Rebuild image when wrapper VERSION changes

.codex_yolo.Dockerfile

@@ -1,6 +1,7 @@
 ARG BASE_IMAGE=node:20-slim
 FROM ${BASE_IMAGE}
 ARG CODEX_VERSION=latest
+ARG CODEX_YOLO_WRAPPER_VERSION=unknown
 
 RUN apt-get update \
   && apt-get install -y --no-install-recommends \
@@ -25,6 +26,9 @@ COPY default-AGENTS.md /etc/codex/default-AGENTS.md
 RUN chmod +x /usr/local/bin/codex-entrypoint \
   && chmod 0644 /etc/codex/default-AGENTS.md
 
+# Record the installed wrapper version so image refreshes when scripts update.
+RUN printf '%s' "${CODEX_YOLO_WRAPPER_VERSION}" > /opt/codex-yolo-version
+
 # Record the installed Codex CLI version for update checks.
 RUN node -e "process.stdout.write(require('/usr/local/lib/node_modules/@openai/codex/package.json').version)" \
   > /opt/codex-version

.codex_yolo.sh

@@ -29,6 +29,10 @@ REPO="${CODEX_YOLO_REPO:-laurenceputra/codex_yolo}"
 BRANCH="${CODEX_YOLO_BRANCH:-main}"
 VERBOSE="${CODEX_VERBOSE:-0}"
 MOUNT_SSH=0
+WRAPPER_VERSION="unknown"
+if [[ -f "${SCRIPT_DIR}/VERSION" ]]; then
+  WRAPPER_VERSION="$(tr -d '\n ' < "${SCRIPT_DIR}/VERSION")"
+fi
 
 log_verbose() {
   if [[ "${VERBOSE}" == "1" ]]; then
@@ -102,16 +106,11 @@ fi
 
 # Check for updates unless explicitly disabled
 if [[ "${CODEX_SKIP_UPDATE_CHECK:-0}" != "1" ]]; then
-  local_version=""
-  if [[ -f "${SCRIPT_DIR}/VERSION" ]]; then
-    local_version="$(tr -d '\n ' < "${SCRIPT_DIR}/VERSION")"
-  fi
-
   if command -v curl >/dev/null 2>&1; then
     remote_version="$(curl -fsSL "https://raw.githubusercontent.com/${REPO}/${BRANCH}/VERSION" 2>/dev/null | tr -d '\n ' || true)"
 
-    if [[ -n "${remote_version}" && "${remote_version}" != "${local_version}" ]]; then
-      log_info "codex_yolo update available: ${local_version:-unknown} -> ${remote_version}"
+    if [[ -n "${remote_version}" && "${remote_version}" != "${WRAPPER_VERSION}" ]]; then
+      log_info "codex_yolo update available: ${WRAPPER_VERSION} -> ${remote_version}"
       log_info "Updating from ${REPO}/${BRANCH}..."
       log_verbose "Downloading update files..."
 
@@ -205,6 +204,7 @@ fi
 
 # Build the image locally (no community image pull).
 build_args=(--build-arg "BASE_IMAGE=${BASE_IMAGE}")
+build_args+=(--build-arg "CODEX_YOLO_WRAPPER_VERSION=${WRAPPER_VERSION}")
 if [[ "${CODEX_BUILD_NO_CACHE:-0}" == "1" ]]; then
   build_args+=(--no-cache)
 fi
@@ -228,25 +228,35 @@ fi
 
 image_exists=0
 image_version=""
+image_wrapper_version=""
 if docker image inspect "${IMAGE}" >/dev/null 2>&1; then
   image_exists=1
   image_version="$(docker run --rm "${IMAGE}" cat /opt/codex-version 2>/dev/null || true)"
   image_version="$(printf '%s' "${image_version}" | tr -d '\n')"
+  image_wrapper_version="$(docker run --rm "${IMAGE}" cat /opt/codex-yolo-version 2>/dev/null || true)"
+  image_wrapper_version="$(printf '%s' "${image_wrapper_version}" | tr -d '\n')"
 fi
 
 # Check if we need to build the image
-# Build if: forced rebuild, forced pull, image missing, or version mismatch
+# Build if: forced rebuild, forced pull, image missing, CLI version mismatch,
+# or wrapper version mismatch.
 version_mismatch=0
 if [[ -n "${latest_version}" ]] && { [[ -z "${image_version}" ]] || [[ "${latest_version}" != "${image_version}" ]]; }; then
   version_mismatch=1
 fi
 
+wrapper_version_mismatch=0
+if [[ "${image_exists}" == "1" ]] && [[ "${image_wrapper_version}" != "${WRAPPER_VERSION}" ]]; then
+  wrapper_version_mismatch=1
+fi
+
 need_build=0
 if [[ "${CODEX_BUILD_NO_CACHE:-0}" == "1" ]] || \
    [[ "${CODEX_BUILD_PULL:-0}" == "1" ]] || \
    [[ "${PULL_REQUESTED}" == "1" ]] || \
    [[ "${image_exists}" == "0" ]] || \
-   [[ "${version_mismatch}" == "1" ]]; then
+   [[ "${version_mismatch}" == "1" ]] || \
+   [[ "${wrapper_version_mismatch}" == "1" ]]; then
   need_build=1
 fi
 
