@gotcos/glasses-server 6.38.1 → 6.39.1

package/.env.example

@@ -48,7 +48,7 @@ BIND_HOST=0.0.0.0
 #   Opus / Fable / Sonnet  ->  Claude Code CLI  (https://docs.anthropic.com/en/docs/claude-code/getting-started, then `claude auth login`)
 #   GPT Frontier/Balanced  ->  Codex CLI        (https://developers.openai.com/codex/, then `codex login`)
 # Install at least one. Pick the default model the glasses use:
-# COS_G2_DEFAULT_MODEL=sonnet     # opus | fable | sonnet | codex-frontier | codex-balanced
+# COS_G2_DEFAULT_MODEL=sonnet     # opus | fable | sonnet | codex-frontier | codex-balanced | cursor-grok | cursor-composer | ollama
 #
 # GPT slots refresh from the Codex model catalog every 15 minutes and retain
 # their last-known-good resolution if discovery is temporarily unavailable.
@@ -66,6 +66,26 @@ BIND_HOST=0.0.0.0
 # Pair with ~/.codex/config.toml [sandbox_workspace_write] network_access = true
 # for interactive Codex CLI; the managed glasses server also passes
 # -c sandbox_workspace_write.network_access=true when workspace-write is set.
+#
+# Local Ollama (https://ollama.com) as a fourth G2 picker. Hidden unless
+# GET http://127.0.0.1:11434/api/tags succeeds with at least one pulled model.
+# Direct POST /api/chat — chat/summarize only, no tools, no Codex --oss.
+#   brew install ollama
+#   ollama serve
+#   ollama run qwen2.5-coder
+# COS_OLLAMA_MODEL=qwen2.5-coder
+# COS_OLLAMA_HOST=http://127.0.0.1:11434
+# COS_G2_DEFAULT_MODEL=ollama
+#
+# Codex CLI operator hatch (not the Ollama picker). Frontier stays ChatGPT
+# unless you set this. Put it in ~/.cos-glasses/.env, not the LaunchAgent plist.
+# Sessions Continue / Fork ignore these flags. No inline comments on this line.
+# COS_CODEX_EXTRA_ARGS=--oss --local-provider ollama --model qwen2.5-coder
+# Do not define [model_providers.ollama] — that id is reserved. LM Studio:
+# COS_CODEX_EXTRA_ARGS=--oss --local-provider lmstudio --model <id>
+# Other OpenAI-compatible proxies (not oss): --model inside EXTRA_ARGS so a
+# plist COS_CODEX_MODEL cannot retarget it:
+# COS_CODEX_EXTRA_ARGS=-c model_provider="local_vllm" --model <id>
 
 # Claude preserves COS's established trusted-machine behavior by default.
 # Security-conscious installs can remove the permission bypass and restrict

package/CHANGELOG.md

@@ -1,3 +1,51 @@
+## 6.39.1
+
+Durable jobs now remember they ran on Ollama.
+
+FIXED: 6.39.0 allowed `provider: 'ollama'` in the durable-job types and the
+runtime stamped it, but the journal sanitizer (`safeLinkage`) and the replay
+reader (`applyLinkage`) both stripped it -- so a live or replayed Ollama job
+came back providerless and the phone could never acknowledge which engine
+answered. Both now persist `ollama` and `ollamaRunId`; unknown providers still
+strip. Pinned by journal round-trip tests, mutation-verified.
+
+No other changes; pairs with COS Glasses 6.8.436 and COS Control 0.5.74.
+
+## 6.39.0
+
+Ollama is a fourth G2 picker, hidden unless a local daemon answers.
+
+When `GET http://127.0.0.1:11434/api/tags` succeeds with at least one pulled
+model, glasses and companion Settings show **Ollama**. Queries go to
+`POST /api/chat` on loopback — chat/summarize only, no tools, no vision, no
+attached Continue / Fork, no Live Cues. If the daemon drops, the slot hides and
+a saved `ollama` preference resets to Opus.
+
+Optional pin: `COS_OLLAMA_MODEL`. Optional loopback override: `COS_OLLAMA_HOST`
+(LAN / `0.0.0.0` refused). `COS_G2_DEFAULT_MODEL=ollama` is valid when the
+probe is ready.
+
+GPT Frontier / Balanced stay Codex CLI → ChatGPT. `COS_CODEX_EXTRA_ARGS` remains
+a Codex operator hatch, not the Ollama product.
+
+## 6.38.1
+
+GPT Frontier can point at a local Ollama (or LM Studio) engine without a fourth
+G2 provider. Set `COS_CODEX_EXTRA_ARGS` in `~/.cos-glasses/.env`:
+
+`COS_CODEX_EXTRA_ARGS=--oss --local-provider ollama --model qwen2.5-coder`
+
+Put `--model` inside that string so a Control-keep-alived plist `COS_CODEX_MODEL`
+cannot retarget off the local id. Sessions Continue / Fork / Settings proof
+ignore extra args. A plist-only EXTRA_ARGS dies on the next Update Server.
+
+The hatch is allowlisted (`--oss`, `--local-provider`, `--model`, `-c` keys
+`model` / `model_provider` / `oss_provider` / `model_reasoning_effort` /
+`service_tier`). It cannot pass `--sandbox`, `--permission-profile`, or a `-c`
+sandbox key. Codex still runs `--sandbox read-only`; that sandbox does not block
+the CLI's own HTTP to `localhost:11434`. `ollama serve` must be running or Codex
+exits `OSS setup failed`. This is not a COS Ollama product.
+
 ## 6.38.1
 
