@bitkyc08/opencodex 2.5.6 → 2.6.0

package/src/codex-auth-api.ts

@@ -26,7 +26,7 @@ export { clearAccountQuota, getAccountQuota, parseUsageQuota, updateAccountQuota
 import { extractAccountId, decodeJwtPayload } from "./oauth/chatgpt";
 import { maskEmail } from "./privacy";
 export { maskEmail } from "./privacy";
-import type { OcxConfig } from "./types";
+import type { CodexAccount, OcxConfig } from "./types";
 
 function jsonResponse(data: unknown, status = 200): Response {
   return new Response(JSON.stringify(data), {
@@ -40,6 +40,92 @@ const MANUAL_IMPORT_ENV = "OPENCODEX_ENABLE_UNVERIFIED_CODEX_IMPORT";
 
 const codexAuthLoginState = new Map<string, { status: string; accountId?: string; email?: string; error?: string; doneAt?: number }>();
 
+function configuredPoolAccount(config: OcxConfig, accountId: string): CodexAccount | null {
+  if (!ACCOUNT_ID_RE.test(accountId)) return null;
+  return (config.codexAccounts ?? []).find(account => account.id === accountId && !account.isMain) ?? null;
+}
+
+function isThirtyDayOnlyPlan(plan: string | null | undefined): boolean {
+  const normalized = plan?.trim().toLowerCase();
+  return normalized === "go" || normalized === "free";
+}
+
+function quotaForPlan<T extends Omit<StoredAccountQuota, "updatedAt"> | StoredAccountQuota | null>(
+  quota: T,
+  plan: string | null | undefined,
+): T {
+  if (!quota || !isThirtyDayOnlyPlan(plan)) return quota;
+  return {
+    ...(quota.monthlyPercent !== undefined ? { monthlyPercent: quota.monthlyPercent } : {}),
+    ...(quota.monthlyResetAt !== undefined ? { monthlyResetAt: quota.monthlyResetAt } : {}),
+    ...(quota.resetCredits !== undefined ? { resetCredits: quota.resetCredits } : {}),
+    ...("updatedAt" in quota ? { updatedAt: quota.updatedAt } : {}),
+  } as T;
+}
+
+function poolAccountDto(
+  account: CodexAccount,
+  quotaResult: PoolQuotaResult,
+  hasCredential: boolean,
+): Record<string, unknown> {
+  const quota = quotaForPlan(quotaResult.quota, account.plan);
+  return {
+    id: account.id,
+    email: maskEmail(account.email) ?? account.email,
+    ...(account.plan !== undefined ? { plan: account.plan } : {}),
+    ...(account.logLabel !== undefined ? { logLabel: account.logLabel } : {}),
+    isMain: false,
+    quota: quota ? { ...quota } : null,
+    needsReauth: !hasCredential || quotaResult.needsReauth || isAccountNeedsReauth(account.id),
+    hasCredential,
+  };
+}
+
+async function resolveResetCreditAuth(
+  runtimeConfig: OcxConfig,
+  accountId: string,
+): Promise<
+  | { ok: true; isMain: boolean; accessToken: string; chatgptAccountId: string }
+  | { ok: false; response: Response }
+> {
+  if (accountId === "__main__") {
+    const tokens = readCodexTokens();
+    if (!tokens) return { ok: false, response: jsonResponse({ error: "Main Codex account not logged in" }, 401) };
+    return { ok: true, isMain: true, accessToken: tokens.access_token, chatgptAccountId: tokens.account_id };
+  }
+  if (!ACCOUNT_ID_RE.test(accountId)) {
+    return { ok: false, response: jsonResponse({ error: "Invalid account id format" }, 400) };
+  }
+  if (!configuredPoolAccount(runtimeConfig, accountId)) {
+    return { ok: false, response: jsonResponse({ error: "Unknown Codex account" }, 404) };
+  }
+  const cred = await getValidCodexToken(accountId);
+  return { ok: true, isMain: false, accessToken: cred.accessToken, chatgptAccountId: cred.chatgptAccountId };
+}
+
+function safeResetCreditsDto(input: unknown): { credits: { granted_at: string; expires_at: string }[]; available_count?: number } {
+  const obj = typeof input === "object" && input !== null ? input as Record<string, unknown> : {};
+  const rawCredits = Array.isArray(obj.credits) ? obj.credits : [];
+  const credits = rawCredits.flatMap((raw): { granted_at: string; expires_at: string }[] => {
+    if (typeof raw !== "object" || raw === null) return [];
+    const credit = raw as Record<string, unknown>;
+    return typeof credit.granted_at === "string" && typeof credit.expires_at === "string"
+      ? [{ granted_at: credit.granted_at, expires_at: credit.expires_at }]
+      : [];
+  });
+  const rawAvailable = (obj.rate_limit_reset_credits as { available_count?: unknown } | null | undefined)?.available_count
+    ?? obj.available_count;
+  return {
+    credits,
+    ...(typeof rawAvailable === "number" && Number.isFinite(rawAvailable) ? { available_count: rawAvailable } : {}),
+  };
+}
+
+function safeResetCreditConsumeDto(input: unknown): { code: string } {
+  const obj = typeof input === "object" && input !== null ? input as Record<string, unknown> : {};
+  return { code: typeof obj.code === "string" ? obj.code : "unknown" };
+}
+
 export function isUnverifiedCodexImportEnabled(): boolean {
   return process.env[MANUAL_IMPORT_ENV] === "1";
 }
@@ -127,7 +213,7 @@ interface PoolQuotaResult {
   needsReauth: boolean;
 }
 
