super-dsh 0.1.10 → 0.1.11

package/agent-claude/dist/sdk-runtime.js

@@ -0,0 +1,320 @@
+/**
+ * sdk-runtime.ts — the lazy, durable Claude Agent SDK runtime (2026-10-04 spec §2.1).
+ *
+ * Zero declared dependency: the FIRST real prompt fetches
+ * `@anthropic-ai/claude-agent-sdk` into <worldHome>/sdk-runtime/ and it stays
+ * durable there. Two modes (user ruling 2026-10-04): host-binary (default,
+ * `--omit=optional` — the 206 MB platform payload is never downloaded; the CLI
+ * is the user's own binary) and bundled-payload (no local binary: the SDK's
+ * own platform payload IS the CLI). A mode flip re-installs with the other
+ * flag set (idempotent heal); a FAILED fetch writes sdk-runtime.error.log and
+ * throws — never a silent degradation.
+ *
+ * Layout (the marker/lock/error-log mechanism is, in shape, the one
+ * `agent-codex-sdk/src/sdk-runtime.ts` runs on):
+ *
+ *   <worldHome>/sdk-runtime/            npm tree (`--ignore-scripts`)
+ *     package.json                 the ANCHOR we write before install
+ *                                  (private, never published): npm otherwise
+ *                                  resolves the nearest ancestor project and
+ *                                  may exit 0 having landed nothing here
+ *     node_modules/@anthropic-ai/claude-agent-sdk/
+ *       sdk.mjs                         the entry `loadClaudeQuery` imports
+ *   <worldHome>/sdk-runtime.json        marker — written LAST; a matching
+ *                                       identity AND a live entry mean complete
+ *   <worldHome>/sdk-runtime.lock        atomic (mkdir) bootstrap lock
+ *   <worldHome>/sdk-runtime.error.log   written ONLY by a failed fetch
+ *
+ * Why the world home rather than the package root: the package root is the
+ * installed tarball — read-only in every real consumer install and shared by
+ * every world — while the world home is per-runtime, writable, and already the
+ * home of this adapter's own DSH state.
+ *
+ * Mode is re-derived on EVERY call: the host binary is resolved again (it may
+ * have appeared or vanished since the fetch), and a marker whose recorded mode
+ * no longer matches re-installs under the other flag set.
+ *
+ * Every path derives from the explicit `worldHome` argument — this module never
+ * reads the ambient `DSH_HOME` — and the SDK entry is imported BY RESOLVED PATH,
+ * never by a bare specifier: the runtime lives in the world home while this
+ * module lives in the plugin tarball, so a bare specifier could not resolve it
+ * and would quietly reintroduce the dependency this module exists to delete.
+ */
+import { execFile } from "node:child_process";
+import { appendFileSync, existsSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { pathToFileURL } from "node:url";
+import { promisify } from "node:util";
+/** The coding-agent SDK this line drives (a plain npm package, never declared). */
+export const SDK_PACKAGE = "@anthropic-ai/claude-agent-sdk";
+/** The pin, written here rather than in `package.json` — the marker carries it. */
+export const SDK_PACKAGE_VERSION = "0.3.263";
+export function sdkRuntimeLayout(worldHome) {
+    return {
+        dir: join(worldHome, "sdk-runtime"),
+        marker: join(worldHome, "sdk-runtime.json"),
+        lock: join(worldHome, "sdk-runtime.lock"),
+        errorLog: join(worldHome, "sdk-runtime.error.log"),
+    };
+}
+/** The entry `loadClaudeQuery` imports — the SDK's `exports["."]`. */
+export function sdkEntryPath(worldHome) {
+    return join(sdkRuntimeLayout(worldHome).dir, "node_modules", SDK_PACKAGE, "sdk.mjs");
+}
+/** Read the install marker; undefined when absent, unreadable or not our shape. */
+export function readSdkRuntimeRecord(worldHome) {
+    const { marker } = sdkRuntimeLayout(worldHome);
+    if (!existsSync(marker))
+        return undefined;
+    try {
+        const parsed = JSON.parse(readFileSync(marker, "utf8"));
+        if (typeof parsed !== "object" || parsed === null)
+            return undefined;
+        const record = parsed;
+        if (record.sdkPackage !== SDK_PACKAGE)
+            return undefined;
+        if (typeof record.sdkVersion !== "string")
+            return undefined;
+        if (record.mode !== "host-binary" && record.mode !== "bundled-payload")
+            return undefined;
+        if (typeof record.createdAt !== "number")
+            return undefined;
+        return record;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The fast path: the marker is present, is ours, carries the current pin, was
+ * written under `wantedMode`, AND the SDK entry it promises still exists.
+ *
+ * The marker is written LAST, after a successful install, so its identity match
+ * normally implies the tree underneath; but an identity match alone is not
+ * enough. `fetchRuntime`'s failure path deletes the tree, a user may delete it
+ * by hand, and a half-wiped install can leave the (separate) marker behind. The
