@bitkyc08/opencodex 2.39.0 → 2.40.0

package/src/server/responses/outbound-body-guard.ts

@@ -0,0 +1,110 @@
+/**
+ * Measure a built passthrough body before it is sent, so an operator can turn an opaque
+ * upstream failure into a local, actionable refusal.
+ *
+ * There is deliberately no default limit. The one measured ceiling in this codebase belongs
+ * to the WebSocket transport (`MAX_CODEX_WS_CREATE_FRAME_BYTES` in `ws-upstream.ts`), and the
+ * comment recording that measurement says the same body still succeeds over HTTP SSE — #2426
+ * observed an 18.2 MB HTTP 200. An implicit HTTP ceiling inferred from the WS number would
+ * refuse requests that work today, on every passthrough destination including Azure and
+ * custom Responses gateways whose limits were never measured at all. The operator who hit a
+ * wall knows where their wall is; this guard is off until they say so.
+ */
+
+export interface OutboundBodyGuardResult {
+  admitted: boolean;
+  /** Serialized UTF-8 bytes. Zero when the guard is disabled before measurement. */
+  bytes: number;
+  /** The configured limit, or 0 when the guard is disabled. */
+  limit: number;
+  imageCount: number;
+  /** Approximate decoded bytes represented by embedded `input_image` data URIs. */
+  imageBytes: number;
+}
+
+const MAX_DIAGNOSTIC_DEPTH = 64;
+
+function decodedDataUriBytes(value: unknown): number {
+  if (typeof value !== "string" || !value.startsWith("data:")) return 0;
+  const comma = value.indexOf(",");
+  if (comma < 0) return 0;
+  const payload = value.length - comma - 1;
+  return payload > 0 ? Math.floor((payload * 3) / 4) : 0;
+}
+
+/**
+ * Walk the parsed body for `input_image` items. Bounded by depth and a seen-set because this
+ * runs on a body that already failed the size check, which is exactly when a pathological
+ * shape is most likely.
+ */
+function imageDiagnostics(value: unknown): { imageCount: number; imageBytes: number } {
+  let imageCount = 0;
+  let imageBytes = 0;
+  const seen = new WeakSet<object>();
+
+  const visit = (entry: unknown, depth: number): void => {
+    if (depth > MAX_DIAGNOSTIC_DEPTH || entry === null || typeof entry !== "object") return;
+    if (seen.has(entry)) return;
+    seen.add(entry);
+
+    if (!Array.isArray(entry) && (entry as Record<string, unknown>).type === "input_image") {
+      imageCount += 1;
+      imageBytes += decodedDataUriBytes((entry as Record<string, unknown>).image_url);
+      return;
+    }
+
+    if (Array.isArray(entry)) {
+      for (const item of entry) visit(item, depth + 1);
+      return;
+    }
+    for (const item of Object.values(entry)) visit(item, depth + 1);
+  };
+
+  visit(value, 0);
+  return { imageCount, imageBytes };
+}
+
+/**
+ * `limitBytes` undefined (unconfigured) or 0 (explicitly disabled) both admit without
+ * measuring, so an unconfigured proxy does no work and sends exactly what it sends today.
+ */
+export function checkOutboundBodySize(
+  body: string,
+  limitBytes: number | undefined,
+): OutboundBodyGuardResult {
+  if (limitBytes === undefined || limitBytes === 0) {
+    return { admitted: true, bytes: 0, limit: 0, imageCount: 0, imageBytes: 0 };
+  }
+
+  const bytes = Buffer.byteLength(body, "utf8");
+  if (bytes <= limitBytes) {
+    return { admitted: true, bytes, limit: limitBytes, imageCount: 0, imageBytes: 0 };
+  }
+
+  try {
+    const diagnostics = imageDiagnostics(JSON.parse(body) as unknown);
+    return { admitted: false, bytes, limit: limitBytes, ...diagnostics };
+  } catch {
+    return { admitted: false, bytes, limit: limitBytes, imageCount: 0, imageBytes: 0 };
+  }
+}
+
+function megabytes(bytes: number): string {
+  return (bytes / (1024 * 1024)).toFixed(1);
+}
+
+/**
+ * Name the likely cause rather than only the number. Accumulated replayed images are the
+ * common way a thread crosses a byte ceiling while its token count still looks healthy, and
+ * the remedy is not something the user can guess from a size alone.
+ */
+export function describeOutboundBodyRefusal(result: OutboundBodyGuardResult): string {
+  const imageDetail = result.imageCount > 0
+    ? ` It contains ${result.imageCount} input_image item${result.imageCount === 1 ? "" : "s"} `
+      + `representing about ${megabytes(result.imageBytes)} MB of decoded embedded image data; `
+      + "accumulated replayed images are the likely cause."
+    : " Large inputs accumulated across replayed turns can cause this.";
+  return `The serialized outbound request is ${megabytes(result.bytes)} MB, `
+    + `above the configured ${megabytes(result.limit)} MB limit.${imageDetail} `
+    + "Start a new session or compact the conversation before retrying.";
+}

