@yalehwang/cloudpit 2.0.0 → 3.0.0

package/server/modules/observation/session-digest.ts

@@ -168,9 +168,14 @@ function blockText(block: UnknownRecord): string {
  * again" after every background task: it opens a new turn span and, for the ask ledger, answers
  * a pending question nobody answered. The other tags are the same kind of row — slash-command
  * and bash-escape bookkeeping, and the metadata blocks the CLI appends.
+ *
+ * `cross-session-message` is another Claude session's SendMessage. It arrives as a `user` row
+ * because it enters this session as a turn, but the person did not type it; counting it as a
+ * prompt answered a pending ask the human had not answered yet.
  */
 const SYNTHETIC_USER_TURN_TAGS = [
   'task-notification',
+  'cross-session-message',
   'system-reminder',
   'local-command-stdout',
   'local-command-stderr',
@@ -182,9 +187,22 @@ const SYNTHETIC_USER_TURN_TAGS = [
   'bash-stderr',
 ] as const;
 
-/** One leading synthetic envelope; matched repeatedly so stacked blocks still strip fully. */
+/**
+ * The fixed lead-in the CLI puts before a peer-session envelope. It is harness prose, not the
+ * person's words, so it strips together with the envelope; older rows that carry no
+ * `origin.kind` marker are still recognised by their text alone.
+ */
+const SYNTHETIC_USER_TURN_LEAD_IN = /^\s*Another Claude session sent a message:\s*/;
+
+/**
+ * One leading synthetic envelope; matched repeatedly so stacked blocks still strip fully.
+ *
+ * The opening tag may carry attributes (`<cross-session-message from="…" from-name="…">`), so
+ * the name is followed by an optional attribute run. Matching only the bare form left those
+ * envelopes in place and made the whole row read as a prompt.
+ */
 const SYNTHETIC_USER_TURN_ENVELOPE = new RegExp(
-  `^\\s*<(${SYNTHETIC_USER_TURN_TAGS.join('|')})>[\\s\\S]*?<\\/\\1>`,
+  `^\\s*<(${SYNTHETIC_USER_TURN_TAGS.join('|')})(?:\\s[^>]*)?>[\\s\\S]*?<\\/\\1>`,
 );
 
 /**
@@ -195,7 +213,7 @@ const SYNTHETIC_USER_TURN_ENVELOPE = new RegExp(
  * prompt — the whole block must strip to emptiness to stop being one.
  */
 function isSyntheticUserText(text: string): boolean {
-  let remainder = text;
+  let remainder = text.replace(SYNTHETIC_USER_TURN_LEAD_IN, '');
   for (;;) {
     const match = SYNTHETIC_USER_TURN_ENVELOPE.exec(remainder);
     if (match === null) break;
@@ -204,17 +222,33 @@ function isSyntheticUserText(text: string): boolean {
   return remainder.trim() === '';
 }
 
+/**
+ * Whether this row is a message another Claude session injected, not the person speaking.
+ *
+ * The CLI writes such a row as `isMeta: true` with `origin.kind === 'peer'` and
+ * `turnOrigin === 'peer'`. Checking the origin first is what makes the rule independent of the
+ * envelope's prose and attributes; the text fallback in {@link isSyntheticUserText} covers
+ * older rows that predate the origin fields.
+ */
+function isPeerInjectedRow(row: UnknownRecord): boolean {
+  const origin = row.origin;
+  if (isRecord(origin) && origin.kind === 'peer') return true;
+  return row.turnOrigin === 'peer';
+}
+
 /**
  * Whether one row is a real prompt — a person's message, not a tool result and not a
  * harness-injected synthetic turn.
  *
  * Claude records tool results as `user` rows. Treating those as turn boundaries would split a
  * single turn at every tool call, so the boundary is a row that carries non-empty text. A
- * `<task-notification>` row also carries non-empty text, but nobody typed it: counting it as a
- * prompt makes a pending ask look answered and shifts the digest's turn boundary.
+ * `<task-notification>` or cross-session `user` row also carries non-empty text, but nobody
+ * typed it: counting it as a prompt makes a pending ask look answered and shifts the digest's
+ * turn boundary.
  */
 export function isUserPromptRow(row: UnknownRecord): boolean {
   if (transcriptRowRole(row) !== 'user') return false;
+  if (isPeerInjectedRow(row)) return false;
   const texts = rowContentBlocks(row)
     .filter((block) => block.type === 'text')
     .map(blockText)

