Project-2 baseline

worker-toolkit-potion-polyglot/scripts/harbor-run

@@ -209,10 +209,11 @@ fi
 # rebuild inputs (the workspace/ dir is gitignored) and every downstream
 # consumer rebuilds from them, so anything uncaptured silently vanishes after
 # packaging.
-# The helper sits next to this script in a packed toolkit and under the
-# toolkit's static scripts in the internal repo layout.
+# The helper sits next to this script in a packed toolkit, and under toolkit/static/scripts
+# in a repo checkout that consumes the toolkit as a submodule.
 for WS_SYNC in "$SCRIPT_DIR/check-workspace-sync.sh" \
-               "$REPO_ROOT/raccoon-worker-toolkit/static/scripts/check-workspace-sync.sh"; do
+               "$REPO_ROOT/toolkit/static/scripts/check-workspace-sync.sh" \
+               "$REPO_ROOT/static/scripts/check-workspace-sync.sh"; do
     if [ -f "$WS_SYNC" ]; then
         bash "$WS_SYNC" "$TASK_DIR" || true
         break
@@ -346,7 +347,7 @@ if [ "$ENV_TYPE" = "daytona" ] && [ -z "${DAYTONA_API_KEY:-}" ]; then
     exit 1
 fi
 
-# Task-image Claude Code floor. A task image installs Claude Code when it is first built and
+# Task-image CLI floors. A task image installs Claude Code and Codex when it is first built and
 # Docker reuses that layer on every later build, --force-build included, so an image built
 # before the grader model's minimum CLI shipped fails every grade with "does not support this
 # model" and the trial ends in RewardFileNotFoundError. Before a local docker trial, check the
@@ -354,6 +355,7 @@ fi
 # cache, so harbor's build below installs a current CLI. Advisory: no docker, no daemon, no
 # images, or RACCOON_SKIP_IMAGE_PREFLIGHT=1 means nothing happens. The floor follows
 # GRADER_CLI_MIN in the shared test.sh; RACCOON_CLAUDE_CODE_MIN overrides it.
+# Codex requires stable 0.158.0, matching task-shared/codex-grader.py.
 CLAUDE_CODE_MIN="${RACCOON_CLAUDE_CODE_MIN:-}"
 if [ -z "$CLAUDE_CODE_MIN" ]; then
     for _ts in "$REPO_ROOT/task-shared/test.sh" "$REPO_ROOT/harbor-tasks/raccoon-shared/test.sh"; do
@@ -367,12 +369,22 @@ if [ "$ENV_TYPE" = "docker" ] && [ "${RACCOON_SKIP_IMAGE_PREFLIGHT:-0}" != "1" ]
     && command -v docker >/dev/null 2>&1 && docker info >/dev/null 2>&1; then
     STALE_IMAGES=""
     for img in $(docker images --format '{{.Repository}}:{{.Tag}}' 2>/dev/null | grep '^hb__' || true); do
-        v="$(docker run --rm --entrypoint claude "$img" --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' | head -1 || true)"
-        [ -n "$v" ] || continue
-        if [ "$(printf '%s\n%s\n' "$CLAUDE_CODE_MIN" "$v" | sort -V | head -1)" != "$CLAUDE_CODE_MIN" ]; then
-            STALE_IMAGES="$STALE_IMAGES $img"
-            echo "Task image $img carries Claude Code $v; the grader needs $CLAUDE_CODE_MIN or newer. Removing it so the next build installs a current one." >&2
-        fi
+        for cli in claude codex; do
+            minimum="$CLAUDE_CODE_MIN"
+            [ "$cli" = codex ] && minimum=0.158.0
+            v="$(docker run --rm --entrypoint "$cli" "$img" --version 2>/dev/null | grep -oE '[0-9]+\.[0-9]+\.[0-9]+[^[:space:]]*' | head -1 || true)"
+            # Keep Claude's existing handling of missing versions and suffixes.
+            if [ "$cli" = claude ]; then
+                v="$(printf '%s' "$v" | grep -oE '[0-9]+\.[0-9]+\.[0-9]+' || true)"
+                [ -n "$v" ] || continue
+            fi
+            if ! [[ "$v" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] \
+                || [ "$(printf '%s\n%s\n' "$minimum" "$v" | sort -V | head -1)" != "$minimum" ]; then
+                STALE_IMAGES="$STALE_IMAGES $img"
+                echo "Task image $img carries $cli ${v:-missing}; the grader needs stable $minimum or newer. Removing it so the next build installs a current one." >&2
+                break
+            fi
+        done
     done
     if [ -n "$STALE_IMAGES" ]; then
         for img in $STALE_IMAGES; do
@@ -382,7 +394,7 @@ if [ "$ENV_TYPE" = "docker" ] && [ "${RACCOON_SKIP_IMAGE_PREFLIGHT:-0}" != "1" ]
         done
         # The stale install layer also lives in the build cache, where a rebuild would find it.
         docker builder prune -af >/dev/null 2>&1 || true
-        echo "The task image rebuilds once with a current Claude Code; later runs reuse it." >&2
+        echo "The task image rebuilds once with current agent CLIs; later runs reuse it." >&2
     fi
 fi