@runuai/host 0.9.135 → 0.9.136

package/lib/agents/codex.ts

@@ -308,6 +308,8 @@ export class CodexSession implements AgentSession {
     environment: TaskEnvironmentAgentSessionSurface;
     systemPreamble: string;
     agentEnv?: Record<string, string>;
+    /** ADR-128: `-c key=value` overrides a delegating adapter prepends. */
+    cliConfigOverrides?: string[];
   }) {
     this.agentId = args.agent.id;
     this.systemPreamble = args.systemPreamble;
@@ -327,6 +329,9 @@ export class CodexSession implements AgentSession {
     if (args.agent.effort) {
       codexArgs.push("-c", `model_reasoning_effort=${args.agent.effort}`);
     }
+    for (const override of args.cliConfigOverrides ?? []) {
+      codexArgs.push("-c", override);
+    }
     codexArgs.push("app-server");
     // ADR-061: the CLI is owned by an in-container runner (durable across
     // host restarts); legacy pipes behind UAI_DURABLE_SESSIONS=0. Codex

package/lib/agents/types.ts

@@ -187,5 +187,9 @@ export interface AgentSessionFactory {
     /** ADR-048: extra per-agent process environment (e.g. this agent's own
      *  UAI_TASK_TOKEN so its `uai` CLI carries only its own permissions). */
     agentEnv?: Record<string, string>;
+    /** ADR-128: engine config overrides a DELEGATING adapter prepends (codex
+     *  `-c key=value`), e.g. the Uai Managed Engine's model-provider block
+     *  that points codex at the inference gateway. Never from the roster. */
+    cliConfigOverrides?: string[];
   }): Promise<AgentSession>;
 }

package/lib/agents/uai.ts

@@ -34,6 +34,8 @@ export function uaiGatewayEnv(
     return {
       OPENAI_BASE_URL: url,
       OPENAI_API_KEY: taskToken,
+      // Read by the `uai` model provider's `env_key` (see uaiCodexOverrides).
+      UAI_INFERENCE_TOKEN: taskToken,
     };
   }
   return {
@@ -47,6 +49,30 @@ export function uaiGatewayEnv(
   };
 }
 
+/**
+ * Codex does NOT follow `OPENAI_BASE_URL` / `OPENAI_API_KEY` for its default
+ * provider any more: with a ChatGPT login present it opens
+ * `wss://api.openai.com/v1/responses` directly and sends no bearer (live
+ * 2026-09-12: "401 Missing bearer or basic authentication", five
+ * reconnects, turn never answered). A dedicated model provider pins the
+ * gateway as the base URL, the HTTP Responses wire (the gateway serves
+ * `/v1/responses`, not WebSockets), and the task token via `env_key`;
+ * `requires_openai_auth=false` keeps the host's Codex login out of a
+ * gateway-billed session. Codex parses `-c` values as TOML, hence the
+ * quotes on strings.
+ */
+export function uaiCodexOverrides(url: string): string[] {
+  const base = `${url.replace(/\/+$/, "")}/v1`;
+  return [
+    "model_provider=uai",
+    'model_providers.uai.name="Uai Managed Engine"',
+    `model_providers.uai.base_url="${base}"`,
+    'model_providers.uai.env_key="UAI_INFERENCE_TOKEN"',
+    'model_providers.uai.wire_api="responses"',
+    "model_providers.uai.requires_openai_auth=false",
+  ];
+}
+
 const create: AgentSessionFactory["create"] = async (args): Promise<AgentSession> => {
   const provider = args.agent.uaiProvider === "openai" ? "openai" : "anthropic";
   const delegateKind = provider === "openai" ? "codex" : "claude";
@@ -69,6 +95,7 @@ const create: AgentSessionFactory["create"] = async (args): Promise<AgentSession
       ...(args.agentEnv ?? {}),
       ...uaiGatewayEnv(provider, gatewayUrl(), taskToken),
     },
+    ...(provider === "openai" ? { cliConfigOverrides: uaiCodexOverrides(gatewayUrl()) } : {}),
   });
 };
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.135",
+  "version": "0.9.136",
   "description": "Uai host — runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",