@bitkyc08/opencodex 2.5.6 → 2.6.0

package/src/cli.ts

@@ -1,11 +1,25 @@
 #!/usr/bin/env bun
-import { execFileSync, spawn } from "node:child_process";
+import { spawn } from "node:child_process";
 import { rmSync } from "node:fs";
 import { restoreNativeCodex } from "./codex-inject";
 import { restoreLegacyOpenaiHistory } from "./codex-history-provider";
 import { writeJournal, reconcileJournal } from "./codex-journal";
-import { codexAutoStartEnabled, getConfigDir, getConfigPath, loadConfig, readPid, removePid, saveConfig, writePid } from "./config";
+import {
+  codexAutoStartEnabled,
+  getConfigDir,
+  loadConfig,
+  readPid,
+  readRuntimePort,
+  removePid,
+  removeRuntimePort,
+  saveConfig,
+  writePid,
+  writeRuntimePort,
+} from "./config";
+import { collectStatus } from "./cli-status";
+import { hasHelpFlag, printSubcommandUsage, printUsage, printVersion } from "./cli-help";
 import { findAvailablePort, shouldPersistSelectedPort } from "./ports";
+import { killProxy } from "./process-control";
 import { serviceCommand, serviceStatusSummary, stopServiceIfInstalled, uninstallServiceIfInstalled } from "./service";
 import { drainAndShutdown, startServer } from "./server";
 import { maybeShowStarPrompt } from "./star-prompt";
@@ -13,94 +27,14 @@ import { maybeShowStarPrompt } from "./star-prompt";
 const args = process.argv.slice(2);
 const command = args[0];
 
-function printUsage() {
-  console.log(`opencodex (ocx) — Universal provider proxy for Codex
-
-Usage:
-  ocx init                    Interactive setup (provider + Codex config injection)
-  ocx start [--port <port>]   Start the proxy server (auto-syncs models to Codex)
-  ocx stop                    Stop the proxy AND restore native Codex (plain codex works again)
-  ocx restore                 Restore native Codex without stopping (alias: eject)
-  ocx recover-history --legacy-openai
-                               Explicitly recover pre-backup syncResumeHistory rows
-  ocx uninstall               Remove service/shim/config and restore native Codex
-  ocx service <sub>           Run as a background service (install|start|stop|status|uninstall)
-  ocx codex-shim <sub>        Auto-start proxy when \`codex\` launches (install|status|uninstall)
-  ocx ensure                  Ensure the proxy is running and Codex config/cache are current
-  ocx sync                    Fetch models from providers and inject into Codex config
-  ocx sync-cache              Refresh Codex's model cache from the active catalog
-  ocx status                  Check proxy server status
-  ocx login <provider>        OAuth login (xai) — opens browser, stores token in ~/.opencodex/auth.json
-  ocx logout <provider>       Remove a stored OAuth login
-  ocx update                  Update opencodex to the latest published version
-  ocx help                    Show this help message
-
-Examples:
-  ocx init                    Set up provider and inject into Codex
-  ocx start                   Start on default port (10100)
-  ocx start --port 8080       Start on custom port
-  ocx sync                    Sync available models to Codex`);
-}
-
-function hasHelpFlag(values: string[]): boolean {
-  return values.some(value => value === "--help" || value === "-h" || value === "help");
+if (command === "--version" || command === "-v" || command === "version") {
+  printVersion();
+  process.exit(0);
 }
 
-function printSubcommandUsage(name: string | undefined): void {
-  switch (name) {
-    case "init":
-      console.log("Usage: ocx init\n\nInteractive setup for providers and Codex config injection.");
-      break;
-    case "start":
-      console.log("Usage: ocx start [--port <port>]\n\nStart the proxy server and sync models to Codex.");
-      break;
-    case "stop":
-      console.log("Usage: ocx stop\n\nStop the proxy and restore native Codex config.");
-      break;
-    case "restore":
-    case "eject":
-      console.log(`Usage: ocx ${name}\n\nRestore native Codex config without stopping the proxy.`);
-      break;
-    case "recover-history":
-      console.log("Usage: ocx recover-history --legacy-openai\n\nExplicitly recover pre-backup syncResumeHistory rows.");
-      break;
-    case "uninstall":
-    case "remove":
-      console.log(`Usage: ocx ${name}\n\nRemove service/shim/config and restore native Codex.`);
-      break;
-    case "service":
-      console.log("Usage: ocx service <install|start|stop|status|uninstall>");
-      break;
-    case "codex-shim":
-      console.log("Usage: ocx codex-shim <install|status|uninstall>");
-      break;
-    case "ensure":
-      console.log("Usage: ocx ensure\n\nEnsure the proxy is running and Codex config/cache are current.");
-      break;
-    case "sync":
-      console.log("Usage: ocx sync\n\nFetch provider models and inject them into Codex config.");
-      break;
-    case "sync-cache":
-      console.log("Usage: ocx sync-cache\n\nRefresh Codex's model cache from the active catalog.");
-      break;
-    case "status":
-      console.log("Usage: ocx status\n\nCheck proxy server status.");
-      break;
-    case "login":
-      console.log("Usage: ocx login <provider>\n\nOAuth or API-key login for a provider.");
-      break;
-    case "logout":
-      console.log("Usage: ocx logout <provider>\n\nRemove a stored provider login.");
-      break;
-    case "gui":
-      console.log("Usage: ocx gui\n\nOpen the opencodex dashboard.");
-      break;
-    case "update":
-      console.log("Usage: ocx update\n\nUpdate opencodex to the latest published version.");
-      break;
-    default:
-      printUsage();
-  }
+if (command === "help" && args[1]) {
+  printSubcommandUsage(args[1]);
+  process.exit(0);
 }
 
