@bitkyc08/opencodex 2.6.26-preview.20260705 → 2.6.28-preview.20260707

package/src/cli/index.ts

@@ -0,0 +1,584 @@
+#!/usr/bin/env bun
+import { spawn } from "node:child_process";
+import { rmSync } from "node:fs";
+import { restoreNativeCodex, shouldInjectApiAuthHeader } from "../codex/inject";
+import { restoreLegacyOpenaiHistory } from "../codex/history-provider";
+import { writeJournal, reconcileJournal } from "../codex/journal";
+import {
+  codexAutoStartEnabled,
+  getConfigDir,
+  loadConfig,
+  readPid,
+  readPidFileValue,
+  readRuntimePort,
+  removePid,
+  removePidIfValueIs,
+  removeRuntimePort,
+  removeRuntimePortIfPidIs,
+  saveConfig,
+  writePid,
+  writeRuntimePort,
+} from "../config";
+import { collectStatus } from "./status";
+import { installCrashGuards } from "../lib/crash-guard";
+import { hasHelpFlag, printSubcommandUsage, printUsage, printVersion } from "./help";
+import { findAvailablePort, isAddrInUse, shouldPersistSelectedPort } from "../server/ports";
+import { findLiveProxy, probeHostname, type LiveProxy } from "../server/proxy-liveness";
+import { stopProxy } from "../lib/process-control";
+import { serviceCommand, serviceStatusSummary, stopServiceIfInstalled, uninstallServiceIfInstalled } from "../service";
+import { drainAndShutdown, startServer } from "../server";
+import { startTokenGuardian } from "../oauth/token-guardian";
+import { startHistoryMigrationGuardian } from "../codex/history-migration-guardian";
+import { maybeShowStarPrompt } from "./star-prompt";
+import { maybeShowUpdatePrompt } from "../update/notify";
+import { syncModelsToCodex } from "../codex/sync";
+import { normalizeUpdateChannel, runGuiUpdateWorker } from "../update/job";
+
+const args = process.argv.slice(2);
+const command = args[0];
+
+if (command === "--version" || command === "-v" || command === "version") {
+  printVersion();
+  process.exit(0);
+}
+
+if (command === "help" && args[1]) {
+  printSubcommandUsage(args[1]);
+  process.exit(0);
+}
+
+if (command !== undefined && command !== "help" && hasHelpFlag(args.slice(1))) {
+  printSubcommandUsage(command);
+  process.exit(0);
+}
+
+function parsePortOption(): number | undefined {
+  if (args.length === 1) return undefined;
+  if (args.length !== 3 || args[1] !== "--port") {
+    console.error("Usage: ocx start [--port <port>]");
+    process.exit(1);
+  }
+  const portIdx = args.indexOf("--port");
+  if (portIdx === -1) return undefined;
+  const value = args[portIdx + 1];
+  const port = value && /^\d+$/.test(value) ? Number(value) : NaN;
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) {
+    console.error("Invalid port number");
+    process.exit(1);
+  }
+  return port;
+}
+
+async function waitForProxy(timeoutMs = 8_000): Promise<LiveProxy | null> {
+  const deadline = Date.now() + timeoutMs;
+  while (Date.now() < deadline) {
+    // Runtime-state-first with identity: finds the proxy even when it started on a
+    // fallback port, and never mistakes a foreign 200 for our proxy.
+    const live = await findLiveProxy();
+    if (live) return live;
+    await new Promise(resolve => setTimeout(resolve, 150));
+  }
+  return null;
+}
+
+async function chooseListenPort(requestedPort?: number): Promise<number> {
+  const config = loadConfig();
+  const preferred = requestedPort ?? config.port ?? 10100;
+  const selected = await findAvailablePort(preferred, config.hostname ?? "127.0.0.1");
+  if (selected !== preferred) {
+    console.log(`⚠️  Port ${preferred} is busy; starting opencodex on ${selected}.`);
+  }
+  if (shouldPersistSelectedPort(config.port, selected, preferred)) {
+    config.port = selected;
+    saveConfig(config);
+  }
+  return selected;
+}
+
+async function handleStart(options: { block?: boolean } = {}) {
+  const requestedPort = parsePortOption();
+  reconcileJournal();
+  const existingPid = readPid();
+  if (existingPid) {
+    const live = await findLiveProxy();
+    if (live) {
+      console.error(`⚠️  Proxy already running (PID ${live.pid ?? existingPid}, port ${live.port}). Use 'ocx stop' first.`);
+      process.exit(1);
+    }
+    removePid(existingPid);
+  }
+
+  // Interactive-only update prompt. Must run BEFORE we bind a port / write a
+  // PID: choosing "Update now" installs globally and exits, so we never want a
+  // live daemon holding resources while it overwrites its own binary.
