@baize-ai/core 0.3.15 → 0.3.17

package/cli/lib/__tests__/runtime-setup.test.js

@@ -162,9 +162,55 @@ describe('renderCodexGlobalConfig', () => {
     assert.doesNotMatch(content, /check_for_update_on_startup/);
   });
 
-  it('includes openai_base_url when provided', () => {
+  it('never writes openai_base_url — legacy opt only cleans the override (D51)', () => {
     const content = renderCodexGlobalConfig('/home/user/baize', '', { openaiBaseUrl: 'https://proxy.example.com/v1' });
-    assert.match(content, /openai_base_url = "https:\/\/proxy\.example\.com\/v1"/);
+    assert.doesNotMatch(content, /openai_base_url/);
+  });
+
+  it('renders a dedicated provider block from opts.codex (D51)', () => {
+    const content = renderCodexGlobalConfig('/home/user/baize', '', {
+      codex: {
+        providerKey: 'deepseek',
+        baseUrl: 'https://api.deepseek.com/',
+        token: 'sk-test',
+        model: 'deepseek-v4-flash',
+      },
+    });
+    assert.match(content, /^model = "deepseek-v4-flash"$/m);
+    assert.match(content, /^model_provider = "deepseek"$/m);
+    assert.match(content, /\[model_providers\.deepseek\]/);
+    assert.match(content, /name = "deepseek"/);
+    assert.match(content, /base_url = "https:\/\/api\.deepseek\.com\/"/);
+    assert.match(content, /wire_api = "responses"/);
+    assert.match(content, /experimental_bearer_token = "sk-test"/);
+    assert.doesNotMatch(content, /openai_base_url/);
+  });
+
+  it('provider block omits the token key when no token is given (D51)', () => {
+    const content = renderCodexGlobalConfig('/home/user/baize', '', {
+      codex: { providerKey: 'deepseek', baseUrl: 'https://api.deepseek.com/', model: 'deepseek-v4-flash' },
+    });
+    assert.match(content, /\[model_providers\.deepseek\]/);
+    assert.doesNotMatch(content, /experimental_bearer_token/);
+  });
+
+  it('provider block replaces the legacy override and keeps other provider tables (D51)', () => {
+    const existing = [
+      'openai_base_url = "https://old.example.com/v1"',
+      'model = "old"',
+      '',
+      '[model_providers.userown]',
+      'name = "userown"',
+      'base_url = "https://u.example"',
+      '',
+    ].join('\n');
+    const content = renderCodexGlobalConfig('/home/user/baize', existing, {
+      codex: { providerKey: 'deepseek', baseUrl: 'https://api.deepseek.com/' },
+    });
+    assert.doesNotMatch(content, /openai_base_url/);
+    assert.match(content, /^model = "old"$/m, 'model kept when opts.codex.model absent');
+    assert.match(content, /\[model_providers\.userown\]/, 'user tables survive');
+    assert.match(content, /\[model_providers\.deepseek\]/);
   });
 
   it('preserves unknown global top-level keys, sections, and unrelated projects', () => {
@@ -189,22 +235,23 @@ describe('renderCodexGlobalConfig', () => {
     assert.match(content, /\[projects\."\/home\/user\/baize"\]\ntrust_level = "trusted"/);
   });
 
-  it('preserves existing openai_base_url when baize has no value', () => {
+  it('strips a stale legacy openai_base_url even without opts (D51 migration)', () => {
     const existing = 'openai_base_url = "https://user-proxy.example.com/v1"\n';
     const content = renderCodexGlobalConfig('/home/user/baize', existing);
-    assert.match(content, /openai_base_url = "https:\/\/user-proxy\.example\.com\/v1"/);
+    assert.doesNotMatch(content, /openai_base_url/);
   });
 
-  it('overwrites existing openai_base_url when baize has a value', () => {
+  it('cleans the legacy openai_base_url when the legacy opt is passed (D51)', () => {
     const existing = 'openai_base_url = "https://old-proxy.example.com/v1"\n';
     const content = renderCodexGlobalConfig('/home/user/baize', existing, {
       openaiBaseUrl: 'https://new-proxy.example.com/v1',
     });
-    assert.match(content, /openai_base_url = "https:\/\/new-proxy\.example\.com\/v1"/);
+    assert.doesNotMatch(content, /openai_base_url/);
     assert.doesNotMatch(content, /old-proxy/);
   });
 });
 