package/server/modules/observation/tests/architecture-delta.test.ts

@@ -311,7 +311,7 @@ test('AC1: the producer writes the snapshot and diff, and throttles a second tri
   const target = {
     projectId: CLOUD_PROJECT_ID,
     fleetProjectId: FLEET_PROJECT_ID,
-    title: 'CloudCLI',
+    title: 'Cloudpit',
     sessionId: 'session-42',
   };
 

package/server/modules/observation/tests/observation-routes.test.ts

@@ -202,6 +202,19 @@ test('AC3: an invalid URI or revision is a 400, not a stored object', async () =
     });
     assert.equal(badSeenUri.status, 400);
 
+    // The retired 2.x spelling is not a valid address any more, even in its well-formed shape.
+    const retiredSpelling = await fetch(`${baseUrl}/api/observation/seen`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ uri: 'cloudcli://session/retired', revision: 1 }),
+    });
+    assert.equal(retiredSpelling.status, 400);
+    const retiredWatch = await fetch(
+      `${baseUrl}/api/observation/watch/${encodeURIComponent('cloudcli://session/retired')}`,
+      { method: 'PUT' },
+    );
+    assert.equal(retiredWatch.status, 400);
+
     const badRevision = await fetch(`${baseUrl}/api/observation/seen`, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },

package/server/modules/observation/tests/observation-store.test.ts

@@ -229,3 +229,61 @@ test('AC2: past the cap the wall sorts red > attention > ok by recent revision a
     'attention entries are newest-first, so the last SHOWN one is the second-oldest',
   );
 });
+
+// ---------------------------------------------------------------------------
+// 3.0 — one spelling: the legacy cloudcli:// read and storage fallback are gone
+// ---------------------------------------------------------------------------
+
+const LEGACY_AT = 3_000_000;
+
+/** Seeds a row exactly as the 2.0 writer would have left it: the storage key is `cloudcli://`. */
+function seedLegacyObject(uri: string, kind: 'session' | 'architecture', revision: number): void {
+  const db = getConnection();
+  db.prepare(
+    `INSERT INTO observed_objects (
+       uri, kind, title, status_state, status_reason, digest_json, revision, updated_at,
+       provenance_producer, provenance_tier, provenance_evaluated_at
+     ) VALUES (?, ?, ?, 'attention', 'waiting', '{}', ?, ?, 'legacy-producer', 'deterministic', ?)`,
+  ).run(uri, kind, `${kind} fixture`, revision, LEGACY_AT, LEGACY_AT);
+  db.prepare(
+    'INSERT INTO observed_revisions (uri, revision, at, delta_items_json) VALUES (?, ?, ?, ?)',
+  ).run(uri, revision, LEGACY_AT, JSON.stringify([`legacy-${uri}`]));
+}
+
+test('3.0: a legacy cloudcli:// read is refused and never falls back to a legacy storage row', () => {
+  // A 2.0-era row, seeded under the legacy key exactly as the 2.0 writer left it.
+  seedLegacyObject('cloudcli://session/a', 'session', 2);
+  seedLegacyObject('cloudcli://architecture/b', 'architecture', 4);
+
+  assert.equal(store.getObject('cloudcli://session/a'), null, 'the retired spelling no longer parses');
+  assert.equal(store.getObject('cloudpit://session/a'), null, 'the store no longer reads the legacy key');
+  assert.equal(store.getObject('cloudcli://architecture/b'), null);
+  assert.equal(store.getObject('cloudpit://architecture/b'), null);
+
+  assert.throws(
+    () => store.listRevisions('cloudcli://session/a', 0),
+    /must be one of cloudpit:\/\/session\/<id>/,
+    'the retired spelling is not a valid address for a read',
+  );
+  assert.deepEqual(store.getWall(USER_ID).entries, [], 'a legacy-key row does not surface on the wall');
+});
+
+test('3.0: a write addresses only the canonical key; a legacy row is not continued', () => {
+  seedLegacyObject('cloudcli://session/chain', 'session', 2);
+
+  const written = store.writeRevision({
+    uri: 'cloudpit://session/chain',
+    kind: 'session',
+    title: 'Fresh canonical chain',
+    status: { state: 'ok' },
+    provenance: { producer: PRODUCER, tier: 'deterministic' },
+  });
+
+  assert.equal(written.uri, 'cloudpit://session/chain', 'the reading is canonical');
+  assert.equal(written.revision, 1, 'the legacy row is not the canonical chain');
+  assert.equal(store.getObject('cloudpit://session/chain')?.revision, 1);
+  assert.deepEqual(
+    store.listRevisions('cloudpit://session/chain', 0).map((revision) => revision.revision),
+    [1],
+  );
+});

