@bitkyc08/opencodex 2.36.0 → 2.38.0

package/src/cli/launcher-context.ts

@@ -14,9 +14,19 @@ export const ANTHROPIC_PARENT_ENV_SLOTS = [
 ] as const;
 
 export type AnthropicParentEnvSlot = typeof ANTHROPIC_PARENT_ENV_SLOTS[number];
+export type CodexCliVersionManagerRootEnvSlot = typeof CODEX_CLI_VERSION_MANAGER_ROOT_ENV_SLOTS[number];
+
+type CodexCliVersionManagerRoots = Readonly<Partial<Record<CodexCliVersionManagerRootEnvSlot, string>>>;
 
 export type TrustedNodeLaunchContext = {
   anthropicEnvSlots: readonly AnthropicParentEnvSlot[];
+  codexCliInspectionEnv: Readonly<{
+    codexCliPath: string | null;
+    path: string | null;
+    pathExt: string | null;
+    managerRoots: CodexCliVersionManagerRoots | null;
+    configDir: string;
+  }> | null;
 };
 
 let trustedContext: TrustedNodeLaunchContext | null = null;
@@ -25,6 +35,21 @@ function isLaunchProof(value: string): boolean {
   return /^[A-Za-z0-9_-]{43}$/.test(value);
 }
 
+function parseVersionManagerRoots(value: unknown): CodexCliVersionManagerRoots | null | undefined {
+  // Missing means an older launcher. Preserve compatibility for unrelated
+  // commands, but updater inspection treats the incomplete snapshot as
+  // untrusted and fails closed.
+  if (value === undefined) return null;
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const allowed = new Set<string>(CODEX_CLI_VERSION_MANAGER_ROOT_ENV_SLOTS);
+  const entries = Object.entries(value);
+  if (entries.length > allowed.size || entries.some(([name, root]) =>
+    !allowed.has(name) || typeof root !== "string" || root.length === 0 || root.length > 32 * 1024)) {
+    return undefined;
+  }
+  return Object.freeze(Object.fromEntries(entries)) as CodexCliVersionManagerRoots;
+}
+
 /** Consume the internal proof before normal CLI argument parsing. */
 export function initializeNodeLauncherContext(
   argv: string[] = process.argv,
@@ -45,7 +70,7 @@ export function initializeNodeLauncherContext(
   delete env.OCX_PRE_BUN_ANTHROPIC_ENV;
   trustedContext = null;
 
-  if (proofArgs.length !== 1 || !raw || raw.length > 2048) return null;
+  if (proofArgs.length !== 1 || !raw || raw.length > 64 * 1024) return null;
   const proof = proofArgs[0]!;
   if (!isLaunchProof(proof)) return null;
 
@@ -54,6 +79,7 @@ export function initializeNodeLauncherContext(
       version?: unknown;
       proof?: unknown;
       anthropicEnvSlots?: unknown;
+      codexCliInspectionEnv?: unknown;
     };
     if (parsed.version !== 1 || parsed.proof !== proof || !Array.isArray(parsed.anthropicEnvSlots)) {
       return null;
@@ -65,7 +91,31 @@ export function initializeNodeLauncherContext(
     if (slots.length !== parsed.anthropicEnvSlots.length || new Set(slots).size !== slots.length) {
       return null;
     }
-    trustedContext = { anthropicEnvSlots: slots };
+    const inspection = parsed.codexCliInspectionEnv;
+    const managerRoots = inspection && typeof inspection === "object" && !Array.isArray(inspection)
+      ? parseVersionManagerRoots((inspection as Record<string, unknown>).managerRoots)
+      : null;
+    const codexCliInspectionEnv = inspection === null || inspection === undefined
+      ? null
+      : inspection && typeof inspection === "object" && !Array.isArray(inspection)
+        && ["codexCliPath", "path", "pathExt"].every(key => {
+          const value = (inspection as Record<string, unknown>)[key];
+          return value === null || typeof value === "string";
+        })
+        && typeof (inspection as Record<string, unknown>).configDir === "string"
+        && (inspection as Record<string, string>).configDir.length > 0
+        && (inspection as Record<string, string>).configDir.length <= 32 * 1024
+        && managerRoots !== undefined
+        ? Object.freeze({
+            codexCliPath: (inspection as Record<string, string | null>).codexCliPath ?? null,
+            path: (inspection as Record<string, string | null>).path ?? null,
+            pathExt: (inspection as Record<string, string | null>).pathExt ?? null,
+            managerRoots,
+            configDir: (inspection as Record<string, string>).configDir,
+          })
+        : undefined;
+    if (codexCliInspectionEnv === undefined) return null;
+    trustedContext = { anthropicEnvSlots: slots, codexCliInspectionEnv };
     return trustedContext;
   } catch {
     return null;
@@ -75,3 +125,4 @@ export function initializeNodeLauncherContext(
 export function trustedNodeLauncherContext(): TrustedNodeLaunchContext | null {
   return trustedContext;
 }
+import { CODEX_CLI_VERSION_MANAGER_ROOT_ENV_SLOTS } from "../update/codex-cli-update-launch-policy.mjs";