+
 describe('writeCodexConfig', () => {
   it('writes project-level config and global config to separate locations', () => {
     const globalConfigPath = path.join(fakeHome, '.codex', 'config.toml');

package/cli/lib/__tests__/tmux-env.test.js

@@ -464,11 +464,20 @@ describe('buildCleanEnv', () => {
 // ── buildCompatEnv ─────────────────────────────────────────────────────────
 
 describe('buildCompatEnv', () => {
-  it('passes through full processEnv', () => {
+  it('passes through full processEnv and prepends known bin dirs (D54)', () => {
     const processEnv = { PATH: '/usr/bin', HOME: '/home/test', SECRET: 'abc123' };
     const { env } = buildCompatEnv({ processEnv, dotenvVars: {} });
     assert.equal(env.SECRET, 'abc123');
-    assert.equal(env.PATH, '/usr/bin');
+    const parts = env.PATH.split(':');
+    // D54: known bin dirs are ALWAYS prepended (npm-global static first),
+    // original PATH entries preserved, no duplicates.
+    assert.equal(parts[0], '/home/test/.npm-global/bin');
+    assert.ok(parts.includes('/home/test/.local/bin'));
+    assert.ok(parts.includes('/home/test/.claude/bin'));
+    assert.ok(parts.includes('/home/test/baize/bin'));
+    assert.ok(parts.includes('/home/test/.local/node/bin'));
+    assert.ok(parts.includes('/usr/bin'));
+    assert.equal(new Set(parts).size, parts.length, 'PATH must be deduplicated');
   });
 
   it('overrides with BAIZE_TMUX_ENV manifest vars', () => {
@@ -478,10 +487,15 @@ describe('buildCompatEnv', () => {
     assert.equal(env.MY_VAR, 'new_value');
   });
 
-  it('deduplicates PATH preserving first-occurrence order', () => {
+  it('deduplicates PATH preserving first-occurrence order with known bins first (D54)', () => {
     const processEnv = { PATH: '/a:/b:/a:/c:/b', HOME: '/home/test' };
     const { env } = buildCompatEnv({ processEnv, dotenvVars: {} });
-    assert.equal(env.PATH, '/a:/b:/c');
+    const parts = env.PATH.split(':');
+    assert.equal(parts[0], '/home/test/.npm-global/bin');
+    // original entries deduped, first-occurrence order preserved after known bins
+    const tail = parts.slice(parts.indexOf('/a'));
+    assert.deepEqual(tail, ['/a', '/b', '/c']);
+    assert.equal(new Set(parts).size, parts.length);
   });
 
   it('does not inject GH_PROMPT_DISABLED, Homebrew paths, or PATH manifest', () => {
@@ -492,7 +506,7 @@ describe('buildCompatEnv', () => {
     };
     const { env } = buildCompatEnv({ processEnv, dotenvVars });
     assert.equal(env.GH_PROMPT_DISABLED, undefined);
-    assert.ok(!env.PATH.includes('/opt/homebrew'), 'compat mode should not add Homebrew paths');
+    // compat mode does NOT apply PATH manifest PREPEND/APPEND (clean-env only)
     assert.ok(!env.PATH.includes('/custom/pre'), 'compat mode should not apply PREPEND');
     assert.ok(!env.PATH.includes('/custom/post'), 'compat mode should not apply APPEND');
   });

package/cli/lib/claude-eval.js

@@ -8,6 +8,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
+import { completeBinPath } from './path-bins.js';
 import { parseSkillMd } from './skill.js';
 
 const MAX_FILE_LINES = 500;
@@ -133,7 +134,7 @@ function callClaude(prompt) {
 
     const child = spawn('claude', ['--print', '--output-format', 'text'], {
       stdio: ['pipe', 'pipe', 'ignore'],
-      env: { ...process.env },
+      env: { ...process.env, PATH: completeBinPath() },
     });
 
     child.stdin.on('error', () => {}); // Ignore EPIPE if child exits early

package/cli/lib/codex-hooks.js

@@ -289,12 +289,23 @@ function writeTrustMarker(markerPath, marker) {
   fs.writeFileSync(markerPath, JSON.stringify(stable(marker), null, 2) + '\n', { mode: 0o600 });
 }
 
