@bitkyc08/opencodex 0.1.0

package/src/cli.ts

@@ -0,0 +1,183 @@
+#!/usr/bin/env bun
+import { restoreNativeCodex } from "./codex-inject";
+import { loadConfig, readPid, removePid, writePid } from "./config";
+import { serviceCommand } from "./service";
+import { startServer } from "./server";
+import { maybeShowStarPrompt } from "./star-prompt";
+
+const args = process.argv.slice(2);
+const command = args[0];
+
+function printUsage() {
+  console.log(`opencodex (ocx) — Universal provider proxy for Codex
+
+Usage:
+  ocx init                    Interactive setup (provider + Codex config injection)
+  ocx start [--port <port>]   Start the proxy server (auto-syncs models to Codex)
+  ocx stop                    Stop the proxy AND restore native Codex (plain codex works again)
+  ocx restore                 Restore native Codex without stopping (alias: eject)
+  ocx service <sub>           Run as a background service (install|start|stop|status|uninstall)
+  ocx sync                    Fetch models from providers and inject into Codex config
+  ocx status                  Check proxy server status
+  ocx login <provider>        OAuth login (xai) — opens browser, stores token in ~/.opencodex/auth.json
+  ocx logout <provider>       Remove a stored OAuth login
+  ocx update                  Update opencodex to the latest published version
+  ocx help                    Show this help message
+
+Examples:
+  ocx init                    Set up provider and inject into Codex
+  ocx start                   Start on default port (10100)
+  ocx start --port 8080       Start on custom port
+  ocx sync                    Sync available models to Codex`);
+}
+
+async function syncModelsToCodex(port?: number) {
+  const config = loadConfig();
+  const p = port ?? config.port ?? 10100;
+  const { injectCodexConfig } = await import("./codex-inject");
+  const result = await injectCodexConfig(p, config);
+  try {
+    const { syncCatalogModels } = await import("./codex-catalog");
+    const cat = await syncCatalogModels(config);
+    if (cat.added > 0) console.log(`   + ${cat.added} models appended to Codex catalog (${cat.path})`);
+  } catch (e) {
+    console.error("catalog sync skipped:", e instanceof Error ? e.message : String(e));
+  }
+  console.log(result.message);
+  return result;
+}
+
+function handleStart() {
+  const existingPid = readPid();
+  if (existingPid) {
+    console.error(`⚠️  Proxy already running (PID ${existingPid}). Use 'ocx stop' first.`);
+    process.exit(1);
+  }
+
+  let port: number | undefined;
+  const portIdx = args.indexOf("--port");
+  if (portIdx !== -1 && args[portIdx + 1]) {
+    port = parseInt(args[portIdx + 1], 10);
+    if (isNaN(port)) {
+      console.error("Invalid port number");
+      process.exit(1);
+    }
+  }
+
+  const server = startServer(port);
+  writePid(process.pid);
+
+  void maybeShowStarPrompt(); // once-only [Y/n] GitHub-star prompt on first interactive start
+  syncModelsToCodex(port).catch(() => {});
+
+  const shutdown = () => {
+    console.log("\n🛑 Shutting down opencodex proxy...");
+    server.stop(true);
+    removePid();
+    // Under the service (OCX_SERVICE), a restart re-injects on start — don't churn Codex config.
+    // `ocx service stop/uninstall` restore explicitly.
+    if (!process.env.OCX_SERVICE) { try { restoreNativeCodex(); } catch { /* best-effort restore */ } }
+    process.exit(0);
+  };
+
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+}
+
+function handleStop() {
+  const pid = readPid();
+  if (pid) {
+    try {
+      process.kill(pid, "SIGTERM");
+      console.log(`✅ Proxy (PID ${pid}) stopped.`);
+    } catch {
+      console.log("Proxy process not found.");
+    }
+    removePid();
+  } else {
+    console.log("No running proxy found.");
+  }
+  // Recover native Codex so plain `codex` keeps working while the proxy is down.