package/src/server/responses/ws-upstream.ts

@@ -18,6 +18,36 @@ import { compareBunVersions } from "../../lib/bun-stream-caps";
 const CODEX_RESPONSES_HTTP_URL = "https://chatgpt.com/backend-api/codex/responses";
 const CODEX_RESPONSES_WS_URL = "wss://chatgpt.com/backend-api/codex/responses";
 const WS_BETA = "responses_websockets=2026-02-06";
+
+/**
+ * Dial URL for a request URL. The canonical ChatGPT backend keeps its constant;
+ * an operator-opted OpenAI-compatible upstream swaps https for wss on the same
+ * path so gateways that serve the Responses WebSocket protocol on their
+ * /v1/responses path get the same fast lane. Plain HTTP remains on SSE because
+ * a provider WS handshake would otherwise send credentials and request data
+ * without transport encryption.
+ */
+function wsUpstreamUrlFor(httpUrl: string): string {
+  if (httpUrl === CODEX_RESPONSES_HTTP_URL) return CODEX_RESPONSES_WS_URL;
+  return httpUrl.replace(/^http(s?):/, "ws$1:");
+}
+
+/**
+ * An operator-opted OpenAI-compatible upstream only joins the WS lane for
+ * Responses endpoints: the WebSocket path speaks the Responses event protocol,
+ * and every downstream consumer (adapter parsers, usage sniffing, SSE relay)
+ * assumes that wire. Other paths (chat completions, images, search) stay HTTP.
+ */
+function isResponsesWebsocketEligibleUrl(url: string): boolean {
+  let parsed: URL;
+  try {
+    parsed = new URL(url);
+  } catch {
+    return false;
+  }
+  return parsed.protocol === "https:"
+    && parsed.pathname.endsWith("/responses");
+}
 // If the 101 never arrives (network black hole), give SSE a chance well before
 // the caller's connect timeout (default 200s) would fire.
 const UPGRADE_DEADLINE_MS = 10_000;
@@ -102,9 +132,11 @@ export function shouldUseCodexWsUpstream(
   url: string,
   init?: RequestInit,
   runtime: BunRuntimeGateInput = currentBunRuntimeIdentity(),
+  upstreamWebsocketConfigured = false,
 ): boolean {
   if (!bunSupportsBoundedCodexWsRelay(runtime)) return false;
-  if (url !== CODEX_RESPONSES_HTTP_URL) return false;
+  if (url !== CODEX_RESPONSES_HTTP_URL && !upstreamWebsocketConfigured) return false;
+  if (upstreamWebsocketConfigured && !isResponsesWebsocketEligibleUrl(url)) return false;
   if ((init?.method ?? "GET").toUpperCase() !== "POST") return false;
   const body = init?.body;
   if (typeof body !== "string") return false;
@@ -123,6 +155,50 @@ export function shouldUseCodexWsUpstream(
 
 const CLOSED_BEFORE_TERMINAL = "codex websocket closed before a Responses terminal event";
 