 The conversation archive was quietly storing the same conversations over and over.

package/README.md

@@ -60,7 +60,7 @@ without silently losing completed replies.
 > No provider API key is needed for chat when using signed-in CLIs. Usage is
 > billed to the corresponding Claude, Codex, or Cursor subscription. Pick a
 > provider per query, or set a default with `COS_G2_DEFAULT_MODEL`
-> (`opus`|`fable`|`sonnet`|`codex-frontier`|`codex-balanced`|`cursor-grok`|`cursor-composer`).
+> (`opus`|`fable`|`sonnet`|`codex-frontier`|`codex-balanced`|`cursor-grok`|`cursor-composer`|`ollama`).
 > Claude tier aliases and the two GPT slots resolve dynamically, so new model
 > releases do not require a new glasses package. GPT discovery refreshes every
 > 15 minutes and retains its last-known-good catalog through transient failures.
@@ -75,6 +75,10 @@ without silently losing completed replies.
 > `COS_CODEX_SANDBOX=workspace-write` for workdir writes + outbound network
 > (`sandbox_workspace_write.network_access=true` is passed by the managed server
 > and should also be set in `~/.codex/config.toml` for interactive Codex).
+> Local Ollama is a **fourth picker**, shown only when `ollama serve` answers
+> `GET http://127.0.0.1:11434/api/tags` with a pulled model. Direct
+> `POST /api/chat` — not Codex `--oss`. Optional pin: `COS_OLLAMA_MODEL`.
+> `COS_CODEX_EXTRA_ARGS` is a Codex CLI hatch, not the Ollama UX. See Configuration.
 > **Claude is the most permissive provider by default.** It runs with
 > `--dangerously-skip-permissions`, so a glasses query on the Claude/Opus path can
 > run shell commands and read, edit, and write files on this Mac without prompting
@@ -173,6 +177,15 @@ optional except an installed CLI. Highlights: `BIND_HOST`, `PORT`,
 in the managed CLI working directory),
 `COS_CURSOR_AGENT_BIN` (optional absolute Cursor `agent` binary),
 `COS_CURSOR_PERSIST_SESSIONS=0` (disable Cursor session resume),
+`COS_CODEX_SANDBOX=workspace-write` (workdir writes + outbound network on GPT),
+`COS_OLLAMA_MODEL` (optional pin; must match a name from `ollama list`),
+`COS_OLLAMA_HOST` (optional loopback origin, default `http://127.0.0.1:11434`;
+non-loopback is refused),
+`COS_CODEX_EXTRA_ARGS` (Codex exec operator hatch — not the Ollama picker.
+`--oss --local-provider ollama --model qwen2.5-coder` still retargets GPT
+Frontier spawn. Put it in `~/.cos-glasses/.env`; a plist-only value is dropped
+on Update Server. G2 Codex exec only — Sessions Continue / Fork ignore it.
+No inline `#` on the EXTRA_ARGS line.),
 `COS_WEATHER_DEFAULT_LAT` / `COS_WEATHER_DEFAULT_LON` /
 `COS_WEATHER_DEFAULT_CITY` (optional home fallback when phone GPS is denied),
 `COS_SCRIPTS_DIR` (full pipeline), `COS_DURABLE_QUERY_JOBS=0` (optional

