coder-eval 0.8.6__tar.gz → 0.8.7rc11__tar.gz

{coder_eval-0.8.6 → coder_eval-0.8.7rc11}/.github/workflows/release.yml

@@ -13,6 +13,13 @@ name: Release
 # and push.
 # (Continuous :latest / :sha- agent images still publish on every main push via
 # docker-publish.yml -- only the versioned release artifacts gate on this run.)
+#
+# PRERELEASE mode (dispatched from a NON-main branch): instead of bumping and
+# pushing main, stamp a throwaway `<next-patch>rc<run#>` version, then build and
+# publish the wheel to public PyPI + a `:<version>` GHCR image. It does NOT move
+# `:latest`, tag, commit, or push to main. This lets a branch be dry-run on the
+# ADO nightly infra before merge (pinned via the pipeline's `coderEvalVersion`).
+# The `bump` input is ignored off main. On `main` the behavior is unchanged.
 
 on:
   workflow_dispatch:
@@ -47,9 +54,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     outputs:
-      # Exposed so the downstream publish-pypi job can gate on a real release
-      # having been cut (empty => no version bumped => skip PyPI publish).
-      version: ${{ steps.release.outputs.version }}
+      # Exposed so the downstream publish-pypi job gates on a version having been
+      # produced (real release on main, or a stamped prerelease on a branch).
+      version: ${{ steps.ver.outputs.version }}
     env:
       # The self-hosted `uipath-ubuntu-latest` runners enforce a minimum
       # package-age safe-chain check on uv installs; on GitHub-hosted runners
@@ -58,8 +65,13 @@ jobs:
       SAFE_CHAIN_MINIMUM_PACKAGE_AGE_EXCLUSIONS: "openai-codex-cli-bin,openai-codex"
 
     steps:
+      # Only a real release (main) needs the app token: semantic-release pushes the
+      # bump commit + tag to the ruleset-protected main branch, and only this app
+      # has the bypass. A prerelease from a branch never commits or pushes, so it
+      # skips the token and checks out with the default GITHUB_TOKEN.
       - name: Mint release app token
         id: app-token
+        if: github.ref == 'refs/heads/main'
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
         with:
           app-id: ${{ secrets.RELEASE_APP_ID }}
@@ -70,8 +82,9 @@ jobs:
         with:
           fetch-depth: 0  # semantic-release needs full history for tags + changelog
           # Persisted in .git config so semantic-release's push to main is
-          # authenticated as the app (which bypasses the branch ruleset).
-          token: ${{ steps.app-token.outputs.token }}
+          # authenticated as the app (which bypasses the branch ruleset). Falls back
+          # to the default token for a prerelease (no push, read-only checkout).
+          token: ${{ steps.app-token.outputs.token || github.token }}
 
       - name: Set up Python 3.13
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
@@ -83,11 +96,38 @@ jobs:
         with:
           enable-cache: true
 
+      # Release mode is chosen by the dispatched ref: main => real release (the
+      # semantic-release path below); any other branch => prerelease (stamp a
+      # throwaway rc version, publish, never touch main). Keying off the ref (not a
+      # new input) keeps this dispatchable from a branch — a new input would have to
+      # exist on the default branch first to be accepted.
+      - name: Determine release mode
+        id: mode
+        env:
+          REF: ${{ github.ref }}
+          RUN_NUMBER: ${{ github.run_number }}
+        run: |
+          set -euo pipefail
+          if [ "$REF" = "refs/heads/main" ]; then
+            echo "prerelease=false" >> "$GITHUB_OUTPUT"
+            echo "Mode: RELEASE (main)"
+          else
+            # Next patch of the current version, suffixed with the run number so
+            # repeated dispatches never collide on PyPI. An exact `==` pin installs
+            # it even though pip/uv skip prereleases by default.
+            NEXT=$(python3 -c 'import re,tomllib; v=tomllib.load(open("pyproject.toml","rb"))["project"]["version"]; m=re.match(r"(\d+)\.(\d+)\.(\d+)",v); print("{}.{}.{}".format(int(m[1]),int(m[2]),int(m[3])+1))')
+            PRE="${NEXT}rc${RUN_NUMBER}"
+            echo "prerelease=true" >> "$GITHUB_OUTPUT"
+            echo "version=${PRE}" >> "$GITHUB_OUTPUT"
+            echo "Mode: PRERELEASE ${PRE}"
+          fi
+
       - name: Install build + release tools
         run: uv tool install python-semantic-release && uv tool install twine
 
