@bitkyc08/opencodex 2.6.26-preview.20260705 → 2.6.28-preview.20260707

package/src/{codex-inject.ts → codex/inject.ts}

@@ -1,13 +1,41 @@
 import { existsSync, readFileSync, unlinkSync } from "node:fs";
-import { atomicWriteFile, websocketsEnabled } from "./config";
-import { markJournalInjectedState, restoreJournalState, writeJournal } from "./codex-journal";
-import { restoreCodexCatalog } from "./codex-catalog";
-import { syncCodexHistoryProvider } from "./codex-history-provider";
-import { CODEX_CONFIG_PATH, CODEX_PROFILE_PATH, DEFAULT_CATALOG_PATH, parseTomlString, readRootTomlString, resolveCodexConfigPath, tomlString } from "./codex-paths";
-import type { OcxConfig } from "./types";
+import { atomicWriteFile, loadConfig, websocketsEnabled } from "../config";
+import { markJournalInjectedState, restoreJournalState, writeJournal } from "./journal";
+import { restoreCodexCatalog } from "./catalog";
+import { migrateHistoryToOpenai, syncCodexHistoryProvider } from "./history-provider";
+import { CODEX_CONFIG_PATH, CODEX_PROFILE_PATH, DEFAULT_CATALOG_PATH, parseTomlString, readRootTomlString, resolveCodexConfigPath, tomlString } from "./paths";
+import type { OcxConfig } from "../types";
 
 const OCX_SECTION_MARKER = "# Auto-injected by opencodex";
 
+/**
+ * Detect the file's dominant line ending. Every transform in this module is LF-pure
+ * (split("\n") + hard "\n" joins), so CRLF configs (Windows-edited config.toml) are
+ * normalized to LF at the pipeline boundary and converted back on write — otherwise a
+ * single inject would leave a mixed-EOL file.
+ */
+export function dominantEol(content: string): "\r\n" | "\n" {
+  const crlf = (content.match(/\r\n/g) ?? []).length;
+  if (crlf === 0) return "\n";
+  const bareLf = (content.match(/\n/g) ?? []).length - crlf;
+  return crlf >= bareLf ? "\r\n" : "\n";
+}
+
+/** Normalize all line endings to `eol` (CRLF first collapsed to LF, then expanded). */
+export function applyEol(content: string, eol: "\r\n" | "\n"): string {
+  const lf = content.replace(/\r\n/g, "\n");
+  return eol === "\n" ? lf : lf.replace(/\n/g, "\r\n");
+}
+
+/**
+ * Design B (2026-07-06): loopback installs no longer re-tag the provider. Instead of
+ * `model_provider = "opencodex"` + a `[model_providers.opencodex]` table, we set the official
+ * built-in override `openai_base_url` (codex-rs config_toml.rs) so codex's own `openai`
+ * provider points at the proxy. Threads keep `model_provider = "openai"`, so history never
+ * needs remapping or restore. Non-loopback binds keep the legacy table injection because the
+ * built-in provider cannot carry the `x-opencodex-api-key` env header.
+ */
+
 export interface InjectCodexOptions {
   /**
    * Absolute or CODEX_HOME-relative catalog path to advertise to Codex. Pass `null` only when the
@@ -41,7 +69,7 @@ function providerBaseHost(hostname: string | undefined): string {
   return trimmed.includes(":") ? `[${trimmed}]` : trimmed;
 }
 
-function shouldInjectApiAuthHeader(config: Pick<OcxConfig, "hostname"> | undefined): boolean {
+export function shouldInjectApiAuthHeader(config: Pick<OcxConfig, "hostname"> | undefined): boolean {
   return !isLoopbackHostname(config?.hostname);
 }
 
@@ -63,6 +91,76 @@ export function buildProviderTableBlock(port: number, supportsWebsockets = false
   return lines.join("\n") + "\n";
 }
 
