viber-channel 0.8.32 → 0.8.33

package/lib/bridge_spawn.ts

@@ -75,6 +75,9 @@ export function createBridgeSpawn(opts: BridgeSpawnOptions = {}): SpawnFn {
 		// authoritatively below (codex-309-review blocking #1).
 		delete env.VIBER_AGENT_NAME_EXPLICIT;
 		delete env.VIBER_AGENT_ROLE;
+		// #665: a parent's codex model/effort must never pin a fresh agent; spec.env may set them.
+		delete env.VIBER_CODEX_MODEL;
+		delete env.VIBER_CODEX_EFFORT;
 		env.VIBER_AGENT_TIER = spec.tier;
 		if (spec.env) Object.assign(env, spec.env);
 		// Identity is set LAST, AFTER spec.env, so neither the inherited env nor a

package/lib/capabilities.ts

@@ -96,8 +96,9 @@ export function capabilitiesText(channelVersion: string | null = null): string {
 		"                                   → agent \"g1-dev\", team \"g1-solo\"",
 		"  runtime: claude|codex|gemma · permission: read-only|read-write (gemma: read-only",
 		"  only; all roles of one template must share one permission) · count optional;",
-		"  model/effort: leave them OUT (runtime default) UNLESS the owner explicitly asks",
-		"  for one; claude only: model opus|sonnet|haiku|fable, effort low|medium|high|xhigh|max.",
+		"  model/effort: on claude leave them OUT (runtime default) UNLESS the owner asks:",
+		"  model opus|sonnet|haiku|fable, effort low|medium|high|xhigh|max. On codex BOTH are",
+		"  REQUIRED: gpt-5.6-sol / low unless the owner asks for another listed pair.",
 		"  (On the web, sidebar ⋯ → Add agent launches ONE named agent without a template edit.)",
 		"",
 		"DISSOLVE (stops the processes, then revokes the proven-stopped instances):",
@@ -145,11 +146,16 @@ export function capabilitiesText(channelVersion: string | null = null): string {
 		"    runtime     REQUIRED  claude | codex | gemma",
 		"    permission  REQUIRED  read-only | read-write (gemma: read-only only)",
 		"    rolePrompt  REQUIRED  non-empty, ≤ 600 chars AFTER {prefix} expands to 32 chars",
-		"    model       optional  claude: opus | sonnet | haiku | fable (a family, never a",
-		"                      version); other runtimes: ≤ 64, stored but not applied",
-		"    effort      optional  claude only: low | medium | high | xhigh | max",
-		"                      model/effort: leave them OUT (runtime default) unless the",
-		"                      owner explicitly asks for one",
+		"    model       claude: optional, opus | sonnet | haiku | fable (a family, never a",
+		"                      version); codex: REQUIRED, one of gpt-6.1-sol gpt-6-astra",
+		"                      gpt-6-sol gpt-6-luna gpt-5.6-sol gpt-5.6-terra gpt-5.6-luna",
+		"                      gpt-5.5; gemma: ≤ 64, stored but not applied",
+		"    effort      claude: optional, low | medium | high | xhigh | max;",
+		"                      codex: REQUIRED, one the model accepts — low..xhigh on all,",
+		"                      max except gpt-5.5, ultra except the luna models and gpt-5.5;",
+		"                      gemma: refused",
+		"                      claude: leave model/effort OUT (runtime default) unless the",
+		"                      owner asks; codex: gpt-5.6-sol / low unless the owner asks",
 		"    count       optional  integer 1..10",
 		"  name: non-empty, ≤ 80, unique per owner, case-insensitive (409 without code = taken).",
 		"  update: send ONLY the fields you change (name / spec / project_id) plus",