       - name: Run semantic-release (bump + tag, no push yet)
         id: release
+        if: steps.mode.outputs.prerelease != 'true'
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           # Passed via env (not interpolated into the script) per GitHub's
@@ -105,8 +145,45 @@ jobs:
           # A dispatch always cuts a release; report the just-published version.
           echo "version=$($PSR version --print)" >> "$GITHUB_OUTPUT"
 
+      # PRERELEASE: stamp the rc version into the two canonical spots (mirrors
+      # publish-testpypi.yml), then refresh uv.lock so the Dockerfile's
+      # `uv export --frozen` accepts the bumped project version. No commit is made —
+      # the working tree is what `uv build` and the image build below consume.
+      - name: Stamp prerelease version
+        if: steps.mode.outputs.prerelease == 'true'
+        env:
+          PRE_VERSION: ${{ steps.mode.outputs.version }}
+        run: |
+          set -euo pipefail
+          python3 - <<'PY'
+          import os, re, pathlib
+          version = os.environ["PRE_VERSION"]
+          for path, key in (("pyproject.toml", "version"), ("src/coder_eval/__init__.py", "__version__")):
+              p = pathlib.Path(path)
+              new, n = re.subn(rf'(?m)^{key}\s*=\s*".+?"$', f'{key} = "{version}"', p.read_text(), count=1)
+              if n != 1:
+                  raise SystemExit(f"version pattern did not match {path} (matched {n})")
+              p.write_text(new)
+          print(f"Stamped prerelease version: {version}")
+          PY
+          uv lock
+
+      # Single source of truth for the steps below: the real release version (main)
+      # or the stamped prerelease version (branch).
+      - name: Resolve published version
+        id: ver
+        env:
+          REL: ${{ steps.release.outputs.version }}
+          PRE: ${{ steps.mode.outputs.version }}
+        run: |
+          set -euo pipefail
+          V="${REL:-$PRE}"
+          if [ -z "$V" ]; then echo "no version resolved" >&2; exit 1; fi
+          echo "version=$V" >> "$GITHUB_OUTPUT"
+          echo "Publishing version: $V"
+
       - name: Regenerate uv.lock and amend release commit
-        if: steps.release.outputs.version != ''
+        if: steps.mode.outputs.prerelease != 'true' && steps.release.outputs.version != ''
         run: |
           uv lock
           if ! git diff --quiet uv.lock; then
@@ -119,43 +196,64 @@ jobs:
           fi
 
       - name: Push release commit and tags
-        if: steps.release.outputs.version != ''
+        if: steps.mode.outputs.prerelease != 'true' && steps.release.outputs.version != ''
         run: git push origin main "v${{ steps.release.outputs.version }}"
 
       - name: Build wheel + sdist
-        if: steps.release.outputs.version != ''
+        if: steps.ver.outputs.version != ''
         run: uv build
 
       # Hand the exact built artifacts to the publish-pypi job. Publishing to
       # public PyPI runs in its own environment-gated job (OIDC), so it must
       # consume these files rather than rebuild them.
       - name: Upload dist for PyPI publish
-        if: steps.release.outputs.version != ''
+        if: steps.ver.outputs.version != ''
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         with:
           name: release-dist
           path: dist/
           if-no-files-found: error
 
