diff --git a/packages/app/src/docker-git/cli/parser-apply.ts b/packages/app/src/docker-git/cli/parser-apply.ts
new file mode 100644
index 00000000..a3615eb9
--- /dev/null
+++ b/packages/app/src/docker-git/cli/parser-apply.ts
@@ -0,0 +1,28 @@
+import { Either } from "effect"
+
+import { type ApplyCommand, type ParseError } from "@effect-template/lib/core/domain"
+
+import { parseProjectDirWithOptions } from "./parser-shared.js"
+
+// CHANGE: parse "apply" command for existing docker-git projects
+// WHY: update managed docker-git config on the current project/container without creating a new project
+// QUOTE(ТЗ): "Не создавать новый... а прямо в текущем обновить её на актуальную"
+// REF: issue-72-followup-apply-current-config
+// SOURCE: n/a
+// FORMAT THEOREM: forall argv: parseApply(argv) = cmd -> deterministic(cmd)
+// PURITY: CORE
+// EFFECT: Effect<ApplyCommand, ParseError, never>
+// INVARIANT: projectDir is never empty
+// COMPLEXITY: O(n) where n = |argv|
+export const parseApply = (
+  args: ReadonlyArray<string>
+): Either.Either<ApplyCommand, ParseError> =>
+  Either.map(parseProjectDirWithOptions(args), ({ projectDir, raw }) => ({
+    _tag: "Apply",
+    projectDir,
+    runUp: raw.up ?? true,
+    gitTokenLabel: raw.gitTokenLabel,
+    codexTokenLabel: raw.codexTokenLabel,
+    claudeTokenLabel: raw.claudeTokenLabel,
+    enableMcpPlaywright: raw.enableMcpPlaywright
+  }))
diff --git a/packages/app/src/docker-git/cli/parser-options.ts b/packages/app/src/docker-git/cli/parser-options.ts
index dd88fe7b..163ba7e0 100644
--- a/packages/app/src/docker-git/cli/parser-options.ts
+++ b/packages/app/src/docker-git/cli/parser-options.ts
@@ -24,6 +24,8 @@ interface ValueOptionSpec {
     | "scrapMode"
     | "label"
     | "gitTokenLabel"
+    | "codexTokenLabel"
+    | "claudeTokenLabel"
     | "token"
     | "scopes"
     | "message"
@@ -53,6 +55,8 @@ const valueOptionSpecs: ReadonlyArray<ValueOptionSpec> = [
   { flag: "--mode", key: "scrapMode" },
   { flag: "--label", key: "label" },
   { flag: "--git-token", key: "gitTokenLabel" },
+  { flag: "--codex-token", key: "codexTokenLabel" },
+  { flag: "--claude-token", key: "claudeTokenLabel" },
   { flag: "--token", key: "token" },
   { flag: "--scopes", key: "scopes" },
   { flag: "--message", key: "message" },
@@ -102,6 +106,8 @@ const valueFlagUpdaters: { readonly [K in ValueKey]: (raw: RawOptions, value: st
   scrapMode: (raw, value) => ({ ...raw, scrapMode: value }),
   label: (raw, value) => ({ ...raw, label: value }),
   gitTokenLabel: (raw, value) => ({ ...raw, gitTokenLabel: value }),
+  codexTokenLabel: (raw, value) => ({ ...raw, codexTokenLabel: value }),
+  claudeTokenLabel: (raw, value) => ({ ...raw, claudeTokenLabel: value }),
   token: (raw, value) => ({ ...raw, token: value }),
   scopes: (raw, value) => ({ ...raw, scopes: value }),
   message: (raw, value) => ({ ...raw, message: value }),
@@ -129,47 +135,68 @@ export const applyCommandValueFlag = (
   return Either.right(update(raw, value))
 }
 
-export const parseRawOptions = (args: ReadonlyArray<string>): Either.Either<RawOptions, ParseError> => {
-  let index = 0
-  let raw: RawOptions = {}
+type ParseRawOptionsStep =
+  | { readonly _tag: "ok"; readonly raw: RawOptions; readonly nextIndex: number }
+  | { readonly _tag: "error"; readonly error: ParseError }
 
-  while (index < args.length) {
-    const token = args[index] ?? ""
-    const equalIndex = token.indexOf("=")
-    if (equalIndex > 0 && token.startsWith("-")) {
-      const flag = token.slice(0, equalIndex)
-      const inlineValue = token.slice(equalIndex + 1)
-      const nextRaw = applyCommandValueFlag(raw, flag, inlineValue)
-      if (Either.isLeft(nextRaw)) {
-        return Either.left(nextRaw.left)
-      }
-      raw = nextRaw.right
-      index += 1
-      continue
-    }
+const parseInlineValueToken = (
+  raw: RawOptions,
+  token: string
+): Either.Either<RawOptions, ParseError> | null => {
+  const equalIndex = token.indexOf("=")
+  if (equalIndex <= 0 || !token.startsWith("-")) {
+    return null
+  }
 
-    const booleanApplied = applyCommandBooleanFlag(raw, token)
-    if (booleanApplied !== null) {
-      raw = booleanApplied
-      index += 1
-      continue
-    }
+  const flag = token.slice(0, equalIndex)
+  const inlineValue = token.slice(equalIndex + 1)
+  return applyCommandValueFlag(raw, flag, inlineValue)
+}
 
-    if (!token.startsWith("-")) {
-      return Either.left({ _tag: "UnexpectedArgument", value: token })
-    }
+const parseRawOptionsStep = (
+  args: ReadonlyArray<string>,
+  index: number,
+  raw: RawOptions
+): ParseRawOptionsStep => {
+  const token = args[index] ?? ""
+  const inlineApplied = parseInlineValueToken(raw, token)
+  if (inlineApplied !== null) {
+    return Either.isLeft(inlineApplied)
+      ? { _tag: "error", error: inlineApplied.left }
+      : { _tag: "ok", raw: inlineApplied.right, nextIndex: index + 1 }
+  }
 
-    const value = args[index + 1]
-    if (value === undefined) {
-      return Either.left({ _tag: "MissingOptionValue", option: token })
-    }
+  const booleanApplied = applyCommandBooleanFlag(raw, token)
+  if (booleanApplied !== null) {
+    return { _tag: "ok", raw: booleanApplied, nextIndex: index + 1 }
+  }
+
+  if (!token.startsWith("-")) {
+    return { _tag: "error", error: { _tag: "UnexpectedArgument", value: token } }
+  }
+
+  const value = args[index + 1]
+  if (value === undefined) {
+    return { _tag: "error", error: { _tag: "MissingOptionValue", option: token } }
+  }
+
+  const nextRaw = applyCommandValueFlag(raw, token, value)
+  return Either.isLeft(nextRaw)
+    ? { _tag: "error", error: nextRaw.left }
+    : { _tag: "ok", raw: nextRaw.right, nextIndex: index + 2 }
+}
+
+export const parseRawOptions = (args: ReadonlyArray<string>): Either.Either<RawOptions, ParseError> => {
+  let index = 0
+  let raw: RawOptions = {}
 
-    const nextRaw = applyCommandValueFlag(raw, token, value)
-    if (Either.isLeft(nextRaw)) {
-      return Either.left(nextRaw.left)
+  while (index < args.length) {
+    const step = parseRawOptionsStep(args, index, raw)
+    if (step._tag === "error") {
+      return Either.left(step.error)
     }
-    raw = nextRaw.right
-    index += 2
+    raw = step.raw
+    index = step.nextIndex
   }
 
   return Either.right(raw)
diff --git a/packages/app/src/docker-git/cli/parser.ts b/packages/app/src/docker-git/cli/parser.ts
index 8824f5ca..29d17423 100644
--- a/packages/app/src/docker-git/cli/parser.ts
+++ b/packages/app/src/docker-git/cli/parser.ts
@@ -2,6 +2,7 @@ import { Either, Match } from "effect"
 
 import { type Command, type ParseError } from "@effect-template/lib/core/domain"
 
