@sleep2agi/commhub-server 0.9.0-preview.120 → 0.9.0-preview.122

package/src/clone-node.ts

@@ -0,0 +1,289 @@
+// Hub #938 — clone a daemon child into a new node on the SAME daemon.
+//
+// Contract (also what `clone_node` returns as `contract`):
+//
+//   Identity     new node_id (minted like create_node: `node_<request id>`),
+//                new alias, new ntok_. The source token is never copied and
+//                never placed in the env blob.
+//   Copied       runtime, model / provider ref (the model string, including
+//                `provider/model`), flags that pass the create_node flag
+//                checks, and commhub channel specs (string entries that are
+//                the network itself). Secret-looking flag values are dropped.
+//   Not copied   token, secrets.env, inline secret env values (key names may
+//                remain as env refs with no value), non-commhub channel
+//                specs (those carry per-node bot credentials).
+//   Session      `copy_session` defaults to true. What that can actually do
+//                depends on the runtime — see `sessionContractForRuntime`.
+//                The daemon performs the copy; this module only states the
+//                capability so the caller is not told a deep copy happened
+//                when the vendor store cannot be forked.
+//   Workdir      `new_empty` (default) or `share_source`. The daemon chooses
+//                the path; this module only records the policy.
+//
+// Workdir policy, decided on the daemon because only it knows the source
+// directory:
+//
+//   new_empty (default)
+//     A new empty directory under the same parent as the source workdir:
+//     `dirname(sourceWorkdir)/<ascii folder>`. The folder name is the new
+//     alias when that alias is already an ASCII directory name, otherwise
+//     the usual `node-<hash>` slug. Nothing inside the source workdir is
+//     copied (no rules file, no checkout).
+//     When the source has no project workdir of its own — it was created
+//     in the daemon cwd — there is no sibling project to sit beside. The
+//     clone is then placed at `<daemon cwd>/clone-work/<ascii folder>`,
+//     still a new empty directory under the daemon root. That is the only
+//     case that does not use the source's parent.
+//
+//   share_source
+//     Explicit opt-in. The clone's cwd is the source workdir. Two nodes
+//     share that checkout. The token is still new. Session files that are
+//     keyed by cwd do not need to be relocated.
+//
+// Cross-daemon: the clone is dispatched only to the daemon that created
+// the source (`node_create_requests.daemon_node_id` of the succeeded row).
+// Passing a different `daemon_node_id` is `cross_daemon_refused`. A node
+// with no succeeded create row on a daemon is `source_not_daemon_child`.
+
+import {
+  FLAG_KEYS,
+  validateFlagValue,
+  validateFlagsForRuntime,
+  validateModel,
+  validateName,
+  validateRuntime,
+  ValidationError,
+} from "./create-node-validate.js";
+
+export const CLONE_WORKDIR_POLICIES = ["new_empty", "share_source"] as const;
+export type CloneWorkdirPolicy = typeof CLONE_WORKDIR_POLICIES[number];
+
+const SECRET_VALUE_RX = /^(sk-|utok_|ntok_|atok_|ak-|gsk_|key-|Bearer\s)/i;
+
+export interface CloneSourceFacts {
+  nodeId: string;
+  alias: string;
+  role: string | null;
+  runtime: string | null;
+  model: string | null;
+  flags: Record<string, unknown>;
+  channels: unknown;
+  /** Daemon that owns the succeeded create row, or null if this node is not a daemon child. */
+  owningDaemonId: string | null;
+  /** Aliases / node names already present in the network. */
+  existingNames: readonly string[];
+  /** child_name values with a pending/delivered create on the owning daemon. */
+  inflightNames: readonly string[];
+}
+
+export interface CloneAsk {
+  newName: string;
+  copySession: boolean;
+  workdirPolicy: CloneWorkdirPolicy;
+  /** When set, must equal the owning daemon. */
+  requestedDaemonId: string | null;
+}
+
+export interface SessionContract {
+  /** Stable code. Not a claim that a private transcript fork already exists. */
+  mode: "transcript_when_present" | "id_aliased" | "unsupported";
