@bitkyc08/opencodex 2.91.0 → 2.92.0

package/src/adapters/workbuddy-schema.ts

@@ -0,0 +1,61 @@
+const schemaMaps = new Set(["properties", "patternProperties", "$defs", "definitions", "dependentSchemas"]);
+const schemaLists = new Set(["anyOf", "oneOf", "allOf", "prefixItems"]);
+const schemaValues = new Set(["items", "additionalProperties", "unevaluatedProperties", "contains", "not", "if", "then", "else", "propertyNames"]);
+const jsonTypes = new Set(["string", "number", "integer", "boolean", "object", "array", "null"]);
+
+/** Normalize schemas only; defaults, examples and property names are data, never schemas. */
+export function workBuddySchema(value: unknown, depth = 0): Record<string, unknown> {
+  if (depth > 64) throw new Error("WorkBuddy AI tool schema exceeds maximum depth");
+  if (value === false) return { not: {} };
+  if (!value || typeof value !== "object" || Array.isArray(value)) return {};
+  const input = value as Record<string, unknown>, out = { ...input };
+  for (const [key, child] of Object.entries(input)) {
+    if (schemaMaps.has(key) && child && typeof child === "object" && !Array.isArray(child)) {
+      out[key] = Object.fromEntries(Object.entries(child).map(([name, schema]) => [name, workBuddySchema(schema, depth + 1)]));
+    } else if (schemaLists.has(key) && Array.isArray(child)) {
+      out[key] = child.map(schema => workBuddySchema(schema, depth + 1));
+    } else if (schemaValues.has(key)) {
+      if ((key === "additionalProperties" || key === "unevaluatedProperties") && typeof child === "boolean") continue;
+      out[key] = key === "items" && Array.isArray(child)
+        ? { anyOf: child.map(schema => workBuddySchema(schema, depth + 1)) } : workBuddySchema(child, depth + 1);
+    }
+  }
+  if (typeof out.pattern === "string") out.pattern = out.pattern.replace(/\\\\|\\0(?![0-9])/g, match => match === "\\0" ? "\\u0000" : match);
+  if (out.required !== undefined && !Array.isArray(out.required)) delete out.required;
+  if (typeof out.type === "string") {
+    out.type = out.type.toLowerCase();
+    if (!jsonTypes.has(out.type as string)) delete out.type;
+  }
+  if (Array.isArray(out.enum)) {
+    if (!out.enum.length) delete out.enum;
+    else if (out.type === undefined) {
+      const groups = new Map<string, unknown[]>();
+      for (const item of out.enum) {
+        const type = item === null ? "null" : Array.isArray(item) ? "array" : typeof item;
+        const values = groups.get(type) ?? []; values.push(item); groups.set(type, values);
+      }
+      if (groups.size === 1) out.type = groups.keys().next().value;
+      else {
+        const union = { anyOf: [...groups].map(([type, values]) => ({ type, enum: values })) };
+        out.allOf = [...(Array.isArray(out.allOf) ? out.allOf : []), union];
+        delete out.enum;
+      }
+    }
+  }
+  return out;
+}
+
+export function workBuddyToolParameters(value: unknown): Record<string, unknown> {
+  const out = workBuddySchema(value);
+  const properties: Record<string, unknown> = { ...(out.properties as Record<string, unknown> ?? {}) };
+  const required = new Set(Array.isArray(out.required) ? out.required.filter(x => typeof x === "string") : []);
+  for (const key of ["anyOf", "oneOf", "allOf"]) {
+    for (const variant of Array.isArray(out[key]) ? out[key] : []) {
+      const row = variant as Record<string, unknown>;
+      Object.assign(properties, row.properties);
+      if (key === "allOf" && Array.isArray(row.required)) for (const field of row.required) if (typeof field === "string") required.add(field);
+    }
+    delete out[key];
+  }
+  return { ...out, type: "object", properties, ...(required.size ? { required: [...required] } : {}) };
+}

