@addai/node 0.30.12 → 0.30.14

package/dist/claude-print.js

@@ -5,6 +5,7 @@
 // our normalised RuntimeEvent shape, and resolves when the process exits.
 // No PTY needed — Claude detects non-TTY and runs headless.
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.claudePrintInputMessage = claudePrintInputMessage;
 exports.blockDelta = blockDelta;
 exports.lineToEvents = lineToEvents;
 exports.spawnClaudePrint = spawnClaudePrint;
@@ -13,6 +14,16 @@ const claude_binary_1 = require("./claude-binary");
 const win_1 = require("./win");
 const claude_system_prompt_1 = require("./claude-system-prompt");
 const prompt_transport_1 = require("./prompt-transport");
+/** Stream JSON reaches stdin only; files never become command-line arguments. */
+function claudePrintInputMessage(prompt, blocks) {
+    if (!Array.isArray(blocks) || blocks.length < 1 || blocks.length > 12 || !blocks.every(b => b && (b.type === 'text' && typeof b.text === 'string' || ['image', 'document'].includes(b.type) && 'source' in b && b.source?.type === 'base64' && typeof b.source.data === 'string' && /^[A-Za-z0-9+/]*={0,2}$/.test(b.source.data)
+        && (b.type === 'document' ? b.source.media_type === 'application/pdf' : ['image/png', 'image/jpeg', 'image/webp', 'image/gif'].includes(b.source.media_type)))))
+        throw new Error('Invalid file input');
+    const message = JSON.stringify({ type: 'user', session_id: '', parent_tool_use_id: null, message: { role: 'user', content: [...blocks, { type: 'text', text: prompt }] } }) + '\n';
+    if (Buffer.byteLength(message) > 30 * 1024 * 1024)
+        throw new Error('File input is too large');
+    return message;
+}
 /**
  * The text to emit for one flushed block, given what came before.
  *
@@ -113,6 +124,7 @@ function lineToEvents(line, suppressText = false) {
     return [{ type: `claude:${type || 'unknown'}`, raw: line }];
 }
 function spawnClaudePrint(input) {
+    const inputMessage = input.inputBlocks ? claudePrintInputMessage(input.prompt, input.inputBlocks) : undefined;
     const bin = (0, claude_binary_1.findClaudeBinary)();
     // No claude on this runtime — fail THIS request cleanly rather than
     // spawning a bare 'claude' that ENOENTs and crashes the daemon. Both
@@ -138,6 +150,8 @@ function spawnClaudePrint(input) {
     ];
     if (partialStream)
         args.push('--include-partial-messages');
+    if (input.inputBlocks)
+        args.push('--input-format', 'stream-json');
     if (input.permissionMode === 'bypassPermissions') {
         args.push('--dangerously-skip-permissions');
     }
@@ -183,6 +197,8 @@ function spawnClaudePrint(input) {
     const isWindows = process.platform === 'win32';
     const sysPrompt = (0, claude_system_prompt_1.offloadLongSystemPrompt)(bin, args, isWindows, (0, claude_system_prompt_1.claudeSupportsPromptFile)(bin));
     const transport = (0, prompt_transport_1.offloadLongPrompt)(bin, sysPrompt.args, sysPrompt.args.length - 1, null, isWindows, true);
+    if (inputMessage !== undefined)
+        transport.stdin = inputMessage;
     let proc;
     try {
         const inv = (0, win_1.resolveCliInvocation)(bin, transport.args);

package/dist/codex-models.d.ts

@@ -0,0 +1,81 @@
+import { type ModelProbeResult } from './model-cache';
+import type { RuntimeEffortLevel } from './types';
+import { type CliInvocation } from './win';
+export interface CodexModelEntry {
+    /** What goes to `--model`. */
+    id: string;
+    /** Always `id` — codex has no aliases. Here so Studio reads both CLIs alike. */
+    resolved: string;
+    /** Codex's own label, e.g. 'GPT-6-Astra'. */
+    name: string;
+    alias: false;
+    /** Effort levels this model takes, in codex's spelling. */
+    efforts?: string[];
+    /** What a run with no model set gets. */
+    default?: true;
+}
+export interface CodexModelReport {
+    /** Plain ids, the default first — the shape `capabilities.codex.models`
+     *  has always had. */
+    models: string[];
+    catalog: CodexModelEntry[];
+    defaultModel?: string;
+    /** 'account': what this node's login can run. 'bundled': what the CLI
+     *  ships with, read without the login. */
+    scope: 'account' | 'bundled';
+}
+export type ProbeResult = ModelProbeResult<CodexModelReport>;
+/**
+ * Turn the `data` of a `model/list` answer into a report. Hidden models
+ * (codex's internal reviewers and the like) are left out. Returns null when
+ * nothing usable is in there.