-      # Build + push the agent image HERE, in the same job that cut the release,
-      # so the `:<version>` tag is built from the BUMPED pyproject (the version
-      # only exists after the semantic-release step above). docker-publish.yml
-      # runs on the triggering commit, BEFORE the bump, so it can never tag the
-      # release version -- this is the authoritative versioned image. It also
-      # repoints `:latest` to the exact release artifact.
+      # Build + push the agent image HERE, in the same job that produced the
+      # version, so the `:<version>` tag is built from the correct pyproject (bumped
+      # by semantic-release on main, or the stamped rc on a prerelease).
+      # docker-publish.yml runs on the triggering commit, BEFORE a main bump, so it
+      # can never tag the release version -- this is the authoritative versioned
+      # image. A real release also repoints `:latest`; a prerelease publishes only
+      # its `:<version>` tag (see Compute image tags).
       - name: Lowercase owner for GHCR
-        if: steps.release.outputs.version != ''
+        if: steps.ver.outputs.version != ''
         id: img
         run: echo "owner_lc=$(echo '${{ github.repository_owner }}' | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_OUTPUT"
 
+      # `:<version>` always; `:latest` only for a real release. A prerelease must
+      # not move `:latest`, which the nightly treats as tip-of-main.
+      - name: Compute image tags
+        if: steps.ver.outputs.version != ''
+        id: tags
+        env:
+          OWNER: ${{ steps.img.outputs.owner_lc }}
+          VERSION: ${{ steps.ver.outputs.version }}
+          IS_PRERELEASE: ${{ steps.mode.outputs.prerelease }}
+        run: |
+          set -euo pipefail
+          {
+            echo "tags<<EOF"
+            echo "ghcr.io/${OWNER}/coder-eval-agent:${VERSION}"
+            if [ "$IS_PRERELEASE" != "true" ]; then
+              echo "ghcr.io/${OWNER}/coder-eval-agent:latest"
+            fi
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
+
       - name: Set up Docker Buildx
         continue-on-error: true  # GHCR image is internal/best-effort; don't block PyPI
-        if: steps.release.outputs.version != ''
+        if: steps.ver.outputs.version != ''
         uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f  # v3.12.0
 
       - name: Log in to GHCR
         continue-on-error: true  # GHCR image is internal/best-effort; don't block PyPI
-        if: steps.release.outputs.version != ''
+        if: steps.ver.outputs.version != ''
         uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3.7.0
         with:
           registry: ghcr.io
@@ -164,17 +262,15 @@ jobs:
 
       - name: Build and push versioned agent image
         continue-on-error: true  # GHCR image is internal/best-effort; don't block PyPI
-        if: steps.release.outputs.version != ''
+        if: steps.ver.outputs.version != ''
         uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6.19.2
         with:
           context: .
           file: docker/Dockerfile
           push: true
-          tags: |
-            ghcr.io/${{ steps.img.outputs.owner_lc }}/coder-eval-agent:${{ steps.release.outputs.version }}
-            ghcr.io/${{ steps.img.outputs.owner_lc }}/coder-eval-agent:latest
+          tags: ${{ steps.tags.outputs.tags }}
           build-args: |
-            CODER_EVAL_VERSION=${{ steps.release.outputs.version }}
+            CODER_EVAL_VERSION=${{ steps.ver.outputs.version }}
           secrets: |
             "uv_index_username=${{ secrets.UV_INDEX_UIPATH_USERNAME }}"
             "uv_index_password=${{ secrets.UV_INDEX_UIPATH_PASSWORD }}"