+  const r = restoreNativeCodex();
+  console.log(`↩️  ${r.message}`);
+}
+
+function handleStatus() {
+  const pid = readPid();
+  if (pid) {
+    console.log(`✅ Proxy running (PID ${pid})`);
+  } else {
+    console.log("❌ Proxy not running");
+  }
+}
+
+switch (command) {
+  case "init": {
+    const { runInit } = await import("./init");
+    await runInit();
+    break;
+  }
+  case "start":
+    handleStart();
+    break;
+  case "stop":
+    handleStop();
+    break;
+  case "restore":
+  case "eject": {
+    const r = restoreNativeCodex();
+    console.log(r.success ? `✅ ${r.message}` : `⚠️  ${r.message}`);
+    console.log("Plain `codex` now runs natively (no proxy).");
+    break;
+  }
+  case "status":
+    handleStatus();
+    break;
+  case "login": {
+    const { handleLogin } = await import("./oauth/login-cli");
+    await handleLogin(args[1]);
+    break;
+  }
+  case "logout": {
+    const { removeCredential } = await import("./oauth/store");
+    const name = (args[1] ?? "").trim().toLowerCase();
+    removeCredential(name);
+    console.log(`Logged out of ${name || "(none)"}.`);
+    break;
+  }
+  case "sync": {
+    await syncModelsToCodex();
+    break;
+  }
+  case "gui": {
+    const cfg = await import("./config");
+    const config = cfg.loadConfig();
+    const guiUrl = `http://localhost:${config.port}`;
+    if (!cfg.readPid()) {
+      console.log("Proxy not running. Starting...");
+      handleStart();
+      await new Promise(r => setTimeout(r, 1000));
+    }
+    console.log(`Opening ${guiUrl}`);
+    (await import("node:child_process")).exec(`open ${guiUrl}`);
+    break;
+  }
+  case "service":
+    serviceCommand(args[1]);
+    break;
+  case "update": {
+    const { runUpdate } = await import("./update");
+    runUpdate();
+    break;
+  }
+  case "help":
+  case "--help":
+  case "-h":
+  case undefined:
+    printUsage();
+    break;
+  default:
+    console.error(`Unknown command: ${command}`);
+    printUsage();
+    process.exit(1);
+}

package/src/codex-catalog.ts

@@ -0,0 +1,318 @@
+import { copyFileSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { atomicWriteFile } from "./config";
+import { DEFAULT_MODEL_CACHE_TTL_MS, getFreshCached, getStaleCached, setCached } from "./model-cache";
+import { buildModelsRequest, resolveModelsAuthToken } from "./oauth/index";
+import type { OcxConfig, OcxProviderConfig } from "./types";
+
+const CODEX_CONFIG_PATH = join(homedir(), ".codex", "config.toml");
+const DEFAULT_CATALOG_PATH = join(homedir(), ".codex", "opencodex-catalog.json");
+const OCX_DIR = join(homedir(), ".opencodex");
+const CATALOG_BACKUP_PATH = join(OCX_DIR, "catalog-backup.json");
+
+/**
+ * Native OpenAI / Codex models served via ChatGPT OAuth passthrough — FALLBACK only. The ChatGPT
+ * backend has no `GET /models`, so the real set is read from the live Codex catalog (the slugs Codex
+ * itself ships for the installed version) via nativeOpenAiSlugs(); this static list is used only when
+ * no catalog is present. Keep it to ids ChatGPT actually accepts — advertising a phantom (e.g. an
+ * old `gpt-5.2`/`gpt-5.3-codex` that a newer Codex dropped) makes it 400 "model is not supported".
+ */
+export const NATIVE_OPENAI_MODELS = [
+  "gpt-5.5", "gpt-5.4", "gpt-5.4-mini", "gpt-5.3-codex-spark",
+];
+
+/**
+ * The native (passthrough) OpenAI slugs to advertise — the LIVE Codex catalog's own bare slugs when
+ * available (always-latest: matches exactly what the installed Codex supports), else the static
+ * fallback above. Single source for the /v1/models native list and the subagent-default seed.