+ */
+export declare function parseModelList(raw: unknown, scope: CodexModelReport['scope']): CodexModelReport | null;
+/** What a picker can offer: every level some listed model takes, in order. */
+export declare function offeredEfforts(report: CodexModelReport): RuntimeEffortLevel[];
+export type ProbeLogin = {
+    use: true;
+    file: string;
+} | {
+    use: false;
+    why: string;
+};
+/**
+ * May the probe use this login? Only if nothing about it can change while the
+ * probe runs: an API key never does, and a ChatGPT login only while its token
+ * is fresh. Never throws.
+ */
+export declare function loginForProbe(codexHome: string, now?: number): ProbeLogin;
+/**
+ * Ask one codex binary for its models. Never throws; resolves within
+ * `timeoutMs` however the CLI behaves, and leaves no process behind.
+ */
+export declare function probeCodexModels(bin: string, opts?: {
+    timeoutMs?: number;
+    /** Where the login lives. Runs link it from ~/.codex (writeCodexHome), so
+     *  the probe does too. */
+    codexHome?: string;
+    now?: number;
+    /** Tests only: run something else in place of the CLI. */
+    resolve?: (bin: string, args: string[]) => CliInvocation;
+    /** Tests only: where the throwaway CODEX_HOME goes. */
+    dir?: string;
+}): Promise<ProbeResult>;
+export interface CodexModelCacheDeps {
+    probe: (bin: string) => Promise<ProbeResult>;
+    now: () => number;
+    log: (line: string) => void;
+}
+/** Refreshed every 6h, retried 30 min after a failure — see model-cache.ts. */
+export declare function createCodexModelCache(deps: CodexModelCacheDeps): {
+    get(bin: string, key: string): CodexModelReport | null;
+    last(): CodexModelReport | null;
+};
+/** What capabilities.ts reports for codex's models. */
+export declare function codexModelsFor(bin: string, key: string): CodexModelReport | null;
+/**
+ * The effort levels a model takes, from the last list codex gave: the
+ * default model's when none is named. Null when codex never said, or the
+ * model is not in its list.
+ */
+export declare function codexModelEfforts(model?: string | null, report?: CodexModelReport | null): string[] | null;

package/dist/codex-models.js

@@ -0,0 +1,385 @@
+"use strict";
+// Which models this node's Codex login can run — asked of the CLI itself.
+//
+// Until 0.30.14 this was the CODEX_MODELS constant in capabilities.ts, last
+// edited in May: gpt-5, gpt-5-mini, o4, o4-mini. A ChatGPT login refuses every
+// one of them ("The 'gpt-5' model is not supported when using Codex with a
+// ChatGPT account"), so the pickers offered nothing that would run, and none
+// of the models codex has shipped since.
+//
+// Codex's app-server answers `model/list` with each model's id, name, the
+// effort levels it takes and which one is the default. No thread is started
+// and no turn is sent, so nothing is billed.