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@gotcos/glasses-server",
-  "version": "6.38.1",
-  "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, or Cursor Agent CLI",
+  "version": "6.39.1",
+  "description": "COS Glasses \u2014 self-hosted AI heads-up-display server for Even G2 smart glasses, powered by Claude Code, Codex, Cursor Agent CLI, or local Ollama",
   "type": "module",
   "bin": {
     "glasses-server": "bin/cli.cjs",

package/server/lib/attached-provider-adapter.ts

@@ -110,26 +110,6 @@ export function isAttachedPermissionPolicy(value: unknown): value is AttachedPer
   return value === 'read_only'
 }
 
-/**
- * Flags that must never reach a provider that is about to write into someone's
- * real conversation (plan 4.7: no always-approve, bypass-permissions,
- * danger-full-access, force, or yolo behavior).
- *
- * Exported so the assertion can be made against the argv that is actually
- * spawned rather than against the source that builds it.
- */
-export const BANNED_PERMISSION_ARGS: readonly string[] = [
-  '--dangerously-skip-permissions',
-  '--dangerously-bypass-approvals-and-sandbox',
-  '--dangerously-bypass-hook-trust',
-  '--full-auto',
-  '--yolo',
-  '--force',
-  'danger-full-access',
-  'bypassPermissions',
-  'acceptEdits',
-]
-
 /** Terminal reason on failure. Never carries prompt or transcript text. */
 export type AttachedTurnFailure =
   | 'invalid_provider'
@@ -238,6 +218,7 @@ import {
   resolveProviderBinary,
   type BinaryResolution,
 } from './provider-binary.js'
+import { findBannedPermissionArg } from './banned-permission-args.js'
 
 export {
   STALE_SHIM_PREFIXES,
@@ -249,6 +230,7 @@ export {
   type BinaryResolutionFailure,
   type BinarySpec,
 } from './provider-binary.js'
+export { findBannedPermissionArg, BANNED_PERMISSION_ARGS } from './banned-permission-args.js'
 
 
 // ---------------------------------------------------------------------------
@@ -506,34 +488,6 @@ export function buildCursorAttachedArgs(nativeThreadId: string, cwd: string): st
   ]
 }
 
-const PATH_VALUED_FLAGS = new Set(['--workspace', '-C', '--cd', '--add-dir'])
-const BARE_BANNED_PERMISSION_ARGS = new Set(
-  BANNED_PERMISSION_ARGS.filter(flag => !flag.startsWith('-')),
-)
-
-/**
- * Is this argv free of every flag plan 4.7 bans?
- *
- * Flag-position tokens (start with `-`) are substring-matched so
- * `--permission-mode=bypassPermissions` still hits. Bare tokens
- * (`danger-full-access`) match only as their own argv slot. Values of
- * `--workspace` / `-C` are skipped: a cwd containing `--force` is a path,
- * not a permission flag.
- */
-export function findBannedPermissionArg(args: readonly string[]): string | null {
-  for (let i = 0; i < args.length; i++) {
-    const value = String(args[i])
-    const prev = i > 0 ? String(args[i - 1]) : ''
-    if (PATH_VALUED_FLAGS.has(prev)) continue
-    if (BARE_BANNED_PERMISSION_ARGS.has(value)) return value
-    if (!value.startsWith('-')) continue
-    for (const banned of BANNED_PERMISSION_ARGS) {
-      if (value.includes(banned)) return banned
-    }
-  }
-  return null
-}
-
 /**
  * Build the argv, and REFUSE to hand back one carrying a banned flag.
  *

