fix(chat): keep GPT account defaults and safe Runtime switching

[loopx-agent]

A desktop Chat service could inherit a terminal's custom Codex home while the steward selected a GPT model. Catalog discovery could read that ambient home too, and a provider's structured request rejection without an HTTP status surfaced only as Codex app-server reported a turn error.

This proposal keeps the existing Codex/GPT default and explicit DeepSeek Harness Runtime choice usable:

• Desktop-owned Chat launches use the standard Codex home unless LOOPX_CHAT_CODEX_HOME is explicit. Direct CLI and existing LaunchAgent precedence retain their behavior. Existing Sessions keep their original home and cannot be silently rebound.
• Model discovery reads the controller's captured native home, matching execution.
• Switching executor in the guided settings clears the prior model/effort overrides and visibly uses the selected Runtime's defaults. Preview/apply remains the configuration writer; same-executor edits and explicit model choices are preserved.
• Status-less structured invalid_request_error envelopes receive the existing safe request-rejection category and actionable guidance. Conflicting/malformed status and unknown prose remain generic; private upstream messages stay withheld and rejected requests are not replayed.

Placement: existing native_chat provider I/O, desktop service launcher and steward_executor editor. No new capability or shared vocabulary is introduced. Python remains native protocol adaptation; TypeScript owns the form transition. The bounded refactor makes catalog discovery reuse execution's account binding. Runtime permissions and persisted Session identity remain with their existing owners.

Related: #6699 also carries the captured-home catalog seam as part of broader conversation/profile work. This bounded repair includes that small shared seam against current main; preserve its newer profile-home resolution when reconciling the two proposals.

First viewport and visual evidence

Before: exported frontend 937a011d9. After: implementation c4de4e38a (the following documentation commit adds these captures). Both use packaged frontend assets and synthetic machine configuration on a real local Chat HTTP backend. The images contain no live account or Goal data. The settings interaction adds no confirmation beyond the existing preview/apply.

Switching to DeepSeek previously retained the GPT override	Switching now selects the new Runtime's defaults

Before: phone controls	After: phone controls

The existing settings composition is retained; the useful change is removing the incompatible override and naming what the empty fields mean. Desktop (1440px) and phone (390px) were inspected with no page-level horizontal overflow. A local preview was used; no hosted preview is published.

Validation and limits

• Related Python coverage: 406 cases passed; the final portable account-bound subprocess fixture was rerun successfully (8 home tests). Includes both terminal event paths, malformed status, private-text withholding, unchanged Session identity and managed-host behavior.
• Desktop service suite: 17 passed. cargo fmt --check and focused Ruff passed.
• npm run smoke:capability-configuration, frontend production build and source bundle verification passed. Real HTTP settings preview/apply read back DeepSeek defaults; source and installed Chat each completed a short synthetic GPT request and a short synthetic DeepSeek request.
• Standard loopx canary premerge --from-git-diff: passed all 19 selected checks plus direct hygiene/compile checks. The initial missing repository Node dependencies were installed and the affected checks rerun successfully. Full semantic inventory summaries match the base; no budgets were changed. Exact-head bilingual RFC check passed.

Frontend and native Chat are covered; CLI account precedence is preserved. Live Lark and non-macOS native launches were not qualified. Successful bounded provider calls do not certify sustained operation or every model/provider combination. The new desktop policy and guided form are proposed source behavior; configuration recovery on an existing installed runtime is separate from installing this proposal. Independent review, hosted CI and maintainer merge remain pending.

[loopx-agent]

Reviewer: model_agent; gpt-6.1-sol; OpenAI; runtime_reported; reasoning_effort=max

Approval conclusion (author-owned PR; GitHub blocks formal self-approval)

HEAD: b66352147264ed729c5b0adbca1cffdc53245372

动机

没有发现阻塞问题。受影响的是在桌面管家中选择 GPT 或 DeepSeek Harness 的用户：终端的另一个 Codex home 可能污染目录发现；切换执行器可能继续携带前一个 Runtime 的模型和档位；没有 HTTP status 的结构化请求拒绝则只显示泛化 turn error。结果是用户选了一个配置，实际目录或 provider 却对不上，失败后也不知道该检查哪里。

依据改动前的 managed Codex home 契约，home 是会话身份的一部分，不能在恢复时静默重绑。当前修复把目录、执行与设置回读放回已有 owner，完成设置中的选择、拒绝恢复与保存反馈；不会把“保存默认值”包装成已有会话已切换。