 if (command !== undefined && command !== "help" && hasHelpFlag(args.slice(1))) {
@@ -131,10 +65,15 @@ async function syncModelsToCodex(port?: number) {
 }
 
 function parsePortOption(): number | undefined {
+  if (args.length === 1) return undefined;
+  if (args.length !== 3 || args[1] !== "--port") {
+    console.error("Usage: ocx start [--port <port>]");
+    process.exit(1);
+  }
   const portIdx = args.indexOf("--port");
   if (portIdx === -1) return undefined;
   const value = args[portIdx + 1];
-  const port = value ? parseInt(value, 10) : NaN;
+  const port = value && /^\d+$/.test(value) ? Number(value) : NaN;
   if (!Number.isInteger(port) || port <= 0 || port > 65535) {
     console.error("Invalid port number");
     process.exit(1);
@@ -142,15 +81,12 @@ function parsePortOption(): number | undefined {
   return port;
 }
 
-function healthHost(hostname?: string): string {
-  return !hostname || hostname === "0.0.0.0" || hostname === "::" ? "127.0.0.1" : hostname;
-}
-
 async function proxyHealthy(port?: number): Promise<boolean> {
   const config = loadConfig();
   const p = port ?? config.port ?? 10100;
   try {
-    const res = await fetch(`http://${healthHost(config.hostname)}:${p}/healthz`, {
+    const hostname = !config.hostname || config.hostname === "0.0.0.0" || config.hostname === "::" ? "127.0.0.1" : config.hostname;
+    const res = await fetch(`http://${hostname}:${p}/healthz`, {
       signal: AbortSignal.timeout(750),
     });
     return res.ok;
@@ -185,6 +121,7 @@ async function chooseListenPort(requestedPort?: number): Promise<number> {
 }
 
 async function handleStart(options: { block?: boolean } = {}) {
+  const requestedPort = parsePortOption();
   reconcileJournal();
   const existingPid = readPid();
   if (existingPid) {
@@ -196,20 +133,21 @@ async function handleStart(options: { block?: boolean } = {}) {
     removePid(existingPid);
   }
 
-  const requestedPort = parsePortOption();
   const port = await chooseListenPort(requestedPort);
 
   const server = startServer(port);
   writePid(process.pid);
-  writeJournal();
 
   const config = loadConfig();
+  writeRuntimePort({ pid: process.pid, port, hostname: config.hostname });
+  writeJournal();
 
   let cleaned = false;
   const syncCleanup = () => {
     if (cleaned) return;
     cleaned = true;
     removePid(process.pid);
+    removeRuntimePort(process.pid);
     if (!process.env.OCX_SERVICE) { try { restoreNativeCodex(); } catch { /* best-effort restore */ } }
   };
 
@@ -269,41 +207,6 @@ async function handleEnsure() {
   console.log(`✅ Proxy running on port ${config.port ?? port}`);
 }
 
