fix(desktop): relink Codex thread across providers

apps/desktop/src/main/__tests__/sessionRuntimeControlWiring.test.ts

@@ -186,6 +186,33 @@ describe('session runtime control wiring', () => {
     expect(axisValidation).toBeLessThan(setModel.indexOf('persistSessionFields(sessionId'));
   });
 
+  it('rolls back a committed Codex thread relink when atomic route persistence fails', () => {
+    const setModel = handlerBody(
+      registerSource,
+      'const handleSetModel = async (',
+      'const recoverRemoteRuntimeAxisPersistence',
+    );
+    const persist = setModel.indexOf('await persistSessionFields(sessionId, patch)');
+    const rollback = setModel.indexOf('await result.codexThreadRelink.rollback()');
+
+    expect(persist).toBeGreaterThan(-1);
+    expect(rollback).toBeGreaterThan(persist);
+    expect(setModel).toContain("throw new Error('Codex thread relink rollback was superseded')");
+  });
+
+  it('keeps the Codex rebuild marker in the production pending-switch projection', () => {
+    const getter = handlerBody(
+      registerSource,
+      'export function getPendingCredentialSwitchTarget(',
+      '// ── Scheduler 撞忙排队桥',
+    );
+
+    expect(getter).toContain('pending.rebuildCodexThread');
+    expect(getter).toContain('{ rebuildCodexThread: true }');
+    expect(getter).toContain('pending.sourceCodexThreadModelProviderId');
+    expect(getter).toContain('pending.previousRoute');
+  });
+
   it('commits user effort and Fast state only after the live runtime call succeeds', () => {
     const effort = handlerBody(
       registerSource,

apps/desktop/src/main/im/shared/__tests__/cardActionTakeoverReplace.test.ts

@@ -23,6 +23,7 @@ const mocks = vi.hoisted(() => ({
   resolveLenientSessionRoute: vi.fn(),
   applyRuntimeSetModelChange:
     vi.fn<(input: unknown) => Promise<{ status: 'applied' | 'deferred' }>>(),
+  relinkCodexThreadForCredentialSwitch: vi.fn(async () => {}),
   registerPendingCredentialSwitchForSession: vi.fn(),
   clearPendingCredentialSwitchForSession: vi.fn(),
   wakeSessionInputAfterCredentialSwitch: vi.fn(),
@@ -97,6 +98,7 @@ vi.mock('../../../maker-ipc/runtimeSetModel', () => ({
 vi.mock('../../../maker-ipc/register', () => ({
   cancelPendingAgentSwitchForSession: mocks.cancelPendingAgentSwitchForSession,
   isSessionInTurn: mocks.isSessionInTurn,
+  relinkCodexThreadForCredentialSwitch: mocks.relinkCodexThreadForCredentialSwitch,
   registerPendingCredentialSwitchForSession: mocks.registerPendingCredentialSwitchForSession,
   clearPendingCredentialSwitchForSession: mocks.clearPendingCredentialSwitchForSession,
   wakeSessionInputAfterCredentialSwitch: mocks.wakeSessionInputAfterCredentialSwitch,

apps/desktop/src/main/im/shared/cardActionHandler.ts

@@ -38,6 +38,7 @@ import {
   clearPendingCredentialSwitchForSession,
   getPendingCredentialSwitchTarget,
   isSessionInTurn,
+  relinkCodexThreadForCredentialSwitch,
   registerPendingCredentialSwitchForSession,
   withSendToSessionLock,
   wakeSessionInputAfterCredentialSwitch,
@@ -393,6 +394,7 @@ export function createCardActionHandler(
           clearPendingCredentialSwitch: clearPendingCredentialSwitchForSession,
           wakeSessionInputQueue: wakeSessionInputAfterCredentialSwitch,
           getPendingCredentialSwitch: getPendingCredentialSwitchTarget,
+          relinkCodexThreadForProviderSwitch: relinkCodexThreadForCredentialSwitch,
           logger: log,
         });
 