package/src/adapters/workbuddy.ts

@@ -0,0 +1,68 @@
+import { createHmac, randomBytes, randomUUID } from "node:crypto";
+import type { ProviderAdapter } from "./base";
+import { workBuddyToolParameters } from "./workbuddy-schema";
+import { retainTranslatedEvent, releaseTranslatedEvent } from "../lib/translator-budget";
+import { createOpenAIChatAdapter } from "./openai-chat";
+import type { AdapterEvent, OcxProviderConfig } from "../types";
+import { assertWorkBuddyDestination, WORKBUDDY_BASE_URL, workBuddyHeaders } from "../providers/workbuddy";
+
+const sessionSalt = randomBytes(32);
+const opaqueId = (value: unknown) => createHmac("sha256", sessionSalt).update(JSON.stringify(value)).digest("hex").slice(0, 32);
+
+export function createWorkBuddyAdapter(provider: OcxProviderConfig): ProviderAdapter {
+  const base = createOpenAIChatAdapter({ ...provider, adapter: "openai-chat", baseUrl: WORKBUDDY_BASE_URL, headers: undefined });
+  return {
+    ...base, name: "workbuddy-ai",
+    async buildRequest(parsed, incoming) {
+      assertWorkBuddyDestination(provider.baseUrl);
+      if (!provider.apiKey || !parsed._workbuddyAuthContext) throw new Error("WorkBuddy AI account unavailable; run ocx login workbuddy-ai");
+      const req = await base.buildRequest({ ...parsed, stream: true }, incoming);
+      const body = JSON.parse(req.body);
+      const messages = body.messages as Array<Record<string, unknown>>;
+      for (const message of messages) if (message.role === "developer") message.role = "system";
+      if (messages[0]?.role !== "system") messages.unshift({ role: "system", content: "You are a helpful assistant." });
+      if (body.max_completion_tokens !== undefined) { body.max_tokens = body.max_completion_tokens; delete body.max_completion_tokens; }
+      if (body.tool_choice === "none") { delete body.tools; delete body.tool_choice; }
+      else if (body.tool_choice?.type === "function") body.tool_choice = body.tool_choice.function.name;
+      for (const tool of body.tools ?? []) {
+        if (tool.type === "function") tool.function.parameters = workBuddyToolParameters(tool.function.parameters);
+      }
+      const users = messages.map((m, index) => ({ m, index })).filter(({ m }) => m.role === "user");
+      const session = parsed._codexOwnThreadId || parsed._clientThreadId
+        || (!parsed._promptCacheKeyIsSharedCohort ? parsed.options.promptCacheKey : undefined)
+        || incoming.headers.get("session_id") || incoming.headers.get("x-session-id");
+      const conversation = session || users[0]?.m.content;
+      const latest = users.at(-1);
+      const requestId = randomUUID().replaceAll("-", "");
+      const headers = {
+        "Content-Type": "application/json", Accept: "text/event-stream",
+        ...workBuddyHeaders(provider.apiKey, parsed._workbuddyAuthContext),
+        "X-Request-ID": requestId, "X-Conversation-Message-ID": requestId,
+        "X-Conversation-Request-ID": latest ? opaqueId([conversation, latest.index, latest.m.content]) : requestId,
+        ...(conversation ? { "X-Conversation-ID": opaqueId(conversation) } : {}),
+      };
+      return { ...req, url: `${WORKBUDDY_BASE_URL}/chat/completions`, headers, body: JSON.stringify(body), redirect: "error" as const };
+    },
+    async parseResponse(response, budget, tier) {
+      const events: AdapterEvent[] = [];
+      try {
+        for await (const event of base.parseStream(response, budget, tier)) {
+          retainTranslatedEvent(event, budget, events.at(-1));
+          events.push(event);
+        }
+        return events;
+      } catch (error) {
+        for (const event of events) releaseTranslatedEvent(event, budget);
+        throw error;
+      }
+    },
+    formatErrorBody(status, _headers, payload) {
+      let code: unknown;
+      try { code = JSON.parse(payload)?.code; } catch { /* Only structured numeric codes are public. */ }
+      if (Number(code) === 11128) return "WorkBuddy AI rejected this client channel (11128).";
+      if (Number(code) === 11140) return "WorkBuddy AI restricted this account (11140); contact WorkBuddy support.";
+      if (Number(code) === 14018) return "WorkBuddy AI credits exhausted (14018).";
+      return `WorkBuddy AI request failed (HTTP ${status}).`;
+    },
+  };
+}

package/src/bridge/response-json.ts

@@ -253,7 +253,7 @@ function buildResponseJSONWithBudget(
     const text = stripCitationMarkers(currentTextStr);
     const sourceBytes = pendingWebSources.reduce((sum, source) => sum + bytesOf(JSON.stringify(source)), 0);
     const annotations = pendingWebSources.map(s => ({
-      type: "url_citation", url: s.url, ...(s.title ? { title: s.title } : {}), start_index: 0, end_index: 0,
+      type: "url_citation", url: s.url, title: s.title || s.url, start_index: 0, end_index: 0,
     }));
     pendingWebSources = [];
     const item = {

package/src/bridge/sse.ts

@@ -488,7 +488,7 @@ export function bridgeToResponsesSSE(
       const takeWebAnnotations = (): { type: string; url: string; title?: string; start_index: number; end_index: number }[] => {
         if (pendingWebSources.length === 0) return [];
         const anns = pendingWebSources.map(s => ({
-          type: "url_citation", url: s.url, ...(s.title ? { title: s.title } : {}), start_index: 0, end_index: 0,
+          type: "url_citation", url: s.url, title: s.title || s.url, start_index: 0, end_index: 0,
         }));
         const annotationBytes = bytesOf(JSON.stringify(anns));
         const reservation = budget?.reserveTransient(annotationBytes, { kind: "retained_collectors" });

package/src/chat/outbound.ts

@@ -22,6 +22,7 @@ import {
   UNDECLARED_TOOL_CALL_ERROR_CODE,
 } from "../lib/errors";
 import { redactSecretString } from "../lib/redact";
+import { truncationReasonFor } from "../responses/truncated-stop-reason";
 import { createSseBlockBuffer, sseDataPayload } from "../server/sse-payload-rewrite";
 import { reasoningDetailEntriesForItem } from "./reasoning-details";
 