package/server/lib/banned-permission-args.ts

@@ -0,0 +1,45 @@
+/**
+ * Shared permission-ban list for attached, fork, and G2 Codex extra-args.
+ * Keep PATH_VALUED_FLAGS and the bare-token set private; they only exist to
+ * make findBannedPermissionArg skip cwd-shaped values.
+ */
+
+export const BANNED_PERMISSION_ARGS: readonly string[] = [
+  '--dangerously-skip-permissions',
+  '--dangerously-bypass-approvals-and-sandbox',
+  '--dangerously-bypass-hook-trust',
+  '--full-auto',
+  '--yolo',
+  '--force',
+  'danger-full-access',
+  'bypassPermissions',
+  'acceptEdits',
+]
+
+const PATH_VALUED_FLAGS = new Set(['--workspace', '-C', '--cd', '--add-dir'])
+const BARE_BANNED_PERMISSION_ARGS = new Set(
+  BANNED_PERMISSION_ARGS.filter(flag => !flag.startsWith('-')),
+)
+
+/**
+ * Is this argv free of every flag plan 4.7 bans?
+ *
+ * Flag-position tokens (start with `-`) are substring-matched so
+ * `--permission-mode=bypassPermissions` still hits. Bare tokens
+ * (`danger-full-access`) match only as their own argv slot. Values of
+ * `--workspace` / `-C` are skipped: a cwd containing `--force` is a path,
+ * not a permission flag.
+ */
+export function findBannedPermissionArg(args: readonly string[]): string | null {
+  for (let i = 0; i < args.length; i++) {
+    const value = String(args[i])
+    const prev = i > 0 ? String(args[i - 1]) : ''
+    if (PATH_VALUED_FLAGS.has(prev)) continue
+    if (BARE_BANNED_PERMISSION_ARGS.has(value)) return value
+    if (!value.startsWith('-')) continue
+    for (const banned of BANNED_PERMISSION_ARGS) {
+      if (value.includes(banned)) return banned
+    }
+  }
+  return null
+}

package/server/lib/claude-bridge.ts

@@ -311,6 +311,7 @@ export interface ModelRunMetadata {
   codexThreadId?: string
   cursorRunId?: string
   cursorChatId?: string
+  ollamaRunId?: string
   outputAttachments?: MediaAttachmentRef[]
   outputImageStats?: RunOutputImageCollectionStats
 }
@@ -318,7 +319,7 @@ export interface ModelRunMetadata {
 /** Public-safe provider launch metadata for durable job coordination. It
  * deliberately exposes no ChildProcess object, kill handle, paths, or env. */
 export interface ProviderProcessMetadata {
-  provider: 'claude' | 'codex' | 'cursor'
+  provider: 'claude' | 'codex' | 'cursor' | 'ollama'
   runId: string
   pid?: number
   clientJobId?: string

package/server/lib/codex-bridge.ts

@@ -7,6 +7,15 @@ import { spawn, spawnSync } from 'node:child_process'
 // because COS Control injects that directory into the managed plist PATH -- it is ENOENT
 // for every public npx user, and for anything launchd- or Finder-spawned.
 import { resolveProviderBinary } from './provider-binary.js'
+import {
+  CodexExtraArgsError,
+  assertSafeCodexExtraArgs,
+  codexEngineFingerprint,
+  parseCodexExtraArgs,
+  skipsCosModel,
+  skipsCosReasoningEffort,
+  skipsCosServiceTier,
+} from './codex-extra-args.js'
 import { logTokenAudit } from './token-audit.js'
 import { cleanupModelImageInputs, type ModelImageInput } from './model-image-input.js'
 import { buildSystemPrompt, buildLightweightSystemPrompt } from './context-builder.js'
@@ -161,6 +170,13 @@ export function codexSupportsAdditionalDir(): boolean {
   return addDirSupported
 }
 
+export {
+  CodexExtraArgsError,
+  parseCodexExtraArgs,
+  assertSafeCodexExtraArgs,
+  codexEngineFingerprint,
+} from './codex-extra-args.js'
+
 export function buildCodexExecArgs(input: {
   codexCwd: string
   imagePaths?: string[]
@@ -170,6 +186,7 @@ export function buildCodexExecArgs(input: {
   resolvedModel?: CodexModelOption
   effort?: EffortPreference
   publisherWritableDirectory?: string
+  extra?: string[]
 }): string[] {
   const imagePaths = input.imagePaths ?? []
   const resolvedModel = input.resolvedModel
@@ -184,10 +201,18 @@ export function buildCodexExecArgs(input: {
     args.push('--add-dir', input.publisherWritableDirectory)
   }
 
