@khorsheed/dsh-local-agent-codex 0.2.0-rc.1 → 0.2.0

package/lib/index.js

@@ -1,12 +1,12 @@
 import z from "@deepseek-ai/schemastery";
-import { LIVE_FLUSH_INTERVAL_MS, LiveFlush, LiveStreamPublisher, ModelDirectoryCache, assertResumeCwdUnchanged, assertResumeScopeUnchanged, containerExecSpawn, containerScopedHome, delegationEnv, establishSubagentCatalogChild, extendModelDirectory, modelDirectoryContextKey, persistChildSession, probeCliVersion, resolveChildCwd, resolveRoundModel, settingsFace, subagentDelegationLabel, vol } from "@khorsheed/dsh-local-agent";
+import { LIVE_FLUSH_INTERVAL_MS, LiveFlush, LiveStreamPublisher, ModelDirectoryCache, assertResumeCwdUnchanged, assertResumeScopeUnchanged, containerExecSpawn, containerScopedHome, delegationEnv, establishSubagentCatalogChild, extendModelDirectory, firstModelOf, modelDirectoryContextKey, persistChildSession, probeCliVersion, readModelList, readModelListSync, resolveChildCwd, resolveRoundModel, settingsFace, subagentDelegationLabel, vol, writeModelList } from "@khorsheed/dsh-local-agent";
 import { MEMBER_BRIDGE_SOCKET_ENV, MEMBER_BRIDGE_TOKEN_ENV, endpointHost } from "@khorsheed/dsh-local-agent/types";
 import { randomUUID } from "node:crypto";
 import { createAssistantMessage, createToolResultMessage, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { SessionId } from "@deepseek-ai/dsh-session";
-import { NO_START_CAPABILITIES, settleRunResult, subprocessRunHandle } from "@deepseek-ai/dsh-subagent";
+import { NO_START_CAPABILITIES, SUBAGENT_DESCRIPTOR_VERSION, settleRunResult, subprocessRunHandle } from "@deepseek-ai/dsh-subagent";
 import { StringDecoder } from "node:string_decoder";
-import { open, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
+import { mkdir, open, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { dirname, join, resolve } from "node:path";
 //#region lib/types/records.js
 /**
@@ -38,21 +38,6 @@ const ROLLOUT_WINDOW_SLACK_MS = 3e5;
 /** Extra future slack for the window end (file timestamps may skew ahead). */
 const ROLLOUT_WINDOW_FUTURE_MS = 6e4;
 /**
-* Whether the scoped home holds usable Codex credentials: the `auth.json`
-* file exists. Absent means the device-code flow has not completed.
-* @param homeDir - the `codex` harness's scoped home.
-* @returns true when credentials are present.
-*/
-async function codexAuthenticated(homeDir) {
-	try {
-		await readFile(join(homeDir, "auth.json"));
-		return true;
-	} catch (error) {
-		if (error.code === "ENOENT") return false;
-		throw error;
-	}
-}
-/**
 * Parse the first line of a rollout file for the listing fields. Unknown or
 * malformed values yield an undefined record rather than failing the list.
 * @param text - the raw rollout file content (only the head is read).
@@ -150,10 +135,12 @@ async function listCodexSessions(homeDir) {
 * `input_tokens` is the TOTAL input including cache hits (OpenAI-style
 * accounting, confirmed against `total_tokens` in the rollout token_count),
 * and `cached_input_tokens` is the cache-read subset — so the uncached
-* bucket subtracts the cached portion to avoid double counting. There is no
-* cache-write concept, so that bucket is omitted (the shared four-bucket
-* contract: uncached input, output, cache read, cache write — codex fills
-* the first three).
+* bucket subtracts the cached portion to avoid double counting.
+* `cached_input_tokens` rides every payload (zero included), so
+* `cacheReadTokens` is written whenever the field is present — a reader can
+* tell "no hits" from "not reported". Codex also reports cache creation
+* (`cache_write_input_tokens`), mapped to `cacheWriteTokens` (the shared
+* four-bucket contract: uncached input, output, cache read, cache write).
 * @param usage - the raw codex usage object (`turn.completed`'s `usage` or a
 *   rollout `token_count` `info.last_token_usage`/`total_token_usage`).
 * @returns the shared usage record.
@@ -162,12 +149,14 @@ function usageFromCodex(usage) {
 	const raw = usage;
 	const input = Number(raw.input_tokens);
 	const cached = Number(raw.cached_input_tokens);
+	const cacheWrite = Number(raw.cache_write_input_tokens);
 	const output = Number(raw.output_tokens);
 	const usageRecord = {
-		inputTokens: Number.isFinite(input) && Number.isFinite(cached) ? Math.max(0, input - cached) : Number.isFinite(input) ? input : 0,
+		inputTokens: Number.isFinite(input) && Number.isFinite(cached) ? Math.max(0, input - cached - (Number.isFinite(cacheWrite) ? cacheWrite : 0)) : Number.isFinite(input) ? input : 0,
 		outputTokens: Number.isFinite(output) ? output : 0
 	};
-	if (Number.isFinite(cached) && cached > 0) usageRecord.cacheReadTokens = cached;
+	if (Number.isFinite(cached)) usageRecord.cacheReadTokens = cached;
+	if (Number.isFinite(cacheWrite) && cacheWrite > 0) usageRecord.cacheWriteTokens = cacheWrite;
 	return usageRecord;
 }
 /**
@@ -430,6 +419,293 @@ async function codexRolloutRoundFacts(homeDir, locator) {
 	};
 }
 //#endregion
+//#region lib/types/endpoint-auth.js
+/**
+* Endpoint-key authentication — the codex harness's ONLY auth mode. There is
+* no web login anywhere in this package: a delegation round reaches its
+* endpoint with a custom `model_providers` entry on the argv pointing at the
+* relay and the key traveling as `OPENAI_API_KEY` in the process environment
+* (verified against codex-cli 0.163.0: a fresh scoped home with only these
+* runs `codex exec` with no login file at all). With no credential the spawn
+* carries no auth at all — it fails loudly at the endpoint, exactly the
+* honest reading the status shows.
+*
+* Verified against codex-cli 0.163.0 (2026-10-20): a fresh scoped home with
+* only `OPENAI_API_KEY` plus the two `-c` overrides below runs
+* `codex exec -m <model>` end-to-end through an OpenAI-compatible relay
+* (openproxy, `wire_api = "responses"`) — no login, no auth.json, no
+* onboarding gate.
+*
+* Two layers, merged per field, file over config:
+*
+* - `<scopedHome>/endpoint-auth.json` (mode 0600) — the per-scope credential.
+*   Its name deliberately matches the eval contract hash's credential denylist
+*   (`auth`), so the key material never enters an evaluation's condition
+*   fingerprint; the file's mtime serves as the credential stamp, which makes
+*   "edit the file" the recovery gesture for a `rejected` grade.
+* - The plugin config's `baseUrl` / `apiKey` — the deployment default every
+*   scope without a file shares. Read PER ROUND, so a profile edit applies to
+*   the next round (and a host restart clears the in-memory `rejected` mark).
+*
+* `wireApi` is a file-only escape hatch: the settings card never edits it,
+* the default `responses` is codex's native wire (relay-verified), and a
+* hand-edit to `"chat"` survives the card's whole-file writes because the
+* read merges it back. The env layer rides the family's existing plumbing:
+* `delegationEnv` on the host, `containerExecSpawn`'s name-only `-e`
+* forwarding into a container — a containerized round authenticates with the
+* same credential as the host, nothing is authorized inside the unit.
+* @module @khorsheed/dsh-local-agent-codex/endpoint-auth
+*/
+/**
+* The scoped-home credential file's name. Chosen to match the eval contract
+* hash's credential-shaped denylist (`/token|key|credential|secret|password|auth|\.env/i`),
+* so the file is excluded from condition fingerprints by name.
+*/
+const ENDPOINT_AUTH_FILE = "endpoint-auth.json";
+/** The custom provider's TOML key in the `-c` overrides (bare-key safe). */
+const ENDPOINT_PROVIDER_NAME = "dsh-endpoint";
+/** The env var the custom provider reads the key from (`env_key`). */
+const ENDPOINT_ENV_KEY = "OPENAI_API_KEY";
+/** Trim and normalize one credential field; blank reads as absent. */
+function field(value) {
+	if (typeof value !== "string") return void 0;
+	const trimmed = value.trim();
+	return trimmed === "" ? void 0 : trimmed;
+}
+/** Whether a resolved endpoint carries a usable credential. */
+function hasEndpointCredential(auth) {
+	return auth !== void 0 && field(auth.apiKey) !== void 0;
+}
+/**
+* Read the scope's endpoint-auth.json. Absent or unreadable yields undefined
+* (the caller falls back to the plugin config); malformed JSON or a non-object
+* payload also yields undefined — a torn file must not fail a status read.
+* Non-string fields are dropped, never carried through.
+* @param homeDir - the `codex` harness's scoped home.
+* @returns the file's endpoint credential, or undefined.
+*/
+async function readEndpointAuthFile(homeDir) {
+	let text;
+	try {
+		text = await readFile(join(homeDir, ENDPOINT_AUTH_FILE), "utf8");
+	} catch {
+		return;
+	}
+	try {
+		const parsed = JSON.parse(text);
+		if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return void 0;
+		const baseUrl = field(parsed["baseUrl"]);
+		const apiKey = field(parsed["apiKey"]);
+		const wireApi = field(parsed["wireApi"]);
+		return {
+			...baseUrl === void 0 ? {} : { baseUrl },
+			...apiKey === void 0 ? {} : { apiKey },
+			...wireApi === void 0 ? {} : { wireApi }
+		};
+	} catch {
+		return;
+	}
+}
+/**
+* Resolve one scope's effective endpoint credential: the scope's
+* endpoint-auth.json merged FIELD BY FIELD over the plugin config's
+* `baseUrl` / `apiKey` (a file that names only a key rotates the key while
+* keeping the deployment's relay URL). The result may carry no credential at
+* all — {@link hasEndpointCredential} is the judgment, kept separate so the
+* caller can still route/log the resolved baseUrl.
+* @param homeDir - the scope's scoped home.
+* @param config - the plugin config's deployment-level endpoint pair.
+* @returns the merged endpoint auth.
