@byok-sdk/client 0.1.1 → 0.3.0

package/dist/adapters/index.js

@@ -1,9 +1,9 @@
 import { execFile, spawn, spawnSync } from 'child_process';
 import { promisify } from 'util';
-import { promises, realpathSync } from 'fs';
-import os from 'os';
-import path2 from 'path';
+import { promises, existsSync, readFileSync, realpathSync } from 'fs';
+import path3 from 'path';
 import { fileURLToPath } from 'url';
+import os from 'os';
 import 'readline';
 
 // src/adapters/pi/pi-adapter.ts
@@ -24,20 +24,50 @@ var SteerUnsupportedError = class extends Error {
     this.runtimeId = runtimeId;
   }
 };
-
-// src/adapters/pi/resolve-bin.ts
 var PI_PACKAGE_NAME = "@earendil-works/pi-coding-agent";
+function readPackageJson(dir) {
+  const candidate = path3.join(dir, "package.json");
+  if (!existsSync(candidate)) return void 0;
+  try {
+    return JSON.parse(readFileSync(candidate, "utf8"));
+  } catch {
+    return void 0;
+  }
+}
 function resolvePiBin() {
   const override = process.env.BYOK_PI_BIN;
   if (override) {
-    return { command: override, source: "path" };
+    return { command: override, source: "env" };
   }
-  return { command: "pi", source: "path" };
+  try {
+    const mainEntryUrl = import.meta.resolve(PI_PACKAGE_NAME);
+    let dir = path3.dirname(fileURLToPath(mainEntryUrl));
+    for (let depth = 0; depth < 6; depth++) {
+      const pkg = readPackageJson(dir);
+      if (pkg?.name === PI_PACKAGE_NAME) {
+        const binRel = typeof pkg.bin === "string" ? pkg.bin : pkg.bin?.pi;
+        if (binRel) {
+          return { command: path3.join(dir, binRel), source: "package" };
+        }
+        break;
+      }
+      const parent = path3.dirname(dir);
+      if (parent === dir) break;
+      dir = parent;
+    }
+  } catch (cause) {
+    throw new Error(
+      `Required ${PI_PACKAGE_NAME} could not be resolved; install @byok-sdk/client dependencies or set BYOK_PI_BIN to a Node 22.19+ pi sidecar`,
+      { cause }
+    );
+  }
+  throw new Error(
+    `Required ${PI_PACKAGE_NAME} does not expose the pi CLI; reinstall the pinned dependency or set BYOK_PI_BIN to a Node 22.19+ pi sidecar`
+  );
 }
 
 // src/adapters/pi/permission-mapping.ts
 var READONLY_TOOLS = ["read", "grep", "find", "ls"];
-var DEFAULT_ACTIVE_TOOLS = ["read", "bash", "edit", "write"];
 function mapPermissionPolicyToPiArgs(policy) {
   if (policy.network === false) {
     return {
@@ -56,22 +86,18 @@ function mapPermissionPolicyToPiArgs(policy) {
   const denyTools = policy.denyTools ?? [];
   if (policy.mode === "readonly") {
     const base = policy.allowTools ? policy.allowTools.filter((tool) => READONLY_TOOLS.includes(tool)) : [...READONLY_TOOLS];
-    const effective = subtractDenied(base, denyTools);
-    return { ok: true, args: effective.length === 0 ? ["--no-tools"] : ["--tools", effective.join(",")] };
-  }
-  if (denyTools.length > 0) {
-    const base = policy.allowTools && policy.allowTools.length > 0 ? policy.allowTools : [...DEFAULT_ACTIVE_TOOLS];
-    const effective = subtractDenied(base, denyTools);
-    return { ok: true, args: effective.length === 0 ? ["--no-tools"] : ["--tools", effective.join(",")] };
+    if (base.length === 0) return { ok: true, args: ["--no-tools"] };
+    return {
+      ok: true,
+      args: ["--tools", base.join(","), ...denyTools.length > 0 ? ["--exclude-tools", denyTools.join(",")] : []]
+    };
   }
+  const args = [];
   if (policy.allowTools && policy.allowTools.length > 0) {
-    return { ok: true, args: ["--tools", policy.allowTools.join(",")] };
+    args.push("--tools", policy.allowTools.join(","));
   }
-  return { ok: true, args: [] };
-}
-function subtractDenied(tools, denyTools) {
-  const denied = new Set(denyTools);
-  return tools.filter((tool) => !denied.has(tool));
+  if (denyTools.length > 0) args.push("--exclude-tools", denyTools.join(","));
+  return { ok: true, args };
 }
 
 // src/adapters/pi/events.ts
@@ -96,7 +122,7 @@ function mapPiMessageToAgentEvent(msg) {
         output: { result: msg.result, isError: msg.isError === true }
       };
     }
-    case "agent_end":
+    case "agent_settled":
       return { type: "turn_end" };
     /**
      * `artifact` is NOT a real pi RPC message — pi's own `write` tool only
@@ -132,16 +158,22 @@ function mapPiMessageToAgentEvent(msg) {
     // `recordUnmappedFrame`) can tell "known, expected, silently ignored"
     // apart from "genuinely never seen before" (falls to `default` below).