+  runtime: string;
+  /** What resume/continue will do, in one sentence the caller can show. */
+  detail: string;
+}
+
+export type CloneDecision =
+  | { ok: false; error: string; detail?: Record<string, unknown> }
+  | {
+      ok: true;
+      daemonNodeId: string;
+      name: string;
+      runtime: string;
+      model: string | null;
+      flags: Record<string, unknown>;
+      channels: string[];
+      droppedChannels: string[];
+      copySession: boolean;
+      workdirPolicy: CloneWorkdirPolicy;
+      sessionContract: SessionContract;
+    };
+
+export function sessionContractForRuntime(runtime: string): SessionContract {
+  if (runtime === "claude-agent-sdk" || runtime === "claude-code-cli") {
+    return {
+      mode: "transcript_when_present",
+      runtime,
+      detail: "Claude resume is the session id plus ~/.claude/projects/<cwd>/<id>.jsonl. The daemon copies that file into the clone's cwd key and writes the same session id. If the file is not on disk, the id is not copied: a bare id would bind an empty session, not continue the old one.",
+    };
+  }
+  if (runtime === "codex-sdk" || runtime === "codex-app-server") {
+    return {
+      mode: "transcript_when_present",
+      runtime,
+      detail: "Codex resume needs the rollout file under the new node's CODEX_HOME. The daemon copies that rollout and keeps the thread id when the file is present. auth.json is not copied. If there is no rollout, the thread id is not copied. This is not `anet node codex fork` (that rewrites a new thread id).",
+    };
+  }
+  if (runtime === "grok-build-acp" || runtime === "grok-build-cli") {
+    return {
+      mode: "transcript_when_present",
+      runtime,
+      detail: "Grok resume needs the session directory under the grok home, keyed by cwd. The daemon copies that directory and keeps the session id when it exists. If it does not, the id is not copied: grok refuses to resume a missing directory.",
+    };
+  }
+  if (runtime === "opencode-cli") {
+    return {
+      mode: "id_aliased",
+      runtime,
+      detail: "OpenCode sessions live in the OpenCode server, not in the node directory. The daemon copies the session id so session/load addresses that same server session. That is not a private deep copy: both nodes share one server-side transcript. There is no local transcript to fork.",
+    };
+  }
+  return {
+    mode: "unsupported",
+    runtime,
+    detail: "This runtime has no clone session copy. The new node starts without a session id.",
+  };
+}
+
+function safeFlags(runtime: string, raw: Record<string, unknown>): Record<string, unknown> {
+  const out: Record<string, unknown> = {};
+  for (const [k, v] of Object.entries(raw)) {
+    if (!(FLAG_KEYS as readonly string[]).includes(k)) continue;
+    if (typeof v === "string" && SECRET_VALUE_RX.test(v)) continue;
+    try {
+      validateFlagValue(k, v);
+    } catch {
+      continue;
+    }
+    out[k] = v;
+  }
+  validateFlagsForRuntime(runtime, out);
+  return out;
+}
+
+/** Commhub channel specs only. Anything else can carry a bot credential. */
+export function safeChannels(raw: unknown): { kept: string[]; dropped: string[] } {
+  if (!Array.isArray(raw)) return { kept: [], dropped: [] };
+  const kept: string[] = [];
+  const dropped: string[] = [];
+  for (const ch of raw) {
+    if (typeof ch !== "string") {
+      dropped.push(typeof ch);
+      continue;
+    }
+    if (ch.includes("commhub") || ch.startsWith("server:")) kept.push(ch);
+    else dropped.push(ch.slice(0, 80));
+  }
+  return { kept, dropped };
+}
+
+function readRole(snapshot: unknown): string | null {
+  if (!snapshot || typeof snapshot !== "object") return null;
+  const role = (snapshot as { role?: unknown }).role;
+  return typeof role === "string" ? role : null;
+}
+
+export function factsFromRows(input: {
+  node: { node_id: string; alias: string | null; node_name?: string | null; runtime?: string | null; model?: string | null; channels?: string | null; config_snapshot?: string | null };
+  createRow: { daemon_node_id: string; runtime: string; model: string | null; flags_json: string; child_name: string } | null;
+  existingNames: readonly string[];
+  inflightNames: readonly string[];