+type ResponsesWsRelayEvent = {
+  type: string;
+  text: string;
+};
+
+/**
+ * Responses WebSocket uses `response.done` as its terminal event, while the
+ * SSE Responses surface uses status-specific terminal events. Normalize the
+ * WS-only discriminator before relaying so the existing SSE consumers can
+ * settle the turn and the socket close cannot be mistaken for a drop. Unknown
+ * or missing status values fail closed instead of being reported as success.
+ */
+function normalizeResponsesWsRelayEvent(text: string): ResponsesWsRelayEvent | null {
+  let payload: unknown;
+  try {
+    payload = JSON.parse(text);
+  } catch {
+    return null;
+  }
+  if (!payload || typeof payload !== "object" || Array.isArray(payload)) return null;
+  const record = payload as Record<string, unknown>;
+  if (typeof record.type !== "string") return null;
+  if (record.type !== "response.done") return { type: record.type, text };
+
+  const response = record.response;
+  const status = response && typeof response === "object" && !Array.isArray(response)
+    ? (response as Record<string, unknown>).status
+    : undefined;
+  const type = status === "completed"
+    ? "response.completed"
+    : status === "failed"
+      ? "response.failed"
+      : status === "incomplete" || status === "cancelled"
+        ? "response.incomplete"
+        : "response.failed";
+  const normalizedRecord: Record<string, unknown> = { ...record, type };
+  if (type === "response.failed" && status !== "failed") {
+    normalizedRecord.response = response && typeof response === "object" && !Array.isArray(response)
+      ? { ...(response as Record<string, unknown>), status: "failed" }
+      : { status: "failed" };
+  }
+  return { type, text: JSON.stringify(normalizedRecord) };
+}
+
 /**
  * The close code is the only thing that separates "the backend refused this
  * payload" from "the network dropped", and both used to reach the caller as the
@@ -221,7 +297,7 @@ export function codexWsUpstreamFetch(
     let ws: WebSocket;
     try {
       // Bun accepts per-handshake headers; the DOM lib types only list protocol arrays.
-      ws = new WebSocket(CODEX_RESPONSES_WS_URL, { headers } as unknown as string[]);
+      ws = new WebSocket(wsUpstreamUrlFor(url), { headers } as unknown as string[]);
     } catch {
       resolve(sseFallback(url, init));
       return;
@@ -311,14 +387,19 @@ export function codexWsUpstreamFetch(
         failStream("codex websocket frame exceeds the response size limit");
         return;
       }
-      const encodedText = encoder.encode(text);
+      const rawEncodedText = encoder.encode(text);
+      if (rawEncodedText.byteLength > MAX_CODEX_WS_FRAME_BYTES) {
+        failStream("codex websocket frame exceeds the response size limit");
+        return;
+      }
+      const normalized = normalizeResponsesWsRelayEvent(text);
+      if (!normalized) return;
+      const { type } = normalized;
+      const encodedText = normalized.text === text ? rawEncodedText : encoder.encode(normalized.text);
       if (encodedText.byteLength > MAX_CODEX_WS_FRAME_BYTES) {
         failStream("codex websocket frame exceeds the response size limit");
         return;
       }
-      let type: unknown;
-      try { type = (JSON.parse(text) as { type?: unknown }).type; } catch { return; }
-      if (typeof type !== "string") return;
       // Relay only the event surface the SSE path produces today. WS-only
       // frames (codex.rate_limits, responsesapi.websocket_timing) are dropped
       // so downstream clients see exactly the stream shape they always got.

