claude-dev-env 8.98.10 → 8.99.0

package/.agents/agents/reference/pr-description-illustrative-voice.md

@@ -45,6 +45,6 @@ The person running the loop asked for a full look, so every pass gets a full loo
 - Prefer Before / After when the change is about how something is asked, found, checked, saved, retried, or stopped.
 - Use picture words: hand it, open it, find it, check it, save it, skip it, stop, call by name.
 - Prefer spoken results: “found it,” “missing,” “duplicated,” “couldn’t.”
-- Keep `Why` short and concrete.
-- Put proof only in `Verification`.
+- Keep `What this does` short and concrete.
+- Put proof only in `Proof in practice`.
 - Explain jargon immediately or replace it.

package/.agents/agents/reference/pr-description-verification.md

@@ -2,7 +2,7 @@
 
 Use this only when the PR writer needs a concrete verification sample.
 
-Verification should lead with something a reviewer can open, see, click, compare, or try.
+Proof in practice should lead with something a reviewer can open, see, click, compare, or try.
 
 Good:
 

package/.agents/agents/test_pr_description_writer_style.py

@@ -30,8 +30,8 @@ def test_voice_reference_keeps_the_plain_illustrative_shape() -> None:
         "found it",
         "missing",
         "duplicated",
-        "Why",
-        "Verification",
+        "What this does",
+        "Proof in practice",
     ):
         assert required_text in reference_text
 

package/.agents/skills/pull-request/SKILL.md

@@ -92,10 +92,9 @@ Check each behavior claim against the final diff and verification evidence.
 Preserve whether a rule is added, removed, or narrowed, and distinguish tests
 added from tests run. Refresh these claims after a rebase or correction.
 
-Open with the concrete problem and resulting behavior in one or two short
-paragraphs of plain prose. Write for a reviewer who has not read the worker's
-conversation. Include only claims supported by the final diff. State commands,
-results, and material limits under `## Verification`.
+Write the body in the section order `reference/body-sections.md` gives: What
+this does, What changed, Existing work, Proof in practice, Eval for a `feat`
+title, Risk, How to revert. Include only claims supported by the final diff.
 
 Keep substantive review and test evidence. Put extensive logs, raw diffs, token
 counts, and agent transcripts in an existing linked artifact or a closed
@@ -189,6 +188,7 @@ Read `reference/examples.md` for a create, a rejected comment, and a recovery.
 | `reference/publication-tasks.md` | Ordered tasks for every publication gate |
 | `reference/legacy-author-recovery.md` | Recovery of one selected legacy author record |
 | `reference/examples.md` | Worked create, rejected comment, and recovery examples |
+| `reference/body-sections.md` | Pull request body sections, their order, and what each holds |
 | `scripts/pull_request.py` | Command for author selection and create, edit, comment, and review actions |
 | `scripts/github_pr_command_constants/` | Constants for pull request actions, recovery, exit codes, and generic messages |
 | `scripts/test_pull_request.py` | Tests for `pull_request.py` |

package/.agents/skills/pull-request/reference/body-sections.md

@@ -0,0 +1,17 @@
+# Pull request body sections
+
+A reviewer reads the body in place of the code. The body says what the change does, how it was tested, what could break, and how to undo it. The order follows the Claude Code team's [code review article](https://claude.dev/blog/solving-code-review-at-anthropic/), whose template "asks how the change was tested and how to undo it". The opening sections follow the team's public pull requests, such as [claude-code #69470](https://github.com/anthropics/claude-code/pull/69470), which opens with What this does, Why now and What changed.
+
+| Section | Holds |
+|---|---|
+| `## What this does` | Two or three plain sentences: the behavior before, the behavior after, and who notices. Written for a reviewer who has not read the worker's conversation. |
+| `## What changed` | One bullet per area of the diff, in plain words. |
+| `## Existing work` | What already did part of the job, with a link or file and line, and what this change adds. Or the places searched. |
+| `## Proof in practice` | Each command in backticks, the output without the change and with it, and anything still unproven. |
+| `## Eval` | Only for a `feat` title. The eval's cases and grader, the command, and its result. |
+| `## Risk` | What could break, for whom, and how anyone would notice. `Low` and one reason for a doc or test change. |
+| `## How to revert` | The exact undo step, and any data or state a plain revert leaves behind. |
+
+A repository's own sections, such as a request record or a session link, follow these. Optional `## Why now` and `## After merge` sections go after What this does and after How to revert.
+
+`pull_request.py template` writes the headings in this order into a new body, and appends each missing heading to the end of a body that already has some. `durable_post_lint.py` reports a create body missing What this does, Risk, or How to revert, and the proof gate holds one missing Existing work, Proof in practice, or Eval for a `feat` title.

