Import personal Codex skills and effective global instructions into guests

Codex users lose personal skills and potentially their effective global instructions when starting a coop guest. This is the Codex counterpart to #457, scoped to the existing import flow rather than a new setup interface.

At checkout 5641577, CODEX_ALLOWED_FILES copies AGENTS.md and conditionally auth.json; CODEX_ALLOWED_DIRS contains only prompts. Host config.toml is merged separately. The bootstrap-content predicate recognizes only those existing entries.

Current Codex documentation places personal skills at ~/.agents/skills, outside coop's default ~/.codex source. Global AGENTS.override.md takes precedence over AGENTS.md, but coop does not copy it. Disabled skills are identified by file path in [[skills.config]], so transferring assets also requires preserving their disabled state at guest paths.

Proposed scope

• Discover and copy complete personal skill bundles from the documented user skill location, including supporting scripts, assets, and metadata.
• Support effective global instructions, including AGENTS.override.md precedence.
• Relocate path-based skill settings for imported skills so a disabled host skill does not become enabled solely because its path changed.
• Update bootstrap detection so a skills-only setup works even when the host has no ~/.codex directory.
• Define the additional skill source explicitly for default, custom, and disabled codex.config_dir. A custom source must not silently pull unrelated content from the real home directory; false must continue to disable host customization copying.
• Verify the compatibility ~/.codex/skills location against supported guest versions before deciding discovery order, duplicate handling, and support. It still appears in official examples, but the current documented personal root is ~/.agents/skills.
• Handle symlinked skill installations intentionally; document the policy and exercise it in tests.

Boundaries

Preserve coop's existing API-key, proxy, and ChatGPT keyring behavior. Preserve guest-owned plugin/marketplace/trust state; do not import arbitrary host plugin caches or credentials as part of skill support. Do not flatten repository or bundled/system skills into personal scope.

Keep the current copy-overlay lifecycle unless a separate change defines removal semantics. Removing a source file or disabling copying currently does not remove previous guest copies; document this rather than promising synchronization.

Custom agent definitions, execution rules, standalone hooks, referenced config files, and automatic marketplace discovery are known additional coverage areas for the separate guided agent setup proposal. They are not requirements for closing this focused issue.

Validation

Use explicit fixtures for complete skill bundles, effective instruction precedence, disabled-path relocation, source selection/opt-out, duplicates, and skills-only bootstrap. Assert actual skill discovery and enabled state in the guest, rather than file existence alone. Exercise first boot and restart on both Lima and Firecracker, and retain existing authentication regression coverage. Update source comments, configuration examples, and integration documentation.

Evidence

• Current allowlists and staging
• Bootstrap-content detection
• Official skill locations and disabled-skill configuration
• Official global instruction precedence

Research verified coop source and current official documentation. The research environment had codex-cli 0.153.0; guest runtime behavior and compatibility roots still need validation.

Related: Guided Claude/Codex setup proposal. This focused fix does not depend on that proposal.

Start in src/backend.rs at the allowlists, staging flow, and bootstrap-content detection referenced at checkout 5641577, then compare them with the official skill-location and global-instruction documentation. Build explicit fixtures and integration coverage for bundles, precedence, disabled-path relocation, source selection, duplicates, symlinks, and skills-only bootstrap on Lima and Firecracker. Done means guest discovery and enabled state are correct across first boot and restart without changing authentication or guest-owned state.