+/**
+ * D54 PATH hardening: build a PATH that always includes the known bin dirs
+ * (npm global prefix bin, ~/.local/bin, ~/.claude/bin, ~/baize/bin) on top of
+ * the current PATH — a login-shell-polluted PATH (missing ~/.npm-global/bin)
+ * must not make a bare `codex` spawn fail with ENOENT (09-13 incident).
+ * Single source of truth: cli/lib/path-bins.js.
+ */
+import { completeBinPath } from './path-bins.js';
+export { completeBinPath };
+
 export function getCodexVersion({ codexBin = process.env.CODEX_BIN || 'codex', execFileSyncImpl } = {}) {
   const execImpl = execFileSyncImpl || execFileSync;
   return String(execImpl(codexBin, ['--version'], {
     encoding: 'utf8',
     timeout: 10_000,
     stdio: 'pipe',
+    env: { ...process.env, PATH: completeBinPath() },
   })).trim();
 }
 
@@ -470,6 +481,7 @@ send('initialize', {
     cwd: baizeDir,
     env: {
       ...process.env,
+      PATH: completeBinPath(),
       BAIZE_CODEX_TRUST_CWD: baizeDir,
       BAIZE_CODEX_BIN: codexBin,
     },

package/cli/lib/path-bins.js

@@ -0,0 +1,54 @@
+/**
+ * D54: complete known-good bin PATH — the single source of truth for the bin
+ * directories where baize/claude/codex binaries actually live. Every spawn
+ * of a runtime binary must pass PATH built from this so a login-shell-polluted
+ * PATH (missing ~/.npm-global/bin — 09-13 incident) can never cause ENOENT.
+ *
+ * Consumers: init.js (profile repair + SYSTEM_PATH), codex-hooks.js
+ * (getCodexVersion), runtime-setup.js (auth checks), claude-eval.js,
+ * runtime/codex.js + runtime/claude.js (launch auth checks).
+ */
+import os from 'node:os';
+import path from 'node:path';
+import { execFileSync } from 'node:child_process';
+
+/**
+ * @param {object} [opts]
+ * @param {string} [opts.currentPath]  base PATH to extend (default process.env.PATH)
+ * @returns {string} deduplicated PATH with all known bin dirs first
+ */
+export function completeBinPath({ currentPath = process.env.PATH || '', home = os.homedir() } = {}) {
+  const bins = [];
+  // ~/.npm-global/bin — STATIC first (the 09-13 incident dir): codex/baize
+  // install there in the standard (Dockerfile NPM_CONFIG_PREFIX + install.sh
+  // user prefix) layouts; must never depend on `npm` being resolvable from
+  // the calling process (PM2 services, containers with replaced PATH).
+  bins.push(path.join(home, '.npm-global', 'bin'));
+  // npm global prefix bin — dynamic (npm config get prefix); covers custom
+  // prefixes (e.g. /opt/homebrew) in addition to the default.
+  try {
+    const prefix = execFileSync('npm', ['config', 'get', 'prefix'], { encoding: 'utf8', timeout: 10_000 }).trim();
+    if (prefix && prefix !== 'undefined' && prefix !== 'null') bins.push(path.join(prefix, 'bin'));
+  } catch { /* npm unavailable */ }
+  bins.push(path.join(home, '.local', 'bin'));
+  bins.push(path.join(home, '.claude', 'bin'));
+  bins.push(path.join(home, 'baize', 'bin'));
+  bins.push(path.join(home, '.local', 'node', 'bin'));
+  for (const entry of currentPath.split(':').filter(Boolean)) bins.push(entry);
+  return [...new Set(bins)].join(':');
+}
+
+/** Known bin dirs (without the current PATH tail) — for profile writes. */
+export function knownBinDirs(home = os.homedir()) {
+  const bins = [];
+  bins.push(path.join(home, '.npm-global', 'bin'));
+  try {
+    const prefix = execFileSync('npm', ['config', 'get', 'prefix'], { encoding: 'utf8', timeout: 10_000 }).trim();
+    if (prefix && prefix !== 'undefined' && prefix !== 'null') bins.push(path.join(prefix, 'bin'));
+  } catch { /* npm unavailable */ }
+  bins.push(path.join(home, '.local', 'bin'));
+  bins.push(path.join(home, '.claude', 'bin'));
+  bins.push(path.join(home, 'baize', 'bin'));
+  bins.push(path.join(home, '.local', 'node', 'bin'));
+  return [...new Set(bins)];
+}