-function killProxy(pid: number): void {
-  if (!isProcessAlive(pid)) return;
-  if (process.platform === "win32") {
-    const taskkill = `${process.env.SystemRoot ?? "C:\\Windows"}\\System32\\taskkill.exe`;
-    try {
-      execFileSync(taskkill, ["/PID", String(pid), "/T", "/F"], { stdio: "pipe" });
-    } catch (err) {
-      if (isProcessAlive(pid)) throw err;
-    }
-  } else {
-    process.kill(pid, "SIGTERM");
-    if (!waitForExit(pid, 5000)) process.kill(pid, "SIGKILL");
-  }
-  if (!waitForExit(pid, 5000)) throw new Error(`process ${pid} did not exit`);
-}
-
-function isProcessAlive(pid: number): boolean {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-function waitForExit(pid: number, timeoutMs: number): boolean {
-  const deadline = Date.now() + timeoutMs;
-  const marker = new Int32Array(new SharedArrayBuffer(4));
-  while (Date.now() < deadline) {
-    if (!isProcessAlive(pid)) return true;
-    Atomics.wait(marker, 0, 0, 50);
-  }
-  return !isProcessAlive(pid);
-}
-
 function handleStop() {
   const stoppedService = stopServiceIfInstalled();
   if (stoppedService) console.log("🛑 Service manager stopped (won't respawn).");
@@ -315,6 +218,7 @@ function handleStop() {
       killProxy(pid);
       console.log(`✅ Proxy (PID ${pid}) stopped.`);
       removePid(pid);
+      removeRuntimePort(pid);
     } catch {
       stopFailed = true;
       console.error(`❌ Failed to stop proxy (PID ${pid}).`);
@@ -341,19 +245,19 @@ async function handleUninstall() {
     }
   };
 
-  runStep("service removed", () => {
-    stopServiceIfInstalled();
-    return uninstallServiceIfInstalled();
-  });
+  runStep("service stopped", () => stopServiceIfInstalled());
 
   runStep("proxy stopped", () => {
     const pid = readPid();
     if (!pid) return false;
     killProxy(pid);
     removePid(pid);
+    removeRuntimePort(pid);
     return true;
   });
 
+  runStep("service removed", () => uninstallServiceIfInstalled());
+
   runStep("native Codex restored", () => {
     const r = restoreNativeCodex();
     if (!r.success) throw new Error(r.message);
@@ -368,9 +272,13 @@ async function handleUninstall() {
     console.error(`⚠️  Codex autostart shim removed failed: ${err instanceof Error ? err.message : String(err)}`);
   }
 
-  runStep("opencodex config removed", () => {
-    rmSync(getConfigDir(), { recursive: true, force: true });
-  });
+  if (failures.length === 0) {
+    runStep("opencodex config removed", () => {
+      rmSync(getConfigDir(), { recursive: true, force: true });
+    });
+  } else {
+    console.error("Leaving opencodex config/backups in place so the failed restore step can be retried.");
+  }
 
   if (failures.length > 0) {
     console.error(`\nUninstall finished with ${failures.length} failed step(s): ${failures.join(", ")}`);
@@ -379,56 +287,35 @@ async function handleUninstall() {
   console.log("\n✅ opencodex local state removed. Remove the package with: npm uninstall -g @bitkyc08/opencodex");
 }
 
-type HealthCheck = {
-  ok: boolean;
-  label: string;
-};
+async function handleStatus() {
+  const statusArgs = args.slice(1);
+  const wantsJson = statusArgs.length === 1 && statusArgs[0] === "--json";
+  if (statusArgs.length > 1 || (statusArgs.length === 1 && !wantsJson)) {
+    console.error("Usage: ocx status [--json]");
+    process.exit(1);
+  }
 
-async function checkProxyHealth(port: number, hostname?: string): Promise<HealthCheck> {
-  const url = `http://${healthHost(hostname)}:${port}/healthz`;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 800);
-  try {
-    const response = await fetch(url, { signal: controller.signal });
-    if (!response.ok) return { ok: false, label: `${url} returned HTTP ${response.status}` };
-    const body = await response.json().catch(() => null) as { version?: unknown; uptime?: unknown } | null;
-    const version = typeof body?.version === "string" ? ` v${body.version}` : "";
-    const uptime = typeof body?.uptime === "number" ? `, uptime ${Math.round(body.uptime)}s` : "";
-    return { ok: true, label: `${url} ok${version}${uptime}` };
-  } catch (error) {
-    const reason = error instanceof Error && error.name === "AbortError" ? "timed out" : "unreachable";
-    return { ok: false, label: `${url} ${reason}` };
-  } finally {
-    clearTimeout(timer);
+  const status = await collectStatus();
+  if (wantsJson) {
+    console.log(JSON.stringify(status.json, null, 2));
+    return;
   }
-}
 
