super-dsh 0.1.10-e → 0.1.11

package/agent-codex/dist/codex-provider-gateway.js

@@ -1,34 +1,3 @@
-/**
- * codex-provider-gateway.ts — the adapter-owned Remote behind the Hub's Codex
- * settings panel (2026-10-03 user ruling; reworked 2026-10-04).
- *
- * Why a Remote and not a hub route: the provider list is ADAPTER config
- * (dev-rules §12), so the adapter owns it and the hub only forwards.
- * `TypertRemoteService` + `@Remote` is the whole mechanism — standard (TC39)
- * method decorators recorded on the class prototype, read back at dispatch time
- * by the gateway's source-claim scan. No codegen, no compiler-injected metadata,
- * which is why a plain `tsc` adapter build can ship one.
- *
- * Wire contract (`superd-hub/src/client/runtime-settings-api.ts` builds each
- * envelope; the hub carrier forwards `envelope.method` verbatim):
- *
- *   request   POST /hub/api?agent=codex
- *             { type:'client-request', rpcId, method:'codexProviders/<op>',
- *               payload: { args: { request?: … } } }
- *   response  { type:'server-response', rpcId, result:{ ok:true, value:<view> } }
- *
- * There is no `select`: which provider a SESSION runs on is DSH's own
- * per-session `model/selection`, chosen from the harness's model selector. This
- * panel is a list editor — add, edit, remove — plus the reconcile with the
- * user's `config.toml` that {@link syncFromNative} performs.
- *
- * The class is a delegation shell on purpose: every operation is a plain
- * function over (worldHome, codexHome), so the entire contract — the key
- * privacy rule, the validation, the sync, the view projection — is pinnable
- * under `node --test` with no Cordis Context and no real home.
- *
- * @module agent-codex/codex-provider-gateway
- */
 var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
     var useValue = arguments.length > 2;
     for (var i = 0; i < initializers.length; i++) {
@@ -63,6 +32,7 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     if (target) Object.defineProperty(target, contextIn.name, descriptor);
     done = true;
 };
+import { OPENAI_OAUTH_ID, hasOpenAiOAuth, openAiOAuthEntry } from "./codex-oauth.js";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { isProviderId, isWireProtocol, providerStorePath, readProviderStore, removeProvider, syncNativeProviders, upsertProvider, writeProviderStore, } from "./codex-providers.js";
 import { providerCatalogDir, readNativeProviders, readNativeSelection, } from "./codex-native-config.js";
@@ -134,6 +104,8 @@ function keyAvailable(codexHome, entry) {
     return nonEmpty(process.env[entry.auth.name]) !== undefined;
 }
 function project(codexHome, entry) {
+    if (entry.kind === "openai-oauth")
+        return { id: entry.id, label: entry.label, protocol: "responses", models: openAiOAuthEntry(codexHome).models, authKind: "oauth", hasKey: hasOpenAiOAuth(codexHome) };
     return {
         id: entry.id,
         label: entry.label,
@@ -172,10 +144,22 @@ export function syncFromNative(worldHome, codexHome) {
     const store = readProviderStore(worldHome);
     const imported = readNativeProviders(codexHome).map(toImport);
     const result = syncNativeProviders(store, imported);
-    if (result.added.length > 0 || result.updated.length > 0) {
-        writeProviderStore(worldHome, result.store);
-    }
-    return result;
+    const legacyAlias = result.store.providers.some(entry => entry.id === OPENAI_OAUTH_ID && entry.kind !== "openai-oauth");
+    const blockedNativeIds = [...new Set([...(result.store.blockedNativeIds ?? []), ...(legacyAlias ? [OPENAI_OAUTH_ID] : [])])];
+    const oauth = hasOpenAiOAuth(codexHome) && !blockedNativeIds.includes(OPENAI_OAUTH_ID);
+    const existed = store.providers.some(entry => entry.kind === "openai-oauth");
+    // Keep collided identities on disk so ambiguous old routes fail closed. They
+    // are quarantined by readEffectiveProviderStore, not silently repurposed.
+    const providers = result.store.providers.flatMap(entry => entry.kind === "openai-oauth"
+        ? legacyAlias || oauth ? [openAiOAuthEntry(codexHome)] : [] : [entry]);
+    if (oauth && !existed)
+        providers.push(openAiOAuthEntry(codexHome));
+    const effective = { ...result.store, providers, ...(blockedNativeIds.length === 0 ? {} : { blockedNativeIds }) };
+    const blockedChanged = JSON.stringify(blockedNativeIds) !== JSON.stringify(store.blockedNativeIds ?? []);
