fix: leave workspace trust to provider commands

agent-session-id: 591448c4-5967-4b12-ae43-1c6320dc1d25
agent-tool: Codex CLI
agent-tool-version: 0.145.0
agent-model: unknown
agent-runtime-profile: /nix/store/v2g542rika3abxn98x5yimz431j5br13-coding-agent-runtime-profile/share/coding-agents/profile.json
agent-skills-manifest: /nix/store/3aq75z8arl44fsvn49i2k4yqlzb1kcwb-agent-skills-corpus/share/agent-skills/manifest.json
tooling-profile: dotfiles@unknown-dirty

Author: schickling-assistant

docs/vrs/spec.md

@@ -44,7 +44,12 @@ validate ──► materialize ──► host-local st2 scheduler/reconciler
   never wake reconciliation; only create, modify, rename, or remove events may
   wake it before the bounded timer.
 - **R06:** st2 passes the complete effective task definition to the underlying
-  launcher so manual and supervised restarts are equivalent.
+  launcher so manual and supervised restarts are equivalent. Harness readiness
+  that depends on a dynamically selected account belongs to that declared
+  command. In particular, reconciliation never mutates an ambient Codex config
+  before launch: the command may select an account-specific `CODEX_HOME` only
+  after st2 starts it. `st2 pretrust` remains an explicit operator utility for
+  commands that intentionally use the ambient Claude and Codex configs.
 - **R07:** Hook bundles are explicit, content-addressed, installed separately,
   and verified before materialization references them. Their receipts use the
   same resolved build identity as the binary's version surfaces for both

src/main.rs

@@ -169,10 +169,9 @@ enum Command {
         #[arg(conflicts_with = "catalog_path")]
         root: Option<PathBuf>,
     },
-    /// Pre-trust agent workspaces in the claude config (`$CLAUDE_CONFIG_DIR/.claude.json` else
-    /// `~/.claude.json`) BEFORE they boot, so a kick-driven `claude` never hangs on the "Is this a
-    /// project you trust?" dialog. One atomic batch write for all dirs closes the multi-spawn trust
-    /// race; merges into existing entries (never clobbers). Run it before `st2 up`.
+    /// Explicitly pre-trust workspaces in the ambient Claude and Codex configs. This is an operator
+    /// utility for harnesses that use those ambient configs; `st2 up` never calls it automatically.
+    /// Account-selecting commands should instead declare trust in the selected harness invocation.
     Pretrust {
         /// Workspace directories to mark trusted.
         #[arg(required = true)]
@@ -934,7 +933,7 @@ fn env_cmd(root: &Path) -> Result<()> {
 fn pretrust_cmd(dirs: &[PathBuf]) -> Result<()> {
     let n = st2::pretrust::pretrust(dirs)?;
     println!(
-        "pre-trusted {n} workspace{} in the claude config",
+        "pre-trusted {n} workspace{} in the ambient Claude and Codex configs",
         if n == 1 { "" } else { "s" }
     );
     Ok(())

src/pretrust.rs

@@ -41,9 +41,9 @@ pub fn pretrust(dirs: &[PathBuf]) -> Result<usize> {
     Ok(n)
 }
 
-/// Pre-trust workspaces for Codex only. Reconciliation uses this immediately before launching a
-/// missing Codex agent task, so a synced declaration cannot park on the interactive workspace-trust
-/// prompt. Keeping this Codex-specific avoids touching Claude configuration during a Codex rollout.
+/// Pre-trust workspaces for Codex only in the caller's ambient config. This remains available to
+/// explicit tooling, but reconciliation does not call it: a provider command may select an
+/// account-specific `CODEX_HOME` only after st2 launches it.
 pub fn pretrust_codex(dirs: &[PathBuf]) -> Result<usize> {
     pretrust_codex_at(&codex_config_path()?, dirs)
 }