+  const extra = input.extra ?? parseCodexExtraArgs(process.env.COS_CODEX_EXTRA_ARGS)
+  assertSafeCodexExtraArgs(extra)
+  args.push(...extra)
+
   const appendModelConfig = () => {
-    if (resolvedModel.id) args.push('--model', resolvedModel.id)
-    args.push('-c', `model_reasoning_effort="${reasoningEffort}"`)
-    if (serviceTier) args.push('-c', `service_tier="${serviceTier}"`)
+    if (resolvedModel.id && !skipsCosModel(extra)) args.push('--model', resolvedModel.id)
+    if (!skipsCosReasoningEffort(extra)) {
+      args.push('-c', `model_reasoning_effort="${reasoningEffort}"`)
+    }
+    if (serviceTier && !skipsCosServiceTier(extra)) {
+      args.push('-c', `service_tier="${serviceTier}"`)
+    }
   }
 
   if (input.codexThreadId) {
@@ -299,6 +324,18 @@ export async function callCodexStreaming(
   if (options?.abortSignal?.aborted) {
     throw new Error('codex-bridge: client disconnected before Codex started.')
   }
+  let extra: string[]
+  try {
+    extra = parseCodexExtraArgs(process.env.COS_CODEX_EXTRA_ARGS)
+    assertSafeCodexExtraArgs(extra)
+  } catch (error) {
+    if (error instanceof CodexExtraArgsError) {
+      await callbacks.onError(error.message)
+      return sid
+    }
+    throw error
+  }
+  const extraFingerprint = codexEngineFingerprint(extra)
   const history = getHistory(sid)
   const session = getSessionRaw(sid)
   const contextBreaks = session?.contextBreaks ?? []
@@ -310,7 +347,13 @@ export async function callCodexStreaming(
   const resolvedCodexModel = resolveCodexModelOption(model)
   const resolvedCodexEffort = resolveCodexEffortForModel(resolvedCodexModel, options?.effort)
   const engineSession = persistentCodexSession
-    ? getCodexEngineSession({ cosSessionId: sid, model, cwd: codexCwd, trustMode: codexTrustMode })
+    ? getCodexEngineSession({
+      cosSessionId: sid,
+      model,
+      cwd: codexCwd,
+      trustMode: codexTrustMode,
+      engineFingerprint: extraFingerprint,
+    })
     : null
   const imageInputs: ModelImageInput[] = images ?? []
   const imagePaths = imageInputs.map(input => input.path)
@@ -419,6 +462,7 @@ export async function callCodexStreaming(
     resolvedModel: resolvedCodexModel,
     effort: options?.effort,
     publisherWritableDirectory: outputImagePublisher?.writableDirectory,
+    extra,
   })
 
   const env = { ...process.env }
@@ -481,6 +525,7 @@ export async function callCodexStreaming(
         codexThreadId,
         cwd: codexCwd,
         trustMode: codexTrustMode,
+        engineFingerprint: extraFingerprint,
       })
       updateCodexRun(run.runId, { codexThreadId, expiresAt: saved.expiresAt })
     } catch (error) {

package/server/lib/codex-engine-sessions.ts

@@ -20,6 +20,7 @@ export interface CodexEngineSession {
   savedAt: number
   lastUsedAt: number
   expiresAt: string
+  engineFingerprint: string
 }
 
 interface CodexEngineSessionFile {
@@ -93,18 +94,21 @@ export function getCodexEngineSession(input: {
   model: CodexModelPreference
   cwd: string
   trustMode: CodexTrustMode
+  engineFingerprint?: string
 }): CodexEngineSession | null {
+  const { engineFingerprint = '', ...rest } = input
   const store = readStore()
   const now = Date.now()
   const sessions = pruneExpired(store.sessions, now)
-  const existing = sessions[sessionKey(input.cosSessionId, input.model)]
+  const existing = sessions[sessionKey(rest.cosSessionId, rest.model)]
   if (!existing) {
     if (Object.keys(sessions).length !== Object.keys(store.sessions).length) {
       writeStore({ sessions, savedAt: new Date().toISOString() })
     }
     return null
   }
-  if (existing.cwd !== input.cwd || existing.trustMode !== input.trustMode) return null
+  if (existing.cwd !== rest.cwd || existing.trustMode !== rest.trustMode) return null
+  if ((existing.engineFingerprint ?? '') !== (engineFingerprint ?? '')) return null
   return existing
 }
 
