super-dsh 0.1.9 → 0.1.10-e

package/agent-codex/dist/adapter.js

@@ -3,53 +3,89 @@
  *
  * The browser model selector never touches the Codex agent directly: it is an
  * RPC round-trip through the apiproxy, which reads `ctx.llm.listProviders /
- * listModels / resolveModel` to build the catalog. This adapter answers those
- * queries from the Codex home's real catalog (`models.ts`: config.toml +
- * model_catalog_json) under the single provider route `codex` — never the
- * native deepseek-official / pi-ai routes, which the profile disables.
+ * listModels / resolveModelInfo` to build the catalog. This adapter answers
+ * those queries from the ADAPTER's canonical provider store
+ * (`codex-providers.ts`), registering ONE ROUTE PER CONFIGURED PROVIDER.
  *
- * `stream` is never dispatched: Codex owns generation through its SDK thread
- * (`CodexAgent`), so the adapter only serves catalog/metadata queries. It
- * throws rather than fabricating a wire route the harness would misuse.
+ * That one-route-per-provider shape is the 2026-10-04 rework, and it is what
+ * makes the whole feature DSH-native: the harness's own model selector already
+ * renders a provider-grouped catalog, already keeps the choice per session
+ * (`session/selectModel` → the durable `model/selection` event + the
+ * `modelSelection` projection), and already reports which route a session last
+ * used. Registering the Codex providers as real routes means Super D gets all
+ * of that by construction instead of re-implementing it — there is no "active
+ * provider" left for the UI to hold.
+ *
+ * `stream` is never dispatched: Codex owns generation through its app-server
+ * thread (`CodexAgent`), so the adapter only serves catalog/metadata queries.
+ * It throws rather than fabricating a wire route the harness would misuse.
+ *
+ * @module agent-codex/adapter
  */
 import { LlmAdapter, LlmError, } from "@deepseek-ai/dsh-llm";
-import { readCodexModelCatalog } from "./models.js";
-/** The one provider route every Codex model is served under. */
+import { readProviderStore } from "./codex-providers.js";
+/**
+ * The single route every Codex model was served under before the multi-provider
+ * rework. No longer registered (a session pinned to it falls back to whatever
+ * the native `config.toml` runs), but kept as the one named constant so the
+ * legacy value is greppable in session logs.
+ */
 export const CODEX_PROVIDER_ID = "codex";
+/** Whether a provider may be registered as a model route. */
+export function routableProvider(entry) {
+    return entry.models.length > 0;
+}
+/** The route ids a store currently contributes to `ctx.llm`. */
+export function routeIds(store) {
+    return store.providers.filter(routableProvider).map((entry) => entry.id);
+}
+/** The provider entry a route id names, or `undefined`. */
+export function providerFor(worldHome, providerId) {
+    return readProviderStore(worldHome).providers.find((entry) => entry.id === providerId);
+}
 export class CodexLlmAdapter extends LlmAdapter {
-    home;
+    worldHome;
     /**
-     * `home` = the codex app home — the CLI's native `~/.codex` (2026-09-17
-     * home ruling), resolved by the provider via resolveCodexHome() so catalog
-     * reads never depend on construction-time context.
+     * @param worldHome - the world's DSH home, holding the canonical provider
+     *   store in `<worldHome>/codex-providers.json`. Read on every call, so a
+     *   panel edit is visible to the next catalog query without re-registration.
      */
-    constructor(home) {
+    constructor(worldHome) {
         super();
-        this.home = home;
+        this.worldHome = worldHome;
     }
-    providerInfo(_provider) {
-        return { id: CODEX_PROVIDER_ID, name: readCodexModelCatalog(this.home).provider ?? "Codex" };
+    providerInfo(provider) {
+        // The display name is the entry's label — for a provider folded in from the
+        // user's own config that is its endpoint URL, which is the only name a
+        // hand-written codex config supplies.
