.Popen[str], input_text: str) -> list[str]:
+    if server.stdin is None or server.stdout is None:
+        _stop_server(server)
+        raise OSError("codex app-server offered no stdio pipes")
+    all_lines: list[str] = []
+    is_done = threading.Event()
+    reader = threading.Thread(
+        target=_collect_lines, args=(server.stdout, all_lines, is_done), daemon=True
+    )
+    reader.start()
+    try:
+        server.stdin.write(input_text)
+        server.stdin.flush()
+        is_done.wait(timeout=APP_SERVER_TIMEOUT_SECONDS)
+    finally:
+        _stop_server(server)
+        reader.join(timeout=READER_JOIN_TIMEOUT_SECONDS)
+    return list(all_lines)
+
+
+def exchange_with_app_server(
+    codex_path: Path,
+    codex_home: Path,
+    all_messages: Sequence[Mapping[str, object]],
+) -> list[str]:
+    """Run ``codex app-server`` under one Codex home and collect the lines it writes.
+
+    Input stays open until the reply lands, since the server quits unanswered on end of input.
+
+    Args:
+        codex_path: The Codex executable.
+        codex_home: The account's Codex home, passed as ``CODEX_HOME``.
+        all_messages: JSON-RPC messages to send.
+
+    Returns:
+        The non-empty lines, ending with the rate-limit reply when it came.
+    """
+    input_text = "".join(json.dumps(each_message) + "\n" for each_message in all_messages)
+    with subprocess.Popen(
+        [str(codex_path), *ALL_APP_SERVER_ARGUMENTS],
+        stdin=subprocess.PIPE,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.DEVNULL,
+        text=True,
+        encoding=TEXT_ENCODING,
+        env={**os.environ, CODEX_HOME_ENVIRONMENT_VARIABLE: str(codex_home)},
+        start_new_session=_process_tree_kill.should_start_new_session(),
+        creationflags=_subprocess_window_access.hidden_window_creation_flags(),
+    ) as server:
+        return _send_and_collect(server, input_text)
+
+
+def read_codex_meters(
+    codex_path: Path,
+    codex_home: Path,
+    exchange: ServerExchange = exchange_with_app_server,
+) -> CodexAccountMeters:
+    """Read one account's windows through the app server under its Codex home.
+
+    Args:
+        codex_path: The Codex executable.
+        codex_home: The account's Codex home.
+        exchange: Sends messages and returns output lines; tests pass a fake.
+
+    Returns:
+        The account's windows.
+
+    Raises:
+        CodexMeterUnreadError: The server failed, timed out, or sent no usable reply.
+    """
+    try:
+        all_lines = exchange(codex_path, codex_home, request_messages())
+    except (OSError, subprocess.SubprocessError, UnicodeDecodeError) as error:
+        raise CodexMeterUnreadError(f"codex app-server failed: {error}") from error
+    for each_line in all_lines:
+        if _is_rate_limits_reply(each_line):
+            return parse_rate_limits_reply(each_line)
+    raise CodexMeterUnreadError("codex app-server sent no rate-limit reply")
+
+
+def resolve_codex_path(explicit_path: Path | None) -> Path:
+    """Find the Codex executable.
+
+    Args:
+        explicit_path: A path the caller named, used as given.
+
+    Returns:
+        The named path, else ``codex`` on PATH, else a known install path.
+
+    Raises:
+        FileNotFoundError: No Codex executable was found.
+    """
+    if explicit_path is not None:
+        return explicit_path
+    on_path = shutil.which(CODEX_BINARY_NAME)
+    if on_path is not None:
+        return Path(on_path)
+    for each_parts in ALL_CODEX_BINARY_CANDIDATE_RELATIVE_PARTS:
+        candidate = Path.home().joinpath(*each_parts)
+        if candidate.is_file():
+            return candidate
+    raise FileNotFoundError("no codex executable on PATH or at its install path")

