@yalehwang/cloudpit 2.0.0 → 3.0.0

package/scripts/mcp-smoke.mjs

@@ -487,7 +487,7 @@ export function upsertSection(filePath, title, body) {
  */
 function recordHeader() {
   return [
-    '# CloudCLI MCP 网关嵌套冒烟记录（AC-256）',
+    '# Cloudpit MCP 网关嵌套冒烟记录（AC-256）',
     '',
     '本文件由 `scripts/mcp-smoke.mjs` 写入：八节各含**原始**读数与一行结论。读数来自一次真跑——真服务',
     '实例（临时 `DATABASE_PATH`、`HOST=127.0.0.1`、端口 `listen(0)` 探得且 ≠ 3001）+ 一个真 PAT +',
@@ -506,7 +506,7 @@ function recordHeader() {
  */
 function residentRecordHeader() {
   return [
-    '# CloudCLI MCP 网关常驻专有能力冒烟记录（AC-276）',
+    '# Cloudpit MCP 网关常驻专有能力冒烟记录（AC-276）',
     '',
     '本文件由 `scripts/mcp-smoke.mjs --run-resident` 写入：八节各含**原始**读数与一行结论。读数来自一次',
     '真跑——真服务实例（临时 `DATABASE_PATH`、`HOST=127.0.0.1`、端口 `listen(0)` 探得且 ≠ 3001）+',

package/scripts/release/tests/fork-release-workflows.test.mjs

@@ -169,10 +169,34 @@ function scanUpstreamMentions() {
 
 const upstreamMentions = scanUpstreamMentions();
 
+// ── R12: the retired runtime tag / asset prefixes ───────────────────────────
+// 2.0 never double-published the legacy tag aliases; 2.1 stops them for good. The frozen ledgers
+// (docs/, tasks/, goals/, CHANGELOG.md) keep the history, so the scan is the LIVE release surface
+// only: every workflow plus the scripts/package metadata that mint tags and asset names.
+const LEGACY_TAG_PREFIXES = ['cloudcli-local-server-', 'cloudcli-desktop-'];
+const RELEASE_SURFACE = [
+  '.github/workflows/release.yml',
+  '.github/workflows/desktop-release.yml',
+  '.github/workflows/desktop-windows-branch-build.yml',
+  '.github/workflows/desktop-macos-branch-build.yml',
+  '.github/workflows/docker.yml',
+  'scripts/release/build-server-bundle.js',
+  'scripts/release/prepare-desktop-app.js',
+  'electron/serverInstaller.js',
+  'package.json',
+];
+
+const legacyTagHits = RELEASE_SURFACE.flatMap((rel) =>
+  LEGACY_TAG_PREFIXES.flatMap((prefix) =>
+    read(rel).includes(prefix) ? [`${rel}:${prefix}`] : [],
+  ),
+);
+
 console.log(`pkg.name=${pkg.name}`);
 console.log(`npm.publish=${npmPublish}`);
 console.log(`auth.env=${authEnv}`);
 console.log(`legacy.upgradeCmds=${upstreamMentions.length}`);
+console.log(`legacy.tag_prefixes=${legacyTagHits.length}`);
 console.log(`requireBranch=${requireBranch}`);
 console.log(`pushRepo=${pushRepo}`);
 console.log(`macos.jobs=${macosJobs}`);
@@ -235,6 +259,27 @@ test('no user-facing command points at the upstream package scope', () => {
   );
 });
 
+test('R12: the release surface carries no legacy runtime tag or asset prefix', () => {
+  assert.deepEqual(
+    legacyTagHits,
+    [],
+    `a release workflow or asset still mints a retired prefix (${LEGACY_TAG_PREFIXES.join(', ')}): ${legacyTagHits.join(', ')}`,
+  );
+});
+
+test('R12 control: the legacy-prefix scan would catch a reintroduction', () => {
+  // The 3.0 gate only re-confirms the 2.1 removal, so a vacuous green would be invisible. The
+  // same predicate must flag a synthetic reintroduction, and every scanned file must be live
+  // (non-empty) so "no hits" cannot come from reading nothing.
+  /** @param {string} text @returns {string[]} */
+  const detect = (text) => LEGACY_TAG_PREFIXES.filter((prefix) => text.includes(prefix));
+  assert.deepEqual(detect('cloudpit-local-server-v3.0.0'), [], 'the live prefix is not a hit');
+  assert.deepEqual(detect('cloudcli-local-server-v3.0.0'), ['cloudcli-local-server-'], 'a retired prefix is a hit');
+  for (const rel of RELEASE_SURFACE) {
+    assert.ok(read(rel).length > 0, `${rel} must be a live release-surface file`);
+  }
+});
+
 test('desktop-release.yml drops the macOS build', () => {
   assert.equal(macosJobs, 0, `desktop-release.yml builds a macOS job again (${macosJobs})`);
   assert.equal(dmgRefs, 0, `desktop-release.yml still references a .dmg (${dmgRefs})`);

