@bitkyc08/opencodex 0.2.1 → 1.9.0

package/src/providers/registry.ts

@@ -0,0 +1,140 @@
+import type { OcxProviderConfig } from "../types";
+
+export type ProviderAuthKind = "forward" | "oauth" | "key" | "local";
+export type MetadataModelIdNormalize = "case-insensitive";
+
+export interface ProviderRegistryEntry {
+  id: string;
+  label: string;
+  adapter: string;
+  baseUrl: string;
+  authKind: ProviderAuthKind;
+  featured?: boolean;
+  note?: string;
+  dashboardUrl?: string;
+  defaultModel?: string;
+  models?: string[];
+  noVisionModels?: string[];
+  noReasoningModels?: string[];
+  oauthId?: string;
+  jawcodeBundle?: string;
+  extraMetadataAliases?: string[];
+  metadataModelIdNormalize?: MetadataModelIdNormalize;
+}
+
+export type ProviderConfigSeed = Pick<
+  OcxProviderConfig,
+  "adapter" | "baseUrl" | "authMode" | "defaultModel" | "models" | "noVisionModels" | "noReasoningModels"
+>;
+
+export const PROVIDER_REGISTRY: readonly ProviderRegistryEntry[] = [
+  {
+    id: "openai",
+    label: "OpenAI (ChatGPT login)",
+    adapter: "openai-responses",
+    baseUrl: "https://chatgpt.com/backend-api/codex",
+    authKind: "forward",
+    featured: true,
+    note: "Uses your codex login — no API key",
+  },
+  {
+    id: "xai",
+    label: "xAI Grok",
+    adapter: "openai-chat",
+    baseUrl: "https://api.x.ai/v1",
+    authKind: "oauth",
+    featured: true,
+    oauthId: "xai",
+    jawcodeBundle: "xai",
+    note: "Log in with your Grok account",
+    models: ["grok-4.3", "grok-4.20-0309-reasoning", "grok-4.20-0309-non-reasoning", "grok-build-0.1", "grok-composer-2.5-fast"],
+    defaultModel: "grok-4.3",
+    noReasoningModels: ["grok-build-0.1", "grok-composer-2.5-fast"],
+    noVisionModels: ["grok-build-0.1", "grok-composer-2.5-fast"],
+  },
+  {
+    id: "anthropic",
+    label: "Anthropic Claude",
+    adapter: "anthropic",
+    baseUrl: "https://api.anthropic.com",
+    authKind: "oauth",
+    featured: true,
+    oauthId: "anthropic",
+    jawcodeBundle: "anthropic",
+    note: "Log in with your Claude account",
+    models: ["claude-opus-4-8", "claude-opus-4-7", "claude-opus-4-6", "claude-sonnet-4-6", "claude-haiku-4-5"],
+    defaultModel: "claude-sonnet-4-6",
+  },
+  {
+    id: "kimi",
+    label: "Kimi",
+    adapter: "openai-chat",
+    baseUrl: "https://api.kimi.com/coding/v1",
+    authKind: "oauth",
+    featured: true,
+    oauthId: "kimi",
+    jawcodeBundle: "moonshot",
+    note: "Log in with your Kimi account",
+    models: ["kimi-k2.6", "kimi-k2.5"],
+    defaultModel: "kimi-k2.6",
+  },
+  { id: "openai-apikey", label: "OpenAI (API key)", adapter: "openai-responses", baseUrl: "https://api.openai.com/v1", authKind: "key", featured: true, dashboardUrl: "https://platform.openai.com/api-keys", defaultModel: "gpt-5.5" },
+  { id: "opencode-go", label: "opencode go", adapter: "openai-chat", baseUrl: "https://opencode.ai/zen/go/v1", authKind: "key", featured: true, dashboardUrl: "https://opencode.ai/auth", defaultModel: "kimi-k2.6", jawcodeBundle: "opencode-go", note: "GLM, DeepSeek, Kimi, Qwen, MiMo…" },
+  { id: "openrouter", label: "OpenRouter", adapter: "openai-chat", baseUrl: "https://openrouter.ai/api/v1", authKind: "key", featured: true, dashboardUrl: "https://openrouter.ai/keys", jawcodeBundle: "openrouter" },
+  { id: "groq", label: "Groq", adapter: "openai-chat", baseUrl: "https://api.groq.com/openai/v1", authKind: "key", featured: true, dashboardUrl: "https://console.groq.com/keys" },