+export function buildOpenaiBaseUrlLine(port: number, hostname?: string): string {
+  return `openai_base_url = "http://${providerBaseHost(hostname)}:${port}/v1"`;
+}
+
+function isRootOpenaiBaseUrlLine(line: string): boolean {
+  return /^\s*openai_base_url\s*=/.test(line);
+}
+
+/**
+ * Design B root-key injection: place `OCX_SECTION_MARKER` + `openai_base_url` at the document
+ * ROOT (before the first table header). Idempotent: an existing marker-owned line is rewritten
+ * in place. A user's OWN root `openai_base_url` (no marker above it) is respected — we keep it
+ * and inject nothing, reporting `keptUserBaseUrl` so the caller can surface it.
+ */
+export function setRootOpenaiBaseUrl(content: string, port: number, hostname?: string): { content: string; keptUserBaseUrl: boolean } {
+  const lines = content.split("\n");
+  const firstTable = lines.findIndex(l => /^\s*\[/.test(l));
+  const rootEnd = firstTable === -1 ? lines.length : firstTable;
+  const key = buildOpenaiBaseUrlLine(port, hostname);
+
+  for (let i = 0; i < rootEnd; i++) {
+    if (!isRootOpenaiBaseUrlLine(lines[i])) continue;
+    const markerOwned = i > 0 && lines[i - 1].includes(OCX_SECTION_MARKER);
+    if (!markerOwned) return { content, keptUserBaseUrl: true };
+    lines[i] = key;
+    return { content: lines.join("\n"), keptUserBaseUrl: false };
+  }
+
+  if (firstTable === -1) {
+    return { content: content.replace(/\n+$/, "") + "\n" + OCX_SECTION_MARKER + "\n" + key + "\n", keptUserBaseUrl: false };
+  }
+  let insertAt = firstTable;
+  while (insertAt > 0 && lines[insertAt - 1].trim() === "") insertAt--;
+  lines.splice(insertAt, 0, OCX_SECTION_MARKER, key);
+  return { content: lines.join("\n"), keptUserBaseUrl: false };
+}
+
+/**
+ * Remove the marker-owned root `openai_base_url` (marker line + the key line right after it).
+ * A user's own root override (no marker) survives; an orphaned marker with no key line after
+ * it is dropped too so repeated strip/inject cycles cannot accumulate marker comments.
+ */
+export function stripInjectedOpenaiBaseUrl(content: string): string {
+  const lines = content.split("\n");
+  const firstTable = lines.findIndex(l => /^\s*\[/.test(l));
+  const rootEnd = firstTable === -1 ? lines.length : firstTable;
+  const drop = new Set<number>();
+  for (let i = 0; i < rootEnd; i++) {
+    if (!lines[i].includes(OCX_SECTION_MARKER)) continue;
+    if (i + 1 < rootEnd && isRootOpenaiBaseUrlLine(lines[i + 1])) {
+      drop.add(i);
+      drop.add(i + 1);
+    } else if (i + 1 >= rootEnd || lines[i + 1].trim() === "") {
+      drop.add(i); // orphaned marker at root
+    }
+  }
+  if (drop.size === 0) return content;
+  return lines.filter((_, i) => !drop.has(i)).join("\n");
+}
+
+function hasInjectedOpenaiBaseUrl(content: string): boolean {
+  const lines = content.split("\n");
+  const firstTable = lines.findIndex(l => /^\s*\[/.test(l));
+  const rootEnd = firstTable === -1 ? lines.length : firstTable;
+  for (let i = 1; i < rootEnd; i++) {
+    if (isRootOpenaiBaseUrlLine(lines[i]) && lines[i - 1].includes(OCX_SECTION_MARKER)) return true;
+  }
+  return false;
+}
+
 /**
  * Strip every existing `model_provider` line that we must not duplicate: any line set to
  * "opencodex" (wherever it sits — including a previously mis-nested one under a table), plus any
@@ -225,6 +323,20 @@ function stripOpencodexCatalogPath(content: string): string {
 