+ */
+export function nativeOpenAiSlugs(): string[] {
+  const live = listCatalogNativeSlugs();
+  return live.length > 0 ? live : NATIVE_OPENAI_MODELS;
+}
+
+export interface CatalogModel { id: string; provider: string; owned_by?: string; }
+type RawEntry = Record<string, unknown>;
+
+/** Resolve the `model_catalog_json` path from Codex config.toml, else the default. */
+export function readCodexCatalogPath(): string {
+  try {
+    if (existsSync(CODEX_CONFIG_PATH)) {
+      const toml = readFileSync(CODEX_CONFIG_PATH, "utf-8");
+      const m = toml.match(/^\s*model_catalog_json\s*=\s*"([^"]+)"/m);
+      if (m) return m[1];
+    }
+  } catch { /* ignore */ }
+  return DEFAULT_CATALOG_PATH;
+}
+
+function readCatalog(path: string): { models?: RawEntry[]; [k: string]: unknown } | null {
+  try {
+    if (!existsSync(path)) return null;
+    const cat = JSON.parse(readFileSync(path, "utf-8"));
+    return (cat && Array.isArray(cat.models)) ? cat : null;
+  } catch { return null; }
+}
+
+/**
+ * A full native entry from the on-disk catalog, used as a clone template so injected
+ * entries carry EVERY field Codex's strict parser requires (e.g. `base_instructions`).
+ * Returns a deep copy, or null if no catalog/native entry exists.
+ */
+export function loadCatalogTemplate(): RawEntry | null {
+  const cat = readCatalog(readCodexCatalogPath());
+  const native = cat?.models?.find(
+    m => typeof m.slug === "string" && !m.slug.includes("/") && "base_instructions" in m,
+  );
+  return native ? JSON.parse(JSON.stringify(native)) : null;
+}
+
+/**
+ * The reasoning ladder advertised for routed models in Codex's picker: low → medium → high → xhigh.
+ * This matches Codex's NATIVE catalog exactly — Codex's strict parser rejects an unknown effort like
+ * `max`, so it must not be advertised here. (Previously routed models were clamped down to
+ * low/medium/high, which dropped the `xhigh` that Codex does support.)
+ */
+const ROUTED_REASONING_LEVELS: { effort: string; description: string }[] = [
+  { effort: "low", description: "Fast responses with lighter reasoning" },
+  { effort: "medium", description: "Balances speed and reasoning depth" },
+  { effort: "high", description: "Greater reasoning depth for complex problems" },
+  { effort: "xhigh", description: "Extended reasoning for the hardest problems" },
+];
+
+function deriveEntry(template: RawEntry | null, slug: string, desc: string, priority: number): RawEntry {
+  if (template) {
+    const e = JSON.parse(JSON.stringify(template)) as RawEntry;
+    e.slug = slug;
+    e.display_name = slug;
+    e.description = desc;
+    e.priority = priority;
+    e.visibility = "list";
+    if ("upgrade" in e) e.upgrade = null;
+    delete e.availability_nux; // don't replay another model's "now available" NUX
+    // Routed (namespaced) models inherit the gpt template — correct its OpenAI/GPT identity
+    // and advertise the reasoning ladder Codex accepts (low/medium/high/xhigh).
+    if (slug.includes("/")) {
+      const modelName = slug.slice(slug.indexOf("/") + 1);
+      if (typeof e.base_instructions === "string") {
+        e.base_instructions = e.base_instructions.replace(
+          "You are Codex, a coding agent based on GPT-5.",
+          `You are a coding agent powered by the ${modelName} model, served through the opencodex proxy. Do not claim to be GPT-5 or made by OpenAI.`,
+        );
+      }
+      // Reuse the template's level objects where they exist (correct shape/fields), synthesize the rest.
+      const byEffort = new Map(
+        (Array.isArray(e.supported_reasoning_levels) ? e.supported_reasoning_levels : [])
+          .map((l: { effort?: string }) => [l.effort, l]),
+      );
+      e.supported_reasoning_levels = ROUTED_REASONING_LEVELS.map(l => byEffort.get(l.effort) ?? { ...l });
+      e.default_reasoning_level = "medium";
+    }
+    return e;
+  }
+  // Fallback when no template is available (best-effort; strict parser may need more).