package/src/cli/opencode.ts

@@ -27,12 +27,17 @@ import {
   OPENCODE_PROVIDER_ID,
   buildOpencodeProviderBlockFromCatalog,
   opencodeGlobalConfigPath,
+  opencodeProviderBlocks,
+  opencodeProxyBaseUrl,
+  opencodeV2ProviderBlock,
 } from "../clients/config-export";
 import type {
   OpencodeCatalogModel,
   OpencodeGeneratedConfig,
   OpencodeLaunchEnv,
   OpencodeProviderBlock,
+  OpencodeProviderBlocks,
+  OpencodeV2ProviderBlock,
 } from "../clients/config-export";
 import { visibleNativeSlugs } from "../codex/catalog";
 import { commandInvocation } from "../lib/win-exec";
@@ -57,6 +62,7 @@ export {
   buildOpencodeProviderBlockFromCatalog,
   opencodeGlobalConfigPath,
   opencodeProxyBaseUrl,
+  opencodeV2ProviderBlock,
 } from "../clients/config-export";
 export type {
   OpencodeCatalogModel,
@@ -64,6 +70,8 @@ export type {
   OpencodeLaunchEnv,
   OpencodeModelEntry,
   OpencodeProviderBlock,
+  OpencodeProviderBlocks,
+  OpencodeV2ProviderBlock,
 } from "../clients/config-export";
 
 /** One proxy-routed model destined for the generated provider block. */
@@ -74,6 +82,8 @@ export interface OpencodeRoutedModel {
   contextWindow?: number;
   /** Authoritative display label (CatalogModel.displayName); optional. */
   displayName?: string;
+  /** Declared effort ladder; exported as opencode model variants when present. */
+  reasoningEfforts?: readonly string[];
 }
 
 /** Row shape from authenticated GET /api/models on the running proxy. */
@@ -85,6 +95,10 @@ export interface OpencodeProxyModelRow {
   disabled?: boolean;
   displayName?: string;
   contextWindow?: number;
+  /** Declared effort ladder from `/api/models`; carried into opencode model variants. */
+  reasoningEfforts?: string[];
+  /** Declared default effort from `/api/models`. */
+  defaultReasoningEffort?: string;
 }
 
 const PROJECT_CONFIG_FILENAMES = ["opencode.json", "opencode.jsonc"] as const;
@@ -196,16 +210,13 @@ export function opencodeLaunchNativeSlugs(config: OcxConfig): string[] {
   return [...visibleNativeSlugs(config)];
 }
 