+        return { id: provider, name: providerFor(this.worldHome, provider)?.label ?? provider };
     }
-    async listModels(_provider) {
-        return readCodexModelCatalog(this.home).models.map((model) => ({
-            provider: CODEX_PROVIDER_ID,
+    async listModels(provider) {
+        const entry = providerFor(this.worldHome, provider);
+        if (entry === undefined)
+            return [];
+        return entry.models.map((model) => ({
+            provider,
             id: model.id,
-            name: model.label,
+            name: model.displayName ?? model.id,
         }));
     }
-    async resolveModel(_provider, model) {
-        const found = readCodexModelCatalog(this.home).models.find((candidate) => candidate.id === model);
+    async resolveModel(provider, model, _signal) {
+        const entry = providerFor(this.worldHome, provider);
+        const found = entry?.models.find((candidate) => candidate.id === model);
         if (found === undefined) {
-            throw new LlmError(`Codex provider "${CODEX_PROVIDER_ID}" does not serve model "${model}"`, "MODEL_NOT_FOUND");
+            throw new LlmError(`Codex provider "${provider}" does not serve model "${model}"`, "MODEL_NOT_FOUND");
         }
         return {
-            provider: CODEX_PROVIDER_ID,
+            provider,
             id: found.id,
-            name: found.label,
-            ...(found.contextWindow !== undefined && found.contextWindow > 0 ? { context: { contextWindow: found.contextWindow } } : {}),
+            name: found.displayName ?? found.id,
+            ...(found.contextWindow !== undefined && found.contextWindow > 0
+                ? { context: { contextWindow: found.contextWindow } }
+                : {}),
         };
     }
     stream(_options) {
-        throw new LlmError("the Codex adapter does not stream: Codex owns generation through its SDK agent", "UNSUPPORTED_STREAM");
+        throw new LlmError("the Codex adapter does not stream: Codex owns generation through its app-server thread", "UNSUPPORTED_STREAM");
     }
 }

package/agent-codex/dist/agent.js

@@ -1,8 +1,13 @@
 import { agentEvents } from "@deepseek-ai/dsh-agent";
 import { Inbox } from "./inbox.js";
+import { canonicalHeader, headerEquals } from "@deepseek-ai/dsh-session";
 import { LlmAttemptId, ToolCallId, QUOTA_EXCEEDED_CODE, createAssistantMessage, createSystemMessage, createToolResultMessage, createUserMessage } from "@deepseek-ai/dsh-llm";
 import { createScope } from "@deepseek-ai/dsh-scope";
+import { makeApprovalHandler, parseApprovalTimeout } from "./app-server-approvals.js";
+import { presetFromEvents, turnPolicyFromEvents } from "./permission.js";
 import { withSystemHead } from "../../superd-hub/dist/index.js";
+import { NATIVE_LAUNCH } from "./codex-launch.js";
+import { resolveRoute } from "./codex-route.js";
 /**
  * v2 live assistant-stream publication for the Codex bridge — the same frame
  * protocol the reference loop's AssistantStreamAttempt speaks (start marker,
@@ -193,11 +198,15 @@ function userMessageText(message) {
 /**
  * Dash-host plugin narration from the approval service: the policy-change
  * notice `agent.inject` carries when `/permission` switches a live session's
- * approval policy. Codex has no runtime approval control either (the policy
- * is pinned at launch via the preset mapping; no SDK surface changes it
- * mid-session), so forwarding the text would steer it into an in-flight turn
- * (interrupting tool work) and echo it into history as a fake user prompt.
- * Detect and drop it.
+ * approval policy.
+ *
+ * App-server line (2026-10-03): the switch itself is now REAL — the fold in
+ * `#syncTurnPolicy` reads the accompanying `approval/policy` + `sandbox/mode`
+ * events and overrides both fields on the next `turn/start`. The narration TEXT
+ * is still dropped on purpose: it is DSH's own sandbox-policy sentence, written
+ * for the native tool loop, and Codex enforces its own policy inside the rust
+ * runtime. Forwarding it would steer it into the in-flight turn (interrupting
+ * tool work) and echo into history as a fake user prompt.
  */
 function isApprovalNarration(message) {
     // 0.1.7: the shared `plugin` source kind is gone (MessageSourceMap is
@@ -235,6 +244,12 @@ function parseIdleExit(raw) {
     const value = Number(raw);
     return Number.isFinite(value) && value >= 0 ? value : 600_000;
 }
+/**
+ * Approval answer timeout: fail closed (decline) after this long so a headless
+ * or unattended run can never hang Codex on a card nobody answers. `0`
+ * disables the timeout. Default: 5 minutes.