+  await maybeShowUpdatePrompt();
+
+  // Port selection is check-then-bind: a concurrent `ocx start`/`ensure` can win the port
+  // between the probe and Bun.serve. Retry the pick instead of dying on EADDRINUSE.
+  let port = await chooseListenPort(requestedPort);
+  let server: ReturnType<typeof startServer>;
+  for (let attempt = 0; ; attempt++) {
+    try {
+      server = startServer(port);
+      break;
+    } catch (err) {
+      if (!isAddrInUse(err) || attempt >= 2) throw err;
+      console.log(`⚠️  Port ${port} was taken while starting; picking another...`);
+      port = await chooseListenPort(requestedPort);
+    }
+  }
+  // A single request's streaming error must never crash the daemon serving every
+  // other Codex session — capture the full stack to crash.log and stay up.
+  installCrashGuards();
+  writePid(process.pid);
+
+  const config = loadConfig();
+  writeRuntimePort({ pid: process.pid, port, hostname: config.hostname });
+  writeJournal();
+
+  // Background proactive token refresh. No-op unless config.tokenGuardian.enabled; timer is unref'd
+  // so it never keeps the process alive on its own. Stopped in syncCleanup so no refresh fires mid-drain.
+  const guardian = startTokenGuardian();
+  // Design B upgrade path: keep retrying the one-time opencodex→openai history migration in the
+  // background — the first `ocx start` after an update usually races the Codex app's DB lock.
+  // Loopback-only (legacy mode still forward-tags) and respects syncResumeHistory opt-out.
+  const historyGuardian = !shouldInjectApiAuthHeader(config) && config.syncResumeHistory !== false
+    ? startHistoryMigrationGuardian()
+    : undefined;
+
+  let cleaned = false;
+  const syncCleanup = () => {
+    if (cleaned) return;
+    cleaned = true;
+    try { guardian.stop(); } catch { /* best-effort */ }
+    try { historyGuardian?.stop(); } catch { /* best-effort */ }
+    removePid(process.pid);
+    removeRuntimePort(process.pid);
+    if (!process.env.OCX_SERVICE) { try { restoreNativeCodex(); } catch { /* best-effort restore */ } }
+  };
+
+  let shuttingDown = false;
+  let shutdownStartedAt = 0;
+  // Terminal Ctrl-C delivers SIGINT to the whole foreground group AND the launcher
+  // forwards its own — two signals land within milliseconds. Treat a duplicate inside
+  // this window as the same Ctrl-C (one graceful drain); a deliberate later press
+  // escalates to an immediate force-exit ("gradual kill").
+  const FORCE_AFTER_MS = 500;
+  const shutdown = () => {
+    const now = Date.now();
+    if (shuttingDown) {
+      if (now - shutdownStartedAt < FORCE_AFTER_MS) return; // near-simultaneous duplicate — ignore
+      console.log("\n⏹  Force shutdown (second signal).");
+      try { syncCleanup(); } catch { /* best-effort */ }
+      process.exit(130);
+    }
+    shuttingDown = true;
+    shutdownStartedAt = now;
+    console.log("\n🛑 Shutting down opencodex proxy...");
+    void (async () => {
+      try {
+        await drainAndShutdown(server, config.shutdownTimeoutMs ?? 5000);
+      } finally {
+        syncCleanup(); // idempotent (cleaned-guard); also re-run by process.on("exit")
+        process.exit(0);
+      }
+    })();
+  };
+
+  process.on("SIGINT", shutdown);
+  process.on("SIGTERM", shutdown);
+  // The launcher (bin/ocx.mjs) forwards SIGHUP too (e.g. terminal close); handle it
+  // gracefully here so it drains + cleans up instead of a default immediate kill.
+  process.on("SIGHUP", shutdown);
+  process.on("exit", syncCleanup);
+
+  await maybeShowStarPrompt(); // once-only [Y/n] GitHub-star prompt on first interactive start
+  await syncModelsToCodex(port).catch(() => {});
+  if (options.block ?? true) {
+    setInterval(() => {}, 60_000);
+    await new Promise<void>(() => {});
+  }
+}
+
+async function handleEnsure() {
+  reconcileJournal();
+  const config = loadConfig();
+  if (!codexAutoStartEnabled(config)) {
+    console.log("Codex autostart is disabled.");
+    return;
+  }
+  const live = await findLiveProxy();
+  if (live) {
+    await syncModelsToCodex(live.port).catch(e => {
+      console.error(`⚠️  Model sync skipped: ${e instanceof Error ? e.message : String(e)}`);
+    });
+    console.log(`✅ Proxy running on port ${live.port}`);
+    return;
+  }
+
+  const child = spawn(process.execPath, [process.argv[1], "start"], {