-/** Back-compat helper for unit tests that assemble slugs/routed rows directly. */
-export function buildOpencodeProviderBlock(
-  port: number,
+/** Catalog rows for the slugs/routed models a caller assembled by hand. */
+function opencodeLaunchCatalog(
   nativeSlugs: readonly string[],
   routedModels: readonly OpencodeRoutedModel[],
-  nativeContextWindow: (slug: string) => number | undefined = () => undefined,
-  hostname?: string,
-  config: OcxConfig = OPENCODE_PROVIDER_BLOCK_DEFAULT_CONFIG,
-): OpencodeProviderBlock {
-  const catalog: OpencodeCatalogModel[] = [
+  nativeContextWindow: (slug: string) => number | undefined,
+): OpencodeCatalogModel[] {
+  return [
     ...nativeSlugs.map(id => ({
       namespaced: id,
       native: true,
@@ -220,9 +231,71 @@ export function buildOpencodeProviderBlock(
       id: model.id,
       contextWindow: model.contextWindow,
       displayName: model.displayName,
+      ...(model.reasoningEfforts && model.reasoningEfforts.length > 0
+        ? { reasoningEfforts: [...model.reasoningEfforts] }
+        : {}),
     })),
   ];
-  return buildOpencodeProviderBlockFromCatalog(port, catalog, hostname, config);
+}
+
+/** Back-compat helper for unit tests that assemble slugs/routed rows directly. */
+export function buildOpencodeProviderBlock(
+  port: number,
+  nativeSlugs: readonly string[],
+  routedModels: readonly OpencodeRoutedModel[],
+  nativeContextWindow: (slug: string) => number | undefined = () => undefined,
+  hostname?: string,
+  config: OcxConfig = OPENCODE_PROVIDER_BLOCK_DEFAULT_CONFIG,
+): OpencodeProviderBlock {
+  return buildOpencodeProviderBlockFromCatalog(
+    port,
+    opencodeLaunchCatalog(nativeSlugs, routedModels, nativeContextWindow),
+    hostname,
+    config,
+  );
+}
+
+/**
+ * V2 counterpart of `buildOpencodeProviderBlock`. The launcher injects both generations,
+ * because only the V2 block carries selectable reasoning efforts.
+ */
+export function buildOpencodeV2ProviderBlock(
+  port: number,
+  nativeSlugs: readonly string[],
+  routedModels: readonly OpencodeRoutedModel[],
+  nativeContextWindow: (slug: string) => number | undefined = () => undefined,
+  hostname?: string,
+  config: OcxConfig = OPENCODE_PROVIDER_BLOCK_DEFAULT_CONFIG,
+): OpencodeV2ProviderBlock {
+  return opencodeBlocks(
+    port,
+    opencodeLaunchCatalog(nativeSlugs, routedModels, nativeContextWindow),
+    hostname,
+    config,
+  ).v2;
+}
+
+/**
+ * Both generations from one catalog, in one pass. Every production path uses this: the two
+ * blocks are one document's fragments and have to agree on model set, names, connection, and
+ * variants, which building them together guarantees instead of merely expecting.
+ */
+export function buildOpencodeProviderBlocksFromCatalog(
+  port: number,
+  catalogModels: readonly OpencodeCatalogModel[],
+  hostname?: string,
+  config: OcxConfig = OPENCODE_PROVIDER_BLOCK_DEFAULT_CONFIG,
+): OpencodeProviderBlocks {
+  return opencodeBlocks(port, catalogModels, hostname, config);
+}
+
+function opencodeBlocks(
+  port: number,
+  catalogModels: readonly OpencodeCatalogModel[],
+  hostname?: string,
+  config: OcxConfig = OPENCODE_PROVIDER_BLOCK_DEFAULT_CONFIG,
+): OpencodeProviderBlocks {
+  return opencodeProviderBlocks(opencodeProxyBaseUrl(port, hostname), catalogModels, config);
 }
 
 /** Default deadline for authenticated GET /api/models during `ocx opencode` launch. */
@@ -315,6 +388,12 @@ export function opencodeCatalogFromProxyRows(
       id: row.id,
       contextWindow: row.contextWindow,
       displayName: row.displayName,
+      ...(Array.isArray(row.reasoningEfforts) && row.reasoningEfforts.length > 0
+        ? { reasoningEfforts: [...row.reasoningEfforts] }
+        : {}),
+      ...(typeof row.defaultReasoningEffort === "string" && row.defaultReasoningEffort.length > 0
+        ? { defaultReasoningEffort: row.defaultReasoningEffort }
+        : {}),
     });
   }
   return catalog;
@@ -330,17 +409,19 @@ export function isOpencodeRuntimeConfigError(
 }
 
 /**
- * Merge inherited `OPENCODE_CONFIG_CONTENT` and override only `provider.opencodex`.
+ * Merge inherited `OPENCODE_CONFIG_CONTENT` and override only our own blocks:
+ * `provider.opencodex` (V1) and `providers.opencodex` (V2, the one carrying variants).
  * When no inline layer is present, emit the minimal runtime object for this launcher.
  */
 export function mergeOpencodeRuntimeConfig(
   inheritedContent: string | undefined,
-  providerBlock: OpencodeProviderBlock,
+  blocks: OpencodeProviderBlocks,
 ): OpencodeGeneratedConfig | OpencodeRuntimeConfigError {
   if (!inheritedContent?.trim()) {
     return {
       $schema: OPENCODE_CONFIG_SCHEMA,
-      provider: { [OPENCODE_PROVIDER_ID]: providerBlock },
+      provider: { [OPENCODE_PROVIDER_ID]: blocks.v1 },
+      providers: { [OPENCODE_PROVIDER_ID]: blocks.v2 },
     };
   }
   let parsed: unknown;
@@ -356,12 +437,20 @@ export function mergeOpencodeRuntimeConfig(
   if (existingProvider !== undefined && !isRecord(existingProvider)) {
     return { error: "OPENCODE_CONFIG_CONTENT provider must be a JSON object when present." };
   }
+  const existingProviders = parsed.providers;
+  if (existingProviders !== undefined && !isRecord(existingProviders)) {
+    return { error: "OPENCODE_CONFIG_CONTENT providers must be a JSON object when present." };
+  }
   return {
     ...parsed,
     $schema: typeof parsed.$schema === "string" ? parsed.$schema : OPENCODE_CONFIG_SCHEMA,
     provider: {
       ...(isRecord(existingProvider) ? existingProvider : {}),
-      [OPENCODE_PROVIDER_ID]: providerBlock,
+      [OPENCODE_PROVIDER_ID]: blocks.v1,
+    },
+    providers: {
+      ...(isRecord(existingProviders) ? existingProviders : {}),
+      [OPENCODE_PROVIDER_ID]: blocks.v2,
     },
   } as OpencodeGeneratedConfig;
 }
@@ -375,10 +464,10 @@ export function buildOpencodeConfig(
   hostname?: string,
   config: OcxConfig = OPENCODE_PROVIDER_BLOCK_DEFAULT_CONFIG,
 ): OpencodeGeneratedConfig {
-  const merged = mergeOpencodeRuntimeConfig(
-    undefined,
-    buildOpencodeProviderBlock(port, nativeSlugs, routedModels, nativeContextWindow, hostname, config),
-  );
+  const merged = mergeOpencodeRuntimeConfig(undefined, {
+    v1: buildOpencodeProviderBlock(port, nativeSlugs, routedModels, nativeContextWindow, hostname, config),
+    v2: buildOpencodeV2ProviderBlock(port, nativeSlugs, routedModels, nativeContextWindow, hostname, config),
+  });
   if (isOpencodeRuntimeConfigError(merged)) {
     throw new Error(merged.error);
   }
@@ -400,11 +489,19 @@ function findGitRoot(start: string): string | null {
   }
 }
 
+/**
+ * True when the file declares our provider in either generation. Both count: the launcher
+ * overwrites `provider.opencodex` and `providers.opencodex` alike, so a config that carries
+ * only the V2 block is overridden just as silently as one carrying only the V1 block.
+ */
 function configFileDefinesProvider(path: string): boolean {
   if (!existsSync(path)) return false;
   try {
     const parsed = parseJsonc(readFileSync(path, "utf8"));
-    return isRecord(parsed) && isRecord(parsed.provider) && OPENCODE_PROVIDER_ID in parsed.provider;
+    if (!isRecord(parsed)) return false;
+    const legacy = isRecord(parsed.provider) && OPENCODE_PROVIDER_ID in parsed.provider;
+    const v2 = isRecord(parsed.providers) && OPENCODE_PROVIDER_ID in parsed.providers;
+    return legacy || v2;
   } catch {
     return false;
   }
@@ -460,16 +557,17 @@ export function opencodeProxyStartEnv(base: OpencodeLaunchEnv = process.env): Op
 }
 