+  return {
+    slug, display_name: slug, description: desc,
+    default_reasoning_level: "medium",
+    supported_reasoning_levels: ROUTED_REASONING_LEVELS.map(l => ({ ...l })),
+    shell_type: "shell_command", visibility: "list", supported_in_api: true,
+    priority, base_instructions: "You are a helpful coding assistant.",
+  };
+}
+
+/**
+ * Single source of truth for Codex-catalog-shaped entries, reused by both the on-disk
+ * catalog sync and the proxy `/v1/models?client_version` branch.
+ * Native gpt slugs stay bare; routed models are namespaced `<provider>/<model>`.
+ */
+export function buildCatalogEntries(template: RawEntry | null, gptSlugs: string[], goModels: CatalogModel[], featured?: string[]): RawEntry[] {
+  // Codex's models-manager sorts by `priority` ASC and advertises the first 5 picker-visible
+  // models to spawn_agent (sort_by_key(priority) + MAX_MODEL_OVERRIDES_IN_SPAWN_AGENT=5). Catalog
+  // ARRAY order is discarded — so "featuring" a model = giving it the LOWEST priority (0..N-1) so
+  // it sorts to the front. This works for native gpt slugs AND routed slugs alike.
+  const rank = new Map((featured ?? []).map((slug, i) => [slug, i] as const));
+  const out: RawEntry[] = [];
+  for (const slug of gptSlugs) {
+    const e = deriveEntry(template, slug, "OpenAI native model (Codex OAuth passthrough).", 9);
+    if (rank.has(slug)) e.priority = rank.get(slug)!;
+    out.push(e);
+  }
+  for (const m of goModels) {
+    const slug = `${m.provider}/${m.id}`;
+    const e = deriveEntry(template, slug, `Routed via opencodex → ${m.provider} (${m.owned_by ?? m.provider}).`, 5);
+    if (rank.has(slug)) e.priority = rank.get(slug)!;
+    out.push(e);
+  }
+  return out;
+}
+
+/** Bare picker-visible native slugs in the live Codex catalog (drives the subagent picker UI). */
+export function listCatalogNativeSlugs(): string[] {
+  const cat = readCatalog(readCodexCatalogPath());
+  return (cat?.models ?? [])
+    .filter(m => typeof m.slug === "string" && !(m.slug as string).includes("/") && m.visibility === "list")
+    .map(m => m.slug as string);
+}
+
+/**
+ * Native-model priority baseline read from the PRISTINE backup, so featuring stays reversible:
+ * a featured native gets its low rank, and un-featuring restores its original catalog priority
+ * (rather than the modified value left in the live catalog by a previous sync).
+ */
+function readNativeBaseline(): Map<string, number> {
+  const backup = readCatalog(CATALOG_BACKUP_PATH);
+  const out = new Map<string, number>();
+  for (const e of backup?.models ?? []) {
+    if (typeof e.slug === "string" && !e.slug.includes("/") && typeof e.priority === "number") {
+      out.set(e.slug, e.priority);
+    }
+  }
+  return out;
+}
+
+/**
+ * Fetch a provider's `/models` (openai-chat style) with a TTL cache + stale fallback. Skips
+ * forward-auth providers. Fresh cache → no network; live fetch → cache the merged result;
+ * fetch failure → last-known-good cache (so a provider blip doesn't drop its models), else the
+ * static config list. This is the per-provider half of jawcode's "always latest" resolver.