package/.agents/skills/pull-request/scripts/github_pr_command_constants/config/constants.py

@@ -9,11 +9,14 @@ ACTION_REVIEW = "review"
 ACTION_TEMPLATE = "template"
 
 ALL_BODY_TEMPLATE_HEADINGS: tuple[str, ...] = (
-    "Why",
+    "What this does",
+    "What changed",
     "Existing work",
     "Proof in practice",
-    "Verification",
+    "Risk",
+    "How to revert",
 )
+FEATURE_BODY_TEMPLATE_HEADING_FOLLOWS = "Proof in practice"
 FEATURE_BODY_TEMPLATE_HEADING = "Eval"
 FEATURE_TITLE_PATTERN: re.Pattern[str] = re.compile(r"^\s*feat(\([^)]*\))?!?:")
 BODY_TEMPLATE_HEADING_FORMAT = "## {heading}"

package/.agents/skills/pull-request/scripts/pull_request.py

@@ -26,6 +26,7 @@ from github_pr_command_constants.config.constants import (
     BODY_TEMPLATE_HEADING_FORMAT,
     BODY_TEMPLATE_LINE_END,
     FEATURE_BODY_TEMPLATE_HEADING,
+    FEATURE_BODY_TEMPLATE_HEADING_FOLLOWS,
     FEATURE_TITLE_PATTERN,
     ALL_GITHUB_AUTHORIZATION_ENVIRONMENT_KEYS,
     ALL_LINTER_ACTIONS_BY_COMMAND,
@@ -77,13 +78,11 @@ def _build_parser() -> argparse.ArgumentParser:
 
 
 def _template_headings(title: str) -> list[str]:
-    all_headings = [
-        BODY_TEMPLATE_HEADING_FORMAT.format(heading=each_heading)
-        for each_heading in ALL_BODY_TEMPLATE_HEADINGS
-    ]
+    all_heading_names = list(ALL_BODY_TEMPLATE_HEADINGS)
     if FEATURE_TITLE_PATTERN.match(title):
-        all_headings.append(BODY_TEMPLATE_HEADING_FORMAT.format(heading=FEATURE_BODY_TEMPLATE_HEADING))
-    return all_headings
+        eval_position = all_heading_names.index(FEATURE_BODY_TEMPLATE_HEADING_FOLLOWS) + 1
+        all_heading_names.insert(eval_position, FEATURE_BODY_TEMPLATE_HEADING)
+    return [BODY_TEMPLATE_HEADING_FORMAT.format(heading=each_heading) for each_heading in all_heading_names]
 
 
 def write_body_template(body_file: Path, title: str) -> list[str]:
@@ -91,8 +90,9 @@ def write_body_template(body_file: Path, title: str) -> list[str]:
 
     ::
 
-        new file, title "fix: x"   -> ["## Why", "## Existing work", "## Proof in practice", "## Verification"]
-        new file, title "feat: x"  -> the same plus "## Eval"
+        new file, title "fix: x"   -> ["## What this does", "## What changed", "## Existing work",
+                                       "## Proof in practice", "## Risk", "## How to revert"]
+        new file, title "feat: x"  -> the same with "## Eval" after "## Proof in practice"
         file already has them all  -> [] and the file is unchanged
 
     Args:

package/.agents/skills/pull-request/scripts/test_pull_request.py

@@ -544,3 +544,20 @@ def should_keep_written_text_and_add_only_missing_headings(tmp_path: Path) -> No
     assert first_text.startswith("## Why\nThe gate bounced twice.\n")
     assert first_text.count("## Why") == 1
     assert body_path.read_text(encoding="utf-8") == first_text
+
+
+def should_write_the_reader_headings_in_order_with_eval_after_the_proof(tmp_path: Path) -> None:
+    body_path = tmp_path / BODY_FILENAME
+    _run_template(body_path, "feat(hooks): add the gate")
+    all_heading_lines = [
+        each_line for each_line in body_path.read_text(encoding="utf-8").splitlines() if each_line.startswith("## ")
+    ]
+    assert all_heading_lines == [
+        "## What this does",
+        "## What changed",
+        "## Existing work",
+        "## Proof in practice",
+        "## Eval",
+        "## Risk",
+        "## How to revert",
+    ]