+    const identityChanged = !legacyAlias && oauth !== existed;
+    if (result.added.length > 0 || result.updated.length > 0 || identityChanged || blockedChanged)
+        writeProviderStore(worldHome, effective);
+    return { ...result, store: effective };
 }
 /** The view for one (already loaded) store. */
 function viewOf(worldHome, codexHome, store, syncedAt, note) {
@@ -189,13 +173,19 @@ function viewOf(worldHome, codexHome, store, syncedAt, note) {
     // Only a SEEDED keyed entry defers to auth.json, so only it can be shadowed
     // by a ChatGPT login. An entry holding its own key bypasses the auth manager
     // entirely through the launch's synthetic `env_key`.
-    const deferred = store.providers.some((entry) => entry.auth.kind === "apiKey" && entry.auth.value === "");
+    const deferred = store.providers.some((entry) => entry.kind !== "openai-oauth" && entry.auth.kind === "apiKey" && entry.auth.value === "");
     const shadowed = deferred && chatgptAuthMode(codexHome)
         ? 'Codex is signed in with a ChatGPT account, which takes precedence over a saved API key — a provider that relies on auth.json will not run until you sign out (`codex logout`) or give this provider its own key.'
         : undefined;
-    const combined = [note, shadowed].filter((part) => part !== undefined).join(" ");
+    const nativeAlias = readNativeProviders(codexHome).some(entry => entry.id === OPENAI_OAUTH_ID);
+    const blocked = store.blockedNativeIds?.includes(OPENAI_OAUTH_ID) === true;
+    const duplicate = store.providers.filter(entry => entry.id === OPENAI_OAUTH_ID).length > 1;
+    const collision = blocked || duplicate || (nativeAlias && store.providers.some(entry => entry.kind === "openai-oauth"))
+        ? 'OpenAI OAuth discovery is blocked by an openai-oauth provider ID conflict. Existing third-party routes and keys are preserved. Rename the conflicting native provider table; historical session routes need explicit repair before this ID can be reused.'
+        : undefined;
+    const combined = [note, shadowed, collision].filter((part) => part !== undefined).join(" ");
     return {
-        providers: store.providers.map((entry) => project(codexHome, entry)),
+        providers: store.providers.filter(entry => !(duplicate && entry.id === OPENAI_OAUTH_ID)).map((entry) => project(codexHome, entry)),
         native,
         protocols: PROTOCOL_OPTIONS,
         paths: {
@@ -243,6 +233,8 @@ export function normalizeSaveRequest(request, existing) {
     }
     const raw = request["provider"];
     const id = raw["id"];
+    if (id === OPENAI_OAUTH_ID && (existing === undefined || existing.kind === "openai-oauth"))
+        throw new TypeError("OpenAI OAuth is a reserved native provider; configure authentication in Codex");
     if (!isProviderId(id)) {
         throw new TypeError(`codexProviders/save: id must match /^[a-z0-9][a-z0-9-]*$/ (got ${JSON.stringify(id)})`);
     }
@@ -328,6 +320,8 @@ export function normalizeSaveRequest(request, existing) {
 export function saveProvider(worldHome, codexHome, request, syncedAt) {
     const store = readProviderStore(worldHome);
     const id = isRecord(request) && isRecord(request["provider"]) ? request["provider"]["id"] : undefined;
+    if (store.providers.filter(entry => entry.id === id).length > 1)
+        throw new TypeError("codexProviders/save: duplicate provider ID is ambiguous; explicitly repair the conflicting identities before editing");
     const existing = store.providers.find((entry) => entry.id === id);
     const entry = normalizeSaveRequest(request, existing);
     const next = upsertProvider(store, entry);
@@ -340,6 +334,10 @@ export function removeProviderEntry(worldHome, codexHome, request, syncedAt) {
     if (id === undefined)
         throw new TypeError("codexProviders/remove: id must be a non-empty string");
     const store = readProviderStore(worldHome);
+    if (id === OPENAI_OAUTH_ID && store.providers.some(entry => entry.id === id && entry.kind === "openai-oauth"))
+        throw new TypeError("OpenAI OAuth is a read-only native provider");
+    if (store.providers.filter(entry => entry.id === id).length > 1)
+        throw new TypeError("codexProviders/remove: duplicate provider ID is ambiguous; explicitly repair the conflicting identities before removing");
     const next = removeProvider(store, id);
     writeProviderStore(worldHome, next);
     return viewOf(worldHome, codexHome, next, syncedAt);