+ */
+async function fetchProviderModels(name: string, prov: OcxProviderConfig, ttlMs: number): Promise<CatalogModel[]> {
+  if (prov.authMode === "forward") return []; // ChatGPT backend has no /models
+  const apiKey = await resolveModelsAuthToken(name, prov);
+  if (prov.authMode === "oauth" && !apiKey) return []; // not logged in → skip
+  const fresh = getFreshCached(name, ttlMs);
+  if (fresh) return fresh; // dedups Codex's frequent /v1/models polling within the TTL
+  const configured: CatalogModel[] = (prov.models ?? []).map(id => ({ id, provider: name }));
+  const { url, headers } = buildModelsRequest(prov, apiKey);
+  try {
+    const res = await fetch(url, { headers, signal: AbortSignal.timeout(8000) });
+    if (!res.ok) return getStaleCached(name) ?? configured;
+    const json = await res.json() as { data?: { id: string; owned_by?: string }[] };
+    const live = (json.data ?? []).map(m => ({ id: m.id, provider: name, owned_by: m.owned_by }));
+    const liveIds = new Set(live.map(m => m.id));
+    // Merge explicit config additions (e.g. a model not in the provider's /models, like a new endpoint).
+    const merged = [...live, ...configured.filter(m => !liveIds.has(m.id))];
+    setCached(name, merged);
+    return merged;
+  } catch {
+    return getStaleCached(name) ?? configured;
+  }
+}
+
+/**
+ * Gather routed (non-forward) provider models across the config — the single source of truth for
+ * the live model list, used by both the on-disk catalog sync and the proxy's /api/* + /v1/models
+ * endpoints. Providers are fetched in parallel; the result is sorted (provider, then id) for a
+ * stable listing. TTL comes from `config.modelCacheTtlMs` (default 5 min).
+ */
+export async function gatherRoutedModels(config: OcxConfig): Promise<CatalogModel[]> {
+  const ttlMs = config.modelCacheTtlMs ?? DEFAULT_MODEL_CACHE_TTL_MS;
+  const lists = await Promise.all(
+    Object.entries(config.providers).map(([name, prov]) => fetchProviderModels(name, prov, ttlMs)),
+  );
+  const all = lists.flat();
+  all.sort((a, b) => (a.provider === b.provider ? a.id.localeCompare(b.id) : a.provider.localeCompare(b.provider)));
+  return all;
+}
+
+/**
+ * Reorder routed models so the configured subagent picks come FIRST (in the chosen order).
+ * Codex's spawn_agent advertises only the first 5 routed catalog entries, so putting the chosen
+ * ones first makes exactly them appear as overrides. Non-featured keep their relative order (stable
+ * sort) and stay visibility:"list" — so they remain in the main /model picker and callable by name.
+ */
+export function orderForSubagents(goModels: CatalogModel[], featured?: string[]): CatalogModel[] {
+  if (!featured || featured.length === 0) return goModels;
+  const rank = new Map(featured.map((id, i) => [id, i]));
+  const keyOf = (m: CatalogModel) => `${m.provider}/${m.id}`;
+  return [...goModels].sort((a, b) => {
+    const ra = rank.has(keyOf(a)) ? rank.get(keyOf(a))! : Number.MAX_SAFE_INTEGER;
+    const rb = rank.has(keyOf(b)) ? rank.get(keyOf(b))! : Number.MAX_SAFE_INTEGER;
+    return ra - rb;
+  });
+}
+
+/**
+ * Merge namespaced routed-model entries into the on-disk Codex catalog.
+ * Idempotent + non-destructive:
+ *  - native entries (slug without "/") are preserved untouched,
+ *  - previously injected entries (slug containing "/") are dropped and re-added,
+ *  - each injected entry is CLONED from a native template so it has all required fields,
+ *  - the catalog is backed up to ~/.opencodex/catalog-backup.json before writing.
+ * No-op if the catalog file does not exist.
+ */
+export async function syncCatalogModels(config: OcxConfig): Promise<{ added: number; path: string }> {
+  const catalogPath = readCodexCatalogPath();
+  const catalog = readCatalog(catalogPath);
+  if (!catalog) return { added: 0, path: catalogPath };
+
+  const template = (catalog.models ?? []).find(
+    m => typeof m.slug === "string" && !m.slug.includes("/") && "base_instructions" in m,
+  ) ?? null;
+
+  const goModels = await gatherRoutedModels(config);
+  if (goModels.length === 0) return { added: 0, path: catalogPath };
+
+  // Hide disabled models from Codex, then feature the chosen subagent models (native OR routed)
+  // by giving them the lowest priority — see buildCatalogEntries for why priority, not array order.