+ * entry `existsSync` is therefore the completeness contract: without it a stale
+ * marker would hand back a record whose `sdk.mjs` is gone and every prompt would
+ * fail `ERR_MODULE_NOT_FOUND` until someone removed the marker by hand. One stat
+ * costs nothing next to a 206 MB re-download.
+ */
+function sdkRuntimeReady(worldHome, wantedMode) {
+    const record = readSdkRuntimeRecord(worldHome);
+    if (record === undefined)
+        return undefined;
+    if (record.sdkVersion !== SDK_PACKAGE_VERSION)
+        return undefined;
+    if (record.mode !== wantedMode)
+        return undefined;
+    if (!existsSync(sdkEntryPath(worldHome)))
+        return undefined;
+    return record;
+}
+/**
+ * Resolve the host Claude Code binary, most specific first:
+ * `CLAUDE_EXECUTABLE` (only when it exists) > `claude` on `PATH` >
+ * `~/.local/bin/claude` > `/usr/local/bin/claude`.
+ *
+ * `undefined` means "no local binary" and is the trigger for
+ * `bundled-payload` — never a bare `"claude"` fallback, which would pretend a
+ * host binary exists and make the SDK spawn a name that is not on `PATH`.
+ */
+export function resolveClaudeBinary() {
+    const override = process.env.CLAUDE_EXECUTABLE;
+    if (override && existsSync(override))
+        return override;
+    for (const dir of (process.env.PATH ?? "").split(":").filter(Boolean)) {
+        const candidate = join(dir, "claude");
+        if (existsSync(candidate))
+            return candidate;
+    }
+    for (const candidate of [join(homedir(), ".local/bin/claude"), "/usr/local/bin/claude"]) {
+        if (existsSync(candidate))
+            return candidate;
+    }
+    return undefined;
+}
+/** The npm argv the runtime tree is installed with (kept pure for the test). */
+export function sdkInstallArgv(version, mode) {
+    const argv = [
+        "install",
+        "--exact",
+        "--ignore-scripts",
+        "--omit=dev",
+        "--no-audit",
+        "--no-fund",
+        `${SDK_PACKAGE}@${version}`,
+    ];
+    if (mode === "host-binary")
+        argv.push("--omit=optional");
+    return argv;
+}
+/** A held lock older than this is treated as abandoned and reclaimed. */
+const LOCK_STALE_MS = 10 * 60 * 1000;
+const execFileAsync = promisify(execFile);
+/**
+ * The production `install`: `SUPERD_SDK_NPM` (so the fetch can be pointed at
+ * pnpm/corepack) over an otherwise inherited environment, run in the runtime
+ * dir. `maxBuffer` is raised for npm's progress output.
+ */
+async function defaultInstall(cmd, args, opts) {
+    await execFileAsync(cmd, args, {
+        cwd: opts.cwd,
+        env: opts.env ?? process.env,
+        maxBuffer: 64 * 1024 * 1024,
+    });
+}
+/**
+ * Return the record for `<worldHome>`'s durable SDK runtime, fetching it first
+ * when it is absent, stale or was installed under the other mode.
+ *
+ * Idempotent: a complete, matching runtime short-circuits without touching the
+ * network. Concurrent callers are separated by a `mkdir` lock — a second caller
+ * that finds a FRESH lock fails with a clear "fetch in progress" error (the SDK
+ * handle is a per-process singleton; the real race is another dsh process on
+ * the same world home), while an abandoned lock (older than
+ * {@link LOCK_STALE_MS}) is reclaimed so a crashed fetch cannot brick the line.
+ *
+ * A failure appends to `<worldHome>/sdk-runtime.error.log`, drops the partial
+ * tree and throws one actionable error — never a marker, so the next call heals.
+ */
+export async function ensureSdkRuntime(worldHome, deps) {
+    const install = deps?.install ?? defaultInstall;
+    const now = deps?.now ?? Date.now;
+    const layout = sdkRuntimeLayout(worldHome);
+    const wantedMode = resolveClaudeBinary() !== undefined ? "host-binary" : "bundled-payload";
+    const ready = sdkRuntimeReady(worldHome, wantedMode);
+    if (ready !== undefined)
+        return ready;
+    mkdirSync(worldHome, { recursive: true });
+    acquireLock(layout);
+    try {
+        // Re-check inside the lock: a peer may have completed the fetch in the
+        // window between our check and the lock, in which case we pay nothing.
+        const done = sdkRuntimeReady(worldHome, wantedMode);
+        if (done !== undefined)
+            return done;
+        try {
+            return await fetchRuntime(worldHome, layout, wantedMode, install, now);
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            try {
+                appendFileSync(layout.errorLog, `[${new Date().toISOString()}] agent-claude SDK runtime fetch failed: ${detail}\n`);
+            }
+            catch {
+                /* the trace is best-effort; the throw below is the contract */
+            }
+            rmSync(layout.dir, { recursive: true, force: true });
+            throw new Error(`agent-claude: could not fetch the SDK runtime ` +