{coder_eval-0.8.6 → coder_eval-0.8.7rc11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coder-eval
-Version: 0.8.6
+Version: 0.8.7rc11
 Summary: Evaluate, benchmark, and A/B-test AI coding agents (Claude Code, Codex, Gemini/Antigravity) with sandboxed, reproducible YAML task suites.
 Project-URL: Homepage, https://github.com/UiPath/coder_eval
 Project-URL: Repository, https://github.com/UiPath/coder_eval
@@ -26,7 +26,7 @@ Requires-Python: >=3.13
 Requires-Dist: anthropic>=0.86.0
 Requires-Dist: anyio>=4.13.0
 Requires-Dist: azure-monitor-opentelemetry-exporter<1.1.0,>=1.0.0b30
-Requires-Dist: claude-agent-sdk>=0.2.82
+Requires-Dist: claude-agent-sdk>=0.2.124
 Requires-Dist: click>=8.3.3
 Requires-Dist: jmespath>=1.1.0
 Requires-Dist: jsonschema>=4.26.0
@@ -41,9 +41,9 @@ Requires-Dist: starlette>=1.3.1
 Requires-Dist: tqdm>=4.67.3
 Requires-Dist: typer>=0.24.1
 Provides-Extra: antigravity
-Requires-Dist: google-antigravity==0.1.5; extra == 'antigravity'
+Requires-Dist: google-antigravity==0.1.7; extra == 'antigravity'
 Provides-Extra: codex
-Requires-Dist: openai-codex>=0.1.0b3; extra == 'codex'
+Requires-Dist: openai-codex>=0.144.4; extra == 'codex'
 Provides-Extra: dev
 Requires-Dist: bandit[toml]>=1.9.4; extra == 'dev'
 Requires-Dist: mcp>=1.28.1; extra == 'dev'

{coder_eval-0.8.6 → coder_eval-0.8.7rc11}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "coder-eval"
-version = "0.8.6"
+version = "0.8.7rc11"
 description = "Evaluate, benchmark, and A/B-test AI coding agents (Claude Code, Codex, Gemini/Antigravity) with sandboxed, reproducible YAML task suites."
 readme = "README.md"
 license = "Apache-2.0"
@@ -34,7 +34,7 @@ dependencies = [
     "rich>=14.3.3",
     "python-dotenv>=1.2.2",
     "anthropic>=0.86.0",
-    "claude-agent-sdk>=0.2.82",
+    "claude-agent-sdk>=0.2.124",
     "anyio>=4.13.0",
     "radon>=6.0.1",
     "tqdm>=4.67.3",
@@ -85,19 +85,24 @@ uipath = [
 # Without this extra, the framework still installs and runs; Codex-dependent
 # code paths fail at dispatch with a clear hint pointing back here.
 codex = [
-    "openai-codex>=0.1.0b3",
+    "openai-codex>=0.144.4",
 ]
 # Optional extra that enables Antigravity agent support:
 #   - AntigravityAgent implementation using Google's official google-antigravity SDK
 #     (drives the bundled `localharness` binary, authenticated via GEMINI_API_KEY).
 # Pinned exactly: the harness binary is a dominant non-model driver of eval results,
 # so it travels with the coder_eval release tag and is bumped deliberately (mirrors
-# the claude-code CLI / codex cli-bin pins). The wheel ships platform-specific
-# (manylinux x86_64 + aarch64, macOS, Windows), so CI/Linux/Docker installs work.
+# the claude-code CLI / codex cli-bin pins).
+# glibc note — verify before bumping: the wheel's manylinux_2_17 tag is NOT a
+# reliable floor; the bundled `localharness` ELF can require a newer glibc than the
+# tag advertises. Eval agents run on Ubuntu 22.04 (glibc 2.35), so the pinned build
+# must load there. 0.1.7 links without DT_RELR (max required symbol GLIBC_2.26) and
+# loads on 2.35+; confirm any future pin does too (readelf -d | grep RELR must be
+# empty / max GLIBC symbol <= the oldest target's glibc).
 # Without this extra the framework still installs and runs; Antigravity-dependent
 # code paths fail at start() with a clear hint pointing back here.
 antigravity = [
-    "google-antigravity==0.1.5",
+    "google-antigravity==0.1.7",
 ]
 
 [project.scripts]
@@ -129,12 +134,14 @@ packages = ["src/coder_eval"]
 allow-direct-references = true
 