+//
+// Unlike Claude's, the useful answer needs the login. Logged out, codex lists
+// only the models bundled with that CLI version; logged in, it lists what the
+// account can run. On popadom's 0.155 (2026-10-30) the bundled list had
+// gpt-5.5 but not gpt-6-sol or gpt-6-luna, and the account list the other way
+// round. So the probe uses the login, but never in a way that can rotate it:
+//
+//   * auth.json is LINKED into a throwaway CODEX_HOME (a symlink, or a hard
+//     link on Windows, where file symlinks need admin rights), never copied.
+//     A token refreshed into a copy is lost, and the next refresh from the
+//     real file reuses a refresh token that was already rotated, which gets
+//     the whole login revoked.
+//   * A ChatGPT login is only used while its token is fresh: refreshed under
+//     5 days ago with more than 3 days left on the access token. They last 10
+//     days and codex renews them days before that, so it has no reason to
+//     refresh one during a probe.
+//
+// Otherwise (no login, a login due a refresh, or no way to link it) the probe
+// runs logged out and says the list is the bundled one (scope 'bundled'). The
+// cache keeps an account list it already has for the same binary over that.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseModelList = parseModelList;
+exports.offeredEfforts = offeredEfforts;
+exports.loginForProbe = loginForProbe;
+exports.probeCodexModels = probeCodexModels;
+exports.createCodexModelCache = createCodexModelCache;
+exports.codexModelsFor = codexModelsFor;
+exports.codexModelEfforts = codexModelEfforts;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const model_cache_1 = require("./model-cache");
+const win_1 = require("./win");
+// Same rule as claude-models.ts: anything that does not look like a model id
+// is dropped rather than shipped to every picker.
+const SAFE_ID = /^[A-Za-z0-9][A-Za-z0-9._:[\]-]{0,119}$/;
+const MAX_ENTRIES = 64;
+const MAX_PAGES = 5;
+/**
+ * Turn the `data` of a `model/list` answer into a report. Hidden models
+ * (codex's internal reviewers and the like) are left out. Returns null when
+ * nothing usable is in there.
+ */
+function parseModelList(raw, scope) {
+    if (!Array.isArray(raw))
+        return null;
+    const catalog = [];
+    const seen = new Set();
+    for (const item of raw.slice(0, MAX_ENTRIES)) {
+        if (!item || typeof item !== 'object')
+            continue;
+        const o = item;
+        if (o.hidden === true)
+            continue;
+        const id = [o.model, o.id].find((v) => typeof v === 'string' && SAFE_ID.test(v.trim()))?.trim();
+        if (!id || seen.has(id))
+            continue;
+        seen.add(id);
+        const name = typeof o.displayName === 'string' && o.displayName.trim() ? o.displayName.trim().slice(0, 80) : id;
+        const efforts = Array.isArray(o.supportedReasoningEfforts)
+            ? o.supportedReasoningEfforts
+                .map(e => (typeof e === 'string' ? e : e?.reasoningEffort))
+                .filter((e) => typeof e === 'string' && /^[a-z]{1,20}$/.test(e))
+            : [];
+        catalog.push({
+            id, resolved: id, name, alias: false,
+            ...(efforts.length ? { efforts } : {}),
+            ...(o.isDefault === true && !catalog.some(e => e.default) ? { default: true } : {}),
+        });
+    }
+    if (catalog.length === 0)
+        return null;
+    // The default first — it is what a blank model runs. The rest stay in
+    // codex's own order (newest first).