package/agent-codex/dist/codex-providers.js

@@ -99,6 +99,9 @@ export function providerEntry(value) {
     if (value === null || typeof value !== "object")
         return undefined;
     const record = value;
+    if (record["kind"] === "openai-oauth" && record["id"] === "openai-oauth") {
+        return { id: "openai-oauth", label: "OpenAI OAuth", kind: "openai-oauth", origin: "native", baseUrl: "", protocol: "responses", auth: { kind: "apiKey", value: "" }, models: [] };
+    }
     const id = record["id"];
     const label = str(record["label"]);
     const baseUrl = str(record["baseUrl"]);
@@ -144,7 +147,9 @@ export function readProviderStore(worldHome) {
     const rawRemoved = record["removed"];
     const removed = (Array.isArray(rawRemoved) ? rawRemoved : [])
         .filter((value) => typeof value === "string" && value.trim() !== "");
-    return { version: 1, providers, ...(removed.length === 0 ? {} : { removed }) };
+    const blockedNativeIds = Array.isArray(record["blockedNativeIds"])
+        ? [...new Set(record["blockedNativeIds"].filter((id) => id === "openai-oauth"))] : [];
+    return { version: 1, providers, ...(removed.length === 0 ? {} : { removed }), ...(blockedNativeIds.length === 0 ? {} : { blockedNativeIds }) };
 }
 /**
  * Persist the store atomically (tmp + rename) and 0600 — the file holds API
@@ -155,7 +160,7 @@ export function writeProviderStore(worldHome, store) {
     const path = providerStorePath(worldHome);
     mkdirSync(dirname(path), { recursive: true });
     const temp = `${path}.tmp-${process.pid}`;
-    writeFileSync(temp, `${JSON.stringify(store, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    writeFileSync(temp, `${JSON.stringify({ ...store, providers: store.providers.map(entry => entry.kind === "openai-oauth" ? { id: entry.id, label: entry.label, kind: entry.kind, origin: "native" } : entry) }, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
     renameSync(temp, path);
 }
 /**
@@ -176,7 +181,8 @@ export function upsertProvider(store, entry) {
     // carry the tombstone forward, and the next sync would keep skipping the
     // endpoint the user just re-added.
     const { removed: _stale, ...rest } = store;
-    return { ...rest, providers, ...(removed.length === 0 ? {} : { removed }) };
+    const blockedNativeIds = [...new Set([...(store.blockedNativeIds ?? []), ...(entry.id === "openai-oauth" && entry.kind !== "openai-oauth" ? [entry.id] : [])])];
+    return { ...rest, providers, ...(removed.length === 0 ? {} : { removed }), ...(blockedNativeIds.length === 0 ? {} : { blockedNativeIds }) };
 }
 /**
  * Drop one provider, and TOMBSTONE its endpoint so the reconcile cannot bring
@@ -193,7 +199,8 @@ export function removeProvider(store, id) {
         return { ...store, providers };
     const key = endpointKey(entry.baseUrl);
     const removed = store.removed?.includes(key) === true ? store.removed : [...store.removed ?? [], key];
-    return { ...store, providers, removed };
+    const blockedNativeIds = [...new Set([...(store.blockedNativeIds ?? []), ...(entry.id === "openai-oauth" && entry.kind !== "openai-oauth" ? [entry.id] : [])])];
+    return { ...store, providers, removed, ...(blockedNativeIds.length === 0 ? {} : { blockedNativeIds }) };
 }
 /**
  * The comparison key for "the same endpoint". Codex itself treats two provider
@@ -330,7 +337,13 @@ export function syncNativeProviders(store, imported) {
         if (store.removed?.includes(key) === true)
             continue;
         const wantedId = incoming.nativeId !== undefined && isProviderId(incoming.nativeId) ? incoming.nativeId : undefined;
-        const at = providers.findIndex((entry) => (wantedId !== undefined && entry.id === wantedId) || endpointKey(entry.baseUrl) === key);
+        // A native identity is not an endpoint table. Never refresh it, rename a
+        // conflicting native table behind the user's back, or select a duplicate id.
+        if (wantedId === "openai-oauth" && (providers.some(entry => entry.id === wantedId && entry.kind === "openai-oauth")
+            || providers.filter(entry => entry.id === wantedId).length > 1))
+            continue;
+        const at = providers.findIndex((entry) => entry.kind !== "openai-oauth" &&
+            ((wantedId !== undefined && entry.id === wantedId) || endpointKey(entry.baseUrl) === key));
         if (at === -1) {
             const id = uniqueProviderId(wantedId ?? providerIdFromEndpoint(baseUrl), providers.map((entry) => entry.id));
             providers.push({
@@ -370,7 +383,7 @@ export function syncNativeProviders(store, imported) {
     }
     const removed = store.removed ?? [];
     const next = removed.length === 0
-        ? { version: 1, providers }
-        : { version: 1, providers, removed };
+        ? { ...store, version: 1, providers }
+        : { ...store, version: 1, providers, removed };
     return { store: next, added, updated };
 }