 [tool.uv]
-# openai-codex 0.1.0b3 hardpins `openai-codex-cli-bin==0.137.0a4`, a
-# PRE-RELEASE. Because that pin is transitive (not referenced directly by us),
-# uv won't select it without an explicit opt-in. Naming it here as an override
-# both enables the pre-release and documents the pinned cli-bin build; 0.137.0a4
-# publishes manylinux wheels (x86_64 + aarch64), so CI/Linux installs work.
-override-dependencies = ["openai-codex-cli-bin==0.137.0a4"]
+# openai-codex 0.144.4 hardpins `openai-codex-cli-bin==0.144.4` (a stable
+# release; the SDK version now tracks the codex CLI version line). Naming it
+# here documents and holds the pinned cli-bin build — the harness binary is a
+# dominant non-model driver of eval results, so it travels with the coder_eval
+# release tag and is bumped deliberately (mirrors the antigravity localharness
+# and claude-code CLI pins). 0.144.4 publishes manylinux wheels (x86_64 +
+# aarch64), so CI/Linux installs work.
+override-dependencies = ["openai-codex-cli-bin==0.144.4"]
 
 constraint-dependencies = [
     # Fix known CVEs in transitive dependencies

{coder_eval-0.8.6 → coder_eval-0.8.7rc11}/src/coder_eval/__init__.py

@@ -1,3 +1,3 @@
 """coder_eval - A framework for evaluating AI coding agents."""
 
-__version__ = "0.8.6"
+__version__ = "0.8.7rc11"

{coder_eval-0.8.6 → coder_eval-0.8.7rc11}/src/coder_eval/agents/codex_agent.py

@@ -5,7 +5,9 @@ import contextlib
 import json
 import logging
 import os
+import shlex
 import shutil
+import tempfile
 import time
 from collections.abc import Callable
 from datetime import datetime
@@ -65,14 +67,6 @@ _CLAUDE_TO_CODEX_TOOL_MAP: dict[str, str] = {
     "Glob": "shell",
 }
 
-# Permission mode → sandbox mode mapping
-_PERMISSION_MODE_TO_SANDBOX: dict[str, str] = {
-    "bypassPermissions": "full-access",
-    "acceptEdits": "workspace-write",
-    "default": "workspace-write",
-    "plan": "read-only",
-}
-
 # Approval mode — the SAME for every permission mode (no per-mode mapping).
 #
 # The Codex SDK exposes exactly two approval modes:
@@ -88,9 +82,9 @@ _PERMISSION_MODE_TO_SANDBOX: dict[str, str] = {
 #     escalations BEYOND the sandbox are refused.
 #
 # An eval harness never wants a reviewer that can flake, so EVERY permission mode
-# uses deny_all. The trust boundary is the sandbox (_PERMISSION_MODE_TO_SANDBOX),
-# which DOES vary by mode: `plan` stays read-only, `bypassPermissions` is
-# full-access (intended for isolated Docker runs).
+# uses deny_all. The trust boundary is coder_eval's per-run sandbox — a docker
+# container or an ephemeral tempdir — NOT Codex's in-process OS sandbox, which
+# _build_thread_options always drops to full-access (rationale there).
 _CODEX_APPROVAL_MODE = "deny_all"
 
 # Provider id registered in thread config when CODEX_BASE_URL routes to a
@@ -215,6 +209,17 @@ def _message_uncached_input(m: AssistantMessage) -> int:
 # supported"), so this is a fixed constant, not an operator knob.
 _CODEX_WIRE_API = "responses"
 
+# Login-shell profile files generated into the per-task HOME (see
+# _setup_login_shell_home). ``.bash_profile`` is what ``bash -l`` reads;
+# ``.profile`` covers ``sh``/``dash`` login shells. The zsh trio covers macOS,
+# where zsh is the default shell: ``.zshenv`` runs in EVERY zsh, ``.zprofile``
+# in login shells (AFTER /etc/zprofile, whose path_helper resets PATH), and
+# ``.zshrc`` in interactive shells - including codex's shell snapshot, which
+# sources it explicitly. zsh selects its dotfiles via $ZDOTDIR (fallback
+# $HOME), so _build_codex_env points ZDOTDIR at the generated home.
+_LOGIN_PROFILE_NAMES = (".bash_profile", ".profile", ".zshenv", ".zprofile", ".zshrc")
+_ZSH_PROFILE_NAMES = frozenset({".zshenv", ".zprofile", ".zshrc"})
+
 