+ */
+const CODEX_APPROVAL_TIMEOUT_MS = parseApprovalTimeout(process.env.CODEX_APPROVAL_TIMEOUT_MS);
 export class CodexAgent {
     id;
     options;
@@ -281,8 +296,26 @@ export class CodexAgent {
      * failure/abort paths so the turn's visible text is never dropped.
      */
     #deferredAssistant = null;
-    /** The last selection already synced to the client via `set_model`, as `provider/model`. */
-    #lastSyncedModel = null;
+    /**
+     * The route the OPEN turn runs, captured when the turn opened.
+     *
+     * Codex's wire messages carry no provider attribution, so the assistant
+     * message's `source` has to be stamped from here. `options` is the wrong
+     * source for it: options are frozen at create/resume, so after a mid-session
+     * switch they name the provider the session STARTED on. Measured on the 4999
+     * line: turn 2 ran on `deepseek/deepseek-flash` while its assistant message was
+     * attributed to `zhipu-cn/glm-5.3-flash` — a user-visible lie, since the UI and
+     * the model-switch notice both read that attribution.
+     */
+    #turnRoute = undefined;
+    /**
+     * The route the LIVE child was last told to run, as `provider/model`. Purely
+     * a work-saver: the client is idempotent about `setModel` and `reattach`, and
+     * this only keeps a steady session from re-issuing either every turn.
+     */
+    #routeKey = null;
+    /** Whether THIS agent instance has already logged a `request/header` snapshot. */
+    #requestHeaderLogged = false;
     /** Fires when the agent has been idle past CODEX_IDLE_EXIT_MS (tears down the client). */
     #onIdleExit;
     #idleExitTimer = undefined;
@@ -310,37 +343,43 @@ export class CodexAgent {
         this.#lastTurn = session.snapshotEvents().findLast((event) => event.type === "turn/start")?.data.turn ?? 0;
         client.on((event) => this.#handleEvent(event));
         client.onFailure((error) => this.#fail(error));
+        // App-server line (2026-10-03): Codex now ASKS before running a command or
+        // applying a patch (`item/commandExecution|fileChange/requestApproval` plus
+        // the legacy execCommand/applyPatch pair) and blocks the tool until the
+        // client answers. Bridge those requests onto the Dash approval seam, whose
+        // Web UI answerer renders the ApprovalPanel. Every failure path answers
+        // DECLINE (fail-closed) so a request is never left hanging; the service is
+        // resolved lazily because the approval row lives in a sibling fiber.
+        client.setServerRequestHandler(makeApprovalHandler({
+            getApproval: () => this.ctx.get("approval"),
+            agent: this,
+            timeoutMs: CODEX_APPROVAL_TIMEOUT_MS,
+            asCallId: (raw) => ToolCallId(raw),
+            trace: (message) => trace(message),
+        }));
         // Session-identity events (the agent-preset stamp) are committed on the
         // FIRST turn by #bootstrapSessionIdentity — only once the client actually
         // exists — so a freshly created session announces completely blank,
         // exactly like the native agent-loop factory's: the backend takes zero
         // part in the UI's browser-local new-session draft.
-        // `/permission` cannot work here: Codex pins the approval policy at
-        // launch and no SDK surface changes it mid-session. Registering the SAME
-        // name on this agent's own scope (a command-injected child of `agent.ctx`)
-        // SHADOWS the global permission command for this agent only — the switch
-        // then fails cleanly instead of appending approval/policy events Codex
-        // cannot honor. (The `inject` narration drop below stays as the backstop.)
-        this.ctx.inject(["commands"], (cmdCtx) => cmdCtx.commands.register({
-            name: "permission",
-            description: "Unavailable for Codex sessions (approval policy is fixed at Codex launch)",
-            input: { hint: "<preset>" },
-            handler: () => ({
-                kind: "error",
-                text: "Approval policy is fixed at Codex launch; runtime switching is not supported for Codex sessions.",
-            }),
-        }));
-        // `/compact` parity: the SDK line exposes no compaction surface (V1 gap
-        // table: no messages surgery/compact — fail-soft default). Shadowing the
-        // loop-owned global name keeps the (disabled) native pipeline from
-        // receiving it; the command node renders the clean refusal natively.
