@byok-sdk/client 0.2.0 → 0.3.0

package/README.md

@@ -5,16 +5,56 @@ WebSocket or long poll, dispatches to local Claude Code, Codex, or pi adapters,
 and exposes authenticated local diagnostics/control commands.
 
 The package installs `byok-agent` and `byok-approval-mcp` binaries. Provider
-credentials are not read by the dispatch plane; `@byok-sdk/keys` is separate.
+credentials are not read by the dispatch plane; `@byok-sdk/keys` is a separate
+install and keeps a zero dependency edge to this package.
 
-Pi is a required exact npm dependency and runs as an external Node subprocess;
-authenticate it with your own provider credentials. Claude Code and Codex
-remain user-installed runtimes. The SDK never reads or packages provider
-credentials. Hosts that only need runtime detection/composition can import the
+Pi is a required exact npm dependency and runs as an external Node subprocess.
+For an authoritative BYOK `dispatchSelection`, configure `piByokLauncher` with
+the separately installed `byok-pi-provider-launcher`, the local non-secret
+profile database path, and a stable Pi session directory. The client passes
+only those paths plus provider/model ids; the launcher alone reads the OS
+credential when required and spawns Pi. Both custody paths must be absolute;
+missing launcher configuration fails closed.
+
+Claude Code and Codex remain user-installed runtimes and use their own login
+state. Hosts that only need runtime detection/composition can import the
 transport-free adapter surface:
 
 ```ts
 import { PiAdapter, ClaudeAdapter, CodexAdapter } from '@byok-sdk/client/adapters';
 ```
 
+Claude tasks can select operator-owned local stdio MCP servers by logical id.
+The toolset selector carries no MCP command or connector credential:
+
+```ts
+import { createDaemon } from '@byok-sdk/client';
+
+createDaemon({
+  // ...normal device and transport configuration
+  mcpToolsets: {
+    'salesko.prospecting': {
+      mcpServers: {
+        'salesko-connectors': {
+          command: '/opt/salesko/bin/connector-mcp',
+          args: ['--profile', 'default'],
+        },
+      },
+    },
+  },
+});
+```
+
+The map accepts only `command` and `args`; put OAuth tokens, cookies, and other
+secrets behind the local MCP process's own credential broker. Toolset offers
+for Pi or Codex are declined because those adapters do not yet expose a strict
+task-scoped MCP configuration boundary.
+
+For a concrete private host composition, see the
+[`examples/salesko-connector-broker`](../../examples/salesko-connector-broker)
+reference. It keeps `@byok-sdk/client` credential-blind while combining
+OS-backed refresh-token custody, a PKCE desktop Google OAuth flow, exact domain
+policy, a real read-only Gmail metadata adapter, and a closed metadata-only MCP
+result.
+
 MIT licensed. Node.js 22.19.0 or newer.

package/dist/adapters/claude/claude-adapter.d.ts

@@ -3,6 +3,8 @@ import { type RuntimeAdapter, type RuntimeCapabilities, type RuntimeDetectResult
 import { type ResolvedBin } from './resolve-bin';
 import { type ResolvedApprovalMcpBin } from './resolve-approval-mcp-bin';
 import { type SpawnFn } from './process-client';
+/** The MCP server NAME this adapter registers `byok-approval-mcp` under in the generated `--mcp-config` (arbitrary, local to this file) — combined with {@link APPROVAL_TOOL_NAME} (imported, single-sourced from `bin/approval-mcp-server.ts` so the two can never independently drift) to form the `mcp__<server>__<tool>` identifier `--permission-prompt-tool` expects. */
+export declare const APPROVAL_MCP_SERVER_NAME = "byokapproval";
 export interface ClaudeAdapterOptions {
     /** Override bin resolution — tests substitute the fake-claude fixture script. */
     resolveBin?: () => ResolvedBin;
@@ -112,6 +114,7 @@ export interface ClaudeAdapterOptions {
  */
 export declare class ClaudeAdapter implements RuntimeAdapter {
     private readonly options;
+    readonly supportsDispatchSelection = true;
     readonly id = "claude";
     constructor(options?: ClaudeAdapterOptions);
     detect(): Promise<RuntimeDetectResult>;