 def _get_item_root(notification: Any) -> Any:
     """Extract the typed item root from a Codex SDK notification.
@@ -649,6 +654,7 @@ class CodexAgent(Agent[CodexAgentConfig]):
         self.thread: Any = None
         self.working_directory: Path | None = None
         self._env_path_prepend: list[str] = []
+        self._login_shell_home: Path | None = None
         # _state / _iteration / _iteration_was_incremented / pending_turn lifecycle
         # bookkeeping lives on the Agent base class (shared defaults + helpers).
         self._log = PrefixedAdapter(logger, {"prefix": instance_name})
@@ -677,6 +683,7 @@ class CodexAgent(Agent[CodexAgentConfig]):
         """
         self.working_directory = Path(working_directory)
         self._env_path_prepend = list(env_path_prepend or [])
+        self._setup_login_shell_home()
         self._state = AgentState.WORKING
 
         try:
@@ -872,6 +879,7 @@ class CodexAgent(Agent[CodexAgentConfig]):
         self._close_client()
         self.thread = None
         self._active_turn_handle = None
+        self._cleanup_login_shell_home()
         self._mark_stopped()
 
     async def kill(self) -> None:
@@ -887,6 +895,7 @@ class CodexAgent(Agent[CodexAgentConfig]):
         """
         self._interrupt_active_turn()
         self._close_client()
+        self._cleanup_login_shell_home()
 
     def _interrupt_active_turn(self) -> None:
         """Interrupt the in-flight Codex turn, if any (best-effort, idempotent)."""
@@ -1071,8 +1080,159 @@ class CodexAgent(Agent[CodexAgentConfig]):
             path_key = next((k for k in os.environ if k.upper() == "PATH"), "PATH")
             env[path_key] = os.pathsep.join([*self._env_path_prepend, os.environ.get(path_key, "")])
             self._log.debug(f"PATH prepend: {os.pathsep.join(self._env_path_prepend)}")
+        if self._login_shell_home is not None:
+            # Point login shells at the generated profile dir (see
+            # _setup_login_shell_home) while pinning codex state (auth, rollout
+            # sessions) to its real location — _codex_home() reads the same
+            # resolution for sub-agent rollout recovery, so both sides agree.
+            # HOME steers bash/sh; ZDOTDIR steers zsh (the macOS default
+            # shell), which ignores HOME for dotfile selection when it is set.
+            env["HOME"] = str(self._login_shell_home)
+            env["ZDOTDIR"] = str(self._login_shell_home)
+            env["CODEX_HOME"] = str(self._codex_home())
         return env if env else None
 