src/run.rs

@@ -804,52 +804,38 @@ fn reconcile_pass(
     debounce.observe(&sessions, now);
     let mut plan = crate::reconcile(&eligible_specs, &sessions, this_host);
     report.deferred = debounce.defer_flickers(&mut plan, now);
-    gate_codex_launches(
-        root,
-        &mut plan,
-        &mut report,
-        || match &hook_error {
-            Some(error) => anyhow::bail!("{error}"),
-            None => Ok(()),
-        },
-        crate::pretrust::pretrust_codex,
-    );
+    gate_codex_launches_on_hooks(&mut plan, &mut report, || match &hook_error {
+        Some(error) => anyhow::bail!("{error}"),
+        None => Ok(()),
+    });
     execute(&plan, runner, cap, &mut report);
     report
 }
 
-/// A missing Codex agent must be trusted before its pty exists. Codex's bypass flags do not bypass
-/// the workspace-trust prompt; without this gate a remotely synced declaration appears launched but
-/// is really parked waiting for a human keystroke. Batch every workspace into one atomic config
-/// update, and fail closed: if trust cannot be established, suppress the affected agent launches
-/// (including their sidecars) and surface the error. Already-live/adopted agents never enter this
-/// path.
-fn gate_codex_launches<'a, V, F>(
-    catalog_root: &Path,
+/// A missing Codex agent must not launch against stale lifecycle hooks. Suppress the affected agent
+/// launches (including their sidecars) and surface the error when hook verification fails.
+///
+/// Workspace trust belongs to the declared provider command and its selected account-specific
+/// runtime. Reconciliation deliberately does not mutate an ambient Codex config: an account selector
+/// may choose `CODEX_HOME` only after this process launches the command, so such a write would target
+/// the wrong state and could not satisfy the launched seat's trust gate.
+fn gate_codex_launches_on_hooks<'a, V>(
     plan: &mut ReconcilePlan<'a>,
     report: &mut UpReport,
     verify_hooks: V,
-    pretrust: F,
 ) where
     V: FnOnce() -> anyhow::Result<()>,
-    F: FnOnce(&[PathBuf]) -> anyhow::Result<usize>,
 {
-    let mut workspaces = Vec::new();
     let mut gated_agents = Vec::new();
     for launch in &plan.launch {
-        let Some(agent) = launch.tasks.iter().find(|target| {
+        let Some(_) = launch.tasks.iter().find(|target| {
             target.name == "agent" && crate::hooks::command_invokes_codex(&target.command)
         }) else {
             continue;
         };
-        let spec_dir = launch.spec.path.parent().unwrap_or_else(|| Path::new("."));
-        let workspace = resolve_task_cwd(agent, spec_dir, catalog_root);
-        if !workspaces.contains(&workspace) {
-            workspaces.push(workspace);
-        }
         gated_agents.push(launch.spec.identity.clone());
     }
-    if workspaces.is_empty() {
+    if gated_agents.is_empty() {
         return;
     }
 
@@ -860,16 +846,6 @@ fn gate_codex_launches<'a, V, F>(
             "verify lifecycle hooks for new Codex agent(s) {}: {error}; launch suppressed",
             gated_agents.join(", ")
         ));
-        return;
-    }
-
-    if let Err(error) = pretrust(&workspaces) {
-        plan.launch
-            .retain(|launch| !gated_agents.contains(&launch.spec.identity));
-        report.errors.push(format!(
-            "pretrust Codex workspace(s) for {}: {error}; launch suppressed",
-            gated_agents.join(", ")
-        ));
     }
 }
 