+  { id: "google", label: "Google Gemini", adapter: "google", baseUrl: "https://generativelanguage.googleapis.com", authKind: "key", featured: true, dashboardUrl: "https://aistudio.google.com/apikey", defaultModel: "gemini-3-pro", jawcodeBundle: "google", extraMetadataAliases: ["gemini"] },
+  { id: "azure-openai", label: "Azure OpenAI", adapter: "azure-openai", baseUrl: "https://{resource}.openai.azure.com/openai/deployments/{deployment}", authKind: "key", featured: true, dashboardUrl: "https://portal.azure.com" },
+  { id: "ollama", label: "Ollama (local)", adapter: "openai-chat", baseUrl: "http://localhost:11434/v1", authKind: "local", featured: true, note: "Local — key usually blank" },
+  { id: "vllm", label: "vLLM (local)", adapter: "openai-chat", baseUrl: "http://localhost:8000/v1", authKind: "local", featured: true, note: "Local — key usually blank" },
+  { id: "lm-studio", label: "LM Studio (local)", adapter: "openai-chat", baseUrl: "http://localhost:1234/v1", authKind: "local", featured: true, note: "Local — no key needed" },
+  { id: "deepseek", label: "DeepSeek", baseUrl: "https://api.deepseek.com", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://platform.deepseek.com/api_keys", models: ["deepseek-chat", "deepseek-reasoner"], defaultModel: "deepseek-chat" },
+  { id: "cerebras", label: "Cerebras", baseUrl: "https://api.cerebras.ai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://cloud.cerebras.ai/platform/apikeys", defaultModel: "llama-3.3-70b" },
+  { id: "together", label: "Together", baseUrl: "https://api.together.xyz/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://api.together.xyz/settings/api-keys" },
+  { id: "fireworks", label: "Fireworks", baseUrl: "https://api.fireworks.ai/inference/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://fireworks.ai/account/api-keys" },
+  { id: "firepass", label: "Fire Pass (Fireworks Kimi)", baseUrl: "https://api.fireworks.ai/inference/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://fireworks.ai/account/api-keys" },
+  { id: "moonshot", label: "Moonshot (Kimi API)", baseUrl: "https://api.moonshot.ai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://platform.moonshot.ai/console/api-keys", defaultModel: "kimi-k2-0905-preview", jawcodeBundle: "moonshot" },
+  { id: "huggingface", label: "Hugging Face", baseUrl: "https://router.huggingface.co/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://huggingface.co/settings/tokens" },
+  { id: "nvidia", label: "NVIDIA NIM", baseUrl: "https://integrate.api.nvidia.com/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://build.nvidia.com" },
+  { id: "venice", label: "Venice", baseUrl: "https://api.venice.ai/api/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://venice.ai/settings/api" },
+  { id: "zai", label: "Z.AI (GLM Coding)", baseUrl: "https://api.z.ai/api/coding/paas/v4", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://z.ai/manage-apikey/apikey-list", defaultModel: "glm-4.6" },
+  { id: "nanogpt", label: "NanoGPT", baseUrl: "https://nano-gpt.com/api/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://nano-gpt.com/api" },
+  { id: "synthetic", label: "Synthetic", baseUrl: "https://api.synthetic.new/openai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://synthetic.new" },
+  { id: "qwen-portal", label: "Qwen Portal", baseUrl: "https://portal.qwen.ai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://portal.qwen.ai" },
+  { id: "qianfan", label: "Qianfan (Baidu)", baseUrl: "https://qianfan.baidubce.com/v2", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://console.bce.baidu.com/iam/#/iam/apikey/list" },
+  { id: "alibaba", label: "Alibaba Coding Plan", baseUrl: "https://coding-intl.dashscope.aliyuncs.com/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://dashscope.console.aliyun.com/apiKey" },
