johns-harness 2026.9.8 → 2026.9.10

package/README.md

@@ -8,7 +8,17 @@
 
 ![A collective of AI agents working one codebase together](docs/images/swarm-collective.png)
 
-John's Harness is a production agent harness for engineers who run more than one coding agent at a time. Agents work the same repositories at once, coordinate through a durable board keyed by git origin, message each other while they run, and ship only through an exact-head push gate with per-commit production authority. Memory persists across sessions and compaction and is shared by every agent in the swarm.
+John's Harness is a production agent harness for engineers who run more than one coding agent at a time. Agents work the same repositories at once, coordinate through a durable board keyed by git origin, message each other while they run, and ship only through an exact-head push gate with per-commit production authority. Memory persists across sessions and compaction and is shared by every agent in the swarm. Launching a swarm takes one command and a number; the members divide the work among themselves.
+
+## Migrating from OpenClaw
+Bring your agents, memory, credentials, and scheduled jobs into John's Harness.
+```sh
+npm i -g johns-harness && johnness migrate
+```
+The command backs up your state, creates `~/.johnness`, rewrites settings, and checks the result.
+If your gateway is running, it shows the exact stop command before making changes.
+Review any script updates, then follow the printed commands to start the new gateway.
+Your original installation stays intact. Preview with `johnness migrate --dry-run`; undo with `johnness migrate --rollback`.
 
 ## Quick start
 
@@ -17,12 +27,12 @@ Requires Node 22.12 or newer.
 ```bash
 npm install -g johns-harness
 johnness onboard
-johnness config set plugins.entries.mr-memory.config.key "mk_your_key"
+johnness memory mk_your_key
 ```
 
 The package is `johns-harness`; the command it installs is `johnness`.
 
-The wizard sets up credentials, workspace, gateway, and channels. The third line stores a MemoryRouter API key from [memoryrouter.ai](https://memoryrouter.ai); until it is set, the harness still runs and prints one setup line saying where to put it.
+The wizard sets up credentials, workspace, gateway, and channels. It asks for your MemoryRouter API key and links to [signup](https://app.memoryrouter.ai/signup), free to start. If you skip memory in the wizard, the third line stores the key later.
 
 ### First run
 
@@ -30,7 +40,7 @@ The wizard sets up credentials, workspace, gateway, and channels. The third line
 | --- | --- | --- |
 | Install | `npm install -g johns-harness` | Installs the CLI, the runtime, and the default memory plugin. A postinstall step applies the patched dependency files. |
 | Configure | `johnness onboard` | Interactive wizard for gateway, workspace, and skills. `johnness configure` reopens it later. |
-| Memory | `johnness config set plugins.entries.mr-memory.config.key "mk_..."` | Turns on persistent memory. The plugin is already installed and enabled. |
+| Memory | `johnness memory mk_your_key` | Turns on persistent memory. The plugin is already installed and enabled. |
 | Start | `johnness gateway start` | Starts the gateway as a background service. `johnness gateway run` keeps it in the foreground. |
 | Connect | `johnness channels add --channel telegram --token "<bot token>"` | Connects a chat channel. Discord, Slack, WhatsApp, Signal, iMessage, Matrix, and more are supported. |
 | Check | `johnness doctor` | Health checks and quick fixes for the gateway and channels. |
@@ -46,21 +56,54 @@ node johnness.mjs --help
 ### Verify
 
 ```bash
-npm test                        # 529 tests against the installed dependency tree
-bash scripts/verify-patches.sh  # 182 checks across every patch family
+npm test                        # 701 tests against the installed dependency tree
+bash scripts/verify-patches.sh  # 258 checks across every patch family
+```
+
+## Launch a swarm with one command
+
+One call, one number. The orchestrator writes a single directive and chooses how many agents should work it. The members decide everything else.
+
+```
+swarm_spawn({
+  directive: "<the whole briefing: goal, scope, forbidden files, push rules, author identity>",
+  count: 12,
+  coord: { root: "/abs/path/to/repo", branch: "main", prodAuthorized: false },
+  model: "anthropic/claude-fable-5-1"      // optional, applies to every member
+})
 ```
 