package/dist/adapters/codex/codex-adapter.d.ts

@@ -52,6 +52,7 @@ export interface CodexAdapterOptions {
  */
 export declare class CodexAdapter implements RuntimeAdapter {
     private readonly options;
+    readonly supportsDispatchSelection = true;
     readonly id = "codex";
     constructor(options?: CodexAdapterOptions);
     detect(): Promise<RuntimeDetectResult>;

package/dist/adapters/index.d.ts

@@ -1,7 +1,7 @@
 export type { RuntimeAdapter, RuntimeCapabilities, RuntimeDetectResult, } from '../types';
 export type { RuntimeEnvironmentRequirements } from '../daemon/environment';
 export { PiAdapter } from './pi/pi-adapter';
-export type { PiAdapterOptions } from './pi/pi-adapter';
+export type { PiAdapterOptions, PiByokLauncherConfig } from './pi/pi-adapter';
 export { PI_PACKAGE_NAME } from './pi/resolve-bin';
 export { ClaudeAdapter } from './claude/claude-adapter';
 export type { ClaudeAdapterOptions } from './claude/claude-adapter';

package/dist/adapters/index.js

@@ -441,13 +441,8 @@ var PiRpcClient = class {
   }
 };
 
-// src/adapters/pi/pi-adapter.ts
-var execFileAsync = promisify(execFile);
-var DETECT_TIMEOUT_MS = 5e3;
-function errorMessage(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-var KNOWN_PROVIDER_ENV_VARS = [
+// src/adapters/provider-credential-environment.ts
+var PROVIDER_CREDENTIAL_ENV_NAMES = [
   "ANTHROPIC_API_KEY",
   "ANTHROPIC_OAUTH_TOKEN",
   "OPENAI_API_KEY",
@@ -458,24 +453,66 @@ var KNOWN_PROVIDER_ENV_VARS = [
   "MISTRAL_API_KEY",
   "OPENROUTER_API_KEY",
   "XAI_API_KEY",
-  // Confirmed against the installed pi's own docs/providers.md ("ZAI |
-  // `ZAI_API_KEY` | `zai`") and exercised live against real GLM traffic
-  // during this task's acceptance run — omitting it made `authPresent`
-  // silently false for a perfectly valid, working z.ai/GLM setup.
   "ZAI_API_KEY"
 ];
+var PROVIDER_CREDENTIAL_ENV_DENY_NAMES = [
+  ...PROVIDER_CREDENTIAL_ENV_NAMES,
+  "ANT_LING_API_KEY",
+  "NVIDIA_API_KEY",
+  "CEREBRAS_API_KEY",
+  "CLOUDFLARE_API_KEY",
+  "AI_GATEWAY_API_KEY",
+  "ZAI_CODING_CN_API_KEY",
+  "OPENCODE_API_KEY",
+  "RADIUS_API_KEY",
+  "FIREWORKS_API_KEY",
+  "TOGETHER_API_KEY",
+  "BASETEN_API_KEY",
+  "KIMI_API_KEY",
+  "MINIMAX_API_KEY",
+  "MINIMAX_CN_API_KEY",
+  "QWEN_TOKEN_PLAN_API_KEY",
+  "QWEN_TOKEN_PLAN_CN_API_KEY",
+  "XIAOMI_API_KEY",
+  "XIAOMI_TOKEN_PLAN_CN_API_KEY",
+  "XIAOMI_TOKEN_PLAN_AMS_API_KEY",
+  "XIAOMI_TOKEN_PLAN_SGP_API_KEY",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "GOOGLE_APPLICATION_CREDENTIALS",
+  // Reserved by the keys-owned Pi projection. It must never be inherited
+  // from the daemon; the launcher deletes any ambient copy and injects only
+  // the exact credential it just resolved from OS custody.
+  "PI_PROVIDER_API_KEY"
+];
+function withoutProviderCredentials(env) {
+  const sanitized = { ...env };
+  for (const name of PROVIDER_CREDENTIAL_ENV_DENY_NAMES) {
+    delete sanitized[name];
+  }
+  return sanitized;
+}
+
+// src/adapters/pi/pi-adapter.ts
+var execFileAsync = promisify(execFile);
+var DETECT_TIMEOUT_MS = 5e3;
+function errorMessage(err) {
+  return err instanceof Error ? err.message : String(err);
+}
 var PiAdapter = class {
   constructor(options = {}) {
     this.options = options;
   }
   options;
   id = "pi";
+  supportsDispatchSelection = true;
   async detect() {
     try {
       const bin = this.resolveBin();