+    detached: true,
+    stdio: "ignore",
+    windowsHide: true,
+    env: { ...process.env, OCX_SERVICE: "1" },
+  });
+  child.unref();
+
+  const port = (await waitForProxy())?.port;
+  if (!port) {
+    console.error("❌ Proxy did not become healthy after starting.");
+    process.exit(1);
+  }
+  // Always sync the LIVE port: after a fallback-port start, config.port still names the
+  // busy preferred port — syncing that would point Codex at a dead listener.
+  await syncModelsToCodex(port).catch(e => {
+    console.error(`⚠️  Model sync skipped: ${e instanceof Error ? e.message : String(e)}`);
+  });
+  console.log(`✅ Proxy running on port ${port}`);
+}
+
+async function handleStop() {
+  const stoppedService = stopServiceIfInstalled();
+  if (stoppedService) console.log("🛑 Service manager stopped (won't respawn).");
+
+  const pid = readPid();
+  let stopFailed = false;
+  if (pid) {
+    try {
+      // Graceful-first (management-API drain) — on Windows this is the only path where
+      // the proxy's shutdown handlers actually run; taskkill /F is the fallback inside.
+      await stopProxy(pid);
+      console.log(`✅ Proxy (PID ${pid}) stopped.`);
+      removePid(pid);
+      removeRuntimePort(pid);
+    } catch {
+      stopFailed = true;
+      console.error(`❌ Failed to stop proxy (PID ${pid}).`);
+    }
+  } else {
+    // Snapshot the stale on-disk state BEFORE the async probe: a concurrent `ocx start`
+    // can write fresh records mid-probe, and the purge below must never delete those.
+    const stalePidValue = readPidFileValue();
+    const staleRuntimePid = readRuntimePort()?.pid ?? null;
+    // Orphan recovery: a live proxy can outlive its pid file (crash, manual delete,
+    // corrupt file). Identity-checked liveness still finds it via the runtime record.
+    const live = await findLiveProxy();
+    if (live?.pid) {
+      try {
+        await stopProxy(live.pid);
+        console.log(`✅ Proxy (PID ${live.pid}) stopped.`);
+      } catch {
+        stopFailed = true;
+        console.error(`❌ Failed to stop proxy (PID ${live.pid}).`);
+      }
+    } else if (!stoppedService) {
+      console.log("No running proxy found.");
+    }
+    if (!stopFailed) {
+      // `readPid() === null` means the snapshotted pid file was absent, invalid, dead, or
+      // not ours — stale by definition. Purge (guarded by the snapshot) so `ocx update`'s
+      // stop gate can't wedge on it.
+      removePidIfValueIs(stalePidValue);
+      removeRuntimePortIfPidIs(staleRuntimePid);
+    }
+  }
+  const r = restoreNativeCodex();
+  console.log(`↩️  ${r.message}`);
+  if (stopFailed) process.exit(1);
+}
+
+async function handleUninstall() {
+  const failures: string[] = [];
+
+  const runStep = async (label: string, step: () => void | boolean | Promise<void | boolean>) => {
+    try {
+      const changed = await step();
+      if (changed === false) console.log(`- ${label}: not installed`);
+      else console.log(`✅ ${label}`);
+    } catch (err) {
+      failures.push(label);
+      console.error(`⚠️  ${label} failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  };
+
+  await runStep("service stopped", () => stopServiceIfInstalled());
+
+  await runStep("proxy stopped", async () => {
+    const pid = readPid();
+    if (!pid) return false;
+    await stopProxy(pid);
+    removePid(pid);
+    removeRuntimePort(pid);
+    return true;
+  });
+
+  await runStep("service removed", () => uninstallServiceIfInstalled());
+
+  await runStep("native Codex restored", () => {
+    const r = restoreNativeCodex();
+    if (!r.success) throw new Error(r.message);
+  });
+
+  try {
+    const { uninstallCodexShim } = await import("../codex/shim");
+    const r = uninstallCodexShim();
+    console.log(r.removed ? "✅ Codex autostart shim removed" : "- Codex autostart shim removed: not installed");
+  } catch (err) {
+    failures.push("Codex autostart shim removed");
+    console.error(`⚠️  Codex autostart shim removed failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+
+  if (failures.length === 0) {
+    await runStep("opencodex config removed", () => {
+      rmSync(getConfigDir(), { recursive: true, force: true });
+    });
+  } else {
+    console.error("Leaving opencodex config/backups in place so the failed restore step can be retried.");
+  }
+
+  if (failures.length > 0) {