+}): CloneSourceFacts {
+  let snap: Record<string, unknown> = {};
+  try {
+    const parsed = input.node.config_snapshot ? JSON.parse(input.node.config_snapshot) : null;
+    if (parsed && typeof parsed === "object") snap = parsed as Record<string, unknown>;
+  } catch { /* snapshot is display state; the create row still stands */ }
+  let createFlags: Record<string, unknown> = {};
+  try {
+    const parsed = input.createRow ? JSON.parse(input.createRow.flags_json) : {};
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) createFlags = parsed as Record<string, unknown>;
+  } catch { /* ignore */ }
+  const snapFlags = snap.flags && typeof snap.flags === "object" && !Array.isArray(snap.flags)
+    ? snap.flags as Record<string, unknown>
+    : {};
+  const runtime = (typeof snap.runtime === "string" && snap.runtime) ? snap.runtime
+    : (input.node.runtime || input.createRow?.runtime || null);
+  const model = (typeof snap.model === "string" || snap.model === null) ? (snap.model as string | null)
+    : (input.node.model ?? input.createRow?.model ?? null);
+  const channels = Array.isArray(snap.channels) ? snap.channels
+    : (input.node.channels ? safeParseArray(input.node.channels) : []);
+  return {
+    nodeId: input.node.node_id,
+    alias: input.node.alias || input.node.node_name || input.createRow?.child_name || "",
+    role: readRole(snap),
+    runtime,
+    model,
+    flags: { ...createFlags, ...snapFlags },
+    channels,
+    owningDaemonId: input.createRow?.daemon_node_id ?? null,
+    existingNames: input.existingNames,
+    inflightNames: input.inflightNames,
+  };
+}
+
+function safeParseArray(raw: string): unknown[] {
+  try {
+    const v = JSON.parse(raw);
+    return Array.isArray(v) ? v : [];
+  } catch {
+    return [];
+  }
+}
+
+/** Pure. Throws ValidationError for a bad new name, model, or runtime. */
+export function decideClone(source: CloneSourceFacts, ask: CloneAsk): CloneDecision {
+  if (!source.alias) {
+    return { ok: false, error: "source_alias_missing", detail: { source_node_id: source.nodeId } };
+  }
+  if (source.role === "host_supervisor") {
+    return { ok: false, error: "cannot_clone_daemon", detail: { source_node_id: source.nodeId } };
+  }
+  if (!source.owningDaemonId) {
+    return { ok: false, error: "source_not_daemon_child", detail: { source_node_id: source.nodeId } };
+  }
+  if (ask.requestedDaemonId && ask.requestedDaemonId !== source.owningDaemonId) {
+    return {
+      ok: false,
+      error: "cross_daemon_refused",
+      detail: { source_daemon_node_id: source.owningDaemonId, requested_daemon_node_id: ask.requestedDaemonId },
+    };
+  }
+  const name = validateName(ask.newName);
+  if (name === source.alias) {
+    return { ok: false, error: "node_name_conflict", detail: { name, reason: "same_as_source" } };
+  }
+  if (source.existingNames.includes(name)) {
+    return { ok: false, error: "node_name_conflict", detail: { name, reason: "alias_taken" } };
+  }
+  if (source.inflightNames.includes(name)) {
+    return { ok: false, error: "node_name_conflict", detail: { name, reason: "inflight_create" } };
+  }
+  if (!source.runtime) {
+    return { ok: false, error: "source_runtime_unknown", detail: { source_node_id: source.nodeId } };
+  }
+  validateRuntime(source.runtime);
+  validateModel(source.model);
+  const flags = safeFlags(source.runtime, source.flags);
+  const channels = safeChannels(source.channels);
+  return {
+    ok: true,
+    daemonNodeId: source.owningDaemonId,
+    name,
+    runtime: source.runtime,
+    model: source.model ?? null,
+    flags,
+    channels: channels.kept,
+    droppedChannels: channels.dropped,
+    copySession: ask.copySession,
+    workdirPolicy: ask.workdirPolicy,
+    sessionContract: sessionContractForRuntime(source.runtime),
+  };
+}
+
+export function parseWorkdirPolicy(raw: unknown): CloneWorkdirPolicy {
+  if (raw === undefined || raw === null || raw === "") return "new_empty";
+  if (raw === "new_empty" || raw === "share_source") return raw;
+  throw new ValidationError("workdir_policy_invalid", { value: typeof raw === "string" ? raw.slice(0, 40) : typeof raw, allowed: [...CLONE_WORKDIR_POLICIES] });
+}
+
+export { ValidationError };