@@ -327,6 +337,13 @@ if [[ "${need_build}" == "1" ]]; then
   if [[ -n "${latest_version}" && -n "${image_version}" && "${latest_version}" != "${image_version}" ]]; then
     log_info "Updating Codex CLI ${image_version} -> ${latest_version}"
   fi
+  if [[ "${wrapper_version_mismatch}" == "1" ]]; then
+    if [[ -n "${image_wrapper_version}" ]]; then
+      log_info "Updating codex_yolo wrapper ${image_wrapper_version} -> ${WRAPPER_VERSION}"
+    else
+      log_info "Rebuilding image to add codex_yolo wrapper metadata (${WRAPPER_VERSION})"
+    fi
+  fi
   # Force BuildKit to avoid the legacy builder deprecation warning.
   DOCKER_BUILDKIT=1 docker build "${build_args[@]}" -t "${IMAGE}" -f "${DOCKERFILE}" "${SCRIPT_DIR}"
 fi

.codex_yolo_diagnostics.sh

@@ -8,8 +8,10 @@ echo ""
 # Version info
 echo "📦 Version Information:"
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+local_wrapper_version="unknown"
 if [[ -f "${SCRIPT_DIR}/VERSION" ]]; then
-  echo "  codex_yolo version: $(cat "${SCRIPT_DIR}/VERSION")"
+  local_wrapper_version="$(cat "${SCRIPT_DIR}/VERSION")"
+  echo "  codex_yolo version: ${local_wrapper_version}"
 else
   echo "  codex_yolo version: unknown (VERSION file missing)"
 fi
@@ -42,12 +44,25 @@ echo ""
 echo "🖼️  Image Status:"
 IMAGE="${CODEX_YOLO_IMAGE:-codex-cli-yolo:local}"
 image_version=""
+image_wrapper_version=""
 if docker image inspect "${IMAGE}" >/dev/null 2>&1; then
   echo "  ✓ Image exists: ${IMAGE}"
 
   image_version=$(docker run --rm --entrypoint cat "${IMAGE}" /opt/codex-version 2>/dev/null || echo "unknown")
   echo "  Codex CLI version in image: ${image_version}"
 
+  image_wrapper_version=$(docker run --rm --entrypoint cat "${IMAGE}" /opt/codex-yolo-version 2>/dev/null || true)
+  if [[ -n "${image_wrapper_version}" ]]; then
+    echo "  codex_yolo wrapper version in image: ${image_wrapper_version}"
+    if [[ "${image_wrapper_version}" == "${local_wrapper_version}" ]]; then
+      echo "  ✓ Wrapper version in image is up to date"
+    else
+      echo "  ⚠ Wrapper update needed: ${image_wrapper_version} -> ${local_wrapper_version}"
+    fi
+  else
+    echo "  ⚠ Wrapper version metadata missing in image (legacy image)"
+  fi
+
   image_size=$(docker image inspect "${IMAGE}" --format='{{.Size}}' 2>/dev/null || echo "0")
   image_size_mb=$((image_size / 1024 / 1024))
   echo "  Image size: ${image_size_mb} MB"

tests/integration_tests.sh

@@ -308,6 +308,26 @@ else
   log_skip "Docker not available, skipping --mount-ssh flag test"
 fi
 
+# Test 16: Wrapper version metadata is embedded in Dockerfile
+log_test "Dockerfile embeds wrapper version metadata"
+dockerfile="${SCRIPT_DIR}/../.codex_yolo.Dockerfile"
+if grep -q 'ARG CODEX_YOLO_WRAPPER_VERSION=' "${dockerfile}" && \
+   grep -q '/opt/codex-yolo-version' "${dockerfile}"; then
+  log_pass "Dockerfile contains wrapper version metadata support"
+else
+  log_fail "Dockerfile missing wrapper version metadata support"
+fi
+
+# Test 17: Main script rebuild logic includes wrapper version mismatch checks
+log_test "Main script rebuilds when wrapper VERSION changes"
+if grep -q 'CODEX_YOLO_WRAPPER_VERSION=' "${CODEX_YOLO_SH}" && \
+   grep -q '/opt/codex-yolo-version' "${CODEX_YOLO_SH}" && \
+   grep -q 'wrapper_version_mismatch' "${CODEX_YOLO_SH}"; then
+  log_pass "Wrapper version mismatch rebuild logic found"
+else
+  log_fail "Wrapper version mismatch rebuild logic missing"
+fi
+
 # Summary
 echo ""
 echo "=== Test Summary ==="