+                `(${SDK_PACKAGE}@${SDK_PACKAGE_VERSION}, ${wantedMode} mode) at ${layout.dir}: ${detail}. ` +
+                `Trace: ${layout.errorLog}`);
+        }
+    }
+    finally {
+        rmSync(layout.lock, { recursive: true, force: true });
+    }
+}
+/** The private manifest that anchors npm to the runtime dir (never published). */
+const RUNTIME_MANIFEST = '{"name":"superd-claude-sdk-runtime","private":true}\n';
+/**
+ * The idempotent install step. npm is anchored to the runtime dir by a private
+ * manifest BEFORE install (without one, npm resolves the nearest ANCESTOR
+ * project and may exit 0 having landed nothing here), and the entry is
+ * verified on disk BEFORE the marker is written — exit 0 alone is not success.
+ */
+async function fetchRuntime(worldHome, layout, mode, install, now) {
+    mkdirSync(layout.dir, { recursive: true });
+    // ANCHOR — npm resolves a tree from the nearest ancestor holding a
+    // package.json; with none in the runtime dir it walks up (on the real
+    // machine: to the repo root), reports "up to date" against THAT project,
+    // exits 0 and lands no tree here — yet the marker used to be written anyway,
+    // so every later loadClaudeQuery failed and each "heal" re-hit the same
+    // no-op install (reproduced twice, 2026-10-04). The private manifest pins
+    // the install to THIS directory; written only when missing or not
+    // byte-exact, so a re-run never rewrites a manifest that is already correct.
+    const manifest = join(layout.dir, "package.json");
+    let manifestExact = false;
+    if (existsSync(manifest)) {
+        try {
+            manifestExact = readFileSync(manifest, "utf8") === RUNTIME_MANIFEST;
+        }
+        catch {
+            manifestExact = false; // unreadable ⇒ treat as absent and re-anchor
+        }
+    }
+    if (!manifestExact)
+        writeFileSync(manifest, RUNTIME_MANIFEST);
+    const npm = process.env.SUPERD_SDK_NPM ?? "npm";
+    await install(npm, sdkInstallArgv(SDK_PACKAGE_VERSION, mode), { cwd: layout.dir });
+    // VERIFY — a zero exit is not success: an unanchored (or no-op) install
+    // resolves without producing the entry. Fail BEFORE the marker — it must
+    // only ever exist with the entry verifiably on disk, or the self-healing
+    // loop never converges. The catch in `ensureSdkRuntime` appends the trace
+    // (the note below names the cause) and wipes this partial tree.
+    const entry = sdkEntryPath(worldHome);
+    if (!existsSync(entry)) {
+        throw new Error(`npm install exited 0 but produced no entry at ${entry} — ` +
+            `the install was not anchored to the runtime dir ` +
+            `(npm likely resolved an ancestor project's tree instead of ${manifest})`);
+    }
+    // Marker LAST — a crash before this point leaves an incomplete runtime that
+    // the next call heals, never a false success.
+    const record = {
+        sdkPackage: SDK_PACKAGE,
+        sdkVersion: SDK_PACKAGE_VERSION,
+        mode,
+        createdAt: now(),
+    };
+    writeFileSync(layout.marker, JSON.stringify(record, null, 2) + "\n");
+    rmSync(layout.errorLog, { force: true });
+    return record;
+}
+/**
+ * mkdir-based mutex: returns owning the lock, throws when a FRESH lock is held
+ * by someone else, reclaims a lock older than {@link LOCK_STALE_MS}.
+ */
+function acquireLock(layout) {
+    for (;;) {
+        try {
+            mkdirSync(layout.lock);
+            return;
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+        let ageMs;
+        try {
+            ageMs = Date.now() - statSync(layout.lock).mtimeMs;
+        }
+        catch {
+            continue; // released between the mkdir attempt and the stat — retry now
+        }
+        if (ageMs > LOCK_STALE_MS) {
+            rmSync(layout.lock, { recursive: true, force: true });
+            continue;
+        }
+        throw new Error(`agent-claude: another SDK runtime fetch is already in progress (lock ${layout.lock}). ` +
+            `Retry once it finishes; if no fetch is running, remove that lock directory.`);
+    }
+}
+/**
+ * Ensure the durable runtime and return the installed SDK entry's `query`
+ * function — the ONE function the client's default factory drives, and the only
+ * place a real download/install happens on the lazy path.
+ *
+ * The entry is imported by resolved path (see the header) and its shape is
+ * checked here: a tree that installs but exposes no `query` fails at fetch
+ * time, loud and near the cause, rather than inside the agent's first prompt.
+ */
+export async function loadClaudeQuery(worldHome) {
+    await ensureSdkRuntime(worldHome);
+    const entry = sdkEntryPath(worldHome);
+    const module = (await import(pathToFileURL(entry).href));
+    if (typeof module.query !== "function") {
+        throw new Error(`agent-claude: ${entry} exposes no query function`);
+    }
+    return module.query;
+}