-async function fetchPoolAccountQuota(accountId: string, forceRefresh = false): Promise<PoolQuotaResult> {
+async function fetchPoolAccountQuota(accountId: string, forceRefresh = false, configuredPlan?: string): Promise<PoolQuotaResult> {
   const existing = getAccountQuota(accountId);
   if (!forceRefresh && existing && Date.now() - existing.updatedAt < POOL_CACHE_TTL) {
     return { quota: existing, needsReauth: false };
@@ -140,7 +226,7 @@ async function fetchPoolAccountQuota(accountId: string, forceRefresh = false): P
     });
     if (!resp.ok) return { quota: existing ?? null, needsReauth: resp.status === 401 };
     const data = (await resp.json()) as WhamUsageResponse;
-    const quota = parseUsageQuota(data);
+    const quota = parseUsageQuota({ ...data, plan_type: data.plan_type ?? configuredPlan });
     if (!quota) return { quota: existing ?? null, needsReauth: false };
     updateAccountQuota(
       accountId,
@@ -174,15 +260,9 @@ export async function handleCodexAuthAPI(
     const withQuota = await mapWithConcurrency(poolAccounts, POOL_QUOTA_REFRESH_CONCURRENCY, async a => {
       const cred = getCodexAccountCredential(a.id);
       const quotaResult = cred
-        ? await fetchPoolAccountQuota(a.id, forceRefresh)
+        ? await fetchPoolAccountQuota(a.id, forceRefresh, a.plan)
         : { quota: null, needsReauth: true };
-      return {
-        ...a,
-        email: maskEmail(a.email) ?? a.email,
-        quota: quotaResult.quota ? { ...quotaResult.quota } : null,
-        needsReauth: !cred || quotaResult.needsReauth || isAccountNeedsReauth(a.id),
-        hasCredential: !!cred,
-      };
+      return poolAccountDto(a, quotaResult, !!cred);
     });
     const main = {
       id: "__main__",
@@ -190,7 +270,7 @@ export async function handleCodexAuthAPI(
       plan: mainInfo.plan,
       isMain: true,
       hasCredential: true,
-      quota: mainInfo.quota ? { ...mainInfo.quota, updatedAt: Date.now() } : null,
+      quota: mainInfo.quota ? { ...quotaForPlan({ ...mainInfo.quota, updatedAt: Date.now() }, mainInfo.plan) } : null,
     };
     return jsonResponse({ accounts: [main, ...withQuota] });
   }
@@ -301,39 +381,27 @@ export async function handleCodexAuthAPI(
     const accountId = url.searchParams.get("accountId");
     if (!accountId) return jsonResponse({ error: "accountId required" }, 400);
 