     case "agent_start":
+    case "agent_end":
+    // one low-level run; `agent_settled` is BYOK completion
     case "turn_start":
     case "turn_end":
-    // pi's own per-LLM-turn boundary, not ours — see `agent_end` above
+    // pi's own per-LLM-turn boundary, not ours
     case "message_start":
     case "message_end":
+    case "bash_execution_update":
     case "tool_execution_update":
     case "queue_update":
     case "compaction_start":
     case "compaction_end":
     case "auto_retry_start":
+    case "summarization_retry_scheduled":
+    case "summarization_retry_attempt_start":
+    case "summarization_retry_finished":
     case "session_info_changed":
     case "thinking_level_changed":
       return void 0;
@@ -151,15 +183,20 @@ function mapPiMessageToAgentEvent(msg) {
 }
 var ROUTINE_PI_EVENT_TYPES = /* @__PURE__ */ new Set([
   "agent_start",
+  "agent_end",
   "turn_start",
   "turn_end",
   "message_start",
   "message_end",
+  "bash_execution_update",
   "tool_execution_update",
   "queue_update",
   "compaction_start",
   "compaction_end",
   "auto_retry_start",
+  "summarization_retry_scheduled",
+  "summarization_retry_attempt_start",
+  "summarization_retry_finished",
   "session_info_changed",
   "thinking_level_changed"
 ]);
@@ -293,10 +330,7 @@ var PiRpcClient = class {
    * traffic. Logs once per distinct type (not per occurrence, so a
    * repeating unmapped type can't spam stdout); the running tally is also
    * folded into this client's exit-time error message (`buildExitError`) so
-   * a post-mortem on a failed/hung task has it without needing separate log
-   * scraping. This is the exact mechanism that would have turned this
-   * task's root-cause hang (`agent_end` arriving with no mapping) into a
-   * one-line, immediate warning instead of a silent stall.
+   * a post-mortem on a failed/hung task has it without separate log scraping.
    */
   recordUnmappedFrame(type) {
     const next = (this.unmappedFrameCounts.get(type) ?? 0) + 1;
@@ -407,13 +441,8 @@ var PiRpcClient = class {
   }
 };
 
-// src/adapters/pi/pi-adapter.ts
-var execFileAsync = promisify(execFile);
-var DETECT_TIMEOUT_MS = 5e3;
-function errorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-var KNOWN_PROVIDER_ENV_VARS = [
+// src/adapters/provider-credential-environment.ts
+var PROVIDER_CREDENTIAL_ENV_NAMES = [
   "ANTHROPIC_API_KEY",
   "ANTHROPIC_OAUTH_TOKEN",
   "OPENAI_API_KEY",
@@ -424,24 +453,66 @@ var KNOWN_PROVIDER_ENV_VARS = [
   "MISTRAL_API_KEY",
   "OPENROUTER_API_KEY",
   "XAI_API_KEY",
-  // Confirmed against the installed pi's own docs/providers.md ("ZAI |
-  // `ZAI_API_KEY` | `zai`") and exercised live against real GLM traffic
-  // during this task's acceptance run — omitting it made `authPresent`
-  // silently false for a perfectly valid, working z.ai/GLM setup.