+import { parseApply } from "./parser-apply.js"
 import { parseAttach } from "./parser-attach.js"
 import { parseAuth } from "./parser-auth.js"
 import { parseClone } from "./parser-clone.js"
@@ -74,6 +75,7 @@ export const parseArgs = (args: ReadonlyArray<string>): Either.Either<Command, P
       Match.when("auth", () => parseAuth(rest))
     )
     .pipe(
+      Match.when("apply", () => parseApply(rest)),
       Match.when("state", () => parseState(rest)),
       Match.orElse(() => Either.left(unknownCommandError))
     )
diff --git a/packages/app/src/docker-git/cli/usage.ts b/packages/app/src/docker-git/cli/usage.ts
index 2aceee40..69fcd86f 100644
--- a/packages/app/src/docker-git/cli/usage.ts
+++ b/packages/app/src/docker-git/cli/usage.ts
@@ -5,6 +5,7 @@ import type { ParseError } from "@effect-template/lib/core/domain"
 export const usageText = `docker-git menu
 docker-git create --repo-url <url> [options]
 docker-git clone <url> [options]
+docker-git apply [<url>] [options]
 docker-git mcp-playwright [<url>] [options]
 docker-git attach [<url>] [options]
 docker-git panes [<url>] [options]
@@ -21,6 +22,7 @@ Commands:
   menu                Interactive menu (default when no args)
   create, init        Generate docker development environment
   clone               Create + run container and clone repo
+  apply               Apply docker-git config to an existing project/container (current dir by default)
   mcp-playwright      Enable Playwright MCP + Chromium sidecar for an existing project dir
   attach, tmux        Open tmux workspace for a docker-git project
   panes, terms        List tmux panes for a docker-git project
@@ -50,6 +52,8 @@ Options:
   --archive <path>          Scrap snapshot directory (default: .orch/scrap/session)
   --mode <session>          Scrap mode (default: session)
   --git-token <label>       Token label for clone/create (maps to GITHUB_TOKEN__<LABEL>, example: agiens)
+  --codex-token <label>     Codex auth label for clone/create (maps to CODEX_AUTH_LABEL, example: agien)
+  --claude-token <label>    Claude auth label for clone/create (maps to CLAUDE_AUTH_LABEL, example: agien)
   --wipe | --no-wipe        Wipe workspace before scrap import (default: --wipe)
   --lines <n>               Tail last N lines for sessions logs (default: 200)
   --include-default         Show default/system processes in sessions list
diff --git a/packages/app/src/docker-git/program.ts b/packages/app/src/docker-git/program.ts
index 8bbf50e7..6adea278 100644
--- a/packages/app/src/docker-git/program.ts
+++ b/packages/app/src/docker-git/program.ts
@@ -1,5 +1,6 @@
 import type { Command, ParseError } from "@effect-template/lib/core/domain"
 import { createProject } from "@effect-template/lib/usecases/actions"
+import { applyProjectConfig } from "@effect-template/lib/usecases/apply"
 import {
   authClaudeLogin,
   authClaudeLogout,
@@ -97,6 +98,7 @@ const handleNonBaseCommand = (command: NonBaseCommand) =>
       Match.when({ _tag: "SessionsKill" }, (cmd) => killTerminalProcess(cmd))
     )
     .pipe(
+      Match.when({ _tag: "Apply" }, (cmd) => applyProjectConfig(cmd)),
       Match.when({ _tag: "SessionsLogs" }, (cmd) => tailTerminalLogs(cmd)),
       Match.when({ _tag: "ScrapExport" }, (cmd) => exportScrap(cmd)),
       Match.when({ _tag: "ScrapImport" }, (cmd) => importScrap(cmd)),
diff --git a/packages/app/tests/docker-git/entrypoint-auth.test.ts b/packages/app/tests/docker-git/entrypoint-auth.test.ts
index a7afe7c6..879dfc85 100644
--- a/packages/app/tests/docker-git/entrypoint-auth.test.ts
+++ b/packages/app/tests/docker-git/entrypoint-auth.test.ts
@@ -28,6 +28,10 @@ describe("renderEntrypoint auth bridge", () => {
       expect(entrypoint).toContain("docker_git_upsert_ssh_env \"GH_TOKEN\" \"$EFFECTIVE_GH_TOKEN\"")
       expect(entrypoint).toContain("docker_git_upsert_ssh_env \"GIT_AUTH_TOKEN\" \"$EFFECTIVE_GITHUB_TOKEN\"")
       expect(entrypoint).toContain("GIT_CREDENTIAL_HELPER_PATH=\"/usr/local/bin/docker-git-credential-helper\"")
+      expect(entrypoint).toContain("CLAUDE_REAL_BIN=\"/usr/local/bin/.docker-git-claude-real\"")
+      expect(entrypoint).toContain("CLAUDE_WRAPPER_BIN=\"/usr/local/bin/claude\"")
+      expect(entrypoint).toContain("cat <<'EOF' > \"$CLAUDE_WRAPPER_BIN\"")
+      expect(entrypoint).toContain("CLAUDE_CONFIG_DIR=\"${CLAUDE_CONFIG_DIR:-$HOME/.claude}\"")
       expect(entrypoint).toContain("token=\"${GITHUB_TOKEN:-}\"")
       expect(entrypoint).toContain("token=\"${GH_TOKEN:-}\"")
       expect(entrypoint).toContain(String.raw`printf "%s\n" "password=$token"`)
diff --git a/packages/app/tests/docker-git/parser.test.ts b/packages/app/tests/docker-git/parser.test.ts
index c61d86d4..3dfa4d62 100644
--- a/packages/app/tests/docker-git/parser.test.ts
+++ b/packages/app/tests/docker-git/parser.test.ts
@@ -33,6 +33,26 @@ const parseOrThrow = (args: ReadonlyArray<string>): Command => {
   })
 }
 
+type ProjectDirRunUpCommand = Extract<Command, { readonly projectDir: string; readonly runUp: boolean }>
+
+const expectProjectDirRunUpCommand = (
+  args: ReadonlyArray<string>,
+  expectedTag: ProjectDirRunUpCommand["_tag"],
+  expectedProjectDir: string,
+  expectedRunUp: boolean
+) =>
+  Effect.sync(() => {
+    const command = parseOrThrow(args)
+    if (command._tag !== expectedTag) {
+      throw new Error(`expected ${expectedTag} command`)
+    }
+    if (!("projectDir" in command) || !("runUp" in command)) {
+      throw new Error("expected command with projectDir and runUp")
+    }
+    expect(command.projectDir).toBe(expectedProjectDir)
+    expect(command.runUp).toBe(expectedRunUp)
+  })
+
 const expectCreateCommand = (
   args: ReadonlyArray<string>,
   onRight: (command: CreateCommand) => void
@@ -106,6 +126,20 @@ describe("parseArgs", () => {
       expect(command.config.gitTokenLabel).toBe("AGIENS")
     }))
 
+  it.effect("parses clone codex/claude token labels from inline options and normalizes them", () =>
+    expectCreateCommand(
+      [
+        "clone",
+        "https://github.com/org/repo.git",
+        "--codex-token= Team A ",
+        "--claude-token=---AGIENS:::Claude---"
+      ],
+      (command) => {
+        expect(command.config.codexAuthLabel).toBe("team-a")
+        expect(command.config.claudeAuthLabel).toBe("agiens-claude")
+      }
+    ))
+
   it.effect("supports enabling SSH auto-open for create", () =>
     expectCreateCommand(["create", "--repo-url", "https://github.com/org/repo.git", "--ssh"], (command) => {
       expect(command.openSsh).toBe(true)
@@ -169,31 +203,53 @@ describe("parseArgs", () => {
     }))
 
   it.effect("parses mcp-playwright command in current directory", () =>
+    expectProjectDirRunUpCommand(["mcp-playwright"], "McpPlaywrightUp", ".", true))
+
+  it.effect("parses mcp-playwright command with --no-up", () =>
+    expectProjectDirRunUpCommand(["mcp-playwright", "--no-up"], "McpPlaywrightUp", ".", false))
+
+  it.effect("parses mcp-playwright with positional repo url into project dir", () =>
     Effect.sync(() => {
-      const command = parseOrThrow(["mcp-playwright"])
+      const command = parseOrThrow(["mcp-playwright", "https://github.com/org/repo.git"])
       if (command._tag !== "McpPlaywrightUp") {
         throw new Error("expected McpPlaywrightUp command")
       }
-      expect(command.projectDir).toBe(".")
-      expect(command.runUp).toBe(true)
+      expect(command.projectDir).toBe(".docker-git/org/repo")
     }))
 
-  it.effect("parses mcp-playwright command with --no-up", () =>
+  it.effect("parses apply command in current directory", () =>
+    expectProjectDirRunUpCommand(["apply"], "Apply", ".", true))
+
+  it.effect("parses apply command with --no-up", () =>
+    expectProjectDirRunUpCommand(["apply", "--no-up"], "Apply", ".", false))
+
+  it.effect("parses apply with positional repo url into project dir", () =>
     Effect.sync(() => {
-      const command = parseOrThrow(["mcp-playwright", "--no-up"])
-      if (command._tag !== "McpPlaywrightUp") {
-        throw new Error("expected McpPlaywrightUp command")
+      const command = parseOrThrow(["apply", "https://github.com/org/repo.git"])
+      if (command._tag !== "Apply") {
+        throw new Error("expected Apply command")
       }
-      expect(command.runUp).toBe(false)
+      expect(command.projectDir).toBe(".docker-git/org/repo")
     }))
 
-  it.effect("parses mcp-playwright with positional repo url into project dir", () =>
+  it.effect("parses apply token and mcp overrides", () =>
     Effect.sync(() => {
-      const command = parseOrThrow(["mcp-playwright", "https://github.com/org/repo.git"])
-      if (command._tag !== "McpPlaywrightUp") {
-        throw new Error("expected McpPlaywrightUp command")
+      const command = parseOrThrow([
+        "apply",
+        "--git-token=agien_main",
+        "--codex-token=Team A",
+        "--claude-token=Team B",
+        "--mcp-playwright",
+        "--no-up"
+      ])
+      if (command._tag !== "Apply") {
+        throw new Error("expected Apply command")
       }
-      expect(command.projectDir).toBe(".docker-git/org/repo")
+      expect(command.runUp).toBe(false)
+      expect(command.gitTokenLabel).toBe("agien_main")
+      expect(command.codexTokenLabel).toBe("Team A")
+      expect(command.claudeTokenLabel).toBe("Team B")
+      expect(command.enableMcpPlaywright).toBe(true)
     }))
 
   it.effect("parses down-all command", () =>
diff --git a/packages/docker-git/tests/core/templates.test.ts b/packages/docker-git/tests/core/templates.test.ts
index 6a529b1b..e2b57d6e 100644
--- a/packages/docker-git/tests/core/templates.test.ts
+++ b/packages/docker-git/tests/core/templates.test.ts
@@ -92,6 +92,11 @@ describe("planFiles", () => {
         expect(entrypointSpec.contents).toContain("npm_config_store_dir")
         expect(entrypointSpec.contents).toContain("NPM_CONFIG_CACHE")
         expect(entrypointSpec.contents).toContain("YARN_CACHE_FOLDER")
+        expect(entrypointSpec.contents).toContain("CLAUDE_REAL_BIN=\"/usr/local/bin/.docker-git-claude-real\"")
+        expect(entrypointSpec.contents).toContain("CLAUDE_WRAPPER_BIN=\"/usr/local/bin/claude\"")
+        expect(entrypointSpec.contents).toContain("cat <<'EOF' > \"$CLAUDE_WRAPPER_BIN\"")
+        expect(entrypointSpec.contents).toContain('CLAUDE_CONFIG_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"')
+        expect(entrypointSpec.contents).toContain("unset CLAUDE_CODE_OAUTH_TOKEN || true")
         expect(entrypointSpec.contents).toContain("CLONE_CACHE_ARGS=\"--reference-if-able '$CACHE_REPO_DIR' --dissociate\"")
         expect(entrypointSpec.contents).toContain("[clone-cache] using mirror: $CACHE_REPO_DIR")
         expect(entrypointSpec.contents).toContain("git clone --progress $CLONE_CACHE_ARGS")
diff --git a/packages/lib/src/core/command-builders.ts b/packages/lib/src/core/command-builders.ts
index 53754e8d..227674f0 100644
--- a/packages/lib/src/core/command-builders.ts
+++ b/packages/lib/src/core/command-builders.ts
@@ -11,6 +11,7 @@ import {
   resolveRepoInput
 } from "./domain.js"
 import { trimRightChar } from "./strings.js"
+import { normalizeAuthLabel, normalizeGitTokenLabel } from "./token-labels.js"
 
 const parsePort = (value: string): Either.Either<number, ParseError> => {
   const parsed = Number(value)
@@ -48,22 +49,6 @@ export const nonEmpty = (
 
 const normalizeSecretsRoot = (value: string): string => trimRightChar(value, "/")
 