+  { id: "parallel", label: "Parallel", baseUrl: "https://platform.parallel.ai", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://platform.parallel.ai" },
+  { id: "zenmux", label: "ZenMux", baseUrl: "https://zenmux.ai/api/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://zenmux.ai" },
+  { id: "litellm", label: "LiteLLM (self-hosted)", baseUrl: "http://localhost:4000/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://docs.litellm.ai/docs/proxy/quick_start" },
+  {
+    id: "ollama-cloud",
+    label: "Ollama Cloud",
+    baseUrl: "https://ollama.com/v1",
+    adapter: "openai-chat",
+    authKind: "key",
+    dashboardUrl: "https://ollama.com/settings/keys",
+    models: ["glm-5.2", "deepseek-v4-pro", "qwen3-coder", "gpt-oss:120b", "kimi-k2.6", "minimax-m3", "qwen3.5", "gemma4"],
+    defaultModel: "glm-5.2",
+    noVisionModels: [
+      "glm-5.2", "glm-5.1", "glm-5", "glm-4.7",
+      "minimax-m2.7", "minimax-m2.5", "minimax-m2.1",
+      "nemotron-3-ultra", "nemotron-3-super",
+      "deepseek-v4-pro", "deepseek-v4-flash",
+      "gpt-oss", "qwen3-coder",
+    ],
+  },
+  { id: "mistral", label: "Mistral", baseUrl: "https://api.mistral.ai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://console.mistral.ai/api-keys", defaultModel: "codestral-latest" },
+  { id: "minimax", label: "MiniMax", baseUrl: "https://api.minimax.io/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://platform.minimax.io", defaultModel: "MiniMax-M2.5", jawcodeBundle: "minimax", metadataModelIdNormalize: "case-insensitive" },
+  { id: "minimax-cn", label: "MiniMax (CN)", baseUrl: "https://api.minimaxi.com/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://platform.minimaxi.com", defaultModel: "MiniMax-M2.5", jawcodeBundle: "minimax", metadataModelIdNormalize: "case-insensitive" },
+  { id: "kimi-code", label: "Kimi (coding)", baseUrl: "https://api.kimi.com/coding/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://platform.moonshot.cn/console/api-keys", defaultModel: "kimi-k2.5" },
+  { id: "opencode-zen", label: "opencode zen", baseUrl: "https://opencode.ai/zen/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://opencode.ai/auth" },
+  { id: "vercel-ai-gateway", label: "Vercel AI Gateway", baseUrl: "https://ai-gateway.vercel.sh/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://vercel.com/dashboard" },
+  { id: "xiaomi", label: "Xiaomi MiMo", baseUrl: "https://api.xiaomimimo.com/anthropic", adapter: "anthropic", authKind: "key", dashboardUrl: "https://xiaomimimo.com", defaultModel: "mimo-v2.5-pro" },
+  { id: "kilo", label: "Kilo", baseUrl: "https://api.kilo.ai/api/gateway", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://kilo.ai" },
+  { id: "cloudflare-ai-gateway", label: "Cloudflare AI Gateway", baseUrl: "https://gateway.ai.cloudflare.com/v1/{account-id}/{gateway}/anthropic", adapter: "anthropic", authKind: "key", dashboardUrl: "https://dash.cloudflare.com/?to=/:account/ai/ai-gateway" },
+  { id: "github-copilot", label: "GitHub Copilot", baseUrl: "https://api.githubcopilot.com", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://github.com/settings/copilot" },
+  { id: "gitlab-duo", label: "GitLab Duo", baseUrl: "https://cloud.gitlab.com/ai/v1/proxy/openai/v1", adapter: "openai-chat", authKind: "key", dashboardUrl: "https://gitlab.com/-/user_settings/personal_access_tokens" },
+];
+
+export function getProviderRegistryEntry(id: string): ProviderRegistryEntry | undefined {
+  return PROVIDER_REGISTRY.find(entry => entry.id === id);
+}