apps/desktop/src/main/maker-host/codex-credential-switch.ts

@@ -247,8 +247,9 @@ export function shouldCloseSessionForCredentialSwitch(
   // oauth spawn 的订阅直连 thread 以 OpenAI 身份 provider 创建(codex 据此走
   // OpenAI 远端压缩),而 provider 身份是 thread 级冻结、settings/update 改不了;
   // 网关 / xAI 等上游不支持远端压缩且失败无本地回退。因此凡切换跨过
-  // oauth-bearer(订阅直连)家族边界,必须关会话、由下一次发送按新路由 resume
-  // 重建 thread(resume 会按新家族重新决定 provider 身份)。这有意收窄了
+  // oauth-bearer(订阅直连)家族边界,必须关会话，并由 host 把旧 rollout 安全 fork
+  // 成新 thread 后再按新路由 resume（直接 resume 同一 thread 会把供应商私有历史
+  // 带到另一条路由）。这有意收窄了
   // 方案 A 的「oauth 超集 host 热切 gateway-key / provider-oauth 会话」范围:
   // host 仍复用不重建,只是该会话自身要走关闭重建。隐式来源解析不出家族且
   // 未提供 codexAuthInjection 时按未知处理 → 与另一侧不同即保守关闭。
@@ -259,7 +260,7 @@ export function shouldCloseSessionForCredentialSwitch(
 
     // provider store 可能先于运行时切换被 UI/持久层覆盖。此时仅比较 currentMode/nextMode
     // 会把两边误判为同一家族，并在仍绑定 cindy_openai 的 thread 上热切 DeepSeek/xAI/XD。
-    // start/resume 响应才是 thread 身份的事实源；与目标身份不一致就必须 close + resume。
+    // start/resume 响应才是 thread 身份的事实源；与目标身份不一致就必须 close + fork。
     if (isCodexThreadModelProviderIdentityMismatch(input)) {
       return true;
     }

apps/desktop/src/main/maker-ipc/__tests__/codexProviderThreadRelink.test.ts

@@ -0,0 +1,142 @@
+import { describe, expect, it, vi } from 'vitest';
+
+import { relinkCodexProviderThread } from '../codexProviderThreadRelink.js';
+
+describe('relinkCodexProviderThread', () => {
+  it('forks a provider-neutral history and CAS-relinks the Cindy session', async () => {
+    const fork = vi.fn(async () => ({ newSdkSessionId: 'thread-openai' }));
+    const commit = vi.fn(async () => true);
+    const onCommitted = vi.fn();
+
+    await expect(
+      relinkCodexProviderThread(
+        {
+          readSource: vi.fn(async () => ({
+            sdkSessionId: 'thread-xd',
+            workingDir: '/work',
+          })),
+          fork,
+          commit,
+          onCommitted,
+        },
+        {
+          sessionId: 'session-1',
+          sourceModel: 'codex/gpt-5.6-sol',
+          sourceProviderId: 'xd',
+        },
+      ),
+    ).resolves.toEqual({
+      previousSdkSessionId: 'thread-xd',
+      newSdkSessionId: 'thread-openai',
+    });
+
+    expect(fork).toHaveBeenCalledWith({
+      sourceSdkSessionId: 'thread-xd',
+      sourceModel: 'codex/gpt-5.6-sol',
+      sourceProviderId: 'xd',
+      workingDir: '/work',
+    });
+    expect(commit).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      expectedSdkSessionId: 'thread-xd',
+      newSdkSessionId: 'thread-openai',
+    });
+    expect(onCommitted).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      previousSdkSessionId: 'thread-xd',
+      newSdkSessionId: 'thread-openai',
+    });
+  });
+
+  it('does nothing when the Cindy session has no native thread yet', async () => {
+    const fork = vi.fn();
+    const commit = vi.fn();
+
+    await expect(
+      relinkCodexProviderThread(
+        {
+          readSource: vi.fn(async () => ({ sdkSessionId: null, workingDir: '/work' })),
+          fork,
+          commit,
+        },
+        {
+          sessionId: 'session-1',
+          sourceModel: 'codex/gpt-5.6-sol',
+          sourceProviderId: 'xd',
+        },
+      ),
+    ).resolves.toBeNull();
+    expect(fork).not.toHaveBeenCalled();
+    expect(commit).not.toHaveBeenCalled();
+  });
+
+  it('fails closed when another owner replaces the thread before CAS commit', async () => {
+    await expect(
+      relinkCodexProviderThread(
+        {
+          readSource: vi.fn(async () => ({
+            sdkSessionId: 'thread-xd',
+            workingDir: null,
+          })),
+          fork: vi.fn(async () => ({ newSdkSessionId: 'thread-openai' })),
+          commit: vi.fn(async () => false),
+        },
+        {
+          sessionId: 'session-1',
+          sourceModel: 'codex/gpt-5.6-sol',
+          sourceProviderId: 'xd',
+        },
+      ),
+    ).rejects.toThrow(/superseded/);
+  });
+
+  it('passes the pending generation guard into the CAS commit', async () => {
+    const isCurrent = vi.fn(() => true);
+    const commit = vi.fn(async () => true);
+
+    await relinkCodexProviderThread(
+      {
+        readSource: vi.fn(async () => ({ sdkSessionId: 'thread-old', workingDir: null })),
+        fork: vi.fn(async () => ({ newSdkSessionId: 'thread-new' })),
+        commit,
+      },
+      {
+        sessionId: 'session-1',
+        sourceModel: 'gpt-5.6-sol',
+        sourceProviderId: 'openai',
+        isCurrent,
+      },
+    );
+
+    expect(commit).toHaveBeenCalledWith({
+      sessionId: 'session-1',
+      expectedSdkSessionId: 'thread-old',
+      newSdkSessionId: 'thread-new',
+      isCurrent,
+    });
+  });
+
+  it('uses the source thread identity when the route store already contains the target', async () => {
+    const fork = vi.fn(async () => ({ newSdkSessionId: 'thread-gateway' }));
+
+    await relinkCodexProviderThread(
+      {
+        readSource: vi.fn(async () => ({ sdkSessionId: 'thread-openai', workingDir: null })),
+        fork,
+        commit: vi.fn(async () => true),
+      },
+      {
+        sessionId: 'session-1',
+        sourceModel: 'deepseek/deepseek-v4-pro',
+        sourceProviderId: 'deepseek',
+        sourceThreadModelProviderId: 'cindy_openai',
+      },
+    );
+
+    expect(fork).toHaveBeenCalledWith({
+      sourceSdkSessionId: 'thread-openai',
+      sourceModel: 'deepseek/deepseek-v4-pro',
+      sourceProviderId: 'openai',
+    });
+  });
+});