package/server/modules/observation/tests/project-truth.test.ts

@@ -87,7 +87,7 @@ function makeProject(overrides: Partial<ProjectTruthProjectRef> = {}): ProjectTr
   return {
     projectId: CLOUD_PROJECT_ID,
     projectPath: '/data/home/yale/work/claudecodeui',
-    title: 'CloudCLI',
+    title: 'Cloudpit',
     fleetProjectId: FLEET_PROJECT_ID,
     deploy: { healthUrl: 'http://127.0.0.1:3001', ref: 'HEAD' },
     ...overrides,
@@ -237,7 +237,7 @@ test('AC1: a snapshot fixture yields all five layers, each from its own source',
   assert.ok(!reading.deltaItems.includes('落地 landed earlier'));
 });
 
-test('AC1: a non-CloudCLI project reads deploy as not-applicable, is not green and is not reddened by the reader', () => {
+test('AC1: a non-Cloudpit project reads deploy as not-applicable, is not green and is not reddened by the reader', () => {
   const reading = build({
     project: makeProject({ fleetProjectId: 'plantuml-js', deploy: null }),
     // Deliberately a failing reader: a project with no deployment concept must not be turned

package/server/modules/observation/tests/session-ask-decision-digest.test.ts

@@ -1574,6 +1574,81 @@ test('option identity: the model-provided id is NEVER written into the decision'
   }
 });
 