       const { stdout, stderr } = await execFileAsync(bin.command, ["--version"], { timeout: DETECT_TIMEOUT_MS });
       const version = stdout.trim() || stderr.trim();
-      const authPresent = KNOWN_PROVIDER_ENV_VARS.some((name) => process.env[name] !== void 0);
+      const authPresent = PROVIDER_CREDENTIAL_ENV_NAMES.some((name) => process.env[name] !== void 0);
       return { present: true, version, authPresent };
     } catch {
       return { present: false };
@@ -494,7 +531,7 @@ var PiAdapter = class {
    * variable beyond the platform baseline (`daemon/environment.ts`).
    */
   environmentRequirements() {
-    return { credentialNames: KNOWN_PROVIDER_ENV_VARS };
+    return { credentialNames: PROVIDER_CREDENTIAL_ENV_NAMES };
   }
   async start(task, ctx) {
     if (typeof task.instruction !== "string") {
@@ -506,12 +543,45 @@ var PiAdapter = class {
     }
     const bin = this.resolveBin();
     const resumeSessionId = task.sessionRef;
-    const args = ["--mode", "rpc", ...resumeSessionId ? ["--session", resumeSessionId] : [], ...mapping.args];
+    const piArgs = ["--mode", "rpc", ...resumeSessionId ? ["--session", resumeSessionId] : [], ...mapping.args];
+    const selection = task.dispatchSelection;
+    let command = bin.command;
+    let args = piArgs;
+    if (selection !== void 0) {
+      if (selection.lane !== "byok" || selection.runtimeId !== "pi") {
+        throw new PolicyUnsupportedError(
+          `pi adapter cannot execute ${selection.lane} selection for runtime ${selection.runtimeId}`
+        );
+      }
+      const launcher = this.options.byokLauncher;
+      if (launcher === void 0) {
+        throw new PolicyUnsupportedError(
+          "pi BYOK selection requires a configured credential-custody launcher"
+        );
+      }
+      command = launcher.command;
+      args = [
+        ...launcher.args ?? [],
+        "--pi-bin",
+        bin.command,
+        "--profile-db",
+        launcher.profileDbPath,
+        "--session-dir",
+        launcher.sessionDir,
+        ...launcher.secretServicePrefix ? ["--secret-service-prefix", launcher.secretServicePrefix] : [],
+        "--provider",
+        selection.providerId,
+        "--model",
+        selection.modelId,
+        "--",
+        ...piArgs
+      ];
+    }
     const rpc = new PiRpcClient({
-      command: bin.command,
+      command,
       args,
       cwd: ctx.workspaceDir,
-      env: ctx.env,
+      env: selection === void 0 ? ctx.env : withoutProviderCredentials(ctx.env),
       spawnFn: this.options.spawnFn
     });
     const response = await rpc.send({ type: "prompt", message: task.instruction });
@@ -530,7 +600,7 @@ var PiAdapter = class {
         throw err;
       }
     }
-    return new PiSession(sessionRef, rpc);
+    return new PiSession(sessionRef, rpc, selection);
   }
   resolveBin() {
     return (this.options.resolveBin ?? resolvePiBin)();
@@ -558,12 +628,14 @@ async function resolveFreshSessionId(rpc) {
   );
 }
 var PiSession = class {
-  constructor(sessionRef, rpc) {
+  constructor(sessionRef, rpc, selection) {
     this.sessionRef = sessionRef;
     this.rpc = rpc;
+    this.selection = selection;
   }
   sessionRef;
   rpc;
+  selection;
   get events() {
     const rpc = this.rpc;
     return {
@@ -592,6 +664,12 @@ var PiSession = class {
     if (typeof task.instruction !== "string") {
       throw new PolicyUnsupportedError("pi adapter only supports string instructions in M0 (no blob-ref fetch yet)");