package/lib/codex_model_pair.ts

@@ -0,0 +1,166 @@
+/**
+ * #665 — the model and reasoning effort a codex agent runs with.
+ *
+ * vibe-master hands them to the bridge as `VIBER_CODEX_MODEL` / `VIBER_CODEX_EFFORT`: BOTH or
+ * NEITHER. Neither is a role stored before #665 — the bridge then behaves exactly as before (no
+ * catalogue call, no field on `thread/start` / `turn/start`). A pair is:
+ *   - checked ONCE at startup against the catalogue of THIS codex (`model/list`), before any
+ *     thread or turn exists — the target is the pair SET by the template, never the model a
+ *     resumed thread reports (that one is the OLD model);
+ *   - applied on `thread/start` (a fresh thread) and on EVERY `turn/start`, which also moves a
+ *     resumed thread onto the template's model.
+ * Anything it cannot honour stops the bridge with a message naming the pair: no silent fallback.
+ */
+
+export interface CodexPair {
+	model: string;
+	effort: string;
+}
+
+/** A page of `model/list`, as codex-cli 0.159.3 answers it (only the fields read here). */
+export interface ModelListPage {
+	data?: { id?: unknown; model?: unknown; supportedReasoningEfforts?: unknown }[];
+	nextCursor?: unknown;
+}
+
+export type ModelListFetch = (cursor: string | null) => Promise<ModelListPage>;
+
+/** Read the pair from the env: both, or neither (`""` is unset, the #411 convention). */
+export function readCodexPair(env: NodeJS.ProcessEnv): CodexPair | undefined {
+	const model = env.VIBER_CODEX_MODEL?.trim() ?? "";
+	const effort = env.VIBER_CODEX_EFFORT?.trim() ?? "";
+	if (model === "" && effort === "") return undefined;
+	if (model === "" || effort === "") {
+		throw new Error(
+			`codex model/effort must come together: got VIBER_CODEX_MODEL="${model}", VIBER_CODEX_EFFORT="${effort}" — ` +
+				"relaunch from a template that sets both",
+		);
+	}
+	return { model, effort };
+}
+
+/** The `thread/start` fields for a pair (codex has no direct effort field there: it is config). */
+export function threadStartPairParams(pair: CodexPair | undefined): Record<string, unknown> {
+	if (pair === undefined) return {};
+	return { model: pair.model, config: { model_reasoning_effort: pair.effort } };
+}
+
+/** The `turn/start` fields for a pair — they persist for later turns, resumed threads included. */
+export function turnStartPairParams(pair: CodexPair | undefined): Record<string, unknown> {
+	if (pair === undefined) return {};
+	return { model: pair.model, effort: pair.effort };
+}
+
+/** The efforts a catalogue entry accepts (`[{ reasoningEffort }]`, or bare strings). */
+function effortsOf(entry: { supportedReasoningEfforts?: unknown }): string[] {
+	const raw = entry.supportedReasoningEfforts;
+	if (!Array.isArray(raw)) throw new Error("model/list entry without supportedReasoningEfforts");
+	return raw.map((e) => {
+		const v = typeof e === "string" ? e : (e as { reasoningEffort?: unknown } | null)?.reasoningEffort;
+		if (typeof v !== "string") throw new Error("model/list entry with a malformed reasoning effort");
+		return v;
+	});
+}
+
+/** Walk every page of `model/list`; a repeated cursor is a loop, not a catalogue. */
+async function collectCatalogue(fetchPage: ModelListFetch, expired: () => boolean): Promise<Map<string, string[]>> {
+	const catalogue = new Map<string, string[]>();
+	const seen = new Set<string>();
+	let cursor: string | null = null;
+	do {
+		// Past the deadline the caller has already refused: stop asking, do not walk on in the dark.
+		if (expired()) throw new Error("model/list walk stopped at the deadline");
+		const page = await fetchPage(cursor);
+		if (!Array.isArray(page.data)) throw new Error("model/list answered without a data array");
+		for (const entry of page.data) {
