@bitkyc08/opencodex 2.6.28-preview.20260707 → 2.6.30-preview.20260707

package/gui/dist/assets/{index-CkV5xFA8.js → index-D6YMHYXe.js}

@@ -12,4 +12,4 @@ Error generating stack: `+e.message+`
   -d '{
     "model": "gpt-5.4",
     "input": "Hello, world!"
-  }'`})]})]})}var xt=`opencodex-api-token`,St=!1,Ct=null;function wt(e){try{let t=e instanceof Request?e.url:String(e);return new URL(t,window.location.href).pathname}catch{return null}}function Tt(e){let t=wt(e);return!!t&&(t.startsWith(`/api/`)||t.startsWith(`/v1/`))}function Et(){try{return sessionStorage.getItem(xt)?.trim()||null}catch{return null}}function Dt(e){try{sessionStorage.setItem(xt,e)}catch{}}function Ot(){try{sessionStorage.removeItem(xt)}catch{}}function kt(e,t,n){let r=new Headers(t?.headers??(e instanceof Request?e.headers:void 0));return r.set(`X-OpenCodex-API-Key`,n),e instanceof Request?[new Request(e,{headers:r}),t?{...t,headers:r}:void 0]:[e,{...t,headers:r}]}async function At(){return Ct||(Ct=Promise.resolve().then(()=>window.prompt(`OpenCodex API token`)?.trim()||null).finally(()=>{Ct=null}),Ct)}function jt(){if(St)return;St=!0;let e=window.fetch.bind(window);window.fetch=async(t,n)=>{if(!Tt(t))return e(t,n);let r=Et(),[i,a]=r?kt(t,n,r):[t,n],o=await e(i,a);if(o.status!==401)return o;r&&Ot();let s=await At();if(!s)return o;Dt(s);let[c,l]=kt(t,n,s),u=await e(c,l);return u.status===401&&Ot(),u}}jt();var Mt=new Set([`dashboard`,`providers`,`models`,`subagents`,`logs`,`usage`,`codex-auth`,`api`]);function Nt(){let e=location.hash.replace(/^#\/?/,``);return Mt.has(e)?e:`dashboard`}var Pt=``,Ft=`ocx-theme`,It=[{id:`dashboard`,tkey:`nav.dashboard`,Icon:w},{id:`providers`,tkey:`nav.providers`,Icon:T},{id:`models`,tkey:`nav.models`,Icon:E},{id:`subagents`,tkey:`nav.subagents`,Icon:ee},{id:`logs`,tkey:`nav.logs`,Icon:D},{id:`usage`,tkey:`nav.usage`,Icon:te},{id:`codex-auth`,tkey:`nav.codexAuth`,Icon:L},{id:`api`,tkey:`nav.api`,Icon:de}],Lt={light:ce,dark:le,system:ue},Rt={light:`theme.light`,dark:`theme.dark`,system:`theme.system`};function zt(e){if(!e||typeof e!=`object`||!(`version`in e))return null;let t=e.version;return typeof t==`string`&&t.length>0?t:null}function Bt(){let e=localStorage.getItem(Ft);return e===`light`||e===`dark`?e:`system`}function Vt(){let[e,t]=(0,_.useState)(Nt),n=e=>{location.hash=e,t(e)},[r,i]=(0,_.useState)(Bt),[a,o]=(0,_.useState)(null),{locale:s,setLocale:c}=be(),l=xe();(0,_.useEffect)(()=>{let e=()=>t(Nt());return window.addEventListener(`hashchange`,e),()=>window.removeEventListener(`hashchange`,e)},[]),(0,_.useEffect)(()=>{let e=document.documentElement;r===`system`?(e.removeAttribute(`data-theme`),localStorage.removeItem(Ft)):(e.setAttribute(`data-theme`,r),localStorage.setItem(Ft,r))},[r]),(0,_.useEffect)(()=>{let e=!1,t=async()=>{try{let t=await fetch(`${Pt}/healthz`);if(!t.ok)return;let n=zt(await t.json());!e&&n&&o(n)}catch{}};t();let n=setInterval(t,3e4);return()=>{e=!0,clearInterval(n)}},[]);let u=()=>i(e=>e===`light`?