 export function buildProfileFile(port: number, catalogPath?: string | null, supportsWebsockets = false, includeApiAuthHeader = false, hostname?: string): string {
   const host = providerBaseHost(hostname);
+  // Design B (loopback): the reference/fallback file documents the root override form.
+  // Non-loopback keeps the legacy provider-table shape (built-in provider cannot carry
+  // the x-opencodex-api-key env header).
+  if (!includeApiAuthHeader) {
+    const lines = [
+      "# OpenCodex proxy fallback config (Design B)",
+      `# Root override that points Codex's built-in openai provider at the proxy on ${host}:${port}.`,
+      "# Merge these root keys into ~/.codex/config.toml manually if auto-injection was removed.",
+      buildOpenaiBaseUrlLine(port, hostname),
+    ];
+    if (catalogPath) lines.push(`model_catalog_json = ${tomlString(catalogPath)}`);
+    lines.push("", "[features]", "fast_mode = true", "");
+    return lines.join("\n");
+  }
   const lines = [
     "# OpenCodex proxy profile — use with: codex --profile opencodex",
     `# Routes all model requests through the opencodex proxy at ${host}:${port}`,
@@ -254,11 +366,17 @@ export async function injectCodexConfig(port: number, config?: OcxConfig, option
   }
 
   writeJournal();
-  let content = readFileSync(CODEX_CONFIG_PATH, "utf-8");
+  const rawContent = readFileSync(CODEX_CONFIG_PATH, "utf-8");
+  // EOL boundary: transforms below are LF-pure; preserve the file's dominant ending on write.
+  const eol = dominantEol(rawContent);
+  let content = applyEol(rawContent, "\n");
 
   // Idempotent clean-up of any prior injection: drop the provider table (marker-based) and every
   // stray/mis-nested model_provider line, so re-injecting can't duplicate keys or leave the buggy
   // table-nested key behind.
+  // Design B form FIRST: removeOcxSection also keys on the marker line, so a root-level
+  // marker + openai_base_url pair must be gone before it scans or it would swallow root keys.
+  content = stripInjectedOpenaiBaseUrl(content);
   if (content.includes("[model_providers.opencodex]")) {
     content = removeOcxSection(content);
   }
@@ -271,36 +389,79 @@ export async function injectCodexConfig(port: number, config?: OcxConfig, option
   const catalogPath = chooseCatalogPathForInjection(content, options.catalogPath);
   content = catalogPath ? setRootModelCatalogPath(content, catalogPath) : stripOpencodexCatalogPath(content);
 
-  // 1) Root key BEFORE the first table header (must be a global, not nested under a table).
-  content = setRootModelProvider(content);
-  // 2) Provider table appended at EOF (position-independent).
-  content = content.trimEnd() + "\n" + buildProviderTableBlock(port, websocketsEnabled(config ?? {}), shouldInjectApiAuthHeader(config), config?.hostname);
+  const legacyMode = shouldInjectApiAuthHeader(config);
+  let keptUserBaseUrl = false;
+  if (legacyMode) {
+    // Legacy (non-loopback) injection: the built-in openai provider cannot carry the
+    // x-opencodex-api-key env header, so keep the opencodex provider table + root re-tag.
+    // 1) Root key BEFORE the first table header (must be a global, not nested under a table).
+    content = setRootModelProvider(content);
+    // 2) Provider table appended at EOF (position-independent).
+    content = content.trimEnd() + "\n" + buildProviderTableBlock(port, websocketsEnabled(config ?? {}), true, config?.hostname);
+  } else {
+    // Design B (loopback): a single root override; codex keeps its native `openai` provider id
+    // so thread history is never remapped. Any legacy form was already stripped above.
+    content = stripInjectedOpenaiBaseUrl(content); // normalize before idempotent re-insert
+    const result = setRootOpenaiBaseUrl(content, port, config?.hostname);
+    content = result.content;
+    keptUserBaseUrl = result.keptUserBaseUrl;
+  }
 