-    const isMain = accountId === "__main__";
-    let accessToken: string;
-    let chatgptAccountId: string;
-
     try {
-      if (isMain) {
-        const tokens = readCodexTokens();
-        if (!tokens) return jsonResponse({ error: "Main Codex account not logged in" }, 401);
-        accessToken = tokens.access_token;
-        chatgptAccountId = tokens.account_id;
-      } else {
-        const cred = await getValidCodexToken(accountId);
-        accessToken = cred.accessToken;
-        chatgptAccountId = cred.chatgptAccountId;
-      }
+      const auth = await resolveResetCreditAuth(getRuntimeConfig(config), accountId);
+      if (!auth.ok) return auth.response;
 
       const resp = await fetch(
         "https://chatgpt.com/backend-api/wham/rate-limit-reset-credits",
         {
           headers: {
-            Authorization: `Bearer ${accessToken}`,
-            "ChatGPT-Account-Id": chatgptAccountId,
+            Authorization: `Bearer ${auth.accessToken}`,
+            "ChatGPT-Account-Id": auth.chatgptAccountId,
           },
           signal: AbortSignal.timeout(8000),
         },
       );
       if (!resp.ok) {
-        const text = await resp.text().catch(() => "");
-        return jsonResponse({ error: `Upstream error ${resp.status}`, detail: text }, resp.status);
+        await resp.body?.cancel().catch(() => {});
+        return jsonResponse({ error: `Upstream error ${resp.status}` }, resp.status);
       }
-      return jsonResponse(await resp.json());
+      return jsonResponse(safeResetCreditsDto(await resp.json()));
     } catch (e) {
-      return jsonResponse({ error: String(e) }, 500);
+      return jsonResponse({ error: e instanceof Error ? e.message : "Reset credit lookup failed" }, 500);
     }
   }
 
@@ -341,21 +409,9 @@ export async function handleCodexAuthAPI(
     const body = (await req.json().catch(() => ({}))) as { accountId?: string };
     if (!body.accountId) return jsonResponse({ error: "accountId required" }, 400);
 
-    const isMain = body.accountId === "__main__";
-    let accessToken: string;
-    let chatgptAccountId: string;
-
     try {
-      if (isMain) {
-        const tokens = readCodexTokens();
-        if (!tokens) return jsonResponse({ error: "Main Codex account not logged in" }, 401);
-        accessToken = tokens.access_token;
-        chatgptAccountId = tokens.account_id;
-      } else {
-        const cred = await getValidCodexToken(body.accountId);
-        accessToken = cred.accessToken;
-        chatgptAccountId = cred.chatgptAccountId;
-      }
+      const auth = await resolveResetCreditAuth(getRuntimeConfig(config), body.accountId);
+      if (!auth.ok) return auth.response;
 
       const idempotencyKey = crypto.randomUUID();
       const resp = await fetch(
@@ -363,8 +419,8 @@ export async function handleCodexAuthAPI(
         {
           method: "POST",
           headers: {
-            Authorization: `Bearer ${accessToken}`,
-            "ChatGPT-Account-Id": chatgptAccountId,
+            Authorization: `Bearer ${auth.accessToken}`,
+            "ChatGPT-Account-Id": auth.chatgptAccountId,
             "Content-Type": "application/json",
           },
           body: JSON.stringify({ redeem_request_id: idempotencyKey }),
@@ -372,20 +428,21 @@ export async function handleCodexAuthAPI(
         },
       );
       if (!resp.ok) {
-        const text = await resp.text().catch(() => "");
-        return jsonResponse({ error: `Upstream error ${resp.status}`, detail: text }, resp.status);
+        await resp.body?.cancel().catch(() => {});
+        return jsonResponse({ error: `Upstream error ${resp.status}` }, resp.status);
       }
-      const result = (await resp.json()) as { code: string };
+      const result = safeResetCreditConsumeDto(await resp.json());
       if (result.code === "reset") {
-        if (isMain) {
+        if (auth.isMain) {
           await fetchMainAccountInfo(true);
         } else {
-          await fetchPoolAccountQuota(body.accountId, true);
+          const account = configuredPoolAccount(getRuntimeConfig(config), body.accountId);
+          await fetchPoolAccountQuota(body.accountId, true, account?.plan);
         }
       }
       return jsonResponse(result);
     } catch (e) {
-      return jsonResponse({ error: String(e) }, 500);
+      return jsonResponse({ error: e instanceof Error ? e.message : "Reset credit consume failed" }, 500);
     }
   }
 