 /**
- * Env assembly (unit-tested). Inherited inline config is merged and only
- * `provider.opencodex` is replaced; disk config layers stay untouched. The admission
- * key travels in the child env rather than in the inline config payload.
+ * Env assembly (unit-tested). Inherited inline config is merged and only our own blocks are
+ * replaced — `provider.opencodex` and `providers.opencodex`; disk config layers stay
+ * untouched. The admission key travels in the child env rather than in the inline config
+ * payload.
  */
 export function buildOpencodeEnv(
-  providerBlock: OpencodeProviderBlock,
+  blocks: OpencodeProviderBlocks,
   apiKey: string,
   base: OpencodeLaunchEnv,
 ): OpencodeLaunchEnv | OpencodeRuntimeConfigError {
-  const runtimeConfig = mergeOpencodeRuntimeConfig(base[OPENCODE_CONFIG_CONTENT_ENV], providerBlock);
+  const runtimeConfig = mergeOpencodeRuntimeConfig(base[OPENCODE_CONFIG_CONTENT_ENV], blocks);
   if (isOpencodeRuntimeConfigError(runtimeConfig)) return runtimeConfig;
   return {
     ...base,
@@ -547,22 +645,17 @@ export async function cmdOpencode(args: string[]): Promise<number> {
     return 1;
   }
   const catalog = opencodeCatalogFromProxyRows(proxyModels, config);
-  const providerBlock = buildOpencodeProviderBlockFromCatalog(
-    live.port,
-    catalog,
-    live.hostname,
-    config,
-  );
-  const baseUrl = providerBlock.options.baseURL;
+  const blocks = buildOpencodeProviderBlocksFromCatalog(live.port, catalog, live.hostname, config);
+  const baseUrl = blocks.v1.options.baseURL;
   const modelCount = catalog.length;
   console.error(`✅ opencode wired to ${baseUrl} — ${modelCount} model(s) under provider \`${OPENCODE_PROVIDER_ID}\`.`);
-  console.error("   Your existing opencode config files are left untouched; only the runtime provider block is injected.");
+  console.error("   Your existing opencode config files are left untouched; only the runtime provider blocks are injected.");
   const providerOverride = opencodeProviderOverridePath(process.cwd());
   if (providerOverride) {
-    console.error(`ℹ ${providerOverride} also defines provider.${OPENCODE_PROVIDER_ID}; the runtime layer from ocx opencode overrides it for this launch.`);
+    console.error(`ℹ ${providerOverride} also defines our provider key; the runtime layer from ocx opencode overrides it for this launch.`);
   }
 
-  const builtEnv = buildOpencodeEnv(providerBlock, apiKey, process.env);
+  const builtEnv = buildOpencodeEnv(blocks, apiKey, process.env);
   if ("error" in builtEnv) {
     console.error(`❌ ${builtEnv.error}`);
     return 1;