+			// `model` is the slug `thread/start` / `turn/start` take, guaranteed by 0.159.3. `id` equals
+			// it today but is not read: an entry without `model` is malformed, not resolved by guess.
+			const id = entry.model;
+			if (typeof id !== "string") throw new Error("model/list entry without a model");
+			catalogue.set(id, effortsOf(entry));
+		}
+		const next = page.nextCursor;
+		if (next !== null && next !== undefined && typeof next !== "string") {
+			throw new Error("model/list answered a non-string nextCursor");
+		}
+		cursor = next ?? null;
+		if (cursor !== null) {
+			if (seen.has(cursor)) throw new Error(`model/list repeated the cursor "${cursor}"`);
+			seen.add(cursor);
+		}
+	} while (cursor !== null);
+	return catalogue;
+}
+
+/**
+ * Throw unless THIS codex's catalogue carries the pair. One deadline covers the whole pagination;
+ * an RPC failure, a malformed answer or the deadline all throw — the caller stops the bridge.
+ */
+export async function verifyCodexPair(
+	pair: CodexPair,
+	fetchPage: ModelListFetch,
+	timeoutMs: number,
+): Promise<void> {
+	let timer: ReturnType<typeof setTimeout> | undefined;
+	let expired = false;
+	const deadline = new Promise<never>((_, reject) => {
+		timer = setTimeout(() => {
+			expired = true;
+			reject(new Error(`model/list did not answer within ${timeoutMs} ms`));
+		}, timeoutMs);
+	});
+	const walk = collectCatalogue(fetchPage, () => expired);
+	walk.catch(() => {}); // after the deadline its own rejection has nobody left to tell
+	let catalogue: Map<string, string[]>;
+	try {
+		catalogue = await Promise.race([walk, deadline]);
+	} catch (err) {
+		const why = err instanceof Error ? err.message : String(err);
+		throw new Error(`cannot check codex model ${pair.model} / effort ${pair.effort}: ${why}`);
+	} finally {
+		clearTimeout(timer);
+	}
+	const efforts = catalogue.get(pair.model);
+	if (efforts === undefined) {
+		throw new Error(
+			`codex model ${pair.model} is absent from the catalogue of THIS codex (has: ${[...catalogue.keys()].join(", ")}) — ` +
+				"update codex or re-edit the template",
+		);
+	}
+	if (!efforts.includes(pair.effort)) {
+		throw new Error(
+			`codex model ${pair.model} does not accept effort ${pair.effort} on THIS codex (accepts: ${efforts.join(", ")}) — ` +
+				"re-edit the template",
+		);
+	}
+}
+
+/**
+ * Why codex is NOT running the pair, judged from what `thread/start` / `thread/resume` answer
+ * (`model`, `reasoningEffort` — the thread's EFFECTIVE settings), or undefined when it is. A null
+ * effort is "not reported", not a mismatch. No pair: nothing to compare (pre-#665 behaviour).
+ */
+export function pairMismatch(
+	pair: CodexPair | undefined,
+	response: unknown,
+	method: string,
+): string | undefined {
+	if (pair === undefined) return undefined;
+	const r = (typeof response === "object" && response !== null ? response : {}) as {
+		model?: unknown;
+		reasoningEffort?: unknown;
+	};
+	if (r.model !== pair.model) {
+		return `codex ${method} runs model ${String(r.model)}, not the template's ${pair.model} — stopping rather than run the wrong model`;
+	}
+	// null = "not reported" (the field is nullable in 0.159.3); absent or any other type is a
+	// malformed answer, refused rather than read as a pass (Codex-2 review of cecd6ff7).
+	if (r.reasoningEffort === null) return undefined;
+	if (typeof r.reasoningEffort !== "string") {
+		return `codex ${method} answered a malformed reasoningEffort (${JSON.stringify(r.reasoningEffort) ?? "absent"}) — stopping rather than guess the effort`;
+	}
+	if (r.reasoningEffort !== pair.effort) {
+		return `codex ${method} runs effort ${r.reasoningEffort}, not the template's ${pair.effort} — stopping rather than run the wrong effort`;
+	}
+	return undefined;
+}