apps/desktop/src/main/maker-ipc/__tests__/messageDeleteHandler.test.ts

@@ -87,8 +87,10 @@ describe('performMessageDeletion', () => {
       resolve(process.cwd(), 'src/main/maker-ipc/register.ts'),
       'utf8',
     );
-    const onCommittedStart = registerSource.indexOf('onCommitted:');
-    expect(onCommittedStart).toBeGreaterThan(-1);
+    const deleteHandlerStart = registerSource.indexOf('registerMakerMessageDeleteHandler(');
+    expect(deleteHandlerStart).toBeGreaterThan(-1);
+    const onCommittedStart = registerSource.indexOf('onCommitted:', deleteHandlerStart);
+    expect(onCommittedStart).toBeGreaterThan(deleteHandlerStart);
     const patchStart = registerSource.indexOf(
       'broadcastSessionPatched(sessionId, {',
       onCommittedStart,

apps/desktop/src/main/maker-ipc/__tests__/pendingCredentialSwitch.test.ts

@@ -41,6 +41,9 @@ function createHarness(
   const persistRoute = vi.fn<NonNullable<PendingCredentialSwitchDeps['persistRoute']>>(
     async () => {},
   );
+  const relinkCodexThreadForProviderSwitch = vi.fn<
+    NonNullable<PendingCredentialSwitchDeps['relinkCodexThreadForProviderSwitch']>
+  >(async () => null);
   const service = new PendingCredentialSwitchService({
     maker: {
       listActiveSessions: () => sessions,
@@ -49,10 +52,19 @@ function createHarness(
     broadcastApplied,
     onApplied,
     persistRoute,
+    relinkCodexThreadForProviderSwitch,
     ...(opts?.resolveRoute ? { resolveRoute: opts.resolveRoute } : {}),
     ...(opts?.retryDelayMs !== undefined ? { retryDelayMs: opts.retryDelayMs } : {}),
   });
-  return { service, closeSession, broadcastApplied, onApplied, persistRoute, sessions };
+  return {
+    service,
+    closeSession,
+    broadcastApplied,
+    onApplied,
+    persistRoute,
+    relinkCodexThreadForProviderSwitch,
+    sessions,
+  };
 }
 
 describe('PendingCredentialSwitchService', () => {
@@ -93,6 +105,117 @@ describe('PendingCredentialSwitchService', () => {
     expect(h.onApplied).toHaveBeenCalledWith(sessionId);
   });
 