package/cli/lib/runtime/claude.js

@@ -16,6 +16,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { execFileSync, execFile } from 'node:child_process';
+import { completeBinPath } from '../path-bins.js';
 import { promisify } from 'node:util';
 
 const execFileAsync = promisify(execFile);
@@ -104,7 +105,7 @@ export class ClaudeAdapter extends RuntimeAdapter {
    */
   async checkAuth() {
     // Build subprocess env: inherit current env, inject .env API keys (same as launch()).
-    const injectedEnv = { ...process.env };
+    const injectedEnv = { ...process.env, PATH: completeBinPath() };
     let envApiKey = '';
     let envOauthToken = '';
     let envBaseUrl = '';
@@ -257,6 +258,7 @@ export class ClaudeAdapter extends RuntimeAdapter {
       try {
         const out = execFileSync(CLAUDE_BIN, ['auth', 'status'], {
           encoding: 'utf8', timeout: 10_000, stdio: ['ignore', 'pipe', 'pipe'],
+          env: { ...process.env, PATH: completeBinPath() },
         });
         const status = JSON.parse(out);
         if (status?.loggedIn === true && status?.authMethod === 'claude.ai') {
@@ -435,7 +437,7 @@ function _ensureOnboardingComplete(projectDir) {
       config.hasCompletedOnboarding = true;
       try {
         config.lastOnboardingVersion = execFileSync(
-          CLAUDE_BIN, ['--version'], { encoding: 'utf8', timeout: 5000 }
+          CLAUDE_BIN, ['--version'], { encoding: 'utf8', timeout: 5000, env: { ...process.env, PATH: completeBinPath() } }
         ).trim();
       } catch {
         config.lastOnboardingVersion = '2.1.59';

package/cli/lib/runtime/codex.js

@@ -18,6 +18,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { execFileSync, execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { completeBinPath } from '../path-bins.js';
 
 const execFileAsync = promisify(execFile);
 import { RuntimeAdapter } from './base.js';
@@ -55,10 +56,27 @@ function getCodexApiBaseUrl() {
   try {
     const configPath = path.join(os.homedir(), '.codex', 'config.toml');
     const config = fs.readFileSync(configPath, 'utf8');
+    // legacy override first (pre-D51 configs)
     const match = config.match(/^\s*openai_base_url\s*=\s*"([^"]+)"\s*$/m);
     if (match?.[1]) {
       return match[1].replace(/\/+$/, '');
     }
+    // D51: the active provider block carries the endpoint — resolve the
+    // top-level model_provider slug and read its base_url, so the /models
+    // probe stays in sync with what codex actually calls (otherwise an
+    // external endpoint activation reports 401 against api.openai.com).
+    const providerKey = config.match(/^\s*model_provider\s*=\s*"([^"]+)"\s*$/m)?.[1];
+    if (providerKey) {
+      const escaped = providerKey.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+      const blockRe = new RegExp(
+        `\\[model_providers\\.${escaped}\\][^[]*?\\bbase_url\\s*=\\s*"([^"]+)"`,
+        'm'
+      );
+      const blockMatch = config.match(blockRe);
+      if (blockMatch?.[1]) {
+        return blockMatch[1].replace(/\/+$/, '');
+      }
+    }
   } catch { /* ignore missing config */ }
 
   if (process.env.OPENAI_BASE_URL) {
@@ -130,6 +148,7 @@ export class CodexAdapter extends RuntimeAdapter {
       try {
         const { stdout, stderr } = await execFileAsync(CODEX_BIN, ['login', 'status'], {
           stdio: 'pipe', encoding: 'utf8', timeout: 10_000,
+          env: { ...process.env, PATH: completeBinPath() },
         });
         const status = classifyCodexLoginStatus((stdout || '') + (stderr || ''));
         if (status === 'success') return { status: 'success', reason: 'codex_login_status' };

package/cli/lib/runtime/tmux-env.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
+import { completeBinPath } from '../path-bins.js';
 
 const VALID_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 
@@ -280,10 +281,10 @@ export function buildCleanEnv({ processEnv, dotenvVars, manifest, platform, uid,
 export function buildCompatEnv({ processEnv, dotenvVars }) {
   const env = { ...processEnv };
 