+        //
+        // `/permission` is NOT shadowed on the app-server line: the app-server
+        // accepts `approvalPolicy` + `sandboxPolicy` on every `turn/start`, so the
+        // global command's `permission/preset` + `sandbox/mode` + `approval/policy`
+        // triple is folded per turn by #syncTurnPolicy and takes effect from the
+        // NEXT turn on. (The SDK line had to shadow it with a refusal.)
+        // `/compact` parity: the app-server DOES expose `thread/compact/start` +
+        // `thread/compacted`, but the DSH compaction event vocabulary is not wired
+        // to it yet (registered backlog item). Shadowing the loop-owned global name
+        // keeps the (disabled) native pipeline from receiving it; the command node
+        // renders the clean refusal natively.
         this.ctx.inject(["commands"], (cmdCtx) => cmdCtx.commands.register({
             name: "compact",
-            description: "Unavailable for Codex sessions (the SDK line has no compaction surface)",
+            description: "Unavailable for Codex sessions (thread compaction is not wired yet)",
             input: { hint: "[instructions]" },
             handler: () => ({
                 kind: "error",
-                text: "Compaction is not available for Codex sessions: the SDK line has no compaction surface.",
+                text: "Compaction is not available for Codex sessions yet: the app-server's thread/compact/start is not wired to the Dash compaction events.",
             }),
         }));
     }
@@ -360,18 +399,16 @@ export class CodexAgent {
     steer(message) {
         // Mirrors dsh-agent-loop's `steer = send(input, "next-step", true)`: an
         // idle driver starts a turn; a running driver consumes it at the next
-        // step (on the SDK line: queued followUp after the in-flight turn).
+        // step (app-server line: `turn/steer` into the live turn).
         this.#deliver(message, "next-step", true);
     }
     inject(message) {
-        // Dash-host approval-policy narrations have no Codex runtime equivalent
-        // (the policy is pinned at launch; no SDK surface changes it mid-session).
-        // Forwarding the text would steer it into an in-flight turn — interrupting
-        // tool work — and echo it into history as a fake user prompt. Drop it; the
-        // accompanying `approval/policy` session event stays recorded so the UI's
-        // permission state remains truthful.
+        // Drop the approval-policy narration text (see isApprovalNarration). The
+        // real switch rides the accompanying `approval/policy` + `sandbox/mode`
+        // session events, which #syncTurnPolicy folds into the next turn/start;
+        // recording them keeps the UI's permission state truthful.
         if (isApprovalNarration(message)) {
-            trace("inject: dropped approval-policy narration (Codex lacks runtime approval control)");
+            trace("inject: dropped approval-policy narration (the switch rides the session events, not the text)");
             return;
         }
         // Mirrors dsh-agent-loop's `inject = send(input, "next-step", false)`:
@@ -430,7 +467,7 @@ export class CodexAgent {
      *
      * Busy is the LOCAL turn state (`#turnOpen`), not the `#streaming` flag:
      * the client needs a moment to emit `agent_start` after a prompt, and in
-     * that gap a bare `prompt` is still safe on the SDK line, but keeping the
+     * that gap a bare `prompt` is still safe on the app-server line, but keeping the
      * omp queuing semantics makes the echo mapping identical.
      */
     #deliver(message, target, wakeup) {
@@ -471,10 +508,15 @@ export class CodexAgent {
      * reservation.
      */
     async #startTurn(message) {
+        let route;
         try {
-            await this.#client.ensureStarted();
-            await this.#bootstrapSessionIdentity();
-            await this.#syncModelSelection();
+            // The route is resolved and put in force BEFORE the thread is touched: a
+            // provider switch is a different child process, and `thread/resume` cannot
+            // move a thread a live app-server already holds (`#applyRoute`).