package/src/codex-auth-collision.ts

@@ -44,6 +44,11 @@ export function checkAccountIdCollision(
   email?: string | null,
   plan?: string | null,
 ): { collision: true; reason: string } | { collision: false } {
+  const mainAccountId = getMainChatgptAccountId();
+  if (mainAccountId && mainAccountId === chatgptAccountId) {
+    return { collision: true, reason: "Account is already used by the main Codex login." };
+  }
+
   const candidateEmail = normalizedEmail(email);
   const candidateWorkspace = isWorkspacePlan(plan);
   for (const account of loadConfig().codexAccounts ?? []) {

package/src/codex-catalog.ts

@@ -311,7 +311,7 @@ function loadCatalogForSync(path: string): RawCatalog | null {
   const catalog = readCatalog(path);
   if (catalog && findNativeTemplate(catalog)) return catalog;
   return readCatalog(catalogBackupPathFor(path))
-    ?? readCatalog(legacyCatalogBackupPath())
+    ?? (isDefaultCatalogPath(path) ? readCatalog(legacyCatalogBackupPath()) : null)
     ?? readCatalog(CODEX_MODELS_CACHE_PATH)
     ?? materializeBundledCodexCatalog(path)
     ?? catalog;
@@ -332,8 +332,7 @@ function readCurrentCatalogOrCache(): RawCatalog | null {
 export function loadCatalogTemplate(): RawEntry | null {
   const catalogPath = readCodexCatalogPath();
   const native = findNativeTemplate(readCatalog(catalogPath))
-    ?? findNativeTemplate(readCatalog(catalogBackupPathFor(catalogPath)))
-    ?? findNativeTemplate(readCatalog(legacyCatalogBackupPath()))
+    ?? findNativeTemplate(readCatalogBackup(catalogPath))
     ?? findNativeTemplate(readCatalog(CODEX_MODELS_CACHE_PATH))
     ?? findNativeTemplate(loadBundledCodexCatalog());
   return native ? JSON.parse(JSON.stringify(native)) : null;
@@ -463,7 +462,8 @@ export function listCatalogNativeSlugs(): string[] {
  * (rather than the modified value left in the live catalog by a previous sync).
  */
 function readCatalogBackup(catalogPath: string): RawCatalog | null {
-  return readCatalog(catalogBackupPathFor(catalogPath)) ?? readCatalog(legacyCatalogBackupPath());
+  return readCatalog(catalogBackupPathFor(catalogPath))
+    ?? (isDefaultCatalogPath(catalogPath) ? readCatalog(legacyCatalogBackupPath()) : null);
 }
 
 function catalogHasRoutedEntries(catalog: RawCatalog | null): boolean {
@@ -486,7 +486,7 @@ function ensureCatalogBackup(catalogPath: string, catalog: RawCatalog): void {
   const dir = getConfigDir();
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
   writePristineCatalogBackup(catalogBackupPathFor(catalogPath), catalogPath, catalog);
-  writePristineCatalogBackup(legacyCatalogBackupPath(), catalogPath, catalog);
+  if (isDefaultCatalogPath(catalogPath)) writePristineCatalogBackup(legacyCatalogBackupPath(), catalogPath, catalog);
 }
 
 function readNativeBaseline(catalogPath: string): Map<string, number> {
@@ -695,7 +695,6 @@ export async function syncCatalogModels(config: OcxConfig): Promise<{ added: num
   const template = findNativeTemplate(catalog);
 