+*/
+async function resolveEndpointAuth(homeDir, config) {
+	const file = await readEndpointAuthFile(homeDir);
+	const configBaseUrl = field(config.baseUrl);
+	const configApiKey = field(config.apiKey);
+	return {
+		...configBaseUrl === void 0 ? {} : { baseUrl: configBaseUrl },
+		...configApiKey === void 0 ? {} : { apiKey: configApiKey },
+		...file
+	};
+}
+/**
+* The spawn-env layer for a resolved endpoint: the key under the custom
+* provider's `env_key` name, nothing else. A credential-less resolution
+* yields an empty layer — the spread then adds no keys at all, byte-identical
+* to the pre-endpoint env. With no baseUrl the CLI's built-in OpenAI provider
+* reads the same variable, so an official platform key needs no `-c`
+* override either.
+* @param auth - the resolved endpoint auth, or undefined.
+* @returns the explicit env entries for the delegation spawn.
+*/
+function endpointAuthEnv(auth) {
+	const apiKey = field(auth?.apiKey);
+	return apiKey === void 0 ? {} : { [ENDPOINT_ENV_KEY]: apiKey };
+}
+/** Quote one TOML basic string for the `-c` config override. */
+function tomlString$1(value) {
+	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+/**
+* The `-c` config overrides routing the CLI at the resolved relay: a custom
+* `model_providers` entry plus the `model_provider` selection, as a flat argv
+* fragment (`-c <override>` pairs). Empty unless BOTH a key and a baseUrl are
+* present — a key without a relay URL is served by the built-in provider
+* through the env layer alone, and a relay URL without a key would route
+* every round into a 401. Verified end-to-end against codex-cli 0.163.0.
+* @param auth - the resolved endpoint auth, or undefined.
+* @returns the argv fragment, possibly empty.
+*/
+function endpointConfigOverrides(auth) {
+	const baseUrl = field(auth?.baseUrl);
+	const apiKey = field(auth?.apiKey);
+	if (baseUrl === void 0 || apiKey === void 0) return [];
+	const wireApi = field(auth?.wireApi) ?? "responses";
+	return [
+		"-c",
+		`model_provider=${tomlString$1(ENDPOINT_PROVIDER_NAME)}`,
+		"-c",
+		`model_providers.${ENDPOINT_PROVIDER_NAME}={name=${tomlString$1(ENDPOINT_PROVIDER_NAME)},base_url=${tomlString$1(baseUrl)},env_key=${tomlString$1(ENDPOINT_ENV_KEY)},wire_api=${tomlString$1(wireApi)}}`
+	];
+}
+/**
+* The credential marker's modification stamp (epoch ms): the endpoint file's
+* mtime, or undefined when the scope has no file (a config-sourced credential
+* has no marker — rotating it pairs with the profile edit and instance
+* restart that clear the in-memory grade marks). A fresh file write is a
+* fresh stamp, which is how an edited-in key recovers a `rejected` grade.
+* @param homeDir - the scope's scoped home.
+* @returns the stamp, or undefined.
+*/
+async function endpointAuthStamp(homeDir) {
+	try {
+		return (await stat(join(homeDir, ENDPOINT_AUTH_FILE))).mtimeMs;
+	} catch {
+		return;
+	}
+}
+/** Whether the scope carries its own endpoint file at all. */
+async function endpointAuthFileExists(homeDir) {
+	return await endpointAuthStamp(homeDir) !== void 0;
+}
+/**
+* Write the scope's endpoint-auth.json (mode 0600, mkdir -p first). The
+* payload preserves the file-only `wireApi` across card writes: callers pass
+* the merged object (current file + edits), never a bare card payload.
+* @param homeDir - the scope's scoped home.
+* @param auth - the endpoint credential to persist.
+*/
+async function writeEndpointAuth(homeDir, auth) {
+	await mkdir(homeDir, { recursive: true });
+	const baseUrl = field(auth.baseUrl);
+	const apiKey = field(auth.apiKey);
+	const wireApi = field(auth.wireApi);
+	const payload = {
+		...baseUrl === void 0 ? {} : { baseUrl },
+		...apiKey === void 0 ? {} : { apiKey },
+		...wireApi === void 0 ? {} : { wireApi }
+	};
+	await writeFile(join(homeDir, ENDPOINT_AUTH_FILE), JSON.stringify(payload, void 0, 2) + "\n", { mode: 384 });
+}
+/**
+* Clear the scope's OWN endpoint credential (the endpoint-auth.json file).
+* A deployment-level credential from the plugin config is untouched — the
+* core's logout reply then names the profile row as the place to edit.
+* @param homeDir - the scope's scoped home.
+*/
+async function clearEndpointAuth(homeDir) {
+	await rm(join(homeDir, ENDPOINT_AUTH_FILE), { force: true });
+}
+/** How many served model ids the check reply lists before truncating. */
+const CHECK_MODEL_LIST_LIMIT = 8;
+/** Bound on the error-body excerpt a failed check reports. */
+const CHECK_ERROR_BODY_LIMIT = 200;
+/**
+* `GET <baseUrl>/v1/models` with `Authorization: Bearer <key>` — the
+* token-free endpoint probe shared by the `/codex check` verdict and any
+* future catalog. OpenAI's own API serves this route with the platform key;
+* relays (openproxy verified 2026-10-20, 139 models) proxy it and answer the
+* same OpenAI-list shape. Never throws: every failure mode folds into the
+* result.
+* @param endpoint - the resolved endpoint auth with a decided baseUrl.
+* @param fetchImpl - the HTTP fetch; default the host's global fetch.
+* @param signal - abort for the whole probe (timeout bundled by the caller).
+* @returns the folded result.
+*/
+async function fetchEndpointModels(endpoint, fetchImpl, signal) {
+	const headers = {};
+	if (endpoint.apiKey !== void 0) headers["authorization"] = `Bearer ${endpoint.apiKey}`;
+	const fetcher = fetchImpl ?? globalThis.fetch;
+	const root = endpoint.baseUrl.replace(/\/+$/, "");
+	const url = `${root}${root.endsWith("/v1") ? "" : "/v1"}/models`;
+	let response;
+	try {
+		response = await fetcher(url, {
+			headers,
+			signal: signal ?? AbortSignal.timeout(8e3)
+		});
+	} catch (error) {
+		return {
+			kind: "unreachable",
+			message: error instanceof Error ? error.message : String(error)
+		};
+	}
+	if (!response.ok) return {
+		kind: "http",
+		status: response.status,
+		body: (await response.text().catch(() => "")).slice(0, CHECK_ERROR_BODY_LIMIT)
+	};
+	let data;
+	try {
+		data = JSON.parse(await response.text()).data;
+	} catch {
+		return { kind: "malformed" };
+	}
+	if (!Array.isArray(data)) return { kind: "malformed" };
+	const models = [];
+	for (const entry of data) {
+		if (typeof entry !== "object" || entry === null) continue;
+		const id = entry.id;
+		if (typeof id === "string" && id !== "") models.push(id);
+	}
+	return {
+		kind: "models",
+		models
+	};
+}
+/**
+* Probe the resolved endpoint with a cheap, token-free round-trip: `GET
+* <baseUrl>/v1/models` with the resolved credential's Bearer header. A 200
+* proves both reachability and credential validity — the exact evidence a
+* "verify" button needs — and the served model list rides the reply. One
+* transport-level retry rides along: a local proxy restart (a Surge/clash
+* reload) stalls the first attempt into the timeout and answers the retry
+* immediately. Never throws: every failure mode folds into the reply text,
+* since the reply IS the diagnostic.
+* @param endpoint - the resolved endpoint auth (scope file over settings).
+* @param fetchImpl - the HTTP fetch; default the host's global fetch.
+* @param timeoutMs - one attempt's deadline (two attempts at most).
+* @returns the human-readable verdict for the check reply.
+*/
+async function checkCodexEndpoint(endpoint, fetchImpl, timeoutMs = 2e4) {
+	if (!hasEndpointCredential(endpoint)) return "No endpoint credential configured — fill Base URL and API Key on the settings card (or the profile row) first.";
+	const baseUrl = (endpoint.baseUrl ?? "https://api.openai.com").replace(/\/+$/, "");
+	let result = await fetchEndpointModels({
+		...endpoint,
+		baseUrl
+	}, fetchImpl, AbortSignal.timeout(timeoutMs));
+	if (result.kind === "unreachable") result = await fetchEndpointModels({
+		...endpoint,
+		baseUrl
+	}, fetchImpl, AbortSignal.timeout(timeoutMs));
+	if (result.kind === "unreachable") return `Endpoint unreachable (${baseUrl}): ${result.message}`;
+	if (result.kind === "http") return `Endpoint answered HTTP ${String(result.status)} (${baseUrl})${result.body === "" ? "" : `: ${result.body}`}`;
+	if (result.kind === "malformed") return `Endpoint reachable (${baseUrl}) but the model list did not parse — the credential worked, the reply was not /v1/models-shaped.`;
+	if (result.models.length === 0) return `Endpoint reachable (${baseUrl}); it serves no models.`;
+	const listed = result.models.slice(0, CHECK_MODEL_LIST_LIMIT).join(", ");
+	const more = result.models.length > CHECK_MODEL_LIST_LIMIT ? `, … +${String(result.models.length - CHECK_MODEL_LIST_LIMIT)} more` : "";
+	return `Endpoint reachable (${baseUrl}): ${String(result.models.length)} model(s) served — ${listed}${more}`;
+}
+//#endregion
 //#region lib/types/live-driver.js
 /**
 * The codex provider's live driver: one resident `codex app-server --stdio`
@@ -468,11 +744,6 @@ const DEFAULT_LIVE_CHANNEL_RETRY_MS = 3e5;
 const RECLAIM_EOF_GRACE_MS = 1e3;
 /** Default minimum interval between one streaming item's snapshot messages. */
 const DEFAULT_SNAPSHOT_MIN_INTERVAL_MS = LIVE_FLUSH_INTERVAL_MS;
-/**
-* The app-server channel could not come up (spawn failure or handshake
-* timeout/mismatch). The provider catches exactly this and falls back to the
-* exec one-shot; any other error is a real round failure.