package/scripts/dev_env_scripts_constants/codex_account_constants.py

@@ -0,0 +1,141 @@
+"""Named constants for the Codex accounts a runner job picks between.
+
+Each account signs in under its own Codex home. The picker reads every
+account's rate-limit windows through ``codex app-server`` and names the account
+a job runs on, trying the accounts in one fixed order.
+"""
+
+from __future__ import annotations
+
+ALL_CODEX_ACCOUNT_NAMES: tuple[str, ...] = ("codex-1", "codex-2", "codex-3", "codex-4")
+"""Codex accounts in the order jobs try them. The names say nothing about a plan."""
+
+CODEX_PROFILES_ROOT_DIRECTORY_NAME: str = ".codex-profiles"
+"""Directory under the user home that holds one Codex home per account."""
+
+CODEX_PROFILES_ROOT_ENVIRONMENT_VARIABLE: str = "CODEX_PROFILES_ROOT"
+"""Environment variable that relocates the Codex profiles root."""
+
+MAIN_CODEX_HOME_DIRECTORY_NAME: str = ".codex"
+"""Directory under the user home that holds the shared Codex setup."""
+
+CODEX_HOME_ENVIRONMENT_VARIABLE: str = "CODEX_HOME"
+"""Environment variable that points Codex at one account's home."""
+
+CODEX_AUTH_FILE_NAME: str = "auth.json"
+"""File in a Codex home that holds that account's sign-in."""
+
+ALL_SHARED_CODEX_HOME_NAMES: frozenset[str] = frozenset(
+    {
+        "AGENTS.md",
+        "config.toml",
+        "hooks",
+        "hooks.json",
+        "plugins",
+        "prompts",
+        "rules",
+        "skills",
+    }
+)
+"""Codex home entries every account shares. Every other entry stays per account."""
+
+NORMAL_TIER_MINIMUM_PERCENT_LEFT: float = 10.0
+"""An account runs a job at its normal model only above this percent left."""
+
+LUNA_TIER_STOP_PERCENT_LEFT: float = 1.0
+"""A Luna fallback job stops once its account is at or below this percent left."""
+
+LUNA_TIER_SHORT_WINDOW_MINIMUM_PERCENT_LEFT: float = 20.0
+"""An account with a window shorter than a week runs Luna only with this much of it left."""
+
+WEEKLY_WINDOW_MINUTES: int = 10080
+"""Length of the weekly window. Any shorter window is a short window, such as 5 hours."""
+
+FULL_PERCENT: float = 100.0
+"""Percent scale ceiling, so percent left is this minus percent used."""
+
+TIER_NORMAL: str = "normal"
+"""Picker answer: run the job at its normal model on the named account."""
+
+TIER_LUNA: str = "luna"
+"""Picker answer: every account is at or under the bar, so Luna runs the job."""
+
+TIER_WAIT: str = "wait"
+"""Picker answer: no account has room, so the job waits."""
+
+ALL_CODEX_BINARY_CANDIDATE_RELATIVE_PARTS: tuple[tuple[str, ...], ...] = (
+    ("AppData", "Local", "Programs", "OpenAI", "Codex", "bin", "codex.exe"),
+)
+"""Install paths under the user home tried when ``codex`` is not on PATH."""
+
+CODEX_BINARY_NAME: str = "codex"
+"""Codex command name looked up on PATH."""
+
+ALL_APP_SERVER_ARGUMENTS: tuple[str, ...] = ("app-server", "--listen", "stdio://")
+"""Arguments that start Codex as a JSON-RPC server on standard input and output."""
+
+APP_SERVER_TIMEOUT_SECONDS: float = 30.0
+"""Longest wait for the rate-limit reply before the read counts as failed."""
+
+READER_JOIN_TIMEOUT_SECONDS: float = 2.0
+"""Longest wait for the output reader to finish after the server stops."""
+
+PROCESS_WAIT_TIMEOUT_SECONDS: float = 5.0
+"""Longest wait to reap the server after its process tree is stopped."""
+
+JSONRPC_VERSION: str = "2.0"
+"""JSON-RPC protocol version on every message."""
+
+INITIALIZE_REQUEST_ID: int = 1
+"""Request id of the initialize handshake."""
+
+RATE_LIMITS_REQUEST_ID: int = 2
+"""Request id of the rate-limit read."""
+
+METHOD_INITIALIZE: str = "initialize"
+"""JSON-RPC method that opens the session."""
+
+METHOD_INITIALIZED: str = "initialized"
+"""JSON-RPC notification that confirms the session opened."""
+
+METHOD_RATE_LIMITS_READ: str = "account/rateLimits/read"
+"""JSON-RPC method that returns the account's rate-limit windows."""
+
+CLIENT_NAME: str = "codex-account-choice"
+"""Client name the handshake reports."""
+
+CLIENT_VERSION: str = "1.0.0"
+"""Client version the handshake reports."""
+
+ALL_WINDOW_KEYS: tuple[str, ...] = ("primary", "secondary")
+"""Keys under ``rateLimits`` that each hold one usage window."""
+
+EXIT_CODE_ROOM: int = 0
+"""Check answer: the account is above the floor."""
+
+EXIT_CODE_NO_ROOM: int = 3
+"""Check answer: the account is at or below the floor, or its meter is unread."""
+
+REASON_NORMAL_TEMPLATE: str = "{account} has {percent_left:.0f}% left"
+"""Reason when an account takes the job at its normal model."""
+
+REASON_LUNA_TEMPLATE: str = (
+    "every account is at or under {bar:.0f}% left; {account} has"
+    " {percent_left:.0f}% and runs Luna until {stop:.0f}%"
+)
+"""Reason when the job falls back to Luna."""
+
+REASON_WAIT_TEMPLATE: str = "no account has room; {account} resets first, at {reset}"
+"""Reason when every account is out of room."""
+
+REASON_WAIT_UNREAD: str = "no account meter could be read"
+"""Reason when no account's meter reads at all."""
+
+UNREAD_NOT_SIGNED_IN: str = "not signed in"
+"""Unread reason when the account's Codex home holds no sign-in."""
+
+UNKNOWN_RESET_TEXT: str = "an unknown time"
+"""Reset text when no blocking window carries a reset time."""
+
+TEXT_ENCODING: str = "utf-8"
+"""Encoding for the server pipes and the JSON reports."""