package/lib/runner_registry.ts

@@ -74,7 +74,7 @@ export interface RegistryRole {
   permission: string;
   rolePrompt?: string;
   model?: string;
-  /** #656: claude reasoning effort, replayed as `--effort` on a relaunch. */
+  /** #656 claude / #665 codex reasoning effort, replayed as `--effort` on a relaunch. */
   effort?: string;
 }
 

package/lib/team_template_tool.ts

@@ -56,8 +56,8 @@ export const TEAM_TEMPLATES_TOOL_DEF = {
         description:
           "The roster, for create/update: { roles: [{ role, runtime, permission, rolePrompt, model?, effort?, count? }] } — same shape `get` returns. " +
           "On update a spec REPLACES the whole spec: send every role. " +
-          "model: leave it OUT (the runtime picks its own default) UNLESS the owner explicitly asks for a model; on claude it is a family: opus, sonnet, haiku or fable. " +
-          "effort (claude only): low, medium, high, xhigh or max — same rule, leave it OUT unless asked. " +
+          "claude: leave model and effort OUT (the runtime picks its own default) UNLESS the owner explicitly asks; model is a family (opus, sonnet, haiku or fable), effort low, medium, high, xhigh or max. " +
+          "codex: model AND effort are REQUIRED — use gpt-5.6-sol / low unless the owner asks for another listed model and an effort it accepts. " +
           "Full field rules: the capabilities tool.",
       },
       project_id: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "viber-channel",
-  "version": "0.8.32",
+  "version": "0.8.33",
   "description": "Voice + text MCP channel between a Claude Code session and the Viber UI (https://viber.dgypx.dev). Push transcripts to Claude; send_message tool delivers text back to the UI.",
   "type": "module",
   "bin": {

package/viber-codex-bridge.ts

@@ -123,6 +123,15 @@ import { startBridgeToolHost, type BridgeToolHost } from "./lib/bridge_tool_host
 import type { AgentToolsContext } from "./lib/agent_tools.ts";
 import type { OpenDmResult } from "./lib/peers.ts";
 import { resolveLockDir } from "./lib/lock_dir.ts";
+import {
+  type CodexPair,
+  type ModelListPage,
+  readCodexPair,
+  threadStartPairParams,
+  turnStartPairParams,
+  pairMismatch,
+  verifyCodexPair,
+} from "./lib/codex_model_pair.ts";
 
 // #480: transport host vs logical identity. IDENTITY_URL is what the session and
 // bridge-lock hashes are keyed on (this file builds several of them, below) —
@@ -673,7 +682,8 @@ class OutboundTurnTracker {
   }
 }
 
-class CodexAppServer {
+/** Exported for its #665 witnesses only (a fake child stands in for `codex app-server`). */
+export class CodexAppServer {
   private child: ChildProcessWithoutNullStreams;
   private nextId = 1;
   private stdoutBuffer = "";
@@ -700,6 +710,10 @@ class CodexAppServer {
      * env (read through `bearer_token_env_var`) so it never lands in argv/config.
      */
     mcp?: { url: string; bearerEnvVar: string; bearerValue: string },
+    /** #665: the model/effort the template set, or undefined (a role stored before #665). */
+    private readonly pair?: CodexPair,
+    /** Test seam (#665): what launches `codex app-server`. Production passes nothing. */
+    spawnChild: typeof spawn = spawn,
   ) {
     const codexBin = process.env.VIBER_CODEX_BIN?.trim() || "codex";
     const args = ["app-server"];
@@ -735,7 +749,7 @@ class CodexAppServer {
       args.push("-c", `mcp_servers.viber.bearer_token_env_var="${mcp.bearerEnvVar}"`);
       childEnv[mcp.bearerEnvVar] = mcp.bearerValue;
     }
-    this.child = spawn(codexBin, args, {
+    this.child = spawnChild(codexBin, args, {
       cwd: process.cwd(),
       env: childEnv,
       stdio: ["pipe", "pipe", "pipe"],
@@ -800,6 +814,7 @@ class CodexAppServer {
     const existing = state.threads[key]?.thread_id;
     const t0 = nowMs(); // #409: measure thread resume/start (the first-DM cost)
     let resumeAttempted = false;
+    let resumeMismatch: string | undefined;
 