-*/
 var LiveChannelUnavailableError = class extends Error {
 	constructor(message) {
 		super(message);
@@ -554,11 +825,14 @@ function codexAppServerItemToLine(item) {
 		case "dynamicToolCall": {
 			const tool = typeof item["tool"] === "string" ? item.tool : "dynamic";
 			const args = item["arguments"] === void 0 || item["arguments"] === null ? void 0 : typeof item["arguments"] === "string" ? item["arguments"] : JSON.stringify(item["arguments"]);
+			const content = item["contentItems"];
+			const result = Array.isArray(content) ? content.filter((block) => typeof block === "object" && block !== null).map((block) => typeof block["text"] === "string" ? block["text"] : void 0).filter((text) => text !== void 0 && text !== "").join("\n") : void 0;
 			return {
 				kind: "tool",
 				id: itemId ?? `codex-live-${randomUUID()}`,
 				name: tool,
-				...args === void 0 || args === "" ? {} : { args }
+				...args === void 0 || args === "" ? {} : { args },
+				...result === void 0 || result === "" ? {} : { result }
 			};
 		}
 		case "collabAgentToolCall": {
@@ -589,12 +863,14 @@ function codexAppServerItemToLine(item) {
 function usageFromAppServer(breakdown) {
 	const input = Number(breakdown["inputTokens"]);
 	const cached = Number(breakdown["cachedInputTokens"]);
+	const cacheWrite = Number(breakdown["cacheWriteInputTokens"]);
 	const output = Number(breakdown["outputTokens"]);
 	const usage = {
-		inputTokens: Number.isFinite(input) && Number.isFinite(cached) ? Math.max(0, input - cached) : Number.isFinite(input) ? input : 0,
+		inputTokens: Number.isFinite(input) && Number.isFinite(cached) ? Math.max(0, input - cached - (Number.isFinite(cacheWrite) ? cacheWrite : 0)) : Number.isFinite(input) ? input : 0,
 		outputTokens: Number.isFinite(output) ? output : 0
 	};
-	if (Number.isFinite(cached) && cached > 0) usage.cacheReadTokens = cached;
+	if (Number.isFinite(cached)) usage.cacheReadTokens = cached;
+	if (Number.isFinite(cacheWrite) && cacheWrite > 0) usage.cacheWriteTokens = cacheWrite;
 	return usage;
 }
 /**
@@ -948,11 +1224,13 @@ var CodexLiveDriver = class {
 		const member = registerCodexMemberRun(this.ctx, String(spec.childSession.id), spec.parentSessionId);
 		const startModel = spec.startModel?.trim();
 		const model = spec.configuration !== void 0 ? spec.configuration.model : startModel !== void 0 && startModel !== "" ? startModel : this.config.model?.(key)?.trim();
+		const endpoint = this.config.endpoint === void 0 ? void 0 : await this.config.endpoint(spec.homeDir).catch(() => void 0);
 		const spawnSpec = {
 			argv: [
 				"codex",
 				"app-server",
 				...member === void 0 ? [] : ["-c", member.configOverride],
+				...endpointConfigOverrides(endpoint),
 				...model === void 0 || model === "" ? [] : ["-c", `model=${JSON.stringify(model)}`],
 				...spec.configuration?.effort === void 0 ? [] : ["-c", `model_reasoning_effort=${JSON.stringify(spec.configuration.effort)}`],
 				"--stdio"
@@ -964,7 +1242,10 @@ var CodexLiveDriver = class {
 				stderr: "pipe"
 			},
 			graceMs: DEFAULT_DISPOSE_GRACE_MS,
-			env: delegationEnv({ CODEX_HOME: spec.homeDir })
+			env: delegationEnv({
+				CODEX_HOME: spec.homeDir,
+				...endpointAuthEnv(endpoint)
+			})
 		};
 		let child;
 		try {
@@ -1151,27 +1432,31 @@ var CodexLiveDriver = class {
 		const lines = [];
 		let mirrored = 0;
 		let usage;
-		/** Whether a folded line already carries the round's usage (no backfill event exists). */
-		let usageCarried = false;
+		/** The cumulative turn total the wire's `tokenUsage.total` names, for the settled report. */
+		let totalUsage;
 		/**
-		* The step ledger: `reservedSteps` holds every step a stream reservation
-		* consumed (in increasing order — permanently, whether the stream later
-		* completes or stays an orphan snapshot), and a sequential line folds at
-		* its index shifted past every reservation before it. A tool completed
-		* mid-stream therefore folds ABOVE the stream's step and the projection
-		* renders the round's chronological order.
+		* Per-call usage by transcript line: each `thread/tokenUsage/updated`
+		* notification closes one API call (its items have all completed), and
+		* the call's LAST line carries its `tokenUsage.last`. The map is
+		* authoritative per line, independent of the flush's withUsage flag.
 		*/
-		const reservedSteps = [];
+		const usageByLine = /* @__PURE__ */ new Map();
+		/** Whether a folded line already carries usage (per-call, or the round's fallback — no backfill event exists). */
+		let usageCarried = false;
 		/**
-		* The streaming items seen this round by item id:
-		* deltas accumulate into throttled snapshot assistant/messages appended
-		* at the item's reserved (turn, step) — the host folds repeated settles
-		* at one coordinate into one live-updating chat node, which is the only
-		* streaming channel left after 0.1.5 retired the durable per-chunk event.
-		* The item's completion folds at the same step and finalizes it; an entry
-		* whose completion never arrives is force-finalized at settle.
+		* The streaming items seen this round by item id: deltas accumulate into
+		* throttled snapshots at the item's step once it may open in the log
+		* (previewed live before that) — the host folds repeated settles at one
+		* coordinate into one live-updating chat node. The item's completion
+		* folds at the same step and finalizes it; an entry whose completion
+		* never arrives is force-finalized at settle. A tool that completes
+		* mid-stream folds after the stream, keeping the round's chronology.
 		*/
 		const streams = /* @__PURE__ */ new Map();
+		/** Provisional stream keys (live flush and preview identity), never log steps. */
+		let streamKeys = 0;
+		/** Line indexes already written (a line may fold ahead of an earlier one it chronologically precedes). */
+		const folded = /* @__PURE__ */ new Set();
 		/** The item deltas currently accumulate into (items stream sequentially). */
 		let activeStream;
 		/** Items/completions that arrived before the turn id was known. */
@@ -1215,6 +1500,27 @@ var CodexLiveDriver = class {
 		*/
 		const streamPublisher = localAgent?.liveStreams === void 0 ? void 0 : new LiveStreamPublisher(localAgent.liveStreams, childSession, turn, persist, (error) => this.ctx.logger.warn(`live checkpoint failed: ${String(error)}`));
 		const liveFlush = new LiveFlush((error) => this.ctx.logger.warn(`live mirror flush failed: ${String(error)}`), this.config.snapshotMinIntervalMs ?? DEFAULT_SNAPSHOT_MIN_INTERVAL_MS);
+		let lastStep = 0;
+		let openStep;
+		const openStreamStep = (stream) => {
+			lastStep += 1;
+			childSession.append("step/start", {
+				turn,
+				step: lastStep
+			});
+			stream.durable = lastStep;
+			stream.opened = true;
+			openStep = lastStep;
+		};
+		const closeOpenStep = () => {
+			if (openStep === void 0) return;
+			childSession.append("step/end", {
+				turn,
+				step: openStep
+			});
+			openStep = void 0;
+		};
+		const canOpenStream = (stream) => openStep === void 0 && mirrored >= stream.after && streams.keys().next().value === stream.itemId;
 		const pendingStreamArrival = /* @__PURE__ */ new Map();
 		const appendStreamSnapshot = (stream, force, interrupted, withUsage = false, final = false) => {
 			if (stream.text.trim() === "") return;
@@ -1227,30 +1533,29 @@ var CodexLiveDriver = class {
 			liveFlush.cancel(stream.step);
 			const receivedAt = pendingStreamArrival.get(stream.step) ?? now;
 			pendingStreamArrival.delete(stream.step);
-			if (streamPublisher !== void 0 && !final) {
-				if (!stream.opened) {
-					childSession.append("step/start", {
-						turn,
-						step: stream.step
+			if (!stream.opened) {
+				if (canOpenStream(stream)) openStreamStep(stream);
+				else if (!final) {
+					streamPublisher?.preview(stream.step, stream.kind, stream.text, {
+						itemId: stream.itemId,
+						receivedAt
 					});
-					stream.opened = true;
+					return;
+				} else {
+					closeOpenStep();
+					openStreamStep(stream);
 				}
-				streamPublisher.update(stream.step, stream.kind, stream.text, { receivedAt });
+			}
+			if (streamPublisher !== void 0 && !final) {
+				streamPublisher.update(stream.durable, stream.kind, stream.text, { receivedAt });
 				stream.lastSnapshotAt = now;
 				stream.lastSnapshotLen = stream.text.length;
 				return;
 			}
-			if (!stream.opened) {
-				childSession.append("step/start", {
-					turn,
-					step: stream.step
-				});
-				stream.opened = true;
-			}
-			const attachUsage = withUsage && !usageCarried && usage !== void 0;
+			const attachUsage = withUsage && !usageCarried && usageByLine.size === 0 && usage !== void 0;
 			childSession.append("assistant/message", {
 				turn,
-				step: stream.step,
+				step: stream.durable,
 				message: codexAssistantEvent([stream.kind === "think" ? {
 					type: "reasoning",
 					text: stream.text
@@ -1259,7 +1564,7 @@ var CodexLiveDriver = class {
 					text: stream.text
 				}]),
 				stream: [],
-				...withUsage && !usageCarried && usage !== void 0 ? { usage } : {},
+				...withUsage && !usageCarried && usageByLine.size === 0 && usage !== void 0 ? { usage } : {},
 				...interrupted ? { interrupted: true } : {}
 			}, { surfaceOp: "append" });
 			if (attachUsage) usageCarried = true;
@@ -1267,11 +1572,19 @@ var CodexLiveDriver = class {
 			stream.lastSnapshotLen = stream.text.length;
 			persist();
 		};
+		/** Close a stream's live presentation once its final text is in the log. */
+		const finishStream = (stream) => {
+			liveFlush.cancel(stream.step);
+			streams.delete(stream.itemId);
+			if (activeStream === stream.itemId) activeStream = void 0;
+			streamPublisher?.finish(stream.step);
+			if (stream.durable !== void 0) streamPublisher?.finish(stream.durable);
+		};
 		/**
-		* Reserve the step one new streaming item will occupy — past every
-		* completed line (folded or held back) and every earlier reservation. A
-		* different item's deltas force one final snapshot of the current stream
-		* (its completion still folds at its own reserved step when it lands).
+		* Track one new streaming item: its provisional key (live flush and
+		* preview identity) and how many lines had completed when it began. A
+		* different item's deltas force one freshness snapshot of the current
+		* stream.