   "ZAI_API_KEY"
 ];
+var PROVIDER_CREDENTIAL_ENV_DENY_NAMES = [
+  ...PROVIDER_CREDENTIAL_ENV_NAMES,
+  "ANT_LING_API_KEY",
+  "NVIDIA_API_KEY",
+  "CEREBRAS_API_KEY",
+  "CLOUDFLARE_API_KEY",
+  "AI_GATEWAY_API_KEY",
+  "ZAI_CODING_CN_API_KEY",
+  "OPENCODE_API_KEY",
+  "RADIUS_API_KEY",
+  "FIREWORKS_API_KEY",
+  "TOGETHER_API_KEY",
+  "BASETEN_API_KEY",
+  "KIMI_API_KEY",
+  "MINIMAX_API_KEY",
+  "MINIMAX_CN_API_KEY",
+  "QWEN_TOKEN_PLAN_API_KEY",
+  "QWEN_TOKEN_PLAN_CN_API_KEY",
+  "XIAOMI_API_KEY",
+  "XIAOMI_TOKEN_PLAN_CN_API_KEY",
+  "XIAOMI_TOKEN_PLAN_AMS_API_KEY",
+  "XIAOMI_TOKEN_PLAN_SGP_API_KEY",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "GOOGLE_APPLICATION_CREDENTIALS",
+  // Reserved by the keys-owned Pi projection. It must never be inherited
+  // from the daemon; the launcher deletes any ambient copy and injects only
+  // the exact credential it just resolved from OS custody.
+  "PI_PROVIDER_API_KEY"
+];
+function withoutProviderCredentials(env) {
+  const sanitized = { ...env };
+  for (const name of PROVIDER_CREDENTIAL_ENV_DENY_NAMES) {
+    delete sanitized[name];
+  }
+  return sanitized;
+}
+
+// src/adapters/pi/pi-adapter.ts
+var execFileAsync = promisify(execFile);
+var DETECT_TIMEOUT_MS = 5e3;
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
 var PiAdapter = class {
   constructor(options = {}) {
     this.options = options;
   }
   options;
   id = "pi";
+  supportsDispatchSelection = true;
   async detect() {
-    const bin = this.resolveBin();
     try {
+      const bin = this.resolveBin();
       const { stdout, stderr } = await execFileAsync(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS });
       const version = stdout.trim() || stderr.trim();
-      const authPresent = KNOWN_PROVIDER_ENV_VARS.some((name) => process.env[name] !== void 0);
+      const authPresent = PROVIDER_CREDENTIAL_ENV_NAMES.some((name) => process.env[name] !== void 0);
       return { present: true, version, authPresent };
     } catch {
       return { present: false };
@@ -460,7 +531,7 @@ var PiAdapter = class {
    * variable beyond the platform baseline (`daemon/environment.ts`).
    */
   environmentRequirements() {
-    return { credentialNames: KNOWN_PROVIDER_ENV_VARS };
+    return { credentialNames: PROVIDER_CREDENTIAL_ENV_NAMES };
   }
   async start(task, ctx) {
     if (typeof task.instruction !== "string") {
@@ -472,12 +543,45 @@ var PiAdapter = class {
     }
     const bin = this.resolveBin();
     const resumeSessionId = task.sessionRef;
-    const args = ["--mode", "rpc", ...resumeSessionId ? ["--session", resumeSessionId] : [], ...mapping.args];
+    const piArgs = ["--mode", "rpc", ...resumeSessionId ? ["--session", resumeSessionId] : [], ...mapping.args];
+    const selection = task.dispatchSelection;
+    let command = bin.command;
+    let args = piArgs;
+    if (selection !== void 0) {
+      if (selection.lane !== "byok" || selection.runtimeId !== "pi") {
+        throw new PolicyUnsupportedError(
+          `pi adapter cannot execute ${selection.lane} selection for runtime ${selection.runtimeId}`
+        );
+      }
+      const launcher = this.options.byokLauncher;
+      if (launcher === void 0) {
+        throw new PolicyUnsupportedError(
+          "pi BYOK selection requires a configured credential-custody launcher"
+        );
+      }
+      command = launcher.command;
+      args = [
+        ...launcher.args ?? [],
+        "--pi-bin",
+        bin.command,
+        "--profile-db",
+        launcher.profileDbPath,
+        "--session-dir",
+        launcher.sessionDir,
+        ...launcher.secretServicePrefix ? ["--secret-service-prefix", launcher.secretServicePrefix] : [],
+        "--provider",
+        selection.providerId,
+        "--model",
+        selection.modelId,