package/bin/install.settings-defaults.test.mjs

@@ -35,6 +35,11 @@ const INSTALL_ENTRY = join(PACKAGE_ROOT, 'bin', 'install.mjs');
 const EXPECTED_DENY_ENTRIES = [];
 const EXPECTED_ALLOW_ENTRIES = [
     'WebFetch(domain:docs.github.com)',
+    'WebFetch(domain:claude.com)',
+    'WebFetch(domain:*.claude.com)',
+    'WebFetch(domain:claude.dev)',
+    'WebFetch(domain:*.claude.dev)',
+    'WebFetch(domain:www.anthropic.com)',
     'Read(~/.claude/docs/**)',
 ];
 const PROFILE_ALLOW_ENTRIES = DECLARED_PROFILE_SETTINGS
@@ -76,7 +81,7 @@ function runInstallerInSandbox(sandboxHome, installerArguments = []) {
     });
 }
 
-test('package settings.json publishes the GitHub docs fetch allow and no managed deny entries', () => {
+test('package settings.json publishes the docs fetch allows and no managed deny entries', () => {
     assert.deepEqual(packageManagedPermissions(), {
         allow: EXPECTED_ALLOW_ENTRIES,
         deny: EXPECTED_DENY_ENTRIES,

package/docs/account-broker.md

@@ -6,7 +6,7 @@ Claude's main home is `~/.claude`. Its `claude-chain.json` file contains a `chai
 
 The optional `claude-account-order.json` file in the main home sets the Claude pick priority. It is a JSON list of account names, first choice first, such as `["claude-second", "claude"]`. An entry matches an account's name, its command, or its `claude-<name>` launcher, and `claude` names the main account. A new job goes to the first listed account with room. When no listed account has room, the broker picks the unlisted account with the most room, and it waits when no account has room. A resumed session stays on its bound account while that account has room. A listed name absent from the roster is skipped. Without the file, every job goes to the account with the most room. Edit the file to change the order; the next pick reads it.
 
-Codex uses its configured account list. When no Codex roster is configured, the broker chooses the default Codex home. A new Codex job goes to an account on a Pro plan before any other account in the same tier. The plan comes from the account's meter reply, and `ALL_PRO_PLAN_TYPES` lists the Pro plans: `pro`, `prolite`, and `promax`. Among accounts of the same kind, the one with the most room wins. A Pro account below the `normal` floor still loses to any account with room in the `normal` tier.
+Codex uses its configured account list. A broker run that reads `CODEX_ACCOUNT_PROFILES` saves that list to `account-launchers.json`, so a later run without the variable reads the same roster; [Codex accounts](codex-accounts.md) has the details. When no Codex roster is configured, the broker chooses the default Codex home. A new Codex job goes to an account on a Pro plan before any other account in the same tier. The plan comes from the account's meter reply, and `ALL_PRO_PLAN_TYPES` lists the Pro plans: `pro`, `prolite`, and `promax`. Among accounts of the same kind, the one with the most room wins. A Pro account below the `normal` floor still loses to any account with room in the `normal` tier.
 
 ## Commands
 

package/docs/codex-accounts.md

@@ -22,6 +22,11 @@ The account list names the accounts and their order. It comes from the
 in `account-launchers.json` under the profiles root. When neither exists, the
 accounts are `codex-1`, `codex-2`, `codex-3` and `codex-4`.
 
+Each read of the variable's list saves it to `account-launchers.json` when the
+file holds a different list. A service, runner, or other process started
+without the variable then reads the same roster from the file. When the file
+cannot be written, the read prints a warning and uses the variable's list.
+
 The broker's `choose` and `check` commands and the setup commands use that list.
 Each account's home is `~/.codex-profiles/<name>`, or
 `<name>` under `CODEX_PROFILES_ROOT` when set. `~/.codex` holds the shared setup
@@ -84,6 +89,12 @@ folder under the profiles root stays, with its `auth.json`, so typing the name
 again restores it. A blank first line empties the roster and moves every launcher
 aside.
 