-  // Deduplicate PATH to prevent bloat across restarts (PR #499 defense)
-  if (env.PATH) {
-    env.PATH = [...new Set(env.PATH.split(':').filter(Boolean))].join(':');
-  }
+  // D54: PATH built from the shared single source of truth (path-bins) —
+  // always prepends npm-global/.local/.claude/baize/node bins and dedupes;
+  // a polluted login-shell PATH can never hide the runtime binaries.
+  env.PATH = completeBinPath({ currentPath: env.PATH, home: processEnv.HOME });
 
   // Override with BAIZE_TMUX_ENV manifest vars from dotenvVars
   const warnings = [];

package/cli/lib/runtime-setup.js

@@ -11,7 +11,9 @@ import os from 'node:os';
 import path from 'node:path';
 import { execSync, execFileSync, spawnSync } from 'node:child_process';
 import { parse, stringify } from 'smol-toml';
+import crypto from 'node:crypto';
 import { BAIZE_DIR } from './config.js';
+import { completeBinPath } from './path-bins.js';
 import { commandExists } from './shell-utils.js';
 import { parseClaudeAuthStatus, parseCodexLoginStatus } from './auth-parsers.js';
 import { installCoreCodexHook } from './codex-hooks.js';
@@ -89,6 +91,7 @@ export function isClaudeAuthenticated() {
       stdio: 'pipe',
       encoding: 'utf8',
       timeout: 10000,
+      env: { ...process.env, PATH: completeBinPath() },
     });
     return parseClaudeAuthStatus(result.stdout);
   } catch {
@@ -128,6 +131,7 @@ export function isCodexAuthenticated() {
   try {
     const result = spawnSync('codex', ['login', 'status'], {
       stdio: 'pipe', encoding: 'utf8', timeout: 10000,
+      env: { ...process.env, PATH: completeBinPath() },
     });
     return parseCodexLoginStatus((result.stdout || '') + (result.stderr || ''));
   } catch {
@@ -157,7 +161,7 @@ export function approveApiKey(keyOrToken) {
     if (!config.hasCompletedOnboarding) {
       config.hasCompletedOnboarding = true;
       try {
-        const ver = execSync('claude --version 2>/dev/null', { encoding: 'utf8' }).trim();
+        const ver = execSync('claude --version 2>/dev/null', { encoding: 'utf8', env: { ...process.env, PATH: completeBinPath() } }).trim();
         config.lastOnboardingVersion = ver;
       } catch { /* omit if claude binary not yet available */ }
     }
@@ -410,21 +414,30 @@ export function renderCodexProjectConfig(existingContent = '', opts = {}) {
 /**
  * Render global ~/.codex/config.toml with user/environment-level settings.
  *
- * Contains only trust declarations and optional base URL override.
- * Existing [projects.*] trust entries are preserved; the baize project trust
- * entry is always regenerated.
- *
- * @param {string} projectDir - The baize working directory to pre-trust
- * @param {string} existingContent - Existing global config.toml contents (optional)
- * @param {{ openaiBaseUrl?: string }} opts - Optional Codex config overrides
+ * Contains only trust declarations and the optional D51 provider block.
  * @returns {string}
  */
 export function renderCodexGlobalConfig(projectDir, existingContent = '', opts = {}) {
   const absProject = path.resolve(projectDir);
-  const openaiBaseUrl = opts.openaiBaseUrl || process.env.OPENAI_BASE_URL || '';
   const obj = parseCodexToml(existingContent);
-  if (openaiBaseUrl) {
-    obj.openai_base_url = openaiBaseUrl;
+  // D51: external Codex endpoints are configured as a dedicated provider
+  // block (model_providers.<key> + top-level model_provider) instead of
+  // overriding the built-in OpenAI provider via openai_base_url — the override
+  // keeps provider.name === "OpenAI", which makes Codex enable remote
+  // compaction v2 against endpoints that cannot answer it (DeepSeek → fatal
+  // "expected exactly one compaction output item").
+  const codex = opts.codex || null;
+  if (codex && codex.providerKey && codex.baseUrl) {
+    obj.model = codex.model || obj.model;
+    obj.model_provider = codex.providerKey;
+    obj.model_providers = isTomlSectionValue(obj.model_providers) ? obj.model_providers : {};
+    const block = { name: codex.providerKey, base_url: codex.baseUrl, wire_api: 'responses' };
+    if (codex.token) block.experimental_bearer_token = codex.token;
+    obj.model_providers[codex.providerKey] = block;
+    delete obj.openai_base_url; // migration cleanup — never mix the two mechanisms
+  } else {
+    // D51: no provider block requested → never leave a stale override behind
+    delete obj.openai_base_url;
   }
   obj.features = isTomlSectionValue(obj.features) ? obj.features : {};
   obj.features.hooks = true;
@@ -438,8 +451,9 @@ export function renderCodexGlobalConfig(projectDir, existingContent = '', opts =
  *
  * - Project config (<projectDir>/.codex/config.toml): headless settings,
  *   features, notice suppression — required for baize unattended operation.
- * - Global config (~/.codex/config.toml): trust declarations, optional
- *   base URL override.
+ * - Global config (~/.codex/config.toml): trust declarations + optional D51
+ *   provider block (opts.codex). Legacy opts.openaiBaseUrl is still accepted
+ *   for compatibility but only cleans the override key (D51 migration).
  *
  * Called by both `baize init` (Codex runtime) and `baize runtime codex` so the
  * config is always present when switching to Codex.
@@ -485,6 +499,136 @@ export function writeCodexConfig(projectDir, opts = {}) {
   }
 }
 