+        "--",
+        ...piArgs
+      ];
+    }
     const rpc = new PiRpcClient({
-      command: bin.command,
+      command,
       args,
       cwd: ctx.workspaceDir,
-      env: ctx.env,
+      env: selection === void 0 ? ctx.env : withoutProviderCredentials(ctx.env),
       spawnFn: this.options.spawnFn
     });
     const response = await rpc.send({ type: "prompt", message: task.instruction });
@@ -496,7 +600,7 @@ var PiAdapter = class {
         throw err;
       }
     }
-    return new PiSession(sessionRef, rpc);
+    return new PiSession(sessionRef, rpc, selection);
   }
   resolveBin() {
     return (this.options.resolveBin ?? resolvePiBin)();
@@ -524,12 +628,14 @@ async function resolveFreshSessionId(rpc) {
   );
 }
 var PiSession = class {
-  constructor(sessionRef, rpc) {
+  constructor(sessionRef, rpc, selection) {
     this.sessionRef = sessionRef;
     this.rpc = rpc;
+    this.selection = selection;
   }
   sessionRef;
   rpc;
+  selection;
   get events() {
     const rpc = this.rpc;
     return {
@@ -558,6 +664,12 @@ var PiSession = class {
     if (typeof task.instruction !== "string") {
       throw new PolicyUnsupportedError("pi adapter only supports string instructions in M0 (no blob-ref fetch yet)");
     }
+    const requestedSelection = task.dispatchSelection;
+    if (requestedSelection !== void 0 && (this.selection?.lane !== "byok" || requestedSelection.lane !== "byok" || requestedSelection.runtimeId !== "pi" || requestedSelection.providerId !== this.selection.providerId || requestedSelection.modelId !== this.selection.modelId)) {
+      throw new PolicyUnsupportedError(
+        "pi persistent session cannot change its authoritative BYOK provider/model selection"
+      );
+    }
     await this.rpc.send({ type: "prompt", message: task.instruction, streamingBehavior: "followUp" });
   }
   async interrupt() {
@@ -584,7 +696,7 @@ function resolveApprovalMcpBin() {
   if (override) {
     return { command: override, args: [], source: "env" };
   }
-  const distBin = path2.join(path2.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
+  const distBin = path3.join(path3.dirname(fileURLToPath(import.meta.url)), "bin", "byok-approval-mcp.js");
   return { command: process.execPath, args: [distBin], source: "dist" };
 }
 
@@ -615,7 +727,7 @@ function mapPermissionPolicyToClaudeArgs(policy) {
   }
   if (policy.mode === "readonly") {
     const base = policy.allowTools ? policy.allowTools.filter((tool) => READONLY_TOOLS2.includes(tool)) : [...READONLY_TOOLS2];
-    const effective = subtractDenied2(base, denyTools);
+    const effective = subtractDenied(base, denyTools);
     return { ok: true, args: ["--permission-mode", "default", "--tools", effective.join(",")] };
   }
   if (denyTools.length > 0) {
@@ -632,7 +744,7 @@ function mapPermissionPolicyToClaudeArgs(policy) {
   }
   return { ok: true, args };
 }
-function subtractDenied2(tools, denyTools) {
+function subtractDenied(tools, denyTools) {
   const denied = new Set(denyTools);
   return tools.filter((tool) => !denied.has(tool));
 }
@@ -664,7 +776,7 @@ var EXTENSION_CONTENT_TYPES = {
   ".yml": "application/yaml"
 };
 function guessContentType(filePath) {
-  const ext = path2.extname(filePath).toLowerCase();
+  const ext = path3.extname(filePath).toLowerCase();
   return EXTENSION_CONTENT_TYPES[ext] ?? "application/octet-stream";
 }
 function mapAssistant(msg, correlation) {
@@ -736,11 +848,11 @@ function tryBuildArtifactEvent(msg, workspaceDir) {
   const filePath = toolUseResult && typeof toolUseResult.filePath === "string" ? toolUseResult.filePath : void 0;
   if (!filePath) return void 0;
   const realWorkspaceDir = tryRealpath(workspaceDir) ?? workspaceDir;
-  const fileDir = path2.dirname(filePath);
+  const fileDir = path3.dirname(filePath);