+While `CODEX_ACCOUNT_PROFILES` is set, the variable's list stays the roster. The
+next broker, sync, or install run saves it over the setup list, and setup prints
+a warning when the two differ. Change or clear the variable to change the
+roster. Two processes with different values of the variable each save their own
+list, so a process without the variable reads whichever list was saved last.
+
 ## Which account a job uses
 
 Room is the least percent left across an account's windows, such as the 5-hour window and the week.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "claude-dev-env",
-    "version": "8.98.10",
+    "version": "8.99.0",
     "description": "Claude Code development standards — rules, hooks, agents, commands, and skills",
     "type": "module",
     "bin": {

package/scripts/codex_account_choice.py

@@ -5,7 +5,9 @@ Each Codex account signs in under its own Codex home in
 ``~/.codex-profiles/<name>``. The account list names them in try order: the
 ``CODEX_ACCOUNT_PROFILES`` environment variable, comma-separated, else the saved
 ``account-launchers.json`` list under the profiles root. With neither,
-``codex-1`` through ``codex-4`` are the roster.
+``codex-1`` through ``codex-4`` are the roster. An environment roster that
+differs from the saved file is saved to it, so a process without the variable
+reads the same roster.
 
 Three commands::
 
@@ -27,6 +29,7 @@ import argparse
 import json
 import os
 import sys
+import time
 from collections.abc import Callable, Sequence
 from datetime import datetime, timezone
 from pathlib import Path
@@ -60,8 +63,12 @@ from dev_env_scripts_constants.codex_account_constants import (
     MAIN_CODEX_HOME_DIRECTORY_NAME,
     ROSTER_JSON_INDENT,
     ROSTER_NOT_A_LIST_TEMPLATE,
+    ROSTER_REPLACE_ATTEMPTS,
+    ROSTER_REPLACE_RETRY_SECONDS,
+    SAVE_ENVIRONMENT_ROSTER_FAILED_TEMPLATE,
     SETUP_NAMES_SEPARATOR,
     SETUP_NO_SAVED_NAMES_TEXT,
+    SETUP_OVERRIDDEN_BY_ENVIRONMENT_TEMPLATE,
     SETUP_PROMPT_TEXT,
     SETUP_SAVED_NAMES_TEMPLATE,
     TEXT_ENCODING,
@@ -156,12 +163,44 @@ def _saved_roster_file_names(profiles_root: Path) -> tuple[str, ...]:
     return _roster(document, str(roster_path))
 
 
+def _saved_roster_or_nothing(profiles_root: Path) -> tuple[str, ...]:
+    try:
+        return _saved_roster_file_names(profiles_root)
+    except (CodexAccountNameError, OSError, UnicodeError):
+        return ()
+
+
+def _save_environment_roster(
+    profiles_root: Path, all_environment_names: tuple[str, ...]
+) -> None:
+    """Copy the environment roster into the saved file when the two differ.
+
+    A process started without ``CODEX_ACCOUNT_PROFILES`` then reads the same
+    roster from the file.
+
+    Args:
+        profiles_root: The directory that holds every account's Codex home.
+        all_environment_names: The validated names the environment gives.
+    """
+    if _saved_roster_or_nothing(profiles_root) == all_environment_names:
+        return
+    try:
+        save_codex_account_names(profiles_root, all_environment_names)
+    except OSError as error:
+        print(
+            SAVE_ENVIRONMENT_ROSTER_FAILED_TEMPLATE.format(
+                path=profiles_root / CODEX_ACCOUNT_LAUNCHERS_FILE_NAME, error=error
+            ),
+            file=sys.stderr,
+        )
+
+
 def saved_codex_account_names(profiles_root: Path) -> tuple[str, ...]:
     """Name the account list, in try order, without duplicates.
 
     ::
 
-        CODEX_ACCOUNT_PROFILES="alpha, beta,alpha" -> ("alpha", "beta")
+        CODEX_ACCOUNT_PROFILES="alpha, beta,alpha" -> ("alpha", "beta"), saved to the file
         unset, account-launchers.json ["gamma"]    -> ("gamma",)
         unset, no file                             -> ()
 
@@ -170,11 +209,16 @@ def saved_codex_account_names(profiles_root: Path) -> tuple[str, ...]:
 
     Returns:
         The environment's names when it names any, else the saved file's names.
+        Environment names that differ from the file are saved to it.
 
     Raises:
         CodexAccountNameError: When the environment or the file names an invalid account.
     """
-    return _environment_roster() or _saved_roster_file_names(profiles_root)
+    all_environment_names = _environment_roster()
+    if all_environment_names:
+        _save_environment_roster(profiles_root, all_environment_names)
+        return all_environment_names
+    return _saved_roster_file_names(profiles_root)
 
 
 def codex_account_names(profiles_root: Path) -> tuple[str, ...]:
@@ -192,15 +236,48 @@ def codex_account_names(profiles_root: Path) -> tuple[str, ...]:
 def save_codex_account_names(profiles_root: Path, all_names: Sequence[str]) -> None:
     """Write the account list as a JSON list under the profiles root.
 