package/scripts/release/tests/server-installer-bundle-url.test.mjs

@@ -2,16 +2,17 @@
 /**
  * Criterion for gap-desktop-local-server-bundle-url-points-at-fork.
  *
- * CloudCLI Desktop downloads its Local runtime bundle from a GitHub Release URL built by
+ * Cloudpit Desktop downloads its Local runtime bundle from a GitHub Release URL built by
  * `electron/serverInstaller.js`. The default base URL named the UPSTREAM repository
  * (`github.com/siteboon/claudecodeui`) while this fork publishes both the desktop installer and the
  * `cloudpit-local-server-v<tag>` prerelease under `yaleh/cloudpit` — so a user who picked
- * "Local CloudCLI" asked a repository that never had the tag and got a 404.
+ * "Local Cloudpit" asked a repository that never had the tag and got a 404.
  *
  * This criterion pins the two decisions that fix it, so neither can silently revert:
  *
  *   1. the DEFAULT base URL names the fork, and no upstream org reference survives in the source;
- *   2. `CLOUDCLI_SERVER_BUNDLE_URL` still overrides it (the escape hatch admins already use).
+ *   2. `CLOUDPIT_SERVER_BUNDLE_URL` still overrides it (the escape hatch admins already use);
+ *      v3.0 retired the legacy `CLOUDCLI_SERVER_BUNDLE_URL` spelling, which is now ignored.
  *
  * It also pins the URL *shape* the release pipeline now produces: the release-tag path segment and
  * the `cloudpit-local-server-v<version>-<platform>-<arch>.tar.gz` filename both carry the `v`
@@ -87,18 +88,38 @@ function installer() {
 
 const sourceText = read(SOURCE_REL);
 
+// R12 (2.1): the retired runtime tag / asset prefixes must not reappear on the release surface.
+const LEGACY_TAG_PREFIXES = ['cloudcli-local-server-', 'cloudcli-desktop-'];
+const RELEASE_SURFACE = [
+  SOURCE_REL,
+  'scripts/release/build-server-bundle.js',
+  '.github/workflows/desktop-release.yml',
+];
+const legacyTagHits = RELEASE_SURFACE.flatMap((rel) =>
+  LEGACY_TAG_PREFIXES.flatMap((prefix) => (read(rel).includes(prefix) ? [`${rel}:${prefix}`] : [])),
+);
+
 // The default reading must be taken with the override env UNSET: a stray
-// CLOUDCLI_SERVER_BUNDLE_URL in the caller's environment would otherwise masquerade as the default.
-const savedBundleUrlEnv = process.env.CLOUDCLI_SERVER_BUNDLE_URL;
+// CLOUDPIT_SERVER_BUNDLE_URL in the caller's environment would otherwise masquerade as the default.
+const savedBundleUrlEnv = process.env.CLOUDPIT_SERVER_BUNDLE_URL;
+const savedLegacyBundleUrlEnv = process.env.CLOUDCLI_SERVER_BUNDLE_URL;
+delete process.env.CLOUDPIT_SERVER_BUNDLE_URL;
 delete process.env.CLOUDCLI_SERVER_BUNDLE_URL;
 const defaultUrl = installer().getBundleUrl();
 const defaultBaseUrl = installer().bundleBaseUrl;
 
-process.env.CLOUDCLI_SERVER_BUNDLE_URL = OVERRIDE_BASE;
+process.env.CLOUDPIT_SERVER_BUNDLE_URL = OVERRIDE_BASE;
 const overrideUrl = installer().getBundleUrl();
 