package/src/codex-config-flags.ts

@@ -0,0 +1,77 @@
+/** Shared Codex node `flags.*` contract (create_node + update_node_config). */
+
+export const REASONING_EFFORT_VALUES = [
+  "none",
+  "minimal",
+  "low",
+  "medium",
+  "high",
+  "xhigh",
+] as const;
+
+export type ModelReasoningEffort = (typeof REASONING_EFFORT_VALUES)[number];
+
+export const CODEX_APPROVAL_POLICIES = [
+  "untrusted",
+  "on-failure",
+  "on-request",
+  "never",
+] as const;
+
+export const CODEX_SANDBOX_MODES = [
+  "read-only",
+  "workspace-write",
+  "danger-full-access",
+] as const;
+
+/** Runtimes that may carry Codex posture / reasoning flags. */
+export const CODEX_CONFIG_FLAG_RUNTIMES = new Set<string>(["codex-sdk", "codex-app-server"]);
+
+export const CODEX_CONFIG_ONLY_FLAG_KEYS = new Set<string>([
+  "approvalPolicy",
+  "sandboxMode",
+  "skipGitRepoCheck",
+  "copresenceFullAccess",
+  "modelReasoningEffort",
+]);
+
+export function isModelReasoningEffort(v: unknown): v is ModelReasoningEffort {
+  return typeof v === "string" && (REASONING_EFFORT_VALUES as readonly string[]).includes(v);
+}
+
+export function validateCodexConfigFlag(
+  key: string,
+  val: unknown,
+  runtime: string | null | undefined,
+): { field: string; reason: string } | null {
+  if (!CODEX_CONFIG_ONLY_FLAG_KEYS.has(key)) return null;
+  if (runtime && !CODEX_CONFIG_FLAG_RUNTIMES.has(runtime)) {
+    return { field: `flags.${key}`, reason: `only supported for codex-sdk / codex-app-server runtimes` };
+  }
+  if (key === "copresenceFullAccess" && runtime && runtime !== "codex-app-server") {
+    return { field: "flags.copresenceFullAccess", reason: "only supported when node runtime is codex-app-server" };
+  }
+  switch (key) {
+    case "approvalPolicy":
+      if (typeof val !== "string" || !(CODEX_APPROVAL_POLICIES as readonly string[]).includes(val)) {
+        return { field: "flags.approvalPolicy", reason: `must be one of ${CODEX_APPROVAL_POLICIES.join("/")}` };
+      }
+      return null;
+    case "sandboxMode":
+      if (typeof val !== "string" || !(CODEX_SANDBOX_MODES as readonly string[]).includes(val)) {
+        return { field: "flags.sandboxMode", reason: `must be one of ${CODEX_SANDBOX_MODES.join("/")}` };
+      }
+      return null;
+    case "skipGitRepoCheck":
+    case "copresenceFullAccess":
+      if (typeof val !== "boolean") return { field: `flags.${key}`, reason: "must be boolean" };
+      return null;
+    case "modelReasoningEffort":
+      if (!isModelReasoningEffort(val)) {
+        return { field: "flags.modelReasoningEffort", reason: `must be one of ${REASONING_EFFORT_VALUES.join("/")}` };
+      }
+      return null;
+    default:
+      return null;
+  }
+}