-  const profileContent = buildProfileFile(port, catalogPath, websocketsEnabled(config ?? {}), shouldInjectApiAuthHeader(config), config?.hostname);
+  const profileContent = buildProfileFile(port, catalogPath, websocketsEnabled(config ?? {}), legacyMode, config?.hostname);
+  content = applyEol(content, eol);
   atomicWriteFile(CODEX_CONFIG_PATH, content);
   atomicWriteFile(CODEX_PROFILE_PATH, profileContent);
   markJournalInjectedState(content, profileContent);
+  // Legacy mode still forward-tags history so re-tagged threads stay listable. Design B needs
+  // the opposite: a one-time migration of previously re-tagged threads BACK to openai (restore
+  // machinery; cheap no-op when there is nothing to migrate).
   const history = config?.syncResumeHistory !== false
-    ? syncCodexHistoryProvider("opencodex")
+    ? (legacyMode ? syncCodexHistoryProvider("opencodex") : migrateHistoryToOpenai())
     : { rows: 0, files: 0 };
 
   const catalogMessage = catalogPath
     ? `  Codex model catalog: ${catalogPath}\n`
     : `  Codex model catalog not injected because no opencodex catalog file exists yet.\n`;
+  const migratedRows = (history.rows ?? 0) + ("ejectedRows" in history ? history.ejectedRows ?? 0 : 0);
   const historyMessage = config?.syncResumeHistory === false
     ? `  Codex resume history: left unchanged (syncResumeHistory=false).\n`
     : history.failed
-      ? `  ⚠️ Codex resume history sync SKIPPED: the history DB is locked (Codex app/IDE open?). Close it and rerun 'ocx start'.\n`
-      : `  Codex resume history: ${history.rows} thread(s) made visible for opencodex; originals backed up for restore.\n`;
+      ? (legacyMode
+        ? `  ⚠️ Codex resume history sync SKIPPED: the history DB is locked (Codex app/IDE open?). Close it and rerun 'ocx start'.\n`
+        // Honest in every caller context: the daemon retries in the background while it runs,
+        // and this inject path re-runs the migration on every future start/sync anyway.
+        : `  ⚠️ Codex resume history migration deferred: the history DB is locked (Codex app/IDE open?). It is retried automatically (while the proxy runs and on every 'ocx start'); to force it now, close the Codex app and run 'ocx sync'.\n`)
+      : legacyMode
+        ? `  Codex resume history: ${history.rows} thread(s) made visible for opencodex; originals backed up for restore.\n`
+        : migratedRows > 0
+          ? `  Codex resume history: ${migratedRows} legacy opencodex-tagged thread(s) migrated back to openai (one-time).\n`
+          : `  Codex resume history: untouched (threads keep their native openai tag).\n`;
+  // A user-owned root openai_base_url means we did NOT install routing — say so honestly
+  // instead of claiming the proxy route is active (catalog/fast_mode were still written).
+  if (keptUserBaseUrl) {
+    return {
+      success: true,
+      message: `⚠️ Codex routing NOT injected: your config already sets a root openai_base_url, and opencodex never overwrites a user-owned override.\n` +
+        catalogMessage +
+        historyMessage +
+        `  To route plain codex through the proxy, remove your openai_base_url line from ~/.codex/config.toml and rerun 'ocx start'.\n` +
+        `  Reference config: ${CODEX_PROFILE_PATH}`,
+    };
+  }
+  const headline = legacyMode
+    ? `Injected opencodex as default provider into Codex config.\n`
+    : `Pointed Codex's built-in openai provider at the opencodex proxy (openai_base_url).\n`;
   return {
     success: true,
-    message: `Injected opencodex as default provider into Codex config.\n` +
+    message: headline +
       catalogMessage +
       historyMessage +
       `  All models now route through opencodex proxy (like OpenRouter).\n` +
       `  OpenAI models (gpt-5.5, etc.) are passed through to OpenAI.\n` +
       `  Custom models route to their configured providers.\n` +
-      `  Fallback: codex --profile opencodex (same behavior)`,
+      (legacyMode
+        ? `  Fallback: codex --profile opencodex (same behavior)`
+        : `  Fallback reference: ${CODEX_PROFILE_PATH}`),
   };
 }
 
