fix: inject role prompts into AGENTS.md for codex container reviewer

prepareContainerSessionEnvironment now writes AGENTS.md (with platform
+ paired-room prompts) to a session-local .codex/ dir alongside auth
credentials from host. CODEX_HOME points to this dir so codex-runner
gets role-appropriate prompts instead of empty instructions.

src/agent-runner-environment.ts

@@ -26,7 +26,10 @@ import {
   readPairedRoomPrompt,
   readPlatformPrompt,
 } from './platform-prompts.js';
-import { getEffectiveChannelLease, hasReviewerLease } from './service-routing.js';
+import {
+  getEffectiveChannelLease,
+  hasReviewerLease,
+} from './service-routing.js';
 import type { AgentType, RegisteredGroup } from './types.js';
 
 // writeCodexApiKeyAuth removed — Codex uses OAuth only.
@@ -329,10 +332,7 @@ EJCLAW_GROUP_FOLDER = ${JSON.stringify(args.group.folder)}
 EJCLAW_IS_MAIN = ${JSON.stringify(args.isMain ? '1' : '0')}
 EJCLAW_AGENT_TYPE = ${JSON.stringify(args.env.EJCLAW_AGENT_TYPE)}
 `;
-    fs.writeFileSync(
+    fs.writeFileSync(sessionConfigPath, toml.trimEnd() + '\n' + mcpSection);
-      sessionConfigPath,
-      toml.trimEnd() + '\n' + mcpSection,
-    );
   }
 
   delete args.env.ANTHROPIC_API_KEY;
@@ -553,6 +553,27 @@ export function prepareContainerSessionEnvironment(args: {
   const sessionClaudeMdPath = path.join(sessionDir, 'CLAUDE.md');
   if (sessionClaudeMd) {
     fs.writeFileSync(sessionClaudeMdPath, sessionClaudeMd + '\n');
+
+    // Write identical content as AGENTS.md for codex-runner compatibility.
+    // Codex SDK reads AGENTS.md from CODEX_HOME, not CLAUDE.md.
+    // Copy auth.json and config.toml from host .codex so the session-local
+    // CODEX_HOME has both prompts and authentication.
+    const codexHomeDir = path.join(sessionDir, '.codex');
+    fs.mkdirSync(codexHomeDir, { recursive: true });
+    fs.writeFileSync(
+      path.join(codexHomeDir, 'AGENTS.md'),
+      sessionClaudeMd + '\n',
+    );
+    const hostCodexHome =
+      process.env.CODEX_HOME || path.join(os.homedir(), '.codex');
+    for (const file of ['auth.json', 'config.toml']) {
+      const src = path.join(hostCodexHome, file);
+      const dst = path.join(codexHomeDir, file);
+      if (fs.existsSync(src)) {
+        fs.copyFileSync(src, dst);
+      }
+    }
+
     logger.info(
       {
         sessionDir,

src/container-runner.ts

@@ -512,7 +512,9 @@ export async function runReviewerContainer(args: {
     }
   }
   if (isCodexAgent) {
-    execArgs.push('-e', 'CODEX_HOME=/home/node/.codex');
+    // Use session-local .codex dir (contains AGENTS.md with role prompts)
+    // instead of the host-mounted ~/.codex (which has owner-only config).
+    execArgs.push('-e', 'CODEX_HOME=/home/node/.claude/.codex');
   }
   const runnerPath = isCodexAgent
     ? '/app/codex/dist/index.js'