package/scripts/dev_env_scripts_constants/private_term_constants.py

@@ -1,6 +1,7 @@
-"""Digests of the private organization names this public repository never names.
+"""Digests of the private names this public repository never names.
 
-The names stay out of the tree. Each entry holds the SHA-256 digest of one
+The names cover private organizations, the owner's private repository, the
+owner's personal handle, and a private client. They stay out of the tree. Each entry holds the SHA-256 digest of one
 name after normalization, which keeps only ASCII letters and digits in lower
 case::
 
@@ -31,6 +32,18 @@ ALL_PRIVATE_TERM_DIGESTS: frozenset[PrivateTermDigest] = frozenset(
             length=10,
             sha256="c2a70b3186691a74dece4ca824bec178bfaec83be119be28faedd14aa392233f",
         ),
+        PrivateTermDigest(
+            length=16,
+            sha256="182cb82e3e973d041b8527659064153f8c4af79503bd198508d3655d9a932fdf",
+        ),
+        PrivateTermDigest(
+            length=7,
+            sha256="d526db5593d5986500e4770cb6018f2d33c459ed93657487958a6086e52e6147",
+        ),
+        PrivateTermDigest(
+            length=7,
+            sha256="968e2d5b08687bf42997461cbdef6c844eabbf04f440cee888c95b864c2a4bcc",
+        ),
     }
 )
 PRIVATE_TERM_TEXT_ENCODING = "utf-8"
@@ -57,4 +70,6 @@ SHORT_SHA_LENGTH = 12
 COMMIT_FIELD_SEPARATOR = "\x1f"
 COMMIT_RECORD_SEPARATOR = "\x1e"
 COMMIT_FIELD_SPLIT_LIMIT = 2
+GITHUB_NOREPLY_ADDRESS_PATTERN = r"<[^<>]*@users\.noreply\.github\.com>"
+MASKED_ADDRESS = "<>"
 COMMIT_LOG_FORMAT = "--format=%H%x1f%an <%ae> %cn <%ce>%x1f%B%x1e"