+            route = this.#resolveRoute();
+            await this.#applyRoute(route);
+            this.#turnRoute = route;
+            this.#syncTurnPolicy();
         }
         catch (error) {
             trace(`#startTurn cold start failed: ${String(error)}`);
@@ -489,7 +531,9 @@ export class CodexAgent {
         if (this.#disposed)
             return;
         this.session.append("turn/start", { turn: this.#dashTurn });
-        this.#emitRequestContext();
+        if (route !== undefined)
+            this.#commitRequestHeader(route);
+        this.#emitRequestContext(route);
         this.session.append("user/message", message, { surfaceOp: "append" });
         void this.#client.prompt(userMessageText(message)).catch((error) => this.#fail(error));
     }
@@ -529,28 +573,34 @@ export class CodexAgent {
      * Turn-enclosed (no step required) and deduped by route key, so it lands at
      * the start of a turn and again only when the effective route changes.
      */
-    #emitRequestContext() {
-        if (this.#runtimeInfo === undefined || !this.#turnOpen)
-            return;
-        const route = this.#runtimeInfo.routeContext(this.options.model);
-        if (route === undefined)
+    /**
+     * Stamp route metadata for the next request (`request/context`): the effective
+     * provider/model plus the provider's own context window when it advertises one.
+     * Turn-enclosed (no step required) and deduped by route key, so it lands at
+     * the start of a turn and again only when the effective route changes.
+     *
+     * @param route - the route this turn runs, already resolved by `#resolveRoute`.
+     */
+    #emitRequestContext(route) {
+        if (route === undefined || !this.#turnOpen)
             return;
         const key = `${route.provider}/${route.model}`;
         if (key === this.#lastRouteKey)
             return;
         this.#lastRouteKey = key;
+        const contextWindow = this.#runtimeInfo?.contextWindowFor?.(route.provider, route.model);
         this.session.append("request/context", {
             provider: route.provider,
             model: route.model,
-            ...(route.contextWindow === undefined ? {} : { contextWindow: route.contextWindow }),
+            ...(contextWindow === undefined ? {} : { contextWindow }),
         });
-        trace(`request/context ${key}${route.contextWindow === undefined ? "" : ` ctx=${route.contextWindow}`}`);
+        trace(`request/context ${key}${contextWindow === undefined ? "" : ` ctx=${contextWindow}`}`);
     }
     /**
      * One-shot first-turn identity commit: the agent-preset stamp (idempotent).
-     * The SDK line exposes no system-prompt surface, so — unlike the omp
-     * bridge — no `system/message` node is emitted here; a Codex session's
-     * system prompt is Codex's own and never crosses the wire. The guard —
+     * The system prompt is not sent BY us: Codex owns its base instructions and
+     * the adapter recovers them from the rollout HEAD (see #emitSystemMessage).
+     * The guard —
      * skip when the seed already carries a `system/message` — stays for shape
      * parity with resumed logs that might carry one.
      */
@@ -580,8 +630,26 @@ export class CodexAgent {
         if (this.#streaming || transport === "followUp")
             this.#flushRemote();
     }
+    /**
+     * Retarget the model the NEXT turn requests, without disturbing a live one.
+     *
+     * A delivery can arrive while a turn is running (steering, or a queued
+     * follow-up the client will auto-generate), and the app-server fixes a turn's
+     * route at `turn/start`. So the model — which the app-server does accept per
+     * turn — is re-pinned here, while a PROVIDER move is deliberately left to the
+     * next turn's `#startTurn`, which is the only place a child can be replaced.
+     */
+    async #pinNextModel() {
+        const route = this.#resolveRoute();
+        if (route === undefined)
+            return;
+        await this.#client.setModel(route.provider, route.model).catch((error) => {
+            trace(`set_model ${route.provider}/${route.model} failed: ${String(error)}`);
+        });
+    }
     #flushRemote() {
-        void this.#syncModelSelection().finally(() => {
+        this.#syncTurnPolicy();
+        void this.#pinNextModel().finally(() => {
             for (const entry of this.#remoteQueue) {
                 if (entry.sent)
                     continue;
@@ -594,33 +662,130 @@ export class CodexAgent {
         });
     }
     /**
-     * Push the effective model selection into the client before a turn is
-     * dispatched. The SDK has no live setModel, so the client stores the id
-     * and applies it as the next run's ThreadOption (via resumeThread, so the
-     * conversation context survives). The omp waterfall pair
-     * (system-prompt assemble → agent/request) is a V1 cut: the base is the
-     * session's logged `request/header` falling back to the global
-     * `agentDefaultModel` selection, else the agent options — the apiproxy's
-     * installed selection IS the global one this process serves.