-if (savedBundleUrlEnv === undefined) delete process.env.CLOUDCLI_SERVER_BUNDLE_URL;
-else process.env.CLOUDCLI_SERVER_BUNDLE_URL = savedBundleUrlEnv;
+// v3.0 negative control: the retired legacy spelling must not override anything.
+delete process.env.CLOUDPIT_SERVER_BUNDLE_URL;
+process.env.CLOUDCLI_SERVER_BUNDLE_URL = 'https://legacy.invalid/bundles';
+const legacyOnlyUrl = installer().getBundleUrl();
+
+if (savedBundleUrlEnv === undefined) delete process.env.CLOUDPIT_SERVER_BUNDLE_URL;
+else process.env.CLOUDPIT_SERVER_BUNDLE_URL = savedBundleUrlEnv;
+if (savedLegacyBundleUrlEnv === undefined) delete process.env.CLOUDCLI_SERVER_BUNDLE_URL;
+else process.env.CLOUDCLI_SERVER_BUNDLE_URL = savedLegacyBundleUrlEnv;
 
 const defaultParsed = new URL(defaultUrl);
 const defaultRepoPath = defaultParsed.pathname.split('/').filter(Boolean).slice(0, 2).join('/');
@@ -112,6 +133,7 @@ const envOverride = overrideUrl.startsWith(`${OVERRIDE_BASE}/`) ? 'honored' : 'i
 console.log(`bundle.default.host=${defaultHost}`);
 console.log(`bundle.default.upstream_refs=${upstreamRefs}`);
 console.log(`bundle.env_override=${envOverride}`);
+console.log(`legacy.tag_prefixes=${legacyTagHits.length}`);
 
 // ── the assertions ───────────────────────────────────────────────────────────
 
@@ -141,7 +163,7 @@ test('the default bundle address points at the fork, not upstream', () => {
   );
 });
 
-test('CLOUDCLI_SERVER_BUNDLE_URL still overrides the default', () => {
+test('CLOUDPIT_SERVER_BUNDLE_URL still overrides the default', () => {
   assert.equal(envOverride, 'honored', 'the environment override must win over the default base URL');
   assert.equal(
     overrideUrl,
@@ -150,6 +172,32 @@ test('CLOUDCLI_SERVER_BUNDLE_URL still overrides the default', () => {
   );
 });
 
+test('v3.0: CLOUDCLI_SERVER_BUNDLE_URL is ignored', () => {
+  assert.equal(
+    legacyOnlyUrl.startsWith(`${OVERRIDE_BASE}/`),
+    false,
+    'the retired legacy spelling must not override the base URL',
+  );
+  assert.equal(
+    legacyOnlyUrl,
+    defaultUrl,
+    'a legacy-only environment must resolve the same URL as no environment',
+  );
+});
+
+test('R12: no legacy runtime tag or asset prefix survives on the release surface', () => {
+  assert.deepEqual(
+    legacyTagHits,
+    [],
+    `the installer/workflow/build script still mints a retired prefix: ${legacyTagHits.join(', ')}`,
+  );
+  // Positive control: the replacement prefix is what the same surface produces.
+  assert.ok(
+    defaultUrl.includes('cloudpit-local-server-'),
+    'the live release surface must produce the cloudpit-local-server- shape',
+  );
+});
+
 test('the bundle URL shape matches the distribution asset prefix', () => {
   assert.equal(
     defaultUrl,

package/scripts/restart-when-idle.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Restart the claudecodeui server once NO CloudCLI session is running a turn.
+# Restart the claudecodeui server once NO Cloudpit session is running a turn.
 #
 # Why this script exists: restarting the server unit kills every claude process under it, so doing
 # it while another session is mid-turn loses that turn. It runs as a systemd USER transient unit

package/scripts/shadow-prediction-report.mjs

@@ -14,7 +14,7 @@
  *     absent, so a damage line cannot quietly look like a hit.
  *
  * `--json` prints the same reading as one JSON document. The report is READ-ONLY:
- * it never writes the stream (the fleet owns retention and CloudCLI never deletes
+ * it never writes the stream (the fleet owns retention and Cloudpit never deletes
  * an event).
  *
  * Consumers: `scripts/shadow-prediction-report.test.mjs` (AC4, which drives the