+// ── D51: dedicated provider block writers (DeepSeek remote-compaction fix) ──
+
+// Keys Codex treats as built-in model_providers entries — a custom provider
+// must never shadow these (merge_configured_model_providers silently drops
+// colliding keys). Also covers the web-console restore targets.
+export const CODEX_RESERVED_PROVIDER_KEYS = new Set([
+  'openai', 'azure', 'amazon-bedrock', 'amazon-bedrock-runtime',
+  'ollama', 'lmstudio', 'gpt-oss', 'official', 'official-openai',
+]);
+
+/**
+ * Deterministic provider slug for a provider id: ASCII slug, or
+ * `codex-<id-hash8>` when empty or reserved. Pure — no store access.
+ */
+export function codexProviderKeyForId(id) {
+  const base = String(id || '').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+  if (base && !CODEX_RESERVED_PROVIDER_KEYS.has(base)) return base;
+  const hash = crypto.createHash('sha256').update(String(id || '')).digest('hex').slice(0, 8);
+  return `codex-${hash}`;
+}
+
+function globalCodexConfigPath(homeDir) {
+  // D51 incident hardening: jest's ESM sandbox resolves os.homedir() to the
+  // REAL home regardless of process.env.HOME — relying on the default once
+  // wrote test fixtures into the user's live ~/.codex. Callers must pass
+  // homeDir explicitly; when they don't, honor HOME env first and only then
+  // fall back to os.homedir().
+  const base = homeDir || process.env.HOME || os.homedir();
+  return path.join(base, '.codex', 'config.toml');
+}
+
+function projectCodexConfigPathFor(projectDir) {
+  // D51: resolve the fallback lazily — BAIZE_DIR is a module-load constant in
+  // config.js, so under test runners that mutate HOME/BAIZE_DIR per case the
+  // cached value would point at the first case's temp dir. env wins here.
+  const base = projectDir
+    ? path.resolve(projectDir)
+    : (process.env.BAIZE_DIR || BAIZE_DIR);
+  return path.join(base, '.codex', 'config.toml');
+}
+
+/** Parse + stringify round-trip preserving everything smol-toml supports. */
+function rewriteCodexToml(targetPath, mutate, { mode } = {}) {
+  const dir = path.dirname(targetPath);
+  fs.mkdirSync(dir, { recursive: true });
+  let content = '';
+  try { content = fs.readFileSync(targetPath, 'utf8'); } catch { /* new file */ }
+  const obj = parseCodexToml(content);
+  mutate(obj);
+  const out = stringify(obj);
+  fs.writeFileSync(targetPath, out.endsWith('\n') ? out : `${out}\n`, mode ? { mode } : 'utf8');
+  return targetPath;
+}
+
+/**
+ * D51: activate an external Codex provider as a dedicated [model_providers.<key>]
+ * block in the GLOBAL config + top-level model_provider, and ensure both files
+ * are free of the legacy openai_base_url override. The block's `name` always
+ * equals the slug (never "OpenAI") so Codex treats the endpoint as a generic
+ * responses-compatible provider → local compaction (DeepSeek-safe).
+ *
+ * @param {{ providerKey: string, baseUrl: string, token?: string, model?: string,
+ *           homeDir?: string, projectDir?: string }} opts
+ * @returns {{ globalPath: string, projectPath: string }} written file paths
+ */
+export function applyCodexProviderBlock(opts) {
+  const { providerKey, baseUrl, token, model } = opts || {};
+  if (!providerKey || !baseUrl) {
+    throw new Error('applyCodexProviderBlock requires providerKey and baseUrl');
+  }
+  const key = CODEX_RESERVED_PROVIDER_KEYS.has(providerKey)
+    ? codexProviderKeyForId(providerKey)
+    : providerKey;
+  const globalPath = rewriteCodexToml(globalCodexConfigPath(opts.homeDir), (obj) => {