@@ -331,6 +492,8 @@ function removeOcxSection(content: string): string {
 export function stripOpencodexConfig(content: string): string {
   let out = content;
   const hadRootOcxProvider = readRootTomlString(out, "model_provider") === "opencodex";
+  const hadInjectedBaseUrl = hasInjectedOpenaiBaseUrl(out);
+  out = stripInjectedOpenaiBaseUrl(out); // before removeOcxSection — it keys on the marker line too
   if (out.includes("[model_providers.opencodex]")) {
     out = removeOcxSection(out);
   }
@@ -338,25 +501,32 @@ export function stripOpencodexConfig(content: string): string {
   // Regex (not exact-string) removal so compact `model_provider="opencodex"` is stripped too —
   // must match the detection regex above, or a detected line could survive un-removed.
   out = out.split("\n").filter(l => !/^\s*model_provider\s*=\s*"opencodex"\s*$/.test(l)).join("\n");
-  if (hadRootOcxProvider) out = stripRootRoutedModel(out);
+  // Routed root model ids (`model = "provider/slug"`) only make sense while the proxy serves
+  // them — strip on both the legacy re-tag form and the Design B injected-base-url form.
+  if (hadRootOcxProvider || hadInjectedBaseUrl) out = stripRootRoutedModel(out);
   out = stripOpencodexCatalogPath(out);
   return out.replace(/\n{3,}/g, "\n\n").trimEnd() + "\n";
 }
 
 function hasOpencodexRouting(content: string): boolean {
-  return content.includes("[model_providers.opencodex]") || /^\s*model_provider\s*=\s*"opencodex"/m.test(content);
+  return content.includes("[model_providers.opencodex]")
+    || /^\s*model_provider\s*=\s*"opencodex"/m.test(content)
+    || hasInjectedOpenaiBaseUrl(content);
 }
 
 export function removeCodexConfig(options: { preserveProfile?: boolean } = {}): { success: boolean; message: string } {
   if (!existsSync(CODEX_CONFIG_PATH)) {
     return { success: false, message: "Codex config not found." };
   }
-  const content = readFileSync(CODEX_CONFIG_PATH, "utf-8");
+  const rawContent = readFileSync(CODEX_CONFIG_PATH, "utf-8");
+  // Same EOL boundary as inject: strip in LF space, write back in the file's own ending.
+  // The unchanged fast path compares in LF space so an untouched file is never rewritten.
+  const eol = dominantEol(rawContent);
+  const content = applyEol(rawContent, "\n");
   const had = hasOpencodexRouting(content);
-  if (had) {
-    atomicWriteFile(CODEX_CONFIG_PATH, stripOpencodexConfig(content));
-  } else if (stripOpencodexConfig(content) !== content) {
-    atomicWriteFile(CODEX_CONFIG_PATH, stripOpencodexConfig(content));
+  const stripped = stripOpencodexConfig(content);
+  if (had || stripped !== content) {
+    atomicWriteFile(CODEX_CONFIG_PATH, applyEol(stripped, eol));
   }
   if (!options.preserveProfile && existsSync(CODEX_PROFILE_PATH)) unlinkSync(CODEX_PROFILE_PATH);
   return {
@@ -378,7 +548,15 @@ export function restoreNativeCodex(): { success: boolean; message: string } {
     ? { success: true, message: "Codex config restored from opencodex journal." }
     : removeCodexConfig({ preserveProfile: journal.profileRestored || journal.profileChanged });
   const cat = restoreCodexCatalog();
-  const history = syncCodexHistoryProvider("openai");
+  // Design B (loopback) steady state: threads are already tagged openai, so prove the
+  // no-op with a readonly probe instead of write-opening a DB the Codex app may hold
+  // (Windows: WAL writer lock -> seconds of stalling + a false warning on every stop).
+  // Legacy (non-loopback) installs keep the unconditional write-open restore.
+  let skipWhenProvablyNoop = false;
+  try {
+    skipWhenProvablyNoop = !shouldInjectApiAuthHeader(loadConfig());
+  } catch { /* unreadable config: keep the conservative write-open restore */ }
+  const history = syncCodexHistoryProvider("openai", undefined, undefined, { skipWhenProvablyNoop });
   const msg = cat.removed > 0
     ? `${cfg.message} Catalog restored to ${cat.kept} native model(s) (dropped ${cat.removed} proxy-routed).`
     : cfg.message;