package/scripts/suite-duration-baseline.tsv

@@ -973,3 +973,48 @@
 #   (dur=1863ms, its own new criterion; no green round contains it yet — the row keeps the 90%
 #   coverage floor clear: the tree collects 497 server test files and the baseline holds 448 of them).
 1863	server/modules/mcp-gateway/tests/knowledge-effective-config-launch-request.test.ts
+#   and the codex-model-providers-settings row by codex-provider-config-surface,
+#   measured once on 2026-11-02 with
+#   `npx tsx --tsconfig server/tsconfig.json --test server/modules/settings/tests/codex-model-providers-settings.test.ts`
+#   (dur=2206ms, its own new criterion; no green round contains it yet — the row keeps the 90%
+#   coverage floor clear: the tree collects 499 server test files and the baseline holds 450 of them).
+2206	server/modules/settings/tests/codex-model-providers-settings.test.ts
+#   and the asset-migration.service row by gap-cloudpit-migrate-assets-rewrite,
+#   measured once on 2026-11-03 with
+#   `npx tsx --tsconfig server/tsconfig.json --test server/modules/cli/tests/asset-migration.service.test.ts`
+#   (dur=1409ms, its own new criterion; no green round contains it yet — the row keeps the 90%
+#   coverage floor clear: the tree collects 500 server test files and the baseline holds 451 of them).
+1409	server/modules/cli/tests/asset-migration.service.test.ts
+#   and the codex-provider-model-binding row by codex-model-entry-provider-binding,
+#   measured once on 2026-11-03 with
+#   `npx tsx --tsconfig server/tsconfig.json --test server/modules/providers/tests/codex-provider-model-binding.test.ts`
+#   (dur=4412ms, its own new criterion; no green round contains it yet — the row keeps the 90%
+#   coverage floor clear: the tree collects 501 server test files and the baseline holds 452 of them).
+4412	server/modules/providers/tests/codex-provider-model-binding.test.ts
+#   and the codex-perrun-provider-injection row by codex-perrun-provider-injection,
+#   measured once on 2026-11-03 with
+#   `npx tsx --tsconfig server/tsconfig.json --test server/modules/providers/tests/codex-runtime-provider-injection.test.ts`
+#   (dur=6729ms, its own new criterion; no green round contains it yet — the row keeps the 90%
+#   coverage floor clear: the tree collects 502 server test files and the baseline holds 453 of them).
+6729	server/modules/providers/tests/codex-runtime-provider-injection.test.ts
+#   The codex-session-provider-id-binding row: measured once on 2026-11-03 with
+#   `npx tsx --tsconfig server/tsconfig.json --test server/modules/providers/tests/codex-session-provider-binding.test.ts`
+#   (dur=6952ms, its own new criterion; no green round contains it yet — the row keeps the 90%
+#   coverage floor clear: the tree collects 503 server test files and the baseline holds 454 of them).
+6952	server/modules/providers/tests/codex-session-provider-binding.test.ts
+#   The codex-resident-provider-injection row: measured once on 2026-11-03 with
+#   `npx tsx --tsconfig server/tsconfig.json --test server/modules/providers/tests/codex-resident-provider-injection.test.ts`
+#   (dur=8469ms, its own new criterion; no green round contains it yet — the row keeps the 90%
+#   coverage floor clear: the tree collects 504 server test files and the baseline holds 455 of them).
+8469	server/modules/providers/tests/codex-resident-provider-injection.test.ts
+#   The codex-provider-import-user-profile row: measured once on 2026-11-03 with
+#   `npx tsx --tsconfig server/tsconfig.json --test server/modules/settings/tests/codex-provider-import.test.ts`
+#   (dur=1460ms, its own new criterion; no green round contains it yet — the row keeps the 90%
+#   coverage floor clear: the tree collects 505 server test files and the baseline holds 456 of them).
+1460	server/modules/settings/tests/codex-provider-import.test.ts
+#   The codex-provider-advanced-capabilities row: measured once on 2026-11-03 with
+#   `npx tsx --tsconfig server/tsconfig.json --test server/modules/settings/tests/codex-provider-advanced.test.ts`
+#   (dur=12784ms, its own new criterion; no green round contains it yet — the row keeps the 90%
+#   coverage floor clear: the tree collects 506 server test files and the baseline holds 457 of them).
+#   The 12.8s is dominated by the one real bundled-CLI turn and the DNS probe, not by load.
+12784	server/modules/settings/tests/codex-provider-advanced.test.ts