   const goModels = await gatherRoutedModels(config);
-  if (goModels.length === 0) return { added: 0, path: catalogPath };
   try {
     // Once-only: preserve the PRISTINE pre-opencodex catalog as the native-priority baseline
     // (later syncs would otherwise overwrite it with featured-modified priorities).
@@ -719,7 +718,12 @@ export async function syncCatalogModels(config: OcxConfig): Promise<{ added: num
     .filter(m => typeof m.slug === "string" && !(m.slug as string).includes("/") && !goIds.has(m.slug as string))
     .map(m => {
       const slug = m.slug as string;
-      const priority = rank.has(slug) ? rank.get(slug)! : (baseline.get(slug) ?? (m.priority as number));
+      const baselinePriority = baseline.get(slug) ?? (m.priority as number);
+      const priority = rank.has(slug)
+        ? rank.get(slug)!
+        : featured.length > 0
+          ? Math.max(typeof baselinePriority === "number" ? baselinePriority : 9, featured.length + 100)
+          : baselinePriority;
       return normalizeServiceTiers({ ...m, priority });
     });
   // Central WS capability override on the FINAL on-disk catalog (the file Codex reads). Applies to
@@ -746,11 +750,19 @@ export function restoreCodexCatalog(): { removed: number; kept: number; path: st
   const catalogPath = readCodexCatalogPath();
   const catalog = readCatalog(catalogPath);
   if (!catalog || !Array.isArray(catalog.models)) return { removed: 0, kept: 0, path: catalogPath };
-  const exactBackup = readCatalog(catalogBackupPathFor(catalogPath));
-  if (exactBackup && Array.isArray(exactBackup.models)) {
-    const removed = Math.max(0, catalog.models.length - exactBackup.models.length);
-    atomicWriteFile(catalogPath, JSON.stringify(exactBackup, null, 2) + "\n");
-    return { removed, kept: exactBackup.models.length, path: catalogPath };
+  const backup = readCatalogBackup(catalogPath);
+  if (backup && Array.isArray(backup.models)) {
+    const removed = (catalog.models ?? []).filter(m => typeof m.slug === "string" && m.slug.includes("/")).length;
+    const backupSlugs = new Set(backup.models.flatMap(m => typeof m.slug === "string" ? [m.slug] : []));
+    const userNativeAdditions = (catalog.models ?? []).filter(m =>
+      typeof m.slug === "string" && !m.slug.includes("/") && !backupSlugs.has(m.slug)
+    );
+    const restored = {
+      ...backup,
+      models: [...backup.models, ...userNativeAdditions],
+    };
+    atomicWriteFile(catalogPath, JSON.stringify(restored, null, 2) + "\n");
+    return { removed, kept: restored.models.length, path: catalogPath };
   }
   const before = catalog.models.length;
   const native = catalog.models.filter(m => !(typeof m.slug === "string" && m.slug.includes("/")));

package/src/codex-history-provider.ts

@@ -1,11 +1,17 @@
+import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, statSync, unlinkSync, utimesSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { Database } from "bun:sqlite";
 import { CODEX_HOME } from "./codex-paths";
 import { atomicWriteFile, getConfigDir } from "./config";
 
 const STATE_DB_PATH = join(CODEX_HOME, "state_5.sqlite");
-const HISTORY_BACKUP_PATH = join(getConfigDir(), "codex-history-backup.json");
+function historyBackupPathFor(stateDbPath: string): string {
+  const normalized = process.platform === "win32" ? resolve(stateDbPath).toLowerCase() : resolve(stateDbPath);
+  const id = createHash("sha256").update(normalized).digest("hex").slice(0, 16);
+  return join(getConfigDir(), `codex-history-backup-${id}.json`);
+}
+const HISTORY_BACKUP_PATH = historyBackupPathFor(STATE_DB_PATH);
 const RESUMABLE_SOURCES = ["cli", "vscode"] as const;
 
 type CodexHistoryProvider = "openai" | "opencodex";
@@ -34,6 +40,7 @@ interface BackupEntry {
 
 interface BackupManifest {
   version: 1;
+  stateDbPath?: string;
   entries: Record<string, BackupEntry>;
 }
 
@@ -43,26 +50,35 @@ interface NativeRestoreTarget {
   hasUserEvent: number;
 }
 
-function readBackup(path: string): BackupManifest {
-  if (!existsSync(path)) return { version: 1, entries: {} };
+function samePath(a: string, b: string): boolean {
+  const left = resolve(a);
+  const right = resolve(b);
+  return process.platform === "win32" ? left.toLowerCase() === right.toLowerCase() : left === right;
+}
+
+function readBackup(path: string, stateDbPath?: string): BackupManifest {
+  if (!existsSync(path)) return { version: 1, stateDbPath, entries: {} };
   try {
     const parsed = JSON.parse(readFileSync(path, "utf8")) as Partial<BackupManifest>;
     if (parsed.version !== 1 || !parsed.entries || typeof parsed.entries !== "object") {
-      return { version: 1, entries: {} };
+      return { version: 1, stateDbPath, entries: {} };
+    }
+    if (stateDbPath && typeof parsed.stateDbPath === "string" && !samePath(parsed.stateDbPath, stateDbPath)) {
+      return { version: 1, stateDbPath, entries: {} };
     }
-    return { version: 1, entries: parsed.entries };
+    return { version: 1, stateDbPath: parsed.stateDbPath ?? stateDbPath, entries: parsed.entries };
   } catch {
-    return { version: 1, entries: {} };
+    return { version: 1, stateDbPath, entries: {} };
   }
 }
 