@@ -115,6 +119,7 @@ export function saveCodexEngineSession(input: {
   cwd: string
   trustMode: CodexTrustMode
   now?: number
+  engineFingerprint?: string
 }): CodexEngineSession {
   const now = input.now ?? Date.now()
   const store = readStore()
@@ -131,6 +136,7 @@ export function saveCodexEngineSession(input: {
     savedAt: previous?.savedAt ?? now,
     lastUsedAt: now,
     expiresAt: expiresAtFrom(now),
+    engineFingerprint: input.engineFingerprint ?? '',
   }
   sessions[key] = session
   writeStore({ sessions, savedAt: new Date().toISOString() })

package/server/lib/codex-extra-args.ts

@@ -0,0 +1,222 @@
+import { findBannedPermissionArg } from './banned-permission-args.js'
+
+export const CODEX_EXTRA_ARGS_MAX_TOKENS = 32
+export const CODEX_EXTRA_ARGS_MAX_CHARS = 2_000
+
+const BOOLEAN_FLAGS = new Set(['--oss'])
+const VALUE_FLAGS = new Set(['-c', '--config', '--model', '-m', '--local-provider'])
+const ALLOWED_FLAGS = new Set(['--oss', '--local-provider', '--model', '-m', '-c', '--config'])
+const ALLOWED_CONFIG_KEYS = new Set([
+  'model',
+  'model_provider',
+  'oss_provider',
+  'model_reasoning_effort',
+  'service_tier',
+])
+const LOCAL_PROVIDER_VALUES = new Set(['ollama', 'lmstudio'])
+
+export class CodexExtraArgsError extends Error {
+  flag: string
+  constructor(flag: string) {
+    super(`Invalid COS_CODEX_EXTRA_ARGS (${flag}). Edit ~/.cos-glasses/.env and restart the glasses server.`)
+    this.name = 'CodexExtraArgsError'
+    this.flag = flag
+  }
+}
+
+function extraArgsUserMessage(flag: string): string {
+  return `Invalid COS_CODEX_EXTRA_ARGS (${flag}). Edit ~/.cos-glasses/.env and restart the glasses server.`
+}
+
+export function extraArgsErrorMessage(flag: string): string {
+  return extraArgsUserMessage(flag)
+}
+
+function unwrapWholeValue(raw: string): string {
+  if (raw.length >= 2) {
+    const first = raw[0]
+    const last = raw[raw.length - 1]
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+      return raw.slice(1, -1).trim()
+    }
+  }
+  return raw
+}
+
+function splitUnquotedWhitespace(raw: string): string[] {
+  const tokens: string[] = []
+  let current = ''
+  let quote: '"' | "'" | null = null
+  for (const ch of raw) {
+    if (quote) {
+      current += ch
+      if (ch === quote) quote = null
+      continue
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch
+      current += ch
+      continue
+    }
+    if (/\s/.test(ch)) {
+      if (current) {
+        tokens.push(current)
+        current = ''
+      }
+      continue
+    }
+    current += ch
+  }
+  if (quote) throw new CodexExtraArgsError('quotes')
+  if (current) tokens.push(current)
+  return tokens
+}
+
+export function parseCodexExtraArgs(raw: string | undefined): string[] {
+  const trimmed = (raw ?? '').trim()
+  if (!trimmed) return []
+  if (trimmed.length > CODEX_EXTRA_ARGS_MAX_CHARS) throw new CodexExtraArgsError('length')
+  const unwrapped = unwrapWholeValue(trimmed)
+  if (!unwrapped) return []
+  const tokens = splitUnquotedWhitespace(unwrapped)
+  if (tokens.length > CODEX_EXTRA_ARGS_MAX_TOKENS) throw new CodexExtraArgsError('length')
+  return tokens
+}
+
+function stripWrappingQuotes(value: string): string {
+  if (value.length >= 2) {
+    const first = value[0]
+    const last = value[value.length - 1]
+    if ((first === '"' && last === '"') || (first === "'" && last === "'")) {
+      return value.slice(1, -1)
+    }
+  }
+  return value
+}
+
+function fusedValueFlag(token: string): string | null {
+  for (const flag of VALUE_FLAGS) {
+    if (token.startsWith(`${flag}=`)) return flag
+  }
+  return null
+}
+
+type Walked =
+  | { kind: 'boolean'; flag: string }
+  | { kind: 'value'; flag: string; value: string }
+
+function walkCodexExtraArgs(args: string[]): Walked[] {
+  const walked: Walked[] = []
+  let i = 0
+  while (i < args.length) {
+    const token = args[i]
+    if (BOOLEAN_FLAGS.has(token)) {
+      walked.push({ kind: 'boolean', flag: token })
+      i += 1
+      continue
+    }
+    const fused = fusedValueFlag(token)
+    if (fused) {