+![One command launches a hundred agents that fan out over a codebase and pick up work from a shared board](docs/images/swarm-spawn.png)
+
+Every member receives the same directive plus a short runtime preamble that carries the protocol. Nobody hands out work.
+
+The lowest-numbered live member decomposes the directive into work items on the shared board. The post is a compare-and-swap, so exactly one plan exists no matter how many members arrive at the same moment; the rest wait for it rather than poll.
+
+Each member claims one open item atomically, works it, pushes, marks it done or failed, and claims the next. A claim is exactly one winner, even under concurrent attempts.
+
+Claims carry a 15 minute lease that heartbeats extend. A lease that lapses reopens the item the moment anyone looks at the board, so a dead member never strands its work.
+
+When work reveals more items, any member appends them to the plan and the addition wakes the others through their inboxes. Members message each other directly only for a real dependency, and each records how the swarm coordinated so the next one starts smarter.
+
+The preamble also carries the operating protocol as defaults with named exceptions: the planner declares the shape of the work, one integrator merges parallel branches and builds and pushes once so parallel work flows into a single sequential step, one gateway or a shared budget fronts each rate-limited host, and done means done. Members ask a service holder with a durable request and wait on the answer without polling.
+
+Per-member announces are suppressed. When the last member finishes, one `swarm finished` rollup arrives with every item, its owner, its pushed head, and its summary.
+
+`count` runs from 2 to 100. Members beyond the concurrency limit are queued and start as slots free, and `swarm_status` reads a swarm's progress without interrupting anyone. Members are ordinary agents: same depth rules, same push preflight, same per-commit production authority, no force pushes.
+
+Full guide, including the preamble members receive and the work item state machine: [`docs/SWARM.md`](docs/SWARM.md).
+
 ## The problem
 
 Coding agents today run as isolated processes. Two agents on the same repository have no shared state, no way to talk to each other mid-task, and no gate between a dirty local branch and production. Once a context window compacts, whatever the agent knew is gone.
 
 ## What makes it different
 
-- **A swarm, not a pile of agents.** One coordination board per repository, direct agent-to-agent messages delivered inside a busy agent's run, exclusive claims on shared areas, and a push preflight that blocks stale, forced, broad, and unauthorized pushes.
+- **A swarm, not a pile of agents.** One coordination board per repository, direct agent-to-agent messages delivered inside a busy agent's run, exclusive claims on shared areas, a push preflight that blocks stale, forced, broad, and unauthorized pushes, and `swarm_spawn`, which launches up to 100 agents from one directive in a single call.
 - **Memory built for production.** Tiered recall that traces from consolidated reflections down to the verbatim record, surviving compaction and shared across the swarm. Installed and enabled by default.
 - **Production authority per commit.** Promotion is granted to an exact SHA, never to a branch name, so one worker's authorization never covers another worker's commits.
 - **An append-only action log.** Agents record every consequential action to `ACTION_LOG.md` and read it before acting.
-- **A fixed runtime surface.** The core does not grow on a schedule. New mechanisms enter only to solve a demonstrated production failure, one narrow, tested, reversible patch at a time: 54 patch families, each with a regression test and a rollback path.
+- **A fixed runtime surface.** The core does not grow on a schedule. New mechanisms enter only to solve a demonstrated production failure, one narrow, tested, reversible patch at a time: 59 patch families, each with a regression test and a rollback path.
 - **Reliability with a definition.** Bounded retries, explicit failure states, exact-once continuation, context-pressure recovery, durable delivery, and supervised gateway recovery.
 - **Coding first, phone optional.** Direct the work at a high level from a chat channel while agents plan, implement, test, coordinate, and stage releases unattended.
 - **Local voice.** Optional native Whisper transcription of inbound audio, entirely on your machine. Off by default. [Setup](docs/NATIVE-WHISPER-MUSE.md).
@@ -92,8 +135,12 @@ Agents sharing a filesystem are not a swarm. A swarm knows who owns which work,
 
 **Production authority belongs to a commit.** Never to a branch name or a timestamp.
 
+**One directive, one number.** `swarm_spawn` launches up to 100 members from the same briefing and they divide the work themselves. See the launch section near the top of this page and the [swarm guide](docs/SWARM.md).
+
 ## Memory
 
+Run `johnness memory mk_your_key` to set your MemoryRouter API key and start persistent memory, or enter it during onboarding.
+
 The future of AI is not smarter models. It is models with the right context: what is happening, what happened before, and what matters now.
 
 An agent in this harness remembers what it was told yesterday, the decision it made last Tuesday, the fix it tried that did not work, and why. That context persists across sessions and survives compaction. It does not live and die inside one context window.
@@ -123,7 +170,7 @@ The log is a [`RULES.md`](RULES.md) workspace convention enforced through the ac
 
 ## Patch families
 
-The runtime carries 54 patch families. Each is a production fix applied at the source with a regression test, a durable patch marker, and a rollback path. A verifier runs 182 checks against the package tree and installed dependencies, and 529 tests run against the installed dependency tree.
+The runtime carries 59 patch families. Each is a production fix applied at the source with a regression test, a durable patch marker, and a rollback path. A verifier runs 258 checks against the package tree and installed dependencies, and 701 tests run against the installed dependency tree.
 