+    console.error(`\nUninstall finished with ${failures.length} failed step(s): ${failures.join(", ")}`);
+    process.exit(1);
+  }
+  console.log("\n✅ opencodex local state removed. Remove the package with: npm uninstall -g @bitkyc08/opencodex");
+}
+
+async function handleStatus() {
+  const statusArgs = args.slice(1);
+  const wantsJson = statusArgs.length === 1 && statusArgs[0] === "--json";
+  if (statusArgs.length > 1 || (statusArgs.length === 1 && !wantsJson)) {
+    console.error("Usage: ocx status [--json]");
+    process.exit(1);
+  }
+
+  const status = await collectStatus();
+  if (wantsJson) {
+    console.log(JSON.stringify(status.json, null, 2));
+    return;
+  }
+
+  if (status.json.proxy.pid || status.json.proxy.health.ok) {
+    console.log(`✅ Proxy: ${status.proxyLabel}`);
+  } else {
+    console.log(`❌ Proxy: ${status.proxyLabel}`);
+  }
+  console.log(`   Health: ${status.healthLabel}`);
+  console.log(`   Dashboard: ${status.json.dashboard.url}`);
+  console.log(`   Config: ${status.json.paths.config}`);
+  console.log(`   PID file: ${status.json.paths.pid}`);
+  console.log(`   Runtime: ${status.json.paths.runtime}`);
+  console.log(`   Runtime source: ${status.json.runtime.source}${status.json.runtime.overrideEnv ? ` (${status.json.runtime.overrideEnv})` : ""}`);
+  console.log(`   Default provider: ${status.json.defaultProvider}`);
+  console.log(`   Codex autostart: ${status.json.codexAutostart ? "enabled" : "disabled"}`);
+  console.log(`   Service: ${status.json.service.summary}`);
+  console.log(`   ${status.json.codexShim.summary}`);
+  if (status.json.codexPlugins.applicable) {
+    const icon = status.json.codexPlugins.stale ? "⚠️ " : "✅";
+    console.log(`   ${icon} Codex bundled plugins: ${status.json.codexPlugins.summary}`);
+    if (status.json.codexPlugins.suggestedRepair) {
+      console.log(`      Suggested: ${status.json.codexPlugins.suggestedRepair}`);
+    }
+  }
+  const { oauthLoginSummary } = await import("../oauth");
+  console.log(`   OAuth logins:`);
+  for (const e of oauthLoginSummary()) {
+    console.log(`     ${e.provider.padEnd(10)} ${e.loggedIn ? `✓ logged in${e.email ? ` (${e.email})` : ""}` : "✗ not logged in"}`);
+  }
+}
+
+function handleRecoverHistory() {
+  if (args[1] !== "--legacy-openai") {
+    console.error("Usage: ocx recover-history --legacy-openai");
+    console.error("Only use this if an older syncResumeHistory build already remapped OpenAI Codex App history to opencodex before backup support existed.");
+    process.exit(1);
+  }
+  const r = restoreLegacyOpenaiHistory();
+  if (r.failed) {
+    console.error(
+      "⚠️  Recovery SKIPPED: the Codex history DB is locked (Codex app/IDE open?). Close it and rerun this command.",
+    );
+    process.exit(1);
+  }
+  console.log(`Recovered ${r.rows} legacy thread(s) to openai (${r.files} rollout file(s) updated).`);
+}
+
+switch (command) {
+  case "init": {
+    const { runInit } = await import("./init");
+    await runInit();
+    break;
+  }
+  case "start":
+    await handleStart();
+    break;
+  case "stop":
+    await handleStop();
+    break;
+  case "restore":
+  case "eject": {
+    if (args[1] === "back") {
+      // Reverse switch: re-point plain `codex` at the RUNNING proxy without touching its
+      // lifecycle — the counterpart of `ocx restore`. Start/stop triggers are unchanged;
+      // this only re-runs the same inject (config + catalog + history) `ocx start` does.
+      const live = await findLiveProxy();
+      if (!live) {
+        console.error("No running proxy found. Run 'ocx start' — it injects opencodex automatically.");
+        process.exit(1);
+      }
+      await syncModelsToCodex(live.port);
+      console.log("Plain `codex` now routes through opencodex again (undo with: ocx restore).");
+      break;
+    }
+    const r = restoreNativeCodex();
+    console.log(r.success ? `✅ ${r.message}` : `⚠️  ${r.message}`);
+    console.log("Plain `codex` now runs natively (no proxy). Switch back with: ocx restore back");
+    break;
+  }
+  case "recover-history":
+    handleRecoverHistory();
+    break;
+  case "uninstall":
+  case "remove":
+    await handleUninstall();
+    break;
+  case "status":
+    await handleStatus();
+    break;
+  case "doctor": {
+    const { runDoctor } = await import("./doctor");