+  it('relinks a deferred Codex thread before route persistence and queue wake', async () => {
+    const sessionId = rememberSession('pending-switch-relink-codex-thread');
+    setSessionProvider(sessionId, 'xd');
+    const h = createHarness([
+      { id: sessionId, agentKind: 'codex', remoteHostId: null, isTurnRunning: () => false },
+    ]);
+
+    h.service.register(sessionId, {
+      model: 'gpt-5.6-sol',
+      providerId: 'openai',
+      rebuildCodexThread: true,
+      previousRoute: { model: 'codex/gpt-5.6-sol', providerId: 'xd' },
+    });
+    await h.service.onTurnSettled(sessionId);
+
+    expect(h.closeSession).toHaveBeenCalledWith(sessionId);
+    expect(h.relinkCodexThreadForProviderSwitch).toHaveBeenCalledWith({
+      sessionId,
+      sourceModel: 'codex/gpt-5.6-sol',
+      sourceProviderId: 'xd',
+      targetModel: 'gpt-5.6-sol',
+      targetProviderId: 'openai',
+      isCurrent: expect.any(Function),
+    });
+    expect(h.relinkCodexThreadForProviderSwitch.mock.invocationCallOrder[0]).toBeLessThan(
+      h.onApplied.mock.invocationCallOrder[0]!,
+    );
+  });
+
+  it('keeps a deferred switch gated when the Codex thread relink fails', async () => {
+    const sessionId = rememberSession('pending-switch-relink-failed');
+    setSessionProvider(sessionId, 'xd');
+    const h = createHarness([
+      { id: sessionId, agentKind: 'codex', remoteHostId: null, isTurnRunning: () => false },
+    ]);
+    h.relinkCodexThreadForProviderSwitch.mockRejectedValueOnce(new Error('fork failed'));
+
+    h.service.register(sessionId, {
+      model: 'gpt-5.6-sol',
+      providerId: 'openai',
+      rebuildCodexThread: true,
+    });
+    await h.service.onTurnSettled(sessionId);
+
+    expect(h.service.has(sessionId)).toBe(true);
+    expect(getSessionProvider(sessionId)).toBe('xd');
+    expect(h.persistRoute).not.toHaveBeenCalled();
+    expect(h.onApplied).not.toHaveBeenCalled();
+    h.service.clear(sessionId);
+  });
+
+  it('rolls back the relink when deferred route persistence fails', async () => {
+    const sessionId = rememberSession('pending-switch-persist-rollback');
+    setSessionProvider(sessionId, 'xd');
+    const rollback = vi.fn(async () => true);
+    const h = createHarness(
+      [{ id: sessionId, agentKind: 'codex', remoteHostId: null, isTurnRunning: () => false }],
+      {
+        resolveRoute: async (_agent, model, providerId) => ({
+          model,
+          providerId,
+          degraded: false,
+        }),
+      },
+    );
+    h.relinkCodexThreadForProviderSwitch.mockResolvedValueOnce({
+      previousSdkSessionId: 'thread-xd',
+      newSdkSessionId: 'thread-openai',
+      rollback,
+    });
+    h.persistRoute.mockRejectedValueOnce(new Error('sqlite failed'));
+
+    h.service.register(sessionId, {
+      model: 'gpt-5.6-sol',
+      providerId: 'openai',
+      rebuildCodexThread: true,
+      previousRoute: { model: 'codex/gpt-5.6-sol', providerId: 'xd' },
+    });
+    await h.service.onTurnSettled(sessionId);
+
+    expect(rollback).toHaveBeenCalledOnce();
+    expect(h.service.get(sessionId)?.rebuildCodexThread).toBe(true);
+    expect(h.onApplied).not.toHaveBeenCalled();
+    h.service.clear(sessionId);
+  });
+
+  it('does not commit an abandoned relink generation after the user cancels it', async () => {
+    const sessionId = rememberSession('pending-switch-cancel-during-relink');
+    setSessionProvider(sessionId, 'xd');
+    const h = createHarness([
+      { id: sessionId, agentKind: 'codex', remoteHostId: null, isTurnRunning: () => false },
+    ]);
+    h.relinkCodexThreadForProviderSwitch.mockImplementationOnce(async (input) => {
+      h.service.clear(sessionId);
+      expect(input.isCurrent()).toBe(false);
+      throw new Error('superseded');
+    });
+
+    h.service.register(sessionId, {
+      model: 'gpt-5.6-sol',
+      providerId: 'openai',
+      rebuildCodexThread: true,
+      previousRoute: { model: 'codex/gpt-5.6-sol', providerId: 'xd' },
+    });
+    await h.service.onTurnSettled(sessionId);
+
+    expect(h.service.has(sessionId)).toBe(false);
+    expect(getSessionProvider(sessionId)).toBe('xd');
+    expect(h.onApplied).not.toHaveBeenCalled();
+  });
+
   it('re-registration overwrites the previous pending target (last click wins)', async () => {
     const sessionId = rememberSession('pending-switch-overwrite');
     setSessionProvider(sessionId, 'openai');