 Every family follows the same six steps: reproduce the failure, trace the exact runtime path, make the smallest source-level change that restores the invariant, add a regression test and a patch marker, run the verifier, and retain rollback artifacts. The full index: [`docs/PATCHES.md`](docs/PATCHES.md).
 
@@ -140,7 +187,7 @@ Every family follows the same six steps: reproduce the failure, trace the exact
 ## Documentation
 
 - [`docs/index.md`](docs/index.md): runtime docs, from gateway and channels to plugins, nodes, and CLI reference.
-- [`docs/PATCHES.md`](docs/PATCHES.md): the 54 patch families, one record each.
+- [`docs/PATCHES.md`](docs/PATCHES.md): the 59 patch families, one record each.
 - [`docs/NATIVE-WHISPER-MUSE.md`](docs/NATIVE-WHISPER-MUSE.md): local Whisper transcription setup.
 - [`RULES.md`](RULES.md): the default operating rules, including Rule Zero on production authorization.
 

package/dist/auth-choice-Ck7FJ_PD.js

@@ -206,7 +206,7 @@ async function applyNonInteractiveAuthChoice(params) {
 			provider,
 			name: ""
 		});
-		upsertAuthProfile({
+		await upsertAuthProfile({
 			profileId,
 			credential: {
 				type: "token",

package/dist/auth-choice-CtvmIf50.js

@@ -62,7 +62,7 @@ async function applyAuthChoiceAnthropic(params) {
 			provider,
 			name: String(profileNameRaw ?? "")
 		});
-		upsertAuthProfile({
+		await upsertAuthProfile({
 			profileId: namedProfileId,
 			agentDir: params.agentDir,
 			credential: {
@@ -813,7 +813,7 @@ async function applyAuthChoicePluginProvider(params, options) {
 	});
 	if (result.configPatch) nextConfig = mergeConfigPatch(nextConfig, result.configPatch);
 	for (const profile of result.profiles) {
-		upsertAuthProfile({
+		await upsertAuthProfile({
 			profileId: profile.profileId,
 			credential: profile.credential,
 			agentDir

package/dist/auth-choice-DYEtgk1X.js

@@ -62,7 +62,7 @@ async function applyAuthChoiceAnthropic(params) {
 			provider,
 			name: String(profileNameRaw ?? "")
 		});
-		upsertAuthProfile({
+		await upsertAuthProfile({
 			profileId: namedProfileId,
 			agentDir: params.agentDir,
 			credential: {
@@ -813,7 +813,7 @@ async function applyAuthChoicePluginProvider(params, options) {
 	});
 	if (result.configPatch) nextConfig = mergeConfigPatch(nextConfig, result.configPatch);
 	for (const profile of result.profiles) {
-		upsertAuthProfile({
+		await upsertAuthProfile({
 			profileId: profile.profileId,
 			credential: profile.credential,
 			agentDir

package/dist/auth-choice-DtQ1-QBl.js

@@ -206,7 +206,7 @@ async function applyNonInteractiveAuthChoice(params) {
 			provider,
 			name: ""
 		});
-		upsertAuthProfile({
+		await upsertAuthProfile({
 			profileId,
 			credential: {
 				type: "token",