`dark`:e===`dark`?`system`:`light`),d=Lt[r],f=a??`2.6.28-preview.20260707`,p=me.find(e=>e.code===s)?.name??`English`,m=()=>{let e=me.map(e=>e.code);c(e[(e.indexOf(s)+1)%e.length])},[h,g]=(0,_.useState)(!1);return(0,S.jsxs)(`div`,{className:`app`,children:[(0,S.jsxs)(`aside`,{className:`sidebar`,children:[(0,S.jsxs)(`div`,{className:`brand`,children:[(0,S.jsx)(`span`,{className:`brand-logo`,role:`img`,"aria-label":`opencodex logo`}),(0,S.jsx)(`span`,{className:`name`,children:`opencodex`}),(0,S.jsxs)(`span`,{className:`ver`,children:[`v`,f]})]}),(0,S.jsx)(`nav`,{children:It.map(({id:t,tkey:r,Icon:i})=>(0,S.jsxs)(`button`,{className:`nav-item${e===t?` active`:``}`,"data-page":t,onClick:()=>n(t),"aria-current":e===t?`page`:void 0,children:[(0,S.jsx)(i,{}),` `,l(r)]},t))}),(0,S.jsxs)(`div`,{className:`sidebar-foot`,children:[(0,S.jsxs)(`button`,{type:`button`,className:`theme-toggle`,onClick:m,"aria-label":`${l(`lang.label`)}: ${p}`,title:`${l(`lang.label`)}: ${p}`,children:[(0,S.jsx)(de,{}),` `,(0,S.jsx)(`span`,{className:`mode`,children:p})]}),(0,S.jsxs)(`button`,{type:`button`,className:`theme-toggle`,onClick:u,"aria-label":`${l(`theme.label`)}: ${l(Rt[r])}`,title:`${l(`theme.label`)}: ${l(Rt[r])}`,children:[(0,S.jsx)(d,{}),` `,(0,S.jsx)(`span`,{className:`mode`,children:l(Rt[r])})]}),(0,S.jsxs)(`button`,{type:`button`,className:`theme-toggle stop-toggle`,onClick:async()=>{if(confirm(l(`dash.stopConfirm`))){g(!0);try{await fetch(`${Pt}/api/stop`,{method:`POST`})}catch{}}},disabled:h,"aria-label":l(`dash.stop`),title:l(`dash.stop`),children:[(0,S.jsx)(F,{}),` `,(0,S.jsx)(`span`,{className:`mode`,children:l(h?`dash.stopping`:`dash.stop`)})]}),(0,S.jsxs)(`a`,{className:`sidebar-link`,href:`https://github.com/lidge-jun/opencodex`,target:`_blank`,rel:`noreferrer`,children:[(0,S.jsx)(P,{}),` `,l(`common.github`)]})]})]}),(0,S.jsx)(`main`,{className:`main`,children:(0,S.jsxs)(`div`,{className:`main-inner`,children:[e===`dashboard`&&(0,S.jsx)(Oe,{apiBase:Pt}),e===`providers`&&(0,S.jsx)(We,{apiBase:Pt}),e===`models`&&(0,S.jsx)(Ye,{apiBase:Pt}),e===`subagents`&&(0,S.jsx)(Xe,{apiBase:Pt}),e===`logs`&&(0,S.jsx)(ot,{apiBase:Pt}),e===`usage`&&(0,S.jsx)(pt,{apiBase:Pt}),e===`codex-auth`&&(0,S.jsx)(ht,{apiBase:Pt}),e===`api`&&(0,S.jsx)(bt,{apiBase:Pt})]})})]})}v.createRoot(document.getElementById(`root`)).render((0,S.jsx)(_.StrictMode,{children:(0,S.jsx)(ye,{children:(0,S.jsx)(Vt,{})})}));