package/src/responses/parser.ts

@@ -386,7 +386,12 @@ export function parseRequest(body: unknown): OcxParsedRequest {
   const structuredOutput = detectStructuredOutput(data.text);
 
   return {
-    modelId: data.model, context, stream: data.stream === true, options, _rawBody: body,
+    modelId: data.model,
+    ...(data.previous_response_id ? { previousResponseId: data.previous_response_id } : {}),
+    context,
+    stream: data.stream === true,
+    options,
+    _rawBody: body,
     ...(webSearch ? { _webSearch: webSearch } : {}),
     ...(structuredOutput ? { _structuredOutput: true } : {}),
   };

package/src/server.ts

@@ -6,7 +6,17 @@ import { createGoogleAdapter } from "./adapters/google";
 import { createOpenAIChatAdapter } from "./adapters/openai-chat";
 import { createResponsesPassthroughAdapter } from "./adapters/openai-responses";
 import { bridgeToResponsesSSE, buildResponseJSON, formatErrorResponse } from "./bridge";
-import { DEFAULT_SUBAGENT_MODELS, loadConfig, saveConfig } from "./config";
+import {
+  buildWarmupCompletionFrames,
+  buildWsErrorFrame,
+  selectForwardHeaders,
+  sendJsonFrame,
+  sendResponseToWebSocket,
+  sendTextFrame,
+  type WsData,
+} from "./ws-bridge";
+import type { ServerWebSocket } from "bun";
+import { DEFAULT_SUBAGENT_MODELS, loadConfig, saveConfig, websocketsEnabled } from "./config";
 import { parseRequest } from "./responses/parser";
 import { routeModel } from "./router";
 import { namespacedToolName } from "./types";
@@ -19,6 +29,7 @@ import { buildWebSearchTool, planWebSearch, runWithWebSearch } from "./web-searc
 import { describeImagesInPlace, planVisionSidecar } from "./vision";
 import { removeCredential } from "./oauth/store";
 import { enrichProviderFromCatalog, listKeyLoginProviders } from "./oauth/key-providers";
+import { deriveProviderPresets } from "./providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "./types";
 
 const VERSION = "0.0.1";
@@ -67,7 +78,7 @@ function serveGuiFile(pathname: string): Response | null {
   });
 }
 
-function resolveAdapter(providerConfig: OcxProviderConfig) {
+export function resolveAdapter(providerConfig: OcxProviderConfig) {
   switch (providerConfig.adapter) {
     case "openai-chat":
       return createOpenAIChatAdapter(providerConfig);
@@ -77,6 +88,7 @@ function resolveAdapter(providerConfig: OcxProviderConfig) {
       return createResponsesPassthroughAdapter(providerConfig);
     case "google":
       return createGoogleAdapter(providerConfig);
+    case "azure":
     case "azure-openai":
       return createAzureAdapter(providerConfig);
     default:
@@ -84,7 +96,12 @@ function resolveAdapter(providerConfig: OcxProviderConfig) {
   }
 }
 
-async function handleResponses(req: Request, config: OcxConfig, logCtx: { model: string; provider: string }): Promise<Response> {
+async function handleResponses(
+  req: Request,
+  config: OcxConfig,
+  logCtx: { model: string; provider: string },
+  options: { forceEmptyResponseId?: boolean; abortSignal?: AbortSignal } = {},
+): Promise<Response> {
   let body: unknown;
   try {
     body = await req.json();
@@ -133,24 +150,30 @@ async function handleResponses(req: Request, config: OcxConfig, logCtx: { model:
   // with text BEFORE the main call, so the text-only model can reason about it.
   const visionPlan = planVisionSidecar(config, route.provider, route.modelId, parsed, req.headers);
   if (visionPlan) {
-    await describeImagesInPlace(parsed, visionPlan.forwardProvider, req.headers, visionPlan.settings);
+    await describeImagesInPlace(parsed, visionPlan.forwardProvider, req.headers, visionPlan.settings, options.abortSignal);
   }
 
   const adapter = resolveAdapter(route.provider);
 
   if ("passthrough" in adapter && adapter.passthrough) {
     const request = adapter.buildRequest(parsed, { headers: req.headers });
+    // Abort the upstream if the client disconnects. A directly-relayed body does not propagate the
+    // consumer's cancel to a signalled fetch, so we pass the signal and relay through relayWithAbort,
+    // whose cancel() aborts the upstream — preventing leaked connections (RC2, passthrough path).
+    const upstream = new AbortController();
+    linkAbortSignal(upstream, options.abortSignal);
     let upstreamResponse: Response;
     try {
       upstreamResponse = await fetch(request.url, {
         method: request.method,
         headers: request.headers,
         body: request.body,
+        signal: upstream.signal,
       });
     } catch (err) {
       return formatErrorResponse(502, "upstream_error", `Provider unreachable: ${err instanceof Error ? err.message : String(err)}`);
     }
-    return new Response(upstreamResponse.body, {
+    return new Response(relayWithAbort(upstreamResponse.body, upstream), {
       status: upstreamResponse.status,
       headers: sanitizePassthroughHeaders(upstreamResponse.headers),
     });
@@ -169,17 +192,23 @@ async function handleResponses(req: Request, config: OcxConfig, logCtx: { model:
       incomingHeaders: req.headers,
       settings: wsPlan.settings,
       maxSearches: wsPlan.maxSearches,
+      abortSignal: options.abortSignal,
     });
   }
 
   const request = adapter.buildRequest(parsed, { headers: req.headers });
 