package/dist/auth-profiles-5CHn7vq1.js

@@ -1,3 +1,4 @@
+import { refreshManagedCodexProfile, readManagedCodexStore, mutateAuthProfile, updateAuthStoreMetadata, saveAuthStoreSnapshot } from "./codex-oauth-owner.js";
 import { t as __exportAll } from "./rolldown-runtime-DUslC3ob.js";
 import { _ as expandHomePrefix, a as resolveCanonicalConfigPath, c as resolveDefaultConfigCandidates, d as resolveIsNixMode, f as resolveLegacyStateDirs, g as resolveStateDir, h as resolveOAuthPath, i as isNixMode, l as resolveGatewayLockDir, m as resolveOAuthDir, n as DEFAULT_GATEWAY_PORT, o as resolveConfigPath, p as resolveNewStateDir, r as STATE_DIR, s as resolveConfigPathCandidate, t as CONFIG_PATH, u as resolveGatewayPort, y as resolveRequiredHomeDir } from "./paths-BfR2LXbA.js";
 import { c as sanitizeForLog, l as stripAnsi, t as createSubsystemLogger } from "./subsystem-Cf9yS0UI.js";
@@ -4199,13 +4200,7 @@ function resolveAuthStorePathForDisplay(agentDir) {
 	const pathname = resolveAuthStorePath(agentDir);
 	return pathname.startsWith("~") ? pathname : resolveUserPath(pathname);
 }
-function ensureAuthStoreFile(pathname) {
-	if (fs.existsSync(pathname)) return;
-	saveJsonFile(pathname, {
-		version: 1,
-		profiles: {}
-	});
-}
+
 //#endregion
 //#region src/agents/auth-profiles/store.ts
 const AUTH_PROFILE_TYPES = new Set([
@@ -4213,6 +4208,24 @@ const AUTH_PROFILE_TYPES = new Set([
 	"oauth",
 	"token"
 ]);
+// JOHNNESS_PATCH_CODEX_OAUTH_OWNERSHIP_58: all compiled adapters share one owner.
+function codexOwnershipContext(agentDir) {
+	return {
+		stateDir: resolveStateDir(),
+		mainAgentDir: resolveJohnnessAgentDir(),
+		agentDir: agentDir ? resolveUserPath(agentDir) : void 0,
+		log: (event) => log$8.info("Codex OAuth ownership", event)
+	};
+}
+function readCodexOwnedAuthStore(agentDir, store) {
+	return readManagedCodexStore({ ...codexOwnershipContext(agentDir), store });
+}
+function sanitizeAuthProfileCredential(credential) {
+	const sanitized = { ...credential };
+	if (sanitized.type === "api_key" && sanitized.keyRef) delete sanitized.key;
+	if (sanitized.type === "token" && sanitized.tokenRef) delete sanitized.token;
+	return sanitized;
+}
 const runtimeAuthStoreSnapshots = /* @__PURE__ */ new Map();
 function resolveRuntimeStoreKey(agentDir) {
 	return resolveAuthStorePath(agentDir);
@@ -4226,34 +4239,34 @@ function resolveRuntimeAuthProfileStore(agentDir) {
 	const requestedKey = resolveRuntimeStoreKey(agentDir);
 	const mainStore = runtimeAuthStoreSnapshots.get(mainKey);
 	const requestedStore = runtimeAuthStoreSnapshots.get(requestedKey);
-	if (!agentDir || requestedKey === mainKey) {
-		if (!mainStore) return null;
-		return cloneAuthProfileStore(mainStore);
-	}
-	if (mainStore && requestedStore) return mergeAuthProfileStores(cloneAuthProfileStore(mainStore), cloneAuthProfileStore(requestedStore));
-	if (requestedStore) return cloneAuthProfileStore(requestedStore);
-	if (mainStore) return cloneAuthProfileStore(mainStore);
-	return null;
+	let store;
+	if (!agentDir || requestedKey === mainKey) store = mainStore;
+	else if (mainStore && requestedStore) store = mergeAuthProfileStores(cloneAuthProfileStore(mainStore), cloneAuthProfileStore(requestedStore));
+	else store = requestedStore ?? mainStore;
+	return store ? readCodexOwnedAuthStore(agentDir, cloneAuthProfileStore(store)) : null;
 }
 function replaceRuntimeAuthProfileStoreSnapshots(entries) {
 	runtimeAuthStoreSnapshots.clear();
-	for (const entry of entries) runtimeAuthStoreSnapshots.set(resolveRuntimeStoreKey(entry.agentDir), cloneAuthProfileStore(entry.store));
+	for (const entry of entries) runtimeAuthStoreSnapshots.set(resolveRuntimeStoreKey(entry.agentDir), readCodexOwnedAuthStore(entry.agentDir, cloneAuthProfileStore(entry.store)));
 }
 function clearRuntimeAuthProfileStoreSnapshots() {
 	runtimeAuthStoreSnapshots.clear();
 }
 async function updateAuthProfileStoreWithLock(params) {
-	const authPath = resolveAuthStorePath(params.agentDir);
-	ensureAuthStoreFile(authPath);
-	try {
-		return await withFileLock(authPath, AUTH_STORE_LOCK_OPTIONS, async () => {
-			const store = ensureAuthProfileStore(params.agentDir);