package/scripts/private_term_scan.py

@@ -12,6 +12,7 @@ from __future__ import annotations
 
 import argparse
 import json
+import re
 import subprocess
 import sys
 from collections.abc import Sequence
@@ -28,6 +29,8 @@ from dev_env_scripts_constants.private_term_constants import (
     COMMIT_MESSAGE_PART,
     COMMIT_RECORD_SEPARATOR,
     FINDING_LINE_TEMPLATE,
+    GITHUB_NOREPLY_ADDRESS_PATTERN,
+    MASKED_ADDRESS,
     PRIVATE_TERM_MESSAGE_TEMPLATE,
     PRIVATE_TERM_TEXT_ENCODING,
     SHORT_SHA_LENGTH,
@@ -76,7 +79,7 @@ def _commit_findings(record: str) -> list[str]:
     return [
         *_findings_for(
             COMMIT_LABEL_TEMPLATE.format(short_sha=short_sha, part=COMMIT_IDENTITY_PART),
-            identity,
+            re.sub(GITHUB_NOREPLY_ADDRESS_PATTERN, MASKED_ADDRESS, identity, flags=re.IGNORECASE),
         ),
         *_findings_for(
             COMMIT_LABEL_TEMPLATE.format(short_sha=short_sha, part=COMMIT_MESSAGE_PART),
@@ -94,7 +97,8 @@ def scan_commits(repository_root: Path, commit_range: str) -> list[str]:
 
     Returns:
         One finding per commit identity or message line that names a private
-        organization.
+        organization. An identity address ending in users.noreply.github.com
+        is left out of the scan, since GitHub builds it from the account handle.
     """
     log_text = subprocess.run(
         ["git", "-C", str(repository_root), "log", "--reverse", COMMIT_LOG_FORMAT, commit_range],

package/scripts/repository_checks/config/constants.py

@@ -13,6 +13,7 @@ CHECK_ID_PACKAGE_INVENTORY = "package-inventory"
 CHECK_ID_PYTEST_TESTPATHS = "pytest-testpaths"
 CHECK_ID_TRACKED_PERSONAL_DATA = "tracked-secrets"
 CHECK_ID_TRACKED_PRIVATE_TERMS = "tracked-private-terms"
+PRIVATE_TERMS_SKIPPED_FILE_NAME = "CHANGELOG.md"
 
 ALL_CHECK_IDS = (
     CHECK_ID_CLAUDE_MD_ORPHANS,

package/scripts/repository_checks/tracked_private_terms.py

@@ -48,11 +48,18 @@ def collect_tracked_private_term_findings(
         Findings that carry the path and line number, never the name. A
         repository whose github.com origin owner is itself a private
         organization returns none, since that organization may name itself.
+        A file named CHANGELOG.md is skipped, since release automation writes
+        it from commit subjects and history keeps it.
     """
     if _is_owned_by_private_organization(repository_root):
         return []
     all_findings: list[RepositoryFinding] = []
     for each_relative_path in all_tracked_paths:
+        if (
+            Path(each_relative_path).name
+            == repository_constants.PRIVATE_TERMS_SKIPPED_FILE_NAME
+        ):
+            continue
         if (content := _read_text_or_none(repository_root / each_relative_path)) is None:
             continue
         posix_relative_path = each_relative_path.replace(

package/scripts/test_claude_account_profile.py

@@ -76,6 +76,18 @@ class TestSyncProfile:
             profile_home / "settings.json", main_home / "settings.json"
         )
 
+    def should_link_only_what_the_callers_rule_shares(self, tmp_path: Path) -> None:
+        main_home = build_main_home(tmp_path)
+        profile_home = tmp_path / "codex-1"
+        report = profile.sync_profile(
+            main_home=main_home,
+            profile_home=profile_home,
+            now=NOW,
+            is_local=lambda entry_name: entry_name != "rules",
+        )
+        assert report.all_linked == ("rules",)
+        assert not (profile_home / "skills").exists()
+
     def should_keep_the_accounts_own_sign_in_state_and_history_apart(
         self, tmp_path: Path
     ) -> None: