From ac4b9b60ad421dba393669cd1141a2c4c742cf44 Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Sun, 28 Jun 2026 03:05:59 +0000
Subject: [PATCH] fix: project code agent stdio supervisor

---
 config/hwlab-node-lanes.yaml        | 1 +
 scripts/src/hwlab-node-lanes.ts     | 2 ++
 scripts/src/hwlab-node/plan.ts      | 1 +
 scripts/src/hwlab-node/render.ts    | 2 ++
 scripts/src/hwlab-node/web-probe.ts | 2 ++
 5 files changed, 8 insertions(+)

diff --git a/config/hwlab-node-lanes.yaml b/config/hwlab-node-lanes.yaml
index 4fb100a2..0deca1c8 100644
--- a/config/hwlab-node-lanes.yaml
+++ b/config/hwlab-node-lanes.yaml
@@ -703,6 +703,7 @@ lanes:
           repoUrlFrom: runtimeGitReadUrl
           providerIdFrom: runtimeNodeId
           defaultProviderProfile: fake-echo
+          codexStdioSupervisor: repo-owned
         publicExposure:
           mode: pk01-caddy-frp
           publicBaseUrl: https://hwlab.pikapython.com
diff --git a/scripts/src/hwlab-node-lanes.ts b/scripts/src/hwlab-node-lanes.ts
index 089f3def..0bf3e144 100644
--- a/scripts/src/hwlab-node-lanes.ts
+++ b/scripts/src/hwlab-node-lanes.ts
@@ -324,6 +324,7 @@ export interface HwlabRuntimeCodeAgentRuntimeSpec {
   readonly repoUrlFrom: "runtimeGitReadUrl";
   readonly providerIdFrom: "runtimeNodeId";
   readonly defaultProviderProfile: string;
+  readonly codexStdioSupervisor: "repo-owned";
 }
 
 export interface HwlabRuntimeSourceWorkspaceSpec {
@@ -784,6 +785,7 @@ function codeAgentRuntimeConfig(value: unknown, path: string): HwlabRuntimeCodeA
     repoUrlFrom: enumStringField(raw, "repoUrlFrom", path, ["runtimeGitReadUrl"]),
     providerIdFrom: enumStringField(raw, "providerIdFrom", path, ["runtimeNodeId"]),
     defaultProviderProfile: stringField(raw, "defaultProviderProfile", path),
+    codexStdioSupervisor: enumStringField(raw, "codexStdioSupervisor", path, ["repo-owned"]),
   };
 }
 
diff --git a/scripts/src/hwlab-node/plan.ts b/scripts/src/hwlab-node/plan.ts
index 44d02c47..b777c147 100644
--- a/scripts/src/hwlab-node/plan.ts
+++ b/scripts/src/hwlab-node/plan.ts
@@ -157,6 +157,7 @@ export function nodeRuntimeExpected(spec: HwlabRuntimeLaneSpec): Record<string,
       providerIdFrom: spec.codeAgentRuntime.providerIdFrom,
       providerId: spec.nodeId,
       defaultProviderProfile: spec.codeAgentRuntime.defaultProviderProfile,
+      codexStdioSupervisor: spec.codeAgentRuntime.codexStdioSupervisor,
       valuesPrinted: false,
     },
     sourceWorkspace: spec.sourceWorkspace === undefined ? null : {
diff --git a/scripts/src/hwlab-node/render.ts b/scripts/src/hwlab-node/render.ts
index daada86e..bd4e2b47 100644
--- a/scripts/src/hwlab-node/render.ts
+++ b/scripts/src/hwlab-node/render.ts
@@ -1569,6 +1569,7 @@ export function nodeRuntimePipelinePostprocessScript(): string[] {
     "        codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_CODE_AGENT_AGENTRUN_REPO_URL', String(codeAgentRuntime.repoUrl)) || codeAgentRuntimeChanged;",
     "        codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID', String(codeAgentRuntime.providerId)) || codeAgentRuntimeChanged;",
     "        codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE', String(codeAgentRuntime.defaultProviderProfile)) || codeAgentRuntimeChanged;",
+    "        codeAgentRuntimeChanged = setEnvValue(container, 'HWLAB_CODE_AGENT_CODEX_STDIO_SUPERVISOR', String(codeAgentRuntime.codexStdioSupervisor)) || codeAgentRuntimeChanged;",
     "      }",
     "    }",
     "  }",
@@ -1893,6 +1894,7 @@ export function nodeRuntimePipelinePostprocessScript(): string[] {
     "            checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_CODE_AGENT_AGENTRUN_REPO_URL', String(codeAgentRuntime.repoUrl));",
     "            checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID', String(codeAgentRuntime.providerId));",
     "            checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE', String(codeAgentRuntime.defaultProviderProfile));",
+    "            checkCodeAgentRuntimeValue(item, file, container, 'HWLAB_CODE_AGENT_CODEX_STDIO_SUPERVISOR', String(codeAgentRuntime.codexStdioSupervisor));",
     "          }",
     "        }",
     "        if (Array.isArray(podSpec.volumes) && podSpec.volumes.some((volume) => volume && volume.name === 'hwlab-metrics-sidecar')) metricsRefs.push(workloadRef(item, file, { name: 'volume/hwlab-metrics-sidecar' }));",
diff --git a/scripts/src/hwlab-node/web-probe.ts b/scripts/src/hwlab-node/web-probe.ts
index 9f29397d..2455994f 100644
--- a/scripts/src/hwlab-node/web-probe.ts
+++ b/scripts/src/hwlab-node/web-probe.ts
@@ -107,6 +107,7 @@ export function nodeRuntimeRenderOverlay(spec: HwlabRuntimeLaneSpec): Record<str
       providerIdFrom: spec.codeAgentRuntime.providerIdFrom,
       providerId: spec.nodeId,
       defaultProviderProfile: spec.codeAgentRuntime.defaultProviderProfile,
+      codexStdioSupervisor: spec.codeAgentRuntime.codexStdioSupervisor,
       valuesPrinted: false,
     },
     runtimeImageRewrites: spec.runtimeImageRewrites,
@@ -1439,6 +1440,7 @@ function nodeRuntimeCodeAgentCloudApiEnvStatus(spec: HwlabRuntimeLaneSpec, runti
   expectValue("HWLAB_CODE_AGENT_AGENTRUN_REPO_URL", spec.gitReadUrl);
   expectValue("HWLAB_CODE_AGENT_AGENTRUN_PROVIDER_ID", spec.nodeId);
   expectValue("HWLAB_CODE_AGENT_DEFAULT_PROVIDER_PROFILE", runtime.defaultProviderProfile);
+  expectValue("HWLAB_CODE_AGENT_CODEX_STDIO_SUPERVISOR", runtime.codexStdioSupervisor);
   return {
     ready: mismatches.length === 0,
     deploymentExists: true,