-			if (params.updater(store)) saveAuthProfileStore(store, params.agentDir);
-			return store;
-		});
-	} catch {
-		return null;
-	}
+	return await updateAuthStoreMetadata({
+		...codexOwnershipContext(params.agentDir),
+		update: (metadata) => {
+			const effective = readCodexOwnedAuthStore(params.agentDir);
+			const profiles = Object.freeze(Object.fromEntries(Object.entries(effective.profiles).map(([id, credential]) => [id, Object.freeze({ ...credential })])));
+			const view = { ...metadata };
+			Object.defineProperty(view, "profiles", {
+				enumerable: true,
+				get: () => profiles,
+				set: () => { throw new Error("Credential mutations require upsertAuthProfileWithLock"); }
+			});
+			if (params.updater(view)) for (const key of ["usageStats", "lastGood", "order"]) metadata[key] = view[key];
+		}
+	});
 }
 /**
 * Normalise a raw auth-profiles.json credential entry.
@@ -4439,68 +4452,18 @@ function loadCoercedStore(authPath) {
 	return coerceAuthStore(loadJsonFile(authPath));
 }
 function loadAuthProfileStore() {
-	const authPath = resolveAuthStorePath();
-	const asStore = loadCoercedStore(authPath);
-	if (asStore) {
-		if (syncExternalCliCredentials(asStore)) saveJsonFile(authPath, asStore);
-		return asStore;
-	}
-	const legacy = coerceLegacyStore(loadJsonFile(resolveLegacyAuthStorePath()));
-	if (legacy) {
-		const store = {
-			version: 1,
-			profiles: {}
-		};
-		applyLegacyStore(store, legacy);
-		syncExternalCliCredentials(store);
-		return store;
-	}
-	const store = {
-		version: 1,
-		profiles: {}
-	};
-	syncExternalCliCredentials(store);
-	return store;
+	return loadAuthProfileStoreForAgent();
 }
 function loadAuthProfileStoreForAgent(agentDir, options) {
-	const readOnly = options?.readOnly === true;
-	const authPath = resolveAuthStorePath(agentDir);
-	const asStore = loadCoercedStore(authPath);
-	if (asStore) {
-		if (syncExternalCliCredentials(asStore) && !readOnly) saveJsonFile(authPath, asStore);
-		return asStore;
-	}
-	if (agentDir && !readOnly) {
-		const mainStore = coerceAuthStore(loadJsonFile(resolveAuthStorePath()));
-		if (mainStore && Object.keys(mainStore.profiles).length > 0) {
-			saveJsonFile(authPath, mainStore);
-			log$8.info("inherited auth-profiles from main agent", { agentDir });
-			return mainStore;
-		}
+	// Loading never copies rotating credentials, migrates files, or imports external CLI state.
+	let store = loadCoercedStore(resolveAuthStorePath(agentDir));
+	if (!store) {
+		store = { version: 1, profiles: {} };
+		const legacy = coerceLegacyStore(loadJsonFile(resolveLegacyAuthStorePath(agentDir)));
+		if (legacy) applyLegacyStore(store, legacy);
+		mergeOAuthFileIntoStore(store);
 	}
-	const legacy = coerceLegacyStore(loadJsonFile(resolveLegacyAuthStorePath(agentDir)));
-	const store = {
-		version: 1,
-		profiles: {}
-	};
-	if (legacy) applyLegacyStore(store, legacy);
-	const mergedOAuth = mergeOAuthFileIntoStore(store);
-	const syncedCli = syncExternalCliCredentials(store);
-	const forceReadOnly = process.env.JOHNNESS_AUTH_STORE_READONLY === "1";
-	const shouldWrite = !readOnly && !forceReadOnly && (legacy !== null || mergedOAuth || syncedCli);
-	if (shouldWrite) saveJsonFile(authPath, store);
-	if (shouldWrite && legacy !== null) {
-		const legacyPath = resolveLegacyAuthStorePath(agentDir);
-		try {
-			fs.unlinkSync(legacyPath);
-		} catch (err) {
-			if (err?.code !== "ENOENT") log$8.warn("failed to delete legacy auth.json after migration", {
-				err,
-				legacyPath
-			});
-		}
-	}
-	return store;
+	return readCodexOwnedAuthStore(agentDir, store);
 }
 function loadAuthProfileStoreForRuntime(agentDir, options) {
 	const store = loadAuthProfileStoreForAgent(agentDir, options);
@@ -4519,13 +4482,12 @@ function ensureAuthProfileStore(agentDir, options) {
 	const runtimeStore = resolveRuntimeAuthProfileStore(agentDir);
 	if (runtimeStore) return runtimeStore;
 	const store = loadAuthProfileStoreForAgent(agentDir, options);
-	const authPath = resolveAuthStorePath(agentDir);
 	const mainAuthPath = resolveAuthStorePath();
-	if (!agentDir || authPath === mainAuthPath) return store;
-	return mergeAuthProfileStores(loadAuthProfileStoreForAgent(void 0, options), store);