+// ---------------------------------------------------------------------------------------------
+// Multi-subdecision bundling: the prompt asks for 3–5 composite options, and the pipeline keeps them
+//
+// When one assistant message asks three INDEPENDENT design points (each A-or-B), flattening them
+// into 6 half-direction options breaks the cockpit's single-select UI: a person can pick only one
+// of six. The model is therefore asked to bundle them into 3–5 self-consistent combinations. This
+// case pins that the parser/summary pipeline accepts that shape unchanged (the parser imposes no
+// option-count ceiling) and that stable ids still derive from the labels.
+// ---------------------------------------------------------------------------------------------
+
+/** The model answer for the multi-subdecision fixture: three composite options, whole coverage. */
+const COMPOSITE_ANSWER = {
+  ask: '三个设计点（①是否拆包、②是否改接口、③是否补迁移）各选 A 还是 B，请一次定下组合。',
+  situation: '助手一次问了三个相互独立的子决定，每个都要在 A 还是 B 之间选。',
+  incomplete: false,
+  recommendedOptionId: null,
+  judgeOptionId: null,
+  judgeReason: null,
+  options: [
+    {
+      id: 'bundle-all-a',
+      label: '①A+②A+③A',
+      does: '①保持单包；②接口不变；③现在补迁移。',
+      tags: [{ kind: 'consequence', text: '全部保持现状' }],
+      source: 'assistant',
+    },
+    {
+      id: 'bundle-all-b',
+      label: '①B+②B+③B',
+      does: '①拆包；②改接口；③不补迁移。',
+      tags: [{ kind: 'risk', text: '改动最大' }],
+      source: 'assistant',
+    },
+    {
+      id: 'bundle-mixed',
+      label: '①A+②B+③A',
+      does: '①保持单包；②改接口；③现在补迁移。',
+      tags: [{ kind: 'benefit', text: '接口与迁移先落地' }],
+      source: 'assistant',
+    },
+  ],
+};
+
+test('multi-subdecision: three composite options survive the digest verbatim, ids derived from labels', async () => {
+  const summariser = createSessionAskDecisionDigest({
+    readSettings: () => STUB_SETTINGS,
+    complete: async () => completion(JSON.stringify(COMPOSITE_ANSWER)),
+  });
+
+  const reading = await summariser.summarize({
+    sessionId: SESSION_ID,
+    sessionTitle: '会话',
+    askId: `${SESSION_ID}:a1`,
+    revision: 1,
+    assistantText:
+      '三个设计点，每个都要选 A 还是 B：\n①是否拆包？A 保持单包，B 拆包。\n②是否改接口？A 不变，B 改。\n③是否补迁移？A 现在补，B 不补。\n请一次定下组合。',
+    context:
+      '[助手] 三个设计点，每个都要选 A 还是 B：\n①是否拆包？A 保持单包，B 拆包。\n②是否改接口？A 不变，B 改。\n③是否补迁移？A 现在补，B 不补。\n请一次定下组合。',
+  });
+
+  assert.equal(reading.state, 'evaluated', 'the pipeline accepts the bundled shape');
+  if (reading.state !== 'evaluated') return;
+  assert.equal(reading.options.length, 3, 'three bundled options are kept, not flattened into six');
+  assert.deepEqual(
+    reading.options.map((option) => option.label),
+    COMPOSITE_ANSWER.options.map((option) => option.label),
+    'the labels keep the declared order, verbatim',
+  );
+  assert.deepEqual(
+    reading.options.map((option) => option.id),
+    COMPOSITE_ANSWER.options.map((option) => stableOptionId(option.label)),
+    'bundling does not change identity: each id is still derived from the label',
+  );
+});
+
 // ---------------------------------------------------------------------------------------------
 // Reliable session.answered: every answered ask, across rounds and across restarts, exactly once
 // ---------------------------------------------------------------------------------------------
@@ -2217,6 +2292,120 @@ test('AC3: turn-end states no session.answered for a <task-notification> row', a
   assert.deepEqual(ledger.pending, [{ askId: `${SESSION_ID}:a1`, messageId: 'a1' }], 'the ask stays open');
 });
 
