@4yi-dev/cli 0.1.12 → 0.1.14

package/README.md

@@ -26,6 +26,7 @@ Both packages install the `4yi` command. The dev package points at `https://xcla
 4yi code
 4yi connect claude
 4yi connect codex
+4yi migrate codex
 4yi status all
 4yi restore all
 ```
@@ -38,6 +39,12 @@ On macOS, `4yi connect claude` also configures an installed Claude Desktop throu
 
 `--scope project` changes only the project's Claude Code settings and never changes the global Claude Desktop profile.
 
+Codex CLI and Codex App share the same Codex home on native Windows (`%USERPROFILE%\\.codex`). After `4yi connect codex`, finish active App tasks, fully quit and reopen the App, and start a new chat so its embedded Codex process loads the new provider. Microsoft Store/AppX installations may not expose a conventional executable path, but that detection does not gate the shared configuration update.
+
+Existing Codex tasks keep the provider they were created with. Run `4yi migrate codex`, choose a recent task by number, and 4YI creates a new task with the same history and project using your Plan's default model. The original task is not modified. Scripts can use `--thread <id>` and optionally `--model <id>`.
+
+The Codex provider uses the official command-backed authentication configuration. Its helper reads the current token from `~/.4yi/config.json`; `config.toml` and the model catalog do not contain the bearer token.
+
 For local development:
 
 ```bash

package/bin/4yi.mjs

@@ -2,16 +2,20 @@
 import { login, loadSession, clearSession } from "../src/auth.mjs";
 import { runCode } from "../src/opencode.mjs";
 import { connect, connectionStatus, prepareConnectionTools, restoreConnection } from "../src/connect.mjs";
+import { migrateCodexTask } from "../src/codex-migrate.mjs";
 
 const command = process.argv[2] || "help";
 
 if (command === "help" || command === "--help" || command === "-h") {
-  console.log("Usage: 4yi <login|whoami|logout|code|connect|status|restore>");
+  console.log("Usage: 4yi <login|whoami|logout|code|connect|migrate|status|restore>");
   console.log("  4yi code            launch OpenCode; switch models live with Tab / /models");
   console.log("  4yi code --model X  pin model X as the default for future sessions");
   console.log("  4yi connect <claude|codex|all>  connect existing coding tools to 4YI");
   console.log("    --yes                         install a missing CLI without prompting");
   console.log("    Claude on macOS also configures installed Claude Desktop 3P Gateway mode");
+  console.log("  4yi migrate codex              continue an existing Codex task through 4YI");
+  console.log("    --thread ID                  select a specific task without prompting");
+  console.log("    --model X                    choose a model (defaults to your Plan model)");
   console.log("  4yi status [claude|codex|all]   inspect the current connection");
   console.log("  4yi restore <claude|codex|all>  restore the latest protected config");
   process.exit(0);
@@ -39,6 +43,29 @@ function parseConnectArgs(args) {
   return { target, scope, platformUrl, claudeBaseUrl, codexBaseUrl, skipCheck, autoInstall };
 }
 
+function parseMigrateArgs(args) {
+  const target = args[0];
+  if (target !== "codex") throw new Error("Use `4yi migrate codex`.");
+  let threadId;
+  let model;
+  for (let i = 1; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--thread") {
+      threadId = args[++i];
+      if (!threadId || threadId.startsWith("-")) throw new Error("--thread requires a task id.");
+    }
+    else if (arg.startsWith("--thread=")) threadId = arg.slice("--thread=".length);
+    else if (arg === "--model" || arg === "-m") {
+      model = args[++i];
+      if (!model || model.startsWith("-")) throw new Error("--model requires a model id.");
+    }
+    else if (arg.startsWith("--model=")) model = arg.slice("--model=".length);
+    else throw new Error(`Unknown option: ${arg}`);
+  }
+  if (threadId === "" || model === "") throw new Error("--thread and --model require a value.");
+  return { threadId, model };
+}
+
 /** Split out `--model <id>` / `--model=<id>` / `-m <id>`; the rest pass through to OpenCode. */
 function parseCodeArgs(args) {
   let preferredModel = null;
@@ -87,6 +114,10 @@ try {
       session = loadSession();
     }
     await connect({ session, ...connectArgs, skipToolCheck: true });
+  } else if (command === "migrate") {
+    const migrateArgs = parseMigrateArgs(process.argv.slice(3));
+    const session = loadSession();
+    await migrateCodexTask({ session, ...migrateArgs });
   } else if (command === "status") {
     const { target, scope } = parseConnectArgs(process.argv.slice(3));
     connectionStatus({ target, scope });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@4yi-dev/cli",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "4YI command-line launcher for OAuth login and OpenCode runtime",
   "type": "module",
   "bin": {