+	const effective = !agentDir || resolveAuthStorePath(agentDir) === mainAuthPath ? store : mergeAuthProfileStores(loadAuthProfileStoreForAgent(void 0, options), store);
+	return readCodexOwnedAuthStore(agentDir, effective);
 }
-function saveAuthProfileStore(store, agentDir) {
-	saveJsonFile(resolveAuthStorePath(agentDir), {
+async function saveAuthProfileStore(store, agentDir) {
+	await saveAuthStoreSnapshot({ ...codexOwnershipContext(agentDir), store: {
 		version: 1,
 		profiles: Object.fromEntries(Object.entries(store.profiles).map(([profileId, credential]) => {
 			if (credential.type === "api_key" && credential.keyRef && credential.key !== void 0) {
@@ -4543,7 +4505,7 @@ function saveAuthProfileStore(store, agentDir) {
 		order: store.order ?? void 0,
 		lastGood: store.lastGood ?? void 0,
 		usageStats: store.usageStats ?? void 0
-	});
+	} });
 }
 //#endregion
 //#region src/agents/auth-profiles/profiles.ts
@@ -4568,7 +4530,7 @@ async function setAuthProfileOrder(params) {
 		}
 	});
 }
-function upsertAuthProfile(params) {
+async function upsertAuthProfile(params) {
 	const credential = params.credential.type === "api_key" ? {
 		...params.credential,
 		...typeof params.credential.key === "string" ? { key: normalizeSecretInput(params.credential.key) } : {}
@@ -4576,18 +4538,11 @@ function upsertAuthProfile(params) {
 		...params.credential,
 		token: normalizeSecretInput(params.credential.token)
 	} : params.credential;
-	const store = ensureAuthProfileStore(params.agentDir);
-	store.profiles[params.profileId] = credential;
-	saveAuthProfileStore(store, params.agentDir);
+	await mutateAuthProfile({ ...codexOwnershipContext(params.agentDir), profileId: params.profileId, credential: sanitizeAuthProfileCredential(credential) });
 }
 async function upsertAuthProfileWithLock(params) {
-	return await updateAuthProfileStoreWithLock({
-		agentDir: params.agentDir,
-		updater: (store) => {
-			store.profiles[params.profileId] = params.credential;
-			return true;
-		}
-	});
+	await mutateAuthProfile({ ...codexOwnershipContext(params.agentDir), profileId: params.profileId, credential: sanitizeAuthProfileCredential(params.credential) });
+	return readCodexOwnedAuthStore(params.agentDir);
 }
 function listProfilesForProvider(store, provider) {
 	const providerKey = normalizeProviderIdForAuth(provider);
@@ -4607,17 +4562,7 @@ async function markAuthProfileGood(params) {
 			return true;
 		}
 	});
-	if (updated) {
-		store.lastGood = updated.lastGood;
-		return;
-	}
-	const profile = store.profiles[profileId];
-	if (!profile || profile.provider !== provider) return;
-	store.lastGood = {
-		...store.lastGood,
-		[provider]: profileId
-	};
-	saveAuthProfileStore(store, agentDir);
+	if (updated) store.lastGood = updated.lastGood;
 }
 //#endregion
 //#region src/agents/auth-profiles/repair.ts
@@ -4939,7 +4884,7 @@ function resolveAgentMaxConcurrent(cfg) {
 function resolveSubagentMaxConcurrent(cfg) {
 	const raw = cfg?.agents?.defaults?.subagents?.maxConcurrent;
 	if (typeof raw === "number" && Number.isFinite(raw)) return Math.max(1, Math.floor(raw));
-	return 12;
+	return 100;
 }
 //#endregion
 //#region src/config/talk.ts
@@ -5357,7 +5302,7 @@ function applyAgentDefaults(cfg) {
 	}
 	const nextSubagents = defaults?.subagents ? { ...defaults.subagents } : {};
 	if (!hasSubMax) {
-		nextSubagents.maxConcurrent = 12;
+		nextSubagents.maxConcurrent = 100;
 		mutated = true;
 	}
 	if (!mutated) return cfg;
@@ -11026,7 +10971,7 @@ const AgentDefaultsSchema = z.object({
 	subagents: z.object({
 		maxConcurrent: z.number().int().positive().optional(),
 		maxSpawnDepth: z.number().int().min(1).max(5).optional().describe("Maximum nesting depth for sub-agent spawning. 1 = no nesting (default), 2 = sub-agents can spawn sub-sub-agents."),
-		maxChildrenPerAgent: z.number().int().min(1).max(20).optional().describe("Maximum number of active children a single agent session can spawn (default: 12)."),
+		maxChildrenPerAgent: z.number().int().min(1).max(100).optional().describe("Maximum number of active children a single agent session can spawn (default: 100)."),
 		archiveAfterMinutes: z.number().int().positive().optional(),
 		model: AgentModelSchema.optional(),