package/agent-claude/package.json

@@ -18,10 +18,8 @@
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",
-    "test": "node --test test/*.test.mjs"
-  },
-  "dependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.263"
+    "test": "node --test test/*.test.mjs",
+    "fetch-sdk-runtime": "node scripts/fetch-sdk-runtime.mjs"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
@@ -30,6 +28,7 @@
     "@deepseek-ai/dsh-llm": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-session": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-session-persistence": ">=0.1.5-0 <0.3.0-0",
+    "@deepseek-ai/dsh-typert-protocol": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-user-approval": ">=0.1.5-0 <0.3.0-0",
     "@deepseek-ai/dsh-user-questions": ">=0.1.5-0 <0.3.0-0"
   },
@@ -52,6 +51,9 @@
     "@deepseek-ai/dsh-session-persistence": {
       "optional": true
     },
+    "@deepseek-ai/dsh-typert-protocol": {
+      "optional": true
+    },
     "@deepseek-ai/dsh-user-approval": {
       "optional": true
     },

package/agent-codex/README.md

@@ -19,10 +19,10 @@ superd 外壳下的 **Codex adapter**（super-dsh 线）：把 Codex CLI 经由
 
 ## 线别（2026-10-03 迁移）
 
-**app-server 线**取代了原 `@openai/codex-sdk` 线（SDK 依赖已从本包与主 pack 移除）。
+**app-server 线**是主路线（SDK 依赖已从本包与主 pack 移除）。SDK 另存为默认关闭的 `agent-codex-sdk`，拥有独立的按需 runtime 安装。
 SDK 线在 adapter 里登记的一整排降级被 app-server 协议面直接消掉：
 
