@lyupro/codex-bridge 0.5.3 → 0.5.4

package/src/home/lib/runner/launcher.mjs

@@ -2,15 +2,9 @@
  * The half the caller can kill: every preparation and every refusal that costs no quota,
  * then the spawn of the worker and the immediate return; a repeated call waits for the reply.
  *
- * The order it leaves for the worker is worker.json in the run folder — after the split
- * that file is the only connection between the two halves. It is written here with
- * `agent`, `slug`, `order_id`, `repo`, `is_git_repo`, `launcher_pid`, `budget_minutes`, `scope_new`
- * and `args`;
- * worker.mjs reads `repo`, `agent`, `args`, `is_git_repo` and `budget_minutes`. The extra fields
- * are deliberate: `slug`, `order_id`, `launcher_pid` and `scope_new` are what a run folder read
- * back months later needs in order to explain itself — which order it belonged to and which new
- * paths it declared included. Nothing may be dropped from this shape without changing worker.mjs
- * and saying so out loud.
+ * The order it leaves for the worker is worker.json in the run folder — after the split that file
+ * is the only connection between the two halves. Its shape and the reason for every field live in
+ * worker-order.mjs, which writes it.
  */
 import fs from 'node:fs';
 import path from 'node:path';
@@ -37,7 +31,9 @@ import { continuationRefusal } from './continuation.mjs';
 import { SCHEMAS } from './schemas.mjs';
 import { INSTRUCTIONS } from './prompts.mjs';
 import { git, headSha, branchName, worktreeSnapshot, reviewScope } from './git-state.mjs';
-import { codexArgs, requireCodex, runMode, unsafeForCmd } from './codex-cmd.mjs';
+import { codexArgs, runMode, runProfile } from './codex-args.mjs';
+import { writeWorkerOrder } from './worker-order.mjs';
+import { requireCodex, unsafeForCmd } from './codex-cmd.mjs';
 import { runsRoot } from './runs-root.mjs';
 import { resolveProjectRunsDir } from './project-dir.mjs';
 import { cleanupRetention } from '../retention.mjs';
@@ -344,26 +340,18 @@ export async function launcher(argv = process.argv.slice(2)) {
     console.log(reply);
     return 1;
   }
-  fs.writeFileSync(
-    path.join(runDir, 'worker.json'),
-    `${JSON.stringify(
-      {
-        agent: opts.agent,
-        slug: opts.slug,
-        order_id: opts.orderId,
-        repo: repoRoot,
-        is_git_repo: isGitRepo,
-        launcher_pid: process.pid,
-        // The mode's wall-clock budget, resolved here and never re-read by the worker: a run
-        // that consulted config.json twice could end up honouring two different limits.
-        budget_minutes: RUN_ENV?.budgets?.[runMode(opts.agent)],
-        scope_new: opts.scopeNewPatterns,
-        args: codexArgv,
-      },
-      null,
-      2,
-    )}\n`,
-  );
+  writeWorkerOrder(runDir, {
+    agent: opts.agent,
+    slug: opts.slug,
+    orderId: opts.orderId,
+    repo: repoRoot,
+    isGitRepo,
+    launcherPid: process.pid,
+    budgetMinutes: RUN_ENV?.budgets?.[runMode(opts.agent)],
+    scopeNew: opts.scopeNewPatterns,
+    profile: runProfile({ ...opts, repo: repoRoot }),
+    args: codexArgv,
+  });
 