-const normalizeGitTokenLabel = (value: string | undefined): string | undefined => {
-  const trimmed = value?.trim() ?? ""
-  if (trimmed.length === 0) {
-    return undefined
-  }
-  const normalized = trimmed
-    .toUpperCase()
-    .replaceAll(/[^A-Z0-9]+/g, "_")
-  const withoutLeading = normalized.replace(/^_+/, "")
-  const cleaned = withoutLeading.replace(/_+$/, "")
-  if (cleaned.length === 0 || cleaned === "DEFAULT") {
-    return undefined
-  }
-  return cleaned
-}
-
 type RepoBasics = {
   readonly repoUrl: string
   readonly repoSlug: string
@@ -223,6 +208,8 @@ export const buildCreateCommand = (
     const forceEnv = raw.forceEnv ?? false
     const enableMcpPlaywright = raw.enableMcpPlaywright ?? false
     const gitTokenLabel = normalizeGitTokenLabel(raw.gitTokenLabel)
+    const codexAuthLabel = normalizeAuthLabel(raw.codexTokenLabel)
+    const claudeAuthLabel = normalizeAuthLabel(raw.claudeTokenLabel)
 
     return {
       _tag: "Create",
@@ -239,7 +226,9 @@ export const buildCreateCommand = (
         sshPort: repo.sshPort,
         repoUrl: repo.repoUrl,
         repoRef: repo.repoRef,
-        ...(gitTokenLabel === undefined ? {} : { gitTokenLabel }),
+        gitTokenLabel,
+        codexAuthLabel,
+        claudeAuthLabel,
         targetDir: repo.targetDir,
         volumeName: names.volumeName,
         dockerGitPath: paths.dockerGitPath,
diff --git a/packages/lib/src/core/command-options.ts b/packages/lib/src/core/command-options.ts
index ec89eedb..fcee059e 100644
--- a/packages/lib/src/core/command-options.ts
+++ b/packages/lib/src/core/command-options.ts
@@ -31,6 +31,8 @@ export interface RawOptions {
   readonly wipe?: boolean
   readonly label?: string
   readonly gitTokenLabel?: string
+  readonly codexTokenLabel?: string
+  readonly claudeTokenLabel?: string
   readonly token?: string
   readonly scopes?: string
   readonly message?: string
diff --git a/packages/lib/src/core/domain.ts b/packages/lib/src/core/domain.ts
index 451acbbe..31051746 100644
--- a/packages/lib/src/core/domain.ts
+++ b/packages/lib/src/core/domain.ts
@@ -11,6 +11,8 @@ export interface TemplateConfig {
   readonly repoRef: string
   readonly forkRepoUrl?: string
   readonly gitTokenLabel?: string | undefined
+  readonly codexAuthLabel?: string | undefined
+  readonly claudeAuthLabel?: string | undefined
   readonly targetDir: string
   readonly volumeName: string
   readonly dockerGitPath: string
@@ -106,6 +108,16 @@ export interface McpPlaywrightUpCommand {
   readonly runUp: boolean
 }
 
+export interface ApplyCommand {
+  readonly _tag: "Apply"
+  readonly projectDir: string
+  readonly runUp: boolean
+  readonly gitTokenLabel?: string | undefined
+  readonly codexTokenLabel?: string | undefined
+  readonly claudeTokenLabel?: string | undefined
+  readonly enableMcpPlaywright?: boolean | undefined
+}
+
 export interface HelpCommand {
   readonly _tag: "Help"
   readonly message: string
@@ -243,6 +255,7 @@ export type Command =
   | SessionsCommand
   | ScrapCommand
   | McpPlaywrightUpCommand
+  | ApplyCommand
   | HelpCommand
   | StatusCommand
   | DownAllCommand
diff --git a/packages/lib/src/core/templates-entrypoint/base.ts b/packages/lib/src/core/templates-entrypoint/base.ts
index 9214e89e..bfe31b07 100644
--- a/packages/lib/src/core/templates-entrypoint/base.ts
+++ b/packages/lib/src/core/templates-entrypoint/base.ts
@@ -15,6 +15,7 @@ elif [[ "$TARGET_DIR" == "~/"* ]]; then
   TARGET_DIR="$HOME\${TARGET_DIR:1}"
 fi
 CLAUDE_AUTH_LABEL="\${CLAUDE_AUTH_LABEL:-}"
+CODEX_AUTH_LABEL="\${CODEX_AUTH_LABEL:-}"
 GIT_AUTH_USER="\${GIT_AUTH_USER:-\${GITHUB_USER:-x-access-token}}"
 GIT_AUTH_TOKEN="\${GIT_AUTH_TOKEN:-\${GITHUB_TOKEN:-\${GH_TOKEN:-}}}"
 GH_TOKEN="\${GH_TOKEN:-\${GIT_AUTH_TOKEN:-}}"
diff --git a/packages/lib/src/core/templates-entrypoint/claude.ts b/packages/lib/src/core/templates-entrypoint/claude.ts
index ed60f731..bf76daab 100644
--- a/packages/lib/src/core/templates-entrypoint/claude.ts
+++ b/packages/lib/src/core/templates-entrypoint/claude.ts
@@ -2,7 +2,7 @@ import type { TemplateConfig } from "../domain.js"
 
 const claudeAuthRootContainerPath = (sshUser: string): string => `/home/${sshUser}/.docker-git/.orch/auth/claude`
 
-export const renderEntrypointClaudeConfig = (config: TemplateConfig): string =>
+const renderClaudeAuthConfig = (config: TemplateConfig): string =>
   String
     .raw`# Claude Code: expose CLAUDE_CONFIG_DIR for SSH sessions (OAuth cache lives under ~/.docker-git/.orch/auth/claude)
 CLAUDE_LABEL_RAW="$CLAUDE_AUTH_LABEL"
@@ -24,20 +24,67 @@ export CLAUDE_CONFIG_DIR
 mkdir -p "$CLAUDE_CONFIG_DIR" || true
 
 CLAUDE_TOKEN_FILE="$CLAUDE_CONFIG_DIR/.oauth-token"
-CLAUDE_CODE_OAUTH_TOKEN=""
+docker_git_refresh_claude_oauth_token() {
+  local token=""
+  if [[ -f "$CLAUDE_TOKEN_FILE" ]]; then
+    token="$(tr -d '\r\n' < "$CLAUDE_TOKEN_FILE")"
+  fi
+  export CLAUDE_CODE_OAUTH_TOKEN="$token"
+}
+
+docker_git_refresh_claude_oauth_token`
+
+const renderClaudeWrapperSetup = (): string =>
+  String.raw`CLAUDE_REAL_BIN="/usr/local/bin/.docker-git-claude-real"
+CLAUDE_WRAPPER_BIN="/usr/local/bin/claude"
+if command -v claude >/dev/null 2>&1; then
+  CURRENT_CLAUDE_BIN="$(command -v claude)"
+  if [[ "$CURRENT_CLAUDE_BIN" != "$CLAUDE_REAL_BIN" && ! -f "$CLAUDE_REAL_BIN" ]]; then
+    mv "$CURRENT_CLAUDE_BIN" "$CLAUDE_REAL_BIN"
+  fi
+  if [[ -f "$CLAUDE_REAL_BIN" ]]; then
+    cat <<'EOF' > "$CLAUDE_WRAPPER_BIN"
+#!/usr/bin/env bash
+set -euo pipefail
+
+CLAUDE_REAL_BIN="/usr/local/bin/.docker-git-claude-real"
+CLAUDE_CONFIG_DIR="${"$"}{CLAUDE_CONFIG_DIR:-$HOME/.claude}"
+CLAUDE_TOKEN_FILE="$CLAUDE_CONFIG_DIR/.oauth-token"
+
 if [[ -f "$CLAUDE_TOKEN_FILE" ]]; then
   CLAUDE_CODE_OAUTH_TOKEN="$(tr -d '\r\n' < "$CLAUDE_TOKEN_FILE")"
+  export CLAUDE_CODE_OAUTH_TOKEN
+else
+  unset CLAUDE_CODE_OAUTH_TOKEN || true
 fi
-export CLAUDE_CODE_OAUTH_TOKEN
 
-CLAUDE_PROFILE="/etc/profile.d/claude-config.sh"
+exec "$CLAUDE_REAL_BIN" "$@"
+EOF
+    chmod 0755 "$CLAUDE_WRAPPER_BIN" || true
+  fi
+fi`
+
+const renderClaudeProfileSetup = (): string =>
+  String.raw`CLAUDE_PROFILE="/etc/profile.d/claude-config.sh"
 printf "export CLAUDE_AUTH_LABEL=%q\n" "$CLAUDE_AUTH_LABEL" > "$CLAUDE_PROFILE"
 printf "export CLAUDE_CONFIG_DIR=%q\n" "$CLAUDE_CONFIG_DIR" >> "$CLAUDE_PROFILE"
-if [[ -n "$CLAUDE_CODE_OAUTH_TOKEN" ]]; then
-  printf "export CLAUDE_CODE_OAUTH_TOKEN=%q\n" "$CLAUDE_CODE_OAUTH_TOKEN" >> "$CLAUDE_PROFILE"
+cat <<'EOF' >> "$CLAUDE_PROFILE"
+CLAUDE_TOKEN_FILE="${"$"}{CLAUDE_CONFIG_DIR:-$HOME/.claude}/.oauth-token"
+if [[ -f "$CLAUDE_TOKEN_FILE" ]]; then
+  export CLAUDE_CODE_OAUTH_TOKEN="$(tr -d '\r\n' < "$CLAUDE_TOKEN_FILE")"
+else
+  unset CLAUDE_CODE_OAUTH_TOKEN || true
 fi
+EOF
 chmod 0644 "$CLAUDE_PROFILE" || true
 
 docker_git_upsert_ssh_env "CLAUDE_AUTH_LABEL" "$CLAUDE_AUTH_LABEL"
 docker_git_upsert_ssh_env "CLAUDE_CONFIG_DIR" "$CLAUDE_CONFIG_DIR"
 docker_git_upsert_ssh_env "CLAUDE_CODE_OAUTH_TOKEN" "$CLAUDE_CODE_OAUTH_TOKEN"`
+
+export const renderEntrypointClaudeConfig = (config: TemplateConfig): string =>
+  [
+    renderClaudeAuthConfig(config),
+    renderClaudeWrapperSetup(),
+    renderClaudeProfileSetup()
+  ].join("\n\n")
diff --git a/packages/lib/src/core/templates-entrypoint/codex.ts b/packages/lib/src/core/templates-entrypoint/codex.ts
index 6578c3fb..93c1eb44 100644
--- a/packages/lib/src/core/templates-entrypoint/codex.ts
+++ b/packages/lib/src/core/templates-entrypoint/codex.ts
@@ -15,13 +15,22 @@ export const renderEntrypointCodexSharedAuth = (config: TemplateConfig): string
   `# Share Codex auth.json across projects (avoids refresh_token_reused)
 CODEX_SHARE_AUTH="\${CODEX_SHARE_AUTH:-1}"
 if [[ "$CODEX_SHARE_AUTH" == "1" ]]; then
+  CODEX_LABEL_RAW="$CODEX_AUTH_LABEL"
+  if [[ -z "$CODEX_LABEL_RAW" ]]; then CODEX_LABEL_RAW="default"; fi
+  CODEX_LABEL_NORM="$(printf "%s" "$CODEX_LABEL_RAW" \
+    | tr '[:upper:]' '[:lower:]' \
+    | sed -E 's/[^a-z0-9]+/-/g; s/^-+//; s/-+$//')"
+  if [[ -z "$CODEX_LABEL_NORM" ]]; then CODEX_LABEL_NORM="default"; fi
+  CODEX_AUTH_LABEL="$CODEX_LABEL_NORM"
   CODEX_SHARED_HOME="${config.codexHome}-shared"
   mkdir -p "$CODEX_SHARED_HOME"
   chown -R 1000:1000 "$CODEX_SHARED_HOME" || true
-
   AUTH_FILE="${config.codexHome}/auth.json"
   SHARED_AUTH_FILE="$CODEX_SHARED_HOME/auth.json"
-
+  if [[ "$CODEX_LABEL_NORM" != "default" ]]; then
+    SHARED_AUTH_FILE="$CODEX_SHARED_HOME/$CODEX_LABEL_NORM/auth.json"
+    mkdir -p "$(dirname "$SHARED_AUTH_FILE")"
+  fi
   # Guard against a bad bind mount creating a directory at auth.json.
   if [[ -d "$AUTH_FILE" ]]; then
     mv "$AUTH_FILE" "$AUTH_FILE.bak-$(date +%s)" || true
@@ -29,8 +38,8 @@ if [[ "$CODEX_SHARE_AUTH" == "1" ]]; then
   if [[ -e "$AUTH_FILE" && ! -L "$AUTH_FILE" ]]; then
     rm -f "$AUTH_FILE" || true
   fi
-
   ln -sf "$SHARED_AUTH_FILE" "$AUTH_FILE"
+  docker_git_upsert_ssh_env "CODEX_AUTH_LABEL" "$CODEX_AUTH_LABEL"
 fi`
 
