[saucam]

Closes #417

What changes

You can choose how hard a session's model thinks, on every backend, from the web UI, the TUI, Telegram and the CLI.

• One scale: Default, Off, Minimal, Low, Medium, High, Extra high, Max.
  Each backend maps it to its own setting; docs/thinking-effort.md has a table of what each level means where.
• Default is the backend's own choice, as it always was.
  Codex and pi keep a level once set, so for them Default is sent as what they'd pick unasked: on Codex your model_reasoning_effort if the running model takes it (a project's only if you trust the project, as Codex itself reads it), else the running model's own default, on pi your own defaultThinkingLevel (else Medium).
• Per session, like the model.
  It's set at creation or any time after, kept across a daemon restart and a backend switch, and inherited by forks.
  session.defaultEffort (or CODEOID_DEFAULT_EFFORT) applies to new sessions.
  Changing it needs session:send on your own session, and every change is in the audit log (one through a delegated token is marked as such).
• Never cuts a running turn short.
  • Live: Claude (applyFlagSettings), Qwen (setEffort) and pi (set_thinking_level) take a change on the running backend.
  • Next turn: Codex, OpenAI, llama.cpp and Gemini take it with each request. So do Claude to or from Off, and Qwen back to Default, whose next turn starts a fresh query that resumes the conversation.
  • Restart before the next turn: the Gemini CLI reads thinking only from its settings at startup, so it restarts with the new value before the next turn and resumes the conversation.
• Each model's own levels where the backend reports them.
  Claude, Codex and pi report them, so the pickers offer only those.
  Everywhere else every level is offered, marked "support unknown", and a level the server refuses fails the turn with a note saying so.
• Where to set it:
  • web: an effort selector next to the model picker;
  • TUI: /effort opens a picker, or /effort high;
  • Telegram: /effort;
  • CLI: codeoid new --effort <level>.

Two backends run from a settings overlay

• The Gemini CLI takes thinking only from its settings.
  It runs from an overlay of its usual home that links everything (logins and chats too) except settings.json.
  That copy redefines the two aliases its chat models think through.
• pi saves any thinking-level change as your global default in ~/.pi/agent/settings.json.
  It runs from an overlay of its agent dir with a private copy of settings.json, so one session's effort never changes your own pi or other sessions.
  Your logins are linked: pi writes them in place, and its OAuth refresh locks the real file.
• Anything either backend writes in its overlay while it runs (a first sign-in, say) is handed back to the home the overlay is of at a later start, as it would have been written there without codeoid; the newer copy wins.
  A save still in progress (a temp file, or anything changed in the last 10 seconds) waits, and only plain files and directories are moved.
• Both kinds of overlay live under ~/.codeoid/accounts/ (covered by the secret-path guard) and are removed with their account.

Code detail

• Protocol: EFFORT_LEVELS / EffortLevel, session.set_effort → EffortChangeResult { effort, applies: "now" | "next-turn" | "restart" }, effort on session.create and SessionInfo, efforts / defaultEffort on ModelInfo.
• Daemon:
  • Session.setEffort, #applyEffortRestart, TurnOpts.effort at every runTurn;
  • sessions.effort (store) and session.defaultEffort (config);
  • SessionManager.#setEffort, effort on create and fork, _cacheModels keeping efforts.
• Providers:
  • claude/ — claudeEffortOptions, applyEffort, claudeCatalogEntry;
  • qwen/ — qwenEffort, applyEffort;
  • pi/ — #setThinkingLevel, applyEffort, piThinkingLevels, overlay env;
  • codex/ — turn/start effort via #effortParam, catalog efforts;
  • openai/ — effortParams (default reasoning_effort); llamacpp/ — llamaCppEffortParams;
  • gemini/ — geminiThinkingConfig; acp/ — effortChange: "restart", applyGeminiCliEffort;
  • effort.ts — effortRejectionHint.
• Overlays (account-apply.ts):
  • applyGeminiCliEffort / geminiEffortSettings;
  • applyPiSettingsOverlay / piDefaultThinkingLevel;
  • ensureOverlayHome now skips lock directories and tolerates concurrent builds;
  • accounts.ts #discardHome trashes an account's overlays.
• Frontends: packages/core /effort + parseEffort + effortChangeSummary; web EffortPicker; TUI /effort + BackendPicker kind effort; Telegram /effort; CLI --effort.

Design decisions (made with you before implementation)

• Per session, with a config default (no per-message override).
• The Gemini CLI included, by restarting it.
• Models with unknown levels: offer every level, and surface a server's refusal.