package/src/cli/registry.ts

@@ -65,7 +65,7 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
     summary: "Run as a background service.",
     details: [
       "With no subcommand, installs when absent or repairs/restarts an existing service.",
-      "`restart` is an alias of `repair` and does not re-register an installed service.",
+      "`restart` aliases `repair`; healthy Windows tasks are reused, while stale definitions may re-register and elevate.",
       "Use `ocx service status` to see diagnostics and log paths.",
     ],
   },
@@ -244,8 +244,8 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
   { name: "api-key", usage: "ocx api-key <list|create|remove> ...", summary: "Alias of ocx access key." },
   {
     name: "export",
-    usage: "ocx export --client <opencode|pi|omp|hermes|openclaw|kimi|gajae|dsh|mcode|zcode|prime> [--json] [--out <path>] [--force]",
-    summary: "Print a client config (OpenCode, Pi, OMP, Hermes, OpenClaw, Kimi Code, Gajae Code, DeepSeek Harness, MiniMax Code, ZCode, Prime Agent) wired to the running proxy.",
+    usage: "ocx export --client <opencode|pi|omp|hermes|openclaw|kimi|gajae|dsh|mcode|zcode|prime|aside> [--json] [--out <path>] [--force]",
+    summary: "Print a client config (OpenCode, Pi, OMP, Hermes, OpenClaw, Kimi Code, Gajae Code, DeepSeek Harness, MiniMax Code, ZCode, Prime Agent, Aside) wired to the running proxy.",
     details: [
       "--json prints the generated document as JSON on stdout; use --out for the client's native format.",
       "--out <path> writes the native config there and refuses to replace an existing file without --force.",
@@ -268,8 +268,13 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
   },
   {
     name: "system",
-    usage: "ocx system <status|settings|startup|diagnostics|sync|update> ...",
-    summary: "Manage headless runtime settings, startup, sync, diagnostics, and updates.",
+    usage: "ocx system <status|settings|startup|diagnostics|sync|codex-app-server|codex-restart|update|codex-cli-update> ...",
+    summary: "Manage headless runtime settings, startup, sync, diagnostics, OpenCodex updates, and read-only Codex CLI inspection.",
+    details: [
+      "system update manages OpenCodex itself.",
+      "ocx system codex-cli-update check [--json]",
+      "The Codex CLI inspection command makes no package-registry request, does not execute Codex or npm, install or repair software, control a process, or write configuration or cache state.",
+    ],
   },
   {
     name: "config",
@@ -309,11 +314,12 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
     summary: "Launch opencode wired to the proxy (runtime provider config).",
     details: [
       "Ensures the proxy is running, then execs `opencode` with the generated `provider.opencodex`",
-      "block injected through OpenCode's inline runtime layer (`OPENCODE_CONFIG_CONTENT`). Any",
-      "existing inline config in the environment is preserved and only `provider.opencodex` is",
-      "overwritten for this launch.",
-      "Global/project opencode.json may be read to warn about an existing provider.opencodex",
-      "override; on-disk files are never modified.",
+      "and `providers.opencodex` blocks injected through OpenCode's inline runtime layer",
+      "(`OPENCODE_CONFIG_CONTENT`). Any existing inline config in the environment is preserved",
+      "and only `provider.opencodex` and `providers.opencodex` are overwritten for this launch.",
+      "Only the V2 block (`providers.opencodex`) carries the reasoning-effort variants.",
+      "Global/project opencode.json may be read to warn about an existing provider.opencodex or",
+      "providers.opencodex override; on-disk files are never modified.",
       "Routed models appear in the model picker as opencodex/<provider>/<model>.",
       "Stop using `ocx opencode` and plain `opencode` behaves exactly as before.",
     ],

package/src/cli/system-command.ts

@@ -19,6 +19,7 @@ const USAGE = `Usage:
   ocx system sync [--json]
   ocx system codex-app-server [--json]
   ocx system codex-restart --yes [--json]
+  ocx system codex-cli-update check [--json]
   ocx system update check [--channel <latest|preview>] [--json]
   ocx system update run [--channel <latest|preview>] [--restart <on|off>] --yes [--json]
   ocx system update status <job-id> [--json]`;
@@ -95,8 +96,12 @@ async function update(argv: string[], deps: RuntimeApiDeps): Promise<void> {
 }
 
 export async function handleSystemCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
+  const [sub = "status", ...rest] = argv;
+  if (sub === "codex-cli-update") {
+    const { handleCodexCliUpdateCommand } = await import("./codex-cli-update");
+    return await handleCodexCliUpdateCommand(rest);
+  }
   return runCliAction(async () => {
-    const [sub = "status", ...rest] = argv;
     if (sub === "status") await status(rest, deps);
     else if (sub === "settings") await settings(rest, deps);
     else if (sub === "startup") await startup(rest, deps);