+// ---------------------------------------------------------------------------------------------
+// A cross-session message is not a user prompt either: it must not answer a pending ask
+// ---------------------------------------------------------------------------------------------
+
+/**
+ * One peer row exactly as the CLI persists another session's SendMessage: a fixed lead-in, an
+ * attribute-bearing envelope, and the row markers that say a machine injected it.
+ */
+function crossSessionRow(id: string): string {
+  return JSON.stringify({
+    type: 'user',
+    uuid: id,
+    isMeta: true,
+    promptSource: 'system',
+    turnOrigin: 'peer',
+    origin: { kind: 'peer', from: 'uds:/tmp/peer.sock', name: 'peer' },
+    message: {
+      role: 'user',
+      content:
+        'Another Claude session sent a message:\n'
+        + '<cross-session-message from="uds:/tmp/peer.sock" from-name="peer" from-mode="bypass">\n'
+        + '选 2\n'
+        + '</cross-session-message>',
+    },
+  });
+}
+
+/** The transcript up to a question, then another session's message — no answer from the person. */
+function askThenCrossSession(): string {
+  return `${[
+    stringContentRow('user', 'u1', '开始'),
+    stringContentRow('assistant', 'a1', '先补测试还是先改实现？'),
+    crossSessionRow('p1'),
+  ].join('\n')}\n`;
+}
+
+test('a cross-session-message row after a pending ask leaves it current, not settled', () => {
+  const scan = readSessionAsks(askThenCrossSession(), SESSION_ID);
+
+  assert.deepEqual(scan.settled, [], 'another session speaking is not the person answering');
+  assert.equal(scan.current?.askId, `${SESSION_ID}:a1`, 'the ask is still the open question');
+  assert.equal(scan.current?.revision, 1);
+});
+
+test('a real user message still settles the ask, even after a cross-session-message row', () => {
+  const raw = `${[
+    stringContentRow('user', 'u1', '开始'),
+    stringContentRow('assistant', 'a1', '先补测试还是先改实现？'),
+    crossSessionRow('p1'),
+    stringContentRow('user', 'u2', '先补测试'),
+    stringContentRow('assistant', 'a2', '补完了，还要先跑一遍吗？'),
+  ].join('\n')}\n`;
+  const scan = readSessionAsks(raw, SESSION_ID);
+
+  assert.deepEqual(
+    scan.settled,
+    [{ askId: `${SESSION_ID}:a1`, answerMessageId: 'u2' }],
+    'the answer is the person\'s row, never the peer row',
+  );
+  assert.equal(scan.current?.askId, `${SESSION_ID}:a2`, 'the tail ask is the newer question');
+});
+
+test('turn-end states no session.answered for a cross-session-message row', async () => {
+  const objects = new Map<string, ObservedObject>();
+  objects.set(formatSessionUri(SESSION_ID), {
+    uri: formatSessionUri(SESSION_ID),
+    kind: 'session',
+    title: '会话：选中方案',
+    status: { state: 'attention' },
+    digest: {
+      activity: 'waiting',
+      askEvents: {
+        answered: [],
+        asking: [`${SESSION_ID}:a1:1`],
+        pending: [{ askId: `${SESSION_ID}:a1`, messageId: 'a1' }],
+      },
+    },
+    blindSpots: [],
+    revision: 1,
+    updatedAt: CLOCK,
+    provenance: { producer: 'session-digest', tier: 'deterministic', evaluatedAt: CLOCK },
+  });
+  const harness = createHarness(JSON.stringify(RECOMMENDED_ANSWER), { objects });
+  harness.setTranscript(askThenCrossSession());
+
+  await harness.turnEnd();
+
+  assert.deepEqual(
+    harness.events.filter((event) => event.kind === 'session.answered'),
+    [],
+    'no answer is stated when only another session spoke',
+  );
+  const ledger = readSessionAskEventLedger(objects.get(formatSessionUri(SESSION_ID))?.digest);
+  assert.deepEqual(ledger.pending, [{ askId: `${SESSION_ID}:a1`, messageId: 'a1' }], 'the ask stays open');
+
+  // The person's own reply still settles it exactly once, with the person's message id. The
+  // assistant turn after it is what a real stop hook sees; without it the transcript ends on a
+  // user row and the digest is unevaluated for a different reason.
+  const secondRaw = `${askThenCrossSession()}${stringContentRow('user', 'u2', '先补测试')}\n${stringContentRow('assistant', 'a2', '好的，先补测试。')}\n`;
+  harness.setTranscript(secondRaw);
+  await harness.turnEnd();
+  const answered = harness.events.filter((event) => event.kind === 'session.answered');
+  assert.equal(answered.length, 1);
+  assert.deepEqual((answered[0]?.data as { messageId?: string } | undefined)?.messageId, 'u2');
+
+  // A replay of the same transcript must not state the answer twice.
+  await harness.turnEnd();
+  assert.equal(
+    harness.events.filter((event) => event.kind === 'session.answered').length,
+    1,
+    'the stated answer survives a turn-end replay',
+  );
+});
+
 // ---------------------------------------------------------------------------------------------
 // The ask digest's JSON contract: its own output ceiling, fences, and a loud truncation
 // ---------------------------------------------------------------------------------------------