package/src/config-apply-validate.test.ts

@@ -26,20 +26,28 @@ describe("ALLOWED_FLAGS — exact contract (no silent extension)", () => {
     // the BLOCKER 2 schema-mismatch issue. P2 to add a claude-code-cli
     // config-apply path.
     expect([...ALLOWED_FLAGS].sort()).toEqual([
+      "approvalPolicy",
       "budget",
+      "copresenceFullAccess",
       "dangerouslySkipPermissions",
       "maxTurns",
+      "modelReasoningEffort",
       "permissionMode",
+      "sandboxMode",
+      "skipGitRepoCheck",
       "timeout",
     ]);
   });
 });
 
 describe("SECURITY_SENSITIVE_FLAGS — privilege-elevation surface", () => {
-  test("contains the 2 privilege-elevation flags (teammateMode dropped — see ALLOWED_FLAGS comment)", () => {
+  test("contains privilege-elevation flags (teammateMode dropped — see ALLOWED_FLAGS comment)", () => {
     expect([...SECURITY_SENSITIVE_FLAGS].sort()).toEqual([
+      "approvalPolicy",
+      "copresenceFullAccess",
       "dangerouslySkipPermissions",
       "permissionMode",
+      "sandboxMode",
     ]);
   });
 
@@ -161,6 +169,10 @@ describe("computeApplyMode — tier classifier (RFC-024 §4)", () => {
     expect(computeApplyMode("gpt-5", { maxTurns: 50 })).toBe("restart");
   });
 
+  test("modelReasoningEffort flag alone → restart tier", () => {
+    expect(computeApplyMode(undefined, { modelReasoningEffort: "medium" })).toBe("restart");
+  });
+
   test("mixed (only hot flags) → hot", () => {
     expect(computeApplyMode(undefined, { maxTurns: 50, budget: 100 })).toBe("hot");
   });
@@ -359,3 +371,23 @@ describe("validatePatch — channels defensive gate", () => {
     expect(r?.field).toBe("channels");
   });
 });
+
+describe("Codex config flags (#815)", () => {
+  test("yolo bundle on codex-app-server passes", () => {
+    expect(validatePatch(undefined, {
+      approvalPolicy: "never",
+      sandboxMode: "danger-full-access",
+      skipGitRepoCheck: true,
+      copresenceFullAccess: true,
+      modelReasoningEffort: "low",
+    }, undefined, "codex-app-server")).toBeNull();
+  });
+  test("modelReasoningEffort invalid enum rejected", () => {
+    expect(validatePatch(undefined, { modelReasoningEffort: "max" }, undefined, "codex-app-server")?.field)
+      .toBe("flags.modelReasoningEffort");
+  });
+  test("codex flags on claude runtime rejected", () => {
+    expect(validatePatch(undefined, { modelReasoningEffort: "low" }, undefined, "claude-agent-sdk")?.field)
+      .toBe("flags.modelReasoningEffort");
+  });
+});

package/src/config-apply-validate.ts

@@ -6,6 +6,13 @@
 // caller identity, role gates).
 
 import { isValidTimeoutMs, TIMEOUT_MS_REASON } from "./create-node-validate.js";
+import {
+  REASONING_EFFORT_VALUES,
+  validateCodexConfigFlag,
+  type ModelReasoningEffort,
+} from "./codex-config-flags.js";
+
+export { REASONING_EFFORT_VALUES, type ModelReasoningEffort } from "./codex-config-flags.js";
 