+    catalog.sort((a, b) => Number(Boolean(b.default)) - Number(Boolean(a.default)));
+    const defaultModel = catalog.find(e => e.default)?.id;
+    return { models: catalog.map(e => e.id), catalog, ...(defaultModel ? { defaultModel } : {}), scope };
+}
+/** The effort levels this platform stores (the DB's check constraints) and
+ *  codex also knows. Codex's `ultra` is not one of them. */
+const PLATFORM_EFFORTS = ['low', 'medium', 'high', 'xhigh', 'max'];
+/** What a picker can offer: every level some listed model takes, in order. */
+function offeredEfforts(report) {
+    const any = new Set(report.catalog.flatMap(e => e.efforts ?? []));
+    return PLATFORM_EFFORTS.filter(e => any.has(e));
+}
+/* ── the login ─────────────────────────────────────────────────────────── */
+const DAY_MS = 24 * 60 * 60 * 1000;
+const FRESH_FOR_MS = 5 * DAY_MS;
+const MIN_LEFT_MS = 3 * DAY_MS;
+const nonEmpty = (v) => typeof v === 'string' && v.trim().length > 0;
+/** When the access token runs out, from its own `exp` claim; null if it is
+ *  not a JWT we can read. Only the expiry is looked at. */
+function accessTokenExpiry(token) {
+    if (!nonEmpty(token))
+        return null;
+    try {
+        const payload = JSON.parse(Buffer.from(token.split('.')[1] ?? '', 'base64url').toString('utf8'));
+        return typeof payload.exp === 'number' ? payload.exp * 1000 : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * May the probe use this login? Only if nothing about it can change while the
+ * probe runs: an API key never does, and a ChatGPT login only while its token
+ * is fresh. Never throws.
+ */
+function loginForProbe(codexHome, now = Date.now()) {
+    const file = path.join(codexHome, 'auth.json');
+    let parsed;
+    try {
+        parsed = JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return { use: false, why: 'no login' };
+    }
+    const tokens = (parsed.tokens ?? null);
+    if (!tokens || !(nonEmpty(tokens.access_token) || nonEmpty(tokens.refresh_token))) {
+        return nonEmpty(parsed.OPENAI_API_KEY) ? { use: true, file } : { use: false, why: 'no login' };
+    }
+    const refreshed = nonEmpty(parsed.last_refresh) ? Date.parse(parsed.last_refresh) : NaN;
+    if (!Number.isFinite(refreshed) || now - refreshed > FRESH_FOR_MS) {
+        return { use: false, why: 'the login is due a refresh, so it was left alone' };
+    }
+    const expires = accessTokenExpiry(tokens.access_token);
+    if (expires !== null && expires - now < MIN_LEFT_MS) {
+        return { use: false, why: 'the access token runs out soon, so the login was left alone' };
+    }
+    return { use: true, file };
+}
+/** Put the login in the probe's CODEX_HOME without copying it. */
+function linkLogin(file, dir) {
+    const target = path.join(dir, 'auth.json');
+    try {
+        if (process.platform === 'win32')
+            fs.linkSync(file, target);
+        else
+            fs.symlinkSync(file, target);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/* ── the probe ─────────────────────────────────────────────────────────── */
+const PROBE_ARGS = ['app-server', '--listen', 'stdio://'];
+const MAX_LINE = 2 * 1024 * 1024;
+/**
+ * Ask one codex binary for its models. Never throws; resolves within
+ * `timeoutMs` however the CLI behaves, and leaves no process behind.
+ */
+function probeCodexModels(bin, opts = {}) {
+    return new Promise(done => {
+        let settled = false;
+        let inv;
+        try {
+            inv = (opts.resolve ?? win_1.resolveCliInvocation)(bin, PROBE_ARGS);
+        }
+        catch (err) {
+            done({ ok: false, reason: err.message || String(err) });
+            return;
+        }
+        // The probe's cwd and its CODEX_HOME: no config.toml, no MCP servers, and
+        // the state codex writes (sqlite logs and the like) stays out of ~/.codex.
+        const dir = opts.dir ?? (0, model_cache_1.makeProbeDir)('codex-');
+        if (!dir) {
+            done({ ok: false, reason: 'no folder to probe from' });
+            return;
+        }
+        const login = loginForProbe(opts.codexHome ?? path.join(os.homedir(), '.codex'), opts.now ?? Date.now());
+        const linked = login.use && linkLogin(login.file, dir);
+        const scope = linked ? 'account' : 'bundled';
+        // Removing the link never touches the real file. It goes as soon as there
+        // is an answer, not when codex gets round to exiting.