package/src/{codex-journal.ts → codex/journal.ts}

@@ -1,8 +1,8 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
-import { atomicWriteFile } from "./config";
-import { CODEX_HOME, CODEX_CONFIG_PATH, CODEX_PROFILE_PATH } from "./codex-paths";
+import { atomicWriteFile } from "../config";
+import { CODEX_HOME, CODEX_CONFIG_PATH, CODEX_PROFILE_PATH } from "./paths";
 
 const JOURNAL_PATH = join(CODEX_HOME, "opencodex-journal.json");
 

package/src/{codex-main-account.ts → codex/main-account.ts}

@@ -1,5 +1,5 @@
-import { readCodexTokens } from "./codex-auth-collision";
-import { decodeJwtPayload } from "./oauth/chatgpt";
+import { readCodexTokens } from "./auth-collision";
+import { decodeJwtPayload } from "../oauth/chatgpt";
 
 /**
  * Stable id under which the "main" Codex account (the Codex CLI login stored in

package/src/{model-cache.ts → codex/model-cache.ts}

@@ -7,7 +7,7 @@
  * long-running process and the on-disk Codex catalog already persists the last sync across
  * restarts, so an in-memory cache is sufficient here (no SQLite layer needed).
  */
-import type { CatalogModel } from "./codex-catalog";
+import type { CatalogModel } from "./catalog";
 
 /** Default freshness window. Matches Codex's own 5-min models cache so the two stay in step. */
 export const DEFAULT_MODEL_CACHE_TTL_MS = 5 * 60 * 1000;

package/src/{codex-paths.ts → codex/paths.ts}

@@ -1,7 +1,7 @@
 import { realpathSync, statSync } from "node:fs";
 import { isAbsolute, join, resolve } from "node:path";
-import { expandUserPath } from "./config";
-import { defaultCodexHome } from "./codex-home";
+import { expandUserPath } from "../config";
+import { defaultCodexHome } from "./home";
 
 function resolveCodexHome(): string {
   const raw = process.env.CODEX_HOME?.trim();

package/src/{codex-plugins-doctor.ts → codex/plugins-doctor.ts}

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { isAbsolute, join } from "node:path";
-import { CODEX_CONFIG_PATH } from "./codex-paths";
-import { redactUserPath } from "./redact";
+import { CODEX_CONFIG_PATH } from "./paths";
+import { redactUserPath } from "../lib/redact";
 
 // Mirrors codex-rs core-plugins/src/marketplace.rs MARKETPLACE_MANIFEST_RELATIVE_PATHS.
 // A marketplace root "resolves" only when one of these files exists under it.

package/src/{codex-refresh.ts → codex/refresh.ts}

@@ -1,8 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
-import { invalidateCodexModelsCache, syncCatalogModels } from "./codex-catalog";
-import { CODEX_MODELS_CACHE_PATH } from "./codex-paths";
-import { atomicWriteFile } from "./config";
-import type { OcxConfig } from "./types";
+import { invalidateCodexModelsCache, syncCatalogModels } from "./catalog";
+import { CODEX_MODELS_CACHE_PATH } from "./paths";
+import { atomicWriteFile } from "../config";
+import type { OcxConfig } from "../types";
 
 export interface CodexCatalogRefreshResult {
   added: number;

package/src/{codex-routing.ts → codex/routing.ts}

@@ -1,11 +1,11 @@
-import { saveConfig } from "./config";
-import { isCodexAccountGenerationLive, readCodexAccountRecord } from "./codex-account-store";
-import { codexAccountLogLabel } from "./codex-account-label";
-import { isCodexAccountUsable } from "./codex-account-usability";
-import { isAccountNeedsReauth, markAccountNeedsReauth } from "./codex-account-runtime-state";
-import { CODEX_UNKNOWN_USAGE_SCORE, getAccountQuota } from "./codex-quota";
-import { MAIN_CODEX_ACCOUNT_ID, getMainAccountPlan } from "./codex-main-account";
-import type { OcxConfig } from "./types";
+import { saveConfig } from "../config";
+import { isCodexAccountGenerationLive, readCodexAccountRecord } from "./account-store";
+import { codexAccountLogLabel } from "./account-label";
+import { isCodexAccountUsable } from "./account-usability";
+import { isAccountNeedsReauth, markAccountNeedsReauth } from "./account-runtime-state";
+import { CODEX_UNKNOWN_USAGE_SCORE, getAccountQuota } from "./quota";
+import { MAIN_CODEX_ACCOUNT_ID, getMainAccountPlan } from "./main-account";
+import type { OcxConfig } from "../types";
 