     if (existing && !options.newThread) {
       try {
@@ -813,17 +828,26 @@ class CodexAppServer {
           sandbox: AGENT_SANDBOX,
           developerInstructions: AGENT_INSTRUCTIONS,
           excludeTurns: true,
+          // #665: the pair at resume time too — a resumed thread was created on the model of
+          // its FIRST launch; this moves it onto the template's, like turn/start does.
+          ...threadStartPairParams(this.pair),
         });
         // #409 (Codex): validate/extract the id BEFORE logging success — a malformed
         // response must NOT be logged as resume then again as resume-failed→start.
         const resumedId = extractThreadId(resumed);
-        logTiming("ensureThread", nowMs() - t0, "outcome=resume");
-        return resumedId;
+        // #665: codex answers the thread's EFFECTIVE model — checked, never assumed. A mismatch
+        // leaves this try (it must not fall back to a fresh thread and hide the problem).
+        resumeMismatch = pairMismatch(this.pair, resumed, "thread/resume");
+        if (resumeMismatch === undefined) {
+          logTiming("ensureThread", nowMs() - t0, "outcome=resume");
+          return resumedId;
+        }
       } catch (err) {
         process.stderr.write(
           `[viber-codex-bridge] codex: resume failed (${safeErrorMessage(err)}), starting a fresh thread\n`,
         );
       }
+      if (resumeMismatch !== undefined) this.stopOnPairMismatch(resumeMismatch);
     }
 
     process.stderr.write("[viber-codex-bridge] codex: starting fresh bridge-owned thread\n");
@@ -836,8 +860,18 @@ class CodexAppServer {
       ephemeral: false,
       threadSource: "user",
       sessionStartSource: options.newThread ? "clear" : "startup",
+      ...threadStartPairParams(this.pair),
+    }).catch((err: unknown) => {
+      // #665: a refusal caused by the pair must name it, not surface as a bare RPC error.
+      if (this.pair === undefined) throw err;
+      throw new Error(
+        `codex refused thread/start with model ${this.pair.model} / effort ${this.pair.effort}: ${safeErrorMessage(err)}`,
+      );
     });
     const threadId = extractThreadId(started);
+    // #665: same check on a fresh thread — what codex SAYS it runs, not what we asked.
+    const startMismatch = pairMismatch(this.pair, started, "thread/start");
+    if (startMismatch !== undefined) this.stopOnPairMismatch(startMismatch);
     state.threads[key] = {
       thread_id: threadId,
       conversation_id: options.conversationId,
@@ -867,11 +901,36 @@ class CodexAppServer {
       sandboxPolicy: buildTurnSandboxPolicy(AGENT_TIER),
       developerInstructions: AGENT_INSTRUCTIONS,
       responsesapiClientMetadata: { source: "viber-codex-bridge" },
+      // #665: on EVERY turn — it also moves a resumed thread onto the template's model.
+      ...turnStartPairParams(this.pair),
     });
     const turnId = this.extractTurnId(response);
     return await this.waitForTurn(threadId, turnId);
   }
 
+  /**
+   * #665: check the pair against THIS codex's catalogue (`model/list`) — no thread, no turn, so
+   * it runs before any `turn/start`. No pair: nothing is called (the pre-#665 behaviour).
+   */
+  /** #665: codex is not running the template's pair — stop the bridge in clear, never run on. */
+  private stopOnPairMismatch(reason: string): never {
+    process.stderr.write(`${LOG_PREFIX} #665: ${reason}\n`);
+    this.onUnexpectedExit?.(reason);
+    throw new Error(reason);
+  }
+
+  async verifyPair(timeoutMs: number): Promise<void> {
+    if (this.pair === undefined) return;
+    await verifyCodexPair(
+      this.pair,
+      async (cursor) => (await this.request("model/list", { cursor, includeHidden: false })) as ModelListPage,
+      timeoutMs,
+    );
+    process.stderr.write(
+      `${LOG_PREFIX} #665: codex model ${this.pair.model} / effort ${this.pair.effort} — found in this codex's catalogue\n`,
+    );
+  }
+
   close(): void {
     this.closing = true;
     this.child.kill();
@@ -1382,6 +1441,8 @@ function setupCodexRuntime(deps: {
   requestShutdown: (err: BridgeShutdownError) => void;
   /** #627: why the bridge is paused (null = may write). */
   pauseReason: () => string | null;
+  /** #665: the template's model/effort, or undefined. */
+  pair: CodexPair | undefined;
 }): { codex: CodexAppServer; toolHost: BridgeToolHost } {
   const { tracker } = deps;
   const bridgeToolsCtx: AgentToolsContext = {
@@ -1417,10 +1478,39 @@ function setupCodexRuntime(deps: {
       deps.requestShutdown(new BridgeShutdownError(reason, 3));
     },
     { url: toolHost.url, bearerEnvVar: "VIBER_MCP_TOKEN", bearerValue: toolHost.bearerToken },
+    deps.pair,
   );
   return { codex, toolHost };
 }
 