+        const unlinkLogin = () => {
+            if (linked) {
+                try {
+                    fs.unlinkSync(path.join(dir, 'auth.json'));
+                }
+                catch { /* already gone, or swept later */ }
+            }
+        };
+        const cleanup = () => {
+            unlinkLogin();
+            if (opts.dir)
+                return;
+            try {
+                fs.rmSync(dir, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
+            }
+            catch { /* swept later */ }
+        };
+        const env = { ...process.env, CODEX_HOME: dir };
+        let child;
+        try {
+            child = (0, child_process_1.spawn)(inv.file, inv.args, { cwd: dir, env, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true });
+        }
+        catch (err) {
+            cleanup();
+            done({ ok: false, reason: err.message || String(err) });
+            return;
+        }
+        child.once('close', cleanup);
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            unlinkLogin();
+            // The app-server exits when its input ends; the kill is the backstop.
+            try {
+                child.stdin?.end();
+            }
+            catch { /* already closed */ }
+            const reap = setTimeout(() => {
+                if (child.exitCode === null && child.signalCode === null)
+                    (0, win_1.killProcessTree)(child);
+            }, 3000);
+            reap.unref();
+            child.once('exit', () => clearTimeout(reap));
+            done(result);
+        };
+        const timer = setTimeout(() => {
+            finish({ ok: false, reason: `no answer within ${opts.timeoutMs ?? 30000}ms` });
+            (0, win_1.killProcessTree)(child);
+        }, opts.timeoutMs ?? 30000);
+        timer.unref();
+        child.on('error', err => finish({ ok: false, reason: err.message || String(err) }));
+        child.on('close', (code, signal) => {
+            finish({ ok: false, reason: `exited ${code ?? signal} before answering${stderr ? `: ${stderr.trim().slice(0, 200)}` : ''}` });
+        });
+        child.stdin?.on('error', () => { });
+        let stderr = '';
+        child.stderr?.on('data', (d) => { if (stderr.length < 4096)
+            stderr += d.toString('utf8'); });
+        const send = (msg) => {
+            try {
+                child.stdin?.write(JSON.stringify(msg) + '\n');
+            }
+            catch { /* reported via 'close' / 'error' */ }
+        };
+        const models = [];
+        let page = 0;
+        const listPage = (cursor) => {
+            page += 1;
+            send({ id: 1 + page, method: 'model/list', params: { includeHidden: false, limit: 100, ...(cursor ? { cursor } : {}) } });
+        };
+        let buf = '';
+        child.stdout?.on('data', (d) => {
+            buf += d.toString('utf8');
+            if (buf.length > MAX_LINE) {
+                finish({ ok: false, reason: 'oversized output' });
+                return;
+            }
+            let nl;
+            while ((nl = buf.indexOf('\n')) >= 0) {
+                const line = buf.slice(0, nl).trim();
+                buf = buf.slice(nl + 1);
+                if (!line.startsWith('{'))
+                    continue;
+                let msg;
+                try {
+                    msg = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                // Notifications and requests from the server carry a method; only
+                // answers to our own requests matter here.