     }
+    const requestedSelection = task.dispatchSelection;
+    if (requestedSelection !== void 0 && (this.selection?.lane !== "byok" || requestedSelection.lane !== "byok" || requestedSelection.runtimeId !== "pi" || requestedSelection.providerId !== this.selection.providerId || requestedSelection.modelId !== this.selection.modelId)) {
+      throw new PolicyUnsupportedError(
+        "pi persistent session cannot change its authoritative BYOK provider/model selection"
+      );
+    }
     await this.rpc.send({ type: "prompt", message: task.instruction, streamingBehavior: "followUp" });
   }
   async interrupt() {
@@ -1016,7 +1094,7 @@ var APPROVAL_TOOL_NAME = "approval_prompt";
 var APPROVAL_MCP_SERVER_NAME = "byokapproval";
 var execFileAsync2 = promisify(execFile);
 var DETECT_TIMEOUT_MS2 = 5e3;
-async function cleanupApprovalMcpConfigDir(dir) {
+async function cleanupMcpConfigDir(dir) {
   if (!dir) return;
   await promises.rm(dir, { recursive: true, force: true }).catch(() => {
   });
@@ -1026,6 +1104,7 @@ var ClaudeAdapter = class {
     this.options = options;
   }
   options;
+  supportsDispatchSelection = true;
   id = "claude";
   async detect() {
     const bin = this.resolveBin();
@@ -1039,7 +1118,13 @@ var ClaudeAdapter = class {
     }
   }
   capabilities() {
-    return { steer: false, resume: true, approvalInteractive: true, permissionModes: ["auto", "readonly", "plan", "confirm"] };
+    return {
+      steer: false,
+      resume: true,
+      approvalInteractive: true,
+      mcpToolsets: true,
+      permissionModes: ["auto", "readonly", "plan", "confirm"]
+    };
   }
   /**
    * M5: deliberate product-boundary decision, not an oversight — byok's
@@ -1065,42 +1150,51 @@ var ClaudeAdapter = class {
     if (!mapping.ok) {
       throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by claude adapter");
     }
-    let approvalMcpConfigDir;
+    const modelId = subscriptionModel(task, "claude");
+    let mcpConfigDir;
+    const taskMcpServers = ctx.mcpServers ?? {};
+    const needsMcpConfig = mapping.needsApprovalMcp || Object.keys(taskMcpServers).length > 0;
     if (mapping.needsApprovalMcp) {
       if (!ctx.approvalChannel) {
         throw new PolicyUnsupportedError(
           'claude adapter requires policy.mode "confirm" to be started with an approval channel (TaskContext.approvalChannel) \u2014 none was provided'
         );
       }
-      const approvalMcpBin = (this.options.resolveApprovalMcpBin ?? resolveApprovalMcpBin)();
-      approvalMcpConfigDir = await promises.mkdtemp(path3.join(os.tmpdir(), "byok-approval-mcp-"));
-      await promises.chmod(approvalMcpConfigDir, 448).catch(() => {
+      if (Object.prototype.hasOwnProperty.call(taskMcpServers, APPROVAL_MCP_SERVER_NAME)) {
+        throw new PolicyUnsupportedError(
+          `MCP server name "${APPROVAL_MCP_SERVER_NAME}" is reserved by the claude approval channel`
+        );
+      }
+    }
+    if (needsMcpConfig) {
+      mcpConfigDir = await promises.mkdtemp(path3.join(os.tmpdir(), "byok-mcp-"));
+      await promises.chmod(mcpConfigDir, 448).catch(() => {
       });
-      const mcpConfigPath = path3.join(approvalMcpConfigDir, "mcp-config.json");
-      const mcpConfig = {
-        mcpServers: {
-          [APPROVAL_MCP_SERVER_NAME]: {
-            command: approvalMcpBin.command,
-            args: approvalMcpBin.args,
-            env: {