+/** #665: one deadline for the whole `model/list` walk at startup (it may refresh over network). */
+const CODEX_PAIR_CHECK_TIMEOUT_MS = 30_000;
+
+/**
+ * #665: initialize codex and check its pair. On ANY failure — initialize, catalogue refusal,
+ * deadline — `release` runs (child, tool host, lock) BEFORE the error leaves as a
+ * BridgeShutdownError (a refused pair) or as itself (initialize): on the `--conversation` path nothing
+ * else would release them.
+ */
+export async function startCheckedCodex(
+  codex: Pick<CodexAppServer, "initialize" | "verifyPair">,
+  timeoutMs: number,
+  release: () => void,
+): Promise<void> {
+  try {
+    await codex.initialize();
+  } catch (err) {
+    release();
+    throw err; // unchanged type: an initialize failure stays a crash, as before #665 (Opus review)
+  }
+  try {
+    await codex.verifyPair(timeoutMs);
+  } catch (err) {
+    release();
+    throw new BridgeShutdownError(safeErrorMessage(err), 2); // a refused pair is a deliberate end
+  }
+}
+
 function logCodexSafety(): void {
   process.stderr.write(
     `${LOG_PREFIX} codex safety: tier=${AGENT_TIER}, sandbox=${AGENT_SANDBOX}, approvalPolicy=${AGENT_APPROVAL_POLICY}, network=${networkForTier(AGENT_TIER)}, ` +
@@ -1436,6 +1526,8 @@ function logCodexSafety(): void {
 
 export async function main(argv: string[] = process.argv.slice(2)): Promise<void> {
   const options = parseArgs(argv);
+  // #665: both or neither — a partial pair stops the bridge HERE, before any identity or child.
+  const pair = readCodexPair(process.env);
   const { auth, fingerprint } = loadBridgeAuthAndFingerprint();
   // #317 (iii): per-turn outbound tracker (anti-double-post + send_message target).
   const tracker = new OutboundTurnTracker();
@@ -1512,10 +1604,20 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<void
           startConversation: helpers.startConversation,
           requestShutdown: helpers.requestShutdown,
           pauseReason: helpers.pauseReason,
+          pair,
         });
         codex = rt.codex;
         toolHost = rt.toolHost;
         await codex.initialize();
+        // #665: before the control stream opens, so before any join, thread or turn. A refusal is
+        // a deliberate end (presence `ended`), never a crash the runner would read as alive.
+        try {
+          await codex.verifyPair(CODEX_PAIR_CHECK_TIMEOUT_MS);
+        } catch (err) {
+          const stop = new BridgeShutdownError(safeErrorMessage(err), 2);
+          helpers.requestShutdown(stop);
+          throw stop;
+        }
         logCodexSafety();
       },
       onShutdown: () => {
@@ -1570,10 +1672,19 @@ export async function main(argv: string[] = process.argv.slice(2)): Promise<void
         if (!shutdown.signal.aborted) shutdown.abort(err);
       },
       pauseReason: () => gateRef.gate?.reason() ?? REASON_STARTING,
+      pair,
     });
     codex = rt.codex;
     toolHost = rt.toolHost;
-    await codex.initialize();
+    // #665: before the presence record and the stream, so before any turn. This runs BEFORE the
+    // try/finally below, so a failure must release what is already held (Codex-2 review of d6d127a5).
+    const started = codex;
+    const host = toolHost;
+    await startCheckedCodex(started, CODEX_PAIR_CHECK_TIMEOUT_MS, () => {
+      started.close();
+      host.stop();
+      res.bridgeLock.release();
+    });
     logCodexSafety();
     process.stderr.write(`${LOG_PREFIX} ready: joined ${res.minted.conversation_id} as instance ${res.instanceKey.slice(0, 8)}\n`);
     // #315: no control stream here, so beat the instance liveness directly.