feat(codex): add --browser-mcp and bump toolchain versions

- Add deva.sh codex --browser-mcp: injects session-only Playwright
  MCP override via Codex --config, switches to rust image profile
- Add CODEX_BROWSER_MCP=true and repeatable CODEX_CONFIG=key=value
  in .deva config files for persistent browser sessions
- Bump Go 1.26.3, Claude Code 2.1.143, Codex 0.131.0,
  Gemini CLI 0.42.0, Playwright 1.60.0
- Redesign container slug: deva--<agent>--<auth_tag>--<slug>..<hash>
  replaces the old ..i/..v/..c suffix soup; agent always in name
- Normalize short_hash to SHA-256; drop cksum fallback (non-hex)
- Add scripts/test-codex-browser-shape.sh dry-run coverage

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: lroolle

.deva.example

@@ -49,6 +49,14 @@ EPHEMERAL=false
 #
 # 6. Disable ephemeral containers (persistent):
 #    EPHEMERAL=false
+#
+# 7. Enable Codex browser MCP for this project:
+#    DEFAULT_AGENT=codex
+#    CODEX_BROWSER_MCP=true
+#
+#    Optional session-only Codex config overrides:
+#    CODEX_CONFIG=features.apps=false
+#    CODEX_CONFIG=features.plugins=false
 
 # Hybrid Agent Setup:
 #

DEV-LOGS.md

@@ -13,6 +13,24 @@
 - Minimal markdown markers, no unnecessary formatting, minimal emojis.
 - Reference issue numbers in the format `#<issue-number>` for easy linking.
 
+# [2026-04-28] Dev Log: agent-context consolidation — ~/.claude as single source of truth [WIP]
+- Why: agent customizations are scattered across three directories (=~/.claude/=, =~/.codex/=, =~/.agents/=), 10 concepts are duplicated between Claude Code agents and Codex skills and are already diverging, and the shared global instructions (GENERAL-AGENTS.md) copied into both =~/.claude/CLAUDE.md= and =~/.codex/AGENTS.md= are 30 lines out of sync
+- What:
+  - **[PLANNING]** Phase 1 — establish source of truth: =~/.claude/= is canonical; Claude Code agents/ are authoritative for the 10 duplicated concepts; =~/.claude/CLAUDE.md= is the master global instructions file
+  - **[PLANNING]** Phase 2 — Codex sync mechanism: decision needed between symlinking =~/.codex/AGENTS.md= -> =~/.claude/CLAUDE.md= vs. a sync script that copies with Codex-specific adaptations; leaning toward symlink for zero-drift maintenance
+  - **[PLANNING]** Phase 3 — deduplicate Codex skills: remove from =~/.codex/skills/= all 10 Claude Code agent duplicates (linus-committer, linus-rants, comment-flusher, etc.) plus 8 skills already covered by the superpowers plugin in CC (brainstorming, executing-plans, writing-plans, dispatching-parallel-agents, subagent-driven-development, skill-creator-6rok, using-superpowers, codex-primary-runtime); retain Codex-only skills: docker-compose-safe-deploy, systematic-debugging, test-driven-development, verification-before-completion, finishing-a-development-branch, using-git-worktrees, receiving-code-review, writing-skills
+  - **[PLANNING]** Phase 4 — clean =~/.agents/=: this directory is dead weight; Claude Code does not scan it; Codex only scans .agents/ walking up from cwd, not from HOME; decide whether to archive the telegram TS package and repurpose the dir as a shared skill source, or delete it entirely
+  - **[PLANNING]** Phase 5 — purge stale files: delete all .bak/.backup files from =~/.claude/= and =~/.codex/= (~1MB), delete empty =~/.codex/instructions.md=, clean =~/.claude/.claude.json= backup chain
+  - **[PLANNING]** Phase 6 — document the layout: brief README or section in CLAUDE.md covering what lives where, how to add new skills/agents, and the Codex sync workflow
+
+- Open decisions:
+  1. Symlink =AGENTS.md= -> =CLAUDE.md=, or keep separate with a sync script? (symlink eliminates drift but loses ability to add Codex-specific front matter)
+  2. Kill the 10 Codex duplicates entirely, or keep for standalone Codex use without deva? (Claude Code + superpowers already covers the gap when running inside deva)
+  3. =~/.agents/=: repurpose as shared skill source readable by both tools, or delete?
+  4. Should unique Codex workflow skills (TDD, systematic-debugging, finishing-a-development-branch, etc.) be ported back into Claude Code agents?
+
+- Result: **[WIP — no files changed yet]** planning entry only; execution blocked on the four decisions above
+
 # [2026-04-13] Dev Log: adopt smux tmux-bridge as layer-2 agent comms
 - Why: deva-v2 proposal left the agent-to-agent transport CLI as an open question; smux (github.com/ShawnPana/smux) shipped exactly the shape we sketched (read/type/keys/label/envelope) in 403 lines of bash, MIT-licensed. Reinventing it would be waste. The existing `deva-bridge-tmux` (socat TCP) is layer 1 (kernel boundary); `tmux-bridge` is layer 2 (semantic). They compose cleanly.
 - What:

Dockerfile

@@ -61,7 +61,7 @@ RUN curl -LsSf https://astral.sh/uv/install.sh | sh
 ARG PYTHON_VERSION=3.14t
 RUN /root/.local/bin/uv python install "${PYTHON_VERSION}"
 
-ARG GO_VERSION=1.26.2
+ARG GO_VERSION=1.26.3
 RUN --mount=type=cache,target=/tmp/go-cache,sharing=locked \
     ARCH=$(dpkg --print-architecture) && \
     GO_ARCH=$([ "$ARCH" = "amd64" ] && echo "amd64" || echo "arm64") && \
@@ -205,10 +205,10 @@ RUN curl -LsSf https://astral.sh/uv/install.sh | sh && \
 FROM agent-base AS final
 
 # Declare ARGs immediately before usage to minimize cache invalidation
-ARG CLAUDE_CODE_VERSION=2.1.116
+ARG CLAUDE_CODE_VERSION=2.1.143
 ARG CLAUDE_TRACE_VERSION=1.0.9
-ARG CODEX_VERSION=0.122.0
-ARG GEMINI_CLI_VERSION=0.38.2
+ARG CODEX_VERSION=0.131.0
+ARG GEMINI_CLI_VERSION=0.42.0
 
 # Record key tool versions as labels for quick inspection
 LABEL org.opencontainers.image.claude_code_version=${CLAUDE_CODE_VERSION}

Dockerfile.rust

@@ -8,12 +8,12 @@ FROM ${BASE_IMAGE}
 LABEL org.opencontainers.image.title="deva-rust"
 LABEL org.opencontainers.image.description="Rust development environment with full toolchain"
 
-ARG CLAUDE_CODE_VERSION=2.1.116
+ARG CLAUDE_CODE_VERSION=2.1.143
 ARG CLAUDE_TRACE_VERSION=1.0.9
-ARG CODEX_VERSION=0.122.0
-ARG GEMINI_CLI_VERSION=0.38.2
+ARG CODEX_VERSION=0.131.0
+ARG GEMINI_CLI_VERSION=0.42.0
 ARG ATLAS_CLI_VERSION=v0.1.4
-ARG PLAYWRIGHT_VERSION=1.59.1
+ARG PLAYWRIGHT_VERSION=1.60.0
 ARG RUST_TOOLCHAINS="stable"
 ARG RUST_DEFAULT_TOOLCHAIN="stable"
 ARG RUST_TARGETS="wasm32-unknown-unknown"