-              BYOK_STORE_DIR: ctx.approvalChannel.storeDir,
-              BYOK_PRODUCT_ID: ctx.approvalChannel.productId,
-              BYOK_TASK_ID: ctx.approvalChannel.taskId,
-              BYOK_APPROVAL_TIMEOUT_MS: String(ctx.approvalChannel.timeoutMs)
-            }
+      const mcpConfigPath = path3.join(mcpConfigDir, "mcp-config.json");
+      const mcpServers = { ...taskMcpServers };
+      if (mapping.needsApprovalMcp) {
+        const approvalChannel = ctx.approvalChannel;
+        if (!approvalChannel) throw new Error("unreachable: approval channel checked above");
+        const approvalMcpBin = (this.options.resolveApprovalMcpBin ?? resolveApprovalMcpBin)();
+        mcpServers[APPROVAL_MCP_SERVER_NAME] = {
+          command: approvalMcpBin.command,
+          args: approvalMcpBin.args,
+          env: {
+            BYOK_STORE_DIR: approvalChannel.storeDir,
+            BYOK_PRODUCT_ID: approvalChannel.productId,
+            BYOK_TASK_ID: approvalChannel.taskId,
+            BYOK_APPROVAL_TIMEOUT_MS: String(approvalChannel.timeoutMs)
           }
-        }
-      };
-      await promises.writeFile(mcpConfigPath, JSON.stringify(mcpConfig), { mode: 384 });
+        };
+      }
+      await promises.writeFile(mcpConfigPath, JSON.stringify({ mcpServers }), { mode: 384 });
       mapping.args = [
         ...mapping.args,
-        "--permission-prompt-tool",
-        `mcp__${APPROVAL_MCP_SERVER_NAME}__${APPROVAL_TOOL_NAME}`,
+        ...mapping.needsApprovalMcp ? ["--permission-prompt-tool", `mcp__${APPROVAL_MCP_SERVER_NAME}__${APPROVAL_TOOL_NAME}`] : [],
         "--mcp-config",
         mcpConfigPath,
-        // Never let this task's confirm-mode run pick up some OTHER MCP
-        // server from ambient project/user config — the approval channel is
-        // the only MCP server this invocation should ever see.
+        // The generated file is the complete task-scoped MCP authority.
+        // Never merge ambient user/project MCP configuration into it.
         "--strict-mcp-config"
       ];
     }
@@ -1117,6 +1211,7 @@ var ClaudeAdapter = class {
       // "Error: When using --print, --output-format=stream-json requires
       // --verbose", before spawning any model call.
       "--verbose",
+      ...modelId ? ["--model", modelId] : [],
       ...resumeSessionId ? ["--resume", resumeSessionId] : [],
       ...mapping.args
     ];
@@ -1124,7 +1219,7 @@ var ClaudeAdapter = class {
       command: bin.command,
       args,
       cwd: ctx.workspaceDir,
-      env: ctx.env,
+      env: withoutProviderCredentials(ctx.env),
       spawnFn: this.options.spawnFn
     });
     client.writeUserMessage(task.instruction);
@@ -1133,17 +1228,24 @@ var ClaudeAdapter = class {
       sessionRef = await client.waitForInit();
     } catch (err) {
       client.kill();
-      await cleanupApprovalMcpConfigDir(approvalMcpConfigDir);
+      await cleanupMcpConfigDir(mcpConfigDir);
       throw err;
     }
     if (resumeSessionId !== void 0 && sessionRef !== resumeSessionId) {
       client.kill();
-      await cleanupApprovalMcpConfigDir(approvalMcpConfigDir);
+      await cleanupMcpConfigDir(mcpConfigDir);
       throw new Error(
         `claude --resume echoed a different session id than requested (requested ${resumeSessionId}, got ${sessionRef}) \u2014 refusing to continue in a possibly-wrong session (fail-closed)`
       );
     }