+  // Abort the upstream fetch if the client (Codex) disconnects mid-stream, so a cancelled turn does
+  // not leak the upstream connection or keep draining tokens. The bridge's cancel() fires upstream.abort() (RC2).
+  const upstream = new AbortController();
+  linkAbortSignal(upstream, options.abortSignal);
   let upstreamResponse: Response;
   try {
     upstreamResponse = await fetch(request.url, {
       method: request.method,
       headers: request.headers,
       body: request.body,
+      signal: upstream.signal,
     });
   } catch (err) {
     return formatErrorResponse(502, "upstream_error", `Provider unreachable: ${err instanceof Error ? err.message : String(err)}`);
@@ -202,7 +231,16 @@ async function handleResponses(req: Request, config: OcxConfig, logCtx: { model:
       if (t.freeform) freeformToolNames.add(t.name);
       if (t.toolSearch) toolSearchToolNames.add(t.name);
     }
-    const sseStream = bridgeToResponsesSSE(eventStream, parsed.modelId, toolNsMap, freeformToolNames, toolSearchToolNames);
+    const sseStream = bridgeToResponsesSSE(
+      eventStream,
+      parsed.modelId,
+      toolNsMap,
+      freeformToolNames,
+      toolSearchToolNames,
+      () => upstream.abort(),
+      2_000,
+      options.forceEmptyResponseId ? { responseId: "" } : undefined,
+    );
     return new Response(sseStream, {
       headers: {
         "Content-Type": "text/event-stream",
@@ -224,6 +262,15 @@ async function handleResponses(req: Request, config: OcxConfig, logCtx: { model:
   return formatErrorResponse(500, "internal_error", "Non-streaming not supported by this adapter");
 }
 
+export function linkAbortSignal(upstream: AbortController, signal?: AbortSignal): void {
+  if (!signal) return;
+  if (signal.aborted) {
+    upstream.abort(signal.reason);
+    return;
+  }
+  signal.addEventListener("abort", () => upstream.abort(signal.reason), { once: true });
+}
+
 const requestLog: { timestamp: number; model: string; provider: string; status: number; durationMs: number }[] = [];
 const MAX_LOG_SIZE = 200;
 
@@ -232,6 +279,39 @@ function addRequestLog(entry: typeof requestLog[number]) {
   if (requestLog.length > MAX_LOG_SIZE) requestLog.shift();
 }
 
+/**
+ * Relay an upstream body verbatim while wiring client-cancel -> upstream.abort(). A body returned
+ * directly from fetch does NOT propagate the consumer's cancel to a signalled fetch, so a client
+ * disconnect would leak the upstream connection. Pumping through this stream (whose cancel() aborts
+ * the upstream) fixes the leak with zero byte changes — passthrough fidelity is preserved (RC2).
+ */
+export function relayWithAbort(
+  body: ReadableStream<Uint8Array> | null,
+  upstream: AbortController,
+): ReadableStream<Uint8Array> | null {
+  if (!body) return null;
+  const reader = body.getReader();
+  return new ReadableStream<Uint8Array>({
+    async pull(controller) {
+      try {
+        const { done, value } = await reader.read();
+        if (done) {
+          controller.close();
+          return;
+        }
+        controller.enqueue(value);
+      } catch (err) {
+        try { controller.error(err); } catch { /* already torn down */ }
+      }
+    },
+    cancel(reason) {
+      // Client disconnected: abort the upstream fetch and release the reader so we do not leak it.
+      upstream.abort(reason);
+      reader.cancel(reason).catch(() => {});
+    },
+  });
+}
+
 /**
  * Bun's fetch auto-decompresses the response body but leaves the upstream `content-encoding`
  * (and a now-stale `content-length`) on `response.headers`. Relaying those with the already-decoded
@@ -239,7 +319,18 @@ function addRequestLog(entry: typeof requestLog[number]) {
  * Drop encoding + hop-by-hop headers; relay everything else (content-type, etc.) verbatim.
  */
 export function sanitizePassthroughHeaders(upstream: Headers): Headers {
-  const DROP = new Set(["content-encoding", "content-length", "transfer-encoding", "connection", "keep-alive"]);
+  const DROP = new Set([
+    "content-encoding",
+    "content-length",
+    "transfer-encoding",
+    "connection",
+    "keep-alive",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "upgrade",
+  ]);
   const out = new Headers();
   upstream.forEach((value, key) => {
     if (!DROP.has(key.toLowerCase())) out.set(key, value);
@@ -361,6 +452,12 @@ async function handleManagementAPI(req: Request, url: URL, config: OcxConfig): P
     return jsonResponse({ providers: listKeyLoginProviders() });
   }
 