 		thinking: z.string().optional(),
@@ -16298,19 +16243,15 @@ function buildOAuthProfileResult(params) {
 function extractErrorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
-function shouldUseOpenaiCodexRefreshFallback(params) {
-	if (normalizeProviderId(params.provider) !== "openai-codex") return false;
-	const message = extractErrorMessage(params.error);
-	if (!/extract\s+accountid\s+from\s+token/i.test(message)) return false;
-	return typeof params.credentials.access === "string" && params.credentials.access.trim().length > 0;
-}
-function adoptNewerMainOAuthCredential(params) {
+
+async function adoptNewerMainOAuthCredential(params) {
+	if (params.cred.provider === "openai-codex") return readCodexOwnedAuthStore(params.agentDir, params.store).profiles[params.profileId] ?? null;
 	if (!params.agentDir) return null;
 	try {
 		const mainCred = ensureAuthProfileStore(void 0).profiles[params.profileId];
 		if (mainCred?.type === "oauth" && mainCred.provider === params.cred.provider && Number.isFinite(mainCred.expires) && (!Number.isFinite(params.cred.expires) || mainCred.expires > params.cred.expires)) {
 			params.store.profiles[params.profileId] = { ...mainCred };
-			saveAuthProfileStore(params.store, params.agentDir);
+			await saveAuthProfileStore(params.store, params.agentDir);
 			log$8.info("adopted newer OAuth credentials from main agent", {
 				profileId: params.profileId,
 				agentDir: params.agentDir,
@@ -16327,11 +16268,22 @@ function adoptNewerMainOAuthCredential(params) {
 	return null;
 }
 async function refreshOAuthTokenWithLock(params) {
+	const store = readCodexOwnedAuthStore(params.agentDir, params.store);
+	const cred = store.profiles[params.profileId];
+	if (cred?.provider === "openai-codex" || params.store?.profiles[params.profileId]?.provider === "openai-codex") return await refreshManagedCodexProfile({
+		...codexOwnershipContext(params.agentDir),
+		profileId: params.profileId,
+		store: params.store
+	});
+	return await refreshUnmanagedOAuthTokenWithLock(params);
+}
+async function refreshUnmanagedOAuthTokenWithLock(params) {
 	const authPath = resolveAuthStorePath(params.agentDir);
-	ensureAuthStoreFile(authPath);
+	fs.mkdirSync(path.dirname(authPath), { recursive: true, mode: 448 });
 	return await withFileLock(authPath, AUTH_STORE_LOCK_OPTIONS, async () => {
 		const store = ensureAuthProfileStore(params.agentDir);
 		const cred = store.profiles[params.profileId];
+		if (cred?.provider === "openai-codex") throw new Error("Auth profile changed to Codex; resolve again through its owner");
 		if (!cred || cred.type !== "oauth") return null;
 		if (Date.now() < cred.expires) return {
 			apiKey: buildOAuthApiKey(cred.provider, cred),
@@ -16361,13 +16313,15 @@ async function refreshOAuthTokenWithLock(params) {
 			...result.newCredentials,
 			type: "oauth"
 		};
-		saveAuthProfileStore(store, params.agentDir);
+		await saveAuthProfileStore(store, params.agentDir);
 		return result;
 	});
 }
 async function tryResolveOAuthProfile(params) {
 	const { cfg, store, profileId } = params;
-	const cred = store.profiles[profileId];
+	const effective = readCodexOwnedAuthStore(params.agentDir, store);
+	store.profiles = effective.profiles;
+	const cred = effective.profiles[profileId];
 	if (!cred || cred.type !== "oauth") return null;
 	if (!isProfileConfigCompatible({
 		cfg,
@@ -16375,6 +16329,11 @@ async function tryResolveOAuthProfile(params) {
 		provider: cred.provider,
 		mode: cred.type
 	})) return null;
+	if (cred.type === "oauth" && cred.provider === "openai-codex") {
+		const result = await refreshManagedCodexProfile({ ...codexOwnershipContext(params.agentDir), profileId, store });
+		if (!result) return null;
+		return buildApiKeyProfileResult({ apiKey: result.apiKey, provider: "openai-codex", email: result.newCredentials?.email ?? cred.email });
+	}
 	if (Date.now() < cred.expires) return buildOAuthProfileResult({
 		provider: cred.provider,
 		credentials: cred,
@@ -16427,7 +16386,9 @@ async function resolveProfileSecretString(params) {
 }
 async function resolveApiKeyForProfile(params) {
 	const { cfg, store, profileId } = params;
-	const cred = store.profiles[profileId];