+                if (typeof msg.method === 'string' || typeof msg.id !== 'number')
+                    continue;
+                if (msg.error) {
+                    const what = msg.id === 1 ? 'initialize' : 'model/list';
+                    finish({ ok: false, reason: `${what} refused: ${String(msg.error?.message ?? 'unknown').slice(0, 200)}` });
+                    return;
+                }
+                if (msg.id === 1) {
+                    send({ method: 'initialized', params: {} });
+                    listPage();
+                    continue;
+                }
+                if (msg.id !== 1 + page)
+                    continue;
+                const data = msg.result?.data;
+                if (Array.isArray(data))
+                    models.push(...data);
+                const next = msg.result?.nextCursor;
+                if (typeof next === 'string' && next && page < MAX_PAGES && models.length < MAX_ENTRIES) {
+                    listPage(next);
+                    continue;
+                }
+                const report = parseModelList(models, scope);
+                finish(report
+                    ? { ok: true, report }
+                    : { ok: false, reason: `model/list answered without a usable model${scope === 'bundled' && !login.use ? ` (${login.why})` : ''}` });
+                return;
+            }
+        });
+        send({
+            id: 1, method: 'initialize',
+            params: { clientInfo: { name: 'ainode_model_probe', title: '+Ai node model probe', version: '1.0.0' }, capabilities: { experimentalApi: true } },
+        });
+    });
+}
+/** Refreshed every 6h, retried 30 min after a failure — see model-cache.ts. */
+function createCodexModelCache(deps) {
+    return (0, model_cache_1.createModelCache)({
+        ...deps,
+        agent: 'codex',
+        describe: report => [
+            report.defaultModel ? `default ${report.defaultModel}` : '',
+            report.scope === 'bundled' ? 'the list bundled with the CLI; the login was left alone' : '',
+        ].filter(Boolean).join('; '),
+        // A probe that had to leave the login alone sees less than one that used
+        // it; the account's list stays until the next probe can read it again.
+        keep: (held, next) => held.scope === 'account' && next.scope === 'bundled',
+    });
+}
+const sharedCache = createCodexModelCache({
+    probe: bin => probeCodexModels(bin),
+    now: () => Date.now(),
+    log: line => console.log(line),
+});
+/** What capabilities.ts reports for codex's models. */
+function codexModelsFor(bin, key) {
+    return sharedCache.get(bin, key);
+}
+/**
+ * The effort levels a model takes, from the last list codex gave: the
+ * default model's when none is named. Null when codex never said, or the
+ * model is not in its list.
+ */
+function codexModelEfforts(model, report = sharedCache.last()) {
+    if (!report)
+        return null;
+    const entry = model ? report.catalog.find(e => e.id === model) : report.catalog.find(e => e.default);
+    return entry?.efforts?.length ? entry.efforts : null;
+}

package/dist/codex-spawn.d.ts

@@ -12,6 +12,9 @@ export interface CodexInput {
     prompt: string;
     model?: string;
     effortLevel?: RuntimeEffortLevel;
+    /** The effort levels codex listed for this model (codexModelEfforts), so
+     *  effortLevel can be clamped to one it takes. */
+    supportedEfforts?: readonly string[] | null;
     /** Sandbox for normal non-bypass runs. Defaults to workspace-write. */
     sandboxMode?: 'read-only' | 'workspace-write' | 'danger-full-access';
     /** Skip Codex approvals and sandboxing. Codex's "yolo" equivalent. */
@@ -73,12 +76,15 @@ export interface CodexHandle {
     onActivity(cb: () => void): void;
     done: Promise<number>;
 }
-/** Clamp our effort ladder to a value codex's CLI accepts. codex only knows
- *  `minimal|low|medium|high` and FAIL-FASTS (exit 2, dead-letter) on anything
- *  else — but RuntimeEffortLevel also carries `xhigh`/`max`, and a ladder
- *  failover (e.g. claude(max) → codex) forwards req.effort across agents
- *  unchanged. Map the extra-high tiers down to `high`; drop anything
- *  unrecognised so we emit no `-c reasoning.effort` at all rather than a bad
- *  one. Mirrors grokEffort() in grok-spawn.ts. */
-export declare function codexEffort(level?: RuntimeEffortLevel): string | null;
+/** Clamp our effort ladder to a value this codex accepts. A codex that does
+ *  not know a level FAIL-FASTS (exit 2, dead-letter), and a ladder failover
+ *  (e.g. claude(max) → codex) forwards req.effort across agents unchanged.