@@ -243,8 +244,14 @@ export function chatCompletionsIncompleteOutcome(
   reason: unknown,
   message: unknown,
 ): { finishReason: "length" | "content_filter" } | { failMessage: string } {
-  if (reason === "max_output_tokens") return { finishReason: "length" };
-  if (reason === "content_filter") return { finishReason: "content_filter" };
+  // Upstream Responses endpoints do not all use OpenAI's `max_output_tokens`: Volcengine Ark
+  // (Coding Plan `/responses`) sends `incomplete_details.reason: "length"` for a hit output cap.
+  // Read the reason through the shared truncation vocabulary so such a turn ends with
+  // finish_reason "length" instead of a 502. Proxy reasons (adapter_eof, upstream_stall_timeout,
+  // missing_terminal_event) are not in that vocabulary and still fail.
+  const truncation = typeof reason === "string" ? truncationReasonFor(reason) : undefined;
+  if (truncation === "max_output_tokens") return { finishReason: "length" };
+  if (truncation === "content_filter") return { finishReason: "content_filter" };
   const why = typeof reason === "string" ? reason : "unknown";
   return {
     failMessage: typeof message === "string" && message.length > 0
@@ -871,8 +878,8 @@ export function responsesJsonToChatCompletion(json: unknown, model: string, tran
   const incomplete = isRec(body.incomplete_details) ? body.incomplete_details : {};
   let incompleteFinish: "length" | "content_filter" | undefined;
   if (body.status === "incomplete") {
-    if (incomplete.reason === "max_output_tokens") incompleteFinish = "length";
-    else if (incomplete.reason === "content_filter") incompleteFinish = "content_filter";
+    const outcome = chatCompletionsIncompleteOutcome(incomplete.reason, undefined);
+    if ("finishReason" in outcome) incompleteFinish = outcome.finishReason;
     else throw new ChatCompletionsStreamError("upstream response ended without a supported completion boundary", {
       code: "upstream_incomplete", type: "upstream_error",
     });

package/src/cli/capabilities-agents-routing.ts

@@ -385,13 +385,13 @@ export const AGENT_ROUTING_CAPABILITIES: readonly Capability[] = [
   },
   {
     command: ["combo","set"],
-    usage: "ocx combo set <id> [--targets <provider/model[:weight],...> | --targets-file <FILE|->] [--strategy <failover|round-robin|random|least-used|reset-window|jev>] [--sticky <1-100|->] [--effort <low|medium|high|xhigh|max|ultra|->] [--effort-mode <fallback|force|->] [--alias <name|->] [--native-alias [on|off]] [--allow-metered-targets <on|off>] [--display-name <label|->] [--description <text|->] [--decision-provider <provider|-> | --decision-model <route|->] [--decision-timeout <ms|->] [--decision-quota-signals <on|off|->] [--decision-quota-tiers <JSON|->] [--rename-from <id>] [--image-input <auto|disabled>] [--reasoning-effort-mode <strict|adaptive>] [--json]",
+    usage: "ocx combo set <id> [--targets <provider/model[:weight],...> | --targets-file <FILE|->] [--strategy <failover|round-robin|random|least-used|reset-window|jev>] [--sticky <1-100|->] [--effort <low|medium|high|xhigh|max|ultra|->] [--effort-mode <fallback|force|->] [--alias <name|->] [--native-alias [on|off]] [--allow-metered-targets <on|off>] [--display-name <label|->] [--description <text|->] [--decision-provider <provider|-> | --decision-model <route|->] [--decision-timeout <ms|->] [--decision-quota-signals <on|off|->] [--decision-quota-tiers <JSON|->] [--session-pin <duration|->] [--rename-from <id>] [--image-input <auto|disabled>] [--reasoning-effort-mode <strict|adaptive>] [--json]",
     summary: "Create, update or rename a combo.",
     routes: [{"method":"GET","path":"/api/combos"},{"method":"PUT","path":"/api/combos"}],
-    flags: [{"name":"--allow-metered-targets","value":"string","summary":"on grants operator consent to metered targets only on a loopback-only proxy; off clears it."},{"name":"--targets","value":"string","summary":"Ordered provider/model[:weight] list; required for creation."},{"name":"--strategy","value":"string","summary":"Routing strategy."},{"name":"--sticky","value":"string","summary":"Round-robin limit 1-100; - resets."},{"name":"--effort","value":"string","summary":"Default effort; - clears."},{"name":"--effort-mode","value":"string","summary":"fallback or force; - resets to fallback."},{"name":"--alias","value":"string","summary":"Alias; - clears."},{"name":"--display-name","value":"string","summary":"Label; - clears."},{"name":"--description","value":"string","summary":"Catalog row description; - clears."},{"name":"--decision-provider","value":"string","summary":"JEV provider; - clears."},{"name":"--decision-model","value":"string","summary":"JEV route; - clears; exclusive with provider."},{"name":"--decision-timeout","value":"string","summary":"JEV deadline 1000-120000 ms; - clears."},{"name":"--decision-quota-signals","value":"string","summary":"JEV advisory quota on/off; - clears."},{"name":"--decision-quota-tiers","value":"string","summary":"Partial JSON thresholds; - clears."},{"name":"--rename-from","value":"string","summary":"Existing combo ID to rename."},{"name":"--json","value":"boolean","summary":"Emit structured JSON."},{"name":"--native-alias","value":"string","summary":"Bare legacy flag means on; explicit on/off preserves presence, including false."},{"name":"--targets-file","value":"string","summary":"Bounded ordered target JSON array, exclusive with --targets; preserves effort/profile/last-resort metadata."},{"name":"--image-input","value":"string","summary":"auto or disabled; explicit auto clears the previous disabled choice."},{"name":"--reasoning-effort-mode","value":"string","summary":"strict or adaptive, distinct from --effort-mode fallback/force."}],
+    flags: [{"name":"--allow-metered-targets","value":"string","summary":"on grants operator consent to metered targets only on a loopback-only proxy; off clears it."},{"name":"--targets","value":"string","summary":"Ordered provider/model[:weight] list; required for creation."},{"name":"--strategy","value":"string","summary":"Routing strategy."},{"name":"--sticky","value":"string","summary":"Round-robin limit 1-100; - resets."},{"name":"--effort","value":"string","summary":"Default effort; - clears."},{"name":"--effort-mode","value":"string","summary":"fallback or force; - resets to fallback."},{"name":"--alias","value":"string","summary":"Alias; - clears."},{"name":"--display-name","value":"string","summary":"Label; - clears."},{"name":"--description","value":"string","summary":"Catalog row description; - clears."},{"name":"--decision-provider","value":"string","summary":"JEV provider; - clears."},{"name":"--decision-model","value":"string","summary":"JEV route; - clears; exclusive with provider."},{"name":"--decision-timeout","value":"string","summary":"JEV deadline 1000-120000 ms; - clears."},{"name":"--decision-quota-signals","value":"string","summary":"JEV advisory quota on/off; - clears."},{"name":"--decision-quota-tiers","value":"string","summary":"Partial JSON thresholds; - clears."},{"name":"--session-pin","value":"string","summary":"JEV session pin idle window 1m-24h (90s, 20m, 1h); - clears."},{"name":"--rename-from","value":"string","summary":"Existing combo ID to rename."},{"name":"--json","value":"boolean","summary":"Emit structured JSON."},{"name":"--native-alias","value":"string","summary":"Bare legacy flag means on; explicit on/off preserves presence, including false."},{"name":"--targets-file","value":"string","summary":"Bounded ordered target JSON array, exclusive with --targets; preserves effort/profile/last-resort metadata."},{"name":"--image-input","value":"string","summary":"auto or disabled; explicit auto clears the previous disabled choice."},{"name":"--reasoning-effort-mode","value":"string","summary":"strict or adaptive, distinct from --effort-mode fallback/force."}],
     mutates: true,
     json: "payload",
-    details: ["create and update are aliases of set. Existing fields are read before writing; --targets replaces targets.","force overrides valid client effort and may increase cost and latency.","Only the implemented target grammar is supported; full GUI target metadata and routing-profile writes are separate tasks.","New file/flag conflicts refuse before transport. Partial edits preserve target metadata; explicit false/default values override server carry. Turning a native alias off may also require clearing its incompatible alias.","Read/merge/write uses one target and remains an upsert without revision CAS. Saved-but-incomplete catalog outcomes return nonzero with their receipt."],
+    details: ["create and update are aliases of set. Existing fields are read before writing; --targets replaces targets. Without --strategy an existing combo keeps its stored strategy and JEV policy; a new combo defaults to failover.","force overrides valid client effort and may increase cost and latency.","Only the implemented target grammar is supported; full GUI target metadata and routing-profile writes are separate tasks.","New file/flag conflicts refuse before transport. Partial edits preserve target metadata; explicit false/default values override server carry. Turning a native alias off may also require clearing its incompatible alias.","Read/merge/write uses one target and remains an upsert without revision CAS. Saved-but-incomplete catalog outcomes return nonzero with their receipt."],
   },
   {
     command: ["combo", "remove"],