+    @staticmethod
+    def _login_shell_profiles_supported() -> bool:
+        """Whether to generate login-shell profile shims (POSIX shells only)."""
+        return os.name == "posix"
+
+    def _setup_login_shell_home(self) -> None:
+        """Create a per-task HOME whose profiles restore the mock PATH prepend.
+
+        Codex issues every shell command through the user's default shell as a
+        login shell: ``bash -lc`` on Linux, ``zsh -lc`` on macOS (its default
+        shell; fish would need the same treatment here if codex ever picks
+        it). A login shell re-sources the system profile chain -
+        ``/etc/profile`` on Linux, ``/etc/zprofile``'s path_helper on macOS -
+        which unconditionally RESETS PATH, silently dropping the mock-CLI
+        prepend passed via the app-server environment, so bare commands
+        resolve to the REAL CLIs (real-tenant contamination). The per-user
+        dotfiles are sourced AFTER that chain, so a generated per-task HOME
+        (wired up in ``_build_codex_env``; codex state stays in CODEX_HOME)
+        gets the last word and re-prepends the mock dirs:
+        ``.bash_profile``/``.profile`` for bash/sh (selected via env HOME) and
+        ``.zshenv``/``.zprofile``/``.zshrc`` for zsh (selected via env
+        ZDOTDIR; ``.zshrc`` also feeds codex's shell snapshot, which sources
+        it explicitly). Per-task rather than the user's real dotfiles so
+        parallel tasks with different mocks cannot collide. No-op without mock
+        dirs or on non-POSIX hosts: Windows codex shells through PowerShell
+        (``-NoProfile``) or ``cmd /c``, neither of which re-sources a profile
+        chain that resets PATH, so the plain env prepend survives there as-is.
+
+        Bash uses the env HOME only to PICK the profile file; the generated
+        profile's first act is to export the ORIGINAL home back, so the
+        sourced user profile and the command body see the real ``$HOME``
+        (git config, tool caches, ``$HOME``-relative sourcing keep working).
+        Known residual gap: a NESTED bash/sh login shell inside a command
+        re-reads the real profiles and loses the prepend again (nested zsh
+        keeps it - ZDOTDIR stays exported).
+        """
+        self._cleanup_login_shell_home()
+        if not (self._env_path_prepend and self._login_shell_profiles_supported()):
+            return
+        original_home = os.environ.get("HOME", "")
+        # Where the user's REAL zsh dotfiles live: their own ZDOTDIR when set,
+        # else their home (zsh's fallback).
+        original_zdotdir = os.environ.get("ZDOTDIR", "") or original_home
+        # The profile only ever executes under a POSIX shell, so the PATH
+        # separator is ':' regardless of the host building it.
+        quoted_prepend = shlex.quote(":".join(self._env_path_prepend))
+        export_line = f'export PATH={quoted_prepend}:"$PATH"'
+        # Track the dir BEFORE writing so a failed write can't orphan it —
+        # the except below (and any later cleanup) always sees it.
+        home = Path(tempfile.mkdtemp(prefix="coder-eval-codex-home-"))
+        self._login_shell_home = home
+        try:
+            for name in _LOGIN_PROFILE_NAMES:
+                content = self._login_profile_content(
+                    name,
+                    original_home,
+                    export_line,
+                    original_zdotdir=original_zdotdir,
+                    generated_home=str(home),
+                )
+                # newline="\n": the profile must stay LF-only no matter which host
+                # builds it, or bash sees literal \r at end of line.
+                (home / name).write_text(content, encoding="utf-8", newline="\n")
+        except Exception:
+            self._cleanup_login_shell_home()
+            raise
+        self._log.debug(f"Login-shell mock-PATH home: {home}")
+
+    @staticmethod
+    def _login_profile_content(
+        profile_name: str,
+        original_home: str,
+        export_line: str,
+        *,
+        original_zdotdir: str = "",
+        generated_home: str = "",
+    ) -> str:
+        """One generated profile file: restore the ORIGINAL ``$HOME``, source
+        the user's own counterpart file (so image/user setup isn't lost), then
+        re-prepend the mock dirs.
+
+        The env HOME pointing at the generated dir exists ONLY so bash selects
+        this file; exporting the original home back on the first line keeps
+        every ``$HOME`` consumer (git, npm, the sourced profile's own
+        ``$HOME/.bashrc`` references) on the real home.
+
+        ``.bash_profile`` mimics bash's first-found chain over the original
+        home; the ``.profile`` twin (read by ``sh``/``dash`` login shells)
+        sources only ``.profile`` — the bash-specific files may contain
+        bashisms a POSIX shell would choke on.
+
+        The zsh files each source their exact counterpart from the user's real
+        zsh dotfile dir (``original_zdotdir``) - zsh reads ALL of its startup
+        files, not a first-found chain. ``.zshenv`` additionally re-pins
+        ZDOTDIR to the generated home AFTER sourcing: the user's ``.zshenv``
+        may redefine ZDOTDIR, which would steer the rest of the startup chain
+        away from the generated ``.zprofile``/``.zshrc``. Each zsh file
+        re-prepends because /etc/zprofile resets PATH BETWEEN ``.zshenv`` and
+        ``.zprofile``, and a sourced user file may reset it again; a duplicate
+        PATH entry is harmless, a lost prepend is contamination.
+        """
+        lines = [
+            "# Generated by coder_eval (CodexAgent): the system profile chain resets",
+            "# PATH in login shells, dropping the mock-CLI prepend - this restores it.",
+        ]
+        if original_home:
+            orig = shlex.quote(original_home)
+            lines.append(f"export HOME={orig}")
+        if profile_name in _ZSH_PROFILE_NAMES:
+            if original_zdotdir:
+                origz = shlex.quote(original_zdotdir)
+                lines += [
+                    f"if [ -r {origz}/{profile_name} ]; then . {origz}/{profile_name}",
+                    "fi",
+                ]
+            if profile_name == ".zshenv" and generated_home:
+                lines.append(f"export ZDOTDIR={shlex.quote(generated_home)}")
+        elif original_home:
+            orig = shlex.quote(original_home)
+            if profile_name == ".bash_profile":
+                lines += [
+                    f"if [ -r {orig}/.bash_profile ]; then . {orig}/.bash_profile",
+                    f"elif [ -r {orig}/.bash_login ]; then . {orig}/.bash_login",
+                    f"elif [ -r {orig}/.profile ]; then . {orig}/.profile",
+                    "fi",
+                ]
+            else:
+                lines += [
+                    f"if [ -r {orig}/.profile ]; then . {orig}/.profile",
+                    "fi",
+                ]
+        lines.append(export_line)
+        return "\n".join(lines) + "\n"
+
+    def _cleanup_login_shell_home(self) -> None:
+        """Remove the generated per-task HOME (best-effort, idempotent)."""
+        home, self._login_shell_home = self._login_shell_home, None
+        if home is None:
+            return
+        shutil.rmtree(home, ignore_errors=True)
+
     def _build_thread_options(self) -> dict[str, Any]:
         """Build thread_start options from agent config.
 