 /**
  * Fields the dashboard may change. Anything not in this list is rejected
@@ -18,6 +25,12 @@ export const ALLOWED_FLAGS = new Set<string>([
   "maxTurns",
   "budget",
   "timeout",
+  // Codex (#815 / client): posture + co-presence grant + thinking level
+  "approvalPolicy",
+  "sandboxMode",
+  "skipGitRepoCheck",
+  "copresenceFullAccess",
+  "modelReasoningEffort",
 ]);
 // NB on teammateMode (dropped from P1 scope per #290 cross-agent
 // review): teammateMode is consumed ONLY by the claude-code-cli
@@ -45,6 +58,9 @@ export const ALLOWED_FLAGS = new Set<string>([
 export const SECURITY_SENSITIVE_FLAGS = new Set<string>([
   "permissionMode",
   "dangerouslySkipPermissions",
+  "approvalPolicy",
+  "sandboxMode",
+  "copresenceFullAccess",
 ]);
 
 /**
@@ -57,6 +73,11 @@ export const RESTART_REQUIRED_FLAGS = new Set<string>([
   "permissionMode",
   "dangerouslySkipPermissions",
   "timeout",
+  "approvalPolicy",
+  "sandboxMode",
+  "skipGitRepoCheck",
+  "copresenceFullAccess",
+  "modelReasoningEffort",
 ]);
 
 /**
@@ -186,6 +207,7 @@ export function validatePatch(
   model: string | undefined,
   flags: Record<string, unknown>,
   channels?: string[] | undefined,
+  nodeRuntime?: string | null,
 ): { field: string; reason: string } | null {
   if (model !== undefined) {
     if (typeof model !== "string" || model.length === 0 || model.length > 200) {
@@ -213,6 +235,8 @@ export function validatePatch(
     if (!ALLOWED_FLAGS.has(key)) {
       return { field: `flags.${key}`, reason: "not in allowlist" };
     }
+    const codexFail = validateCodexConfigFlag(key, val, nodeRuntime ?? null);
+    if (codexFail) return codexFail;
     switch (key) {
       case "permissionMode":
         if (

package/src/create-node-validate.test.ts

@@ -3,7 +3,7 @@ import {
   ValidationError,
   validateName, validateRuntime, validateModel, validateFlagValue, RUNTIMES,
   validateEnvRefs, validateChannelsP1, serializeEnvLocal, buildAnetArgs,
-  MAX_ENV_KEYS_PER_NODE, validateFlagsForRuntime, COPRESENCE_FLAG_RUNTIMES,
+  MAX_ENV_KEYS_PER_NODE, validateFlagsForRuntime, validateOpenCodeV2ProviderModel, COPRESENCE_FLAG_RUNTIMES,
 } from "./create-node-validate.js";
 