package/src/cli/codex-cli-update.ts

@@ -221,11 +221,19 @@ function inspectionDeps(commandDeps: CodexCliUpdateCommandDeps): CodexCliInstall
   return {
     env: {
       ...trusted.managerRoots,
+      ...trusted.transportEnv,
       CODEX_CLI_PATH: trusted.codexCliPath ?? undefined,
       PATH: trusted.path ?? undefined,
       PATHEXT: trusted.pathExt ?? undefined,
+      // The lookup seeds the inspection models against the launch-time
+      // capture; ambient values are never consulted.
+      HOME: trusted.home ?? undefined,
+      NODE_PATH: trusted.nodePath ?? undefined,
     },
     configDir: trusted.configDir,
+    // Content observation picks the platform backing by the Node launcher's
+    // arch, which can differ from this Bun process's under Rosetta.
+    arch: trusted.arch ?? undefined,
     // The snapshot is proof-bound to the launcher, but the report may only attest
     // the environment candidate when the resolver picks the same canonical path —
     // managed requires both.

package/src/cli/combo-result.ts

@@ -1,4 +1,5 @@
 import { normalizeJevQuotaTiers } from "../combos/jev-quota-config";
+import { normalizeJevSessionPin } from "../combos/jev-session-pin-config";
 import { parseComboTargets } from "./combo-input";
 import { printCatalogResult } from "./catalog-command-result";
 
@@ -39,6 +40,11 @@ function publicCombo(value: unknown): Record<string, unknown> {
       if (!tiers) invalid();
       result[key] = tiers;
       continue;
+    } else if (key === "sessionPin") {
+      const pin = normalizeJevSessionPin(child);
+      if (!pin) invalid();
+      result[key] = pin;
+      continue;
     } else if (key === "nativeAlias" || key === "allowMeteredTargets" || key === "decisionQuotaSignals") {
       if (typeof child !== "boolean") invalid();
     } else invalid();