+  const disabled = new Set(config.disabledModels ?? []);
+  const enabledGo = goModels.filter(m => !disabled.has(`${m.provider}/${m.id}`));
+  const featured = config.subagentModels ?? [];
+  const rank = new Map(featured.map((slug, i) => [slug, i] as const));
+  const orderedGoModels = orderForSubagents(enabledGo, featured); // stable tie-break among equal priorities
+  const goEntries = buildCatalogEntries(template ? JSON.parse(JSON.stringify(template)) : null, [], orderedGoModels, featured);
+  // Keep genuine native entries (gpt-*, codex-*) with their real per-model fields, but drop bare
+  // duplicates of routed models (replaced by namespaced entries) + any prior "/" entries. Re-derive
+  // each native's priority from the pristine baseline so featuring a native is reversible.
+  const baseline = readNativeBaseline();
+  const goIds = new Set(enabledGo.map(m => m.id));
+  const native = (catalog.models ?? [])
+    .filter(m => typeof m.slug === "string" && !(m.slug as string).includes("/") && !goIds.has(m.slug as string))
+    .map(m => {
+      const slug = m.slug as string;
+      const priority = rank.has(slug) ? rank.get(slug)! : (baseline.get(slug) ?? (m.priority as number));
+      return { ...m, priority };
+    });
+  catalog.models = [...native, ...goEntries];
+
+  try {
+    if (!existsSync(OCX_DIR)) mkdirSync(OCX_DIR, { recursive: true });
+    // Once-only: preserve the PRISTINE pre-opencodex catalog as the native-priority baseline
+    // (later syncs would otherwise overwrite it with featured-modified priorities).
+    if (!existsSync(CATALOG_BACKUP_PATH)) copyFileSync(catalogPath, CATALOG_BACKUP_PATH);
+  } catch { /* backup best-effort */ }
+  atomicWriteFile(catalogPath, JSON.stringify(catalog, null, 2) + "\n");
+  return { added: goEntries.length, path: catalogPath };
+}
+
+/**
+ * Restore the Codex catalog to native-only by dropping every opencodex-injected
+ * "<provider>/<model>" entry (those route through the proxy). Native gpt/codex slugs (no "/")
+ * are kept, so plain `codex` works when the proxy is stopped. Idempotent; no-op if nothing injected.
+ */
+export function restoreCodexCatalog(): { removed: number; kept: number; path: string } {
+  const catalogPath = readCodexCatalogPath();
+  const catalog = readCatalog(catalogPath);
+  if (!catalog || !Array.isArray(catalog.models)) return { removed: 0, kept: 0, path: catalogPath };
+  const before = catalog.models.length;
+  const native = catalog.models.filter(m => !(typeof m.slug === "string" && m.slug.includes("/")));
+  const removed = before - native.length;
+  if (removed > 0) {
+    catalog.models = native;
+    atomicWriteFile(catalogPath, JSON.stringify(catalog, null, 2) + "\n");
+  }
+  return { removed, kept: native.length, path: catalogPath };
+}
+
+/**
+ * Delete Codex's models cache (~/.codex/models_cache.json) so the next turn re-fetches /v1/models.
+ * Codex caches the model list for 5 min (DEFAULT_MODEL_CACHE_TTL); invalidating makes catalog edits
+ * (enable/disable, subagent reorder) apply on the next turn instead of waiting for the TTL.