 const entrypointMcpPlaywrightTemplate = String.raw`# Optional: configure Playwright MCP for Codex (browser automation)
diff --git a/packages/lib/src/core/templates-entrypoint/git.ts b/packages/lib/src/core/templates-entrypoint/git.ts
index d5d9c125..4f9fc348 100644
--- a/packages/lib/src/core/templates-entrypoint/git.ts
+++ b/packages/lib/src/core/templates-entrypoint/git.ts
@@ -1,6 +1,6 @@
 import type { TemplateConfig } from "../domain.js"
 
-const renderEntrypointAuthEnvBridge = (config: TemplateConfig): string =>
+const renderAuthLabelResolution = (): string =>
   String.raw`# 2) Ensure GitHub auth vars are available for SSH sessions.
 # Prefer a label-selected token (same selection model as clone/create) when present.
 RESOLVED_AUTH_LABEL=""
@@ -15,9 +15,10 @@ if [[ -n "$AUTH_LABEL_RAW" ]]; then
   if [[ "$RESOLVED_AUTH_LABEL" == "DEFAULT" ]]; then
     RESOLVED_AUTH_LABEL=""
   fi
-fi
+fi`
 
-EFFECTIVE_GITHUB_TOKEN="$GITHUB_TOKEN"
+const renderEffectiveTokenResolution = (): string =>
+  String.raw`EFFECTIVE_GITHUB_TOKEN="$GITHUB_TOKEN"
 if [[ -z "$EFFECTIVE_GITHUB_TOKEN" ]]; then
   EFFECTIVE_GITHUB_TOKEN="$GH_TOKEN"
 fi
@@ -41,9 +42,10 @@ if [[ -n "$RESOLVED_AUTH_LABEL" ]]; then
   elif [[ -n "$LABELED_GH_TOKEN" ]]; then
     EFFECTIVE_GITHUB_TOKEN="$LABELED_GH_TOKEN"
   fi
-fi
+fi`
 
-EFFECTIVE_GH_TOKEN="$EFFECTIVE_GITHUB_TOKEN"
+const renderAuthBridgeFinalize = (config: TemplateConfig): string =>
+  String.raw`EFFECTIVE_GH_TOKEN="$EFFECTIVE_GITHUB_TOKEN"
 
 if [[ -n "$EFFECTIVE_GH_TOKEN" ]]; then
   printf "export GH_TOKEN=%q\n" "$EFFECTIVE_GH_TOKEN" > /etc/profile.d/gh-token.sh
@@ -71,6 +73,13 @@ if [[ -n "$EFFECTIVE_GH_TOKEN" ]]; then
   fi
 fi`
 
+const renderEntrypointAuthEnvBridge = (config: TemplateConfig): string =>
+  [
+    renderAuthLabelResolution(),
+    renderEffectiveTokenResolution(),
+    renderAuthBridgeFinalize(config)
+  ].join("\n\n")
+
 const renderEntrypointGitCredentialHelper = (config: TemplateConfig): string =>
   String.raw`# 3) Configure git credential helper for HTTPS remotes
 GIT_CREDENTIAL_HELPER_PATH="/usr/local/bin/docker-git-credential-helper"
diff --git a/packages/lib/src/core/templates-entrypoint/tasks.ts b/packages/lib/src/core/templates-entrypoint/tasks.ts
index e669d5c7..50fde1dd 100644
--- a/packages/lib/src/core/templates-entrypoint/tasks.ts
+++ b/packages/lib/src/core/templates-entrypoint/tasks.ts
@@ -31,7 +31,7 @@ const renderCloneRemotes = (config: TemplateConfig): string =>
   fi
 fi`
 
-const renderCloneBodyStart = (config: TemplateConfig): string =>
+const renderCloneGuard = (config: TemplateConfig): string =>
   `if [[ -z "$REPO_URL" ]]; then
   echo "[clone] skip (no repo url)"
 elif [[ -d "$TARGET_DIR/.git" ]]; then
@@ -41,9 +41,10 @@ else
   if [[ "$TARGET_DIR" != "/" ]]; then
     chown -R 1000:1000 "$TARGET_DIR"
   fi
-  chown -R 1000:1000 /home/${config.sshUser}
+  chown -R 1000:1000 /home/${config.sshUser}`
 
-  RESOLVED_GIT_AUTH_USER="$GIT_AUTH_USER"
+const renderCloneAuthSelection = (): string =>
+  `  RESOLVED_GIT_AUTH_USER="$GIT_AUTH_USER"
   RESOLVED_GIT_AUTH_TOKEN="$GIT_AUTH_TOKEN"
   RESOLVED_GIT_AUTH_LABEL=""
   GIT_TOKEN_LABEL_RAW="\${GIT_AUTH_LABEL:-\${GITHUB_AUTH_LABEL:-}}"
@@ -77,14 +78,16 @@ else
     if [[ -n "$LABELED_GIT_USER" ]]; then
       RESOLVED_GIT_AUTH_USER="$LABELED_GIT_USER"
     fi
-  fi
+  fi`
 
-  AUTH_REPO_URL="$REPO_URL"
+const renderCloneAuthRepoUrl = (): string =>
+  `  AUTH_REPO_URL="$REPO_URL"
   if [[ -n "$RESOLVED_GIT_AUTH_TOKEN" && "$REPO_URL" == https://* ]]; then
     AUTH_REPO_URL="$(printf "%s" "$REPO_URL" | sed "s#^https://#https://\${RESOLVED_GIT_AUTH_USER}:\${RESOLVED_GIT_AUTH_TOKEN}@#")"
-  fi
+  fi`
 
-  CLONE_CACHE_ARGS=""
+const renderCloneCacheInit = (config: TemplateConfig): string =>
+  `  CLONE_CACHE_ARGS=""
   CACHE_REPO_DIR=""
   CACHE_ROOT="/home/${config.sshUser}/.docker-git/.cache/git-mirrors"
   if command -v sha256sum >/dev/null 2>&1; then
@@ -113,6 +116,14 @@ else
     fi
   fi`
 
+const renderCloneBodyStart = (config: TemplateConfig): string =>
+  [
+    renderCloneGuard(config),
+    renderCloneAuthSelection(),
+    renderCloneAuthRepoUrl(),
+    renderCloneCacheInit(config)
+  ].join("\n\n")
+
 const renderCloneBodyRef = (config: TemplateConfig): string =>
   `  if [[ -n "$REPO_REF" ]]; then
     if [[ "$REPO_REF" == refs/pull/* ]]; then
diff --git a/packages/lib/src/core/templates/docker-compose.ts b/packages/lib/src/core/templates/docker-compose.ts
index 731c5c3d..484c0399 100644
--- a/packages/lib/src/core/templates/docker-compose.ts
+++ b/packages/lib/src/core/templates/docker-compose.ts
@@ -1,42 +1,105 @@
 import type { TemplateConfig } from "../domain.js"
 
-export const renderDockerCompose = (config: TemplateConfig): string => {
-  const networkName = `${config.serviceName}-net`
-  const forkRepoUrl = config.forkRepoUrl ?? ""
-  const gitTokenLabel = config.gitTokenLabel?.trim() ?? ""
-  const maybeGitTokenLabelEnv = gitTokenLabel.length > 0
+type ComposeFragments = {
+  readonly networkName: string
+  readonly maybeGitTokenLabelEnv: string
+  readonly maybeCodexAuthLabelEnv: string
+  readonly maybeClaudeAuthLabelEnv: string
+  readonly maybeDependsOn: string
+  readonly maybePlaywrightEnv: string
+  readonly maybeBrowserService: string
+  readonly maybeBrowserVolume: string
+  readonly forkRepoUrl: string
+}
+
+type PlaywrightFragments = Pick<
+  ComposeFragments,
+  "maybeDependsOn" | "maybePlaywrightEnv" | "maybeBrowserService" | "maybeBrowserVolume"
+>
+
+const renderGitTokenLabelEnv = (gitTokenLabel: string): string =>
+  gitTokenLabel.length > 0
     ? `      GITHUB_AUTH_LABEL: "${gitTokenLabel}"\n      GIT_AUTH_LABEL: "${gitTokenLabel}"\n`
     : ""
 
+const renderCodexAuthLabelEnv = (codexAuthLabel: string): string =>
+  codexAuthLabel.length > 0
+    ? `      CODEX_AUTH_LABEL: "${codexAuthLabel}"\n`
+    : ""
+
+const renderClaudeAuthLabelEnv = (claudeAuthLabel: string): string =>
+  claudeAuthLabel.length > 0
+    ? `      CLAUDE_AUTH_LABEL: "${claudeAuthLabel}"\n`
+    : ""
+
+const buildPlaywrightFragments = (
+  config: TemplateConfig,
+  networkName: string
+): PlaywrightFragments => {
+  if (!config.enableMcpPlaywright) {
+    return {
+      maybeDependsOn: "",
+      maybePlaywrightEnv: "",
+      maybeBrowserService: "",
+      maybeBrowserVolume: ""
+    }
+  }
+
   const browserServiceName = `${config.serviceName}-browser`
   const browserContainerName = `${config.containerName}-browser`
   const browserVolumeName = `${config.volumeName}-browser`
   const browserDockerfile = "Dockerfile.browser"
   const browserCdpEndpoint = `http://${browserServiceName}:9223`
 