package/src/cli/combo-stats.ts

@@ -53,6 +53,8 @@ function projectStats(value: unknown, id: string, range: string) {
   const rawSummary = record(dto.summary);
   const summary = {
     ...counts(rawSummary, SUMMARY_COUNTS),
+    // Absent means zero: a proxy started before session pins (#7525) does not report the field.
+    pinnedRequests: Object.hasOwn(rawSummary, "pinnedRequests") ? number(rawSummary.pinnedRequests) : 0,
     averageLatencyMs: nullable(rawSummary.averageLatencyMs),
     averageConfidence: nullable(rawSummary.averageConfidence, 1),
     averageChosenProbability: nullable(rawSummary.averageChosenProbability, 1),
@@ -111,6 +113,7 @@ export async function handleComboStatsCommand(argv: string[], deps: RuntimeApiDe
       `Combo ${id} — JEV observations (${range})`,
       ...(summary.decisions === 0 ? ["No recorded JEV decisions in this window."] : []),
       `Decisions: ${summary.decisions}; applied: ${summary.appliedDecisions}; fail-open: ${summary.failOpenDecisions}`,
+      ...(summary.pinnedRequests > 0 ? [`Session-pinned requests (no decision call): ${summary.pinnedRequests}`] : []),
       `Successful requests: ${summary.successfulRequests}; requests with model fallback: ${summary.requestsWithModelFallback}`,
       `Model tokens: ${summary.modelTotalTokens}; measured attempts: ${summary.measuredModelAttempts}/${summary.modelAttempts}`,
       `Decision tokens: ${summary.decisionTotalTokens}; decisions reporting usage: ${summary.decisionUsageReported}/${summary.decisions}`,

package/src/cli/combo.ts

@@ -1,9 +1,11 @@
 import { normalizeJevQuotaTiers } from "../combos/jev-quota-config";
+import { parseJevSessionPinDuration } from "../combos/jev-session-pin-config";
 import { JEV_DECISION_TIMEOUT_MAX_MS, JEV_DECISION_TIMEOUT_MIN_MS } from "../combos/types";
 import {
   CliUsageError,
   printData,
   rejectArgs,
+  RuntimeApiError,
   runCliAction,
   runtimeRequest,
   runtimeBaseUrl,
@@ -29,6 +31,7 @@ const USAGE = `Usage:
       [--image-input <auto|disabled>] [--reasoning-effort-mode <strict|adaptive>]
       [--decision-provider <provider|-> | --decision-model <route|->] [--decision-timeout <ms|->]
       [--decision-quota-signals <on|off|->] [--decision-quota-tiers <JSON|->]
+      [--session-pin <duration|->] (e.g. 20m; keeps a session on JEV's target while active)
       (jev only; the provider must be a configured jev-decision row)
       [--rename-from <id>] [--json]
   ocx combo stats <id> [--range <7d|30d|all>] [--json]
@@ -39,6 +42,15 @@ const USAGE = `Usage:
   ocx combo discover [--query <text>] [--json]`;
 
 type ComboRow = Record<string, unknown> & { id?: string; model?: string; strategy?: string };
+const STRATEGIES = ["failover", "round-robin", "random", "least-used", "reset-window", "jev"] as const;
+const isComboStrategy = (value: string): value is typeof STRATEGIES[number] => (STRATEGIES as readonly string[]).includes(value);
+// Combo writes print fixed messages instead of server text. When --targets kept a stored JEV
+// strategy the user did not name, a refusal of the targets or a JEV setting says so (#7579).
+const KEPT_JEV_REJECTED = "combo_targets_rejected_by_kept_jev";
+const KEPT_JEV_FIELDS = new Set(["targets", "decisionProvider", "decisionModel", "decisionTimeoutMs", "decisionQuotaSignals", "decisionQuotaTiers", "sessionPin"]);
+const SET_ERRORS = {
+  [KEPT_JEV_REJECTED]: "The selected target rejected the new targets or the kept jev settings. Without --strategy, --targets keeps the stored jev strategy with its decision method, quota policy and session pin, and the save checks the new targets together with them. Inspect the combo with ocx combo show <id> --json, then fix the targets or those settings, or pass --strategy to change the strategy.",
+};
 