package/scripts/ui-scenario.mjs

@@ -23,6 +23,10 @@
  *       `settings`   — the Settings dialog's Cockpit tab, opened from the sidebar's Settings
  *                      button; the opener waits until the form's own reading is `ready`/`failed`,
  *                      so the first step never catches it mid-load.
+ *       `settings-agents-codex` — Settings → Agents → Codex → Models: the project provider
+ *                      registry with the bound model library and the user-profile import
+ *                      panel; waits until BOTH the registry's and the import panel's own
+ *                      statuses settle (`ready`/`failed`).
  *       `quay-pulse` — the title-bar Loop pulse popover of the session the page is already on;
  *                      the opener presses the trigger and waits for the mention list to settle,
  *                      because that list arrives over the network after the popover mounts.
@@ -550,6 +554,151 @@ function expectationFailures(expect, reading) {
         if (actual !== expected) fail(key, expected, actual);
         break;
       }
+      case 'codexProvidersOpen': {
+        const actual = reading.codexProviders?.open === true;
+        if (actual !== expected) fail(key, expected, actual);
+        break;
+      }
+      case 'codexProvidersStatus': {
+        const actual = reading.codexProviders?.status ?? null;
+        if (actual !== expected) fail(key, expected, actual);
+        break;
+      }
+      case 'codexProvidersError': {
+        const actual = reading.codexProviders?.error ?? null;
+        if (actual !== expected) fail(key, expected, actual);
+        break;
+      }
+      case 'codexProvidersCount': {
+        const actual = reading.codexProviders?.count ?? null;
+        if (actual !== expected) fail(key, expected, actual);
+        break;
+      }
+      case 'codexProviderIds': {
+        // The registry's ids IN DRAW ORDER: a row that silently disappears is observable.
+        const actual = Array.isArray(reading.codexProviders?.ids) ? reading.codexProviders.ids : null;
+        if (!Array.isArray(expected) || !sameJson(actual, expected)) fail(key, expected, actual);
+        break;
+      }
+      case 'codexProviderTokenSet': {
+        // Per row, whether a secret is stored — never the secret itself.
+        const actual = Array.isArray(reading.codexProviders?.tokenSet)
+          ? reading.codexProviders.tokenSet
+          : null;
+        if (!Array.isArray(expected) || !sameJson(actual, expected)) fail(key, expected, actual);
+        break;
+      }
+      case 'codexProviderWarningsInclude': {
+        const warnings = Array.isArray(reading.codexProviders?.warnings)
+          ? reading.codexProviders.warnings.join('\n')
+          : '';
+        if (!warnings.includes(String(expected))) fail(key, expected, warnings);
+        break;
+      }
+      case 'codexResponsesOnlyIncludes': {
+        const actual = reading.codexProviders?.responsesOnly ?? null;
+        if (actual === null || !actual.includes(String(expected))) fail(key, expected, actual);
+        break;
+      }
+      case 'codexModelProvider': {
+        const actual = reading.codexProviders?.modelProvider ?? null;
+        if (actual !== expected) fail(key, expected, actual);
+        break;
+      }
+      case 'codexModelProviderOptions': {
+        const actual = Array.isArray(reading.codexProviders?.modelProviderOptions)
+          ? reading.codexProviders.modelProviderOptions
+          : null;
+        if (!Array.isArray(expected) || !sameJson(actual, expected)) fail(key, expected, actual);
+        break;
+      }
+      case 'codexModelLibraryStatus': {
+        const actual = reading.codexProviders?.modelLibraryStatus ?? null;
+        if (actual !== expected) fail(key, expected, actual);
+        break;
+      }
+      case 'codexModelLibraryNoticeIncludes': {
+        const actual = reading.codexProviders?.modelLibraryNotice ?? null;
+        if (actual === null || !actual.includes(String(expected))) fail(key, expected, actual);
+        break;
+      }
+      case 'codexModelIds': {
+        const actual = Array.isArray(reading.codexProviders?.modelIds)
+          ? reading.codexProviders.modelIds
+          : null;
+        if (!Array.isArray(expected) || !sameJson(actual, expected)) fail(key, expected, actual);
+        break;
+      }
+      case 'codexModelLabelsInclude': {
+        const labels = Array.isArray(reading.codexProviders?.modelLabels)
+          ? reading.codexProviders.modelLabels.join('\n')
+          : '';
+        if (!labels.includes(String(expected))) fail(key, expected, labels);
+        break;
+      }
+      case 'codexImportOpen': {
+        const actual = reading.codexProviders?.importOpen === true;
+        if (actual !== expected) fail(key, expected, actual);
+        break;
+      }
+      case 'codexImportStatus': {
+        const actual = reading.codexProviders?.importStatus ?? null;
+        if (actual !== expected) fail(key, expected, actual);
+        break;
+      }
+      case 'codexImportCount': {
+        const actual = reading.codexProviders?.importCount ?? null;
+        if (actual !== expected) fail(key, expected, actual);
+        break;
+      }
+      case 'codexImportIds': {
+        // The user-profile rows IN DRAW ORDER (`config.toml` first, then profiles).
+        const actual = Array.isArray(reading.codexProviders?.importIds)
+          ? reading.codexProviders.importIds
+          : null;
+        if (!Array.isArray(expected) || !sameJson(actual, expected)) fail(key, expected, actual);
+        break;
+      }
+      case 'codexImportBindable': {
+        // A row this project refuses (reserved id / Chat Completions) reads `false` here.
+        const actual = Array.isArray(reading.codexProviders?.importBindable)
+          ? reading.codexProviders.importBindable
+          : null;
+        if (!Array.isArray(expected) || !sameJson(actual, expected)) fail(key, expected, actual);
+        break;
+      }
+      case 'codexImportEnvKeys': {
+        // The variable NAMES only; a value would have to be a different string.
+        const actual = Array.isArray(reading.codexProviders?.importEnvKeys)
+          ? reading.codexProviders.importEnvKeys
+          : null;
+        if (!Array.isArray(expected) || !sameJson(actual, expected)) fail(key, expected, actual);
+        break;
+      }
+      case 'codexImportBaseUrls': {
+        const actual = Array.isArray(reading.codexProviders?.importBaseUrls)
+          ? reading.codexProviders.importBaseUrls
+          : null;
+        if (!Array.isArray(expected) || !sameJson(actual, expected)) fail(key, expected, actual);
+        break;
+      }
+      case 'codexImportWireApis': {
+        const actual = Array.isArray(reading.codexProviders?.importWireApis)
+          ? reading.codexProviders.importWireApis
+          : null;
+        if (!Array.isArray(expected) || !sameJson(actual, expected)) fail(key, expected, actual);
+        break;
+      }
+      case 'codexImportDirectoryIncludes': {
+        const actual = reading.codexProviders?.importDirectory ?? null;
+        if (actual === null || !actual.includes(String(expected))) fail(key, expected, actual);
+        break;
+      }
+      case 'codexImportError': {
+        const actual = reading.codexProviders?.importError ?? null;
+        if (actual !== expected) fail(key, expected, actual);
+        break;
+      }
       case 'cockpitCardDismissNoticeOk': {
         // The last dismiss answer's outcome, read from the list-level line that outlives the card.
         // `null` (no dismiss attempted yet) is a real reading, not "skip".
@@ -1043,6 +1192,51 @@ async function openSettingsCockpit(page) {
   );
 }
 