@@ -1421,7 +1397,7 @@ mod tests {
     }
 
     #[test]
-    fn codex_pretrust_batches_every_new_workspace_once() {
+    fn codex_hook_gate_accepts_new_agents_without_mutating_the_launch_plan() {
         let mut left = spec_fixture();
         left.identity = "left".into();
         left.path = PathBuf::from("/catalog/node/left/agent.kdl");
@@ -1441,96 +1417,29 @@ mod tests {
             spec: &right,
             tasks: vec![right_agent],
         });
-        let captured = RefCell::new(Vec::new());
-
-        gate_codex_launches(
-            Path::new("/catalog"),
-            &mut plan,
-            &mut UpReport::default(),
-            || Ok(()),
-            |workspaces| {
-                captured.borrow_mut().extend_from_slice(workspaces);
-                Ok(workspaces.len())
-            },
-        );
-
-        assert_eq!(
-            captured.into_inner(),
-            [PathBuf::from("/workspaces/shared")],
-            "all affected workspaces are passed in one deduplicated batch"
-        );
-        assert_eq!(plan.launch.len(), 2);
-    }
-
-    #[test]
-    fn codex_pretrust_failure_suppresses_every_affected_agent_and_sidecar() {
-        let mut left = spec_fixture();
-        left.identity = "left".into();
-        left.path = PathBuf::from("/catalog/node/left/agent.kdl");
-        let mut right = spec_fixture();
-        right.identity = "right".into();
-        right.path = PathBuf::from("/catalog/node/right/agent.kdl");
-        let mut other = spec_fixture();
-        other.identity = "other".into();
-        other.path = PathBuf::from("/catalog/node/other/agent.kdl");
-
-        let mut left_agent = target("node.left.agent", "exec codex");
-        left_agent.workspace = Some("/workspaces/left".into());
-        let mut left_ding = target("node.left.ding", "st2 ding");
-        left_ding.name = "ding".into();
-        let mut right_agent = target("node.right.agent", "/opt/bin/codex --model gpt-5");
-        right_agent.workspace = Some("/workspaces/right".into());
-        let mut right_ding = target("node.right.ding", "st2 ding");
-        right_ding.name = "ding".into();
-        let non_codex = target("node.other.agent", "exec claude");
-        let mut plan = ReconcilePlan::default();
-        plan.launch.push(Launch {
-            spec: &left,
-            tasks: vec![left_agent, left_ding],
-        });
-        plan.launch.push(Launch {
-            spec: &right,
-            tasks: vec![right_agent, right_ding],
-        });
-        plan.launch.push(Launch {
-            spec: &other,
-            tasks: vec![non_codex],
-        });
+        let expected = plan
+            .launch
+            .iter()
+            .map(|launch| launch.spec.identity.clone())
+            .collect::<Vec<_>>();
         let mut report = UpReport::default();
 
-        gate_codex_launches(
-            Path::new("/catalog"),
-            &mut plan,
-            &mut report,
-            || Ok(()),
-            |workspaces| {
-                assert_eq!(
-                    workspaces,
-                    [
-                        PathBuf::from("/workspaces/left"),
-                        PathBuf::from("/workspaces/right")
-                    ]
-                );
-                anyhow::bail!("read-only Codex config")
-            },
-        );
+        gate_codex_launches_on_hooks(&mut plan, &mut report, || Ok(()));
 
         assert_eq!(
             plan.launch
                 .iter()
-                .map(|launch| launch.spec.identity.as_str())
+                .map(|launch| launch.spec.identity.clone())
                 .collect::<Vec<_>>(),
-            ["other"],
-            "both Codex agents and all their sidecars fail closed"
+            expected,
+            "successful hook verification must leave the launch plan unchanged"
         );
-        assert_eq!(plan.launch[0].tasks[0].pty_id, "node.other.agent");
-        assert_eq!(report.errors.len(), 1);
-        assert!(report.errors[0].contains("left, right"));
-        assert!(report.errors[0].contains("launch suppressed"));
+        assert_eq!(plan.launch.len(), 2);
+        assert!(report.errors.is_empty());
     }
 
     #[test]
-    fn codex_pretrust_does_not_touch_adopted_agents_or_sidecar_only_repairs() {
+    fn codex_hook_gate_does_not_touch_adopted_agents_or_sidecar_only_repairs() {
         let mut spec = spec_fixture();
         spec.identity = "root".into();
         let mut ding = target("node.root.ding", "st2 ding");
@@ -1543,12 +1452,10 @@ mod tests {
         });
         let mut report = UpReport::default();
 