-async function handleStatus() {
-  const config = loadConfig();
-  const port = config.port ?? 10100;
-  const pid = readPid();
-  const health = await checkProxyHealth(port, config.hostname);
-  const proxyLabel = pid && health.ok
-    ? `running (PID ${pid})`
-    : pid
-      ? `PID file points to PID ${pid}, but health check failed`
-      : health.ok
-        ? "reachable, but PID file is missing or stale"
-        : "not running";
-
-  if (pid || health.ok) {
-    console.log(`✅ Proxy: ${proxyLabel}`);
+  if (status.json.proxy.pid || status.json.proxy.health.ok) {
+    console.log(`✅ Proxy: ${status.proxyLabel}`);
   } else {
-    console.log(`❌ Proxy: ${proxyLabel}`);
+    console.log(`❌ Proxy: ${status.proxyLabel}`);
   }
-  console.log(`   Health: ${health.label}`);
-  console.log(`   Dashboard: http://localhost:${port}/`);
-  console.log(`   Config: ${getConfigPath()}`);
-  console.log(`   Default provider: ${config.defaultProvider}`);
-  console.log(`   Codex autostart: ${codexAutoStartEnabled(config) ? "enabled" : "disabled"}`);
-  console.log(`   Service: ${serviceStatusSummary()}`);
-  const { codexShimStatus } = await import("./codex-shim");
-  console.log(`   ${codexShimStatus()}`);
+  console.log(`   Health: ${status.healthLabel}`);
+  console.log(`   Dashboard: ${status.json.dashboard.url}`);
+  console.log(`   Config: ${status.json.paths.config}`);
+  console.log(`   PID file: ${status.json.paths.pid}`);
+  console.log(`   Runtime: ${status.json.paths.runtime}`);
+  console.log(`   Runtime source: ${status.json.runtime.source}${status.json.runtime.overrideEnv ? ` (${status.json.runtime.overrideEnv})` : ""}`);
+  console.log(`   Default provider: ${status.json.defaultProvider}`);
+  console.log(`   Codex autostart: ${status.json.codexAutostart ? "enabled" : "disabled"}`);
+  console.log(`   Service: ${status.json.service.summary}`);
+  console.log(`   ${status.json.codexShim.summary}`);
 }
 
 function handleRecoverHistory() {
@@ -497,8 +384,8 @@ switch (command) {
   case "gui": {
     const cfg = await import("./config");
     const config = cfg.loadConfig();
-    const guiUrl = `http://localhost:${config.port}`;
-    if (!cfg.readPid()) {
+    let pid = cfg.readPid();
+    if (!pid) {
       console.log("Proxy not running. Starting...");
       const child = spawn(process.execPath, [process.argv[1], "start"], {
         detached: true,
@@ -508,7 +395,11 @@ switch (command) {
       });
       child.unref();
       await new Promise(r => setTimeout(r, 1000));
+      pid = cfg.readPid();
     }
+    const runtimePort = pid ? cfg.readRuntimePort(pid) : null;
+    const guiPort = runtimePort?.port ?? config.port;
+    const guiUrl = `http://localhost:${guiPort}`;
     console.log(`Opening ${guiUrl}`);
     const { openUrl } = await import("./open-url");
     openUrl(guiUrl);
@@ -535,7 +426,7 @@ switch (command) {
         break;
       }
       default:
-        console.error("Usage: ocx codex-shim <install|status|uninstall>");
+        console.error("Usage: ocx codex-shim <install|status|uninstall|remove>");
         process.exit(1);
     }
     break;

package/src/codex-account-store.ts

@@ -1,7 +1,7 @@
 import { createHash } from "node:crypto";
 import { closeSync, existsSync, readFileSync, mkdirSync, openSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { getConfigDir, atomicWriteFile, hardenConfigDir, hardenExistingSecret } from "./config";
+import { getConfigDir, atomicWriteFile, backupInvalidConfig, hardenConfigDir, hardenExistingSecret } from "./config";
 import type { CodexAccountCredentialRecord, CodexAccountCredentials } from "./types";
 
 type LegacyCodexAccountStore = Record<string, CodexAccountCredentials>;
@@ -87,6 +87,7 @@ function loadCodexAccountRecordStore(): CodexAccountStore {
     }
     return normalized;
   } catch {
+    backupInvalidConfig(path);
     return {};
   }
 }
@@ -145,10 +146,13 @@ export function saveCodexAccountCredentialIfGeneration(
   if (!current || current.generation !== generation || current.deletedAt != null || !current.credential) {
     return false;
   }
+  const refreshGrantFingerprint = current.credential.refreshToken === cred.refreshToken
+    ? current.refreshGrantFingerprint ?? refreshGrantFingerprintForToken(cred.refreshToken)
+    : refreshGrantFingerprintForToken(cred.refreshToken);
   store[id] = {
     credential: cred,
     generation: generation + 1,
-    refreshGrantFingerprint: current.refreshGrantFingerprint ?? refreshGrantFingerprintForToken(current.credential.refreshToken),
+    refreshGrantFingerprint,
     replacedAt: current.replacedAt,
   };
   persist(store);
@@ -191,7 +195,8 @@ export class CodexCredentialRefreshLockTimeoutError extends Error {
 }
 