+  // Complete GUI picker presets, derived from the canonical provider registry. The GUI is a
+  // standalone Vite package, so it consumes this runtime view instead of importing repo-root src.
+  if (url.pathname === "/api/provider-presets" && req.method === "GET") {
+    return jsonResponse({ providers: deriveProviderPresets() });
+  }
+
   // Subagent model picker: which ≤5 routed models Codex's spawn_agent advertises (it shows the
   // first 5 routed catalog entries). PUT reorders the injected catalog so the chosen ones lead.
   if (url.pathname === "/api/subagent-models" && req.method === "GET") {
@@ -452,7 +549,7 @@ export function startServer(port?: number) {
   }
   const listenPort = port ?? config.port ?? 10100;
 
-  const server = Bun.serve({
+  const server = Bun.serve<WsData>({
     port: listenPort,
     async fetch(req) {
       const url = new URL(req.url);
@@ -461,6 +558,13 @@ export function startServer(port?: number) {
         return new Response(null, { status: 204, headers: corsHeaders() });
       }
 
+      // Responses WebSocket (phase 120.2). Codex upgrades the same /v1/responses path; auth is
+      // handshake-time only, so capture inbound headers and thread them into the pipeline.
+      if (url.pathname === "/v1/responses" && req.headers.get("upgrade")?.toLowerCase() === "websocket") {
+        if (server.upgrade(req, { data: { headers: selectForwardHeaders(req.headers) } })) return undefined as unknown as Response;
+        return formatErrorResponse(426, "upgrade_required", "WebSocket upgrade failed");
+      }
+
       if (url.pathname === "/healthz" && req.method === "GET") {
         return jsonResponse({ status: "ok", version: VERSION, uptime: process.uptime() });
       }
@@ -481,7 +585,7 @@ export function startServer(port?: number) {
           // Codex client → Codex catalog shape: native gpt + namespaced routed models,
           // cloned from a native template so required fields (base_instructions, etc.) are present.
           // Pass the subagent picks so featured models lead by priority (matches the on-disk file).
-          return jsonResponse({ models: buildCatalogEntries(loadCatalogTemplate(), nativeSlugs, goOrdered, config.subagentModels) });
+          return jsonResponse({ models: buildCatalogEntries(loadCatalogTemplate(), nativeSlugs, goOrdered, config.subagentModels, websocketsEnabled(config)) });
         }
         // OpenAI list shape: native gpt bare + routed models namespaced "<provider>/<id>"
         const data = [
@@ -510,6 +614,75 @@ export function startServer(port?: number) {
 