package/src/codex-migrate.mjs

@@ -0,0 +1,256 @@
+import path from "node:path";
+import process from "node:process";
+import { spawn as nodeSpawn } from "node:child_process";
+import { createInterface } from "node:readline/promises";
+import { requestJson } from "./http.mjs";
+
+const DEFAULT_LIMIT = 10;
+const REQUEST_TIMEOUT_MS = 15_000;
+
+function executableName(command, platform = process.platform) {
+  return platform === "win32" ? `${command}.cmd` : command;
+}
+
+function appServerLaunch({ command, args, env, platform }) {
+  if (platform !== "win32") return { command, args, shell: false };
+  // Node 24 warns when `shell: true` receives an argv array (DEP0190). Invoke
+  // cmd.exe explicitly with constant, non-user-controlled arguments instead.
+  const shell = env.ComSpec || env.COMSPEC || "cmd.exe";
+  return { command: shell, args: ["/d", "/s", "/c", `${command} ${args.join(" ")}`], shell: false };
+}
+
+function oneLine(value, fallback) {
+  const line = String(value || "").split(/\r?\n/, 1)[0].replace(/\s+/g, " ").trim();
+  if (!line) return fallback;
+  return line.length > 64 ? `${line.slice(0, 61)}...` : line;
+}
+
+function relativeTime(timestamp, now = Date.now()) {
+  const elapsed = Math.max(0, Math.floor(now / 1000) - Number(timestamp || 0));
+  if (elapsed < 60) return "刚刚";
+  if (elapsed < 3600) return `${Math.floor(elapsed / 60)} 分钟前`;
+  if (elapsed < 86400) return `${Math.floor(elapsed / 3600)} 小时前`;
+  if (elapsed < 86400 * 30) return `${Math.floor(elapsed / 86400)} 天前`;
+  return new Date(Number(timestamp) * 1000).toLocaleDateString();
+}
+
+export function describeCodexThread(thread, { now = Date.now() } = {}) {
+  const title = oneLine(thread.name || thread.preview, "未命名任务");
+  const project = path.basename(String(thread.cwd || "")) || String(thread.cwd || "未知项目");
+  const updatedAt = thread.recencyAt || thread.updatedAt || thread.createdAt;
+  return { title, project, age: relativeTime(updatedAt, now) };
+}
+
+export async function selectCodexThread(threads, {
+  input = process.stdin,
+  output = process.stdout,
+  now = Date.now(),
+} = {}) {
+  if (!input?.isTTY || !output?.isTTY) {
+    throw new Error("Interactive task selection requires a terminal. Use --thread <id> in scripts.");
+  }
+
+  output.write("选择要迁移到 4YI 的 Codex 任务：\n\n");
+  threads.forEach((thread, index) => {
+    const item = describeCodexThread(thread, { now });
+    output.write(`${index + 1}. ${item.title}\n   ${item.project} · ${item.age}\n`);
+  });
+
+  const readline = createInterface({ input, output });
+  try {
+    while (true) {
+      const answer = await readline.question("\n输入序号（默认 1，q 取消）：");
+      const value = answer.trim().toLowerCase();
+      if (value === "q" || value === "quit") return null;
+      const index = value === "" ? 0 : Number(value) - 1;
+      if (Number.isInteger(index) && index >= 0 && index < threads.length) return threads[index];
+      output.write(`请输入 1-${threads.length} 之间的序号。\n`);
+    }
+  } finally {
+    readline.close();
+  }
+}
+
+export class CodexAppServerClient {
+  constructor({
+    command = executableName("codex"),
+    args = ["app-server", "--stdio"],
+    env = process.env,
+    platform = process.platform,
+    spawn = nodeSpawn,
+    timeoutMs = REQUEST_TIMEOUT_MS,
+  } = {}) {
+    this.nextId = 1;
+    this.pending = new Map();
+    this.stderr = "";
+    this.timeoutMs = timeoutMs;
+    const launch = appServerLaunch({ command, args, env, platform });
+    this.child = spawn(launch.command, launch.args, {
+      env,
+      shell: launch.shell,
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+
+    let stdoutBuffer = "";
+    this.child.stdout.setEncoding("utf8");
+    this.child.stdout.on("data", (chunk) => {
+      stdoutBuffer += chunk;
+      const lines = stdoutBuffer.split(/\r?\n/);
+      stdoutBuffer = lines.pop() || "";
+      for (const line of lines) this.#handleLine(line);
+    });
+    this.child.stderr.setEncoding("utf8");
+    this.child.stderr.on("data", (chunk) => {
+      this.stderr = `${this.stderr}${chunk}`.slice(-4000);
+    });
+    this.child.on("error", (error) => this.#rejectAll(error));
+    this.child.on("exit", (code, signal) => {
+      if (this.pending.size === 0) return;
+      const detail = this.stderr.trim();
+      const exitReason = signal || (code ?? "unknown");
+      this.#rejectAll(new Error(`Codex app-server stopped (${exitReason}).${detail ? ` ${detail}` : ""}`));
+    });
+  }
+
+  #handleLine(line) {
+    if (!line.trim()) return;