   const realFileDir = tryRealpath(fileDir) ?? fileDir;
-  const realFilePath = path2.join(realFileDir, path2.basename(filePath));
-  const relative = path2.relative(realWorkspaceDir, realFilePath);
-  if (relative === "" || relative.startsWith("..") || path2.isAbsolute(relative)) {
+  const realFilePath = path3.join(realFileDir, path3.basename(filePath));
+  const relative = path3.relative(realWorkspaceDir, realFilePath);
+  if (relative === "" || relative.startsWith("..") || path3.isAbsolute(relative)) {
     return void 0;
   }
   return { type: "artifact", name: relative, contentType: guessContentType(filePath) };
@@ -982,7 +1094,7 @@ var APPROVAL_TOOL_NAME = "approval_prompt";
 var APPROVAL_MCP_SERVER_NAME = "byokapproval";
 var execFileAsync2 = promisify(execFile);
 var DETECT_TIMEOUT_MS2 = 5e3;
-async function cleanupApprovalMcpConfigDir(dir) {
+async function cleanupMcpConfigDir(dir) {
   if (!dir) return;
   await promises.rm(dir, { recursive: true, force: true }).catch(() => {
   });
@@ -992,6 +1104,7 @@ var ClaudeAdapter = class {
     this.options = options;
   }
   options;
+  supportsDispatchSelection = true;
   id = "claude";
   async detect() {
     const bin = this.resolveBin();
@@ -1005,7 +1118,13 @@ var ClaudeAdapter = class {
     }
   }
   capabilities() {
-    return { steer: false, resume: true, approvalInteractive: true, permissionModes: ["auto", "readonly", "plan", "confirm"] };
+    return {
+      steer: false,
+      resume: true,
+      approvalInteractive: true,
+      mcpToolsets: true,
+      permissionModes: ["auto", "readonly", "plan", "confirm"]
+    };
   }
   /**
    * M5: deliberate product-boundary decision, not an oversight — byok's
@@ -1031,42 +1150,51 @@ var ClaudeAdapter = class {
     if (!mapping.ok) {
       throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by claude adapter");
     }
-    let approvalMcpConfigDir;
+    const modelId = subscriptionModel(task, "claude");
+    let mcpConfigDir;
+    const taskMcpServers = ctx.mcpServers ?? {};
+    const needsMcpConfig = mapping.needsApprovalMcp || Object.keys(taskMcpServers).length > 0;
     if (mapping.needsApprovalMcp) {
       if (!ctx.approvalChannel) {
         throw new PolicyUnsupportedError(
           'claude adapter requires policy.mode "confirm" to be started with an approval channel (TaskContext.approvalChannel) \u2014 none was provided'
         );
       }
-      const approvalMcpBin = (this.options.resolveApprovalMcpBin ?? resolveApprovalMcpBin)();
-      approvalMcpConfigDir = await promises.mkdtemp(path2.join(os.tmpdir(), "byok-approval-mcp-"));
-      await promises.chmod(approvalMcpConfigDir, 448).catch(() => {
+      if (Object.prototype.hasOwnProperty.call(taskMcpServers, APPROVAL_MCP_SERVER_NAME)) {
+        throw new PolicyUnsupportedError(
+          `MCP server name "${APPROVAL_MCP_SERVER_NAME}" is reserved by the claude approval channel`
+        );
+      }
+    }
+    if (needsMcpConfig) {
+      mcpConfigDir = await promises.mkdtemp(path3.join(os.tmpdir(), "byok-mcp-"));
+      await promises.chmod(mcpConfigDir, 448).catch(() => {
       });
-      const mcpConfigPath = path2.join(approvalMcpConfigDir, "mcp-config.json");
-      const mcpConfig = {
-        mcpServers: {
-          [APPROVAL_MCP_SERVER_NAME]: {
-            command: approvalMcpBin.command,
-            args: approvalMcpBin.args,
-            env: {
-              BYOK_STORE_DIR: ctx.approvalChannel.storeDir,
-              BYOK_PRODUCT_ID: ctx.approvalChannel.productId,
-              BYOK_TASK_ID: ctx.approvalChannel.taskId,
-              BYOK_APPROVAL_TIMEOUT_MS: String(ctx.approvalChannel.timeoutMs)
-            }
+      const mcpConfigPath = path3.join(mcpConfigDir, "mcp-config.json");
+      const mcpServers = { ...taskMcpServers };