 type ThreadAffinityEntry = {
   accountId: string;

package/src/{codex-shim.ts → codex/shim.ts}

@@ -1,9 +1,9 @@
 import { delimiter, dirname, extname, join } from "node:path";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
-import { getConfigDir } from "./config";
-import { durableBunPath } from "./bun-runtime";
-import { serviceApiTokenFilePath } from "./service-secrets";
-import { windowsEnvIndirectBatchValue } from "./win-paths";
+import { getConfigDir } from "../config";
+import { durableBunPath } from "../lib/bun-runtime";
+import { serviceApiTokenFilePath } from "../lib/service-secrets";
+import { windowsEnvIndirectBatchValue } from "../lib/win-paths";
 
 const SHIM_MARKER = "opencodex codex autostart shim";
 let lastShimDiscoveryError: string | null = null;
@@ -48,7 +48,8 @@ interface ShimFileState {
 function cliEntry(): { bun: string; cli: string } {
   // Bundled Bun path (survives `ocx update`); all three shim builders
   // (Unix / Windows cmd / Windows PowerShell) receive it via this entry.
-  return { bun: durableBunPath(), cli: join(import.meta.dir, "cli.ts") };
+  // This module lives in src/codex/, the CLI entry in src/cli/index.ts.
+  return { bun: durableBunPath(), cli: join(import.meta.dir, "..", "cli", "index.ts") };
 }
 
 function commandNames(name: string): string[] {

package/src/{codex-sync.ts → codex/sync.ts}

@@ -1,7 +1,7 @@
-import { injectCodexConfig } from "./codex-inject";
-import { refreshCodexModelCatalog } from "./codex-refresh";
-import { applyProxyEnv, loadConfig } from "./config";
-import type { OcxConfig } from "./types";
+import { injectCodexConfig } from "./inject";
+import { refreshCodexModelCatalog } from "./refresh";
+import { applyProxyEnv, loadConfig } from "../config";
+import type { OcxConfig } from "../types";
 
 export interface CodexSyncResult {
   ok: boolean;

package/src/{codex-websocket-registry.ts → codex/websocket-registry.ts}

@@ -1,5 +1,5 @@
 import type { ServerWebSocket } from "bun";
-import type { WsData } from "./ws-bridge";
+import type { WsData } from "../server/ws-bridge";
 
 const socketsByAccount = new Map<string, Set<ServerWebSocket<WsData>>>();
 

package/src/config.ts

@@ -472,7 +472,9 @@ export function parsePidFile(raw: string): number | null {
 
 export function isOcxStartCommandLine(commandLine: string): boolean {
   const normalized = commandLine.toLowerCase().replace(/\\/g, "/");
+  // "src/cli.ts" matches pre-restructure installs still running; "src/cli/index.ts" is current.
   const hasOcxEntrypoint = normalized.includes("src/cli.ts")
+    || normalized.includes("src/cli/index.ts")
     || normalized.includes("@bitkyc08/opencodex")
     || /(?:^|[\s/"'])(?:ocx|opencodex)(?:\.cmd)?(?:$|[\s"'])/.test(normalized);
   return hasOcxEntrypoint && /(?:^|[\s"'])start(?:$|[\s"'])/.test(normalized);

package/src/generated/jawcode-model-metadata.ts

@@ -14,6 +14,8 @@ export interface JawcodeModelMetadata {
 const PROVIDER_ALIASES: Record<string, string> = {
   "xai": "xai",
   "anthropic": "anthropic",
+  "anthropic-apikey": "anthropic",
+  "anthropic-key": "anthropic",
   "kimi": "moonshot",
   "opencode-go": "opencode-go",
   "openrouter": "openrouter",