+ *
+ *  `supported` is what codex listed for the model about to run
+ *  (codexModelEfforts): the level asked for if the model takes it, else the
+ *  highest it takes below that. Without a list — an older codex, or one that
+ *  has not answered yet — only `minimal|low|medium|high` is safe, so xhigh
+ *  and max become high, as they always did. Anything unrecognised emits no
+ *  effort at all rather than a bad one. Mirrors grokEffort() in grok-spawn.ts. */
+export declare function codexEffort(level?: RuntimeEffortLevel, supported?: readonly string[] | null): string | null;
 export declare function spawnCodex(input: CodexInput): CodexHandle;

package/dist/codex-spawn.js

@@ -328,14 +328,31 @@ function lineToEvents(line) {
     // new "codex:" namespace which adds zero value.
     return [{ type: `claude:codex.${type || 'unknown'}`, raw: line }];
 }
-/** Clamp our effort ladder to a value codex's CLI accepts. codex only knows
- *  `minimal|low|medium|high` and FAIL-FASTS (exit 2, dead-letter) on anything
- *  else — but RuntimeEffortLevel also carries `xhigh`/`max`, and a ladder
- *  failover (e.g. claude(max) → codex) forwards req.effort across agents
- *  unchanged. Map the extra-high tiers down to `high`; drop anything
- *  unrecognised so we emit no `-c reasoning.effort` at all rather than a bad
- *  one. Mirrors grokEffort() in grok-spawn.ts. */
-function codexEffort(level) {
+/** codex's effort levels, lowest first. */
+const CODEX_EFFORT_LADDER = ['minimal', 'low', 'medium', 'high', 'xhigh', 'max', 'ultra'];
+/** Clamp our effort ladder to a value this codex accepts. A codex that does
+ *  not know a level FAIL-FASTS (exit 2, dead-letter), and a ladder failover
+ *  (e.g. claude(max) → codex) forwards req.effort across agents unchanged.
+ *
+ *  `supported` is what codex listed for the model about to run
+ *  (codexModelEfforts): the level asked for if the model takes it, else the
+ *  highest it takes below that. Without a list — an older codex, or one that
+ *  has not answered yet — only `minimal|low|medium|high` is safe, so xhigh
+ *  and max become high, as they always did. Anything unrecognised emits no
+ *  effort at all rather than a bad one. Mirrors grokEffort() in grok-spawn.ts. */
+function codexEffort(level, supported) {
+    const want = CODEX_EFFORT_LADDER.indexOf(level ?? '');
+    if (want < 0)
+        return null;
+    if (supported?.length) {
+        let best = -1;
+        for (const s of supported) {
+            const i = CODEX_EFFORT_LADDER.indexOf(s);
+            if (i >= 0 && i <= want && i > best)
+                best = i;
+        }
+        return best >= 0 ? CODEX_EFFORT_LADDER[best] : null;
+    }
     switch (level) {
         case 'low': return 'low';
         case 'medium': return 'medium';
@@ -363,9 +380,12 @@ function spawnCodex(input) {
         baseFlags.push('--sandbox', input.sandboxMode ?? 'workspace-write');
     if (input.model)
         baseFlags.push('--model', input.model);
-    const effort = codexEffort(input.effortLevel);
+    const effort = codexEffort(input.effortLevel, input.supportedEfforts);
     if (effort) {
-        baseFlags.push('-c', `reasoning.effort=${JSON.stringify(effort)}`);
+        // `model_reasoning_effort` is the key codex reads. The `reasoning.effort`
+        // this sent before was ignored ("session-flags: `reasoning` is ignored",
+        // codex 0.164), so every codex run went out at its model's default.
+        baseFlags.push('-c', `model_reasoning_effort=${JSON.stringify(effort)}`);
     }
     const args = input.resumeThreadId
         ? ['exec', ...baseFlags, 'resume', input.resumeThreadId, input.prompt]