-| 能力 | SDK 线（已退役） | app-server 线（现役） |
+| 能力 | SDK 可选线 | app-server 主路线 |
 |---|---|---|
 | 打断 | 只有 AbortSignal（掐断本轮 stream） | **`turn/interrupt`** |
 | steer | 无 → 排队 followUp 近似 | **`turn/steer`**（注入进行中的 turn） |
@@ -82,19 +82,31 @@ collab/subagent 项。
 | 变量 | 作用 |
 |---|---|
 | `CODEX_TRACE=1` | provider/agent/app-server 追踪（stderr） |
-| `CODEX_BIN` | 覆盖 codex 入口脚本（测试）；默认 = 本包 pin 的 `@openai/codex/bin/codex.js` |
+| `CODEX_BIN` | 显式覆盖 Codex 核心或 JS 入口；默认依序发现 desktop 核心、用户 CLI、包内 exact-pin fallback |
 | `CODEX_HOME` | Codex 原生 home 重定向（**测试专用**；生产路径零重定向） |
 | `CODEX_APPROVAL_MODE` | 覆盖审批档（`never`/`on-request`/`on-failure`/`untrusted`；非法值忽略） |
 | `CODEX_APPROVAL_TIMEOUT_MS` | 审批应答超时；`0` 关闭；默认 300000 |
 | `CODEX_IDLE_EXIT_MS` | 会话空闲后拆客户端；`0` 关闭；默认 600000 |
 
+## Binary 与官方 OAuth
+
+核心发现顺序是显式 `CODEX_BIN` → 已安装 desktop 核心 → 用户 CLI → 包内 `@openai/codex@0.160.0`。
+发现和启动仅发生在真正 prompt 时。JS 入口经 Node 启动，原生核心直接执行；认证或生成失败不会静默换 provider。
+desktop 优先选择核心版本，不代表复制 desktop 宿主：独立 app-server 使用 Super D 自有 clientInfo，
+不借用父任务的 desktop 工具 pipe。browser/computer use 仍需要对应宿主服务与工具接线。
+
+本地 `auth.json` 有 ChatGPT OAuth 时，模型选择器增加只读的 **OpenAI OAuth** provider。
+adapter 正本仅存其 native 身份，token 留在 Codex home；选择该 route 时通过子进程配置覆盖 builtin `openai`，
+不会改写用户的 config/auth。官方模型读取原生 `models_cache.json`，并保留原生配置的官方默认模型；第三方自定义目录不会当作官方目录。
+没有原生目录冲突时不强制注入静态 catalog，让实际选中的 binary 按版本、身份与有效期维护 cache；有目录冲突时仅注入可消费的官方 cache，缺失时明确报错。原生默认模型的 ID 不代表当前 binary 的访问权限。OAuth logout 后显式选择必须失败，不能落到本地第三方默认配置。
+
 ## 测试
 
 ```bash
-npm run build                                   # tsc strict
+node super-dsh/scripts/pack.mjs                  # 仓根执行，唯一构建打包入口
 DSH_HOME=<repo>/.tests \
-SUPERD_DSH_ANCHOR=<repo>/upstream/deepseek-harness/package.json \
-node --test test/*.test.mjs
+SUPERD_DSH_ANCHOR=<repo>/upstream/deepseek-harness/apps/cli/package.json \
+node --test super-dsh/agent-codex/test/*.test.mjs
 ```
 
 单测全部是 fake：`test/fixtures/fake-app-server.mjs` 是一个**可编程的 app-server 替身**

package/agent-codex/dist/adapter.js

@@ -1,3 +1,5 @@
+import { readEffectiveProviderStore } from "./codex-oauth.js";
+import { resolveCodexHome } from "./codex-store.js";
 /**
  * Codex-backed `LlmAdapter` registered on `ctx.llm` by the Codex provider.
  *
@@ -23,7 +25,6 @@
  * @module agent-codex/adapter
  */
 import { LlmAdapter, LlmError, } from "@deepseek-ai/dsh-llm";
-import { readProviderStore } from "./codex-providers.js";
 /**
  * The single route every Codex model was served under before the multi-provider
  * rework. No longer registered (a session pinned to it falls back to whatever
@@ -41,7 +42,7 @@ export function routeIds(store) {
 }
 /** The provider entry a route id names, or `undefined`. */
 export function providerFor(worldHome, providerId) {
-    return readProviderStore(worldHome).providers.find((entry) => entry.id === providerId);
+    return readEffectiveProviderStore(worldHome, resolveCodexHome()).providers.find((entry) => entry.id === providerId);
 }
 export class CodexLlmAdapter extends LlmAdapter {
     worldHome;