+	const effective = readCodexOwnedAuthStore(params.agentDir, store);
+	store.profiles = effective.profiles;
+	const cred = effective.profiles[profileId];
 	if (!cred) return null;
 	if (!isProfileConfigCompatible({
 		cfg,
@@ -16436,6 +16397,11 @@ async function resolveApiKeyForProfile(params) {
 		mode: cred.type,
 		allowOAuthTokenCompatibility: true
 	})) return null;
+	if (cred.type === "oauth" && cred.provider === "openai-codex") {
+		const result = await refreshManagedCodexProfile({ ...codexOwnershipContext(params.agentDir), profileId, store });
+		if (!result) return null;
+		return buildApiKeyProfileResult({ apiKey: result.apiKey, provider: "openai-codex", email: result.newCredentials?.email ?? cred.email });
+	}
 	const refResolveCache = {};
 	const configForRefResolution = cfg ?? loadConfig();
 	const refDefaults = configForRefResolution.secrets?.defaults;
@@ -16479,7 +16445,7 @@ async function resolveApiKeyForProfile(params) {
 			email: cred.email
 		});
 	}
-	const oauthCred = adoptNewerMainOAuthCredential({
+	const oauthCred = await adoptNewerMainOAuthCredential({
 		store,
 		profileId,
 		agentDir: params.agentDir,
@@ -16504,6 +16470,7 @@ async function resolveApiKeyForProfile(params) {
 	} catch (error) {
 		const refreshedStore = ensureAuthProfileStore(params.agentDir);
 		const refreshed = refreshedStore.profiles[profileId];
+		if (refreshed?.type === "oauth" && refreshed.provider === "openai-codex") return await resolveApiKeyForProfile({ ...params, store: refreshedStore });
 		if (refreshed?.type === "oauth" && Date.now() < refreshed.expires) return buildOAuthProfileResult({
 			provider: refreshed.provider,
 			credentials: refreshed,
@@ -16526,9 +16493,9 @@ async function resolveApiKeyForProfile(params) {
 		} catch {}
 		if (params.agentDir) try {
 			const mainCred = ensureAuthProfileStore(void 0).profiles[profileId];
-			if (mainCred?.type === "oauth" && Date.now() < mainCred.expires) {
+			if (mainCred?.type === "oauth" && mainCred.provider === cred.provider && Date.now() < mainCred.expires) {
 				refreshedStore.profiles[profileId] = { ...mainCred };
-				saveAuthProfileStore(refreshedStore, params.agentDir);
+				await saveAuthProfileStore(refreshedStore, params.agentDir);
 				log$8.info("inherited fresh OAuth credentials from main agent", {
 					profileId,
 					agentDir: params.agentDir,
@@ -16541,21 +16508,6 @@ async function resolveApiKeyForProfile(params) {
 				});
 			}
 		} catch {}
-		if (shouldUseOpenaiCodexRefreshFallback({
-			provider: cred.provider,
-			credentials: cred,
-			error
-		})) {
-			log$8.warn("openai-codex oauth refresh failed; using cached access token fallback", {
-				profileId,
-				provider: cred.provider
-			});
-			return buildApiKeyProfileResult({
-				apiKey: cred.access,
-				provider: cred.provider,
-				email: cred.email
-			});
-		}
 		const message = extractErrorMessage(error);
 		const hint = formatAuthDoctorHint({
 			cfg,
@@ -16728,13 +16680,7 @@ async function markAuthProfileUsed(params) {
 			return true;
 		}
 	});
-	if (updated) {
-		store.usageStats = updated.usageStats;
-		return;
-	}
-	if (!store.profiles[profileId]) return;
-	updateUsageStatsEntry(store, profileId, (existing) => resetUsageStats(existing, { lastUsed: Date.now() }));
-	saveAuthProfileStore(store, agentDir);
+	if (updated) store.usageStats = updated.usageStats;
 }
 function calculateAuthProfileCooldownMs(errorCount) {
 	const normalized = Math.max(1, errorCount);
@@ -16855,23 +16801,7 @@ async function markAuthProfileFailure(params) {
 			return true;
 		}
 	});
-	if (updated) {
-		store.usageStats = updated.usageStats;
-		return;
-	}
-	if (!store.profiles[profileId]) return;
-	const now = Date.now();
-	const cfgResolved = resolveAuthCooldownConfig({
-		cfg,
-		providerId: normalizeProviderId(store.profiles[profileId]?.provider ?? "")
-	});
-	updateUsageStatsEntry(store, profileId, (existing) => computeNextProfileUsageStats({
-		existing: existing ?? {},
-		now,
-		reason,
-		cfgResolved
-	}));
-	saveAuthProfileStore(store, agentDir);
+	if (updated) store.usageStats = updated.usageStats;
 }
 //#endregion
 //#region src/agents/auth-profiles/order.ts