package/server/modules/observation/tests/session-digest.test.ts

@@ -42,6 +42,7 @@ import {
   analyzeAsking,
   analyzeAssistantAsk,
   buildSessionDigest,
+  isUserPromptRow,
   parseTestOutput,
   SESSION_DIGEST_CONCLUSION_CHARS,
 } from '../session-digest.js';
@@ -1204,3 +1205,45 @@ test('AC7: the live 62d959c0 fixture is a real question — no retraction, and t
   assert.equal(answered.length, 1, 'the live gap was a missing session.answered');
   assert.deepEqual(answered[0]?.data, { askId, messageId: 'u2' });
 });
+
+test('a cross-session peer row is not a user prompt, in either the marker or the text shape', () => {
+  const envelope = 'Another Claude session sent a message:\n'
+    + '<cross-session-message from="uds:/tmp/peer.sock" from-name="peer" from-mode="bypass">\n'
+    + '选 2\n'
+    + '</cross-session-message>';
+
+  // The live shape: the CLI marks the row as machine-injected and names the peer origin.
+  assert.equal(
+    isUserPromptRow({
+      type: 'user',
+      isMeta: true,
+      promptSource: 'system',
+      turnOrigin: 'peer',
+      origin: { kind: 'peer', from: 'uds:/tmp/peer.sock' },
+      message: { role: 'user', content: envelope },
+    }),
+    false,
+    'the person did not type the other session\'s message',
+  );
+
+  // An older row without the origin marker still reads as synthetic from its text alone.
+  assert.equal(
+    isUserPromptRow({ type: 'user', message: { role: 'user', content: envelope } }),
+    false,
+    'the envelope and its fixed lead-in strip to emptiness',
+  );
+
+  // A person's own words stay a prompt, including when they sit beside a metadata block.
+  assert.equal(
+    isUserPromptRow({ type: 'user', message: { role: 'user', content: '选 1，立任务' } }),
+    true,
+  );
+  assert.equal(
+    isUserPromptRow({
+      type: 'user',
+      message: { role: 'user', content: '<system-reminder>note</system-reminder>\n选 1，立任务' },
+    }),
+    true,
+    'a real block beside an injected one still means the person spoke',
+  );
+});

package/server/modules/providers/index.ts

@@ -2,6 +2,19 @@ export { sessionSynchronizerService } from './services/session-synchronizer.serv
 export { providerSkillsService } from './services/skills.service.js';
 export { providerMcpService } from './services/mcp.service.js';
 export { providerRuntimeService, createProviderRuntimeService } from './services/provider-runtime.service.js';
+// The Codex upstream-provider adapter and its two injection compilers. They are
+// public because the Settings module's AC-467 criterion drives the end-to-end
+// path across a module boundary (where the boundaries lint requires this
+// barrel), and because a settings surface that renders the same advanced fields
+// needs one compiler rather than a second copy. `codexRuntime` is the per-run
+// entry the registry composes, re-exported for the same criterion.
+export { codexRuntime } from './list/codex/codex-runtime.provider.js';
+export { CodexProviderModels, CODEX_PREDEFINED_MODELS } from './list/codex/codex-models.provider.js';
+export {
+  codexOptionsForProvider,
+  codexProviderSpawnArgs,
+  type CodexModelLimits,
+} from './list/codex/codex-provider-injection.js';
 // ControlStopTaskOutcome: the answer the runtime gateway's stop-task verb gives
 // (`requested` / `unsupported` / `timeout` / `error`). Exported so the websocket
 // control handler types its pass-through against the one union rather than

package/server/modules/providers/list/claude/claude-host-driver.provider.ts

@@ -1087,7 +1087,7 @@ export function deriveBackgroundWorkTrigger(
 // The address a resident process answers to used to be *computed* here and
 // handed to the CLI as `--name`. That is gone: in the CLI's ladder a launch name
 // is both the session's `agent-name` and its `custom-title`, so writing one
-// pinned the session's name at launch, let a CloudCLI-invented address outrank
+// pinned the session's name at launch, let a Cloudpit-invented address outrank
 // an `ai-title` the session had earned, and grew another `-<id6>` on every
 // restart. The app no longer names anything; it reads the name the CLI derived
 // for the process, in `readCliSessionRegistration` below.

package/server/modules/providers/list/codex/codex-app-server.client.ts

@@ -58,7 +58,21 @@ export type CodexModelDescriptor = {
   hidden?: boolean;
   isDefault?: boolean;
   defaultReasoningEffort?: string;
-  supportedReasoningEfforts?: Array<{ reasoningEffort?: string }>;
+  supportedReasoningEfforts?: Array<{ reasoningEffort?: string; description?: string }>;
+  /**
+   * A custom catalog (`model_catalog_url`) may declare the model's window and
+   * auto-compaction threshold per entry. Codex 0.166's own `model/list` reply
+   * does not carry them, so they stay optional and are read from either the
+   * Codex-native snake_case or the app's camelCase spelling.
+   */
+  modelContextWindow?: number;
+  modelAutoCompactTokenLimit?: number;
+};
+
+/** Reads a positive integer quantity a catalog entry may report; anything else is absent. */
+const readPositiveModelQuantity = (value: unknown): number | undefined => {
+  const parsed = typeof value === 'number' ? value : Number(value);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : undefined;
 };
 