+     * The route this session must run, resolved the way the harness itself
+     * resolves it.
+     *
+     * `sessionController.selectionFor(agent).current` is `pending ?? logged ??
+     * default`, and `pending` is the durable `modelSelection` projection's view of
+     * the latest `model/selection` event that no later `request/header` has
+     * consumed. Reading the PROJECTION (rather than re-scanning the log) is what
+     * makes a mid-turn switch work for free: the harness's own `session.selectModel`
+     * appends that event and retires it once this agent logs the header that used
+     * it, so "switch now, run next turn" is the projection's semantics, not ours.
+     *
+     * @returns the route, or `undefined` when nothing in the log or the services
+     * names a complete provider/model pair.
+     * @returns the route, or `undefined` when nothing in the log or the services
+     * names a complete provider/model pair (see `codex-route.ts` for the order).
      */
-    async #syncModelSelection() {
-        const persisted = this.session.requestHeader()?.config;
+    #resolveRoute() {
+        const projections = this.#loopCtx.get("sessionProjections");
         const service = this.ctx.get("agentDefaultModel");
-        const selection = service?.currentSelection();
-        const target = persisted !== undefined && persisted.provider !== "" && persisted.model !== ""
-            ? { provider: persisted.provider, model: persisted.model }
-            : selection !== undefined && selection.provider !== "" && selection.model !== ""
-                ? selection
-                : { provider: this.options.provider ?? "", model: this.options.model ?? "" };
-        if (target.provider === "" || target.model === "")
-            return;
-        const key = `${target.provider}/${target.model}`;
-        if (key === this.#lastSyncedModel)
-            return;
-        await this.#client.setModel(target.provider, target.model).catch((error) => {
-            trace(`set_model ${key} failed: ${String(error)}`);
+        return resolveRoute({
+            pending: projections?.stateOf?.(this.session, "modelSelection")?.pending,
+            logged: this.session.requestHeader()?.config,
+            preferred: service?.currentSelection(),
+            fallback: { provider: this.options.provider, model: this.options.model },
+        });
+    }
+    /**
+     * Put the resolved route in force on the native side, switching the CHILD if
+     * the provider moved.
+     *
+     * Three cases, in increasing cost:
+     *
+     *  1. nothing attached yet — pin the launch and let the first prompt spawn
+     *     (this is the lazy-spawn gate: choosing a model must not cost a process);
+     *  2. same provider, different model — `setModel` rides the next `turn/start`,
+     *     which the app-server documents as "this turn and subsequent turns";
+     *  3. different provider — the child has to be replaced, because a provider is
+     *     an argv-level property of the process and `thread/resume` cannot move a
+     *     thread a live app-server already holds (see `app-server-client.ts`
+     *     `reattach`). This is THE turn boundary the feature is built around.
+     *
+     * @param route - the resolved route, or `undefined` when none is known (the
+     * native config then decides, which is also a legacy `codex` selection's fate).
+     */
+    async #applyRoute(route) {
+        const launch = route === undefined ? undefined : this.#runtimeInfo?.launchFor(route.provider);
+        // An unknown provider id (a session pinned before the multi-provider rework)
+        // maps to "no injection": the user's own config.toml is the honest answer.
+        const launchSpec = launch ?? NATIVE_LAUNCH;
+        const providerId = launch === undefined ? null : route?.provider ?? null;
+        const client = this.#client;
+        const key = `${providerId ?? "native"}/${route?.model ?? ""}`;
+        if (!client.spawned && client.threadId === null) {
+            client.applyLaunch(launchSpec, providerId);
+            await client.ensureStarted();
+        }
+        else if (client.threadId === null) {
+            // A live child with no thread yet: still just a launch swap.