+      if (mapping.needsApprovalMcp) {
+        const approvalChannel = ctx.approvalChannel;
+        if (!approvalChannel) throw new Error("unreachable: approval channel checked above");
+        const approvalMcpBin = (this.options.resolveApprovalMcpBin ?? resolveApprovalMcpBin)();
+        mcpServers[APPROVAL_MCP_SERVER_NAME] = {
+          command: approvalMcpBin.command,
+          args: approvalMcpBin.args,
+          env: {
+            BYOK_STORE_DIR: approvalChannel.storeDir,
+            BYOK_PRODUCT_ID: approvalChannel.productId,
+            BYOK_TASK_ID: approvalChannel.taskId,
+            BYOK_APPROVAL_TIMEOUT_MS: String(approvalChannel.timeoutMs)
           }
-        }
-      };
-      await promises.writeFile(mcpConfigPath, JSON.stringify(mcpConfig), { mode: 384 });
+        };
+      }
+      await promises.writeFile(mcpConfigPath, JSON.stringify({ mcpServers }), { mode: 384 });
       mapping.args = [
         ...mapping.args,
-        "--permission-prompt-tool",
-        `mcp__${APPROVAL_MCP_SERVER_NAME}__${APPROVAL_TOOL_NAME}`,
+        ...mapping.needsApprovalMcp ? ["--permission-prompt-tool", `mcp__${APPROVAL_MCP_SERVER_NAME}__${APPROVAL_TOOL_NAME}`] : [],
         "--mcp-config",
         mcpConfigPath,
-        // Never let this task's confirm-mode run pick up some OTHER MCP
-        // server from ambient project/user config — the approval channel is
-        // the only MCP server this invocation should ever see.
+        // The generated file is the complete task-scoped MCP authority.
+        // Never merge ambient user/project MCP configuration into it.
         "--strict-mcp-config"
       ];
     }
@@ -1083,6 +1211,7 @@ var ClaudeAdapter = class {
       // "Error: When using --print, --output-format=stream-json requires
       // --verbose", before spawning any model call.
       "--verbose",
+      ...modelId ? ["--model", modelId] : [],
       ...resumeSessionId ? ["--resume", resumeSessionId] : [],
       ...mapping.args
     ];
@@ -1090,7 +1219,7 @@ var ClaudeAdapter = class {
       command: bin.command,
       args,
       cwd: ctx.workspaceDir,
-      env: ctx.env,
+      env: withoutProviderCredentials(ctx.env),
       spawnFn: this.options.spawnFn
     });
     client.writeUserMessage(task.instruction);
@@ -1099,17 +1228,24 @@ var ClaudeAdapter = class {
       sessionRef = await client.waitForInit();
     } catch (err) {
       client.kill();
-      await cleanupApprovalMcpConfigDir(approvalMcpConfigDir);
+      await cleanupMcpConfigDir(mcpConfigDir);
       throw err;
     }
     if (resumeSessionId !== void 0 && sessionRef !== resumeSessionId) {
       client.kill();
-      await cleanupApprovalMcpConfigDir(approvalMcpConfigDir);
+      await cleanupMcpConfigDir(mcpConfigDir);
       throw new Error(
         `claude --resume echoed a different session id than requested (requested ${resumeSessionId}, got ${sessionRef}) \u2014 refusing to continue in a possibly-wrong session (fail-closed)`
       );
     }
-    return new ClaudeSession(sessionRef, client, ctx.workspaceDir, ctx.approvalChannel, approvalMcpConfigDir);
+    return new ClaudeSession(
+      sessionRef,
+      client,
+      ctx.workspaceDir,
+      ctx.approvalChannel,
+      mcpConfigDir,
+      modelId
+    );
   }
   /**
    * `claude auth status --json` is claude's OWN non-secret login-state
@@ -1143,19 +1279,31 @@ var ClaudeAdapter = class {
     return (this.options.resolveBin ?? resolveClaudeBin)();
   }
 };
+function subscriptionModel(task, runtimeId) {
+  const selection = task.dispatchSelection;
+  if (selection === void 0) return void 0;
+  if (selection.lane !== "subscription" || selection.runtimeId !== runtimeId) {
+    throw new PolicyUnsupportedError(
+      `claude adapter cannot execute ${selection.lane} selection for runtime ${selection.runtimeId}`