-    return new ClaudeSession(sessionRef, client, ctx.workspaceDir, ctx.approvalChannel, approvalMcpConfigDir);
+    return new ClaudeSession(
+      sessionRef,
+      client,
+      ctx.workspaceDir,
+      ctx.approvalChannel,
+      mcpConfigDir,
+      modelId
+    );
   }
   /**
    * `claude auth status --json` is claude's OWN non-secret login-state
@@ -1177,19 +1279,31 @@ var ClaudeAdapter = class {
     return (this.options.resolveBin ?? resolveClaudeBin)();
   }
 };
+function subscriptionModel(task, runtimeId) {
+  const selection = task.dispatchSelection;
+  if (selection === void 0) return void 0;
+  if (selection.lane !== "subscription" || selection.runtimeId !== runtimeId) {
+    throw new PolicyUnsupportedError(
+      `claude adapter cannot execute ${selection.lane} selection for runtime ${selection.runtimeId}`
+    );
+  }
+  return selection.modelId;
+}
 var ClaudeSession = class {
-  constructor(sessionRef, client, workspaceDir, approvalChannel, approvalMcpConfigDir) {
+  constructor(sessionRef, client, workspaceDir, approvalChannel, mcpConfigDir, modelId) {
     this.sessionRef = sessionRef;
     this.client = client;
     this.workspaceDir = workspaceDir;
     this.approvalChannel = approvalChannel;
-    this.approvalMcpConfigDir = approvalMcpConfigDir;
+    this.mcpConfigDir = mcpConfigDir;
+    this.modelId = modelId;
   }
   sessionRef;
   client;
   workspaceDir;
   approvalChannel;
-  approvalMcpConfigDir;
+  mcpConfigDir;
+  modelId;
   correlation = createToolUseCorrelation();
   get events() {
     const client = this.client;
@@ -1240,6 +1354,12 @@ var ClaudeSession = class {
     if (typeof task.instruction !== "string") {
       throw new PolicyUnsupportedError("claude adapter only supports string instructions in M2 (no blob-ref fetch yet)");
     }
+    const requestedModel = subscriptionModel(task, "claude");
+    if (requestedModel !== void 0 && requestedModel !== this.modelId) {
+      throw new PolicyUnsupportedError(
+        `claude persistent session cannot change model from ${this.modelId ?? "(legacy default)"} to ${requestedModel}`
+      );
+    }
     this.client.writeUserMessage(task.instruction);
   }
   /**
@@ -1259,7 +1379,7 @@ var ClaudeSession = class {
   }
   async close() {
     this.client.kill();
-    await cleanupApprovalMcpConfigDir(this.approvalMcpConfigDir);
+    await cleanupMcpConfigDir(this.mcpConfigDir);
   }
   /**
    * M4 Phase 3: routes into the out-of-band approval channel `start()`
@@ -1583,6 +1703,7 @@ var CodexAdapter = class {
     this.options = options;
   }
   options;
+  supportsDispatchSelection = true;
   id = "codex";
   async detect() {
     const bin = this.resolveBin();
@@ -1655,17 +1776,20 @@ ${withStreams.stderr ?? ""}`);
     if (!mapping.ok) {
       throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by codex adapter");
     }
+    const modelId = subscriptionModel2(task);
     const bin = this.resolveBin();
     const queue = new AsyncQueue();
     const recordUnmapped = makeUnmappedFrameRecorder(/* @__PURE__ */ new Map());
     const workspaceDir = await resolveRealWorkspaceDir(ctx.workspaceDir);
+    const runtimeEnv = withoutProviderCredentials(ctx.env);
     const { sessionRef, runner } = await runCodexTurn({
       command: bin.command,
       resumeRef: task.sessionRef,
       instruction: task.instruction,
+      modelId,
       policyArgs: mapping.args,
       cwd: ctx.workspaceDir,
-      env: ctx.env,
