Split /codex mount per project

sloptrap

@@ -225,7 +225,10 @@ MANIFEST_PRESENT=false
 
 CURRENT_IGNORE_FILE=""
 CONTAINER_ENGINE=""
-CODEX_HOME_HOST=""
+CODEX_ROOT_HOST=""
+CODEX_STATE_HOME_HOST=""
+CODEX_AUTH_FILE_HOST=""
+CODEX_STATE_KEY=""
 CODEX_HOME_BOOTSTRAP=false
 NEED_LOGIN=false
 IGNORE_STUB_BASE=""
@@ -372,13 +375,23 @@ select_codex_home() {
     error "expected Codex home '$preferred' to be a directory"
   fi
 
-  CODEX_HOME_HOST="$preferred"
-  if [[ -d $CODEX_HOME_HOST ]]; then
-    CODEX_HOME_HOST="$(cd "$CODEX_HOME_HOST" && pwd -P)"
+  CODEX_ROOT_HOST="$preferred"
+  if [[ -d $CODEX_ROOT_HOST ]]; then
+    CODEX_ROOT_HOST="$(cd "$CODEX_ROOT_HOST" && pwd -P)"
     CODEX_HOME_BOOTSTRAP=false
   else
     CODEX_HOME_BOOTSTRAP=true
   fi
+  CODEX_STATE_KEY=$(printf '%s' "$CODE_DIR" | sha256sum)
+  CODEX_STATE_KEY=${CODEX_STATE_KEY%% *}
+  CODEX_STATE_HOME_HOST="$CODEX_ROOT_HOST/sloptrap/state/$CODEX_STATE_KEY"
+  CODEX_AUTH_FILE_HOST="$CODEX_ROOT_HOST/auth.json"
+  if [[ -L $CODEX_AUTH_FILE_HOST ]]; then
+    error "Codex auth file '$CODEX_AUTH_FILE_HOST' must not be a symlink"
+  fi
+  if [[ -e $CODEX_AUTH_FILE_HOST && ! -f $CODEX_AUTH_FILE_HOST ]]; then
+    error "expected Codex auth file '$CODEX_AUTH_FILE_HOST' to be a regular file"
+  fi
 }
 
 assert_path_within_code_dir() {
@@ -820,7 +833,11 @@ print_config() {
   info_line "container_engine=%s\n" "$CONTAINER_ENGINE"
   info_line "image_name=%s\n" "$SLOPTRAP_IMAGE_NAME"
   info_line "container_name=%s\n" "$SLOPTRAP_CONTAINER_NAME"
-  info_line "codex_home=%s\n" "$CODEX_HOME_HOST"
+  info_line "codex_home=%s\n" "$CODEX_STATE_HOME_HOST"
+  info_line "codex_root=%s\n" "$CODEX_ROOT_HOST"
+  info_line "codex_state_home=%s\n" "$CODEX_STATE_HOME_HOST"
+  info_line "codex_auth_file=%s\n" "$CODEX_AUTH_FILE_HOST"
+  info_line "codex_state_key=%s\n" "$CODEX_STATE_KEY"
   info_line "codex_home_bootstrap=%s\n" "$CODEX_HOME_BOOTSTRAP"
   info_line "codex_archive=%s\n" "$SLOPTRAP_CODEX_ARCHIVE"
   info_line "codex_url=%s\n" "$SLOPTRAP_CODEX_URL"
@@ -942,15 +959,46 @@ run_or_print() {
   "$@"
 }
 