+    );
+  }
+  return selection.modelId;
+}
 var ClaudeSession = class {
-  constructor(sessionRef, client, workspaceDir, approvalChannel, approvalMcpConfigDir) {
+  constructor(sessionRef, client, workspaceDir, approvalChannel, mcpConfigDir, modelId) {
     this.sessionRef = sessionRef;
     this.client = client;
     this.workspaceDir = workspaceDir;
     this.approvalChannel = approvalChannel;
-    this.approvalMcpConfigDir = approvalMcpConfigDir;
+    this.mcpConfigDir = mcpConfigDir;
+    this.modelId = modelId;
   }
   sessionRef;
   client;
   workspaceDir;
   approvalChannel;
-  approvalMcpConfigDir;
+  mcpConfigDir;
+  modelId;
   correlation = createToolUseCorrelation();
   get events() {
     const client = this.client;
@@ -1206,6 +1354,12 @@ var ClaudeSession = class {
     if (typeof task.instruction !== "string") {
       throw new PolicyUnsupportedError("claude adapter only supports string instructions in M2 (no blob-ref fetch yet)");
     }
+    const requestedModel = subscriptionModel(task, "claude");
+    if (requestedModel !== void 0 && requestedModel !== this.modelId) {
+      throw new PolicyUnsupportedError(
+        `claude persistent session cannot change model from ${this.modelId ?? "(legacy default)"} to ${requestedModel}`
+      );
+    }
     this.client.writeUserMessage(task.instruction);
   }
   /**
@@ -1225,7 +1379,7 @@ var ClaudeSession = class {
   }
   async close() {
     this.client.kill();
-    await cleanupApprovalMcpConfigDir(this.approvalMcpConfigDir);
+    await cleanupMcpConfigDir(this.mcpConfigDir);
   }
   /**
    * M4 Phase 3: routes into the out-of-band approval channel `start()`
@@ -1389,8 +1543,8 @@ function extractArtifactEvents(changes, workspaceDir) {
     const absolutePath = typeof change.path === "string" ? change.path : void 0;
     const kind = typeof change.kind === "string" ? change.kind : void 0;
     if (!absolutePath || kind === "delete") continue;
-    const relative = path2.relative(workspaceDir, absolutePath);
-    if (relative.length === 0 || relative.startsWith("..") || path2.isAbsolute(relative)) continue;
+    const relative = path3.relative(workspaceDir, absolutePath);
+    if (relative.length === 0 || relative.startsWith("..") || path3.isAbsolute(relative)) continue;
     events.push({ type: "artifact", name: relative, contentType: guessContentType2(relative) });
   }
   return events;
@@ -1411,7 +1565,7 @@ var CONTENT_TYPE_BY_EXTENSION = {
   ".csv": "text/csv"
 };
 function guessContentType2(relativePath) {
-  return CONTENT_TYPE_BY_EXTENSION[path2.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
+  return CONTENT_TYPE_BY_EXTENSION[path3.extname(relativePath).toLowerCase()] ?? "application/octet-stream";
 }
 function extractErrorMessage(rawError) {
   if (typeof rawError === "string") return rawError;
@@ -1549,6 +1703,7 @@ var CodexAdapter = class {
     this.options = options;
   }
   options;
+  supportsDispatchSelection = true;
   id = "codex";
   async detect() {
     const bin = this.resolveBin();
@@ -1572,9 +1727,10 @@ var CodexAdapter = class {
    * Two independently-verified channel gotchas apply here, the "pi lesson"
    * yet again:
    *   - `codex login status`'s human-readable "Logged in using ChatGPT"
-   *     message prints on STDERR, not stdout (the opposite-channel
-   *     counterpart of pi's own `--version`-goes-to-stderr surprise) — both
-   *     streams are checked here for exactly that reason.
+   *     message prints on STDERR, not stdout — both streams are checked
+   *     here for exactly that reason. pi's `--version` is the same class of
+   *     hazard from the other direction: its channel has moved between pi
+   *     releases (see ../pi/pi-adapter.ts), so neither stream is assumed.