-  const maybeDependsOn = config.enableMcpPlaywright
-    ? `    depends_on:\n      - ${browserServiceName}\n`
-    : ""
-  const maybePlaywrightEnv = config.enableMcpPlaywright
-    ? `      MCP_PLAYWRIGHT_ENABLE: "1"\n      MCP_PLAYWRIGHT_CDP_ENDPOINT: "${browserCdpEndpoint}"\n`
-    : ""
-  const maybeBrowserService = config.enableMcpPlaywright
-    ? `\n  ${browserServiceName}:\n    build:\n      context: .\n      dockerfile: ${browserDockerfile}\n    container_name: ${browserContainerName}\n    environment:\n      VNC_NOPW: "1"\n    shm_size: "2gb"\n    expose:\n      - "9223"\n    volumes:\n      - ${browserVolumeName}:/data\n    networks:\n      - ${networkName}\n`
-    : ""
-  const maybeBrowserVolume = config.enableMcpPlaywright ? `  ${browserVolumeName}:\n` : ""
+  return {
+    maybeDependsOn: `    depends_on:\n      - ${browserServiceName}\n`,
+    maybePlaywrightEnv:
+      `      MCP_PLAYWRIGHT_ENABLE: "1"\n      MCP_PLAYWRIGHT_CDP_ENDPOINT: "${browserCdpEndpoint}"\n`,
+    maybeBrowserService:
+      `\n  ${browserServiceName}:\n    build:\n      context: .\n      dockerfile: ${browserDockerfile}\n    container_name: ${browserContainerName}\n    environment:\n      VNC_NOPW: "1"\n    shm_size: "2gb"\n    expose:\n      - "9223"\n    volumes:\n      - ${browserVolumeName}:/data\n    networks:\n      - ${networkName}\n`,
+    maybeBrowserVolume: `  ${browserVolumeName}:\n`
+  }
+}
+
+const buildComposeFragments = (config: TemplateConfig): ComposeFragments => {
+  const networkName = `${config.serviceName}-net`
+  const forkRepoUrl = config.forkRepoUrl ?? ""
+  const gitTokenLabel = config.gitTokenLabel?.trim() ?? ""
+  const codexAuthLabel = config.codexAuthLabel?.trim() ?? ""
+  const claudeAuthLabel = config.claudeAuthLabel?.trim() ?? ""
+  const maybeGitTokenLabelEnv = renderGitTokenLabelEnv(gitTokenLabel)
+  const maybeCodexAuthLabelEnv = renderCodexAuthLabelEnv(codexAuthLabel)
+  const maybeClaudeAuthLabelEnv = renderClaudeAuthLabelEnv(claudeAuthLabel)
+  const playwright = buildPlaywrightFragments(config, networkName)
+
+  return {
+    networkName,
+    maybeGitTokenLabelEnv,
+    maybeCodexAuthLabelEnv,
+    maybeClaudeAuthLabelEnv,
+    maybeDependsOn: playwright.maybeDependsOn,
+    maybePlaywrightEnv: playwright.maybePlaywrightEnv,
+    maybeBrowserService: playwright.maybeBrowserService,
+    maybeBrowserVolume: playwright.maybeBrowserVolume,
+    forkRepoUrl
+  }
+}
 
-  return `services:
+const renderComposeServices = (config: TemplateConfig, fragments: ComposeFragments): string =>
+  `services:
   ${config.serviceName}:
     build: .
     container_name: ${config.containerName}
     environment:
       REPO_URL: "${config.repoUrl}"
       REPO_REF: "${config.repoRef}"
-      FORK_REPO_URL: "${forkRepoUrl}"
-${maybeGitTokenLabelEnv}      # Optional token label selector (maps to GITHUB_TOKEN__<LABEL>/GIT_AUTH_TOKEN__<LABEL>)
+      FORK_REPO_URL: "${fragments.forkRepoUrl}"
+${fragments.maybeGitTokenLabelEnv}      # Optional token label selector (maps to GITHUB_TOKEN__<LABEL>/GIT_AUTH_TOKEN__<LABEL>)
+${fragments.maybeCodexAuthLabelEnv}      # Optional Codex account label selector (maps to CODEX_AUTH_LABEL)
+${fragments.maybeClaudeAuthLabelEnv}      # Optional Claude account label selector (maps to CLAUDE_AUTH_LABEL)
       TARGET_DIR: "${config.targetDir}"
       CODEX_HOME: "${config.codexHome}"
-${maybePlaywrightEnv}${maybeDependsOn}    env_file:
+${fragments.maybePlaywrightEnv}${fragments.maybeDependsOn}    env_file:
       - ${config.envGlobalPath}
       - ${config.envProjectPath}
     ports:
@@ -49,14 +112,24 @@ ${maybePlaywrightEnv}${maybeDependsOn}    env_file:
       - ${config.codexSharedAuthPath}:${config.codexHome}-shared
       - /var/run/docker.sock:/var/run/docker.sock
     networks:
-      - ${networkName}
-${maybeBrowserService}
+      - ${fragments.networkName}
+${fragments.maybeBrowserService}`
 
-networks:
+const renderComposeNetworks = (networkName: string): string =>
+  `networks:
   ${networkName}:
-    driver: bridge
+    driver: bridge`
 