+    The list goes to a staged file first, and ``os.replace`` moves it over the
+    saved file in one step, so a concurrent reader sees the old list or the new one.
+
     Args:
         profiles_root: The directory that holds every account's Codex home.
         all_names: The account names in try order.
     """
     profiles_root.mkdir(parents=True, exist_ok=True)
     roster_text = json.dumps(list(all_names), indent=ROSTER_JSON_INDENT) + "\n"
-    (profiles_root / CODEX_ACCOUNT_LAUNCHERS_FILE_NAME).write_bytes(
-        roster_text.encode(TEXT_ENCODING)
-    )
+    roster_path = profiles_root / CODEX_ACCOUNT_LAUNCHERS_FILE_NAME
+    staged_path = roster_path.with_name(f"{roster_path.name}.{os.getpid()}.tmp")
+    try:
+        staged_path.write_bytes(roster_text.encode(TEXT_ENCODING))
+        _replace_with_retries(staged_path, roster_path)
+    except OSError:
+        staged_path.unlink(missing_ok=True)
+        raise
+
+
+def _replace_with_retries(staged_path: Path, roster_path: Path) -> None:
+    """Replace the saved roster, retrying while a Windows reader holds it open.
+
+    Args:
+        staged_path: The fully written new roster file.
+        roster_path: The saved roster file to replace.
+
+    Raises:
+        PermissionError: When the saved file stays locked through every attempt.
+    """
+    for _ in range(ROSTER_REPLACE_ATTEMPTS - 1):
+        if _replaced(staged_path, roster_path):
+            return
+        time.sleep(ROSTER_REPLACE_RETRY_SECONDS)
+    os.replace(staged_path, roster_path)
+
+
+def _replaced(staged_path: Path, roster_path: Path) -> bool:
+    try:
+        os.replace(staged_path, roster_path)
+    except PermissionError:
+        return False
+    return True
 
 
 def _sync_account(
@@ -403,9 +480,24 @@ def _run_setup(arguments: argparse.Namespace) -> int:
         now=now,
     )
     print(json.dumps({JSON_INSTALLED_KEY: all_installed, JSON_RETIRED_KEY: all_retired}))
+    _warn_when_the_environment_replaces(all_names)
     return 0
 
 
+def _warn_when_the_environment_replaces(all_setup_names: tuple[str, ...]) -> None:
+    try:
+        all_environment_names = _environment_roster()
+    except CodexAccountNameError:
+        return
+    if all_environment_names and all_environment_names != all_setup_names:
+        print(
+            SETUP_OVERRIDDEN_BY_ENVIRONMENT_TEMPLATE.format(
+                names=SETUP_NAMES_SEPARATOR.join(all_environment_names)
+            ),
+            file=sys.stderr,
+        )
+
+
 def _add_main_home_argument(command_parser: argparse.ArgumentParser) -> None:
     command_parser.add_argument(
         "--main-home", type=Path, default=Path.home() / MAIN_CODEX_HOME_DIRECTORY_NAME

package/scripts/dev_env_scripts_constants/codex_account_constants.py

@@ -39,6 +39,23 @@ INVALID_ACCOUNT_ROSTER_TEMPLATE: str = "{source} names {name!r}: {reason}"
 ROSTER_NOT_A_LIST_TEMPLATE: str = "{source} must hold a JSON list of account names"
 """Error when the roster JSON is anything other than a list of names."""
 
+SAVE_ENVIRONMENT_ROSTER_FAILED_TEMPLATE: str = (
+    "warning: cannot save the CODEX_ACCOUNT_PROFILES roster to {path}: {error}"
+)
+"""Warning when the environment roster cannot be copied into the saved file."""
+
+ROSTER_REPLACE_ATTEMPTS: int = 5
+"""Tries at replacing the saved roster while a Windows reader holds it open."""
+
+ROSTER_REPLACE_RETRY_SECONDS: float = 0.05
+"""Pause between tries at replacing the saved roster."""
+
+SETUP_OVERRIDDEN_BY_ENVIRONMENT_TEMPLATE: str = (
+    "warning: CODEX_ACCOUNT_PROFILES names {names}; the next broker, sync or install run"
+    " saves that list over this setup list"
+)
+"""Warning when setup saves a list that the environment roster will replace."""
+
 ROSTER_JSON_INDENT: int = 2
 """Indent of the saved roster JSON, one name per line."""
 