 const readModelDescriptor = (value: unknown): CodexModelDescriptor | null => {
@@ -72,11 +86,25 @@ const readModelDescriptor = (value: unknown): CodexModelDescriptor | null => {
 
   const efforts = Array.isArray(record.supportedReasoningEfforts)
     ? record.supportedReasoningEfforts
-      .map((entry) => readOptionalString(readObjectRecord(entry)?.reasoningEffort))
-      .filter((effort): effort is string => effort !== undefined)
-      .map((reasoningEffort) => ({ reasoningEffort }))
+      .map((entry) => {
+        const effort = readOptionalString(readObjectRecord(entry)?.reasoningEffort);
+        if (effort === undefined) return undefined;
+        const description = readOptionalString(readObjectRecord(entry)?.description);
+        return {
+          reasoningEffort: effort,
+          ...(description === undefined ? {} : { description }),
+        };
+      })
+      .filter((effort): effort is { reasoningEffort: string; description?: string } => effort !== undefined)
     : undefined;
 
+  const contextWindow = readPositiveModelQuantity(
+    record.model_context_window ?? record.modelContextWindow,
+  );
+  const autoCompactTokenLimit = readPositiveModelQuantity(
+    record.model_auto_compact_token_limit ?? record.modelAutoCompactTokenLimit,
+  );
+
   return {
     id,
     displayName: readOptionalString(record.displayName),
@@ -85,6 +113,10 @@ const readModelDescriptor = (value: unknown): CodexModelDescriptor | null => {
     isDefault: typeof record.isDefault === 'boolean' ? record.isDefault : undefined,
     defaultReasoningEffort: readOptionalString(record.defaultReasoningEffort),
     supportedReasoningEfforts: efforts,
+    ...(contextWindow === undefined ? {} : { modelContextWindow: contextWindow }),
+    ...(autoCompactTokenLimit === undefined
+      ? {}
+      : { modelAutoCompactTokenLimit: autoCompactTokenLimit }),
   };
 };
 
@@ -278,7 +310,7 @@ async function withAppServer<T>(
     // in the stable protocol; only `beforeTurnId` and the turn-listing methods
     // are gated behind `experimentalApi`, and neither is needed here.
     await call('initialize', {
-      clientInfo: { name: 'cloudcli', title: 'CloudCLI', version: '1' },
+      clientInfo: { name: 'cloudpit', title: 'Cloudpit', version: '1' },
       capabilities: {},
     });
     child.stdin?.write(`${JSON.stringify({ jsonrpc: '2.0', method: 'initialized', params: {} })}\n`);

package/server/modules/providers/list/codex/codex-app-server.connection.ts

@@ -213,7 +213,7 @@ export class CodexAppServerConnection {
       ? { experimentalApi: true }
       : {};
     await this.request('initialize', {
-      clientInfo: { name: 'cloudcli', title: 'CloudCLI', version: '1' },
+      clientInfo: { name: 'cloudpit', title: 'Cloudpit', version: '1' },
       capabilities,
     });
     this.experimentalApiDeclaredFlag = capabilities.experimentalApi === true;

package/server/modules/providers/list/codex/codex-host-driver.contract.ts

@@ -123,6 +123,13 @@ export type ResidentSession = {
 export type PendingResidentLaunch = {
   providerSessionId: string | null;
   threadDefaults: CodexThreadDefaults;
+  /**
+   * The process launch this session's host must be spawned with, or null for
+   * the driver-wide launch. Compiled by `codex-resident-provider-launch.ts`:
+   * Codex 0.166 checks the process-global provider on every turn and again on
+   * resume, so a bound session needs `-c model_provider` at spawn time.
+   */
+  launch: CodexAppServerLaunch | null;
 };
 