 type CodexTokenResult = { accessToken: string; chatgptAccountId: string; generation: number };
-const refreshLocks = new Map<string, Promise<CodexTokenResult>>();
+type CodexRefreshResult = CodexTokenResult & { credential?: CodexAccountCredentials };
+const refreshLocks = new Map<string, Promise<CodexRefreshResult>>();
 
 function codexRefreshLockPath(lockKey: string): string {
   const digest = createHash("sha256").update(lockKey).digest("hex").slice(0, 32);
@@ -283,22 +288,50 @@ export async function getValidCodexToken(id: string): Promise<CodexTokenResult>
 
   const existing = refreshLocks.get(refreshGrantFingerprint);
   if (existing) {
-    await existing;
+    const refreshed = await existing;
+    const current = readCodexAccountRecord(id);
+    const currentCred = current?.deletedAt == null ? current?.credential : undefined;
+    if (
+      current &&
+      currentCred &&
+      refreshed.credential &&
+      recordGrantFingerprint(current) === refreshGrantFingerprint
+    ) {
+      if (!saveCodexAccountCredentialIfGeneration(id, current.generation, refreshed.credential)) {
+        throw new CodexCredentialGenerationConflictError();
+      }
+      return {
+        accessToken: refreshed.credential.accessToken,
+        chatgptAccountId: refreshed.credential.chatgptAccountId,
+        generation: current.generation + 1,
+      };
+    }
     return getValidCodexToken(id);
   }
 
-  const refreshPromise = withCodexRefreshFileLock(refreshGrantFingerprint, async (): Promise<CodexTokenResult> => {
+  const refreshPromise = withCodexRefreshFileLock(refreshGrantFingerprint, async (): Promise<CodexRefreshResult> => {
     const lockedRecord = readCodexAccountRecord(id);
     const lockedCred = lockedRecord?.deletedAt == null ? lockedRecord?.credential : undefined;
     if (!lockedRecord || !lockedCred) throw new CodexCredentialGenerationConflictError();
     const startGeneration = lockedRecord.generation;
     const lockedRefreshGrantFingerprint = recordGrantFingerprint(lockedRecord);
-    if (lockedRefreshGrantFingerprint !== refreshGrantFingerprint) throw new CodexCredentialGenerationConflictError();
+    if (lockedRefreshGrantFingerprint !== refreshGrantFingerprint) {
+      if (lockedCred.expiresAt > Date.now() + REFRESH_SKEW_MS) {
+        return {
+          accessToken: lockedCred.accessToken,
+          chatgptAccountId: lockedCred.chatgptAccountId,
+          generation: startGeneration,
+          credential: lockedCred,
+        };
+      }
+      throw new CodexCredentialGenerationConflictError();
+    }
     if (lockedCred.expiresAt > Date.now() + REFRESH_SKEW_MS) {
       return {
         accessToken: lockedCred.accessToken,
         chatgptAccountId: lockedCred.chatgptAccountId,
         generation: startGeneration,
+        credential: lockedCred,
       };
     }
     const sameGrantFreshCredential = findFreshCredentialForGrant(refreshGrantFingerprint, id);
@@ -310,6 +343,7 @@ export async function getValidCodexToken(id: string): Promise<CodexTokenResult>
         accessToken: sameGrantFreshCredential.accessToken,
         chatgptAccountId: sameGrantFreshCredential.chatgptAccountId,
         generation: startGeneration + 1,
+        credential: sameGrantFreshCredential,
       };
     }
     const res = await fetch(CHATGPT_TOKEN_URL, {
@@ -345,11 +379,16 @@ export async function getValidCodexToken(id: string): Promise<CodexTokenResult>
     if (!saveCodexAccountCredentialIfGeneration(id, startGeneration, updated)) {
       throw new CodexCredentialGenerationConflictError();
     }
-    return { accessToken: updated.accessToken, chatgptAccountId: updated.chatgptAccountId, generation: startGeneration + 1 };
+    return { accessToken: updated.accessToken, chatgptAccountId: updated.chatgptAccountId, generation: startGeneration + 1, credential: updated };
   }).finally(() => {
     refreshLocks.delete(refreshGrantFingerprint);
   });
 
   refreshLocks.set(refreshGrantFingerprint, refreshPromise);
-  return refreshPromise;
+  const result = await refreshPromise;
+  return {
+    accessToken: result.accessToken,
+    chatgptAccountId: result.chatgptAccountId,
+    generation: result.generation,
+  };
 }