+    if (model) obj.model = model;
+    obj.model_provider = key;
+    obj.model_providers = isTomlSectionValue(obj.model_providers) ? obj.model_providers : {};
+    const block = { name: key, base_url: baseUrl, wire_api: 'responses' };
+    if (token) block.experimental_bearer_token = token;
+    obj.model_providers[key] = block;
+    delete obj.openai_base_url;
+  }, { mode: 0o600 }); // token may ride the global file — write user-only from the start
+
+
+  // D31 semantics: codex prefers project-level values, so the provider model
+  // must be mirrored here — otherwise a stale project model (e.g. gpt-5.5
+  // backfilled by init) would shadow the just-activated provider model.
+  const projectPath = rewriteCodexToml(projectCodexConfigPathFor(opts.projectDir), (obj) => {
+    if (model) obj.model = model;
+    delete obj.openai_base_url; // project-level never carries endpoint/auth
+  });
+  return { globalPath, projectPath };
+}
+
+/**
+ * D51: restore the official OpenAI configuration — remove the top-level
+ * model_provider and every baize-written custom provider block, drop the
+ * legacy openai_base_url override, reset model to gpt-5.5. Project-level
+ * model resets too (mirrors the pre-D51 applyCodexOfficial behavior).
+ *
+ * @param {{ homeDir?: string, projectDir?: string }} [opts]
+ * @returns {{ globalPath: string, projectPath: string }}
+ */
+export function restoreCodexOfficialBlock(opts = {}) {
+  const globalPath = rewriteCodexToml(globalCodexConfigPath(opts.homeDir), (obj) => {
+    delete obj.model_provider;
+    if (isTomlSectionValue(obj.model_providers)) {
+      for (const key of Object.keys(obj.model_providers)) {
+        const block = obj.model_providers[key];
+        // D51 review P2: only remove blocks baize itself wrote — the writer
+        // always stamps name === key && wire_api === 'responses'. Hand-edited
+        // user providers (any other shape) must survive an official restore.
+        const isBaizeWritten = isTomlSectionValue(block)
+          && block.name === key
+          && block.wire_api === 'responses';
+        if (isBaizeWritten) delete obj.model_providers[key];
+      }
+      if (Object.keys(obj.model_providers).length === 0) delete obj.model_providers;
+    }
+    delete obj.openai_base_url;
+    obj.model = 'gpt-5.5';
+  });
+  const projectPath = rewriteCodexToml(projectCodexConfigPathFor(opts.projectDir), (obj) => {
+    delete obj.openai_base_url;
+    obj.model = 'gpt-5.5';
+  });
+  return { globalPath, projectPath };
+}
+
+
 /**
  * Persist an OpenAI API key to ~/.codex/auth.json (Codex's native credential store).
  * Also sets OPENAI_API_KEY in process.env for the current init process so that

package/docker/entrypoint.sh

@@ -124,8 +124,10 @@ upsert_env "CODEX_BYPASS_PERMISSIONS" "${CODEX_BYPASS_PERMISSIONS:-true}"
 upsert_env "OPENAI_API_KEY" "${OPENAI_API_KEY:-}"
 upsert_env "CODEX_API_KEY" "${CODEX_API_KEY:-}"
 
-# Save current PATH so PM2 services can find claude and node
-upsert_env "SYSTEM_PATH" "${PATH}"
+# D54: SYSTEM_PATH is owned exclusively by baize init (saveSystemPath writes
+# the complete known-good bin PATH). entrypoint no longer captures the
+# container PATH here — ecosystem.config.cjs carries an explicit
+# ~/.npm-global/bin fallback, so a polluted shell can never degrade services.
 
 # ── Graceful shutdown ─────────────────────────────────────────────────────────
 # docker stop sends SIGTERM to PID 1 (this script). Clean up tmux + PM2.