+    let message;
+    try { message = JSON.parse(line); } catch { return; }
+    if (message.id === undefined || message.id === null) return;
+    const pending = this.pending.get(message.id);
+    if (!pending) return;
+    this.pending.delete(message.id);
+    clearTimeout(pending.timer);
+    if (message.error) {
+      const text = message.error.message || JSON.stringify(message.error);
+      pending.reject(new Error(text));
+    } else {
+      pending.resolve(message.result);
+    }
+  }
+
+  #rejectAll(error) {
+    for (const pending of this.pending.values()) {
+      clearTimeout(pending.timer);
+      pending.reject(error);
+    }
+    this.pending.clear();
+  }
+
+  request(method, params = {}) {
+    const id = this.nextId++;
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(id);
+        reject(new Error(`Codex app-server timed out while calling ${method}.`));
+      }, this.timeoutMs);
+      this.pending.set(id, { resolve, reject, timer });
+      this.child.stdin.write(`${JSON.stringify({ id, method, params })}\n`, (error) => {
+        if (!error) return;
+        clearTimeout(timer);
+        this.pending.delete(id);
+        reject(error);
+      });
+    });
+  }
+
+  notify(method, params = {}) {
+    this.child.stdin.write(`${JSON.stringify({ method, params })}\n`);
+  }
+
+  async initialize() {
+    const result = await this.request("initialize", {
+      clientInfo: { name: "4yi-cli", version: "0.1.0" },
+      capabilities: { experimentalApi: true },
+    });
+    this.notify("initialized", {});
+    return result;
+  }
+
+  async close() {
+    this.child.stdin.end();
+    if (this.child.exitCode !== null) return;
+    await new Promise((resolve) => {
+      const timer = setTimeout(() => {
+        this.child.kill();
+        resolve();
+      }, 1000);
+      this.child.once("exit", () => {
+        clearTimeout(timer);
+        resolve();
+      });
+    });
+  }
+}
+
+async function loadDefaultCodexModel(session) {
+  const response = await requestJson(session.baseUrl, "/api/cli/models?runtime=codex", { token: session.token });
+  const ids = (response?.models || []).map((model) => model?.id).filter(Boolean);
+  if (ids.length === 0) throw new Error("Your active Plan has no Codex-compatible Responses models.");
+  return ids.includes(response.default_model) ? response.default_model : ids[0];
+}
+
+export async function migrateCodexTask({
+  session,
+  threadId,
+  model,
+  limit = DEFAULT_LIMIT,
+  input = process.stdin,
+  output = process.stdout,
+  stdout = console.log,
+  client,
+  clientOptions = {},
+  selectThread = selectCodexThread,
+} = {}) {
+  if (!session?.token) throw new Error("Not signed in. Run `4yi login`.");
+  const selectedModel = model || await loadDefaultCodexModel(session);
+  const appServer = client || new CodexAppServerClient(clientOptions);
+  try {
+    await appServer.initialize();
+    let selected;
+    if (threadId) {
+      selected = { id: threadId };
+    } else {
+      const response = await appServer.request("thread/list", {
+        limit: Math.max(limit * 3, 30),
+        sortKey: "updated_at",
+        sortDirection: "desc",
+        useStateDbOnly: true,
+      });
+      const candidates = (response?.data || [])
+        .filter((thread) => thread?.id && thread.modelProvider !== "4yi" && !thread.ephemeral)
+        .slice(0, limit);
+      if (candidates.length === 0) {
+        throw new Error("没有找到可迁移的旧 Codex 任务。新任务已经会默认使用 4YI。");
+      }
+      selected = await selectThread(candidates, { input, output });
+      if (!selected) {
+        stdout("已取消，没有修改任何任务。");
+        return { cancelled: true };
+      }
+    }
+
+    stdout(`正在迁移到 ${selectedModel}…`);
+    const result = await appServer.request("thread/fork", {
+      threadId: selected.id,
+      model: selectedModel,
+      modelProvider: "4yi",
+      excludeTurns: true,
+    });
+    if (!result?.thread?.id) throw new Error("Codex did not return the migrated task id.");
+    if (result.modelProvider !== "4yi" && result.thread.modelProvider !== "4yi") {
+      throw new Error("Codex created the task but did not apply the 4YI provider.");
+    }
+    stdout("✓ 已创建新的 4YI 任务，原任务未修改。");
+    stdout(`新任务 ID: ${result.thread.id}`);
+    return { cancelled: false, sourceThreadId: selected.id, threadId: result.thread.id, model: selectedModel };
+  } finally {
+    if (!client) await appServer.close();
+  }
+}
+
+export const __testing = {
+  appServerLaunch,
+  loadDefaultCodexModel,
+  relativeTime,
+};