package/src/server/responses-self-named-namespace-scrub.ts

@@ -0,0 +1,181 @@
+import type { SsePayloadRewrite } from "./sse-payload-rewrite";
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+export interface SelfNamedNamespaceScrubAuthorization {
+  customToolCallNames: ReadonlySet<string>;
+  functionCallNames: ReadonlySet<string>;
+}
+
+function collectBareToolSpecs(
+  bareCustomNames: Set<string>,
+  bareFunctionNames: Set<string>,
+  sameNameNamespacedCustomNames: Set<string>,
+  sameNameNamespacedFunctionNames: Set<string>,
+  specs: unknown,
+): void {
+  if (!Array.isArray(specs)) return;
+  for (const spec of specs) {
+    if (!isPlainObject(spec)) continue;
+    if (spec.type === "namespace" && Array.isArray(spec.tools)) {
+      const namespace = typeof spec.name === "string" ? spec.name : undefined;
+      for (const inner of spec.tools) {
+        if (!isPlainObject(inner) || typeof inner.name !== "string") continue;
+        if (namespace !== "functions" && namespace === inner.name) {
+          if (inner.type === "custom") sameNameNamespacedCustomNames.add(inner.name);
+          else if (inner.type === "function") sameNameNamespacedFunctionNames.add(inner.name);
+        }
+        if (namespace === "functions") {
+          if (inner.type === "custom") bareCustomNames.add(inner.name);
+          else if (inner.type === "function") bareFunctionNames.add(inner.name);
+        }
+      }
+      continue;
+    }
+    // `buildTools` (parser.ts) also accepts the Chat-shaped `{ type: "function", function: { name } }`
+    // declaration, and the undeclared-tool guard authorizes it the same way. Reading only
+    // `spec.name` here left such a function out of the raw-body set, so the intersection dropped
+    // it and a self-named echo for it reached Codex again.
+    const nestedFunction = spec.type === "function" && isPlainObject(spec.function) ? spec.function : undefined;
+    const name = typeof spec.name === "string" && spec.name.length > 0
+      ? spec.name
+      : typeof nestedFunction?.name === "string" && nestedFunction.name.length > 0
+        ? nestedFunction.name
+        : undefined;
+    if (!name) continue;
+    const namespace = typeof spec.namespace === "string" ? spec.namespace : undefined;
+    if (namespace !== "functions" && namespace === name) {
+      if (spec.type === "custom") sameNameNamespacedCustomNames.add(name);
+      else if (spec.type === "function") sameNameNamespacedFunctionNames.add(name);
+    }
+    if (!namespace || namespace === "functions") {
+      if (spec.type === "custom") bareCustomNames.add(name);
+      else if (spec.type === "function") bareFunctionNames.add(name);
+    }
+  }
+}
+
+/** Bare custom tools authorized by this turn, scoped to each response call type. */
+export function collectSelfNamedNamespaceScrubAuthorization(
+  body: unknown,
+  authorizedBareCustomToolNames: ReadonlySet<string>,
+  authorizedBareFunctionToolNames: ReadonlySet<string>,
+): SelfNamedNamespaceScrubAuthorization {
+  const bareCustomNames = new Set<string>();
+  const bareFunctionNames = new Set<string>();
+  const sameNameNamespacedCustomNames = new Set<string>();
+  const sameNameNamespacedFunctionNames = new Set<string>();
+  if (isPlainObject(body)) {
+    collectBareToolSpecs(
+      bareCustomNames,
+      bareFunctionNames,
+      sameNameNamespacedCustomNames,
+      sameNameNamespacedFunctionNames,
+      body.tools,
+    );
+    if (Array.isArray(body.input)) {
+      for (const item of body.input) {
+        if (
+          isPlainObject(item)
+          && (item.type === "additional_tools" || item.type === "tool_search_output")
+        ) {