package/agent-codex/dist/codex-runtime.js

@@ -0,0 +1,120 @@
+/** Resolve an installed Codex runtime at first use, without modifying its home. */
+import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { createRequire } from "node:module";
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+function readableFile(path) {
+    try {
+        accessSync(path, constants.R_OK);
+        return statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function executable(path) {
+    try {
+        accessSync(path, constants.X_OK);
+        return statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function desktopPaths(discovery) {
+    if (discovery.desktopCandidates !== undefined)
+        return discovery.desktopCandidates;
+    const explicit = discovery.env.CODEX_DESKTOP_BIN?.trim();
+    const paths = explicit ? [explicit] : [];
+    if (discovery.platform === "linux") {
+        paths.push("/usr/lib/chatgpt/resources/codex", "/usr/lib/codex/resources/codex", "/opt/Codex/resources/codex", "/opt/codex/resources/codex");
+    }
+    else if (discovery.platform === "darwin") {
+        for (const root of ["/Applications", posix.join(discovery.homeDir, "Applications")]) {
+            for (const app of ["Codex.app", "ChatGPT.app"])
+                paths.push(posix.join(root, app, "Contents/Resources/codex"));
+        }
+    }
+    else if (discovery.platform === "win32") {
+        const local = discovery.env.LOCALAPPDATA;
+        if (local) {
+            for (const app of ["Codex", "ChatGPT"])
+                paths.push(win32.join(local, "Programs", app, "resources", "codex.exe"));
+        }
+    }
+    return paths;
+}
+function isNodeScript(command, discovery) {
+    let target = command;
+    try {
+        target = discovery.realpath(command);
+    }
+    catch {
+        // Explicit nonexistent paths are rejected by the file check below.
+    }
+    return /\.(?:[cm]?js)$/i.test(target);
+}
+export function resolveCodexRuntime(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const env = options.env ?? process.env;
+    const isFile = options.isFile ?? readableFile;
+    const isExecutable = options.isExecutable ?? executable;
+    const path = platform === "win32" ? win32 : posix;
+    const shellWrapper = (command) => platform === "win32" && /\.(?:cmd|bat)$/i.test(command);
+    const discovery = {
+        platform,
+        env,
+        homeDir: options.homeDir ?? homedir(),
+        ...(options.desktopCandidates === undefined ? {} : { desktopCandidates: options.desktopCandidates }),
+        isFile,
+        isExecutable,
+        realpath: options.realpath ?? realpathSync,
+        findCommand: options.findCommand ?? ((name) => {
+            const suffixes = platform === "win32" ? ["", ...(env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";")] : [""];
+            for (const directory of (env.PATH ?? "").split(platform === "win32" ? ";" : ":")) {
+                if (directory === "")
+                    continue;
+                for (const suffix of suffixes) {
+                    const candidate = path.join(directory, `${name}${suffix}`);
+                    if (shellWrapper(candidate))
+                        continue;
+                    if (isFile(candidate) && isExecutable(candidate))
+                        return candidate;
+                }
+            }
+            return undefined;
+        }),
+        resolvePackageEntry: options.resolvePackageEntry ?? (() => createRequire(import.meta.url).resolve("@openai/codex/bin/codex.js")),
+    };
+    const usable = (command) => !shellWrapper(command) && isFile(command) && (isNodeScript(command, discovery) || isExecutable(command));
+    const selected = (command, source) => ({ command, nodeScript: isNodeScript(command, discovery), source });
+    const override = env.CODEX_BIN?.trim();
+    if (override) {
+        const command = /[\\/]/.test(override) ? override : discovery.findCommand(override) ?? override;
+        if (shellWrapper(command))
+            throw new Error(`CODEX_BIN ${override} is a Windows .cmd/.bat shell wrapper. Set CODEX_BIN to the native codex.exe executable or the @openai/codex JavaScript entry instead.`);
+        if (!usable(command))
+            throw new Error(`CODEX_BIN ${override} is not a readable JavaScript entry or executable Codex runtime. Fix CODEX_BIN or remove the override.`);
+        return selected(command, "override");
+    }
+    for (const candidate of desktopPaths(discovery)) {
+        if (!shellWrapper(candidate) && isFile(candidate) && isExecutable(candidate))
+            return selected(candidate, "desktop");
+    }
+    const cli = discovery.findCommand("codex");
+    if (cli !== undefined && usable(cli))
+        return selected(cli, "cli");
+    try {
+        const entry = discovery.resolvePackageEntry();
+        if (isFile(entry))
+            return { command: entry, nodeScript: true, source: "package" };
+    }
+    catch {
+        // Installation fallback only; authentication/generation never reaches here.
+    }
+    throw new Error("cannot locate a Codex runtime: install Codex desktop or a user CLI on PATH, restore the exact-pin @openai/codex package, or set CODEX_BIN to its executable or JavaScript entry.");
+}
+/** Compatibility interface for callers that need only the selected path. */
+export function resolveCodexCommand(options = {}) {
+    return resolveCodexRuntime(options).command;
+}