 function parseTargets(value: string): Array<{ provider: string; model: string; weight?: number }> {
   const targets = value.split(",").map(part => part.trim()).filter(Boolean).map(part => {
@@ -91,29 +103,17 @@ async function set(argv: string[], deps: RuntimeApiDeps): Promise<number> {
   if (!id) throw new CliUsageError("combo id is required", USAGE);
   const additional = await prepareComboInput(args, deps);
   const targetsRaw = takeOption(args, "--targets");
+  const parsedTargets = targetsRaw === undefined ? undefined : parseTargets(targetsRaw);
   const renameFrom = takeOption(args, "--rename-from");
-  const replacingTargets = targetsRaw !== undefined || additional.targets !== undefined;
-  deps = { ...deps, baseUrl: await runtimeBaseUrl(deps) };
-  // A structured target file replaces the target list, not unrelated combo settings.
-  const partialCurrent = targetsRaw === undefined
-    ? await runtimeRequest<{ combos?: ComboRow[] }>("/api/combos", { redirect: "error" }, deps)
-    : undefined;
-  const partialExisting = partialCurrent?.combos?.find(row => row.id === (renameFrom ?? id));
-  if (!replacingTargets && !partialExisting) {
-    throw new CliUsageError("--targets is required when creating a combo", USAGE);
-  }
+  const replacingTargets = parsedTargets !== undefined || additional.targets !== undefined;
   const strategyRaw = takeOption(args, "--strategy");
-  const strategy = strategyRaw ?? partialExisting?.strategy ?? "failover";
-  if (strategy !== "failover" && strategy !== "round-robin" && strategy !== "random" && strategy !== "least-used" && strategy !== "reset-window" && strategy !== "jev") throw new CliUsageError("--strategy must be failover, round-robin, random, least-used, reset-window, or jev", USAGE);
+  if (strategyRaw !== undefined && !isComboStrategy(strategyRaw)) throw new CliUsageError("--strategy must be failover, round-robin, random, least-used, reset-window, or jev", USAGE);
   const stickyRaw = takeOption(args, "--sticky");
   const stickyLimit = stickyRaw === undefined ? undefined : stickyRaw === "-" ? 1 : Number(stickyRaw);
   if (stickyLimit !== undefined && (!Number.isInteger(stickyLimit) || stickyLimit < 1)) {
     throw new CliUsageError("--sticky must be an integer from 1 to 100, or -", USAGE);
   }
-  if (stickyLimit !== undefined) {
-    if (stickyLimit > 100) throw new CliUsageError("--sticky must be <= 100", USAGE);
-    if (strategy !== "round-robin") throw new CliUsageError("--sticky applies only to round-robin", USAGE);
-  }
+  if (stickyLimit !== undefined && stickyLimit > 100) throw new CliUsageError("--sticky must be <= 100", USAGE);
   const effort = takeOption(args, "--effort");
   const effortMode = takeOption(args, "--effort-mode");
   if (effortMode !== undefined && effortMode !== "fallback" && effortMode !== "force" && effortMode !== "-") {
@@ -128,19 +128,17 @@ async function set(argv: string[], deps: RuntimeApiDeps): Promise<number> {
   if (decisionModel !== undefined && decisionModel !== "-" && decisionProvider !== undefined && decisionProvider !== "-") {
     throw new CliUsageError("--decision-model cannot be combined with --decision-provider", USAGE);
   }
-  if (decisionModel !== undefined && decisionModel !== "-" && strategy !== "jev") {
-    throw new CliUsageError("--decision-model applies only to the jev strategy", USAGE);
-  }
-  if (decisionProvider !== undefined && decisionProvider !== "-" && strategy !== "jev") {
-    throw new CliUsageError("--decision-provider applies only to the jev strategy", USAGE);
-  }
   const quotaSignals = takeOption(args, "--decision-quota-signals");
   const quotaTiers = takeOption(args, "--decision-quota-tiers");
   if (quotaSignals !== undefined && !["on", "off", "-"].includes(quotaSignals)) throw new CliUsageError("--decision-quota-signals must be on, off or -", USAGE);
   let parsedQuotaTiers: ReturnType<typeof normalizeJevQuotaTiers> | null;
   try { parsedQuotaTiers = quotaTiers === undefined || quotaTiers === "-" ? null : normalizeJevQuotaTiers(JSON.parse(quotaTiers)); } catch { throw new CliUsageError("invalid --decision-quota-tiers JSON", USAGE); }
   if (quotaTiers !== undefined && quotaTiers !== "-" && !parsedQuotaTiers) throw new CliUsageError("quota tiers must be finite 0..100 and strictly ascending", USAGE);
-  if (strategy !== "jev" && (quotaSignals !== undefined && quotaSignals !== "-" || quotaTiers !== undefined && quotaTiers !== "-")) throw new CliUsageError("quota settings apply only to jev", USAGE);
+  const sessionPinRaw = takeOption(args, "--session-pin");
+  const sessionPinMs = sessionPinRaw === undefined || sessionPinRaw === "-" ? undefined : parseJevSessionPinDuration(sessionPinRaw);
+  if (sessionPinRaw !== undefined && sessionPinRaw !== "-" && sessionPinMs === undefined) {
+    throw new CliUsageError("--session-pin must be a duration from 1m to 24h (for example 90s, 20m, 1h, or milliseconds), or -", USAGE);
+  }
   const decisionTimeout = takeOption(args, "--decision-timeout");
   let decisionTimeoutMs: number | null | undefined;
   if (decisionTimeout !== undefined) {
@@ -154,19 +152,38 @@ async function set(argv: string[], deps: RuntimeApiDeps): Promise<number> {
         USAGE,
       );
     }
-    if (decisionTimeoutMs !== null && strategy !== "jev") {
-      throw new CliUsageError("--decision-timeout applies only to the jev strategy", USAGE);
-    }
   }
   rejectArgs(args, USAGE);
+  // Flags that belong to one strategy. An explicit --strategy is checked before any request; an
+  // omitted one is the stored strategy, so it is checked once the row has been read.
+  const requireStrategyFlags = (strategy: string): void => {
+    if (stickyLimit !== undefined && strategy !== "round-robin") throw new CliUsageError("--sticky applies only to round-robin", USAGE);
+    if (strategy === "jev") return;
+    if (decisionModel !== undefined && decisionModel !== "-") throw new CliUsageError("--decision-model applies only to the jev strategy", USAGE);
+    if (decisionProvider !== undefined && decisionProvider !== "-") throw new CliUsageError("--decision-provider applies only to the jev strategy", USAGE);
+    if (quotaSignals !== undefined && quotaSignals !== "-" || quotaTiers !== undefined && quotaTiers !== "-") throw new CliUsageError("quota settings apply only to jev", USAGE);
+    if (sessionPinMs !== undefined) throw new CliUsageError("--session-pin applies only to the jev strategy", USAGE);
+    if (decisionTimeoutMs != null) throw new CliUsageError("--decision-timeout applies only to the jev strategy", USAGE);
+  };
+  if (strategyRaw !== undefined) requireStrategyFlags(strategyRaw);
+  deps = { ...deps, baseUrl: await runtimeBaseUrl(deps) };
+  // Replacing targets keeps every other stored setting, including the strategy and its policy (#7579).
+  const current = await runtimeRequest<{ combos?: ComboRow[] }>("/api/combos", { redirect: "error" }, deps);
+  const existing = current.combos?.find(row => row.id === (renameFrom ?? id));
+  if (!replacingTargets && !existing) {
+    throw new CliUsageError("--targets is required when creating a combo", USAGE);
+  }
+  const strategy = strategyRaw ?? existing?.strategy ?? "failover";
+  if (!isComboStrategy(strategy)) throw new CliUsageError(`combo ${renameFrom ?? id} has an unsupported stored strategy; pass --strategy`, USAGE);
+  if (strategyRaw === undefined) requireStrategyFlags(strategy);
   // Listing-only nulls must not be resent as explicit clears (alias rejects null).
-  const combo: Record<string, unknown> = partialExisting
-    ? Object.fromEntries(Object.entries(partialExisting).filter(([, value]) => value !== null))
-    : { strategy, stickyLimit: stickyLimit ?? 1, targets: additional.targets ?? parseTargets(targetsRaw!) };
+  const combo: Record<string, unknown> = existing
+    ? Object.fromEntries(Object.entries(existing).filter(([, value]) => value !== null))
+    : { strategy, stickyLimit: stickyLimit ?? 1 };
   delete combo.id;
   delete combo.model;
-  if (additional.targets !== undefined) combo.targets = additional.targets;
-  if (strategyRaw !== undefined) combo.strategy = strategy;
+  if (replacingTargets) combo.targets = additional.targets ?? parsedTargets;
+  combo.strategy = strategy;
   if (stickyLimit !== undefined) combo.stickyLimit = stickyLimit;
   if (effort !== undefined) combo.defaultEffort = effort === "-" ? null : effort;
   if (effortMode !== undefined) combo.defaultEffortMode = effortMode === "-" ? "fallback" : effortMode;
@@ -184,26 +201,33 @@ async function set(argv: string[], deps: RuntimeApiDeps): Promise<number> {
   if (decisionTimeoutMs !== undefined) combo.decisionTimeoutMs = decisionTimeoutMs;
   if (quotaSignals !== undefined) combo.decisionQuotaSignals = quotaSignals === "-" ? null : quotaSignals === "on";
   if (quotaTiers !== undefined) combo.decisionQuotaTiers = parsedQuotaTiers;
+  if (sessionPinRaw !== undefined) combo.sessionPin = sessionPinMs === undefined ? null : { ttlMs: sessionPinMs };
   if (strategy !== "jev") {
     delete combo.decisionProvider;
     delete combo.decisionModel;
     delete combo.decisionTimeoutMs;
     delete combo.decisionQuotaSignals;
     delete combo.decisionQuotaTiers;
-  }
-  const current = partialCurrent ?? await runtimeRequest<{ combos?: ComboRow[] }>("/api/combos", { redirect: "error" }, deps);
-  const existing = (current.combos ?? []).find(row => row.id === (renameFrom ?? id));
-  if (additional.imageInput === undefined && existing?.imageInput === "disabled") combo.imageInput = "disabled";
-  if (effort === undefined && existing?.defaultEffort != null && combo.defaultEffort === undefined) {
-    combo.defaultEffort = existing.defaultEffort;
+    delete combo.sessionPin;
   }
   if (effortMode === undefined && existing?.defaultEffortMode === "force") {
     combo.defaultEffortMode = effort === "-" ? "fallback" : "force";
   }
-  const result = await runtimeRequest("/api/combos", {
-    method: "PUT", redirect: "error",
-    body: serializeManagementJson({ id, combo, ...(renameFrom ? { renameFrom } : {}) }),
-  }, deps);
+  let result: unknown;
+  try {
+    result = await runtimeRequest("/api/combos", {
+      method: "PUT", redirect: "error",
+      body: serializeManagementJson({ id, combo, ...(renameFrom ? { renameFrom } : {}) }),
+    }, deps);
+  } catch (error) {
+    const field = error instanceof RuntimeApiError && error.body !== null && typeof error.body === "object"
+      ? (error.body as Record<string, unknown>).field : undefined;
+    if (error instanceof RuntimeApiError && error.status === 400 && typeof field === "string" && KEPT_JEV_FIELDS.has(field)
+      && replacingTargets && strategyRaw === undefined && strategy === "jev") {
+      throw new RuntimeApiError(error.message, error.status, { code: KEPT_JEV_REJECTED });
+    }
+    throw error;
+  }
   return printComboWriteResult(result, id, wantsJson);
 }
 