+/**
+ * Opens Settings → Agents → Codex → Models: the project provider registry with the bound model
+ * library below it.
+ *
+ * The dialog has no route of its own, so the opener presses the same four controls a person
+ * does: the sidebar's Settings button, the Agents tab, the Codex agent pill, and the Models
+ * category tab. It then waits for the registry's own published status to settle (`ready` or
+ * `failed`), because the reading arrives over the network and a scenario's first `expect` must
+ * not catch it in `loading`.
+ *
+ * @param {import('playwright').Page} page
+ */
+async function openSettingsAgentsCodex(page) {
+  if (!page.url().startsWith('http')) {
+    await page.goto('/');
+  }
+  await waitForSurface(page);
+  const opener = page.locator('[data-testid="open-settings"]:visible').first();
+  await opener.waitFor({ state: 'visible', timeout: BOOT_TIMEOUT_MS });
+  await opener.click();
+  const tab = page.locator('[data-settings-tab="agents"]:visible').first();
+  await tab.waitFor({ state: 'visible', timeout: BOOT_TIMEOUT_MS });
+  await tab.click();
+  const agent = page.locator('[data-settings-agent="codex"]:visible').first();
+  await agent.waitFor({ state: 'visible', timeout: BOOT_TIMEOUT_MS });
+  await agent.click();
+  const category = page.locator('[data-settings-category="models"]:visible').first();
+  await category.waitFor({ state: 'visible', timeout: BOOT_TIMEOUT_MS });
+  await category.click();
+  await page.waitForFunction(
+    () => {
+      const root = /** @type {any} */ (globalThis).document.querySelector('[data-codex-providers]');
+      if (root === null) return false;
+      const status = root.getAttribute('data-codex-providers');
+      // The user-profile import is a second, independent read; a scenario whose first step
+      // asserts it must not catch it mid-load.
+      const importStatus = root.getAttribute('data-codex-import-status');
+      return (status === 'ready' || status === 'failed')
+        && (importStatus === 'ready' || importStatus === 'failed');
+    },
+    undefined,
+    { timeout: PANEL_TIMEOUT_MS },
+  );
+}
+
 /**
  * Opens the title-bar Loop pulse popover for the session already on screen.
  *
@@ -1282,6 +1476,7 @@ async function runScenario(browser, scenario, options) {
             cockpit: () => openCockpit(page),
             'cockpit-cards': () => openCockpitCards(page),
             settings: () => openSettingsCockpit(page),
+            'settings-agents-codex': () => openSettingsAgentsCodex(page),
             'quay-pulse': () => openQuayPulse(page),
             'cost-panel': () => openCostPanel(page, target),
           };