+      env: runtimeEnv,
       spawnFn: this.options.spawnFn,
       workspaceDir,
       queue,
@@ -1682,7 +1806,8 @@ ${withStreams.stderr ?? ""}`);
       queue,
       recordUnmapped,
       initialRunner: runner,
-      preparedGit: ctx.gitWorkspace !== void 0
+      preparedGit: ctx.gitWorkspace !== void 0,
+      modelId
     });
   }
   resolveBin() {
@@ -1703,12 +1828,25 @@ function makeUnmappedFrameRecorder(counts) {
     }
   };
 }
-function buildArgv(resumeRef, policyArgs, instruction, preparedGit = false) {
+function buildArgv(resumeRef, policyArgs, instruction, modelId, preparedGit = false) {
   const base = resumeRef !== void 0 ? ["exec", "resume", resumeRef] : ["exec"];
-  return [...base, "--json", ...preparedGit ? [] : ["--skip-git-repo-check"], ...policyArgs, instruction];
+  return [
+    ...base,
+    "--json",
+    ...modelId ? ["--model", modelId] : [],
+    ...preparedGit ? [] : ["--skip-git-repo-check"],
+    ...policyArgs,
+    instruction
+  ];
 }
 async function runCodexTurn(params) {
-  const argv = buildArgv(params.resumeRef, params.policyArgs, params.instruction, params.preparedGit);
+  const argv = buildArgv(
+    params.resumeRef,
+    params.policyArgs,
+    params.instruction,
+    params.modelId,
+    params.preparedGit
+  );
   let firstLineSettled = false;
   let resolveFirstLine;
   let rejectFirstLine;
@@ -1809,6 +1947,7 @@ var CodexSession = class {
   queue;
   recordUnmapped;
   preparedGit;
+  modelId;
   currentRunner;
   closed = false;
   constructor(options) {
@@ -1820,6 +1959,7 @@ var CodexSession = class {
     this.queue = options.queue;
     this.recordUnmapped = options.recordUnmapped;
     this.preparedGit = options.preparedGit;
+    this.modelId = options.modelId;
     this.currentRunner = options.initialRunner;
     void this.forgetRunnerOnceClosed(options.initialRunner);
   }
@@ -1880,6 +2020,13 @@ var CodexSession = class {
     if (!mapping.ok) {
       throw new PolicyUnsupportedError(mapping.reason ?? "policy rejected by codex adapter");
     }
+    const requestedModel = subscriptionModel2(task);
+    if (requestedModel !== void 0 && requestedModel !== this.modelId) {
+      throw new PolicyUnsupportedError(
+        `codex persistent session cannot change model from ${this.modelId ?? "(legacy default)"} to ${requestedModel}`
+      );
+    }
+    const modelId = this.modelId;
     const resumeRef = this.sessionRef;
     let sessionRef;
     let runner;
@@ -1888,9 +2035,10 @@ var CodexSession = class {
         command: this.command,
         resumeRef,
         instruction: task.instruction,
+        modelId,
         policyArgs: mapping.args,
         cwd: this.workspaceDir,
-        env: this.env,
+        env: withoutProviderCredentials(this.env),
         spawnFn: this.spawnFn,
         workspaceDir: this.workspaceDir,
         queue: this.queue,
@@ -1950,6 +2098,16 @@ var CodexSession = class {
     );
   }
 };
+function subscriptionModel2(task) {
+  const selection = task.dispatchSelection;
+  if (selection === void 0) return void 0;
+  if (selection.lane !== "subscription" || selection.runtimeId !== "codex") {
+    throw new PolicyUnsupportedError(
+      `codex adapter cannot execute ${selection.lane} selection for runtime ${selection.runtimeId}`
+    );
+  }
+  return selection.modelId;
+}
 
 export { ClaudeAdapter, CodexAdapter, PI_PACKAGE_NAME, PiAdapter };
 //# sourceMappingURL=index.js.map