package/agent-codex/dist/index.js

@@ -1,3 +1,4 @@
+import { OPENAI_OAUTH_ID, readEffectiveProviderStore } from "./codex-oauth.js";
 /**
  * agent-codex provider — Codex provider plugin for DeepSeek Harness
  * (Super D, app-server line).
@@ -29,7 +30,6 @@ import { CodexLlmAdapter, routeIds } from "./adapter.js";
 import { registerCodexPreset } from "./agent-preset-codex.js";
 import { readRolloutHead, resolveCodexHome } from "./codex-store.js";
 import { CodexProvidersGateway, syncFromNative } from "./codex-provider-gateway.js";
-import { readProviderStore } from "./codex-providers.js";
 import { readNativeSelection } from "./codex-native-config.js";
 import { seedRoute } from "./codex-route.js";
 import { providerLaunch } from "./codex-launch.js";
@@ -159,12 +159,12 @@ export class CodexProvider extends Service {
      */
     syncNow() {
         try {
-            const { store, added, updated } = syncFromNative(this.home, resolveCodexHome());
+            const { added, updated } = syncFromNative(this.home, resolveCodexHome());
             if (added.length > 0 || updated.length > 0) {
                 this.runtime.ctx.logger.info(`codex-provider: config.toml sync — added ${added.join(", ") || "none"}, refreshed ${updated.join(", ") || "none"}`);
             }
             this.syncedAt = Date.now();
-            this.#applyRoutes(store.providers);
+            this.#applyRoutes(readEffectiveProviderStore(this.home, resolveCodexHome()).providers);
         }
         catch (error) {
             this.runtime.ctx.logger.warn(`codex-provider: provider sync failed: ${String(error)}`);
@@ -173,7 +173,7 @@ export class CodexProvider extends Service {
     /** Re-register the `ctx.llm` routes from the current store (panel mutation path). */
     refreshRoutes() {
         try {
-            this.#applyRoutes(readProviderStore(this.home).providers);
+            this.#applyRoutes(readEffectiveProviderStore(this.home, resolveCodexHome()).providers);
         }
         catch (error) {
             this.runtime.ctx.logger.warn(`codex-provider: route refresh failed: ${String(error)}`);
@@ -188,14 +188,14 @@ export class CodexProvider extends Service {
     nativeProviderId() {
         const native = readNativeSelection(resolveCodexHome());
         const wanted = native.providerId;
-        if (wanted === undefined)
-            return undefined;
-        const providers = readProviderStore(this.home).providers;
-        return providers.find((entry) => entry.id === wanted)?.id ?? undefined;
+        if (wanted === undefined || wanted === "openai")
+            return readEffectiveProviderStore(this.home, resolveCodexHome()).providers.some(entry => entry.kind === "openai-oauth") ? OPENAI_OAUTH_ID : undefined;
+        const providers = readEffectiveProviderStore(this.home, resolveCodexHome()).providers;
+        return providers.find((entry) => entry.kind !== "openai-oauth" && entry.id === wanted)?.id ?? undefined;
     }
     /** The store entry a DSH route id names. */
     providerEntry(providerId) {
-        return readProviderStore(this.home).providers.find((entry) => entry.id === providerId);
+        return readEffectiveProviderStore(this.home, resolveCodexHome()).providers.find((entry) => entry.id === providerId);
     }
     /**
      * The factory's session-level route fallback — always ONE coherent pair.
@@ -217,8 +217,13 @@ export class CodexProvider extends Service {