+    await runDoctor();
+    break;
+  }
+  case "ensure":
+    await handleEnsure();
+    break;
+  case "login": {
+    const { handleLogin } = await import("../oauth/login-cli");
+    await handleLogin(args[1]);
+    break;
+  }
+  case "logout": {
+    const { removeCredential } = await import("../oauth/store");
+    const name = (args[1] ?? "").trim().toLowerCase();
+    removeCredential(name);
+    console.log(`Logged out of ${name || "(none)"}.`);
+    break;
+  }
+  case "sync": {
+    await syncModelsToCodex((await findLiveProxy())?.port);
+    break;
+  }
+  case "sync-cache": {
+    const { invalidateCodexModelsCache } = await import("../codex/catalog");
+    invalidateCodexModelsCache();
+    break;
+  }
+  case "gui": {
+    const cfg = await import("../config");
+    const config = cfg.loadConfig();
+    // Identity-checked liveness (not the pid file + a fixed sleep): finds a fallback-port
+    // proxy and waits until the spawned one actually answers before opening the browser.
+    let live = await findLiveProxy();
+    if (!live) {
+      console.log("Proxy not running. Starting...");
+      const child = spawn(process.execPath, [process.argv[1], "start"], {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+        env: process.env,
+      });
+      child.unref();
+      live = await waitForProxy();
+    }
+    // Open the host the proxy actually binds — `localhost` only answers for
+    // loopback/wildcard binds, not a concrete LAN/IPv6 hostname.
+    const guiHost = probeHostname(live?.hostname ?? config.hostname);
+    const guiUrl = `http://${guiHost === "127.0.0.1" ? "localhost" : guiHost}:${live?.port ?? config.port}`;
+    console.log(`Opening ${guiUrl}`);
+    const { openUrl } = await import("../lib/open-url");
+    openUrl(guiUrl);
+    break;
+  }
+  case "service":
+    await serviceCommand(args[1]);
+    break;
+  case "codex-shim": {
+    const { codexShimStatus, installCodexShim, uninstallCodexShim } = await import("../codex/shim");
+    switch (args[1]) {
+      case "install": {
+        const r = installCodexShim();
+        console.log(r.installed ? `✅ ${r.message}` : `⚠️  ${r.message}`);
+        break;
+      }
+      case "status":
+        console.log(codexShimStatus());
+        break;
+      case "uninstall":
+      case "remove": {
+        const r = uninstallCodexShim();
+        console.log(r.removed ? `✅ ${r.message}` : `⚠️  ${r.message}`);
+        break;
+      }
+      default:
+        console.error("Usage: ocx codex-shim <install|status|uninstall|remove>");
+        process.exit(1);
+    }
+    break;
+  }
+  case "update": {
+    const { runUpdate } = await import("../update");
+    await runUpdate();
+    break;
+  }
+  case "__refresh-version": {
+    // Hidden, detached helper spawned by the update prompt to refresh the
+    // cached latest version without blocking the foreground start. Not in help.
+    const { refreshVersionCache } = await import("../update/notify");
+    const channel = args[1] === "preview" ? "preview" : "latest";
+    await refreshVersionCache(channel);
+    break;
+  }
+  case "__gui-update-worker": {
+    const jobId = args[1];
+    if (!jobId) process.exit(1);
+    const channel = normalizeUpdateChannel(args[2]);
+    runGuiUpdateWorker(jobId, channel, args[3] === "restart");
+    break;
+  }
+  case "restart": {
+    await handleStop();
+    await handleEnsure();
+    break;
+  }
+  case "health": {
+    const healthArgs = args.slice(1);
+    const wantsHealthJson = healthArgs.includes("--json");
+    const live = await findLiveProxy();
+    if (wantsHealthJson) {
+      console.log(JSON.stringify({ ok: !!live, pid: live?.pid ?? null, port: live?.port ?? null }));
+    } else {
+      console.log(live ? `Proxy healthy (PID ${live.pid}, port ${live.port})` : "Proxy not healthy");
+    }
+    process.exit(live ? 0 : 1);
+  }
+    case "provider": {
+    const { handleProviderCommand } = await import("./provider");
+    await handleProviderCommand(args.slice(1));
+    break;
+  }
+  case "models": {
+    const { handleModels } = await import("./models");
+    handleModels(args.slice(1));
+    break;
+  }
+    case "help":
+  case "--help":
+  case "-h":
+  case undefined:
+    printUsage();
+    break;
+  default:
+    console.error(`Unknown command: ${command}`);
+    printUsage();
+    process.exit(1);
+}