@@ -1090,25 +1250,22 @@ class CodexAgent(Agent[CodexAgentConfig]):
             options["model"] = effective_model
             self._log.debug(f"Codex model pinned to {effective_model}")
 
-        # Map permission_mode to sandbox and approval_mode
         permission_mode = self.config.permission_mode.value
-        sandbox_mode_str = _PERMISSION_MODE_TO_SANDBOX.get(permission_mode, "workspace-write")
         approval_mode_str = _CODEX_APPROVAL_MODE
 
-        # Codex's read-only / workspace-write sandboxes are enforced by a Landlock
-        # helper that can't initialize inside the eval's docker container — its
-        # writes/execs then fail silently and the agent produces no artifacts
-        # (FAILURE with score 0, no loud error). When the harness already provides
-        # container isolation (docker driver, signalled by CODER_EVAL_IN_CONTAINER),
-        # the in-process sandbox is both redundant and broken, so fall back to
-        # full-access: the container IS the trust boundary. No-op on the host
-        # (tempdir/host runs), where Landlock works and the marker is unset.
-        if sandbox_mode_str != "full-access" and os.getenv("CODER_EVAL_IN_CONTAINER"):
-            self._log.warning(
-                f"Codex sandbox '{sandbox_mode_str}' can't initialize inside the eval container "
-                + "(Landlock unavailable); using 'full-access' — the container provides isolation."
-            )
-            sandbox_mode_str = "full-access"
+        # Codex always runs full-access. coder_eval owns this run's isolation
+        # boundary either way — a docker container (docker driver) or an ephemeral
+        # per-task tempdir it creates and discards (tempdir driver); those are the
+        # only two drivers — so Codex's own in-process OS sandbox (Landlock/seatbelt)
+        # is always redundant. Worse, it actively breaks on the paths we rely on:
+        # inside the container Landlock is unavailable, on constrained CI agents the
+        # bwrap re-exec is denied ("bwrap: execvp .../codex: Permission denied"), and
+        # on Windows there is no OS sandbox at all — in each case a read-only /
+        # workspace-write run fails its writes/execs silently and scores 0 with no
+        # loud error. Dropping to full-access matches Claude Code and Antigravity,
+        # which run with no in-agent OS sandbox; hard isolation of untrusted actions
+        # is the docker driver's job, and approval_mode stays deny_all regardless.
+        sandbox_mode_str = "full-access"
 
         # Convert to Codex SDK enum values
         # Sandbox enum values use hyphens, ApprovalMode uses underscores