 /** Reads `{ thread: { id } }` from a thread start/resume result. */
@@ -176,7 +183,7 @@ export function residentThreadDefaults(options: AnyRecord): CodexThreadDefaults
 }
 
 /**
- * The `thread/start` fields a CloudCLI permission mode asks for.
+ * The `thread/start` fields a Cloudpit permission mode asks for.
  *
  * `thread/start` takes a `sandbox` *string* (`workspace-write`,
  * `danger-full-access`), while live settings take an object `sandboxPolicy`
@@ -239,11 +246,13 @@ export function threadDefaultsFromLaunchOptions(options: AnyRecord): CodexThread
 /**
  * The MCP server name this server's gateway is injected under.
  *
- * `cloudcli` is the name the settings page tells a Claude user to connect
- * (`claude mcp add --transport http cloudcli …`), so a Codex session and a Claude
+ * `cloudpit` is the name the settings page tells a Claude user to connect
+ * (`claude mcp add --transport http cloudpit …`), so a Codex session and a Claude
  * session name the same backend the same way; nothing in the driver reads it.
+ * An existing `claude mcp add … cloudcli` entry keeps working: the server name is
+ * a client-local key and authentication comes from the URL plus the PAT.
  */
-export const CODEX_MCP_GATEWAY_SERVER_NAME = 'cloudcli';
+export const CODEX_MCP_GATEWAY_SERVER_NAME = 'cloudpit';
 
 /**
  * The child environment variable that carries the gateway credential.
@@ -253,7 +262,7 @@ export const CODEX_MCP_GATEWAY_SERVER_NAME = 'cloudcli';
  * never appears in the process arguments — an argv token is visible to every
  * `ps` on the machine and to the app-server's own logs.
  */
-export const CODEX_MCP_GATEWAY_TOKEN_ENV = 'CLOUDCLI_MCP_GATEWAY_TOKEN';
+export const CODEX_MCP_GATEWAY_TOKEN_ENV = 'CLOUDPIT_MCP_GATEWAY_TOKEN';
 
 /** One `-c key=value` config override, with the value written as a TOML basic string. */
 function codexConfigArg(key: string, value: string): string[] {
@@ -274,8 +283,8 @@ function tomlBasicString(value: string): string {
  *
  * When a target is present the child is told about one extra HTTP MCP server:
  *
- *   -c mcp_servers.cloudcli.url="http://127.0.0.1:<port>/mcp"
- *   -c mcp_servers.cloudcli.bearer_token_env_var="CLOUDCLI_MCP_GATEWAY_TOKEN"
+ *   -c mcp_servers.cloudpit.url="http://127.0.0.1:<port>/mcp"
+ *   -c mcp_servers.cloudpit.bearer_token_env_var="CLOUDPIT_MCP_GATEWAY_TOKEN"
  *
  * and the token is placed in the child's environment. That is the same config
  * shape `codex.mcp` writes to `config.toml` (`url` + `bearer_token_env_var`), so
@@ -349,7 +358,7 @@ export function threadParams(
  * app-server, copied from its own refusal: "Supported values are: 'none',
  * 'minimal', 'low', 'medium', 'high', 'xhigh', and 'max'."
  *
- * CloudCLI's vocabulary is wider than this: `default` is its "use the model's
+ * Cloudpit's vocabulary is wider than this: `default` is its "use the model's
  * default" sentinel (`DEFAULT_EFFORT_VALUE` in `src/shared/constants.ts`) and
  * `ultracode` is a Claude-only pseudo-level. Neither is a codex effort, and the
  * server rejects the whole `turn/start` with a 400 for one unknown value, so a
@@ -365,7 +374,7 @@ const CODEX_EFFORT_VALUES: Readonly<Record<string, true>> = {
   max: true,
 };
 
-/** The codex `effort` for one CloudCLI effort, or undefined to leave the field off. */
+/** The codex `effort` for one Cloudpit effort, or undefined to leave the field off. */
 function codexTurnEffort(effort: unknown): string | undefined {
   return typeof effort === 'string' && CODEX_EFFORT_VALUES[effort] === true ? effort : undefined;
 }