 		*/
 		const reserveStream = (itemId, kind) => {
 			if (activeStream !== void 0 && activeStream !== itemId) {
@@ -1281,12 +1594,12 @@ var CodexLiveDriver = class {
 			}
 			let stream = streams.get(itemId);
 			if (stream === void 0) {
-				const step = lines.length + reservedSteps.length + 1;
-				reservedSteps.push(step);
+				streamKeys += 1;
 				stream = {
 					itemId,
 					kind,
-					step,
+					step: streamKeys,
+					after: lines.length,
 					text: "",
 					lastSnapshotAt: 0,
 					lastSnapshotLen: 0,
@@ -1296,60 +1609,78 @@ var CodexLiveDriver = class {
 			}
 			activeStream = itemId;
 		};
-		/** The sequential fold step for `lines[index]`: its position shifted past every reservation before it. */
-		const foldStep = (index) => {
-			let step = index + 1;
-			for (const reserved of reservedSteps) if (reserved <= step) step += 1;
-			else break;
-			return step;
+		/** The stream a completed line finalizes, if it was streamed. */
+		const streamOfLine = (line) => line === void 0 || line.kind === "tool" ? void 0 : streams.get(line.itemId ?? "");
+		/** Write lines[index] at the next step(s). */
+		const foldLine = (index, lineUsage) => {
+			const line = lines[index];
+			const stream = streamOfLine(line);
+			if (stream !== void 0) {
+				if (!stream.opened) {
+					closeOpenStep();
+					openStreamStep(stream);
+				}
+				const blocks = stream.kind === "think" ? [{
+					type: "reasoning",
+					text: line.kind === "tool" ? "" : line.text
+				}] : [{
+					type: "text",
+					text: line.kind === "tool" ? "" : line.text
+				}];
+				childSession.append("assistant/message", {
+					turn,
+					step: stream.durable,
+					message: codexAssistantEvent(blocks),
+					stream: [],
+					...lineUsage === void 0 ? {} : { usage: lineUsage }
+				}, { surfaceOp: "append" });
+				finishStream(stream);
+				closeOpenStep();
+			} else {
+				closeOpenStep();
+				lastStep += 1;
+				appendCodexTranscriptLine(childSession, turn, lastStep, line, lineUsage);
+			}
+			folded.add(index);
+			localAgent?.reportRunProgress(childSession.id, {
+				kind: "delta",
+				text: codexLineText(line)
+			});
 		};
-		/** Mirror folded lines [mirrored, upto); the last line is held back until completion. */
+		/**
+		* Mirror the completed lines before `upto` in chronological order; the
+		* last line is held back until completion. A line waits behind every
+		* stream that began before it completed: that stream's line folds first,
+		* or — while it is still streaming — the mirror stops until it lands.
+		*/
 		const mirrorUpTo = (upto, withUsage) => {
 			let usageIndex = -1;
-			if (withUsage) {
+			if (withUsage && usageByLine.size === 0) {
 				for (let index = 0; index < lines.length; index += 1) if (lines[index]?.kind !== "tool") usageIndex = index;
 			}
-			for (let index = mirrored; index < upto; index += 1) {
-				const line = lines[index];
-				if (line === void 0) continue;
+			const usageFor = (index) => {
+				const own = usageByLine.get(index);
+				if (own !== void 0) {
+					usageCarried = true;
+					return own;
+				}
 				const lineUsage = withUsage && index === usageIndex ? usage : void 0;
 				if (lineUsage !== void 0) usageCarried = true;
-				const itemId = line.kind === "tool" ? void 0 : line.itemId;
-				const stream = itemId === void 0 ? void 0 : streams.get(itemId);
-				if (itemId !== void 0 && stream !== void 0) {
-					liveFlush.cancel(stream.step);
-					streams.delete(itemId);
-					if (activeStream === itemId) activeStream = void 0;
-					if (!stream.opened) childSession.append("step/start", {
-						turn,
-						step: stream.step
-					});
-					const blocks = stream.kind === "think" ? [{
-						type: "reasoning",
-						text: line.kind === "tool" ? "" : line.text
-					}] : [{
-						type: "text",
-						text: line.kind === "tool" ? "" : line.text
-					}];
-					childSession.append("assistant/message", {
-						turn,
-						step: stream.step,
-						message: codexAssistantEvent(blocks),
-						stream: [],
-						...lineUsage === void 0 ? {} : { usage: lineUsage }
-					}, { surfaceOp: "append" });
-					streamPublisher?.finish(stream.step);
-					childSession.append("step/end", {
-						turn,
-						step: stream.step
-					});
-				} else appendCodexTranscriptLine(childSession, turn, foldStep(index), line, lineUsage);
-				mirrored = index + 1;
-				localAgent?.reportRunProgress(childSession.id, {
-					kind: "delta",
-					text: codexLineText(line)
-				});
+				return lineUsage;
+			};
+			outer: for (let index = mirrored; index < upto; index += 1) {
+				if (folded.has(index)) continue;
+				const own = streamOfLine(lines[index]);
+				const all = [...streams.values()];
+				const before = own === void 0 ? all.filter((stream) => stream.after <= index) : all.slice(0, all.indexOf(own));
+				for (const earlier of before) {
+					const at = lines.findIndex((line, position) => position > index && position < upto && !folded.has(position) && streamOfLine(line) === earlier);
+					if (at < 0) break outer;
+					foldLine(at, usageFor(at));
+				}
+				foldLine(index, usageFor(index));
 			}
+			while (folded.has(mirrored)) mirrored += 1;
 			if (upto > 0) persist();
 		};
 		let resolveCompletion;
@@ -1358,6 +1689,11 @@ var CodexLiveDriver = class {
 		});
 		const openTurn = () => {
 			childSession.append("turn/start", { turn });
+			if (spec.configuration?.model !== void 0) appendCodexRequestHeader(childSession, {
+				provider: "codex-local",
+				model: spec.configuration.model,
+				...spec.configuration.effort === void 0 ? {} : { reasoningEffort: spec.configuration.effort }
+			});
 			childSession.append("user/message", createUserMessage({
 				content: [{
 					type: "text",
@@ -1408,17 +1744,29 @@ var CodexLiveDriver = class {
 				return;
 			}
 			if (method === "thread/tokenUsage/updated") {
-				const last = params["tokenUsage"]?.["last"];
-				if (last !== void 0) usage = usageFromAppServer(last);
+				const tokenUsage = params["tokenUsage"];
+				const last = tokenUsage?.["last"];
+				const total = tokenUsage?.["total"];
+				if (total !== void 0 && (Number.isFinite(Number(total["inputTokens"])) || Number.isFinite(Number(total["outputTokens"])))) totalUsage = usageFromAppServer(total);
+				if (last !== void 0) {
+					usage = usageFromAppServer(last);
+					if (lines.length > 0) {
+						usageByLine.set(lines.length - 1, usage);
+						mirrorUpTo(lines.length - 1, true);
+					}
+				}
 				return;
 			}
 			if (method === "turn/completed") {
 				const turnData = params["turn"];
-				mirrorUpTo(lines.length, true);
-				resolveCompletion({
-					status: String(turnData["status"]),
-					...turnData["error"] === null || turnData["error"] === void 0 ? {} : { error: turnData["error"] }
-				});
+				try {
+					mirrorUpTo(lines.length, true);
+				} finally {
+					resolveCompletion({
+						status: String(turnData["status"]),
+						...turnData["error"] === null || turnData["error"] === void 0 ? {} : { error: turnData["error"] }
+					});
+				}
 			}
 		};
 		/** Route one wire notification: round-scoped, turn-id tagged, early ones buffered. */
@@ -1518,15 +1866,19 @@ var CodexLiveDriver = class {
 			liveFlush.dispose();
 			if (turnOpened) {
 				if (mirrored < lines.length) mirrorUpTo(lines.length, true);
+				while (mirrored < lines.length && streams.size > 0) {
+					const oldest = streams.values().next().value;
+					appendStreamSnapshot(oldest, true, settled.stopReason !== "completed", false, true);
+					finishStream(oldest);
+					closeOpenStep();
+					mirrorUpTo(lines.length, true);
+				}
 				if (streams.size > 0) {
 					const remaining = [...streams.values()];
 					for (const [position, stream] of remaining.entries()) {
 						appendStreamSnapshot(stream, true, settled.stopReason !== "completed", position === remaining.length - 1, true);
-						streamPublisher?.finish(stream.step);
-						if (stream.opened) childSession.append("step/end", {
-							turn,
-							step: stream.step
-						});
+						finishStream(stream);
+						closeOpenStep();
 					}
 					streams.clear();
 					activeStream = void 0;
@@ -1577,7 +1929,7 @@ var CodexLiveDriver = class {
 						windowStart: startedAtMs,
 						cwd: spec.cwd
 					});
-					const settledUsage = usage ?? facts.usage;
+					const settledUsage = totalUsage ?? usage ?? facts.usage;
 					const round = {
 						...facts.model === void 0 ? {} : { observedModel: facts.model },
 						...facts.cliVersion === void 0 ? {} : { cliVersion: facts.cliVersion },
@@ -1593,7 +1945,7 @@ var CodexLiveDriver = class {
 		});
 		await Promise.race([accepted, abortBranch.catch(() => void 0)]);
 		return subprocessRunHandle({
-			id: childSession.id,
+			id: SessionId(randomUUID()),
 			result,
 			signal: request.signal,
 			onAbort,
@@ -1608,31 +1960,33 @@ var CodexLiveDriver = class {
 //#endregion
 //#region lib/types/provision.js
 /**
-* Codex scoped-home provisioning: pin file-based credential storage so the
-* device-code login writes `auth.json` inside the scoped home. Codex's
-* `cli_auth_credentials_store` defaults to `auto` — on macOS that resolves
-* to the keychain, which would both leak credentials outside the scoped
-* home and defeat the `auth.json` presence check this package's records
-* adapter uses for authentication. An existing config is respected
-* untouched; sign-out removes the credential file.
+* Codex scoped-home provisioning: a working `config.toml` (a person may edit
+* it — custom providers, model, effort) plus the one-way sweep of the web
+* login's leftover `auth.json`. The harness is endpoint-key only: a stale
+* grant sitting next to an endpoint credential would keep authenticating the
+* built-in provider while the status reads "unauthenticated", so provisioning
+* deletes it on every boot (claude-code's OAuth-remnant sweep, same idea).
 * @module @khorsheed/dsh-local-agent-codex/provision
 */
-/** Credential file inside the scoped home; its presence marks auth. */
-const AUTH_FILE = "auth.json";
-/** Minimal scoped config: keep credentials in the scoped home. */
+/** Minimal scoped config: keep any hand-run login's credentials in the scoped home. */
 const SCOPED_CONFIG = `# Written by dsh-local-agent-codex: keep the device-code
 # credentials inside the scoped home (auth.json) instead of the OS keychain.
 cli_auth_credentials_store = "file"
 `;
+/** The web login's credential file, swept on every boot (endpoint-key only now). */
+const LEGACY_AUTH_FILE = "auth.json";
 /**
-* Provision `<homeDir>/config.toml` unless one already exists. A present
-* config is respected untouched (a person may have edited it); otherwise a
-* minimal config pinning file-based credential storage is written so login
-* lands in the scoped home's `auth.json`.