@@ -286,7 +310,7 @@ async function discover(argv: string[], deps: RuntimeApiDeps): Promise<void> {
 
 export async function handleComboCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
   const [subcommand, ...writeArgs] = argv;
-  if (subcommand === "set" || subcommand === "create" || subcommand === "update") return runCatalogAction(() => set(writeArgs, deps));
+  if (subcommand === "set" || subcommand === "create" || subcommand === "update") return runCatalogAction(() => set(writeArgs, deps), SET_ERRORS);
   if (subcommand === "stats") {
     const { handleComboStatsCommand } = await import("./combo-stats");
     return handleComboStatsCommand(writeArgs, deps);

package/src/cli/launcher-context.ts

@@ -24,7 +24,11 @@ export type TrustedNodeLaunchContext = {
     codexCliPath: string | null;
     path: string | null;
     pathExt: string | null;
+    home: string | null;
+    nodePath: string | null;
     managerRoots: CodexCliVersionManagerRoots | null;
+    transportEnv: Readonly<Record<string, string>>;
+    arch: NodeJS.Architecture | null;
     configDir: string;
   }> | null;
 };
@@ -50,6 +54,27 @@ function parseVersionManagerRoots(value: unknown): CodexCliVersionManagerRoots |
   return Object.freeze(Object.fromEntries(entries)) as CodexCliVersionManagerRoots;
 }
 