package/scripts/ui-scenarios/codex-provider-import.json

@@ -0,0 +1,63 @@
+{
+  "name": "codex-provider-import",
+  "description": "Settings → Agents → Codex: the user-profile import panel lists the operator's own ~/.codex providers (variable NAMES only, never a secret), one Bind writes the selected provider into the PROJECT registry, and the imported provider becomes a selectable binding for a new model. The isolated instance this runs against starts from an empty CODEX_SETTINGS_PATH and a HOME whose .codex/config.toml declares `bob` and whose bob-gpt.config.toml declares `bob-gpt`.",
+  "steps": [
+    {
+      "open": "settings-agents-codex",
+      "checkpoint": true,
+      "expect": {
+        "codexProvidersOpen": true,
+        "codexProvidersStatus": "ready",
+        "codexProvidersError": null,
+        "codexProvidersCount": 0,
+        "codexProviderIds": [],
+        "codexModelProvider": "",
+        "codexModelProviderOptions": [""],
+        "codexImportOpen": true,
+        "codexImportStatus": "ready",
+        "codexImportCount": 2,
+        "codexImportIds": ["bob", "bob-gpt"],
+        "codexImportBindable": [true, true],
+        "codexImportEnvKeys": ["BOB_API_KEY", "BOB_GPT_API_KEY"],
+        "codexImportBaseUrls": ["http://127.0.0.1:9/v1", "http://127.0.0.1:9/gpt/v1"],
+        "codexImportWireApis": ["responses", "responses"],
+        "codexImportDirectoryIncludes": ".codex",
+        "codexImportError": null
+      }
+    },
+    {
+      "drive": { "codexProvider.import": "bob" },
+      "checkpoint": true,
+      "expect": {
+        "codexProvidersStatus": "ready",
+        "codexProvidersError": null,
+        "codexProvidersCount": 1,
+        "codexProviderIds": ["bob"],
+        "codexModelProviderOptions": ["", "bob"],
+        "codexImportStatus": "ready",
+        "codexImportError": null
+      }
+    },
+    {
+      "drive": { "modelLibrary.setField": { "field": "name", "value": "Scenario Imported Model" } }
+    },
+    {
+      "drive": { "modelLibrary.setField": { "field": "id", "value": "scenario-imported-model" } },
+      "expect": { "codexModelProviderOptions": ["", "bob"] }
+    },
+    {
+      "drive": { "modelLibrary.selectCodexProvider": "bob" },
+      "expect": { "codexModelProvider": "bob" }
+    },
+    {
+      "drive": { "modelLibrary.save": true },
+      "checkpoint": true,
+      "expect": {
+        "codexModelLibraryStatus": "saved",
+        "codexModelLibraryNoticeIncludes": "Scenario Imported Model was added.",
+        "codexModelIds": ["scenario-imported-model"],
+        "codexModelLabelsInclude": "· bob"
+      }
+    }
+  ]
+}