package/scripts/durable_post_lint.py

@@ -25,7 +25,6 @@ from durable_post_lint_config.config.constants import (
     ALL_BODY_REQUIRED_ACTIONS,
     ALL_PATH_ANCHORED_VOLATILE_PATH_MARKERS,
     ALL_POST_ACTIONS,
-    ALL_PR_DESCRIPTION_ACTIONS,
     ALL_RELEASE_BODY_MARKERS,
     ALL_REQUIRED_PR_DESCRIPTION_HEADINGS,
     ALL_TITLE_ACTIONS,
@@ -266,9 +265,8 @@ def _body_findings(
     if _is_release_automation_branch(head_branch):
         all_findings.extend(_release_body_findings(body_text))
     else:
-        if action in ALL_PR_DESCRIPTION_ACTIONS:
-            all_findings.extend(_description_heading_findings(body_text))
         if action == ACTION_PR_CREATE:
+            all_findings.extend(_description_heading_findings(body_text))
             all_findings.extend(_pull_request_proof_findings(title, body_text))
         if action == ACTION_GITHUB_MCP_COMMENT:
             all_findings.extend(_comment_length_findings(body_text))

package/scripts/durable_post_lint_config/config/constants.py

@@ -37,9 +37,6 @@ ALL_BODY_REQUIRED_ACTIONS: frozenset[str] = frozenset(
         ACTION_PR_REVIEW,
     }
 )
-ALL_PR_DESCRIPTION_ACTIONS: frozenset[str] = frozenset(
-    {ACTION_PR_CREATE, ACTION_PR_EDIT}
-)
 ALL_TITLE_ACTIONS: frozenset[str] = frozenset({ACTION_PR_CREATE, ACTION_PR_EDIT})
 ALL_CONVENTIONAL_TITLE_TYPES: tuple[str, ...] = (
     "build",
@@ -58,8 +55,9 @@ CONVENTIONAL_TITLE_PATTERN: re.Pattern[str] = re.compile(
     rf"^(?:{'|'.join(ALL_CONVENTIONAL_TITLE_TYPES)})(?:\([^)\r\n]+\))?!?: [^\s].*$"
 )
 ALL_REQUIRED_PR_DESCRIPTION_HEADINGS: tuple[str, ...] = (
-    "Why",
-    "Verification",
+    "What this does",
+    "Risk",
+    "How to revert",
 )
 ALL_PATH_ANCHORED_VOLATILE_PATH_MARKERS: tuple[str, ...] = (
     ".claude-profile-a/jobs/",

package/scripts/durable_post_lint_config/config/test_constants.py

@@ -40,5 +40,5 @@ def should_name_the_branch_prefix_release_automation_pushes() -> None:
     assert RELEASE_BRANCH_PREFIX == "release-please--branches--"
 
 
-def should_require_only_the_headings_both_pull_request_rule_sets_name() -> None:
-    assert ALL_REQUIRED_PR_DESCRIPTION_HEADINGS == ("Why", "Verification")
+def should_require_the_reader_headings_a_reviewer_reads_in_place_of_the_code() -> None:
+    assert ALL_REQUIRED_PR_DESCRIPTION_HEADINGS == ("What this does", "Risk", "How to revert")

package/scripts/test_account_broker.py

@@ -850,6 +850,18 @@ def test_should_use_default_codex_home_without_roster(
     assert "no roster" in decision.reason
 
 
+def test_should_keep_the_codex_roster_for_a_process_without_the_roster_variable(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    monkeypatch.setattr(account_broker.support.codex_account_choice, "default_profiles_root", lambda: tmp_path / "profiles")
+    monkeypatch.setenv("CODEX_ACCOUNT_PROFILES", "team,personal")
+    assert [each_account.name for each_account in account_broker.load_codex_accounts()] == ["team", "personal"]
+
+    monkeypatch.delenv("CODEX_ACCOUNT_PROFILES")
+
+    assert [each_account.name for each_account in account_broker.load_codex_accounts()] == ["team", "personal"]
+
+
 def test_should_reuse_meter_cache_for_60_seconds() -> None:
     account = _account("cached")
     calls: list[str] = []

package/scripts/test_codex_account_choice.py

@@ -144,6 +144,79 @@ class TestAccountRoster:
         monkeypatch.setenv("CODEX_ACCOUNT_PROFILES", " beta , alpha,, ")
         assert choice.saved_codex_account_names(tmp_path) == ("beta", "alpha")
 