package/src/connect.mjs

@@ -65,6 +65,7 @@ export function connectionPaths({
     claudeProject: path.join(cwd, ".claude", "settings.local.json"),
     codexConfig: path.join(codexDir, "config.toml"),
     codexCatalog: path.join(codexDir, "model-catalogs", "4yi.json"),
+    codexCredentialHelper: path.join(home, ".4yi", "helpers", "codex-credential.mjs"),
   };
   if (platform === "darwin") {
     const desktopDir = path.join(home, "Library", "Application Support", "Claude-3p");
@@ -154,17 +155,37 @@ async function ensureToolCli(target, {
 function desktopAppCandidates(target, { home = os.homedir(), platform = process.platform, env = process.env } = {}) {
   const appName = target === "claude" ? "Claude" : "Codex";
   if (platform === "darwin") {
-    return [
+    const candidates = [
       path.join("/Applications", `${appName}.app`),
       path.join(home, "Applications", `${appName}.app`),
     ];
+    if (target === "codex") {
+      candidates.push(
+        path.join("/Applications", "ChatGPT.app"),
+        path.join(home, "Applications", "ChatGPT.app"),
+      );
+    }
+    return candidates;
   }
   if (platform === "win32") {
-    const localAppData = env.LOCALAPPDATA || path.join(home, "AppData", "Local");
-    return [
-      path.join(localAppData, "Programs", appName, `${appName}.exe`),
-      path.join(localAppData, appName, `${appName}.exe`),
+    const localAppData = env.LOCALAPPDATA || path.win32.join(home, "AppData", "Local");
+    const candidates = [
+      path.win32.join(localAppData, "Programs", appName, `${appName}.exe`),
+      path.win32.join(localAppData, appName, `${appName}.exe`),
     ];
+    if (target === "codex") {
+      // Microsoft Store/AppX builds keep their mutable runtime under this
+      // directory and commonly expose only an execution alias in WindowsApps.
+      // Checking both covers the Store build without traversing the protected
+      // C:\Program Files\WindowsApps package directory.
+      candidates.push(
+        path.win32.join(localAppData, "OpenAI", "Codex"),
+        path.win32.join(localAppData, "OpenAI", "ChatGPT"),
+        path.win32.join(localAppData, "Microsoft", "WindowsApps", "Codex.exe"),
+        path.win32.join(localAppData, "Microsoft", "WindowsApps", "ChatGPT.exe"),
+      );
+    }
+    return candidates;
   }
   return [];
 }
@@ -179,6 +200,14 @@ function reportDesktopApp(target, {
   const meta = TOOL_METADATA[target];
   const candidates = desktopAppCandidates(target, { home, platform, env });
   const detected = candidates.some((candidate) => exists(candidate));
+  if (target === "codex" && platform === "win32") {
+    if (detected) {
+      stdout("Codex App detected. 4YI updated the shared Windows Codex home. Finish active tasks, fully quit and reopen the App, then start a new chat to load the new provider.");
+    } else {
+      stdout("4YI updated the shared Windows Codex home. A Microsoft Store/AppX install may not expose a standard executable path; finish active tasks, fully quit and reopen any running Codex App, then start a new chat.");
+    }
+    return detected;
+  }
   if (detected) {
     stdout(`${meta.appLabel} detected. Quit and reopen it to use the new connection.`);
   } else if (candidates.length > 0) {
@@ -268,6 +297,25 @@ printf '%s' "$token"
 `;
 }
 