+* Provision the scoped home: ensure a `config.toml` exists (a minimal one —
+* codex reads it for custom providers, model, and effort; the historical
+* `cli_auth_credentials_store = "file"` pin stays so a hand-run `codex login`
+* under the scoped home can never spill into the macOS keychain), and sweep
+* the web login's leftover `auth.json` (the harness no longer consults it —
+* endpoint key or nothing).
 * @param homeDir - the `codex` harness's scoped home.
 * @returns true when a config was written, false when one already existed.
 */
 async function provisionCodexConfig(homeDir) {
+	await rm(join(homeDir, LEGACY_AUTH_FILE), { force: true });
 	try {
 		await readFile(join(homeDir, "config.toml"));
 		return false;
@@ -1767,47 +2121,6 @@ async function listCodexConfigModels(homeDir) {
 	}
 	return found;
 }
-/**
-* The credential file's modification stamp (epoch ms), undefined when absent.
-* A completed device-code login rewrites `auth.json`, so the stamp
-* distinguishes a fresh login from a leftover (possibly revoked) credential.
-* @param homeDir - the `codex` harness's scoped home.
-* @returns the marker's mtime, or undefined when no credential exists.
-*/
-async function codexCredentialStamp(homeDir) {
-	try {
-		return (await stat(join(homeDir, AUTH_FILE))).mtimeMs;
-	} catch {
-		return;
-	}
-}
-/**
-* Sign out of the scoped account: remove the credential file, so `/<name>
-* status` reports not authenticated and the next login authorizes a fresh
-* account. With `cli_auth_credentials_store = "file"` the credentials live
-* solely in `auth.json`, so removing it is the logout path.
-* @param homeDir - the `codex` harness's scoped home.
-*/
-async function codexLogout(homeDir) {
-	await rm(join(homeDir, AUTH_FILE), { force: true });
-}
-//#endregion
-//#region lib/types/codex-cli-provider.js
-/**
-* One-shot Codex CLI subagent lifecycle: spawn `codex exec "<task>"` through
-* the subprocess seam under the harness's scoped home, capture its printed
-* response as the run output, and dispose to whole-tree quiescence. Mirrors
-* the kimi-cli provider: every accepted run is a fresh process and a fresh
-* codex session; there is no continuation across runs.
-*
-* The provider name `codex-local` avoids colliding with the official
-* `subagent-codex` package's provider name `codex` — a composition that
-* mounts both would fail loud with DUPLICATE_PROVIDER. The tool row in this
-* bundle's patch takes the official model-facing name `subagent_codex`
-* instead: the official preset row ships disabled, and the patch disables
-* it too (a deliberate user re-enable conflicts loud, by design).
-* @module @khorsheed/dsh-local-agent-codex/codex-cli-provider
-*/
 /** Quote one TOML basic string for the `-c` config override. */
 function tomlString(value) {
 	return `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
@@ -1831,7 +2144,7 @@ function registerCodexMemberRun(ctx, childSessionId, parentSessionId) {
 	});
 	const serverName = `dsh-member-${token.slice(0, 8)}`;
 	const bridge = registry.memberBridgeCommand();
-	const configOverride = `mcp_servers.${serverName}={command=${tomlString(bridge.command)},args=[${bridge.args.map(tomlString).join(",")}],env={${MEMBER_BRIDGE_SOCKET_ENV}=${tomlString(registry.memberBridgeSocketPath())},${MEMBER_BRIDGE_TOKEN_ENV}=${tomlString(token)}},default_tools_approval_mode=${tomlString("approve")}}`;
+	const configOverride = `mcp_servers.${serverName}={command=${tomlString(bridge.command)},args=[${bridge.args.map(tomlString).join(",")}],env={${MEMBER_BRIDGE_SOCKET_ENV}=${tomlString(registry.memberBridgeSocketPath())},${MEMBER_BRIDGE_TOKEN_ENV}=${tomlString(token)}},default_tools_approval_mode=${tomlString("approve")},tool_timeout_sec=1800}`;
 	let released = false;
 	return {
 		token,
@@ -1889,6 +2202,7 @@ var CodexCliProvider = class {
 	live;
 	model;
 	overrides;
+	endpoint;
 	name = "codex-local";
 	capabilities = NO_START_CAPABILITIES;
 	inheritsParentContext = false;
@@ -1899,22 +2213,33 @@ var CodexCliProvider = class {
 	*   while a retiring generation still hosts it).
 	* @param model - resolver for the configured model, read PER ROUND so a
 	*   settings-card write takes effect on the next delegation without a
-	*   reload. Undefined (the resolver absent, or returning undefined) leaves
-	*   the argv exactly as it was before the key existed — the scoped
-	*   config.toml's own `model` then decides, as it always did.
+	*   reload; it receives the round's scope (a named scope's curated list
+	*   answers first). Undefined (the resolver absent, or returning
+	*   undefined) leaves the argv exactly as it was before the key existed —
+	*   the scoped config.toml's own `model` then decides, as it always did.
 	* @param overrides - resolver for the member's session-level model override
 	*   (the composer picker, owned by the model broker). It outranks BOTH the
 	*   delegation's recorded model and the configured one: on the exec path it
 	*   re-points the next round's `-m`, and on the live path it is the member's
 	*   start model — a resident runtime bound to a different model is retired
 	*   so the round respawns onto the override.
+	* @param endpoint - resolver for the scope's endpoint credential, read PER
+	*   ROUND so a settings-card write takes effect on the next delegation
+	*   without a reload. A resolution carrying a key routes the round at the
+	*   relay (a custom `model_providers` entry on the argv, the key in the
+	*   env); with no key the spawn carries no credential at all.
 	*/
-	constructor(ctx, sandbox = "workspace-write", live, model, overrides) {
+	constructor(ctx, sandbox = "workspace-write", live, model, overrides, endpoint) {
 		this.ctx = ctx;
 		this.sandbox = sandbox;
 		this.live = live;
 		this.model = model;
 		this.overrides = overrides;
+		this.endpoint = endpoint;
+	}
+	/** The scope's endpoint credential for this round; absent resolver = never. */
+	resolveEndpoint(homeDir) {
+		return this.endpoint === void 0 ? Promise.resolve(void 0) : this.endpoint(homeDir).catch(() => void 0);
 	}
 	/** Resolve the live driver for one round's member, if live is on for it. */
 	liveDriver(childSessionId) {
@@ -1950,7 +2275,7 @@ var CodexCliProvider = class {
 				...record?.configurationLock === void 0 ? {} : { configurationLock: record.configurationLock }
 			}, (configuration) => this.startCodexResume(request, intent, cwd, homeDir, exec, scope, record?.model, configuration), request.signal, intent?.onAdmitted);
 		}
-		const childSessionId = SessionId(intent?.preparedMemberId ?? randomUUID());
+		const childSessionId = SessionId(intent?.preparedMemberId ?? intent?.childSessionId ?? randomUUID());
 		if (typeof this.ctx.localAgent.withMemberConfigurationRound !== "function") {
 			if (intent?.effort !== void 0) throw new Error("Codex effort requires the configuration admission core");
 			return this.startCodexFresh(request, cwd, homeDir, exec, scope, intent?.model, childSessionId);
@@ -1979,16 +2304,19 @@ var CodexCliProvider = class {
 				delegationDepth: (request.parent.session.header.delegationDepth ?? 0) + 1
 			} });
 			const harness = this.ctx.localAgent.get("codex");
-			const label = subagentDelegationLabel(harness?.displayName ?? "codex", request.descriptor.label);
+			const label = subagentDelegationLabel(harness?.displayName ?? "codex", request.label || void 0);
 			childSession.append("subagent/descriptor", {
-				...request.descriptor,
+				version: SUBAGENT_DESCRIPTOR_VERSION,
+				mode: "one-shot",
+				provider: this.name,
 				label
 			});
 			establishSubagentCatalogChild(request.parent.session, childSession.header, label);
 		} catch (error) {
 			this.ctx.logger.warn(`subagent-codex: subagent session record failed: ${error instanceof Error ? error.message : String(error)}`);
 		}
-		const baseUrl = await readCodexBaseUrl(homeDir).catch(() => void 0);
+		const endpoint = await this.resolveEndpoint(homeDir);
+		const baseUrl = hasEndpointCredential(endpoint) ? endpoint.baseUrl : await readCodexBaseUrl(homeDir).catch(() => void 0);
 		this.ctx.logger.info(`subagent-codex: delegating via ${baseUrl ?? "codex default endpoint"}`);
 		const live = exec === void 0 ? this.liveDriver(runId) : void 0;
 		if (live !== void 0 && childSession !== void 0 && !live.disabled) {
@@ -2022,11 +2350,15 @@ var CodexCliProvider = class {
 		try {
 			const run = await startCodexCliRun(request, {
 				cwd,
-				env: delegationEnv({ CODEX_HOME: homeDir }),
+				env: delegationEnv({
+					CODEX_HOME: homeDir,
+					...endpointAuthEnv(endpoint)
+				}),
 				...exec === void 0 ? {} : { exec },
 				endpointLabel: baseUrl,
+				endpointArgv: endpointConfigOverrides(endpoint),
 				sandbox: this.sandbox,
-				...configuration?.resolved ?? resolveRoundModel(this.overrides?.(runId) ?? requestedModel, this.model),
+				...configuration?.resolved ?? resolveRoundModel(this.overrides?.(runId) ?? requestedModel, () => this.model?.(scope)),
 				disposeGraceMs: DEFAULT_DISPOSE_GRACE_MS,
 				spawn: (spec) => this.ctx.subprocess.spawn(spec),
 				onError: (error, stopReason) => {
@@ -2072,7 +2404,8 @@ var CodexCliProvider = class {
 			const childSession = this.ctx.get("sessions")?.get(SessionId(intent.childSessionId));
 			if (childSession === void 0) throw new Error(`subagent-codex: resume target child session ${intent.childSessionId} is not live — start a fresh delegation instead`);
 			const nextTurn = childSession.snapshotEvents().filter((event) => event.type === "turn/start").length + 1;
-			const baseUrl = await readCodexBaseUrl(homeDir).catch(() => void 0);
+			const endpoint = await this.resolveEndpoint(homeDir);
+			const baseUrl = hasEndpointCredential(endpoint) ? endpoint.baseUrl : await readCodexBaseUrl(homeDir).catch(() => void 0);
 			this.ctx.logger.info(`subagent-codex: resuming via ${baseUrl ?? "codex default endpoint"}`);
 			const live = exec === void 0 ? this.liveDriver(intent.childSessionId) : void 0;
 			if (live !== void 0 && !live.disabled) {
@@ -2106,11 +2439,15 @@ var CodexCliProvider = class {
 			try {
 				run = await startCodexCliRun(request, {
 					cwd,
-					env: delegationEnv({ CODEX_HOME: homeDir }),
+					env: delegationEnv({
+						CODEX_HOME: homeDir,
+						...endpointAuthEnv(endpoint)
+					}),
 					...exec === void 0 ? {} : { exec },
 					endpointLabel: baseUrl,
+					endpointArgv: endpointConfigOverrides(endpoint),
 					sandbox: this.sandbox,
-					...configuration?.resolved ?? resolveRoundModel(this.overrides?.(intent.childSessionId) ?? requestedModel, this.model),
+					...configuration?.resolved ?? resolveRoundModel(this.overrides?.(intent.childSessionId) ?? requestedModel, () => this.model?.(scope)),
 					disposeGraceMs: DEFAULT_DISPOSE_GRACE_MS,
 					spawn: (spec) => this.ctx.subprocess.spawn(spec),
 					onError: (error, stopReason) => {
@@ -2278,6 +2615,23 @@ function foldCodexStreamLine(state, raw) {
 				result: last.result === void 0 ? output : `${last.result}\n${output}`
 			};
 		}
+	} else if (item.type === "custom_tool_call") {
+		countToolCall(state, "custom_tool_call");
+		state.lines.push({
+			kind: "tool",
+			id: typeof item.id === "string" ? item.id : `codex-tool-${state.lines.length}`,
+			name: item.name ?? "custom",
+			...typeof item.input === "string" && item.input !== "" ? { args: item.input } : {}
+		});
+	} else if (item.type === "custom_tool_call_output") {
+		const output = typeof item.output === "string" ? item.output : Array.isArray(item.output) ? item.output.filter((block) => typeof block === "object" && block !== null && typeof block.text === "string").map((block) => block.text).join("\n") : void 0;
+		if (output !== void 0 && output.trim() !== "") {
+			const last = state.lines[state.lines.length - 1];
+			if (last !== void 0 && last.kind === "tool") state.lines[state.lines.length - 1] = {
+				...last,
+				result: last.result === void 0 ? output : `${last.result}\n${output}`
+			};
+		}
 	}
 }
 /**
@@ -2312,7 +2666,8 @@ var CodexStreamParser = class {
 * not put one on the wire; the settle path then reads the rollout's
 * turn_context). Item types covered: `reasoning` (thinking), `agent_message`
 * (reply text), `command_execution` (shell command with aggregated output),
-* `web_search_call`, and `function_call_output`. The last `agent_message`
+* `web_search_call`, `custom_tool_call`/`custom_tool_call_output` (deferred
+* and dynamic tools), and `function_call_output`. The last `agent_message`
 * wins as the run output (the final answer), and `turn.completed` carries the
 * turn's usage. Malformed lines are skipped.