+          collectBareToolSpecs(
+            bareCustomNames,
+            bareFunctionNames,
+            sameNameNamespacedCustomNames,
+            sameNameNamespacedFunctionNames,
+            item.tools,
+          );
+        }
+      }
+    }
+  }
+  const authorizedCustomNames = [...bareCustomNames]
+    .filter(name => authorizedBareCustomToolNames.has(name));
+  const authorizedFunctionNames = new Set([
+    ...authorizedCustomNames,
+    ...[...bareFunctionNames].filter(name => authorizedBareFunctionToolNames.has(name)),
+  ]);
+  return {
+    customToolCallNames: new Set(
+      authorizedCustomNames.filter(name => !sameNameNamespacedCustomNames.has(name)),
+    ),
+    functionCallNames: new Set(
+      [...authorizedFunctionNames].filter(name => !sameNameNamespacedFunctionNames.has(name)),
+    ),
+  };
+}
+
+/**
+ * Drop a tool-call `namespace` that merely repeats the call's own `name` (#3217).
+ *
+ * codex-rs resolves a client tool call as `ToolName::new(namespace, name)` and treats only
+ * `None | "" | "functions"` as the default namespace; anything else is concatenated into a flat
+ * name before routing. A backend answer of `{ name: "exec", namespace: "exec" }` therefore
+ * becomes `execexec`, which no client tool matches, and Codex re-issues the same call forever.
+ * The malformed Spark shape is scrubbed only when the current turn authorized a bare custom tool
+ * with that name. A genuine namespaced tool may intentionally use the same namespace and name.
+ * The adapter fix that stops provoking the answer lives in `stripSparkCompatibility`; this is the
+ * belt to that suspender.
+ */
+export function scrubSelfNamedToolCallNamespace(
+  value: unknown,
+  authorization: SelfNamedNamespaceScrubAuthorization,
+): { value: unknown; changed: boolean } {
+  if (Array.isArray(value)) {
+    let changed = false;
+    const out = value.map(entry => {
+      const result = scrubSelfNamedToolCallNamespace(entry, authorization);
+      changed ||= result.changed;
+      return result.value;
+    });
+    return changed ? { value: out, changed: true } : { value, changed: false };
+  }
+  if (!isPlainObject(value)) return { value, changed: false };
+  let changed = false;
+  const out: Record<string, unknown> = {};
+  for (const [key, entry] of Object.entries(value)) {
+    const result = scrubSelfNamedToolCallNamespace(entry, authorization);
+    out[key] = result.value;
+    changed ||= result.changed;
+  }
+  const authorizedNames = value.type === "custom_tool_call"
+    ? authorization.customToolCallNames
+    : value.type === "function_call"
+      ? authorization.functionCallNames
+      : undefined;
+  if (
+    authorizedNames
+    && typeof value.name === "string"
+    && value.name.length > 0
+    && value.namespace === value.name
+    && authorizedNames.has(value.name)
+  ) {
+    delete out.namespace;
+    changed = true;
+  }
+  return changed ? { value: out, changed: true } : { value, changed: false };
+}
+
+export function scrubSelfNamedToolCallNamespaceInJson(
+  text: string,
+  authorization: SelfNamedNamespaceScrubAuthorization,
+): string {
+  if (!text.includes("\"namespace\"")) return text;
+  let payload: unknown;
+  try {
+    payload = JSON.parse(text);
+  } catch {
+    return text;
+  }
+  const result = scrubSelfNamedToolCallNamespace(payload, authorization);
+  return result.changed ? JSON.stringify(result.value) : text;
+}
+
+export function createSelfNamedToolCallNamespaceScrubRewrite(
+  authorization: SelfNamedNamespaceScrubAuthorization,
+): SsePayloadRewrite {
+  return payload => scrubSelfNamedToolCallNamespaceInJson(payload, authorization);
+}