-volumes:
+const renderComposeVolumes = (config: TemplateConfig, maybeBrowserVolume: string): string =>
+  `volumes:
   ${config.volumeName}:
 ${maybeBrowserVolume}`
+
+export const renderDockerCompose = (config: TemplateConfig): string => {
+  const fragments = buildComposeFragments(config)
+  return [
+    renderComposeServices(config, fragments),
+    renderComposeNetworks(fragments.networkName),
+    renderComposeVolumes(config, fragments.maybeBrowserVolume)
+  ].join("\n\n")
 }
diff --git a/packages/lib/src/core/token-labels.ts b/packages/lib/src/core/token-labels.ts
new file mode 100644
index 00000000..2258f431
--- /dev/null
+++ b/packages/lib/src/core/token-labels.ts
@@ -0,0 +1,51 @@
+import { trimLeftChar, trimRightChar } from "./strings.js"
+
+const trimEdgeUnderscores = (value: string): string => {
+  let start = 0
+  while (start < value.length && value[start] === "_") {
+    start += 1
+  }
+
+  let end = value.length
+  while (end > start && value[end - 1] === "_") {
+    end -= 1
+  }
+  return value.slice(start, end)
+}
+
+const trimEdgeHyphens = (value: string): string => {
+  const withoutLeading = trimLeftChar(value, "-")
+  return trimRightChar(withoutLeading, "-")
+}
+
+export const normalizeGitTokenLabel = (value: string | undefined): string | undefined => {
+  const trimmed = value?.trim() ?? ""
+  if (trimmed.length === 0) {
+    return undefined
+  }
+
+  const normalized = trimmed
+    .toUpperCase()
+    .replaceAll(/[^A-Z0-9]+/g, "_")
+  const cleaned = trimEdgeUnderscores(normalized)
+  if (cleaned.length === 0 || cleaned === "DEFAULT") {
+    return undefined
+  }
+  return cleaned
+}
+
+export const normalizeAuthLabel = (value: string | undefined): string | undefined => {
+  const trimmed = value?.trim() ?? ""
+  if (trimmed.length === 0) {
+    return undefined
+  }
+
+  const normalized = trimmed
+    .toLowerCase()
+    .replaceAll(/[^a-z0-9]+/g, "-")
+  const cleaned = trimEdgeHyphens(normalized)
+  if (cleaned.length === 0 || cleaned === "default") {
+    return undefined
+  }
+  return cleaned
+}
diff --git a/packages/lib/src/shell/config.ts b/packages/lib/src/shell/config.ts
index 710a9a43..1deed16a 100644
--- a/packages/lib/src/shell/config.ts
+++ b/packages/lib/src/shell/config.ts
@@ -18,6 +18,8 @@ const TemplateConfigSchema = Schema.Struct({
   repoUrl: Schema.String,
   repoRef: Schema.String,
   gitTokenLabel: Schema.optional(Schema.String),
+  codexAuthLabel: Schema.optional(Schema.String),
+  claudeAuthLabel: Schema.optional(Schema.String),
   targetDir: Schema.String,
   volumeName: Schema.String,
   dockerGitPath: Schema.optionalWith(Schema.String, {
diff --git a/packages/lib/src/usecases/apply-overrides.ts b/packages/lib/src/usecases/apply-overrides.ts
new file mode 100644
index 00000000..86a3adf5
--- /dev/null
+++ b/packages/lib/src/usecases/apply-overrides.ts
@@ -0,0 +1,46 @@
+import type { ApplyCommand, TemplateConfig } from "../core/domain.js"
+import { normalizeAuthLabel, normalizeGitTokenLabel } from "../core/token-labels.js"
+
+export const hasApplyOverrides = (command: ApplyCommand): boolean =>
+  command.gitTokenLabel !== undefined ||
+  command.codexTokenLabel !== undefined ||
+  command.claudeTokenLabel !== undefined ||
+  command.enableMcpPlaywright !== undefined
+
+export const applyTemplateOverrides = (
+  template: TemplateConfig,
+  command: ApplyCommand | undefined
+): TemplateConfig => {
+  if (command === undefined) {
+    return template
+  }
+
+  let nextTemplate = template
+
+  if (command.gitTokenLabel !== undefined) {
+    nextTemplate = {
+      ...nextTemplate,
+      gitTokenLabel: normalizeGitTokenLabel(command.gitTokenLabel)
+    }
+  }
+  if (command.codexTokenLabel !== undefined) {
+    nextTemplate = {
+      ...nextTemplate,
+      codexAuthLabel: normalizeAuthLabel(command.codexTokenLabel)
+    }
+  }
+  if (command.claudeTokenLabel !== undefined) {
+    nextTemplate = {
+      ...nextTemplate,
+      claudeAuthLabel: normalizeAuthLabel(command.claudeTokenLabel)
+    }
+  }
+  if (command.enableMcpPlaywright !== undefined) {
+    nextTemplate = {
+      ...nextTemplate,
+      enableMcpPlaywright: command.enableMcpPlaywright
+    }
+  }
+
+  return nextTemplate
+}
diff --git a/packages/lib/src/usecases/apply.ts b/packages/lib/src/usecases/apply.ts
new file mode 100644
index 00000000..40f22b6a
--- /dev/null
+++ b/packages/lib/src/usecases/apply.ts
@@ -0,0 +1,355 @@
+import type { CommandExecutor } from "@effect/platform/CommandExecutor"
+import type { PlatformError } from "@effect/platform/Error"
+import type { FileSystem } from "@effect/platform/FileSystem"
+import type { Path } from "@effect/platform/Path"
+import { Effect } from "effect"
+
+import { type ApplyCommand, deriveRepoPathParts, type TemplateConfig } from "../core/domain.js"
+import { parseGithubRepoUrl } from "../core/repo.js"
+import { runCommandCapture, runCommandExitCode } from "../shell/command-runner.js"
+import { readProjectConfig } from "../shell/config.js"
+import { ensureDockerDaemonAccess } from "../shell/docker.js"
+import type * as ShellErrors from "../shell/errors.js"
+import { writeProjectFiles } from "../shell/files.js"
+import { resolveBaseDir } from "../shell/paths.js"
+import { applyTemplateOverrides, hasApplyOverrides } from "./apply-overrides.js"
+import { ensureCodexConfigFile } from "./auth-sync.js"
+import { findDockerGitConfigPaths } from "./docker-git-config-search.js"
+import { defaultProjectsRoot, findExistingUpwards } from "./path-helpers.js"
+import { runDockerComposeUpWithPortCheck } from "./projects-up.js"
+
+type ApplyProjectFilesError =
+  | ShellErrors.ConfigNotFoundError
+  | ShellErrors.ConfigDecodeError
+  | ShellErrors.FileExistsError
+  | PlatformError
+type ApplyProjectFilesEnv = FileSystem | Path
+
+// CHANGE: apply existing docker-git.json to managed files in an already created project
+// WHY: allow updating current project/container config without creating a new project directory
+// QUOTE(ТЗ): "Не создавать новый... а прямо в текущем обновить её на актуальную"
+// REF: issue-72-followup-apply-current-config
+// SOURCE: n/a
+// FORMAT THEOREM: forall p: apply_files(p) -> files(p) = plan(read_config(p))
+// PURITY: SHELL
+// EFFECT: Effect<TemplateConfig, ConfigNotFoundError | ConfigDecodeError | FileExistsError | PlatformError, FileSystem | Path>
+// INVARIANT: rewrites only managed files from docker-git.json
+// COMPLEXITY: O(n) where n = |managed_files|
+export const applyProjectFiles = (
+  projectDir: string,
+  command?: ApplyCommand
+): Effect.Effect<TemplateConfig, ApplyProjectFilesError, ApplyProjectFilesEnv> =>
+  Effect.gen(function*(_) {
+    yield* _(Effect.log(`Applying docker-git config files in ${projectDir}...`))
+    const config = yield* _(readProjectConfig(projectDir))
+    const resolvedTemplate = applyTemplateOverrides(config.template, command)
+    yield* _(writeProjectFiles(projectDir, resolvedTemplate, true))
+    yield* _(ensureCodexConfigFile(projectDir, resolvedTemplate.codexAuthPath))
+    return resolvedTemplate
+  })
+
+export type ApplyProjectConfigError =
+  | ApplyProjectFilesError
+  | ShellErrors.DockerAccessError
+  | ShellErrors.DockerCommandError
+  | ShellErrors.PortProbeError
+
+type ApplyProjectConfigEnv = ApplyProjectFilesEnv | CommandExecutor
+
+type RepoIdentity = {
+  readonly fullPath: string
+  readonly repo: string
+}
+
+type ProjectCandidate = {
+  readonly projectDir: string
+  readonly repoUrl: string
+  readonly repoRef: string
+}
+
+const gitSuccessExitCode = 0
+const gitBranchDetached = "HEAD"
+const maxLocalConfigSearchDepth = 6
+const gitBaseEnv: Readonly<Record<string, string>> = {
+  GIT_TERMINAL_PROMPT: "0"
+}
+
+const emptyConfigPaths = (): ReadonlyArray<string> => []
+const nullProjectCandidate = (): ProjectCandidate | null => null
+const nullString = (): string | null => null
+
+const normalizeRepoIdentity = (repoUrl: string): RepoIdentity => {
+  const github = parseGithubRepoUrl(repoUrl)
+  if (github !== null) {
+    const owner = github.owner.trim().toLowerCase()
+    const repo = github.repo.trim().toLowerCase()
+    return { fullPath: `${owner}/${repo}`, repo }
+  }
+
+  const parts = deriveRepoPathParts(repoUrl)
+  const normalizedParts = parts.pathParts.map((part) => part.toLowerCase())
+  const repo = parts.repo.toLowerCase()
+  return {
+    fullPath: normalizedParts.join("/"),
+    repo
+  }
+}
+
+const toProjectDirBaseName = (projectDir: string): string => {
+  const normalized = projectDir.replaceAll("\\", "/")
+  const parts = normalized.split("/").filter((part) => part.length > 0)
+  return parts.at(-1)?.toLowerCase() ?? ""
+}
+
+const parsePrRefFromBranch = (branch: string): string | null => {
+  const prefix = "pr-"
+  if (!branch.toLowerCase().startsWith(prefix)) {
+    return null
+  }
+  const id = branch.slice(prefix.length).trim()
+  return id.length > 0 ? `refs/pull/${id}/head` : null
+}
+
+const scoreBranchMatch = (
+  branch: string | null,
+  candidate: ProjectCandidate
+): number => {
+  if (branch === null) {
+    return 0
+  }
+
+  const branchLower = branch.toLowerCase()
+  const candidateRef = candidate.repoRef.toLowerCase()
+  const prRef = parsePrRefFromBranch(branchLower)
+  const branchRefScore = candidateRef === branchLower ? 8 : 0
+  const prRefScore = prRef !== null && candidateRef === prRef.toLowerCase() ? 8 : 0
+  const dirNameScore = toProjectDirBaseName(candidate.projectDir) === branchLower ? 5 : 0
+  return branchRefScore + prRefScore + dirNameScore
+}
+
+const scoreCandidate = (
+  remoteIdentities: ReadonlyArray<RepoIdentity>,
+  branch: string | null,
+  candidate: ProjectCandidate
+): number => {
+  const candidateIdentity = normalizeRepoIdentity(candidate.repoUrl)
+  const hasFullPathMatch = remoteIdentities.some((remote) => remote.fullPath === candidateIdentity.fullPath)
+  const hasRepoMatch = remoteIdentities.some((remote) => remote.repo === candidateIdentity.repo)
+  if (!hasFullPathMatch && !hasRepoMatch) {
+    return 0
+  }
+
+  const repoScore = hasFullPathMatch ? 100 : 10
+  return repoScore + scoreBranchMatch(branch, candidate)
+}
+
+const selectCandidateProjectDir = (
+  remoteIdentities: ReadonlyArray<RepoIdentity>,
+  branch: string | null,
+  candidates: ReadonlyArray<ProjectCandidate>
+): string | null => {
+  const scored = candidates
+    .map((candidate) => ({ candidate, score: scoreCandidate(remoteIdentities, branch, candidate) }))
+    .filter((entry) => entry.score > 0)
+
+  if (scored.length === 0) {
+    return null
+  }
+
+  const topScore = Math.max(...scored.map((entry) => entry.score))
+  const topCandidates = scored.filter((entry) => entry.score === topScore)
+  if (topCandidates.length !== 1) {
+    return null
+  }
+
+  return topCandidates[0]?.candidate.projectDir ?? null
+}
+
+const tryGitCapture = (
+  cwd: string,
+  args: ReadonlyArray<string>
+): Effect.Effect<string | null, never, CommandExecutor> => {
+  const spec = { cwd, command: "git", args, env: gitBaseEnv }
+
+  return runCommandExitCode(spec).pipe(
+    Effect.matchEffect({
+      onFailure: () => Effect.succeed<string | null>(null),
+      onSuccess: (exitCode) =>
+        exitCode === gitSuccessExitCode
+          ? runCommandCapture(spec, [gitSuccessExitCode], (code) => ({ _tag: "ApplyGitCaptureError", code })).pipe(
+            Effect.map((value) => value.trim()),
+            Effect.match({
+              onFailure: nullString,
+              onSuccess: (value) => value
+            })
+          )
+          : Effect.succeed<string | null>(null)
+    })
+  )
+}
+
+const listProjectCandidates = (
+  projectsRoot: string
+): Effect.Effect<ReadonlyArray<ProjectCandidate>, PlatformError, ApplyProjectFilesEnv> =>
+  Effect.gen(function*(_) {
+    const { fs, path, resolved } = yield* _(resolveBaseDir(projectsRoot))
+    const configPaths = yield* _(
+      findDockerGitConfigPaths(fs, path, resolved).pipe(
+        Effect.match({
+          onFailure: emptyConfigPaths,
+          onSuccess: (value) => value
+        })
+      )
+    )
+
+    const candidates: Array<ProjectCandidate> = []
+    for (const configPath of configPaths) {
+      const projectDir = path.dirname(configPath)
+      const candidate = yield* _(
+        readProjectConfig(projectDir).pipe(
+          Effect.match({
+            onFailure: nullProjectCandidate,
+            onSuccess: (config) => ({
+              projectDir,
+              repoUrl: config.template.repoUrl,
+              repoRef: config.template.repoRef
+            })
+          })
+        )
+      )
+      if (candidate !== null) {
+        candidates.push(candidate)
+      }
+    }
+
+    return candidates
+  })
+
+const collectRemoteIdentities = (
+  repoRoot: string
+): Effect.Effect<ReadonlyArray<RepoIdentity>, never, CommandExecutor> =>
+  Effect.gen(function*(_) {
+    const listedRemotes = yield* _(tryGitCapture(repoRoot, ["remote"]))
+    const dynamicNames = listedRemotes === null
+      ? []
+      : listedRemotes
+        .split(/\r?\n/)
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0)
+    const remoteNames = [...new Set([...dynamicNames, "origin", "upstream"])]
+    const urls: Array<string> = []
+
+    for (const remoteName of remoteNames) {
+      const url = yield* _(tryGitCapture(repoRoot, ["remote", "get-url", remoteName]))
+      if (url !== null && url.length > 0) {
+        urls.push(url)
+      }
+    }
+
+    const identityMap = new Map<string, RepoIdentity>()
+    for (const url of urls) {
+      const identity = normalizeRepoIdentity(url)
+      identityMap.set(`${identity.fullPath}|${identity.repo}`, identity)
+    }
+    return [...identityMap.values()]
+  })
+
+const resolveFromCurrentTree = (): Effect.Effect<string | null, PlatformError, ApplyProjectFilesEnv> =>
+  Effect.gen(function*(_) {
+    const { fs, path, resolved } = yield* _(resolveBaseDir("."))
+    const configPath = yield* _(
+      findExistingUpwards(fs, path, resolved, "docker-git.json", maxLocalConfigSearchDepth).pipe(
+        Effect.match({
+          onFailure: nullString,
+          onSuccess: (value) => value
+        })
+      )
+    )
+    return configPath === null ? null : path.dirname(configPath)
+  })
+
+const normalizeBranch = (branch: string | null): string | null => {
+  const normalized = branch?.trim() ?? ""
+  if (normalized.length === 0 || normalized === gitBranchDetached) {
+    return null
+  }
+  return normalized
+}
+
+const resolveFromCurrentRepository = (): Effect.Effect<string | null, PlatformError, ApplyProjectConfigEnv> =>
+  Effect.gen(function*(_) {
+    const cwd = process.cwd()
+    const repoRoot = yield* _(tryGitCapture(cwd, ["rev-parse", "--show-toplevel"]))
+    if (repoRoot === null) {
+      return null
+    }
+
+    const remoteIdentities = yield* _(collectRemoteIdentities(repoRoot))
+    if (remoteIdentities.length === 0) {
+      return null
+    }
+
+    const branch = normalizeBranch(yield* _(tryGitCapture(repoRoot, ["rev-parse", "--abbrev-ref", "HEAD"])))
+    const projectsRoot = defaultProjectsRoot(cwd)
+    const candidates = yield* _(listProjectCandidates(projectsRoot))
+    if (candidates.length === 0) {