+    def should_save_the_environment_roster_for_a_process_without_it(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        monkeypatch.setenv("CODEX_ACCOUNT_PROFILES", "beta,alpha")
+        assert choice.saved_codex_account_names(tmp_path) == ("beta", "alpha")
+        monkeypatch.delenv("CODEX_ACCOUNT_PROFILES")
+        assert choice.saved_codex_account_names(tmp_path) == ("beta", "alpha")
+
+    @pytest.mark.parametrize("saved_bytes", [b'["alpha",', b"\xff\xfe\x00"])
+    def should_replace_an_unreadable_saved_file_with_the_environment_roster(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch, saved_bytes: bytes
+    ) -> None:
+        (tmp_path / "account-launchers.json").write_bytes(saved_bytes)
+        monkeypatch.setenv("CODEX_ACCOUNT_PROFILES", "alpha")
+        assert choice.saved_codex_account_names(tmp_path) == ("alpha",)
+        assert json.loads((tmp_path / "account-launchers.json").read_text(encoding="utf-8")) == ["alpha"]
+
+    def should_keep_the_environment_roster_when_the_saved_file_cannot_be_read(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        def refuse_read(_: Path) -> tuple[str, ...]:
+            raise PermissionError("locked")
+
+        monkeypatch.setattr(choice, "_saved_roster_file_names", refuse_read)
+        monkeypatch.setenv("CODEX_ACCOUNT_PROFILES", "alpha")
+        assert choice.saved_codex_account_names(tmp_path) == ("alpha",)
+
+    def should_remove_the_staged_roster_when_the_write_fails(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        original_write_bytes = Path.write_bytes
+
+        def fail_after_partial_write(path: Path, data: bytes) -> int:
+            original_write_bytes(path, data[:3])
+            raise OSError("disk full")
+
+        monkeypatch.setattr(Path, "write_bytes", fail_after_partial_write)
+        with pytest.raises(OSError, match="disk full"):
+            choice.save_codex_account_names(tmp_path, ("alpha",))
+        assert list(tmp_path.iterdir()) == []
+
+    @pytest.mark.parametrize("document", [["gamma"], ["alpha", "bad name"], {"alpha": 1}])
+    def should_replace_a_saved_file_that_differs_from_the_environment(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch, document: object
+    ) -> None:
+        save_roster(tmp_path, document)
+        monkeypatch.setenv("CODEX_ACCOUNT_PROFILES", "alpha")
+        choice.saved_codex_account_names(tmp_path)
+        assert json.loads((tmp_path / "account-launchers.json").read_text(encoding="utf-8")) == ["alpha"]
+
+    def should_leave_a_saved_file_that_matches_the_environment_untouched(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        save_roster(tmp_path, ["beta", "alpha"])
+        saved_bytes = (tmp_path / "account-launchers.json").read_bytes()
+        monkeypatch.setenv("CODEX_ACCOUNT_PROFILES", "beta,alpha")
+        choice.saved_codex_account_names(tmp_path)
+        assert (tmp_path / "account-launchers.json").read_bytes() == saved_bytes
+
+    def should_keep_the_environment_roster_when_the_file_cannot_be_written(
+        self,
+        tmp_path: Path,
+        monkeypatch: pytest.MonkeyPatch,
+        capsys: pytest.CaptureFixture[str],
+    ) -> None:
+        def refuse_save(*_: object) -> None:
+            raise PermissionError("read-only")
+
+        monkeypatch.setattr(choice, "save_codex_account_names", refuse_save)
+        monkeypatch.setenv("CODEX_ACCOUNT_PROFILES", "alpha")
+        assert choice.saved_codex_account_names(tmp_path) == ("alpha",)
+        assert "cannot save the CODEX_ACCOUNT_PROFILES roster" in capsys.readouterr().err
+
     def should_read_the_saved_file_when_the_environment_is_unset(
         self, tmp_path: Path
     ) -> None:
@@ -190,6 +263,37 @@ class TestAccountRoster:
             b'[\n  "alpha",\n  "beta"\n]\n'
         )
         assert choice.saved_codex_account_names(profiles_root) == ("alpha", "beta")
+        assert [each.name for each in profiles_root.iterdir()] == ["account-launchers.json"]
+
+    def should_retry_a_replace_while_a_reader_holds_the_roster(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        original_replace = os.replace
+        all_attempts: list[object] = []
+
+        def refuse_first_replace(source: Path, target: Path) -> None:
+            all_attempts.append(source)
+            if len(all_attempts) == 1:
+                raise PermissionError("in use")
+            original_replace(source, target)
+
+        monkeypatch.setattr(choice.os, "replace", refuse_first_replace)
+        monkeypatch.setattr(choice.time, "sleep", lambda _: None)
+        choice.save_codex_account_names(tmp_path, ("alpha",))
+        assert len(all_attempts) == 2
+        assert json.loads((tmp_path / "account-launchers.json").read_text(encoding="utf-8")) == ["alpha"]
+
+    def should_remove_the_staged_roster_when_the_replace_fails(
+        self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
+    ) -> None:
+        def refuse_replace(*_: object) -> None:
+            raise PermissionError("in use")
+
+        monkeypatch.setattr(choice.os, "replace", refuse_replace)
+        monkeypatch.setattr(choice.time, "sleep", lambda _: None)
+        with pytest.raises(PermissionError):
+            choice.save_codex_account_names(tmp_path, ("alpha",))
+        assert list(tmp_path.iterdir()) == []
 