     sessionAgentOptions(requested) {
         const native = readNativeSelection(resolveCodexHome());
         const wanted = requested?.provider !== undefined && typeof requested.model === "string" ? requested : undefined;
+        const requestedEntry = wanted === undefined ? undefined : this.providerEntry(wanted.provider);
+        // An explicitly selected native identity must survive unavailable auth or
+        // metadata. Its launch fails honestly instead of seeding a third-party route.
+        if (wanted?.provider === OPENAI_OAUTH_ID && (requestedEntry === undefined || requestedEntry.kind === "openai-oauth"))
+            return { ...wanted };
         const serves = wanted !== undefined
-            && this.providerEntry(wanted.provider)?.models.some((model) => model.id === wanted.model) === true;
+            && requestedEntry?.models.some((model) => model.id === wanted.model) === true;
         if (wanted !== undefined && serves)
             return { ...wanted, provider: wanted.provider, model: wanted.model };
         const provider = this.nativeProviderId();
@@ -274,6 +279,8 @@ export class CodexProvider extends Service {
             // the user's home (the per-provider model catalog is ours).
             launchFor: (providerId) => {
                 const entry = this.providerEntry(providerId);
+                if (entry === undefined && providerId === OPENAI_OAUTH_ID)
+                    throw new Error("OpenAI OAuth authentication is unavailable; sign in using Codex");
                 return entry === undefined ? undefined : providerLaunch(this.home, codexHome, entry);
             },
             contextWindowFor: (providerId, model) => {
@@ -379,7 +386,7 @@ export class CodexProvider extends Service {
      * picker would be noise.
      */
     #registerModelCatalog() {
-        this.#applyRoutes(readProviderStore(this.home).providers);
+        this.#applyRoutes(readEffectiveProviderStore(this.home, resolveCodexHome()).providers);
     }
     /** Register or atomically re-point the codex routes at the given providers. */
     #applyRoutes(providers) {

package/agent-codex/package.json

@@ -22,7 +22,7 @@
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
-    "@openai/codex": "0.154.0",
+    "@openai/codex": "0.160.0",
     "zod": "4.4.3"
   },
   "peerDependencies": {

package/agent-codex-sdk/dist/adapter.js

@@ -1,3 +1,5 @@
+import { readEffectiveProviderStore } from "./codex-oauth.js";
+import { resolveCodexHome } from "./codex-store.js";
 /**
  * Codex-backed `LlmAdapter` registered on `ctx.llm` by the Codex provider.
  *
@@ -23,7 +25,6 @@
  * @module agent-codex/adapter
  */
 import { LlmAdapter, LlmError, } from "@deepseek-ai/dsh-llm";
-import { readProviderStore } from "./codex-providers.js";
 /**
  * The single route every Codex model was served under before the multi-provider
  * rework. No longer registered (a session pinned to it falls back to whatever
@@ -41,7 +42,7 @@ export function routeIds(store) {
 }
 /** The provider entry a route id names, or `undefined`. */
 export function providerFor(worldHome, providerId) {
-    return readProviderStore(worldHome).providers.find((entry) => entry.id === providerId);
+    return readEffectiveProviderStore(worldHome, resolveCodexHome()).providers.find((entry) => entry.id === providerId);
 }
 export class CodexLlmAdapter extends LlmAdapter {
     worldHome;