+      return null
+    }
+
+    return selectCandidateProjectDir(remoteIdentities, branch, candidates)
+  })
+
+const resolveImplicitApplyProjectDir = (): Effect.Effect<string | null, PlatformError, ApplyProjectConfigEnv> =>
+  Effect.gen(function*(_) {
+    const localProjectDir = yield* _(resolveFromCurrentTree())
+    if (localProjectDir !== null) {
+      return localProjectDir
+    }
+    return yield* _(resolveFromCurrentRepository())
+  })
+
+const runApplyForProjectDir = (
+  projectDir: string,
+  command: ApplyCommand
+): Effect.Effect<TemplateConfig, ApplyProjectConfigError, ApplyProjectConfigEnv> =>
+  command.runUp ? applyProjectWithUp(projectDir, command) : applyProjectFiles(projectDir, command)
+
+const applyProjectWithUp = (
+  projectDir: string,
+  command: ApplyCommand
+): Effect.Effect<TemplateConfig, ApplyProjectConfigError, ApplyProjectConfigEnv> =>
+  Effect.gen(function*(_) {
+    yield* _(Effect.log(`Applying docker-git config and refreshing container in ${projectDir}...`))
+    yield* _(ensureDockerDaemonAccess(process.cwd()))
+    if (hasApplyOverrides(command)) {
+      yield* _(applyProjectFiles(projectDir, command))
+    }
+    return yield* _(runDockerComposeUpWithPortCheck(projectDir))
+  })
+
+// CHANGE: add command handler to apply docker-git config on an existing project
+// WHY: update current project/container config without running create/clone again
+// QUOTE(ТЗ): "Не создавать новый... а прямо в текущем обновить её на актуальную"
+// REF: issue-72-followup-apply-current-config
+// SOURCE: n/a
+// FORMAT THEOREM: forall c: apply(c) -> updated(project(c)) && (c.runUp -> container_refreshed(c))
+// PURITY: SHELL
+// EFFECT: Effect<TemplateConfig, ApplyProjectConfigError, FileSystem | Path | CommandExecutor>
+// INVARIANT: project path remains unchanged; command only updates managed artifacts
+// COMPLEXITY: O(n) + O(command)
+export const applyProjectConfig = (
+  command: ApplyCommand
+): Effect.Effect<TemplateConfig, ApplyProjectConfigError, ApplyProjectConfigEnv> =>
+  runApplyForProjectDir(command.projectDir, command).pipe(
+    Effect.catchTag("ConfigNotFoundError", (error) =>
+      command.projectDir === "."
+        ? Effect.gen(function*(_) {
+          const inferredProjectDir = yield* _(resolveImplicitApplyProjectDir())
+          if (inferredProjectDir === null) {
+            return yield* _(Effect.fail(error))
+          }
+          yield* _(Effect.log(`Auto-resolved docker-git project directory: ${inferredProjectDir}`))
+          return yield* _(runApplyForProjectDir(inferredProjectDir, command))
+        })
+        : Effect.fail(error))
+  )
diff --git a/packages/lib/src/usecases/docker-git-config-search.ts b/packages/lib/src/usecases/docker-git-config-search.ts
index 0eae6112..b5e34ab7 100644
--- a/packages/lib/src/usecases/docker-git-config-search.ts
+++ b/packages/lib/src/usecases/docker-git-config-search.ts
@@ -31,11 +31,10 @@ const processDockerGitEntry = (
     const resolved = path.join(dir, entry)
     const info = yield* _(
       fs.stat(resolved).pipe(
-        Effect.catchAll((error) =>
+        Effect.catchTag("SystemError", (error) =>
           isNotFoundStatError(error)
             ? Effect.succeed(null)
-            : Effect.fail(error)
-        )
+            : Effect.fail(error))
       )
     )
     if (info === null) {
diff --git a/packages/lib/tests/usecases/apply.test.ts b/packages/lib/tests/usecases/apply.test.ts
new file mode 100644
index 00000000..d4722968
--- /dev/null
+++ b/packages/lib/tests/usecases/apply.test.ts
@@ -0,0 +1,255 @@
+import * as Command from "@effect/platform/Command"
+import * as FileSystem from "@effect/platform/FileSystem"
+import * as Path from "@effect/platform/Path"
+import { NodeContext } from "@effect/platform-node"
+import { describe, expect, it } from "@effect/vitest"
+import { Effect } from "effect"
+
+import type { TemplateConfig } from "../../src/core/domain.js"
+import { applyProjectConfig, applyProjectFiles } from "../../src/usecases/apply.js"
+import { prepareProjectFiles } from "../../src/usecases/actions/prepare-files.js"
+
+const withTempDir = <A, E, R>(
+  use: (tempDir: string) => Effect.Effect<A, E, R>
+): Effect.Effect<A, E, R | FileSystem.FileSystem> =>
+  Effect.scoped(
+    Effect.gen(function*(_) {
+      const fs = yield* _(FileSystem.FileSystem)
+      const tempDir = yield* _(
+        fs.makeTempDirectoryScoped({
+          prefix: "docker-git-apply-config-"
+        })
+      )
+      return yield* _(use(tempDir))
+    })
+  )
+
+const makeTemplateConfig = (
+  root: string,
+  outDir: string,
+  path: Path.Path,
+  targetDir: string
+): TemplateConfig => ({
+  containerName: "dg-test",
+  serviceName: "dg-test",
+  sshUser: "dev",
+  sshPort: 2222,
+  repoUrl: "https://github.com/org/repo.git",
+  repoRef: "main",
+  targetDir,
+  volumeName: "dg-test-home",
+  dockerGitPath: path.join(root, ".docker-git"),
+  authorizedKeysPath: path.join(root, "authorized_keys"),
+  envGlobalPath: path.join(root, ".orch/env/global.env"),
+  envProjectPath: path.join(outDir, ".orch/env/project.env"),
+  codexAuthPath: path.join(root, ".orch/auth/codex"),
+  codexSharedAuthPath: path.join(root, ".orch/auth/codex-shared"),
+  codexHome: "/home/dev/.codex",
+  enableMcpPlaywright: false,
+  pnpmVersion: "10.27.0"
+})
+
+const isRecord = (value: unknown): value is Record<string, unknown> =>
+  typeof value === "object" && value !== null
+
+const rewriteTargetDirInConfig = (source: string, targetDir: string): string => {
+  const parsed: unknown = JSON.parse(source)
+  if (!isRecord(parsed)) {
+    throw new Error("invalid docker-git.json root")
+  }
+  const template = parsed["template"]
+  if (!isRecord(template)) {
+    throw new Error("invalid docker-git.json template")
+  }
+  const next = { ...parsed, template: { ...template, targetDir } }
+  return `${JSON.stringify(next, null, 2)}\n`
+}
+
+type ProcessPatch = {
+  readonly prevCwd: string
+  readonly prevProjectsRoot: string | undefined
+}
+
+const patchProcess = (cwd: string, projectsRoot: string): Effect.Effect<ProcessPatch, never> =>
+  Effect.sync(() => {
+    const prevCwd = process.cwd()
+    const prevProjectsRoot = process.env["DOCKER_GIT_PROJECTS_ROOT"]
+    process.chdir(cwd)
+    process.env["DOCKER_GIT_PROJECTS_ROOT"] = projectsRoot
+    return { prevCwd, prevProjectsRoot }
+  })
+
+const restorePatchedProcess = (patch: ProcessPatch): Effect.Effect<void, never> =>
+  Effect.sync(() => {
+    process.chdir(patch.prevCwd)
+    if (patch.prevProjectsRoot === undefined) {
+      delete process.env["DOCKER_GIT_PROJECTS_ROOT"]
+    } else {
+      process.env["DOCKER_GIT_PROJECTS_ROOT"] = patch.prevProjectsRoot
+    }
+  })
+
+const withPatchedProcess = <A, E, R>(
+  cwd: string,
+  projectsRoot: string,
+  effect: Effect.Effect<A, E, R>
+): Effect.Effect<A, E, R> =>
+  Effect.scoped(
+    Effect.acquireRelease(patchProcess(cwd, projectsRoot), restorePatchedProcess).pipe(
+      Effect.flatMap(() => effect)
+    )
+  )
+
+const runGit = (
+  cwd: string,
+  args: ReadonlyArray<string>
+): Effect.Effect<void, unknown, never> =>
+  Effect.gen(function*(_) {
+    const command = Command.make("git", ...args).pipe(
+      Command.workingDirectory(cwd),
+      Command.env({ GIT_TERMINAL_PROMPT: "0" }),
+      Command.stdout("pipe"),
+      Command.stderr("pipe")
+    )
+    const exitCode = yield* _(Command.exitCode(command))
+    expect(Number(exitCode)).toBe(0)
+  }).pipe(Effect.asVoid)
+
+describe("applyProjectFiles", () => {
+  it.effect("applies updated docker-git.json to managed files in existing project", () =>
+    withTempDir((root) =>
+      Effect.gen(function*(_) {
+        const fs = yield* _(FileSystem.FileSystem)
+        const path = yield* _(Path.Path)
+        const outDir = path.join(root, "project")
+        const initialTargetDir = "/home/dev/workspaces/org/repo"
+        const updatedTargetDir = "/home/dev/workspaces/org/repo-updated"
+        const globalConfig = makeTemplateConfig(root, outDir, path, initialTargetDir)
+        const projectConfig = makeTemplateConfig(root, outDir, path, initialTargetDir)
+
+        yield* _(
+          prepareProjectFiles(outDir, root, globalConfig, projectConfig, {
+            force: false,
+            forceEnv: false
+          })
+        )
+
+        const envProjectPath = path.join(outDir, ".orch/env/project.env")
+        yield* _(fs.writeFileString(envProjectPath, "# custom env\nCUSTOM_KEY=1\n"))
+
+        const configPath = path.join(outDir, "docker-git.json")
+        const configBefore = yield* _(fs.readFileString(configPath))
+        yield* _(fs.writeFileString(configPath, rewriteTargetDirInConfig(configBefore, updatedTargetDir)))
+
+        const appliedTemplate = yield* _(applyProjectFiles(outDir))
+        expect(appliedTemplate.targetDir).toBe(updatedTargetDir)
+
+        const composeAfter = yield* _(fs.readFileString(path.join(outDir, "docker-compose.yml")))
+        expect(composeAfter).toContain(`TARGET_DIR: "${updatedTargetDir}"`)
+
+        const dockerfileAfter = yield* _(fs.readFileString(path.join(outDir, "Dockerfile")))
+        expect(dockerfileAfter).toContain(`RUN mkdir -p ${updatedTargetDir}`)
+
+        const envAfter = yield* _(fs.readFileString(envProjectPath))
+        expect(envAfter).toContain("CUSTOM_KEY=1")
+      })
+    ).pipe(Effect.provide(NodeContext.layer)))
+
+  it.effect("applies token and mcp overrides from apply command", () =>
+    withTempDir((root) =>
+      Effect.gen(function*(_) {
+        const fs = yield* _(FileSystem.FileSystem)
+        const path = yield* _(Path.Path)
+        const outDir = path.join(root, "project")
+        const targetDir = "/home/dev/workspaces/org/repo"
+        const globalConfig = makeTemplateConfig(root, outDir, path, targetDir)
+        const projectConfig = makeTemplateConfig(root, outDir, path, targetDir)
+
+        yield* _(
+          prepareProjectFiles(outDir, root, globalConfig, projectConfig, {
+            force: false,
+            forceEnv: false
+          })
+        )
+
+        const appliedTemplate = yield* _(
+          applyProjectFiles(outDir, {
+            _tag: "Apply",
+            projectDir: outDir,
+            runUp: false,
+            gitTokenLabel: "agien_main",
+            codexTokenLabel: "Team A",
+            claudeTokenLabel: "Team B",
+            enableMcpPlaywright: true
+          })
+        )
+        expect(appliedTemplate.gitTokenLabel).toBe("AGIEN_MAIN")
+        expect(appliedTemplate.codexAuthLabel).toBe("team-a")
+        expect(appliedTemplate.claudeAuthLabel).toBe("team-b")
+        expect(appliedTemplate.enableMcpPlaywright).toBe(true)
+
+        const composeAfter = yield* _(fs.readFileString(path.join(outDir, "docker-compose.yml")))
+        expect(composeAfter).toContain('GITHUB_AUTH_LABEL: "AGIEN_MAIN"')
+        expect(composeAfter).toContain('GIT_AUTH_LABEL: "AGIEN_MAIN"')
+        expect(composeAfter).toContain('CODEX_AUTH_LABEL: "team-a"')
+        expect(composeAfter).toContain('CLAUDE_AUTH_LABEL: "team-b"')
+        expect(composeAfter).toContain('MCP_PLAYWRIGHT_ENABLE: "1"')
+        expect(composeAfter).toContain("dg-test-browser")
+      })
+    ).pipe(Effect.provide(NodeContext.layer)))
+})
+
+describe("applyProjectConfig", () => {
+  it.effect("auto-resolves docker-git project by current repo and branch when projectDir is default", () =>
+    withTempDir((root) =>
+      Effect.gen(function*(_) {
+        const fs = yield* _(FileSystem.FileSystem)
+        const path = yield* _(Path.Path)
+
+        const projectsRoot = path.join(root, "projects-root")
+        const projectDir = path.join(projectsRoot, "provercoderai", "docker-git", "issue-72")
+        const workspaceRepoDir = path.join(root, "workspace", "docker-git")
+        const initialTargetDir = "/home/dev/workspaces/provercoderai/docker-git"
+        const updatedTargetDir = "/home/dev/workspaces/provercoderai/docker-git-updated"
+
+        const globalConfig = makeTemplateConfig(root, projectDir, path, initialTargetDir)
+        const projectConfig = {
+          ...makeTemplateConfig(root, projectDir, path, initialTargetDir),
+          repoUrl: "https://github.com/ProverCoderAI/docker-git.git",
+          repoRef: "issue-72"
+        }
+
+        yield* _(
+          prepareProjectFiles(projectDir, projectsRoot, globalConfig, projectConfig, {
+            force: false,
+            forceEnv: false
+          })
+        )
+
+        const configPath = path.join(projectDir, "docker-git.json")
+        const configBefore = yield* _(fs.readFileString(configPath))
+        yield* _(fs.writeFileString(configPath, rewriteTargetDirInConfig(configBefore, updatedTargetDir)))
+
+        yield* _(fs.makeDirectory(workspaceRepoDir, { recursive: true }))
+        yield* _(runGit(workspaceRepoDir, ["init"]))
+        yield* _(runGit(workspaceRepoDir, ["config", "user.email", "test@example.com"]))
+        yield* _(runGit(workspaceRepoDir, ["config", "user.name", "test-user"]))
+        yield* _(runGit(workspaceRepoDir, ["commit", "--allow-empty", "-m", "init"]))
+        yield* _(runGit(workspaceRepoDir, ["checkout", "-b", "issue-72"]))
+        yield* _(runGit(workspaceRepoDir, ["remote", "add", "origin", "https://github.com/skulidropek/docker-git.git"]))
+
+        const applied = yield* _(
+          withPatchedProcess(
+            workspaceRepoDir,
+            projectsRoot,
+            applyProjectConfig({ _tag: "Apply", projectDir: ".", runUp: false })
+          )
+        )
+
+        expect(applied.targetDir).toBe(updatedTargetDir)
+
+        const composeAfter = yield* _(fs.readFileString(path.join(projectDir, "docker-compose.yml")))
+        expect(composeAfter).toContain(`TARGET_DIR: "${updatedTargetDir}"`)
+      })
+    ).pipe(Effect.provide(NodeContext.layer)))
+})
diff --git a/packages/lib/tests/usecases/prepare-files.test.ts b/packages/lib/tests/usecases/prepare-files.test.ts
index baab7003..34109d55 100644
--- a/packages/lib/tests/usecases/prepare-files.test.ts
+++ b/packages/lib/tests/usecases/prepare-files.test.ts
@@ -47,7 +47,9 @@ const makeProjectConfig = (
   outDir: string,
   enableMcpPlaywright: boolean,
   path: Path.Path,
-  gitTokenLabel?: string
+  gitTokenLabel?: string,
+  codexAuthLabel?: string,
+  claudeAuthLabel?: string
 ): TemplateConfig => ({
   containerName: "dg-test",
   serviceName: "dg-test",
@@ -56,6 +58,8 @@ const makeProjectConfig = (
   repoUrl: "https://github.com/org/repo.git",
   repoRef: "main",
   gitTokenLabel,
+  codexAuthLabel,
+  claudeAuthLabel,
   targetDir: "/home/dev/org/repo",
   volumeName: "dg-test-home",
   dockerGitPath: path.join(outDir, ".docker-git"),
@@ -95,7 +99,7 @@ describe("prepareProjectFiles", () => {
         const outDir = path.join(root, "project")
         const globalConfig = makeGlobalConfig(root, path)
         const withoutMcp = makeProjectConfig(outDir, false, path)
-        const withMcp = makeProjectConfig(outDir, true, path, "AGIENS")
+        const withMcp = makeProjectConfig(outDir, true, path, "AGIENS", "agien-codex", "agien-claude")
 