package/src/server/system-env.ts

@@ -3,8 +3,10 @@ import { accessSync, constants, readFileSync, writeFileSync, unlinkSync, mkdirSy
 import { delimiter, join } from "node:path";
 import { getConfigDir } from "../config";
 import { resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
-import { PROXY_MARKER, defaultAuthDetectDeps, detectClaudeAuth, ownAdmissionTokens } from "../claude/auth-detect";
+import { PROXY_MARKER, defaultAuthDetectDeps, detectClaudeAuth, ownAdmissionTokens, type AuthDetectDeps } from "../claude/auth-detect";
 import { resolveClaudeAuthMode } from "../claude/auth-mode";
+import { ANTHROPIC_PARENT_ENV_SLOTS, trustedNodeLauncherContext, type AnthropicParentEnvSlot } from "../cli/launcher-context";
+import { isProxyAdmissionSecret } from "./auth-cors";
 import type { OcxConfig } from "../types";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
 import { providerContextCap } from "../providers/context-cap";
@@ -21,8 +23,43 @@ import { OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
  * NOTE this is a SNAPSHOT: the file only changes when this runs (proxy start, `ocx
  * ensure`, or a settings save). `ocx claude` re-resolves live on every launch.
  */
-function systemEnvMarkerMode(config: OcxConfig): "proxy" | "subscription" {
-  return resolveClaudeAuthMode(config, detectClaudeAuth(defaultAuthDetectDeps(process.env, ownAdmissionTokens(config)))).markerMode;
+export type SystemEnvDeps = {
+  /** Test seam; production uses the authenticated Node-launcher context. */
+  preBunAnthropicSlots?: readonly AnthropicParentEnvSlot[] | null;
+  /** Test seam for auth sources; `env` and `ownTokens` stay bound below. */
+  authDetect?: Omit<Partial<AuthDetectDeps>, "env" | "ownTokens">;
+};
+
+/**
+ * Bun may synthesize Anthropic variables from a project `.env` before this module runs.
+ * Only values recorded by the plain-Node launcher are trusted as parent exports. Direct
+ * Bun/service launches have no proof-bound slot list, so they fail closed and let the
+ * file/keychain auth sources decide instead of allowing dotenv to select subscription mode.
+ */
+function systemEnvAnthropicEnv(
+  env: NodeJS.ProcessEnv,
+  preBunAnthropicSlots: readonly AnthropicParentEnvSlot[] | null | undefined,
+): NodeJS.ProcessEnv {
+  const trustedSlots = preBunAnthropicSlots === undefined
+    ? trustedNodeLauncherContext()?.anthropicEnvSlots ?? []
+    : preBunAnthropicSlots ?? [];
+  const exported = new Set<AnthropicParentEnvSlot>(trustedSlots);
+  const sanitized = { ...env };
+  for (const name of ANTHROPIC_PARENT_ENV_SLOTS) {
+    if (sanitized[name] !== undefined && !exported.has(name)) delete sanitized[name];
+  }
+  return sanitized;
+}
+
+function systemEnvMarkerMode(config: OcxConfig, deps: SystemEnvDeps = {}): "proxy" | "subscription" {
+  const env = systemEnvAnthropicEnv(process.env, deps.preBunAnthropicSlots);
+  const ownTokens = ownAdmissionTokens(config);
+  return resolveClaudeAuthMode(config, detectClaudeAuth({
+    ...defaultAuthDetectDeps(env, ownTokens),
+    ...(deps.authDetect ?? {}),
+    env: () => env,
+    ownTokens,
+  })).markerMode;
 }
 
 // ---------------------------------------------------------------------------
@@ -39,7 +76,13 @@ function shellValue(value: string): string {
   return `'${value.replaceAll("'", `'\\''`)}'`;
 }
 
-function writeShellEnvFile(port: number, config: OcxConfig, modelEnv: Record<string, string> = {}, auto?: AutoContextMode): void {
+function writeShellEnvFile(
+  port: number,
+  config: OcxConfig,
+  modelEnv: Record<string, string> = {},
+  auto?: AutoContextMode,
+  deps: SystemEnvDeps = {},
+): void {
   const lines = [
     `# Generated by opencodex — do not edit manually`,
     `export ANTHROPIC_BASE_URL=${shellValue(`http://127.0.0.1:${port}`)}`,
@@ -49,10 +92,12 @@ function writeShellEnvFile(port: number, config: OcxConfig, modelEnv: Record<str
   // exported in their shell wins even though launchctl knows nothing about it.
   const conditional = (name: string, value: string) =>
     `[ -z "\${${name}+x}" ] && export ${name}=${shellValue(value)}`;
-  if (config.apiKeys?.length) {
-    lines.push(`export ANTHROPIC_AUTH_TOKEN=${shellValue(config.apiKeys[0].key)}`);
-  } else if (systemEnvMarkerMode(config) === "proxy") {
-    lines.push(conditional("ANTHROPIC_AUTH_TOKEN", PROXY_MARKER));
+  if (systemEnvMarkerMode(config, deps) === "proxy") {
+    if (config.apiKeys?.length) {
+      lines.push(`export ANTHROPIC_AUTH_TOKEN=${shellValue(config.apiKeys[0].key)}`);
+    } else {
+      lines.push(conditional("ANTHROPIC_AUTH_TOKEN", PROXY_MARKER));
+    }
   }
   // Model slots (default + tiers + legacy small-fast) with [1m] applied (devlog 260712 B2).
   if (modelEnv.ANTHROPIC_MODEL) {
@@ -319,7 +364,11 @@ async function computeEffectiveModelEnv(config: OcxConfig, auto?: AutoContextMod
   return { modelEnv: effectiveModelEnv(config.claudeCode, windows ?? {}, auto), windows: windows ?? {} };
 }
 