 * @param stream - the collected stdout NDJSON text.
@@ -2357,11 +2712,13 @@ function startCodexCliRun(request, spec) {
 	if (request.signal.aborted) throw new Error("subagent-codex: request was aborted before the CLI started");
 	const turn = spec.resume?.turn ?? 1;
 	const memberArgv = spec.member === void 0 ? [] : ["-c", spec.member.configOverride];
+	const endpointArgv = spec.endpointArgv ?? [];
 	const modelArgv = [...spec.model === void 0 ? [] : ["-m", spec.model], ...spec.effort === void 0 ? [] : ["-c", `model_reasoning_effort=${JSON.stringify(spec.effort)}`]];
 	const argv = spec.resume === void 0 ? [
 		"codex",
 		"exec",
 		...memberArgv,
+		...endpointArgv,
 		...modelArgv,
 		"--sandbox",
 		spec.sandbox,
@@ -2372,6 +2729,7 @@ function startCodexCliRun(request, spec) {
 		"codex",
 		"exec",
 		...memberArgv,
+		...endpointArgv,
 		...modelArgv,
 		"--sandbox",
 		spec.sandbox,
@@ -2401,6 +2759,11 @@ function startCodexCliRun(request, spec) {
 	});
 	const startedAtMs = Date.now();
 	spec.childSession?.append("turn/start", { turn });
+	if (spec.model !== void 0 && spec.childSession !== void 0) appendCodexRequestHeader(spec.childSession, {
+		provider: "codex-local",
+		model: spec.model,
+		...spec.effort === void 0 ? {} : { reasoningEffort: spec.effort }
+	});
 	const liveMirror = spec.childSession !== void 0 && spec.ctx !== void 0 ? createCodexLiveMirror(spec, task, turn) : void 0;
 	let output = "";
 	child.stdout?.on("data", (chunk) => {
@@ -2488,7 +2851,16 @@ function startCodexCliRun(request, spec) {
 		onAbort
 	}).then((settled) => {
 		if (settled.stopReason === "completed") spec.onAuthSuccess?.();
+		return settled;
+	});
+	result.then(() => child.done).then(async () => {
+		if (spec.onAuthFailure !== void 0) {
+			const authDetail = `${child.collected.stderr?.readFrom(0).text || stderr}\n${child.collected.stdout?.readFrom(0).text || output}`;
+			if (CODEX_AUTH_FAILURE.test(authDetail)) spec.onAuthFailure(authDetail.split("\n").find((line) => line.trim() !== "") ?? "auth failure");
+		}
+		await mirrorCodexAfterExit(spec, task, turn, output, liveMirror, startedAtMs);
 		if (spec.childSession !== void 0) {
+			const settled = await result;
 			if (settled.stopReason === "completed") spec.childSession.append("turn/end", {
 				turn,
 				reason: { kind: "completed" }
@@ -2510,18 +2882,13 @@ function startCodexCliRun(request, spec) {
 					}
 				}
 			});
+			if (spec.ctx !== void 0) await persistChildSession(spec.ctx, spec.childSession).catch((error) => {
+				spec.ctx?.logger.warn(`subagent-codex: turn/end persistence failed: ${thrown(error).message}`);
+			});
 		}
-		return settled;
-	});
-	result.then(() => child.done).then(() => {
-		if (spec.onAuthFailure !== void 0) {
-			const authDetail = `${child.collected.stderr?.readFrom(0).text || stderr}\n${child.collected.stdout?.readFrom(0).text || output}`;
-			if (CODEX_AUTH_FAILURE.test(authDetail)) spec.onAuthFailure(authDetail.split("\n").find((line) => line.trim() !== "") ?? "auth failure");
-		}
-		return mirrorCodexAfterExit(spec, task, turn, output, liveMirror, startedAtMs);
 	}, () => {});
 	return Promise.resolve(subprocessRunHandle({
-		id: spec.childSession?.id ?? SessionId(randomUUID()),
+		id: SessionId(randomUUID()),
 		result,
 		signal: request.signal,
 		onAbort,
@@ -2529,6 +2896,22 @@ function startCodexCliRun(request, spec) {
 		teardown: disposeProcess
 	}));
 }
+/**
+* Write the round's request/header when the config differs from the child
+* log's last one (the host logs changed snapshots, not per-call duplicates):
+* the first write is `initial`, a differing one `change`, an identical one
+* skipped. Context Lens reads the child log's config from these headers.
+*/
+function appendCodexRequestHeader(childSession, config) {
+	const serialized = JSON.stringify(config);
+	let last;
+	for (const event of childSession.snapshotEvents()) if (event.type === "request/header") last = JSON.stringify(event.data.header?.config);
+	if (last === serialized) return;
+	childSession.append("request/header", {
+		header: { config },
+		reason: last === void 0 ? "initial" : "change"
+	});
+}
 /** One assistant-role message event, attributed to the codex route. */
 function codexAssistantEvent(blocks) {
 	return createAssistantMessage({
@@ -2545,8 +2928,17 @@ function codexAssistantEvent(blocks) {
 * assembler requires: without a boundary the step never enters the location
 * index, the line's assistant message resolves to a turn-level location, and
 * the real-time view renders nothing (only a full rebuild, which mints step
-* drafts from the explicit coordinates, recovers it). Tool cards escape that
-* fate only because their definition does not consult the step location.
+* drafts from the explicit coordinates, recovers it).
+*
+* A tool line folds the NATIVE lifecycle inside its one step: an assistant
+* message advertising the tool-call block, the `tool/call`, then its
+* `tool/result` — the released-log reader pairs call and result against the
+* advertisement and resolves every advertised call before the step closes.
+* Every fold sees a COMPLETED item (the exec live mirror holds the volatile
+* last line; the live driver folds at item/completed), so a result the
+* stream has not recorded by fold time will never arrive — the call folds
+* with the synthesized interrupted result instead of leaving the step
+* unresolvable.
 * @returns whether the line folded (false when the options skipped it).
 */
 function appendCodexTranscriptLine(childSession, turn, step, line, usage) {
@@ -2555,23 +2947,36 @@ function appendCodexTranscriptLine(childSession, turn, step, line, usage) {
 		step
 	});
 	if (line.kind === "tool") {
+		const args = line.args ?? "";
+		childSession.append("assistant/message", {
+			turn,
+			step,
+			message: codexAssistantEvent([{
+				type: "tool-call",
+				id: line.id,
+				name: line.name,
+				arguments: args
+			}]),
+			stream: [],
+			...usage === void 0 ? {} : { usage }
+		}, { surfaceOp: "append" });
 		const call = childSession.append("tool/call", {
 			turn,
 			step,
 			callId: line.id,
 			name: line.name,
-			arguments: line.args ?? ""
+			arguments: args
 		});
-		if (line.result !== void 0) childSession.append("tool/result", {
+		childSession.append("tool/result", {
 			turn,
 			step,
 			message: createToolResultMessage({
 				callId: line.id,
 				content: [{
 					type: "text",
-					text: line.result
+					text: line.result ?? "（工具调用被中断，未能记录返回结果）"
 				}],
-				isError: false
+				isError: line.result === void 0
 			})
 		}, {
 			surfaceOp: "append",
@@ -2881,7 +3286,8 @@ var LiveDriverSwitch = class {
 		this.active = next.live ? new CodexLiveDriver(this.ctx, {
 			...this.options.sandbox === void 0 ? {} : { sandbox: this.options.sandbox },
 			...this.options.liveIdleMs === void 0 ? {} : { liveIdleMs: this.options.liveIdleMs },
-			...this.options.model === void 0 ? {} : { model: this.options.model }
+			...this.options.model === void 0 ? {} : { model: this.options.model },
+			...this.options.endpoint === void 0 ? {} : { endpoint: this.options.endpoint }
 		}) : void 0;
 		if (retiring !== void 0) {
 			this.draining.add(retiring);
@@ -2941,6 +3347,47 @@ function dedupeChoices(layers) {
 	}
 	return choices;
 }
+/**
+* Scope the served directory to the surface asking for it (the same helper
+* lives in each provider's broker — fold into the family core when the
+* directory faces next evolve):
+*
+* - memberless (the card's add-model dialog, the invite picker): the
+*   endpoint's served catalog only — the configuration/history extras the
+*   broker's info extension adds for STATUS display must never become add
+*   candidates;
+* - a member whose harness has a curated list: the list IS the vocabulary,
+*   in the list's own order (the same rule `choices` already follows) — a
+*   curated value the endpoint no longer serves stays as a bare row (the
+*   card shows it the same way), and the member's current effective model is
+*   kept visible as a bare entry when it sits outside the list, so a pre-list
+*   binding never renders blank;
+* - a member without a curated list: the legacy extended vocabulary.