-ensure_codex_home_dir() {
-  if [[ -d $CODEX_HOME_HOST ]]; then
+ensure_codex_directory() {
+  local path=$1
+  local label=$2
+  if [[ -L $path ]]; then
+    error "$label '$path' must not be a symlink"
+  fi
+  if [[ -e $path && ! -d $path ]]; then
+    error "expected $label '$path' to be a directory"
+  fi
+  if [[ -d $path ]]; then
     return 0
   fi
   if $DRY_RUN; then
-    print_command mkdir -p "$CODEX_HOME_HOST"
+    print_command mkdir -p "$path"
     return 0
   fi
-  mkdir -p "$CODEX_HOME_HOST"
+  mkdir -p "$path"
+}
+
+ensure_codex_storage_paths() {
+  local state_root="$CODEX_ROOT_HOST/sloptrap"
+  local state_bucket="$state_root/state"
+  ensure_codex_directory "$CODEX_ROOT_HOST" "Codex home"
+  ensure_codex_directory "$state_root" "sloptrap Codex namespace"
+  ensure_codex_directory "$state_bucket" "sloptrap Codex state root"
+  ensure_codex_directory "$CODEX_STATE_HOME_HOST" "project Codex state"
+  if [[ -L $CODEX_AUTH_FILE_HOST ]]; then
+    error "Codex auth file '$CODEX_AUTH_FILE_HOST' must not be a symlink"
+  fi
+  if [[ -e $CODEX_AUTH_FILE_HOST && ! -f $CODEX_AUTH_FILE_HOST ]]; then
+    error "expected Codex auth file '$CODEX_AUTH_FILE_HOST' to be a regular file"
+  fi
+  if [[ -f $CODEX_AUTH_FILE_HOST ]]; then
+    return 0
+  fi
+  if $DRY_RUN; then
+    print_command touch "$CODEX_AUTH_FILE_HOST"
+    return 0
+  fi
+  : > "$CODEX_AUTH_FILE_HOST"
 }
 
 fetch_latest_codex_digest() {
@@ -1175,7 +1223,8 @@ prepare_container_runtime() {
 
   local -a volume_opts=(
     -v "$SLOPTRAP_SHARED_DIR_ABS:$SLOPTRAP_WORKDIR$SLOPTRAP_VOLUME_LABEL"
-    -v "$CODEX_HOME_HOST:$SLOPTRAP_CODEX_HOME_CONT$SLOPTRAP_VOLUME_LABEL"
+    -v "$CODEX_STATE_HOME_HOST:$SLOPTRAP_CODEX_HOME_CONT$SLOPTRAP_VOLUME_LABEL"
+    -v "$CODEX_AUTH_FILE_HOST:$SLOPTRAP_CODEX_HOME_CONT/auth.json$SLOPTRAP_VOLUME_LABEL"
   )
 
   local -a env_args=(
@@ -1361,6 +1410,7 @@ prune_sloptrap_images() {
 
 run_codex_command() {
   local -a extra_args=("$@")
+  ensure_codex_storage_paths
   local -a cmd=("${BASE_CONTAINER_CMD[@]}" "$SLOPTRAP_IMAGE_NAME")
   if [[ ${#CODEX_ARGS_ARRAY[@]} -gt 0 ]]; then
     cmd+=("${CODEX_ARGS_ARRAY[@]}")
@@ -1379,6 +1429,7 @@ run_codex() {
 }
 
 run_login_target() {
+  ensure_codex_storage_paths
   if ! $DRY_RUN; then
     status_line "Login %s\n" "$SLOPTRAP_IMAGE_NAME"
   fi
@@ -1387,6 +1438,7 @@ run_login_target() {
 }
 
 run_shell_target() {
+  ensure_codex_storage_paths
   if ! $DRY_RUN; then
     status_line "Shell %s\n" "$SLOPTRAP_IMAGE_NAME"
   fi
@@ -1429,7 +1481,6 @@ dispatch_target() {
       ;;
     login)
       build_if_missing
-      ensure_codex_home_dir
       run_login_target
       ;;
     shell)
@@ -1553,9 +1604,7 @@ IGNORE_STUB_BASE="$IGNORE_HELPER_ROOT/session-${BASHPID:-$$}"
 resolve_sloptrap_ignore "$CODE_DIR"
 resolve_container_workdir
 NEED_LOGIN=false
-if [[ $CODEX_HOME_BOOTSTRAP == true ]]; then
-  NEED_LOGIN=true
-elif [[ ! -f "$CODEX_HOME_HOST/auth.json" ]]; then
+if [[ ! -s "$CODEX_AUTH_FILE_HOST" ]]; then
   NEED_LOGIN=true
 fi
 
@@ -1653,9 +1702,8 @@ fi
 
 if $AUTO_LOGIN; then
   if ! $DRY_RUN; then
-    status_line "Codex login required (%s)\n" "$CODEX_HOME_HOST"
+    status_line "Codex login required (%s)\n" "$CODEX_AUTH_FILE_HOST"
   fi
-  ensure_codex_home_dir
   dispatch_target login
 fi