package/agent-codex/dist/agent.js

@@ -289,6 +289,11 @@ export class CodexAgent {
      */
     #remoteQueue = [];
     #bridgedToolResults = new Set();
+    /** callIds already advertised by an appended assistant/message frame — the
+     *  strict validator refuses any `tool/call` whose callId no assistant frame
+     *  advertised, and requires the execution arguments to equal the advertised
+     *  string (2026-10-04 dev3 omp/hermes repair: same write-side family). */
+    #advertisedToolCalls = new Set();
     /**
      * The open turn's FINAL assistant message, buffered from `message_end`
      * until `turn_end` so the SAME turn's usage can land on it (the DSH
@@ -711,9 +716,14 @@ export class CodexAgent {
         // An unknown provider id (a session pinned before the multi-provider rework)
         // maps to "no injection": the user's own config.toml is the honest answer.
         const launchSpec = launch ?? NATIVE_LAUNCH;
-        const providerId = launch === undefined ? null : route?.provider ?? null;
+        const providerId = launch === undefined ? null : launch.runtimeProvider ?? route?.provider ?? null;
         const client = this.#client;
         const key = `${providerId ?? "native"}/${route?.model ?? ""}`;
+        // Pin before ensureStarted: the first thread and turn otherwise inherit
+        // the native model captured at construction, even with a new provider.
+        if (route !== undefined) {
+            await client.setModel(route.provider, route.model);
+        }
         if (!client.spawned && client.threadId === null) {
             client.applyLaunch(launchSpec, providerId);
             await client.ensureStarted();
@@ -726,11 +736,6 @@ export class CodexAgent {
         else if (client.appliedProvider !== providerId) {
             await client.reattach(launchSpec, providerId, route?.model);
         }
-        else if (route !== undefined) {
-            await client.setModel(route.provider, route.model).catch((error) => {
-                trace(`set_model ${key} failed: ${String(error)}`);
-            });
-        }
         this.#routeKey = key;
     }
     /**
@@ -1043,7 +1048,32 @@ export class CodexAgent {
             case "tool_execution_start": {
                 const callId = String(event.toolCallId ?? "");
                 const name = String(event.toolName ?? "");
+                const argumentsJson = String(event.argumentsJson ?? JSON.stringify(event.args ?? {}));
                 this.#commitStepStart();
+                // Advertisement-before-execution (validator invariant, 2026-10-04 dev3
+                // omp/hermes repair family): unless a real assistant frame advertised
+                // this callId, bridge a minimal assistant/message carrying the
+                // tool-call block — arguments copied verbatim into both frames. The
+                // synthesized source mirrors #appendAssistantMessage's open-turn
+                // fallback chain.
+                if (!this.#advertisedToolCalls.has(callId)) {
+                    const advertisement = createAssistantMessage({
+                        content: [{ type: "tool-call", id: ToolCallId(callId), name, arguments: argumentsJson }],
+                        source: {
+                            provider: String(this.#turnRoute?.provider ?? this.options.provider ?? ""),
+                            model: String(this.#turnRoute?.model ?? this.options.model ?? ""),
+                        },
+                    });
+                    this.session.append("assistant/message", {
+                        turn: this.#dashTurn,
+                        step: this.#step,
+                        message: advertisement,
+                        stream: [],
+                    }, {
+                        surfaceOp: "append",
+                    });
+                    this.#advertisedToolCalls.add(callId);
+                }
                 this.session.append("tool/call", {
                     turn: this.#dashTurn,
                     step: this.#step,
@@ -1052,7 +1082,7 @@ export class CodexAgent {
                     // The DSH payload requires the RAW JSON string the model produced;
                     // the wire carries it verbatim for MCP calls and renders it from the
                     // discrete fields for the other item shapes.
-                    arguments: String(event.argumentsJson ?? JSON.stringify(event.args ?? {})),
+                    arguments: argumentsJson,
                 });
                 break;
             }
@@ -1164,6 +1194,10 @@ export class CodexAgent {
     }
     #appendAssistantMessage(message, usage) {
         const content = convertContent(message.content);
+        for (const block of content) {
+            if (block.type === "tool-call")
+                this.#advertisedToolCalls.add(block.id);
+        }
         const assistant = createAssistantMessage({
             content,
             source: {