package/src/{init.ts → cli/init.ts}

@@ -1,9 +1,9 @@
 import * as readline from "node:readline";
-import { injectCodexConfig } from "./codex-inject";
-import { getDefaultConfig, isValidProviderName, saveConfig } from "./config";
-import { enrichProviderFromCatalog } from "./oauth/key-providers";
-import { deriveInitProviders } from "./providers/derive";
-import type { OcxConfig, OcxProviderConfig } from "./types";
+import { injectCodexConfig } from "../codex/inject";
+import { getDefaultConfig, isValidProviderName, saveConfig } from "../config";
+import { enrichProviderFromCatalog } from "../oauth/key-providers";
+import { deriveInitProviders } from "../providers/derive";
+import type { OcxConfig, OcxProviderConfig } from "../types";
 
 function createPrompt(): { ask(question: string): Promise<string>; close(): void } {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -139,7 +139,7 @@ export async function runInit(): Promise<void> {
   const shimAnswer = await prompt.ask("Install Codex autostart shim? [Y/n]: ");
   if (shimAnswer.trim().toLowerCase() !== "n") {
     try {
-      const { installCodexShim } = await import("./codex-shim");
+      const { installCodexShim } = await import("../codex/shim");
       const result = installCodexShim();
       console.log(result.installed ? `✅ ${result.message}` : `⚠️  ${result.message}`);
     } catch (err) {

package/src/{cli-models.ts → cli/models.ts}

@@ -4,8 +4,8 @@
  * Usage:
  *   ocx models [--provider <name>] [--json]
  */
-import { hasOwnProvider, loadConfig } from "./config";
-import type { OcxConfig } from "./types";
+import { hasOwnProvider, loadConfig } from "../config";
+import type { OcxConfig } from "../types";
 