-function writeBackup(path: string, manifest: BackupManifest): void {
+function writeBackup(path: string, manifest: BackupManifest, stateDbPath?: string): void {
   if (Object.keys(manifest.entries).length === 0) {
     if (existsSync(path)) unlinkSync(path);
     return;
   }
   mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-  atomicWriteFile(path, JSON.stringify(manifest, null, 2) + "\n");
+  atomicWriteFile(path, JSON.stringify({ ...manifest, stateDbPath: manifest.stateDbPath ?? stateDbPath }, null, 2) + "\n");
 }
 
 function rememberOriginal(manifest: BackupManifest, row: ThreadRow): void {
@@ -211,9 +227,9 @@ function syncCodexHistoryProviderUnsafe(provider: CodexHistoryProvider, stateDbP
       `)
       .all();
 
-    const manifest = readBackup(backupPath);
+    const manifest = readBackup(backupPath, stateDbPath);
     for (const row of [...openaiRows, ...execRows]) rememberOriginal(manifest, row);
-    writeBackup(backupPath, manifest);
+    writeBackup(backupPath, manifest, stateDbPath);
 
     let files = 0;
     for (const row of openaiRows) {
@@ -262,7 +278,7 @@ function syncCodexHistoryProviderUnsafe(provider: CodexHistoryProvider, stateDbP
 }
 
 function restoreCodexHistoryProvider(stateDbPath: string, backupPath: string): CodexHistorySyncResult {
-  const manifest = readBackup(backupPath);
+  const manifest = readBackup(backupPath, stateDbPath);
   const entries = Object.values(manifest.entries);
 
   const db = new Database(stateDbPath);
@@ -296,7 +312,7 @@ function restoreCodexHistoryProvider(stateDbPath: string, backupPath: string): C
       }
     });
     restore();
-    writeBackup(backupPath, { version: 1, entries: {} });
+    writeBackup(backupPath, { version: 1, stateDbPath, entries: {} }, stateDbPath);
     const ejected = ejectRemainingOpencodexHistory(db);
     return ejected.rows > 0
       ? { rows: entries.length, files: files + ejected.files, ejectedRows: ejected.rows }

package/src/codex-inject.ts

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, unlinkSync } from "node:fs";
 import { atomicWriteFile, websocketsEnabled } from "./config";
-import { removeJournal } from "./codex-journal";
+import { markJournalInjectedState, restoreJournalState, writeJournal } from "./codex-journal";
 import { restoreCodexCatalog } from "./codex-catalog";
 import { syncCodexHistoryProvider } from "./codex-history-provider";
 import { CODEX_CONFIG_PATH, CODEX_PROFILE_PATH, DEFAULT_CATALOG_PATH, parseTomlString, readRootTomlString, resolveCodexConfigPath, tomlString } from "./codex-paths";
@@ -25,16 +25,36 @@ export interface InjectCodexOptions {
  * whatever `[table]` happened to be open last (e.g. `[plugins."chrome@openai-bundled"]`), so Codex
  * never saw a global model_provider and silently fell back to the `openai` (ChatGPT) provider.
  */
-export function buildProviderTableBlock(port: number, supportsWebsockets = false): string {
+function isLoopbackHostname(hostname: string | undefined): boolean {
+  const normalized = (hostname ?? "127.0.0.1").trim().toLowerCase();
+  return normalized === "" || normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]";
+}
+
+function providerBaseHost(hostname: string | undefined): string {
+  const trimmed = (hostname ?? "127.0.0.1").trim();
+  if (isLoopbackHostname(trimmed) || trimmed === "0.0.0.0" || trimmed === "::" || trimmed === "[::]") return "localhost";
+  if (trimmed.startsWith("[") && trimmed.endsWith("]")) return trimmed;
+  return trimmed.includes(":") ? `[${trimmed}]` : trimmed;
+}
+
+function shouldInjectApiAuthHeader(config: Pick<OcxConfig, "hostname"> | undefined): boolean {
+  return !isLoopbackHostname(config?.hostname);
+}
+
+export function buildProviderTableBlock(port: number, supportsWebsockets = false, includeApiAuthHeader = false, hostname?: string): string {
+  const host = providerBaseHost(hostname);
   const lines = [
     "",
     OCX_SECTION_MARKER,
     "[model_providers.opencodex]",
     'name = "OpenCodex Proxy"',
-    `base_url = "http://localhost:${port}/v1"`,
+    `base_url = "http://${host}:${port}/v1"`,
     'wire_api = "responses"',
     "requires_openai_auth = true",
   ];
+  if (includeApiAuthHeader) {
+    lines.push('env_http_headers = { "x-opencodex-api-key" = "OPENCODEX_API_AUTH_TOKEN" }');
+  }
   if (supportsWebsockets) lines.push("supports_websockets = true");
   return lines.join("\n") + "\n";
 }
@@ -61,17 +81,6 @@ function stripExistingModelProvider(content: string): string {
   return out.join("\n");
 }
 