Verification

Live (isolated daemon on this branch):

• Claude: created at Off, a turn had no thinking blocks; set to High, the next turn thought. A change from High to Low applied immediately. The model list carries Claude's per-model levels.
• Qwen: a live change applied immediately.
• Codex: turn/start accepts effort (and null). config/read returns your model_reasoning_effort, and thread/start the model and effort the config gives. config/read for an untrusted project ignores the project's .codex/config.toml effort; once the project is trusted, it returns it. Model turns themselves can't run on this machine's ChatGPT login.
• pi:
  • A live level change was accepted, and the model list shows per-model levels.
  • After the fix, ~/.pi/agent/settings.json stayed unchanged while the overlay's copy took the write.
  • Turns produced no reply: pi has no credentials on this machine.
• Not run live: the Gemini CLI (expired login), plain OpenAI, Gemini API, llama.cpp. Their mappings and request bodies are covered by tests.

Tests:

• src/tests/thinking-effort.test.ts: each backend's mapping, the overlays, and the session path (create, set, persist, resume, apply modes, restart before the next turn, forks, scopes, tenancy, audit, catalog, config default).
• Effort cases added to the Claude, Codex, OpenAI and pi provider suites, with their fakes extended (Codex turn/start effort + config/read; pi thinking level that writes its settings as real pi does).
• Each audit fix was mutation-checked: reverting it makes a test fail. Survivors are checks covered twice (lock entries filtered in both passes; the file-versus-directory skip and the staged-copy cleanup, which fail together), and one equivalent change (renaming a directory over an empty one loses nothing).
• The cross-filesystem copy is tested across two real filesystems (/tmp and /dev/shm; skipped where they're one).
• bun run typecheck, bun run lint and web tsc --noEmit are clean; the full suite is 3744 pass, 0 fail.
• No regression tier: codeoid has no highflame-regression coverage.

Audit rounds (correctness + security each round, until one came back clean):

• Round 1 (1bdc917): both go-with-fixes.
  pi's level change wrote your global pi default; Codex Default didn't reset an override; Gemini 3 Pro levels.
  Fixed in cc8ec1e.
• Round 2: both go-with-fixes.
  High: my Codex fix sent the catalog's default model's effort over your own config; pi overlay login linking.
  Fixed in da48f6b.
• Round 3: no High.
  Four correctness Mediums (Codex config cached for the process, fork path model, Codex's own lock file no longer linked, EEXIST on pi's auth.json); security Lows only.
  Fixed in 82f10cb.
• Round 4: no Critical or High.
  One Medium in both lanes: pi's Default read a project's .pi/settings.json, which pi honours only for a trusted project. Also a fork at Default taking the config default, and a lock-race edge.
• Rounds 5–8: no Critical or High; Mediums and Lows on Default semantics per model (Codex's configured effort only where the model takes it), pending-state display, waitsForBackground, pickers dropping a Default the model can't take, pi's agent dir required absolute.
  Fixed through 38d27c5.
• Round 9: no Critical, High or Medium. Lows: a stray test file, a relative GEMINI_CLI_HOME, a first Gemini sign-in stranded in an overlay, a restart left pending across a backend switch or a reverted change. Fixed in 751a46e.
• Round 10: security go; correctness two Mediums in the new overlay hand-back (a temp file mid-save in another session; a pi login held by an earlier overlay). Fixed in 564d5ca.
• Round 11: both go. Lows in the cross-filesystem copy (a FIFO could block, a planted link at a guessable staged name, a partial copy left behind). Fixed in 765ef4f.
• Round 12: both go, no findings at any severity.
  The one open question (does Codex's config/read honour project trust?) was checked live and is answered above.

Known, accepted (in docs/thinking-effort.md):

• A pi sign-in or sign-out made in codeoid's pi and in your own at the same moment isn't serialized; OAuth refresh is.
• On Codex, a model its catalog doesn't list, with no effort configured, has no known default, so Default sends nothing there.
• A project's .gemini/settings.json that redefines the chat aliases overrides the effort on the Gemini CLI.
• An overlay built by an earlier commit of this branch that holds a pi login, when your own pi dir holds a different non-empty one, keeps only the newer file (no per-provider merge). Only someone who ran this branch can have one.
• The Gemini CLI and pi overlays of your own home stay (each with a copy of that tool's settings); agents can't read them.

Found and filed separately: #418 (a Codex turn right after its backend restarts can get the old process's exit error).
Oracle: n/a, codeoid isn't in enabled_repos.

🤖 Generated with Claude Code