-        gate_codex_launches(
-            Path::new("/catalog"),
+        gate_codex_launches_on_hooks(
             &mut plan,
             &mut report,
             || panic!("an already-live Codex agent must not enter the hook gate"),
-            |_| panic!("an already-live Codex agent must not enter the pretrust gate"),
         );
 
         assert_eq!(plan.adopt, [&spec]);
@@ -1579,13 +1486,9 @@ mod tests {
         });
         let mut report = UpReport::default();
 
-        gate_codex_launches(
-            Path::new("/catalog"),
-            &mut plan,
-            &mut report,
-            || anyhow::bail!("stale receipt"),
-            |_| panic!("pretrust must not run after hook verification fails"),
-        );
+        gate_codex_launches_on_hooks(&mut plan, &mut report, || {
+            anyhow::bail!("stale receipt")
+        });
 
         assert_eq!(
             plan.launch

tests/hooks.rs

@@ -417,6 +417,77 @@ fn up_once_suppresses_a_new_codex_agent_without_mutating_hooks() {
     );
 }
 
+#[test]
+fn up_once_never_mutates_the_ambient_codex_config_before_account_selection() {
+    let tmp = tempfile::tempdir().unwrap();
+    let catalog = tmp.path().join("catalog");
+    let workspace = tmp.path().join("workspace");
+    let hooks_root = tmp.path().join("hooks");
+    let ambient_codex_home = tmp.path().join("ambient-codex-home");
+    let selected_codex_home = tmp.path().join("selected-codex-home");
+    let bin = tmp.path().join("bin");
+    let pty_log = tmp.path().join("pty.log");
+    let declaration = catalog.join("agents/h/worker/agent.kdl");
+    fs::create_dir_all(declaration.parent().unwrap()).unwrap();
+    fs::create_dir_all(&workspace).unwrap();
+    fs::create_dir_all(&bin).unwrap();
+    fs::write(
+        &declaration,
+        format!(
+            "agent \"worker\" {{\n  host \"h\"\n  workspace \"{}\"\n  \
+             env {{ ST_AGENT \"h.worker\" CODEX_HOME \"{}\" }}\n  \
+             command \"exec codex -c \
+             'projects={{\\\"{}\\\"={{trust_level=\\\"trusted\\\"}}}}'\"\n}}\n",
+            workspace.display(),
+            selected_codex_home.display(),
+            workspace.display()
+        ),
+    )
+    .unwrap();
+    write_executable(
+        &bin.join("pty"),
+        &format!(
+            "#!/bin/sh\nprintf '%s\\n' \"$*\" >> '{}'\nif [ \"$1\" = list ]; then printf '[]\\n'; fi\n",
+            pty_log.display()
+        ),
+    );
+    assert!(
+        command(&hooks_root)
+            .args(["hooks", "install"])
+            .status()
+            .unwrap()
+            .success()
+    );
+
+    let output = command(&hooks_root)
+        .arg("up")
+        .arg(&catalog)
+        .args(["--host", "h", "--once"])
+        .env("PATH", &bin)
+        .env("CODEX_HOME", &ambient_codex_home)
+        .output()
+        .unwrap();
+    let report = format!(
+        "{}{}",
+        String::from_utf8_lossy(&output.stdout),
+        String::from_utf8_lossy(&output.stderr)
+    );
+
+    assert!(output.status.success(), "{report}");
+    assert!(report.contains("launched (1): h.worker"), "{report}");
+    assert!(
+        fs::read_to_string(&pty_log)
+            .unwrap_or_default()
+            .lines()
+            .any(|line| line.starts_with("run ")),
+        "the declared account-selecting Codex command must launch"
+    );
+    assert!(
+        !ambient_codex_home.exists(),
+        "st2 up must not create or mutate an ambient Codex config before the command selects its account"
+    );
+}
+
 #[test]
 fn missing_hooks_do_not_rewrite_or_stop_an_already_live_codex_agent() {
     let tmp = tempfile::tempdir().unwrap();