-export async function injectSystemEnv(port: number, config: OcxConfig): Promise<SystemEnvResult> {
+export async function injectSystemEnv(
+  port: number,
+  config: OcxConfig,
+  deps: SystemEnvDeps = {},
+): Promise<SystemEnvResult> {
   if (process.platform !== "darwin") return { injected: false, reason: "not macOS" };
   if (config.claudeCode?.enabled === false) return { injected: false, reason: "claude disabled" };
 
@@ -351,21 +400,25 @@ export async function injectSystemEnv(port: number, config: OcxConfig): Promise<
   try {
     inject("ANTHROPIC_BASE_URL", ownedBaseUrl(port));
     inject("CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY", "1");
-    if (config.apiKeys?.length) {
-      inject("ANTHROPIC_AUTH_TOKEN", config.apiKeys[0].key);
-    } else if (systemEnvMarkerMode(config) === "proxy" && launchctlGetenv("ANTHROPIC_AUTH_TOKEN") === undefined) {
-      inject("ANTHROPIC_AUTH_TOKEN", PROXY_MARKER);
-    } else if (systemEnvMarkerMode(config) !== "proxy"
-      && injectedKeys.includes("ANTHROPIC_AUTH_TOKEN")
-      && launchctlGetenv("ANTHROPIC_AUTH_TOKEN") === PROXY_MARKER) {
-      // Subscription switch-back (devlog 260720_claude_authmode_persist): remove ONLY
-      // the opencodex-owned dummy token so a launchd-started Claude regains its own
-      // claude.ai OAuth. User-set tokens (not tracked in injectedKeys, or carrying a
-      // different value) are never touched.
-      unsetLaunchctlEnv("ANTHROPIC_AUTH_TOKEN");
-      const dummyIdx = injectedKeys.indexOf("ANTHROPIC_AUTH_TOKEN");
-      if (dummyIdx >= 0) injectedKeys.splice(dummyIdx, 1);
-      writeTracking(port, injectedKeys);
+    const markerMode = systemEnvMarkerMode(config, deps);
+    if (markerMode === "proxy") {
+      if (config.apiKeys?.length) {
+        inject("ANTHROPIC_AUTH_TOKEN", config.apiKeys[0].key);
+      } else if (launchctlGetenv("ANTHROPIC_AUTH_TOKEN") === undefined) {
+        inject("ANTHROPIC_AUTH_TOKEN", PROXY_MARKER);
+      }
+    } else if (injectedKeys.includes("ANTHROPIC_AUTH_TOKEN")) {
+      const currentToken = launchctlGetenv("ANTHROPIC_AUTH_TOKEN");
+      if (currentToken
+        && (currentToken === PROXY_MARKER || isProxyAdmissionSecret(currentToken, config))) {
+        // Subscription switch-back (devlog 260720_claude_authmode_persist): remove
+        // opencodex-owned dummy or admission tokens so a launchd-started Claude regains
+        // its own claude.ai OAuth. User-set tokens are never touched.
+        unsetLaunchctlEnv("ANTHROPIC_AUTH_TOKEN");
+        const tokenIdx = injectedKeys.indexOf("ANTHROPIC_AUTH_TOKEN");
+        if (tokenIdx >= 0) injectedKeys.splice(tokenIdx, 1);
+        writeTracking(port, injectedKeys);
+      }
     }
     // Lever keys (devlog 136 B6): user-wins — skip any key the user already set in the
     // launchd domain, and track ONLY the keys we actually injected so revert cannot
@@ -399,7 +452,7 @@ export async function injectSystemEnv(port: number, config: OcxConfig): Promise<
     }
 
     // Shell-hook env file: works for new shells in already-running Terminal.app.
-    writeShellEnvFile(port, config, modelEnv, auto);
+    writeShellEnvFile(port, config, modelEnv, auto, deps);
 
     // Gateway-model cache pre-write (devlog 030): plain `claude` sessions read the
     // picker list from ~/.claude/cache/gateway-models.json and cannot refresh it