package/agent-codex/dist/app-server-client.js

@@ -440,11 +440,17 @@ export class CodexAppServerClient {
             // crash still fails the client.
             const generation = ++this.#transportGeneration;
             const launch = this.#launch;
+            // This is an independent Super D consumer, including when its parent
+            // happens to be a desktop task. The desktop host's attribution and
+            // tools pipe belong to that host, not to this new app-server.
+            const childEnv = { ...process.env, ...launch.env };
+            delete childEnv.CODEX_INTERNAL_ORIGINATOR_OVERRIDE;
+            delete childEnv.CODEX_APP_TOOLS_PIPE_PATH;
             transport = transportFactory({
                 ...(this.#options.cwd === undefined ? {} : { cwd: this.#options.cwd }),
                 ...(this.#options.requestTimeoutMs === undefined ? {} : { requestTimeoutMs: this.#options.requestTimeoutMs }),
                 args: ["app-server", ...launch.argv],
-                env: { ...process.env, ...launch.env },
+                env: childEnv,
                 onNotification: (notification) => this.#onNotification(notification),
                 onServerRequest: (request) => this.#onServerRequest(request),
                 onExit: (info) => {

package/agent-codex/dist/app-server-wire.js

@@ -7,7 +7,7 @@
  * `{"id":…,"result":…}` / `{"id":…,"error":{…}}`).
  *
  * This module owns exactly four things and nothing else:
- *   1. executable resolution (pin-faithful: the package's own `@openai/codex`),
+ *   1. runtime selection (override → installed desktop → CLI → pinned package),
  *   2. process spawn + line framing + per-id request/response correlation,
  *   3. dispatch of server-initiated notifications and server-requests,
  *   4. teardown (process GROUP kill — the app-server may spawn stdio MCP
@@ -22,7 +22,8 @@
  * process, and the client calls it on first real work.
  */
 import { spawn } from "node:child_process";
-import { createRequire } from "node:module";
+import { resolveCodexRuntime } from "./codex-runtime.js";
+export { resolveCodexCommand, resolveCodexRuntime } from "./codex-runtime.js";
 /** Per-request protocol error surfaced by the server (JSON-RPC `error` object). */
 export class CodexWireError extends Error {
     code;
@@ -37,23 +38,6 @@ export class CodexWireError extends Error {
 /** Server overload: the documented retryable backpressure code. */
 export const SERVER_OVERLOADED_CODE = -32001;
 const DEFAULT_REQUEST_TIMEOUT_MS = 60_000;
-/** The codex entry script this package pins (`@openai/codex/bin/codex.js`). */
-export function resolveCodexCommand() {
-    const override = process.env.CODEX_BIN;
-    if (override !== undefined && override.trim() !== "")
-        return override;
-    const require = createRequire(import.meta.url);
-    try {
-        // Pin-faithful: the SAME `@openai/codex` this package depends on, so the
-        // wire protocol and the binary version can never drift apart. Set
-        // CODEX_BIN to override (tests).
-        return require.resolve("@openai/codex/bin/codex.js");
-    }
-    catch (error) {
-        throw new Error("cannot locate the pinned codex CLI (@openai/codex/bin/codex.js): "
-            + `${error instanceof Error ? error.message : String(error)}. Install the package or set CODEX_BIN.`);
-    }
-}
 /** True for a plain JSON object (never arrays/null). */
 function asRecord(value) {
     if (value === null || typeof value !== "object" || Array.isArray(value))
@@ -90,17 +74,21 @@ export class CodexAppServerTransport {
     start() {
         if (this.#child !== undefined)
             return;
-        const command = this.#options.command ?? resolveCodexCommand();
+        const env = this.#options.env ?? { ...process.env };
+        const runtime = resolveCodexRuntime({
+            env: this.#options.command === undefined ? env : { ...env, CODEX_BIN: this.#options.command },
+        });
         const args = [...(this.#options.args ?? ["app-server"])];
         // `detached` gives the child its own process group so teardown can kill
         // the whole tree (stdio MCP descendants included), not just the root.
-        const child = spawn(process.execPath, [command, ...args], {
+        const child = spawn(runtime.nodeScript ? process.execPath : runtime.command, runtime.nodeScript ? [runtime.command, ...args] : args, {
             cwd: this.#options.cwd,
-            env: this.#options.env ?? { ...process.env },
+            env,
             stdio: ["pipe", "pipe", "pipe"],
             detached: true,
         });
         this.#child = child;
+        this.#options.onStderr?.(`codex runtime source=${runtime.source} command=${runtime.command} mode=${runtime.nodeScript ? "node" : "native"}\n`);
         child.stdout?.setEncoding("utf8");
         child.stderr?.setEncoding("utf8");
         child.stdout?.on("data", (chunk) => this.#onStdout(chunk));