+*/
+function scopeServedDirectory(directory, opts) {
+	if (opts.member && opts.curated.length === 0) return directory;
+	const served = directory.entries.filter((entry) => entry.source === "native");
+	if (!opts.member) return {
+		...directory,
+		entries: served
+	};
+	const byValue = new Map(served.flatMap((entry) => entry.resolvedModel === void 0 ? [[entry.value, entry]] : [[entry.value, entry], [entry.resolvedModel, entry]]));
+	const entries = opts.curated.map((value) => byValue.get(value) ?? {
+		value,
+		label: value,
+		source: "configuration"
+	});
+	const current = opts.current?.trim();
+	if (current !== void 0 && current !== "" && !entries.some((entry) => entry.value === current || entry.resolvedModel === current)) entries.push({
+		value: current,
+		label: current,
+		source: "configuration"
+	});
+	return {
+		...directory,
+		entries
+	};
+}
 var CodexModelBroker = class {
 	deps;
 	constructor(deps) {
@@ -2954,7 +3401,7 @@ var CodexModelBroker = class {
 				await this.deps.refreshDirectory?.(home, binding.cwd);
 				directory = this.deps.directory?.(home, binding.cwd);
 			}
-			const model = selection.model.mode === "value" ? selection.model.value : (selection.model.mode === "inherit" ? binding.model : void 0) ?? this.deps.settingsModel() ?? await readCodexModel(home) ?? this.deps.catalogDefault(home, binding.cwd);
+			const model = selection.model.mode === "value" ? selection.model.value : (selection.model.mode === "inherit" ? binding.model : void 0) ?? this.deps.settingsModel(home) ?? await readCodexModel(home) ?? this.deps.catalogDefault(home, binding.cwd);
 			const entry = directory?.entries.find((entry) => entry.value === model);
 			const explicitEffort = selection.effort.mode === "value" ? selection.effort.value : selection.effort.mode === "inherit" ? binding.effort : void 0;
 			const effort = explicitEffort ?? await readCodexReasoningEffort(home) ?? entry?.reasoning?.default;
@@ -2992,14 +3439,19 @@ var CodexModelBroker = class {
 	async modelDirectory(childSessionId, refresh = false) {
 		const home = this.deps.homeDir(childSessionId);
 		if (refresh) await this.deps.refreshDirectory?.(home, this.deps.cwd?.(childSessionId));
-		return (await this.modelInfo(childSessionId, childSessionId === void 0 ? void 0 : this.deps.ctx.localAgent.getDelegation(childSessionId)?.model)).directory ?? {
+		const info = await this.modelInfo(childSessionId, childSessionId === void 0 ? void 0 : this.deps.ctx.localAgent.getDelegation(childSessionId)?.model);
+		return scopeServedDirectory(info.directory ?? {
 			entries: [],
 			complete: false,
 			customInput: true,
 			status: "unsupported",
 			refreshing: false,
 			revision: 0
-		};
+		}, {
+			member: childSessionId !== void 0,
+			curated: this.deps.modelList?.(home) ?? [],
+			current: info.effective
+		});
 	}
 	async *followModelDirectory(childSessionId, signal) {
 		if (this.deps.followDirectory === void 0) {
@@ -3019,7 +3471,7 @@ var CodexModelBroker = class {
 		if (override !== void 0) return override;
 		const recorded = this.deps.ctx.localAgent.getDelegation(childSessionId)?.model?.trim();
 		if (recorded !== void 0 && recorded !== "") return recorded;
-		return this.deps.settingsModel();
+		return this.deps.settingsModel(this.deps.homeDir(childSessionId));
 	}
 	/**
 	* Read the model surface. The cliDefault and the discovered identifiers come
@@ -3030,8 +3482,8 @@ var CodexModelBroker = class {
 	* re-fetches on open, so it never blocks on a CLI boot).
 	*/
 	async modelInfo(childSessionId, delegationModel) {
-		const settings = this.deps.settingsModel();
 		const homeDir = this.deps.homeDir(childSessionId);
+		const settings = this.deps.settingsModel(homeDir);
 		const [cliDefault, discovered] = await Promise.all([readCodexModel(homeDir).catch(() => void 0), listCodexConfigModels(homeDir).catch(() => [])]);
 		const override = childSessionId === void 0 ? void 0 : this.deps.overrides.get(childSessionId);
 		const delegation = delegationModel?.trim() === "" ? void 0 : delegationModel;
@@ -3039,6 +3491,7 @@ var CodexModelBroker = class {
 		const effective = override ?? delegation ?? settings ?? cliDefault ?? (catalogDefaultRaw === void 0 || catalogDefaultRaw === "" ? void 0 : catalogDefaultRaw);
 		const source = override !== void 0 ? "override" : delegation !== void 0 ? "delegation" : settings !== void 0 ? "settings" : cliDefault !== void 0 ? "cli-config" : "cli-builtin";
 		const inFlight = childSessionId !== void 0 && this.activeDelegations().includes(childSessionId);
+		const curated = this.deps.modelList?.(homeDir) ?? [];
 		return {
 			...effective === void 0 ? {} : { effective },
 			source,
@@ -3050,8 +3503,8 @@ var CodexModelBroker = class {
 				settings,
 				cliDefault,
 				...discovered
-			], this.deps.recentModels()) },
-			choices: dedupeChoices([
+			], curated.length > 0 ? [] : this.deps.recentModels()) },
+			choices: curated.length > 0 ? [...curated] : dedupeChoices([
 				settings,
 				cliDefault,
 				...discovered,
@@ -3083,6 +3536,16 @@ var CodexModelBroker = class {
 };
 /** Grace between stdin EOF and terminate when the probe tears the process down. */
 const PROBE_EOF_GRACE_MS = 1e3;
+/** One directory answer that names why it is empty. */
+function unsupported(reason) {
+	return {
+		entries: [],
+		complete: false,
+		customInput: true,
+		unsupported: true,
+		reason
+	};
+}
 /** Preserve native metadata, including hidden candidates; reject malformed pages. */
 function catalogEntries(result) {
 	const page = result;
@@ -3138,7 +3601,7 @@ var CodexModelCatalog = class {
 		this.cache = new ModelDirectoryCache({
 			load: (key, signal) => {
 				const context = JSON.parse(key);
-				return this.probe(context.homeDir, context.cwd, signal);
+				return this.load(context.homeDir, context.cwd, signal);
 			},
 			ttlMs: deps.ttlMs ?? 3e5,
 			...deps.now === void 0 ? {} : { now: deps.now },
@@ -3146,7 +3609,11 @@ var CodexModelCatalog = class {
 		});
 	}
 	key(homeDir, cwd = homeDir) {
-		const files = [join(homeDir, "config.toml"), join(homeDir, "auth.json")];
+		const files = [
+			join(homeDir, "config.toml"),
+			join(homeDir, "auth.json"),
+			join(homeDir, ENDPOINT_AUTH_FILE)
+		];
 		for (let directory = cwd;; directory = dirname(directory)) {
 			files.push(join(directory, ".codex", "config.toml"));
 			if (dirname(directory) === directory) break;
@@ -3181,16 +3648,69 @@ var CodexModelCatalog = class {
 		return (await this.cache.refresh(this.key(homeDir, cwd))).entries.filter((entry) => !entry.hidden).map((entry) => entry.value);
 	}
 	/**
-	* One bounded probe: spawn the app-server against the scoped home, answer
-	* the initialize handshake exactly as the live driver shapes it, ask
-	* `model/list`, then tear the process down (stdin EOF → grace →
-	* terminate). The overall timeout kills the process on expiry. Failures propagate to the shared cache, which preserves prior data.
+	* One directory load: the endpoint's served id list is the vocabulary (the
+	* card's add dialog can only offer what the endpoint answers), folded
+	* CONCURRENTLY with the native app-server probe's metadata. The endpoint
+	* answers are deliberate:
+	*
+	* - no credential resolved → empty with a "save a key first" reason;
+	* - 401/403 → empty with the rejection (definitive — cached as data);
+	* - another HTTP status → empty with it (the relay serves no model route);
+	* - a transport failure THROWS, so the cache keeps the last good list and
+	*   retries on schedule instead of blanking a momentarily-down endpoint
+	*   (the openproxy relay once 500'd and recovered — 2026-10-22).
+	*
+	* The native probe's failure never fails the load: endpoint data alone is
+	* complete (it warns once via the deps sink). The endpoint fetch gets a
+	* 20s ceiling by default (mirrors claude's catalog timeout); the native
+	* probe keeps its own tighter bound internally.
 	*/
-	async probe(homeDir, cwd, signal) {
+	async load(homeDir, cwd, signal) {
+		const endpoint = this.deps.endpoint === void 0 ? void 0 : await this.deps.endpoint(homeDir).catch(() => void 0);
+		if (!hasEndpointCredential(endpoint)) return unsupported("No endpoint credential configured — the model list loads from the endpoint once an API Key is saved");
+		const combined = AbortSignal.any([signal, AbortSignal.timeout(this.deps.timeoutMs ?? 2e4)]);
+		const [result, native] = await Promise.all([fetchEndpointModels({
+			...endpoint,
+			baseUrl: endpoint.baseUrl ?? "https://api.openai.com"
+		}, this.deps.fetchImpl, combined), this.probeNative(homeDir, cwd, combined).catch((error) => {
+			this.deps.warn?.(`local-agent-codex: the native model/list probe failed (metadata only — the endpoint's list stands): ${error instanceof Error ? error.message : String(error)}`);
+		})]);
+		if (result.kind === "unreachable") throw new Error(`endpoint unreachable: ${result.message}`);
+		if (result.kind === "malformed") return unsupported("The endpoint answered but the model list did not parse (not /v1/models-shaped)");
+		if (result.kind === "http") {
+			if (result.status === 401 || result.status === 403) return unsupported(`The endpoint rejected the credential (HTTP ${String(result.status)}) — the list loads once a valid key is saved`);
+			return unsupported(`The endpoint does not serve a model list (HTTP ${String(result.status)})`);
+		}
+		if (result.models.length === 0) return unsupported("The endpoint serves no models");
+		const nativeByValue = new Map((native?.entries ?? []).map((entry) => [entry.value, entry]));
+		const entries = result.models.map((id) => nativeByValue.get(id) ?? {
+			value: id,
+			label: id,
+			source: "native"
+		});
+		const defaultModel = native?.defaultModel;
+		return {
+			entries,
+			complete: true,
+			customInput: true,
+			...defaultModel === void 0 ? {} : { defaultModel }
+		};
+	}
+	/**
+	* One bounded NATIVE probe — the metadata-enrichment side of {@link load}:
+	* spawn the app-server against the scoped home, answer the initialize
+	* handshake exactly as the live driver shapes it, ask `model/list`, then
+	* tear the process down (stdin EOF → grace → terminate). The overall
+	* timeout kills the process on expiry. Failures propagate to the caller
+	* (load demotes them to a warn).