       return formatErrorResponse(404, "not_found", `Unknown endpoint: ${req.method} ${url.pathname}`);
     },
+    websocket: {
+      // Responses WebSocket data plane (phase 120.2). Re-frames the same SSE pipeline onto the
+      // socket: parse response.create → run handleResponses unchanged → pump its SSE body as WS
+      // Text frames. response.processed is a no-op ack. close() aborts the upstream (RC2 parity).
+      message(ws: ServerWebSocket<WsData>, raw: string | Buffer) {
+        let frame: Record<string, unknown>;
+        try {
+          frame = JSON.parse(typeof raw === "string" ? raw : raw.toString()) as Record<string, unknown>;
+        } catch {
+          return; // text-only contract; ignore unparseable frames
+        }
+        if (frame.type === "response.processed") return; // ack — no-op
+        if (frame.type !== "response.create") return;
+
+        ws.data.cancel?.();
+        const turnId = (ws.data.turnId ?? 0) + 1;
+        ws.data.turnId = turnId;
+        const isCurrent = () => ws.data.turnId === turnId;
+        const turnAbort = new AbortController();
+        const cancelTurn = () => {
+          turnAbort.abort("websocket turn superseded or closed");
+        };
+        ws.data.cancel = cancelTurn;
+
+        if (frame.generate === false) {
+          for (const payload of buildWarmupCompletionFrames(frame)) {
+            if (!isCurrent()) return;
+            sendTextFrame(ws, payload);
+          }
+          if (ws.data.cancel === cancelTurn) ws.data.cancel = undefined;
+          return;
+        }
+
+        const payload: Record<string, unknown> = { ...frame };
+        delete payload.type;
+        void (async () => {
+          const logCtx = { model: "unknown", provider: "unknown" };
+          const fwd = new Headers({ "content-type": "application/json" });
+          ws.data.headers?.forEach((value, key) => fwd.set(key, value));
+          const req = new Request("http://localhost/v1/responses", {
+            method: "POST",
+            headers: fwd,
+            body: JSON.stringify({ ...payload, stream: true }),
+          });
+          try {
+            const response = await handleResponses(req, config, logCtx, {
+              forceEmptyResponseId: true,
+              abortSignal: turnAbort.signal,
+            });
+            await sendResponseToWebSocket(ws, response, isCurrent);
+          } catch (err) {
+            if (!isCurrent()) return;
+            try {
+              sendJsonFrame(ws, buildWsErrorFrame(502, {
+                type: "proxy_error",
+                message: err instanceof Error ? err.message : String(err),
+              }));
+            } catch {
+              /* socket already gone or send dropped */
+            }
+          } finally {
+            if (ws.data.cancel === cancelTurn) ws.data.cancel = undefined;
+          }
+        })();
+      },
+      close(ws: ServerWebSocket<WsData>) {
+        ws.data.cancel?.(); // RC2: abort the upstream when the client disconnects
+      },
+    },
   });
 
   console.log(`🚀 opencodex proxy running on http://localhost:${listenPort}`);

package/src/service.ts

@@ -28,10 +28,25 @@ function logPath(): string {
   return join(getConfigDir(), "service.log");
 }
 
+function windowsServiceScriptPath(): string {
+  return join(getConfigDir(), "opencodex-service.cmd");
+}
+
+function plistString(value: string): string {
+  return value
+    .replace(/&/g, "&")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&apos;");
+}
+
 export function buildPlist(): string {
   const { bun, cli } = cliEntry();
   const log = logPath();
   const path = process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin";
+  const codexHome = process.env.CODEX_HOME?.trim();
+  const codexHomeXml = codexHome ? `    <key>CODEX_HOME</key><string>${plistString(codexHome)}</string>` : "";
   return `<?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <plist version="1.0">
@@ -39,8 +54,8 @@ export function buildPlist(): string {
   <key>Label</key><string>${LABEL}</string>
   <key>ProgramArguments</key>
   <array>
-    <string>${bun}</string>
-    <string>${cli}</string>
+    <string>${plistString(bun)}</string>
+    <string>${plistString(cli)}</string>
     <string>start</string>
   </array>
   <key>RunAtLoad</key><true/>
@@ -48,19 +63,57 @@ export function buildPlist(): string {
   <key>EnvironmentVariables</key>
   <dict>
     <key>OCX_SERVICE</key><string>1</string>
-    <key>PATH</key><string>${path}</string>
-  </dict>
-  <key>StandardOutPath</key><string>${log}</string>
-  <key>StandardErrorPath</key><string>${log}</string>
+    <key>PATH</key><string>${plistString(path)}</string>
+${codexHomeXml ? `${codexHomeXml}\n` : ""}  </dict>
+  <key>StandardOutPath</key><string>${plistString(log)}</string>
+  <key>StandardErrorPath</key><string>${plistString(log)}</string>
 </dict>
 </plist>
 `;
 }
 