     def should_fall_back_to_the_four_fixed_accounts_without_a_roster(
         self, tmp_path: Path
@@ -308,6 +412,23 @@ class TestSetupRoster:
             "profile name must use letters, digits, hyphens, or underscores",
         ]
 
+    @pytest.mark.parametrize(("environment_roster", "is_warned"), [("alpha,beta", True), ("alpha", False), ("", False), ("bad name", False)])
+    def should_warn_when_the_environment_roster_will_replace_the_setup_list(
+        self,
+        tmp_path: Path,
+        monkeypatch: pytest.MonkeyPatch,
+        capsys: pytest.CaptureFixture[str],
+        environment_roster: str,
+        is_warned: bool,
+    ) -> None:
+        monkeypatch.setattr(choice, "update_codex_account_roster", lambda **_: (("alpha",), {}))
+        monkeypatch.setenv("CODEX_ACCOUNT_PROFILES", environment_roster)
+        all_arguments = ["--profiles-root", str(tmp_path / "profiles"), "setup"]
+        main_home = build_codex_main_home(tmp_path)
+        assert choice.main([*all_arguments, "--main-home", str(main_home), "--launcher-directory", str(tmp_path / "bin")]) == 0
+        assert ("CODEX_ACCOUNT_PROFILES names alpha" in capsys.readouterr().err) is is_warned
+        assert (tmp_path / "bin" / "codex-alpha.cmd").is_file()
+
     def should_finish_at_the_end_of_input(self, tmp_path: Path) -> None:
         all_names, _ = choice.update_codex_account_roster(
             profiles_root=tmp_path,

package/scripts/test_durable_post_lint.py

@@ -18,9 +18,9 @@ from hooks_constants.pull_request_proof_constants import (
 )
 
 SCRIPT_PATH = Path(__file__).resolve().parent / "durable_post_lint.py"
-VALID_PR_BODY = """## Why
+VALID_PR_BODY = """## What this does
 
-Why text.
+What this does text.
 
 ## Scope
 
@@ -34,9 +34,13 @@ Tradeoffs text.
 
 Blast radius text.
 
-## Verification
+## Risk
 
-Verification text.
+Risk text.
+
+## How to revert
+
+Revert text.
 
 ## Existing work
 
@@ -201,7 +205,7 @@ def test_pr_body_reports_each_missing_heading(missing_heading: str) -> None:
     ]
 
 
-def should_accept_an_edit_body_carrying_only_the_two_required_headings() -> None:
+def should_accept_an_edit_body_without_the_reader_headings() -> None:
     all_findings = durable_post_lint.lint_durable_post(
         action="pr-edit",
         title="fix(cli): tighten input handling",

package/settings.json

@@ -3,6 +3,11 @@
   "permissions": {
     "allow": [
       "WebFetch(domain:docs.github.com)",
+      "WebFetch(domain:claude.com)",
+      "WebFetch(domain:*.claude.com)",
+      "WebFetch(domain:claude.dev)",
+      "WebFetch(domain:*.claude.dev)",
+      "WebFetch(domain:www.anthropic.com)",
       "Read(~/.claude/docs/**)"
     ]
   },