package/agent-codex-sdk/dist/agent.js

@@ -276,6 +276,11 @@ export class CodexAgent {
      */
     #remoteQueue = [];
     #bridgedToolResults = new Set();
+    /** callIds already advertised by an appended assistant/message frame — the
+     *  strict validator refuses any `tool/call` whose callId no assistant frame
+     *  advertised, and requires the execution arguments to equal the advertised
+     *  string (2026-10-04 dev3 omp/hermes repair: same write-side family). */
+    #advertisedToolCalls = new Set();
     /**
      * The open turn's FINAL assistant message, buffered from `message_end`
      * until `turn_end` so the SAME turn's usage can land on it (the DSH
@@ -894,7 +899,32 @@ export class CodexAgent {
             case "tool_execution_start": {
                 const callId = String(event.toolCallId ?? "");
                 const name = String(event.toolName ?? "");
+                const argumentsJson = String(event.argumentsJson ?? JSON.stringify(event.args ?? {}));
                 this.#commitStepStart();
+                // Advertisement-before-execution (validator invariant, 2026-10-04 dev3
+                // omp/hermes repair family): unless a real assistant frame advertised
+                // this callId, bridge a minimal assistant/message carrying the
+                // tool-call block — arguments copied verbatim into both frames. The
+                // synthesized source mirrors #appendAssistantMessage's open-turn
+                // fallback chain.
+                if (!this.#advertisedToolCalls.has(callId)) {
+                    const advertisement = createAssistantMessage({
+                        content: [{ type: "tool-call", id: ToolCallId(callId), name, arguments: argumentsJson }],
+                        source: {
+                            provider: String(this.#turnRoute?.provider ?? this.options.provider ?? ""),
+                            model: String(this.#turnRoute?.model ?? this.options.model ?? ""),
+                        },
+                    });
+                    this.session.append("assistant/message", {
+                        turn: this.#dashTurn,
+                        step: this.#step,
+                        message: advertisement,
+                        stream: [],
+                    }, {
+                        surfaceOp: "append",
+                    });
+                    this.#advertisedToolCalls.add(callId);
+                }
                 this.session.append("tool/call", {
                     turn: this.#dashTurn,
                     step: this.#step,
@@ -903,7 +933,7 @@ export class CodexAgent {
                     // The DSH payload requires the RAW JSON string the model produced;
                     // the wire carries it verbatim for MCP calls and renders it from the
                     // discrete fields for the other item shapes.
-                    arguments: String(event.argumentsJson ?? JSON.stringify(event.args ?? {})),
+                    arguments: argumentsJson,
                 });
                 break;
             }
@@ -1015,6 +1045,10 @@ export class CodexAgent {
     }
     #appendAssistantMessage(message, usage) {
         const content = convertContent(message.content);
+        for (const block of content) {
+            if (block.type === "tool-call")
+                this.#advertisedToolCalls.add(block.id);
+        }
         const assistant = createAssistantMessage({
             content,
             source: {

package/agent-codex-sdk/dist/codex-native-config.js

@@ -95,9 +95,10 @@ function slugOf(entry) {
  * that we do not already hold, then upserts `models` by slug. Each upserted
  * entry is a CLONE of `template` — an existing entry for the same slug if there
  * is one, else the caller's template, else the first entry either side supplied
- * — with only the identity fields overridden. The other ~35 keys are Codex's
- * and are copied through untouched; see the plan's D5 for why we do not try to
- * synthesize them.
+ * — with identity and declared context window overridden. The other metadata
+ * is copied through except `comp_hash`: this optional opaque compatibility
+ * identifier belongs to the template's model, not an unrelated provider model.
+ * See the plan's D5 for why we do not synthesize the remaining fields.
  */
 export function mergeModelCatalog(existing, absorbed, models, template) {
     // Both sides are a TEMPLATE POOL only — never output. What gets emitted is
@@ -132,6 +133,11 @@ export function mergeModelCatalog(existing, absorbed, models, template) {
             slug: model.id,
             display_name: model.displayName ?? model.id,
         };
+        // A copied OpenAI hash falsely triggers previous-model compaction on
+        // provider switches in Codex 0.160. Our provider model declarations do not
+        // carry verified hashes; remove stale generated values too. Context-limit
+        // compaction and its window/threshold metadata remain unchanged.
+        delete entry["comp_hash"];
         if (model.contextWindow !== undefined) {
             // Codex reads context_window and caps against max_context_window; a stale
             // template value must not silently cap a larger real window.