+function systemdQuote(value: string): string {
+  return `"${value
+    .replace(/\\/g, "\\\\")
+    .replace(/"/g, "\\\"")
+    .replace(/%/g, "%%")
+    .replace(/\n/g, "\\n")}"`;
+}
+
+function systemdEnvironmentAssignment(name: string, value: string | undefined): string | null {
+  if (!value) return null;
+  return `Environment=${systemdQuote(`${name}=${value}`)}`;
+}
+
 function sh(cmd: string): string {
   return execSync(cmd, { encoding: "utf8", stdio: ["pipe", "pipe", "pipe"] }).trim();
 }
 
+function windowsBatchValue(value: string): string {
+  return value.replace(/%/g, "%%").replace(/[\r\n]/g, "");
+}
+
+function windowsBatchSet(name: string, value: string | undefined): string | null {
+  if (!value) return null;
+  return `set "${name}=${windowsBatchValue(value)}"`;
+}
+
+export function buildWindowsServiceScript(): string {
+  const { bun, cli } = cliEntry();
+  const path = process.env.PATH ?? "";
+  const lines = [
+    "@echo off",
+    "setlocal",
+    windowsBatchSet("OCX_SERVICE", "1"),
+    windowsBatchSet("PATH", path),
+    windowsBatchSet("CODEX_HOME", process.env.CODEX_HOME?.trim()),
+    `"${bun}" "${cli}" start`,
+    "set \"OCX_EXIT=%ERRORLEVEL%\"",
+    "endlocal & exit /b %OCX_EXIT%",
+  ].filter((line): line is string => Boolean(line));
+  return `${lines.join("\r\n")}\r\n`;
+}
+
 // ── macOS (launchd) ──
 function installLaunchd(): void {
   const dir = join(homedir(), "Library", "LaunchAgents");
@@ -82,14 +135,19 @@ function uninstallLaunchd(): void {
 
 // ── Windows (Task Scheduler) ──
 function installWindows(): void {
-  const { bun, cli } = cliEntry();
-  sh(`schtasks /create /tn ${TASK} /tr "\\"${bun}\\" \\"${cli}\\" start" /sc onlogon /rl highest /f`);
+  if (!existsSync(getConfigDir())) mkdirSync(getConfigDir(), { recursive: true });
+  const script = windowsServiceScriptPath();
+  writeFileSync(script, buildWindowsServiceScript(), "utf8");
+  sh(`schtasks /create /tn ${TASK} /tr "\\"${script}\\"" /sc onlogon /rl highest /f`);
   sh(`schtasks /run /tn ${TASK}`);
 }
 function startWindows(): void { sh(`schtasks /run /tn ${TASK}`); }
 function stopWindows(): void { try { sh(`schtasks /end /tn ${TASK}`); } catch { /* not running */ } }
 function statusWindows(): string { try { return sh(`schtasks /query /tn ${TASK}`); } catch { return ""; } }
-function uninstallWindows(): void { try { sh(`schtasks /delete /tn ${TASK} /f`); } catch { /* absent */ } }
+function uninstallWindows(): void {
+  try { sh(`schtasks /delete /tn ${TASK} /f`); } catch { /* absent */ }
+  if (existsSync(windowsServiceScriptPath())) unlinkSync(windowsServiceScriptPath());
+}
 
 // ── Linux (systemd user unit) ──
 function unitDir(): string {
@@ -104,6 +162,12 @@ export function buildUnit(): string {
   const { bun, cli } = cliEntry();
   const log = logPath();
   const path = process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin";
+  const codexHome = systemdEnvironmentAssignment("CODEX_HOME", process.env.CODEX_HOME?.trim());
+  const envLines = [
+    systemdEnvironmentAssignment("OCX_SERVICE", "1"),
+    systemdEnvironmentAssignment("PATH", path),
+    codexHome,
+  ].filter((line): line is string => Boolean(line)).join("\n");
   return `[Unit]
 Description=OpenCodex Proxy Server
 After=network-online.target
@@ -111,13 +175,12 @@ Wants=network-online.target
 
 [Service]
 Type=simple
-ExecStart=${bun} ${cli} start
+ExecStart=${systemdQuote(bun)} ${systemdQuote(cli)} start
 Restart=on-failure
 RestartSec=5
-Environment=OCX_SERVICE=1
-Environment=PATH=${path}
-StandardOutput=append:${log}
-StandardError=append:${log}
+${envLines}
+StandardOutput=${systemdQuote(`append:${log}`)}
+StandardError=${systemdQuote(`append:${log}`)}
 
 [Install]
 WantedBy=default.target