-function stripRootContextWindowOverrides(content: string): string {
-  const lines = content.split("\n");
-  const firstTable = lines.findIndex(l => /^\s*\[/.test(l));
-  return lines
-    .filter((line, i) => {
-      const isRoot = firstTable === -1 || i < firstTable;
-      return !isRoot || !/^\s*model_(?:context_window|auto_compact_token_limit)\s*=/.test(line);
-    })
-    .join("\n");
-}
-
 function stripRootRoutedModel(content: string): string {
   const lines = content.split("\n");
   const firstTable = lines.findIndex(l => /^\s*\[/.test(l));
@@ -142,7 +151,7 @@ function removeProfileSection(content: string): string {
       continue;
     }
     if (inProfile) {
-      if (line.startsWith("[") && line.trim() !== "[profiles.opencodex]") {
+      if (/^\s*\[/.test(line) && line.trim() !== "[profiles.opencodex]") {
         inProfile = false;
         filtered.push(line);
       }
@@ -193,14 +202,16 @@ function stripOpencodexCatalogPath(content: string): string {
     .join("\n");
 }
 
-export function buildProfileFile(port: number, catalogPath?: string | null): string {
+export function buildProfileFile(port: number, catalogPath?: string | null, supportsWebsockets = false, includeApiAuthHeader = false, hostname?: string): string {
+  const host = providerBaseHost(hostname);
   const lines = [
     "# OpenCodex proxy profile — use with: codex --profile opencodex",
-    `# Routes all model requests through the opencodex proxy at localhost:${port}`,
+    `# Routes all model requests through the opencodex proxy at ${host}:${port}`,
     'model_provider = "opencodex"',
   ];
   if (catalogPath) lines.push(`model_catalog_json = ${tomlString(catalogPath)}`);
-  lines.push("", "[features]", "fast_mode = true", "");
+  lines.push("", "[features]", "fast_mode = true");
+  lines.push(buildProviderTableBlock(port, supportsWebsockets, includeApiAuthHeader, hostname).trimEnd(), "");
   return lines.join("\n");
 }
 
@@ -221,6 +232,7 @@ export async function injectCodexConfig(port: number, config?: OcxConfig, option
     return { success: false, message: `Codex config not found at ${CODEX_CONFIG_PATH}. Is Codex installed?` };
   }
 
+  writeJournal();
   let content = readFileSync(CODEX_CONFIG_PATH, "utf-8");
 
   // Idempotent clean-up of any prior injection: drop the provider table (marker-based) and every
@@ -231,7 +243,6 @@ export async function injectCodexConfig(port: number, config?: OcxConfig, option
   }
   content = removeProfileSection(content);
   content = stripExistingModelProvider(content);
-  content = stripRootContextWindowOverrides(content);
   content = normalizeServiceTier(content);
   content = ensureFastModeFeature(content);
 
@@ -241,10 +252,12 @@ export async function injectCodexConfig(port: number, config?: OcxConfig, option
   // 1) Root key BEFORE the first table header (must be a global, not nested under a table).
   content = setRootModelProvider(content);
   // 2) Provider table appended at EOF (position-independent).
-  content = content.trimEnd() + "\n" + buildProviderTableBlock(port, websocketsEnabled(config ?? {}));
+  content = content.trimEnd() + "\n" + buildProviderTableBlock(port, websocketsEnabled(config ?? {}), shouldInjectApiAuthHeader(config), config?.hostname);
 