    *   - The NOT-logged-in message/exit-code shape was deliberately never
    *     empirically tested: this machine has a real, live ChatGPT login, and
    *     running `codex logout` to observe the negative case would have
@@ -1620,17 +1776,20 @@ ${withStreams.stderr ?? ""}`);
     if (!mapping.ok) {
       throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by codex adapter");
     }
+    const modelId = subscriptionModel2(task);
     const bin = this.resolveBin();
     const queue = new AsyncQueue();
     const recordUnmapped = makeUnmappedFrameRecorder(/* @__PURE__ */ new Map());
     const workspaceDir = await resolveRealWorkspaceDir(ctx.workspaceDir);
+    const runtimeEnv = withoutProviderCredentials(ctx.env);
     const { sessionRef, runner } = await runCodexTurn({
       command: bin.command,
       resumeRef: task.sessionRef,
       instruction: task.instruction,
+      modelId,
       policyArgs: mapping.args,
       cwd: ctx.workspaceDir,
-      env: ctx.env,
+      env: runtimeEnv,
       spawnFn: this.options.spawnFn,
       workspaceDir,
       queue,
@@ -1647,7 +1806,8 @@ ${withStreams.stderr ?? ""}`);
       queue,
       recordUnmapped,
       initialRunner: runner,
-      preparedGit: ctx.gitWorkspace !== void 0
+      preparedGit: ctx.gitWorkspace !== void 0,
+      modelId
     });
   }
   resolveBin() {
@@ -1668,12 +1828,25 @@ function makeUnmappedFrameRecorder(counts) {
     }
   };
 }
-function buildArgv(resumeRef, policyArgs, instruction, preparedGit = false) {
+function buildArgv(resumeRef, policyArgs, instruction, modelId, preparedGit = false) {
   const base = resumeRef !== void 0 ? ["exec", "resume", resumeRef] : ["exec"];
-  return [...base, "--json", ...preparedGit ? [] : ["--skip-git-repo-check"], ...policyArgs, instruction];
+  return [
+    ...base,
+    "--json",
+    ...modelId ? ["--model", modelId] : [],
+    ...preparedGit ? [] : ["--skip-git-repo-check"],
+    ...policyArgs,
+    instruction
+  ];
 }
 async function runCodexTurn(params) {
-  const argv = buildArgv(params.resumeRef, params.policyArgs, params.instruction, params.preparedGit);
+  const argv = buildArgv(
+    params.resumeRef,
+    params.policyArgs,
+    params.instruction,
+    params.modelId,
+    params.preparedGit
+  );
   let firstLineSettled = false;
   let resolveFirstLine;
   let rejectFirstLine;
@@ -1774,6 +1947,7 @@ var CodexSession = class {
   queue;
   recordUnmapped;
   preparedGit;
+  modelId;
   currentRunner;
   closed = false;
   constructor(options) {
@@ -1785,6 +1959,7 @@ var CodexSession = class {
     this.queue = options.queue;
     this.recordUnmapped = options.recordUnmapped;
     this.preparedGit = options.preparedGit;
+    this.modelId = options.modelId;
     this.currentRunner = options.initialRunner;
     void this.forgetRunnerOnceClosed(options.initialRunner);
   }
@@ -1845,6 +2020,13 @@ var CodexSession = class {
     if (!mapping.ok) {
       throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by codex adapter");
     }
+    const requestedModel = subscriptionModel2(task);
+    if (requestedModel !== void 0 && requestedModel !== this.modelId) {
+      throw new PolicyUnsupportedError(
+        `codex persistent session cannot change model from ${this.modelId ?? "(legacy default)"} to ${requestedModel}`
+      );
+    }
+    const modelId = this.modelId;
     const resumeRef = this.sessionRef;
     let sessionRef;
     let runner;
@@ -1853,9 +2035,10 @@ var CodexSession = class {
         command: this.command,
         resumeRef,
         instruction: task.instruction,
+        modelId,
         policyArgs: mapping.args,
         cwd: this.workspaceDir,
-        env: this.env,
+        env: withoutProviderCredentials(this.env),
         spawnFn: this.spawnFn,
         workspaceDir: this.workspaceDir,
         queue: this.queue,
@@ -1915,6 +2098,16 @@ var CodexSession = class {
     );
   }
 };
+function subscriptionModel2(task) {
+  const selection = task.dispatchSelection;
+  if (selection === void 0) return void 0;
+  if (selection.lane !== "subscription" || selection.runtimeId !== "codex") {
+    throw new PolicyUnsupportedError(
+      `codex adapter cannot execute ${selection.lane} selection for runtime ${selection.runtimeId}`
+    );
+  }
+  return selection.modelId;
+}
 
 export { ClaudeAdapter, CodexAdapter, PI_PACKAGE_NAME, PiAdapter };
 //# sourceMappingURL=index.js.map