package/agent-codex/dist/codex-launch.js

@@ -1,35 +1,4 @@
-/**
- * codex-launch.ts — how a provider reaches a `codex app-server` child
- * (2026-10-04 on-the-fly rework).
- *
- * The retired design put the provider in force by REWRITING the user's
- * `~/.codex/config.toml` before the child started. That made the user's native
- * home the switchboard: every switch was a disk write, only ever affected the
- * next child, and fought every other tool that owns the same file (cc-switch's
- * whole-config rewrites, the user's own hand edits).
- *
- * This module replaces it with process arguments. `codex app-server -c
- * <dotted.path>=<value>` overrides any `config.toml` value for THAT child
- * alone (the flag's own help text: "Override a configuration value that would
- * otherwise be loaded from `~/.codex/config.toml`. Use a dotted path."), and
- * `ThreadStartParams`/`ThreadResumeParams` accept the same object as `config`.
- * A provider therefore costs nothing on disk and is scoped to one process, which
- * is exactly what a per-session provider choice needs.
- *
- * Measured constraints this module encodes (see
- * `docs/test-reports/2026-10-03-codex-provider-model-switch-probe.md`):
- *
- *  - a HYPHENATED id is fine in a dotted path (`model_providers.zhipu-cn.…`),
- *    so native table names survive verbatim as provider ids;
- *  - `model_catalog_json` is resolved against the process CWD when it arrives
- *    as an override, so the path is always absolute;
- *  - `env_key` is the one auth shape that never consults the auth manager, so a
- *    stored API key rides the CHILD's environment under a synthetic variable
- *    name. That is also what makes a keyed provider usable behind a ChatGPT
- *    login, where `requires_openai_auth` is silently shadowed.
- *
- * @module agent-codex/codex-launch
- */
+import { officialCatalogForLaunch } from "./codex-oauth.js";
 import { tomlString, writeProviderCatalog } from "./codex-native-config.js";
 /** The environment variable prefix for a key this adapter injects itself. */
 const SYNTHETIC_KEY_PREFIX = "SUPERD_CODEX_KEY_";
@@ -48,6 +17,15 @@ export function syntheticKeyName(providerId) {
  * @returns the argv/env additions and the provider id they pin.
  */
 export function providerLaunch(worldHome, codexHome, provider) {
+    if (provider.kind === "openai-oauth") {
+        const catalog = officialCatalogForLaunch(codexHome);
+        // Empty override is filtered to None by Codex, restoring its builtin
+        // endpoint without changing the user's native configuration.
+        const argv = ["-c", 'model_provider="openai"', "-c", 'openai_base_url=""'];
+        if (catalog !== undefined)
+            argv.push("-c", `model_catalog_json=${tomlString(catalog)}`);
+        return { argv, env: {}, runtimeProvider: "openai" };
+    }
     const table = `model_providers.${provider.id}`;
     const argv = [
         "-c", `${table}.name=${tomlString(provider.label)}`,