设置中切换执行器不再留下不兼容的旧模型覆盖；并发修改使预览过期时明确拒绝，重新预览后读回新默认，原 Session 保持不变。

本 PR 交付源码及隔离设置旅程；真实安装、实时模型、Lark、其它系统原生启动和持续服务商资格仍需独立验收。

契约基线：937a011d9d507e499697046bcd86b9db0a925461，原 owner 规范。对照三项：归属边界、失败恢复、更广验收；前两项由本次源码与反例核验，后者保留原 owner 的独立验收。

改动思路

Rust 桌面 launcher 只给自己启动的 Chat 设置明确的默认 home，专用 override 优先；已连接服务、直接 CLI 与 LaunchAgent 保留原优先级。Python catalog 使用 controller 启动时固定的 home；错误适配器复用已存在的安全 request-rejection 类别。TypeScript 表单只在 steward executor 真正变化时清空模型和 effort，持久写入继续经过原 HTTP preview/apply 与 revision 检查。

不修改会继续让来源不匹配；仅改错误文案不能消除错误选择；全局改 CODEX_HOME 又会破坏 CLI/worker 的既有语义。这几个最近 owner 的局部修改是同一故障链的完整有界修复，不需要新 capability、平行配置源或自动账户迁移。

具体改动

全18路径 +202/-14 已审阅：3个 Python runtime/provider 文件、2个 Python 测试文件、Rust service launcher、4个前端源码/smoke、两语 RFC 与 adapter 文档、5张公共合成截图。configure_codex_chat_home 同时接入两个实际 Chat spawn 分支；非 Chat 分支不调用它，空或缺失专用 override 使用标准目录，显式 override 保留。

codex_model_options 子进程接收 captured home，inspect_agent_model_options 传入该 binding。独立同一 Python debug 子进程夹具中，改变 ambient home 后，base 返回 ambient 目录模型，当前返回 bound 目录模型，父进程环境未变；这是真实 subprocess seam，不冒充实时 Codex 账号请求。

_terminal_turn_error 对 exact typed invalid_request_error 接受缺失 status 或严格整数400；None、bool、float400、字符串400、401/500及未知 prose 保持泛化，不公开上游私密正文、不自动重放。实际当前384项相关 Python 用例覆盖两个终止事件、目录绑定、机器配置和已有错误边界。

changeStewardExecutorDraft 在切换 codex/dsh 时清空两项覆盖；同执行器重选、显式模型编辑及原配置对象保留。空字段的中英文文字明确表示所选 Runtime 默认值。17项 Rust service 测试、前端 smoke、生产 bundle 与 provenance 校验通过。

对主干的风险

真实打包前端连接当前生产 Chat HTTP、机器配置 File/typed owner：同一后端和初始配置，只换 base 前端时，选择 DSH 后仍保留 GPT/high；当前清空两项。先预览后由隔离外部 writer 改 revision，实际 apply 返回409，界面说明需要重新预览；重新预览/应用后读回 dsh/null/null，原 Session 全字段不变。反向切换也清空旧 DeepSeek 模型，显式 GPT/high 可保存、回读。1440和390px检查无页面横向溢出；窄屏键盘返回原工作区，并把焦点放回导航按钮；英文默认值文案也实际读取。

导航状态使用公开合成 fixture，模型和其它无关写请求被隔离服务拒绝；设置的检查与写入走真实 owner。上述证据不等于实时 GPT/DeepSeek 推理或新安装 App，作者的实际 provider/installed 资格未当作本次独立证据。当前 native desktop 的直接证据是 Rust command/environment service tests；Live Lark、非macOS原生启动及持续服务商组合仍未资格化。

标准 premerge 6项直接检查、19项选择检查全通过，零失败、零人工 hold；Ruff、cargo fmt、advisory→完整语义及精确双语 RFC 检查通过，两提交均 DCO。五张新增截图为公共合成状态，现有分层、标签和隐私边界保留；没有新增确认轮次。与 #6699 的共享 captured-home seam 已核对，其更广 profile-home/会话恢复工作仍须在集成时保留，不以本提案替代。

我的整体评价

APPROVE。最近 owner 的修改足够解决来源、选择与拒绝反馈的同一实际问题，既有 Session/权限/预览写入 authority 保持。邻接的有界整理是复用 execution 的 captured-home binding 与单一 TS draft transition，避免另一份账号发现或模型默认决策。结论绑定当前 head；独立 merge readiness、维护者授权、安装与持续运行资格各自保留。

English verdict: APPROVE - HEAD b663521; captured-home catalog, scoped desktop defaults, safe structured rejection and Runtime draft reset verified by384 Python/17 Rust cases, real HTTP/File/typed settings recovery, paired base frontend/subprocess probes and6+19 premerge checks. No live model, installed-App or merge authority is inferred.