+            client.applyLaunch(launchSpec, providerId);
+            await client.ensureStarted();
+        }
+        else if (client.appliedProvider !== providerId) {
+            await client.reattach(launchSpec, providerId, route?.model);
+        }
+        else if (route !== undefined) {
+            await client.setModel(route.provider, route.model).catch((error) => {
+                trace(`set_model ${key} failed: ${String(error)}`);
+            });
+        }
+        this.#routeKey = key;
+    }
+    /**
+     * Log the request header the NEXT request runs under, exactly as the reference
+     * loop does.
+     *
+     * This single append is what wires Super D into the harness's model-selection
+     * state machine rather than beside it: the `modelSelection` projection takes
+     * `lastUsed` from it, `sessionController.consumeSelection` retires a pending
+     * switch when it matches, and `installModelSelection` compares it to decide
+     * whether a model-change notice is owed. Without it a resumed session can
+     * never say which provider produced its transcript.
+     *
+     * @param route - the route this turn runs.
+     */
+    #commitRequestHeader(route) {
+        const header = canonicalHeader({
+            config: {
+                provider: route.provider,
+                model: route.model,
+                ...(route.reasoningEffort === undefined
+                    ? {}
+                    : { reasoningEffort: route.reasoningEffort }),
+            },
         });
-        this.#lastSyncedModel = key;
+        const baseline = this.session.requestHeader();
+        if (!this.#requestHeaderLogged) {
+            this.session.append("request/header", { header, reason: baseline === undefined ? "initial" : "resume" });
+            this.#requestHeaderLogged = true;
+            return;
+        }
+        if (baseline === undefined || !headerEquals(baseline, header)) {
+            this.session.append("request/header", { header, reason: "change" });
+        }
+    }
+    /**
+     * Fold the session's LIVE permission state into the codex per-turn overrides
+     * and hand them to the client. The app-server accepts `approvalPolicy` and
+     * `sandboxPolicy` on every `turn/start` ("for this turn and subsequent
+     * turns"), so a `/permission` switch is honored from the NEXT turn on — the
+     * capability whose absence forced the SDK line to shadow that command with a
+     * refusal. Never throws: any fold failure leaves the previous override in
+     * place (the thread's launch posture), which is the safe direction.
+     */
+    #syncTurnPolicy() {
+        try {
+            const events = this.session.snapshotEvents();
+            const cwd = this.#runtimeInfo?.cwd?.() ?? "";
+            const policy = turnPolicyFromEvents(events, presetFromEvents(events), cwd);
+            this.#client.setTurnPolicy(policy);
+            trace(`turn policy: approval=${policy.approvalPolicy} sandbox=${policy.sandbox.type}`);
+        }
+        catch (error) {
+            trace(`turn policy fold failed: ${String(error)}`);
+        }
     }
     /**
      * Reserve a turn WITHOUT appending anything: the prompt path reserves
@@ -643,7 +808,15 @@ export class CodexAgent {
         this.#reserveTurn();
         this.#localUserPending = localUser;
         this.session.append("turn/start", { turn: this.#dashTurn });
-        this.#emitRequestContext();
+        // This path opens a turn for a message the CLIENT queued and is now
+        // generating, so the child is already running: resolve the route for the
+        // log's benefit only. It cannot have moved since the turn it belongs to
+        // started, because a provider switch needs a turn boundary.
+        const route = this.#resolveRoute();
+        this.#turnRoute = route;
+        if (route !== undefined)
+            this.#commitRequestHeader(route);
+        this.#emitRequestContext(route);
         this.session.append("user/message", message, { surfaceOp: "append" });
     }
     #closeTurn(reason) {
@@ -994,10 +1167,11 @@ export class CodexAgent {
         const assistant = createAssistantMessage({
             content,
             source: {
-                // Rollout/wire messages may carry no attribution: fall back to this
-                // agent's options (the omp bridge did the same).
-                provider: String(message.provider ?? this.options.provider ?? ""),
-                model: String(message.model ?? this.options.model ?? ""),
+                // Codex's wire messages carry no attribution at all, so the fallback is
+                // the route the OPEN turn runs — never `options`, which is frozen at
+                // create/resume and would name the provider the session started on.
+                provider: String(message.provider ?? this.#turnRoute?.provider ?? this.options.provider ?? ""),
+                model: String(message.model ?? this.#turnRoute?.model ?? this.options.model ?? ""),
             },
         });
         const bridge = this.#streamBridge;