Makefile

@@ -25,18 +25,18 @@ DETECTED_IMAGE := $(shell \
 		echo "$(IMAGE_NAME):$(TAG)"; \
 	fi)
 NODE_MAJOR ?= 22
-GO_VERSION ?= 1.26.2
+GO_VERSION ?= 1.26.3
 PYTHON_VERSION ?= 3.14t
 DELTA_VERSION ?= 0.19.2
 TMUX_VERSION ?= 3.6a
 TMUX_SHA256 ?= b6d8d9c76585db8ef5fa00d4931902fa4b8cbe8166f528f44fc403961a3f3759
-CLAUDE_CODE_VERSION ?= 2.1.116
+CLAUDE_CODE_VERSION ?= 2.1.143
 CLAUDE_TRACE_VERSION ?= 1.0.9
-CODEX_VERSION ?= 0.122.0
-GEMINI_CLI_VERSION ?= 0.38.2
+CODEX_VERSION ?= 0.131.0
+GEMINI_CLI_VERSION ?= 0.42.0
 ATLAS_CLI_VERSION ?= v0.1.4
 COPILOT_API_VERSION ?= 0ea08febdd7e3e055b03dd298bf57e669500b5c1
-PLAYWRIGHT_VERSION ?= 1.59.1
+PLAYWRIGHT_VERSION ?= 1.60.0
 RUST_TOOLCHAINS ?= stable
 RUST_DEFAULT_TOOLCHAIN ?= stable
 RUST_TARGETS ?= wasm32-unknown-unknown
@@ -402,10 +402,10 @@ help:
 	@echo "  make CLAUDE_CODE_VERSION=2.0.5 build          # Override with specific version"
 	@echo "  make GEMINI_CLI_VERSION=0.18.0 build          # Override gemini version"
 	@echo "  make ATLAS_CLI_VERSION=5f6a20c build          # Pin atlas-cli to specific commit"
-	@echo "  make GO_VERSION=1.26.2 build                  # Override Go pin"
+	@echo "  make GO_VERSION=1.26.3 build                  # Override Go pin"
 	@echo "  make toolchains                               # Show pinned toolchain inventory"
 	@echo "  make scripts                                  # List helper scripts"
 	@echo "  make versions-pin                             # Refresh shared pin file"
 	@echo "  make versions                                 # Check current versions"
-	@echo "  make PLAYWRIGHT_VERSION=1.59.1 build-rust     # Override rust browser tooling"
+	@echo "  make PLAYWRIGHT_VERSION=1.60.0 build-rust     # Override rust browser tooling"
 	@echo "  make versions-up                              # Upgrade to latest upstream versions"

agents/codex.sh

@@ -3,6 +3,23 @@
 # shellcheck disable=SC1091
 source "$(dirname "${BASH_SOURCE[0]}")/shared_auth.sh"
 
+toml_escape_string() {
+    local value="$1"
+    value="${value//\\/\\\\}"
+    value="${value//\"/\\\"}"
+    printf '%s' "$value"
+}
+
+codex_browser_mcp_config_override() {
+    local package
+    package="$(configured_env_value DEVA_CODEX_BROWSER_MCP_PACKAGE || true)"
+    [ -n "$package" ] || package="$(configured_env_value DEVA_PLAYWRIGHT_MCP_PACKAGE || true)"
+    [ -n "$package" ] || package="${DEVA_CODEX_BROWSER_MCP_PACKAGE:-${DEVA_PLAYWRIGHT_MCP_PACKAGE:-@playwright/mcp@0.0.75}}"
+    package="$(toml_escape_string "$package")"
+
+    printf '%s' "mcp_servers.playwright={command=\"npx\",args=[\"-y\",\"${package}\",\"--headless\",\"--browser\",\"chromium\",\"--no-sandbox\",\"--isolated\"],startup_timeout_sec=30}"
+}
+
 agent_prepare() {
     local -a args
     if [ $# -gt 0 ]; then
@@ -46,6 +63,15 @@ agent_prepare() {
         AGENT_COMMAND+=("-m" "${DEVA_DEFAULT_CODEX_MODEL:-gpt-5-codex}")
     fi
 
+    if [ "${DEVA_CODEX_BROWSER_MCP:-${DEVA_WITH_BROWSER:-0}}" = "1" ]; then
+        AGENT_COMMAND+=("--config" "$(codex_browser_mcp_config_override)")
+    fi
+
+    local codex_config
+    for codex_config in "${CODEX_CONFIG_OVERRIDES[@]+"${CODEX_CONFIG_OVERRIDES[@]}"}"; do
+        AGENT_COMMAND+=("--config" "$codex_config")
+    done
+
     AGENT_COMMAND+=("${remaining_args[@]+"${remaining_args[@]}"}")
 
     DOCKER_ARGS+=("-p" "127.0.0.1:1455:1455")