+ */
+export function invalidateCodexModelsCache(): void {
+  try {
+    const p = join(homedir(), ".codex", "models_cache.json");
+    if (existsSync(p)) unlinkSync(p);
+  } catch { /* best-effort */ }
+}

package/src/codex-inject.ts

@@ -0,0 +1,186 @@
+import { existsSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { atomicWriteFile } from "./config";
+import { restoreCodexCatalog } from "./codex-catalog";
+import type { OcxConfig } from "./types";
+
+const CODEX_HOME = join(homedir(), ".codex");
+const CODEX_CONFIG_PATH = join(CODEX_HOME, "config.toml");
+const CODEX_PROFILE_PATH = join(CODEX_HOME, "opencodex.config.toml");
+
+const OCX_SECTION_MARKER = "# Auto-injected by opencodex";
+
+/**
+ * The `[model_providers.opencodex]` TABLE only. A table is position-independent in TOML, so it is
+ * safe to append at EOF. The bare root key `model_provider = "opencodex"` is NOT included here —
+ * it must live at the document root (before any table header) and is set separately by
+ * setRootModelProvider(). Appending the bare key at EOF was the original bug: it nested under
+ * whatever `[table]` happened to be open last (e.g. `[plugins."chrome@openai-bundled"]`), so Codex
+ * never saw a global model_provider and silently fell back to the `openai` (ChatGPT) provider.
+ */
+function buildProviderTableBlock(port: number): string {
+  const lines = [
+    "",
+    OCX_SECTION_MARKER,
+    "[model_providers.opencodex]",
+    'name = "OpenCodex Proxy"',
+    `base_url = "http://localhost:${port}/v1"`,
+    'wire_api = "responses"',
+  ];
+  return lines.join("\n") + "\n";
+}
+
+/**
+ * Strip every existing `model_provider` line that we must not duplicate: any line set to
+ * "opencodex" (wherever it sits — including a previously mis-nested one under a table), plus any
+ * ROOT-level model_provider (before the first table) of any value, since we override the global.
+ * A `model_provider` legitimately inside a user table/profile with a non-opencodex value is left
+ * untouched.
+ */
+function stripExistingModelProvider(content: string): string {
+  const lines = content.split("\n");
+  const firstTable = lines.findIndex(l => /^\s*\[/.test(l));
+  const out: string[] = [];
+  lines.forEach((line, i) => {
+    if (/^\s*model_provider\s*=/.test(line)) {
+      const isOurs = /^\s*model_provider\s*=\s*"opencodex"\s*$/.test(line);
+      const isRoot = firstTable === -1 || i < firstTable;
+      if (isOurs || isRoot) return; // drop it
+    }
+    out.push(line);
+  });
+  return out.join("\n");
+}
+
+/**
+ * Insert `model_provider = "opencodex"` at the document ROOT — immediately before the first table
+ * header (TOML root keys must precede all tables). If there are no tables, append it to the root body.
+ */
+function setRootModelProvider(content: string): string {
+  const lines = content.split("\n");
+  const firstTable = lines.findIndex(l => /^\s*\[/.test(l));
+  const key = 'model_provider = "opencodex"';
+  if (firstTable === -1) {
+    return content.replace(/\n+$/, "") + "\n" + key + "\n";
+  }
+  let insertAt = firstTable;
+  while (insertAt > 0 && lines[insertAt - 1].trim() === "") insertAt--;
+  lines.splice(insertAt, 0, key);
+  return lines.join("\n");
+}
+
+function buildProfileFile(port: number): string {
+  return [
+    "# OpenCodex proxy profile — use with: codex --profile opencodex",
+    `# Routes all model requests through the opencodex proxy at localhost:${port}`,
+    'model_provider = "opencodex"',
+    "",
+  ].join("\n");
+}
+
+export async function injectCodexConfig(port: number, _config?: OcxConfig): Promise<{ success: boolean; message: string }> {
+  if (!existsSync(CODEX_CONFIG_PATH)) {
+    return { success: false, message: `Codex config not found at ${CODEX_CONFIG_PATH}. Is Codex installed?` };
+  }
+
+  let content = readFileSync(CODEX_CONFIG_PATH, "utf-8");
+
+  // Idempotent clean-up of any prior injection: drop the provider table (marker-based) and every
+  // stray/mis-nested model_provider line, so re-injecting can't duplicate keys or leave the buggy
+  // table-nested key behind.
+  if (content.includes("[model_providers.opencodex]")) {
+    content = removeOcxSection(content);
+  }
+  content = stripExistingModelProvider(content);
+
+  // 1) Root key BEFORE the first table header (must be a global, not nested under a table).