package/src/{bun-runtime.ts → lib/bun-runtime.ts}

@@ -8,7 +8,7 @@
  * stable path to that binary. This module is the single source of truth.
  *
  * In a from-source dev checkout the `bun` dependency may be absent; callers fall
- * back to `process.execPath` (which is itself Bun when run via `bun src/cli.ts`).
+ * back to `process.execPath` (which is itself Bun when run via `bun src/cli/index.ts`).
  */
 import { createRequire } from "node:module";
 import { existsSync, statSync } from "node:fs";

package/src/{crash-guard.ts → lib/crash-guard.ts}

@@ -1,6 +1,6 @@
 import { appendFileSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
-import { getConfigDir } from "./config";
+import { getConfigDir } from "../config";
 import { redactSecretString, redactUrlForLog } from "./redact";
 import { sidecarBreadcrumb, activityBreadcrumb } from "./sidecar-tracker";
 

package/src/{process-control.ts → lib/process-control.ts}

@@ -1,5 +1,5 @@
 import { execFileSync } from "node:child_process";
-import { loadConfig, readRuntimePort } from "./config";
+import { loadConfig, readRuntimePort } from "../config";
 
 export function isProcessAlive(pid: number): boolean {
   try {

package/src/{service-secrets.ts → lib/service-secrets.ts}

@@ -1,5 +1,5 @@
 import { join } from "node:path";
-import { getConfigDir } from "./config";
+import { getConfigDir } from "../config";
 
 export function serviceApiTokenFilePath(): string {
   return join(getConfigDir(), "service-api-token");

package/src/oauth/callback-server.ts

@@ -8,7 +8,7 @@
  * Handles: port allocation (preferred → random fallback), callback server, CSRF state,
  * manual-input race, 300s timeout. Providers implement generateAuthUrl() + exchangeToken().
  */
-import { isAddrInUse } from "../ports";
+import { isAddrInUse } from "../server/ports";
 import type { OAuthController, OAuthCredentials } from "./types";
 
 const DEFAULT_TIMEOUT = 300_000;

package/src/oauth/google-antigravity.ts

@@ -154,8 +154,9 @@ function credentialsFromPayload(payload: GoogleTokenPayload, refreshFallback = "
 
 class AntigravityOAuthFlow extends OAuthCallbackFlow {
   #verifier = "";
+  #forceAccountSelect: boolean;
 
-  constructor(ctrl: OAuthController) {
+  constructor(ctrl: OAuthController, opts?: { forceAccountSelect?: boolean }) {
     super(ctrl, {
       preferredPort: CALLBACK_PORT,
       callbackPath: CALLBACK_PATH,
@@ -163,6 +164,7 @@ class AntigravityOAuthFlow extends OAuthCallbackFlow {
       callbackBindHostname: "127.0.0.1",
       redirectUri: `http://127.0.0.1:${CALLBACK_PORT}${CALLBACK_PATH}`,
     } satisfies OAuthCallbackFlowOptions);
+    this.#forceAccountSelect = opts?.forceAccountSelect === true;
   }
 
   async generateAuthUrl(state: string, redirectUri: string): Promise<{ url: string; instructions?: string }> {
@@ -176,7 +178,8 @@ class AntigravityOAuthFlow extends OAuthCallbackFlow {
       code_challenge: pkce.challenge,
       code_challenge_method: "S256",
       access_type: "offline",
-      prompt: "consent",
+      // select_account lets the user pick a DIFFERENT Google account when adding a second one.
+      prompt: this.#forceAccountSelect ? "consent select_account" : "consent",
       state,
     });
     return {
@@ -207,8 +210,8 @@ class AntigravityOAuthFlow extends OAuthCallbackFlow {
   }
 }
 
-export async function loginAntigravity(ctrl: OAuthController): Promise<OAuthCredentials> {
-  return new AntigravityOAuthFlow(ctrl).login();
+export async function loginAntigravity(ctrl: OAuthController, opts?: { forceAccountSelect?: boolean }): Promise<OAuthCredentials> {
+  return new AntigravityOAuthFlow(ctrl, opts).login();
 }
 
 export async function refreshAntigravityToken(refreshToken: string, signal?: AbortSignal): Promise<OAuthCredentials> {