+  const profileContent = buildProfileFile(port, catalogPath, websocketsEnabled(config ?? {}), shouldInjectApiAuthHeader(config), config?.hostname);
   atomicWriteFile(CODEX_CONFIG_PATH, content);
-  atomicWriteFile(CODEX_PROFILE_PATH, buildProfileFile(port, catalogPath));
+  atomicWriteFile(CODEX_PROFILE_PATH, profileContent);
+  markJournalInjectedState(content, profileContent);
   const history = config?.syncResumeHistory !== false
     ? syncCodexHistoryProvider("opencodex")
     : { rows: 0, files: 0 };
@@ -279,7 +292,7 @@ function removeOcxSection(content: string): string {
     if (inOcxSection) {
       // End the injected section at the next table header that ISN'T our own — exact match so a
       // user's "[model_providers.opencodex_backup]" (or similar) is preserved, not swallowed.
-      if (line.startsWith("[") && line.trim() !== "[model_providers.opencodex]") {
+      if (/^\s*\[/.test(line) && line.trim() !== "[model_providers.opencodex]") {
         inOcxSection = false;
         filtered.push(line);
       }
@@ -293,6 +306,7 @@ function removeOcxSection(content: string): string {
 /** Pure transform: strip the opencodex provider block + `model_provider = "opencodex"` lines. */
 export function stripOpencodexConfig(content: string): string {
   let out = content;
+  const hadRootOcxProvider = readRootTomlString(out, "model_provider") === "opencodex";
   if (out.includes("[model_providers.opencodex]")) {
     out = removeOcxSection(out);
   }
@@ -300,8 +314,7 @@ export function stripOpencodexConfig(content: string): string {
   // Regex (not exact-string) removal so compact `model_provider="opencodex"` is stripped too —
   // must match the detection regex above, or a detected line could survive un-removed.
   out = out.split("\n").filter(l => !/^\s*model_provider\s*=\s*"opencodex"\s*$/.test(l)).join("\n");
-  out = stripRootContextWindowOverrides(out);
-  out = stripRootRoutedModel(out);
+  if (hadRootOcxProvider) out = stripRootRoutedModel(out);
   out = stripOpencodexCatalogPath(out);
   return out.replace(/\n{3,}/g, "\n\n").trimEnd() + "\n";
 }
@@ -310,7 +323,7 @@ function hasOpencodexRouting(content: string): boolean {
   return content.includes("[model_providers.opencodex]") || /^\s*model_provider\s*=\s*"opencodex"/m.test(content);
 }
 
-export function removeCodexConfig(): { success: boolean; message: string } {
+export function removeCodexConfig(options: { preserveProfile?: boolean } = {}): { success: boolean; message: string } {
   if (!existsSync(CODEX_CONFIG_PATH)) {
     return { success: false, message: "Codex config not found." };
   }
@@ -321,10 +334,12 @@ export function removeCodexConfig(): { success: boolean; message: string } {
   } else if (stripOpencodexConfig(content) !== content) {
     atomicWriteFile(CODEX_CONFIG_PATH, stripOpencodexConfig(content));
   }
-  if (existsSync(CODEX_PROFILE_PATH)) unlinkSync(CODEX_PROFILE_PATH);
+  if (!options.preserveProfile && existsSync(CODEX_PROFILE_PATH)) unlinkSync(CODEX_PROFILE_PATH);
   return {
     success: true,
-    message: had ? "Removed opencodex routing from Codex config + profile." : "opencodex not present in Codex config.",
+    message: had
+      ? `Removed opencodex routing from Codex config${options.preserveProfile ? "." : " + profile."}`
+      : "opencodex not present in Codex config.",
   };
 }
 
@@ -334,10 +349,12 @@ export function removeCodexConfig(): { success: boolean; message: string } {
  * handler, and `ocx restore`. Idempotent + atomic.
  */
 export function restoreNativeCodex(): { success: boolean; message: string } {
-  const cfg = removeCodexConfig();
+  const journal = restoreJournalState();
+  const cfg = journal.configRestored
+    ? { success: true, message: "Codex config restored from opencodex journal." }
+    : removeCodexConfig({ preserveProfile: journal.profileRestored || journal.profileChanged });
   const cat = restoreCodexCatalog();
   const history = syncCodexHistoryProvider("openai");
-  removeJournal();
   const msg = cat.removed > 0
     ? `${cfg.message} Catalog restored to ${cat.kept} native model(s) (dropped ${cat.removed} proxy-routed).`
     : cfg.message;