 interface ModelEntry {
   provider: string;

package/src/{cli-provider.ts → cli/provider.ts}

@@ -8,13 +8,13 @@
  *   show <name>   Show provider config details (secrets masked)
  *   set-default <name>  Change the default provider
  */
-import { hasOwnProvider, isValidProviderName, loadConfig, saveConfig } from "./config";
-import { hasHelpFlag } from "./cli-help";
-import { getProviderRegistryEntry, PROVIDER_REGISTRY } from "./providers/registry";
-import { providerConfigSeed } from "./providers/derive";
-import type { OcxProviderConfig } from "./types";
-import { findLiveProxy } from "./proxy-liveness";
-import { syncModelsToCodex } from "./codex-sync";
+import { hasOwnProvider, isValidProviderName, loadConfig, saveConfig } from "../config";
+import { hasHelpFlag } from "./help";
+import { getProviderRegistryEntry, PROVIDER_REGISTRY } from "../providers/registry";
+import { providerConfigSeed } from "../providers/derive";
+import type { OcxProviderConfig } from "../types";
+import { findLiveProxy } from "../server/proxy-liveness";
+import { syncModelsToCodex } from "../codex/sync";
 
 // ---------------------------------------------------------------------------
 // Arg helpers
@@ -302,7 +302,11 @@ function handleShow(args: string[]): void {
   }
 
   const prov = config.providers[name];
-  const display = { ...prov, ...(prov.apiKey ? { apiKey: maskSecret(prov.apiKey) } : {}) };
+  const display = {
+    ...prov,
+    ...(prov.apiKey ? { apiKey: maskSecret(prov.apiKey) } : {}),
+    ...(prov.apiKeyPool ? { apiKeyPool: prov.apiKeyPool.map(e => ({ ...e, key: maskSecret(e.key) })) } : {}),
+  };
 
   if (wantsJson) {
     console.log(JSON.stringify({ name, isDefault: name === config.defaultProvider, ...display }, null, 2));

package/src/{star-prompt.ts → cli/star-prompt.ts}

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { createInterface } from "node:readline/promises";
-import { getConfigDir } from "./config";
+import { getConfigDir } from "../config";
 
 const REPO = "lidge-jun/opencodex";
 /** Fires exactly once from the first interactive `ocx start`. */

package/src/{cli-status.ts → cli/status.ts}

@@ -1,9 +1,9 @@
-import { durableBunRuntime } from "./bun-runtime";
-import { codexAutoStartEnabled, getConfigPath, getPidPath, readConfigDiagnostics, readPid, readRuntimePort, type RuntimePortState } from "./config";
-import { diagnoseCodexBundledPlugins, type CodexPluginsDiagnostic } from "./codex-plugins-doctor";
-import { isOpencodexHealthz, probeHostname } from "./proxy-liveness";
-import type { OcxConfig } from "./types";
-import { serviceStatusSummary } from "./service";
+import { durableBunRuntime } from "../lib/bun-runtime";
+import { codexAutoStartEnabled, getConfigPath, getPidPath, readConfigDiagnostics, readPid, readRuntimePort, type RuntimePortState } from "../config";
+import { diagnoseCodexBundledPlugins, type CodexPluginsDiagnostic } from "../codex/plugins-doctor";
+import { isOpencodexHealthz, probeHostname } from "../server/proxy-liveness";
+import type { OcxConfig } from "../types";
+import { serviceStatusSummary } from "../service";
 
 type HealthCheck = {
   ok: boolean;
@@ -116,7 +116,7 @@ export async function collectStatus(): Promise<CliStatusView> {
   const health = await checkProxyHealth(listen);
   const bunRuntime = durableBunRuntime();
   const serviceSummary = serviceStatusSummary();
-  const { codexShimStatus } = await import("./codex-shim");
+  const { codexShimStatus } = await import("../codex/shim");
   const codexShimSummary = codexShimStatus();
   const codexPlugins = diagnoseCodexBundledPlugins();
   const proxyLabel = pid && health.ok