+  }'`})]})]})}var xt=`opencodex-api-token`,St=!1,Ct=null;function wt(e){try{let t=e instanceof Request?e.url:String(e);return new URL(t,window.location.href).pathname}catch{return null}}function Tt(e){let t=wt(e);return!!t&&(t.startsWith(`/api/`)||t.startsWith(`/v1/`))}function Et(){try{return sessionStorage.getItem(xt)?.trim()||null}catch{return null}}function Dt(e){try{sessionStorage.setItem(xt,e)}catch{}}function Ot(){try{sessionStorage.removeItem(xt)}catch{}}function kt(e,t,n){let r=new Headers(t?.headers??(e instanceof Request?e.headers:void 0));return r.set(`X-OpenCodex-API-Key`,n),e instanceof Request?[new Request(e,{headers:r}),t?{...t,headers:r}:void 0]:[e,{...t,headers:r}]}async function At(){return Ct||(Ct=Promise.resolve().then(()=>window.prompt(`OpenCodex API token`)?.trim()||null).finally(()=>{Ct=null}),Ct)}function jt(){if(St)return;St=!0;let e=window.fetch.bind(window);window.fetch=async(t,n)=>{if(!Tt(t))return e(t,n);let r=Et(),[i,a]=r?kt(t,n,r):[t,n],o=await e(i,a);if(o.status!==401)return o;r&&Ot();let s=await At();if(!s)return o;Dt(s);let[c,l]=kt(t,n,s),u=await e(c,l);return u.status===401&&Ot(),u}}jt();var Mt=new Set([`dashboard`,`providers`,`models`,`subagents`,`logs`,`usage`,`codex-auth`,`api`]);function Nt(){let e=location.hash.replace(/^#\/?/,``);return Mt.has(e)?e:`dashboard`}var Pt=``,Ft=`ocx-theme`,It=[{id:`dashboard`,tkey:`nav.dashboard`,Icon:w},{id:`providers`,tkey:`nav.providers`,Icon:T},{id:`models`,tkey:`nav.models`,Icon:E},{id:`subagents`,tkey:`nav.subagents`,Icon:ee},{id:`logs`,tkey:`nav.logs`,Icon:D},{id:`usage`,tkey:`nav.usage`,Icon:te},{id:`codex-auth`,tkey:`nav.codexAuth`,Icon:L},{id:`api`,tkey:`nav.api`,Icon:de}],Lt={light:ce,dark:le,system:ue},Rt={light:`theme.light`,dark:`theme.dark`,system:`theme.system`};function zt(e){if(!e||typeof e!=`object`||!(`version`in e))return null;let t=e.version;return typeof t==`string`&&t.length>0?t:null}function Bt(){let e=localStorage.getItem(Ft);return e===`light`||e===`dark`?e:`system`}function Vt(){let[e,t]=(0,_.useState)(Nt),n=e=>{location.hash=e,t(e)},[r,i]=(0,_.useState)(Bt),[a,o]=(0,_.useState)(null),{locale:s,setLocale:c}=be(),l=xe();(0,_.useEffect)(()=>{let e=()=>t(Nt());return window.addEventListener(`hashchange`,e),()=>window.removeEventListener(`hashchange`,e)},[]),(0,_.useEffect)(()=>{let e=document.documentElement;r===`system`?(e.removeAttribute(`data-theme`),localStorage.removeItem(Ft)):(e.setAttribute(`data-theme`,r),localStorage.setItem(Ft,r))},[r]),(0,_.useEffect)(()=>{let e=!1,t=async()=>{try{let t=await fetch(`${Pt}/healthz`);if(!t.ok)return;let n=zt(await t.json());!e&&n&&o(n)}catch{}};t();let n=setInterval(t,3e4);return()=>{e=!0,clearInterval(n)}},[]);let u=()=>i(e=>e===`light`?`dark`:e===`dark`?`system`:`light`),d=Lt[r],f=a??`2.6.30-preview.20260707`,p=me.find(e=>e.code===s)?.name??`English`,m=()=>{let e=me.map(e=>e.code);c(e[(e.indexOf(s)+1)%e.length])},[h,g]=(0,_.useState)(!1);return(0,S.jsxs)(`div`,{className:`app`,children:[(0,S.jsxs)(`aside`,{className:`sidebar`,children:[(0,S.jsxs)(`div`,{className:`brand`,children:[(0,S.jsx)(`span`,{className:`brand-logo`,role:`img`,"aria-label":`opencodex logo`}),(0,S.jsx)(`span`,{className:`name`,children:`opencodex`}),(0,S.jsxs)(`span`,{className:`ver`,children:[`v`,f]})]}),(0,S.jsx)(`nav`,{children:It.map(({id:t,tkey:r,Icon:i})=>(0,S.jsxs)(`button`,{className:`nav-item${e===t?