package/scripts/ui-scenarios/codex-provider-settings.json

@@ -0,0 +1,77 @@
+{
+  "name": "codex-provider-settings",
+  "description": "Settings → Agents → Codex → Models: create a project upstream provider (id/baseUrl/envKey/tokenFile + a secret that must be masked), save it, then add a custom Codex model bound to that provider and save it. The instance this runs against starts from an empty CODEX_SETTINGS_PATH, so the first reading has zero providers and the model picker offers only the inherit-default choice.",
+  "steps": [
+    {
+      "open": "settings-agents-codex",
+      "checkpoint": true,
+      "expect": {
+        "codexProvidersOpen": true,
+        "codexProvidersStatus": "ready",
+        "codexProvidersError": null,
+        "codexProvidersCount": 0,
+        "codexProviderIds": [],
+        "codexProviderTokenSet": [],
+        "codexResponsesOnlyIncludes": "responses",
+        "codexModelProvider": "",
+        "codexModelProviderOptions": [""]
+      }
+    },
+    {
+      "drive": { "codexProvider.add": true },
+      "expect": { "codexProvidersCount": 1 }
+    },
+    {
+      "drive": { "codexProvider.fill": { "index": 0, "field": "id", "value": "bob" } }
+    },
+    {
+      "drive": { "codexProvider.fill": { "index": 0, "field": "name", "value": "Bob Endpoint" } }
+    },
+    {
+      "drive": { "codexProvider.fill": { "index": 0, "field": "baseUrl", "value": "http://127.0.0.1:9/v1" } }
+    },
+    {
+      "drive": { "codexProvider.fill": { "index": 0, "field": "envKey", "value": "BOB_API_KEY" } }
+    },
+    {
+      "drive": { "codexProvider.fill": { "index": 0, "field": "tokenFile", "value": "/tmp/cloudpit-dod-bob.token" } }
+    },
+    {
+      "drive": { "codexProvider.fill": { "index": 0, "field": "token", "value": "sk-scenario-secret" } },
+      "checkpoint": true
+    },
+    {
+      "drive": { "codexProvider.save": true },
+      "checkpoint": true,
+      "expect": {
+        "codexProvidersStatus": "ready",
+        "codexProvidersError": null,
+        "codexProvidersCount": 1,
+        "codexProviderIds": ["bob"],
+        "codexProviderTokenSet": [true],
+        "codexModelProviderOptions": ["", "bob"]
+      }
+    },
+    {
+      "drive": { "modelLibrary.setField": { "field": "name", "value": "Scenario Codex Model" } }
+    },
+    {
+      "drive": { "modelLibrary.setField": { "field": "id", "value": "scenario-codex-model" } },
+      "expect": { "codexModelProviderOptions": ["", "bob"] }
+    },
+    {
+      "drive": { "modelLibrary.selectCodexProvider": "bob" },
+      "expect": { "codexModelProvider": "bob" }
+    },
+    {
+      "drive": { "modelLibrary.save": true },
+      "checkpoint": true,
+      "expect": {
+        "codexModelLibraryStatus": "saved",
+        "codexModelLibraryNoticeIncludes": "Scenario Codex Model was added.",
+        "codexModelIds": ["scenario-codex-model"],
+        "codexModelLabelsInclude": "· bob"
+      }
+    }
+  ]
+}

package/scripts/voice-capture-process-check.false-forms.test.mjs

@@ -36,7 +36,7 @@
  *
  *   `startup-line-missing` deletes the one call that announces the mode. It is NOT a bare
  *   deletion: `voiceCapture` is read again eight lines later, so removing the statement outright
- *   makes the module throw at load, the child never prints `CloudCLI Server - Ready`, and the
+ *   makes the module throw at load, the child never prints `Cloudpit Server - Ready`, and the
  *   criterion exits 2 with no readings at all — a red that names nothing, which is the failure
  *   shape this AC is written against. The mutation therefore deletes the announcing call and
  *   inlines the single field the rest of the file reads, which is the smallest single-site change

package/scripts/voice-phase0-report.test.mjs

@@ -446,7 +446,7 @@ test('error forms: every class is counted, rewrites are separated from correctio
   const directory = scratchDir();
   const pairs = [
     ['fan in', 'fan-in', 'form'],
-    ['cloud cli', 'CloudCLI', 'form'],
+    ['needs human', 'needs-human', 'form'],
     ['AC 零零二', 'AC-002', 'spoken-form'],
     ['GOAL 十三', 'GOAL-13', 'spoken-form'],
     ['翻译', 'fan-in', 'cjk-rendering'],