+function parseTransportEnv(value: unknown): Readonly<Record<string, string>> | undefined {
+  // Older snapshots convey no transport settings. Never fill them from Bun's ambient env.
+  if (value === undefined) return Object.freeze({});
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const entries = Object.entries(value);
+  if (entries.some(([name, setting]) => !CODEX_CLI_TRANSPORT_ENV_KEYS.includes(name.toLowerCase())
+    || typeof setting !== "string" || setting.length > 32 * 1024)) return undefined;
+  return Object.freeze(Object.fromEntries(entries));
+}
+
+const NODE_ARCHITECTURES: ReadonlySet<string> = new Set<NodeJS.Architecture>([
+  "arm", "arm64", "ia32", "loong64", "mips", "mipsel", "ppc64", "riscv64", "s390x", "x64",
+]);
+
+function parseLauncherArch(value: unknown): NodeJS.Architecture | null | undefined {
+  // Older snapshots predate the field; absent stays null (Bun's own arch is the
+  // pre-existing fallback). Any other non-architecture value is untrusted.
+  if (value === undefined || value === null) return null;
+  return typeof value === "string" && NODE_ARCHITECTURES.has(value) ? value as NodeJS.Architecture : undefined;
+}
+
 /** Consume the internal proof before normal CLI argument parsing. */
 export function initializeNodeLauncherContext(
   argv: string[] = process.argv,
@@ -70,7 +95,7 @@ export function initializeNodeLauncherContext(
   delete env.OCX_PRE_BUN_ANTHROPIC_ENV;
   trustedContext = null;
 
-  if (proofArgs.length !== 1 || !raw || raw.length > 64 * 1024) return null;
+  if (proofArgs.length !== 1 || !raw || raw.length > NODE_LAUNCH_CONTEXT_MAX_CHARS) return null;
   const proof = proofArgs[0]!;
   if (!isLaunchProof(proof)) return null;
 
@@ -95,6 +120,12 @@ export function initializeNodeLauncherContext(
     const managerRoots = inspection && typeof inspection === "object" && !Array.isArray(inspection)
       ? parseVersionManagerRoots((inspection as Record<string, unknown>).managerRoots)
       : null;
+    const transportEnv = inspection && typeof inspection === "object" && !Array.isArray(inspection)
+      ? parseTransportEnv((inspection as Record<string, unknown>).transportEnv)
+      : undefined;
+    const arch = inspection && typeof inspection === "object" && !Array.isArray(inspection)
+      ? parseLauncherArch((inspection as Record<string, unknown>).arch)
+      : undefined;
     const codexCliInspectionEnv = inspection === null || inspection === undefined
       ? null
       : inspection && typeof inspection === "object" && !Array.isArray(inspection)
@@ -102,15 +133,27 @@ export function initializeNodeLauncherContext(
           const value = (inspection as Record<string, unknown>)[key];
           return value === null || typeof value === "string";
         })
+        // Older launchers predate the lookup-seed slots; absent stays null so
+        // the fallback lane simply remains unverifiable rather than untrusted.
+        && ["home", "nodePath"].every(key => {
+          const value = (inspection as Record<string, unknown>)[key];
+          return value === undefined || value === null || typeof value === "string";
+        })
         && typeof (inspection as Record<string, unknown>).configDir === "string"
         && (inspection as Record<string, string>).configDir.length > 0
         && (inspection as Record<string, string>).configDir.length <= 32 * 1024
         && managerRoots !== undefined
+        && transportEnv !== undefined
+        && arch !== undefined
         ? Object.freeze({
             codexCliPath: (inspection as Record<string, string | null>).codexCliPath ?? null,
             path: (inspection as Record<string, string | null>).path ?? null,
             pathExt: (inspection as Record<string, string | null>).pathExt ?? null,
+            home: (inspection as Record<string, string | null>).home ?? null,
+            nodePath: (inspection as Record<string, string | null>).nodePath ?? null,
             managerRoots,
+            transportEnv,
+            arch,
             configDir: (inspection as Record<string, string>).configDir,
           })
         : undefined;
@@ -125,4 +168,8 @@ export function initializeNodeLauncherContext(
 export function trustedNodeLauncherContext(): TrustedNodeLaunchContext | null {
   return trustedContext;
 }
-import { CODEX_CLI_VERSION_MANAGER_ROOT_ENV_SLOTS } from "../update/codex-cli-update-launch-policy.mjs";
+import {
+  CODEX_CLI_TRANSPORT_ENV_KEYS,
+  CODEX_CLI_VERSION_MANAGER_ROOT_ENV_SLOTS,
+  NODE_LAUNCH_CONTEXT_MAX_CHARS,
+} from "../update/codex-cli-update-launch-policy.mjs";