 const okSecret = (k: string, _net: string, key: string) => k === key ? `value-of-${k}` : undefined;
@@ -216,6 +216,31 @@ describe("buildAnetArgs (§4.2.2 F2 — fully validated argv)", () => {
     expect(args).toContain("--permission-mode");
     expect(args[args.indexOf("--permission-mode") + 1]).toBe("plan");
   });
+  test("OpenCode V2 requires provider/model only after unsafe opt-in", () => {
+    let unsafe = "";
+    try {
+      buildAnetArgs({ name: "v2", runtime: "opencode-cli", flags: { opencodeGeneration: "v2" } });
+    } catch (e) { unsafe = (e as ValidationError).code; }
+    expect(unsafe).toBe("opencode_v2_requires_unsafe_opt_in");
+    let missing = "";
+    try {
+      buildAnetArgs({ name: "v2", runtime: "opencode-cli", flags: { opencodeGeneration: "v2", opencodeUnsafeTools: true } });
+    } catch (e) { missing = (e as ValidationError).code; }
+    expect(missing).toBe("opencode_v2_requires_provider_model");
+    let bare = "";
+    try {
+      buildAnetArgs({ name: "v2", runtime: "opencode-cli", model: "opencode", flags: { opencodeGeneration: "v2", opencodeUnsafeTools: true } });
+    } catch (e) { bare = (e as ValidationError).code; }
+    expect(bare).toBe("opencode_v2_requires_provider_model");
+    const args = buildAnetArgs({
+      name: "v2", runtime: "opencode-cli", model: "stub/model",
+      flags: { opencodeGeneration: "v2", opencodeUnsafeTools: true },
+    });
+    expect(args).toContain("stub/model");
+    expect(() => validateOpenCodeV2ProviderModel("opencode-cli", undefined, { opencodeGeneration: "v2" })).not.toThrow();
+    expect(() => validateOpenCodeV2ProviderModel("claude-agent-sdk", undefined, { opencodeGeneration: "v2", opencodeUnsafeTools: true })).not.toThrow();
+    expect(buildAnetArgs({ name: "x", runtime: "opencode-cli" })).toEqual(["node", "create", "x", "--runtime", "opencode-cli"]);
+  });
   test("omitted model is allowed and does not emit --model", () => {
     const args = buildAnetArgs({
       name: "x", runtime: "codex-sdk",

package/src/create-node-validate.ts

@@ -9,6 +9,7 @@
 
 import { isReservedEnvKey } from "./shared/reserved-env.js";
 import { checkNodeName } from "./shared/node-name.js";
+import { CODEX_CONFIG_ONLY_FLAG_KEYS, validateCodexConfigFlag } from "./codex-config-flags.js";
 
 export class ValidationError extends Error {
   constructor(public code: string, public detail?: Record<string, unknown>) {
@@ -52,7 +53,11 @@ export type Runtime = typeof RUNTIMES[number];
 // 🔴 故意放在 flags 里而不是 node_spec 顶层:老 hub 的 zod 会静默丢弃未知顶层字段、老 daemon 也静默忽略
 //    —— 那正是 #584 的形状(用户选了共存,拿到无头节点,没有任何报错)。flags 的未知键在老 hub(这份
 //    FLAG_KEYS)和老 daemon(buildAnetArgsDaemon)都**拒绝**,新 app 撞到老组件得到的是一条报错。
-export const FLAG_KEYS = ["permissionMode", "dangerouslySkipPermissions", "maxTurns", "budget", "timeout", "copresence", "opencodeGeneration", "opencodeUnsafeTools"] as const;
+export const FLAG_KEYS = [
+  "permissionMode", "dangerouslySkipPermissions", "maxTurns", "budget", "timeout",
+  "copresence", "opencodeGeneration", "opencodeUnsafeTools",
+  "approvalPolicy", "sandboxMode", "skipGitRepoCheck", "copresenceFullAccess", "modelReasoningEffort",
+] as const;
 