   // detached + unref + no stdio: the worker leaves the caller's process group, so a Ctrl+C
   // or a timeout kill aimed at the dispatcher's shell does not reach it, and it holds no

package/src/home/lib/runner/worker-order.mjs

@@ -0,0 +1,56 @@
+/**
+ * The order the launcher leaves for the worker: worker.json in the run folder.
+ *
+ * After the launcher/worker split this file is the only connection between the two halves, and the
+ * worker never re-reads the CLI or the configuration — a run that consulted config.json twice could
+ * end up honouring two different limits. It carries `agent`, `slug`, `order_id`, `repo`,
+ * `is_git_repo`, `launcher_pid`, `budget_minutes`, `scope_new`, `profile` and `args`; worker.mjs
+ * reads `repo`, `agent`, `args`, `is_git_repo` and `budget_minutes`. The rest is deliberate: those
+ * fields are what a run folder read back months later needs in order to explain itself — which
+ * order it belonged to, which new paths it declared included, and which worker was actually
+ * ordered. Nothing may be dropped from this shape without changing worker.mjs and saying so out
+ * loud; `docs/worker-contract.md` is the document that says it.
+ *
+ * It lives beside launcher.mjs rather than inside it because writing this contract is its own job,
+ * and the launcher had grown past the size limit while the contract was buried in the middle of it.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+
+export function workerOrder({
+  agent,
+  slug,
+  orderId,
+  repo,
+  isGitRepo,
+  launcherPid,
+  budgetMinutes,
+  scopeNew,
+  profile,
+  args,
+}) {
+  return {
+    agent,
+    slug,
+    order_id: orderId,
+    repo,
+    is_git_repo: isGitRepo,
+    launcher_pid: launcherPid,
+    // The mode's wall-clock budget, resolved by the launcher and never re-read by the worker.
+    budget_minutes: budgetMinutes,
+    scope_new: scopeNew,
+    // Which worker was ordered, and where each half of that answer came from. Recorded separately
+    // from args because an absent flag says nothing: a run without `-m` looked exactly like a run
+    // whose configured model had never been read, which is how a pinned profile went unnoticed for
+    // three releases (2026-08-26).
+    profile,
+    args,
+  };
+}
+
+export function writeWorkerOrder(runDir, fields) {
+  fs.writeFileSync(
+    path.join(runDir, 'worker.json'),
+    `${JSON.stringify(workerOrder(fields), null, 2)}\n`,
+  );
+}

package/src/home/lib/write-meta.mjs

@@ -28,7 +28,7 @@ import { splitRunChanges } from './meta/environment.mjs';
 import { readEvents } from './meta/events.mjs';
 import { writeStatus } from './meta/run-state.mjs';
 import { resolveStatus } from './meta/verdict.mjs';
-import { AGENTS, failReply, limitReply } from './meta/reply.mjs';
+import { AGENTS, failReply, limitReply, withProfileRow } from './meta/reply.mjs';
 
 function readRunnerVersion() {
   try {
@@ -122,7 +122,12 @@ export function collect(runDir, agent, exitCode) {
     tokens: events.tokens,
     tokens_reported: events.tokens !== null,
     usage: events.usage,
-    model: argValue('-m'),
+    // The ordered profile, straight from worker.json; null for runs made before it was recorded.
+    // `model` stays for readers that already know it, and now answers for a run that pinned
+    // nothing instead of going quiet: an absent -m used to be indistinguishable from a model
+    // the operator had configured and never received (2026-08-26).
+    profile: worker?.profile ?? null,
+    model: worker?.profile?.model || argValue('-m'),
     sandbox: argValue('--sandbox'),
     // Null for runs made before env.json existed: absence is not the same as "both off".
     env: readJson(path.join(runDir, 'env.json')),
@@ -143,7 +148,10 @@ export function collect(runDir, agent, exitCode) {
     file: (name) => path.join(runDir, name),
   };
   const reply =
-    status === 'OK' ? cfg.reply(ctx) : status === 'LIMIT' ? limitReply(ctx, meta) : failReply(ctx, meta);
+    withProfileRow(
+      status === 'OK' ? cfg.reply(ctx) : status === 'LIMIT' ? limitReply(ctx, meta) : failReply(ctx, meta),
+      meta,
+    );
 
   return { meta, reply: reply.join('\n') };
 }