+      const value = token.slice(fused.length + 1)
+      if (!value) throw new CodexExtraArgsError(fused)
+      if (value.startsWith('-')) throw new CodexExtraArgsError(fused)
+      walked.push({ kind: 'value', flag: fused, value })
+      i += 1
+      continue
+    }
+    if (VALUE_FLAGS.has(token)) {
+      const value = args[i + 1]
+      if (value === undefined) throw new CodexExtraArgsError(token)
+      if (value.startsWith('-')) throw new CodexExtraArgsError(token)
+      walked.push({ kind: 'value', flag: token, value })
+      i += 2
+      continue
+    }
+    throw new CodexExtraArgsError(token)
+  }
+  return walked
+}
+
+function configPayloads(walked: Walked[]): { key: string; value: string }[] {
+  const payloads: { key: string; value: string }[] = []
+  for (const step of walked) {
+    if (step.kind !== 'value' || (step.flag !== '-c' && step.flag !== '--config')) continue
+    const eq = step.value.indexOf('=')
+    if (eq <= 0) throw new CodexExtraArgsError(`-c ${stripWrappingQuotes(step.value)}`)
+    const key = stripWrappingQuotes(step.value.slice(0, eq))
+    const value = step.value.slice(eq + 1)
+    payloads.push({ key, value })
+  }
+  return payloads
+}
+
+export function extraIncludesFlag(args: string[], flags: string[]): boolean {
+  for (const token of args) {
+    for (const flag of flags) {
+      if (token === flag || token.startsWith(`${flag}=`)) return true
+    }
+  }
+  return false
+}
+
+export function extraIncludesConfigKey(args: string[], key: string): boolean {
+  const walked = walkCodexExtraArgs(args)
+  return configPayloads(walked).some(payload => payload.key === key)
+}
+
+export function assertSafeCodexExtraArgs(args: string[]): void {
+  if (args.length === 0) return
+  const walked = walkCodexExtraArgs(args)
+  for (const step of walked) {
+    if (!ALLOWED_FLAGS.has(step.flag)) throw new CodexExtraArgsError(step.flag)
+  }
+  const hasOss = walked.some(step => step.kind === 'boolean' && step.flag === '--oss')
+  const hasLocalProvider = extraIncludesFlag(args, ['--local-provider'])
+  const payloads = configPayloads(walked)
+  const hasOssProvider = payloads.some(payload => payload.key === 'oss_provider')
+  const hasModelProvider = payloads.some(payload => payload.key === 'model_provider')
+
+  if (hasOss && hasModelProvider) throw new CodexExtraArgsError('-c model_provider')
+  if (hasOss && !hasLocalProvider && !hasOssProvider) throw new CodexExtraArgsError('--oss')
+  if ((hasLocalProvider || hasOssProvider) && !hasOss) {
+    throw new CodexExtraArgsError(hasLocalProvider ? '--local-provider' : '-c oss_provider')
+  }
+
+  for (const step of walked) {
+    if (step.kind !== 'value') continue
+    if (step.flag === '--local-provider') {
+      if (!LOCAL_PROVIDER_VALUES.has(stripWrappingQuotes(step.value))) {
+        throw new CodexExtraArgsError('--local-provider')
+      }
+    }
+  }
+  for (const payload of payloads) {
+    if (!ALLOWED_CONFIG_KEYS.has(payload.key)) throw new CodexExtraArgsError(`-c ${payload.key}`)
+    if (payload.key === 'oss_provider' && !LOCAL_PROVIDER_VALUES.has(stripWrappingQuotes(payload.value))) {
+      throw new CodexExtraArgsError('-c oss_provider')
+    }
+  }
+
+  const banned = findBannedPermissionArg(args)
+  if (banned !== null) throw new CodexExtraArgsError(banned)
+}
+
+export function skipsCosModel(extra: string[]): boolean {
+  return extraIncludesFlag(extra, ['--model', '-m']) || extraIncludesConfigKey(extra, 'model')
+}
+
+export function skipsCosServiceTier(extra: string[]): boolean {
+  return extraIncludesFlag(extra, ['--oss', '--local-provider'])
+    || extraIncludesConfigKey(extra, 'model_provider')
+    || extraIncludesConfigKey(extra, 'service_tier')
+}
+
+export function skipsCosReasoningEffort(extra: string[]): boolean {
+  return extraIncludesConfigKey(extra, 'model_reasoning_effort')
+    || extraIncludesFlag(extra, ['--oss', '--local-provider'])
+    || extraIncludesConfigKey(extra, 'model_provider')
+}
+
+export function codexEngineFingerprint(extra: string[]): string {
+  return extra.join('\0')
+}