+  content = setRootModelProvider(content);
+  // 2) Provider table appended at EOF (position-independent).
+  content = content.trimEnd() + "\n" + buildProviderTableBlock(port);
+
+  writeFileSync(CODEX_CONFIG_PATH, content, "utf-8");
+  writeFileSync(CODEX_PROFILE_PATH, buildProfileFile(port), "utf-8");
+
+  return {
+    success: true,
+    message: `Injected opencodex as default provider into Codex config.\n` +
+      `  All models now route through opencodex proxy (like OpenRouter).\n` +
+      `  OpenAI models (gpt-5.5, etc.) are passed through to OpenAI.\n` +
+      `  Custom models route to their configured providers.\n` +
+      `  Fallback: codex --profile opencodex (same behavior)`,
+  };
+}
+
+function removeOcxSection(content: string): string {
+  const lines = content.split("\n");
+  const filtered: string[] = [];
+  let inOcxSection = false;
+  for (const line of lines) {
+    if (line.includes(OCX_SECTION_MARKER) || line.trim() === "[model_providers.opencodex]") {
+      inOcxSection = true;
+      continue;
+    }
+    if (inOcxSection) {
+      // End the injected section at the next table header that ISN'T our own — exact match so a
+      // user's "[model_providers.opencodex_backup]" (or similar) is preserved, not swallowed.
+      if (line.startsWith("[") && line.trim() !== "[model_providers.opencodex]") {
+        inOcxSection = false;
+        filtered.push(line);
+      }
+      continue;
+    }
+    filtered.push(line);
+  }
+  return filtered.join("\n").replace(/\n{3,}/g, "\n\n").trimEnd() + "\n";
+}
+
+/** Pure transform: strip the opencodex provider block + `model_provider = "opencodex"` lines. */
+export function stripOpencodexConfig(content: string): string {
+  let out = content;
+  if (out.includes("[model_providers.opencodex]")) {
+    out = removeOcxSection(out);
+  }
+  // Regex (not exact-string) removal so compact `model_provider="opencodex"` is stripped too —
+  // must match the detection regex above, or a detected line could survive un-removed.
+  out = out.split("\n").filter(l => !/^\s*model_provider\s*=\s*"opencodex"\s*$/.test(l)).join("\n");
+  return out.replace(/\n{3,}/g, "\n\n").trimEnd() + "\n";
+}
+
+function hasOpencodexRouting(content: string): boolean {
+  return content.includes("[model_providers.opencodex]") || /^\s*model_provider\s*=\s*"opencodex"/m.test(content);
+}
+
+export function removeCodexConfig(): { success: boolean; message: string } {
+  if (!existsSync(CODEX_CONFIG_PATH)) {
+    return { success: false, message: "Codex config not found." };
+  }
+  const content = readFileSync(CODEX_CONFIG_PATH, "utf-8");
+  const had = hasOpencodexRouting(content);
+  if (had) {
+    atomicWriteFile(CODEX_CONFIG_PATH, stripOpencodexConfig(content));
+  }
+  if (existsSync(CODEX_PROFILE_PATH)) unlinkSync(CODEX_PROFILE_PATH);
+  return {
+    success: true,
+    message: had ? "Removed opencodex routing from Codex config + profile." : "opencodex not present in Codex config.",
+  };
+}
+
+/**
+ * Recover native Codex: strip opencodex from config.toml AND drop proxy-routed catalog entries,
+ * so plain `codex` works when the proxy is stopped. Called by `ocx stop`, the proxy shutdown
+ * handler, and `ocx restore`. Idempotent + atomic.
+ */
+export function restoreNativeCodex(): { success: boolean; message: string } {
+  const cfg = removeCodexConfig();
+  const cat = restoreCodexCatalog();
+  const msg = cat.removed > 0
+    ? `${cfg.message} Catalog restored to ${cat.kept} native model(s) (dropped ${cat.removed} proxy-routed).`
+    : cfg.message;
+  return { success: cfg.success, message: msg };
+}
+
+export function getCodexConfigPath(): string {
+  return CODEX_CONFIG_PATH;
+}