         yield* _(
           prepareProjectFiles(outDir, root, globalConfig, withoutMcp, {
@@ -111,6 +115,7 @@ describe("prepareProjectFiles", () => {
         expect(dockerfile).toContain("gitleaks version")
         expect(entrypoint).toContain('DOCKER_GIT_HOME="/home/dev/.docker-git"')
         expect(entrypoint).toContain('SOURCE_SHARED_AUTH="/home/dev/.codex-shared/auth.json"')
+        expect(entrypoint).toContain('CODEX_LABEL_RAW="$CODEX_AUTH_LABEL"')
         expect(entrypoint).toContain('OPENCODE_DATA_DIR="/home/dev/.local/share/opencode"')
         expect(entrypoint).toContain('OPENCODE_SHARED_HOME="/home/dev/.codex-shared/opencode"')
         expect(entrypoint).toContain('OPENCODE_CONFIG_DIR="/home/dev/.config/opencode"')
@@ -133,6 +138,8 @@ describe("prepareProjectFiles", () => {
         expect(composeAfter).toContain('MCP_PLAYWRIGHT_ENABLE: "1"')
         expect(composeAfter).toContain('GITHUB_AUTH_LABEL: "AGIENS"')
         expect(composeAfter).toContain('GIT_AUTH_LABEL: "AGIENS"')
+        expect(composeAfter).toContain('CODEX_AUTH_LABEL: "agien-codex"')
+        expect(composeAfter).toContain('CLAUDE_AUTH_LABEL: "agien-claude"')
         expect(readEnableMcpPlaywrightFlag(configAfter)).toBe(true)
       })
     ).pipe(Effect.provide(NodeContext.layer)))
diff --git a/scripts/e2e/clone-cache.sh b/scripts/e2e/clone-cache.sh
index 7d5e36c5..8aa5b04f 100755
--- a/scripts/e2e/clone-cache.sh
+++ b/scripts/e2e/clone-cache.sh
@@ -21,7 +21,7 @@ export DOCKER_GIT_PROJECTS_ROOT="$ROOT"
 export DOCKER_GIT_STATE_AUTO_SYNC=0
 
 REPO_URL="https://github.com/octocat/Hello-World/issues/1"
-TARGET_DIR="/home/dev/.docker-git/workspaces/octocat/hello-world/issue-1"
+TARGET_DIR="/home/dev/workspaces/octocat/hello-world/issue-1"
 MIRROR_PREFIX="/home/dev/.docker-git/.cache/git-mirrors"
 
 ACTIVE_OUT_DIR=""
diff --git a/scripts/e2e/opencode-autoconnect.sh b/scripts/e2e/opencode-autoconnect.sh
index e1e12af2..906b1342 100755
--- a/scripts/e2e/opencode-autoconnect.sh
+++ b/scripts/e2e/opencode-autoconnect.sh
@@ -25,7 +25,7 @@ export DOCKER_GIT_PROJECTS_ROOT="$ROOT"
 export DOCKER_GIT_STATE_AUTO_SYNC=0
 
 REPO_URL="https://github.com/octocat/Hello-World/issues/1"
-TARGET_DIR="/home/dev/.docker-git/workspaces/octocat/hello-world/issue-1"
+TARGET_DIR="/home/dev/workspaces/octocat/hello-world/issue-1"
 E2E_BIN="$ROOT/.e2e-bin"
 dg_ensure_docker "$E2E_BIN"