+	*/
+	async probeNative(homeDir, cwd, signal) {
+		const endpoint = this.deps.endpoint === void 0 ? void 0 : await this.deps.endpoint(homeDir).catch(() => void 0);
 		const spec = {
 			argv: [
 				"codex",
 				"app-server",
+				...endpointConfigOverrides(endpoint),
 				"--stdio"
 			],
 			cwd,
@@ -3200,7 +3720,10 @@ var CodexModelCatalog = class {
 				stderr: "pipe"
 			},
 			graceMs: DEFAULT_DISPOSE_GRACE_MS,
-			env: delegationEnv({ CODEX_HOME: homeDir })
+			env: delegationEnv({
+				CODEX_HOME: homeDir,
+				...endpointAuthEnv(endpoint)
+			})
 		};
 		const child = this.deps.spawn(spec);
 		const decoder = new StringDecoder("utf8");
@@ -3337,8 +3860,8 @@ var CodexModelCatalog = class {
 /**
 * Codex harness instantiation of the local-agent family. Registers the
 * `codex` harness into the core registry: scoped home under the shared homes
-* root (`CODEX_HOME`), device-code login through `codex login --device-auth`
-* (prompt captured from stdout), and rollout-file session records.
+* root (`CODEX_HOME`), endpoint-key authentication (endpoint-auth.ts — no web
+* login anywhere), and rollout-file session records.
 * Delegation mounts through the `codex-local` provider (one-shot
 * `codex exec` under the scoped home); the bundle patch's
 * `tool-subagent-codex-local` row puts the tool on the profile root, so
@@ -3350,7 +3873,8 @@ var CodexModelCatalog = class {
 const name = "local-agent-codex";
 /**
 * Boot delay before the model catalog's eager warmup probe fires. The probe
-* spawns a `codex app-server` — cheap, but not free — so it waits out the
+* fetches the endpoint's served model list AND spawns a `codex app-server`
+* (the native metadata side) — cheap, but not free — so it waits out the
 * boot storm instead of competing with it, and the FIRST settings-card open
 * usually hits a warm cache. A card opened before the timer fires simply
 * triggers the probe itself (the read path's lazy kick), so the delay never
@@ -3393,6 +3917,8 @@ const Config = z.object({
 		z.const("workspace-write"),
 		z.const("danger-full-access")
 	]),
+	baseUrl: z.string(),
+	apiKey: z.string(),
 	model: volatilize(SETTINGS_FIELDS.model),
 	live: volatilize(SETTINGS_FIELDS.live),
 	liveIdleMs: z.number().default(DEFAULT_LIVE_IDLE_MS),
@@ -3449,14 +3975,22 @@ function apply(ctx, config) {
 			legacyBase,
 			read: readSettings
 		});
-		const resolveModel = () => {
+		const resolveModelKey = () => {
 			const model = face.get().model?.trim();
 			return model === void 0 || model === "" ? void 0 : model;
 		};
+		const resolveModelFor = (homeDir) => firstModelOf(readModelListSync(homeDir)) ?? resolveModelKey();
+		const resolveModel = (scope) => resolveModelFor(ctx.localAgent.homeDir("codex", scope));
 		const memberModelOverrides = /* @__PURE__ */ new Map();
+		const endpointConfig = {
+			...config.baseUrl === void 0 ? {} : { baseUrl: config.baseUrl },
+			...config.apiKey === void 0 ? {} : { apiKey: config.apiKey }
+		};
+		const resolveEndpoint = (scopeHome) => resolveEndpointAuth(scopeHome, endpointConfig);
 		const modelCatalog = new CodexModelCatalog({
 			spawn: (spec) => ctx.subprocess.spawn(spec),
-			warn: (message) => ctx.logger.warn(message)
+			warn: (message) => ctx.logger.warn(message),
+			endpoint: resolveEndpoint
 		});
 		const warmup = setTimeout(() => {
 			modelCatalog.read(homeDir);
@@ -3464,12 +3998,14 @@ function apply(ctx, config) {
 		warmup.unref();
 		const liveSwitch = new LiveDriverSwitch(ctx, face, {
 			sandbox,
-			model: (childSessionId) => memberModelOverrides.get(childSessionId) ?? resolveModel(),
+			model: (childSessionId) => memberModelOverrides.get(childSessionId) ?? resolveModel((ctx.localAgent.memberBinding?.(childSessionId) ?? ctx.localAgent.getDelegation(childSessionId))?.scope),
+			endpoint: resolveEndpoint,
 			...config.liveIdleMs === void 0 ? {} : { liveIdleMs: config.liveIdleMs }
 		});
 		const modelBroker = new CodexModelBroker({
 			ctx,
-			settingsModel: resolveModel,
+			settingsModel: resolveModelFor,
+			modelList: (homeDir) => readModelListSync(homeDir),
 			recentModels: () => face.get().recentModels ?? [],
 			homeDir: (childSessionId) => ctx.localAgent.homeDir("codex", childSessionId === void 0 ? void 0 : (ctx.localAgent.memberBinding?.(childSessionId) ?? ctx.localAgent.getDelegation(childSessionId))?.scope),
 			cwd: (childSessionId) => childSessionId === void 0 ? void 0 : (ctx.localAgent.memberBinding?.(childSessionId) ?? ctx.localAgent.getDelegation(childSessionId))?.cwd,
@@ -3483,7 +4019,7 @@ function apply(ctx, config) {
 			catalog: (scopedHome, cwd) => modelCatalog.read(scopedHome, cwd),
 			catalogDefault: (scopedHome, cwd) => modelCatalog.readDefault(scopedHome, cwd)
 		});
-		const disposeProvider = ctx.subagents.registerProvider(new CodexCliProvider(ctx, sandbox, liveSwitch.resolve, resolveModel, (childSessionId) => memberModelOverrides.get(childSessionId)));
+		const disposeProvider = ctx.subagents.registerProvider(new CodexCliProvider(ctx, sandbox, liveSwitch.resolve, resolveModel, (childSessionId) => memberModelOverrides.get(childSessionId), resolveEndpoint));
 		const disposeHarness = ctx.localAgent.register({
 			prepareMember: async ({ binding, childSession, configuration, signal }) => {
 				const driver = liveSwitch.resolve(binding.childSessionId);
@@ -3501,23 +4037,53 @@ function apply(ctx, config) {
 			homeEnvVar: "CODEX_HOME",
 			delegationProvider: "codex-local",
 			modelBroker,
-			login: { pty: {
-				command: "codex",
-				args: ["login"]
-			} },
+			modelList: {
+				read: (home) => readModelList(home),
+				write: (home, models) => writeModelList(home, models)
+			},
 			records: { listSessions: (homeDir) => listCodexSessions(homeDir) },
 			provision: (scopedHome) => provisionCodexConfig(scopedHome).then(() => {}),
-			isAuthenticated: codexAuthenticated,
-			credentialStamp: codexCredentialStamp,
-			logout: codexLogout,
+			isAuthenticated: async (home) => hasEndpointCredential(await resolveEndpoint(home)),
+			checkEndpoint: (home) => resolveEndpoint(home).then((endpoint) => checkCodexEndpoint(endpoint)),
+			endpointAuth: {
+				read: async (home) => {
+					const endpoint = await resolveEndpoint(home);
+					return {
+						...endpoint.baseUrl === void 0 ? {} : { baseUrl: endpoint.baseUrl },
+						apiKeySet: endpoint.apiKey !== void 0,
+						authTokenSet: false
+					};
+				},
+				write: async (home, fields) => {
+					const next = { ...await readEndpointAuthFile(home) ?? {} };
+					for (const [field, value] of Object.entries(fields)) {
+						if (field !== "baseUrl" && field !== "apiKey") continue;
+						if (value === void 0) continue;
+						const trimmed = typeof value === "string" ? value.trim() : "";
+						if (value === null || trimmed === "") delete next[field];
+						else next[field] = trimmed;
+					}
+					if (Object.keys(next).length === 0) await clearEndpointAuth(home);
+					else await writeEndpointAuth(home, next);
+				}
+			},
+			credentialStamp: endpointAuthStamp,
+			logout: async (home) => {
+				if (await endpointAuthFileExists(home)) {
+					await clearEndpointAuth(home);
+					return;
+				}
+				throw new Error("codex has no scoped endpoint-auth.json to clear — the credential comes from the settings card or the profile row (baseUrl/apiKey); clear it there instead");
+			},
 			effectiveSettings: async (scopedHome) => {
-				const [reasoningEffort, baseUrl, scopedModel, cliVersion] = await Promise.all([
+				const [reasoningEffort, endpoint, scopedModel, cliVersion] = await Promise.all([
 					readCodexReasoningEffort(scopedHome).catch(() => void 0),
-					readCodexBaseUrl(scopedHome).catch(() => void 0),
+					resolveEndpoint(scopedHome).catch(() => void 0),
 					readCodexModel(scopedHome).catch(() => void 0),
 					codexCliVersion(ctx, scopedHome).catch(() => void 0)
 				]);
-				const model = resolveModel() ?? scopedModel;
+				const baseUrl = hasEndpointCredential(endpoint) ? endpoint.baseUrl : await readCodexBaseUrl(scopedHome).catch(() => void 0);
+				const model = resolveModelFor(scopedHome) ?? scopedModel;
 				const baseUrlHost = baseUrl !== void 0 ? endpointHost(baseUrl) : void 0;
 				return {
 					drive: face.get().live ? "live" : "exec",