 /** #584 —— 只有这些 runtime 认 `flags.copresence`。目前只有 codex-app-server 的共存靠 config 字段
  *  (`codexCopresence`)决定;grok-build-cli / opencode-cli 各有自己的字段,接进来之前一律拒,不静默吞。 */
@@ -170,6 +175,11 @@ export function validateFlagValue(k: string, v: unknown): void {
       if (typeof v !== "boolean") throw new ValidationError("flag_value_invalid", { field: k, reason: "must be boolean" });
       return;
     default:
+      if (CODEX_CONFIG_ONLY_FLAG_KEYS.has(k)) {
+        const fail = validateCodexConfigFlag(k, v, null);
+        if (fail) throw new ValidationError("flag_value_invalid", { field: k, reason: fail.reason });
+        return;
+      }
       throw new ValidationError("flag_key_unknown", { field: k });
   }
 }
@@ -196,6 +206,38 @@ export function validateFlagsForRuntime(runtime: string, flags: Record<string, u
       field: "copresence", runtime, applicable: [...COPRESENCE_FLAG_RUNTIMES],
     });
   }
+  for (const [k, v] of Object.entries(flags)) {
+    if (!CODEX_CONFIG_ONLY_FLAG_KEYS.has(k)) continue;
+    const fail = validateCodexConfigFlag(k, v, runtime);
+    if (fail) throw new ValidationError("flag_value_invalid", { field: k, reason: fail.reason });
+  }
+}
+
+/**
+ * V2 co-presence start requires OpenCode's own `provider/model`.
+ * Call only after the unsafe-opt-in check: a missing opt-in stays
+ * `opencode_v2_requires_unsafe_opt_in`. This API does not take an anet
+ * provider preset or a vault key (#2565 owns presets).
+ */
+export function validateOpenCodeV2ProviderModel(
+  runtime: string,
+  model: unknown,
+  flags: Record<string, unknown> | undefined | null,
+): void {
+  if (runtime !== "opencode-cli" || !flags || typeof flags !== "object") return;
+  if (flags.opencodeGeneration !== "v2" || flags.opencodeUnsafeTools !== true) return;
+  const native = typeof model === "string"
+    && model.length > 0
+    && model.length <= 100
+    && MODEL_RE.test(model)
+    && !MODEL_DOT_ONLY_SEGMENT.test(model)
+    && model.includes("/")
+    && model.indexOf("/") === model.lastIndexOf("/");
+  if (!native) {
+    throw new ValidationError("opencode_v2_requires_provider_model", {
+      reason: "OpenCode V2 uses the installed OpenCode provider/model (exactly one slash, for example provider/model). This API does not take an anet provider preset.",
+    });
+  }
 }
 
 // §4.4.7 — env_refs 7-step gate. networkSecretsGet is injected so
@@ -356,9 +398,11 @@ export function buildAnetArgs(spec: NodeSpec): string[] {
       // `anet node create --copresence` 是布尔开关,不吃值。
       if (k === "copresence") { if (v === true) args.push("--copresence"); continue; }
       if (k === "opencodeUnsafeTools") { if (v === true) args.push("--opencode-unsafe-tools"); continue; }
+      if (CODEX_CONFIG_ONLY_FLAG_KEYS.has(k)) continue;
       args.push(`--${kebab(k)}`, String(v));
     }
     validateFlagsForRuntime(spec.runtime, spec.flags);
   }
+  validateOpenCodeV2ProviderModel(spec.runtime, spec.model, spec.flags);
   return args;
 }

package/src/create-node-workdir.test.ts

@@ -119,6 +119,19 @@ describe("create_node + workdir", () => {
     expect(pulled.node_spec.flags).toEqual(flags);
   });
 
+  test("#829 V2 without native provider/model rejected before request or child token mint", async () => {
+    seed({ runtimes_supported: ["opencode-cli"] });
+    const tokenCount = () => db.get<{ n: number }>("SELECT COUNT(*) AS n FROM api_tokens WHERE network_id = ?1", NET)!.n;
+    const before = tokenCount();
+    const flags = { opencodeGeneration: "v2", opencodeUnsafeTools: true };
+    const missing = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { name: "v2-child", runtime: "opencode-cli", flags } });
+    expect(missing.error).toBe("opencode_v2_requires_provider_model");
+    const bare = await call(tools().create_node, { daemon_node_id: DAEMON_ID, node_spec: { name: "v2-child", runtime: "opencode-cli", model: "opencode", flags } });
+    expect(bare.error).toBe("opencode_v2_requires_provider_model");
+    expect(rowCount()).toBe(0);
+    expect(tokenCount()).toBe(before);
+  });
+
   test("#829 missing opt-in rejected before request or child token mint", async () => {
     seed({ runtimes_supported: ["opencode-cli"] });
     const tokenCount = () => db.get<{ n: number }>("SELECT COUNT(*) AS n FROM api_tokens WHERE network_id = ?1", NET)!.n;