fix: prepare writable codex home for runner jobs

src/selftest/cases/20-runner-k8s-job.ts

@@ -5,7 +5,7 @@ import { startManagerServer } from "../../mgr/server.js";
 import { MemoryAgentRunStore } from "../../mgr/store.js";
 import { ManagerClient } from "../../mgr/client.js";
 import { renderRunnerJobDryRun } from "../../runner/k8s-job.js";
-import type { RunRecord } from "../../common/types.js";
+import type { JsonRecord, RunRecord } from "../../common/types.js";
 import { assertNoSecretLeak, createRunWithCommand, type SelfTestCase } from "../harness.js";
 
 const selfTest: SelfTestCase = async (context) => {
@@ -24,6 +24,7 @@ const selfTest: SelfTestCase = async (context) => {
     assert.equal(rendered.dryRun, true);
     assert.equal(rendered.mutation, false);
     assert.equal((rendered.jobIdentity as { serviceAccountName?: string }).serviceAccountName, "agentrun-v01-runner");
+    assertRunnerJobUsesWritableCodexHome(rendered.manifest as JsonRecord, context.codexHome);
     assertNoSecretLeak(rendered);
 
     const fakeKubectl = path.join(context.tmp, "fake-kubectl.js");
@@ -66,3 +67,24 @@ console.log(JSON.stringify({ apiVersion: manifest.apiVersion, kind: manifest.kin
 };
 
 export default selfTest;
+
+function assertRunnerJobUsesWritableCodexHome(manifest: JsonRecord, expectedCodexHome: string): void {
+  const spec = manifest.spec as JsonRecord;
+  const template = spec.template as JsonRecord;
+  const podSpec = template.spec as JsonRecord;
+  const volumes = podSpec.volumes as JsonRecord[];
+  assert.ok(volumes.some((volume) => volume.name === "runner-home" && typeof volume.emptyDir === "object"), "runner home must be writable emptyDir");
+
+  const containers = podSpec.containers as JsonRecord[];
+  const runner = containers[0] as JsonRecord;
+  const mounts = runner.volumeMounts as JsonRecord[];
+  assert.ok(mounts.some((mount) => mount.name === "runner-home" && mount.mountPath === "/home/agentrun"), "runner-home must mount at /home/agentrun");
+  assert.ok(mounts.some((mount) => mount.name === "codex-0" && mount.mountPath === "/var/run/agentrun/secrets/codex-0" && mount.readOnly === true), "Codex Secret must mount read-only outside CODEX_HOME");
+
+  const env = runner.env as JsonRecord[];
+  const value = (name: string): unknown => env.find((item) => item.name === name)?.value;
+  assert.equal(value("HOME"), "/home/agentrun");
+  assert.equal(value("CODEX_HOME"), expectedCodexHome);
+  assert.equal(value("AGENTRUN_CODEX_SECRET_HOME"), "/var/run/agentrun/secrets/codex-0");
+  assert.notEqual(value("CODEX_HOME"), value("AGENTRUN_CODEX_SECRET_HOME"));
+}

src/selftest/cases/30-codex-stdio.ts

@@ -1,4 +1,5 @@
 import assert from "node:assert/strict";
+import { access } from "node:fs/promises";
 import path from "node:path";
 import os from "node:os";
 import { startManagerServer } from "../../mgr/server.js";
@@ -25,12 +26,19 @@ const selfTest: SelfTestCase = async (context) => {
     const finalCommand = await client.get(`/api/v1/runs/${happy.runId}/commands/${happy.commandId}`) as { state?: string };
     assert.equal(finalCommand.state, "completed");
 
+    const projectedHome = path.join(context.tmp, "runtime-codex-home");
+    const projected = await createRunWithCommand(client, { workspace: context.workspace, codexHome: projectedHome }, "hello projected", "selftest-projected-codex-home", 15_000);
+    const projectedResult = await runOnce({ managerUrl: server.baseUrl, runId: projected.runId, codexCommand: context.fakeCodexCommand, codexArgs: context.fakeCodexArgs, codexHome: projectedHome, env: { CODEX_HOME: projectedHome, AGENTRUN_CODEX_SECRET_HOME: context.codexHome } });
+    assert.equal(projectedResult.terminalStatus, "completed");
+    await access(path.join(projectedHome, "auth.json"));
+    await access(path.join(projectedHome, "config.toml"));
+
     await runFailureCase({ client, managerUrl: server.baseUrl, context, mode: "missing-turn-result", expectedStatus: "failed", expectedFailureKind: "backend-response-invalid" });
     await runFailureCase({ client, managerUrl: server.baseUrl, context, mode: "invalid-json", expectedStatus: "failed", expectedFailureKind: "backend-json-parse-error" });
     await runFailureCase({ client, managerUrl: server.baseUrl, context, mode: "missing-terminal", expectedStatus: "failed", expectedFailureKind: "backend-timeout", timeoutMs: 500 });
     await runSpawnFailureCase({ client, managerUrl: server.baseUrl, context });
 
-    return { name: "codex-stdio", tests: ["runner-lease-heartbeat", "codex-stdio-fake-turn", "codex-stdio-missing-turn-result", "codex-stdio-invalid-json", "codex-stdio-timeout", "codex-stdio-spawn-failure"] };
+    return { name: "codex-stdio", tests: ["runner-lease-heartbeat", "codex-stdio-fake-turn", "codex-stdio-projected-writable-home", "codex-stdio-missing-turn-result", "codex-stdio-invalid-json", "codex-stdio-timeout", "codex-stdio-spawn-failure"] };
   } finally {
     await new Promise<void>((resolve) => server.server.close(() => resolve()));
   }