+function codexCredentialHelper() {
+  return `#!/usr/bin/env node
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+try {
+  const configFile = path.join(os.homedir(), ".4yi", "config.json");
+  const config = JSON.parse(fs.readFileSync(configFile, "utf8"));
+  const token = typeof config.token === "string" ? config.token.trim() : "";
+  if (!token) throw new Error("4YI session is missing a token.");
+  process.stdout.write(token);
+} catch (error) {
+  process.stderr.write((error.message || "4YI session is invalid.") + " Run: 4yi login\\n");
+  process.exit(1);
+}
+`;
+}
+
 function configureClaudeDesktop({
   home,
   claudeBaseUrl,
@@ -494,7 +542,8 @@ async function checkCodex(session, codexBaseUrl, model) {
 }
 
 async function connectCodex({ session, home, codexHome, codexBaseUrl, stdout, skipCheck = false, tooling = {} }) {
-  const paths = connectionPaths({ home, codexHome });
+  const platform = tooling.platform || process.platform;
+  const paths = connectionPaths({ home, codexHome, platform });
   const { models, defaultModel } = await loadCodexModels(session);
   if (!skipCheck) await checkCodex(session, codexBaseUrl, defaultModel);
   ensureDir(path.dirname(paths.codexConfig));
@@ -502,17 +551,26 @@ async function connectCodex({ session, home, codexHome, codexBaseUrl, stdout, sk
   const catalog = buildCodexCatalog(models, template);
   atomicWrite(paths.codexCatalog, `${JSON.stringify(catalog, null, 2)}\n`);
 
-  const backup = backupFile("codex", paths.codexConfig, home);
+  const backupGroup = timestamp();
+  const backup = backupFile("codex", paths.codexConfig, home, backupGroup);
+  const helperBackup = backupFile("codex", paths.codexCredentialHelper, home, backupGroup);
   let existing = fs.existsSync(paths.codexConfig) ? fs.readFileSync(paths.codexConfig, "utf8") : "";
   existing = removeManagedBlock(existing, CODEX_ROOT_START, CODEX_ROOT_END);
   existing = removeManagedBlock(existing, CODEX_PROVIDER_START, CODEX_PROVIDER_END);
   existing = removeCodexRootAssignments(existing);
   const root = `${CODEX_ROOT_START}\nmodel = ${JSON.stringify(defaultModel)}\nmodel_provider = "4yi"\nmodel_catalog_json = ${JSON.stringify(paths.codexCatalog)}\n${CODEX_ROOT_END}`;
-  const provider = `${CODEX_PROVIDER_START}\n[model_providers."4yi"]\nname = "4YI Gateway"\nbase_url = ${JSON.stringify(codexBaseUrl.replace(/\/+$/, ""))}\nwire_api = "responses"\nexperimental_bearer_token = ${JSON.stringify(session.token)}\n${CODEX_PROVIDER_END}`;
+  const nodeExecutable = tooling.nodeExecutable || process.execPath;
+  const provider = `${CODEX_PROVIDER_START}\n[model_providers."4yi"]\nname = "4YI Gateway"\nbase_url = ${JSON.stringify(codexBaseUrl.replace(/\/+$/, ""))}\nwire_api = "responses"\n\n[model_providers."4yi".auth]\ncommand = ${JSON.stringify(nodeExecutable)}\nargs = [${JSON.stringify(paths.codexCredentialHelper)}]\ntimeout_ms = 5000\n${CODEX_PROVIDER_END}`;
+  // Codex loads the provider when its process starts. Make the command-backed
+  // credential durable before activating the provider in config.toml, and
+  // never copy the bearer token into Codex-owned files.
+  atomicWrite(paths.codexCredentialHelper, codexCredentialHelper(), 0o700);
   atomicWrite(paths.codexConfig, `${root}\n\n${existing ? `${existing}\n\n` : ""}${provider}\n`);
   stdout(`Connected Codex: ${paths.codexConfig}`);
+  stdout(`Codex credential helper: ${paths.codexCredentialHelper}`);
   stdout(`Available Codex models: ${models.map((model) => model.id).join(", ")}`);
   stdout(`Backup: ${backup}`);
+  stdout(`Backup: ${helperBackup}`);
 }
 
 function resolveUrls(session, options) {
@@ -641,6 +699,7 @@ export const __testing = {
   reportDesktopApp,
   configureClaudeDesktop,
   claudeDesktopCredentialHelper,
+  codexCredentialHelper,
   readClaudeDesktopStatus,
   removeManagedBlock,
   removeCodexRootAssignments,