@runuai/host 0.9.134 → 0.9.136

package/lib/agents/codex.ts

@@ -308,6 +308,8 @@ export class CodexSession implements AgentSession {
     environment: TaskEnvironmentAgentSessionSurface;
     systemPreamble: string;
     agentEnv?: Record<string, string>;
+    /** ADR-128: `-c key=value` overrides a delegating adapter prepends. */
+    cliConfigOverrides?: string[];
   }) {
     this.agentId = args.agent.id;
     this.systemPreamble = args.systemPreamble;
@@ -327,6 +329,9 @@ export class CodexSession implements AgentSession {
     if (args.agent.effort) {
       codexArgs.push("-c", `model_reasoning_effort=${args.agent.effort}`);
     }
+    for (const override of args.cliConfigOverrides ?? []) {
+      codexArgs.push("-c", override);
+    }
     codexArgs.push("app-server");
     // ADR-061: the CLI is owned by an in-container runner (durable across
     // host restarts); legacy pipes behind UAI_DURABLE_SESSIONS=0. Codex

package/lib/agents/types.ts

@@ -187,5 +187,9 @@ export interface AgentSessionFactory {
     /** ADR-048: extra per-agent process environment (e.g. this agent's own
      *  UAI_TASK_TOKEN so its `uai` CLI carries only its own permissions). */
     agentEnv?: Record<string, string>;
+    /** ADR-128: engine config overrides a DELEGATING adapter prepends (codex
+     *  `-c key=value`), e.g. the Uai Managed Engine's model-provider block
+     *  that points codex at the inference gateway. Never from the roster. */
+    cliConfigOverrides?: string[];
   }): Promise<AgentSession>;
 }

package/lib/agents/uai.ts

@@ -34,6 +34,8 @@ export function uaiGatewayEnv(
     return {
       OPENAI_BASE_URL: url,
       OPENAI_API_KEY: taskToken,
+      // Read by the `uai` model provider's `env_key` (see uaiCodexOverrides).
+      UAI_INFERENCE_TOKEN: taskToken,
     };
   }
   return {
@@ -47,6 +49,30 @@ export function uaiGatewayEnv(
   };
 }
 
+/**
+ * Codex does NOT follow `OPENAI_BASE_URL` / `OPENAI_API_KEY` for its default
+ * provider any more: with a ChatGPT login present it opens
+ * `wss://api.openai.com/v1/responses` directly and sends no bearer (live
+ * 2026-09-12: "401 Missing bearer or basic authentication", five
+ * reconnects, turn never answered). A dedicated model provider pins the
+ * gateway as the base URL, the HTTP Responses wire (the gateway serves
+ * `/v1/responses`, not WebSockets), and the task token via `env_key`;
+ * `requires_openai_auth=false` keeps the host's Codex login out of a
+ * gateway-billed session. Codex parses `-c` values as TOML, hence the
+ * quotes on strings.
+ */
+export function uaiCodexOverrides(url: string): string[] {
+  const base = `${url.replace(/\/+$/, "")}/v1`;
+  return [
+    "model_provider=uai",
+    'model_providers.uai.name="Uai Managed Engine"',
+    `model_providers.uai.base_url="${base}"`,
+    'model_providers.uai.env_key="UAI_INFERENCE_TOKEN"',
+    'model_providers.uai.wire_api="responses"',
+    "model_providers.uai.requires_openai_auth=false",
+  ];
+}
+
 const create: AgentSessionFactory["create"] = async (args): Promise<AgentSession> => {
   const provider = args.agent.uaiProvider === "openai" ? "openai" : "anthropic";
   const delegateKind = provider === "openai" ? "codex" : "claude";
@@ -69,6 +95,7 @@ const create: AgentSessionFactory["create"] = async (args): Promise<AgentSession
       ...(args.agentEnv ?? {}),
       ...uaiGatewayEnv(provider, gatewayUrl(), taskToken),
     },
+    ...(provider === "openai" ? { cliConfigOverrides: uaiCodexOverrides(gatewayUrl()) } : {}),
   });
 };
 

package/lib/skills.ts

@@ -220,15 +220,32 @@ export function nonInteractiveInstallCommand(command: string): string {
   const found = add.exec(command);
   if (!found) return command;
   // Only the flags AFTER the subcommand count: `npx -y skills add …` is npx's
-  // own -y, not the CLI's.
-  const rest = command.slice(found.index + found[0].length);
+  // own -y, not the CLI's. And the CLI wants its options AFTER the source —
+  // put before it, the parser reports "Missing required argument: source"
+  // (live 2026-09-10, smoke 14) — so the flags go right after the source
+  // token: the first token past `add` that is not an option or an option's
+  // value, stopping at a shell operator.
+  const afterAdd = found.index + found[0].length;
+  const rest = command.slice(afterAdd);
+  const tail = rest.split(/(?=\s(?:&&|\|\||[|;]))/)[0] ?? rest;
   const flags: string[] = [];
-  if (!/(^|\s)(-y|--yes)(\s|$)/.test(rest)) flags.push("-y");
-  if (!/(^|\s)(-a|--agent)(\s|=)/.test(rest)) flags.push("--agent claude-code");
+  if (!/(^|\s)(-y|--yes)(\s|$)/.test(tail)) flags.push("-y");
+  if (!/(^|\s)(-a|--agent)(\s|=)/.test(tail)) flags.push("--agent claude-code");
   if (flags.length === 0) return command;
-  return (
-    command.slice(0, found.index + found[0].length) + ` ${flags.join(" ")}` + rest
-  );
+  const valued = /^(-a|--agent|-s|--skill)$/;
+  const tokens = [...tail.matchAll(/\S+/g)];
+  let sourceEnd = -1;
+  for (let i = 0; i < tokens.length; i++) {
+    const token = tokens[i]![0];
+    if (token.startsWith("-")) {
+      if (valued.test(token)) i += 1; // skip the option's value
+      continue;
+    }
+    sourceEnd = tokens[i]!.index! + token.length;
+    break;
+  }
+  const at = sourceEnd >= 0 ? afterAdd + sourceEnd : afterAdd + tail.length;
+  return `${command.slice(0, at)} ${flags.join(" ")}${command.slice(at)}`;
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.134",
+  "version": "0.9.136",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",