` active`:``}`,"data-page":t,onClick:()=>n(t),"aria-current":e===t?`page`:void 0,children:[(0,S.jsx)(i,{}),` `,l(r)]},t))}),(0,S.jsxs)(`div`,{className:`sidebar-foot`,children:[(0,S.jsxs)(`button`,{type:`button`,className:`theme-toggle`,onClick:m,"aria-label":`${l(`lang.label`)}: ${p}`,title:`${l(`lang.label`)}: ${p}`,children:[(0,S.jsx)(de,{}),` `,(0,S.jsx)(`span`,{className:`mode`,children:p})]}),(0,S.jsxs)(`button`,{type:`button`,className:`theme-toggle`,onClick:u,"aria-label":`${l(`theme.label`)}: ${l(Rt[r])}`,title:`${l(`theme.label`)}: ${l(Rt[r])}`,children:[(0,S.jsx)(d,{}),` `,(0,S.jsx)(`span`,{className:`mode`,children:l(Rt[r])})]}),(0,S.jsxs)(`button`,{type:`button`,className:`theme-toggle stop-toggle`,onClick:async()=>{if(confirm(l(`dash.stopConfirm`))){g(!0);try{await fetch(`${Pt}/api/stop`,{method:`POST`})}catch{}}},disabled:h,"aria-label":l(`dash.stop`),title:l(`dash.stop`),children:[(0,S.jsx)(F,{}),` `,(0,S.jsx)(`span`,{className:`mode`,children:l(h?`dash.stopping`:`dash.stop`)})]}),(0,S.jsxs)(`a`,{className:`sidebar-link`,href:`https://github.com/lidge-jun/opencodex`,target:`_blank`,rel:`noreferrer`,children:[(0,S.jsx)(P,{}),` `,l(`common.github`)]})]})]}),(0,S.jsx)(`main`,{className:`main`,children:(0,S.jsxs)(`div`,{className:`main-inner`,children:[e===`dashboard`&&(0,S.jsx)(Oe,{apiBase:Pt}),e===`providers`&&(0,S.jsx)(We,{apiBase:Pt}),e===`models`&&(0,S.jsx)(Ye,{apiBase:Pt}),e===`subagents`&&(0,S.jsx)(Xe,{apiBase:Pt}),e===`logs`&&(0,S.jsx)(ot,{apiBase:Pt}),e===`usage`&&(0,S.jsx)(pt,{apiBase:Pt}),e===`codex-auth`&&(0,S.jsx)(ht,{apiBase:Pt}),e===`api`&&(0,S.jsx)(bt,{apiBase:Pt})]})})]})}v.createRoot(document.getElementById(`root`)).render((0,S.jsx)(_.StrictMode,{children:(0,S.jsx)(ye,{children:(0,S.jsx)(Vt,{})})}));

package/gui/dist/index.html

@@ -16,7 +16,7 @@
         } catch (e) {}
       })();
     </script>
-    <script type="module" crossorigin src="/assets/index-CkV5xFA8.js"></script>
+    <script type="module" crossorigin src="/assets/index-D6YMHYXe.js"></script>
     <link rel="stylesheet" crossorigin href="/assets/index-ByGC8-Bm.css">
   </head>
   <body>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bitkyc08/opencodex",
-  "version": "2.6.28-preview.20260707",
+  "version": "2.6.30-preview.20260707",
   "description": "Universal provider proxy for OpenAI Codex — use any LLM with Codex CLI/App/SDK",
   "type": "module",
   "main": "./bin/package-main.mjs",

package/src/cli/doctor.ts

@@ -8,10 +8,12 @@
  * networking. See devlog/_plan/260630_wsl-account-autoswitch/30_*.
  */
 import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
 import { join } from "node:path";
 import { getConfigDir, getConfigPath, readConfigDiagnostics, readPid, resolveEnvValue } from "../config";
 import { readCodexTokens } from "../codex/auth-collision";
-import { resolveCodexHomeDir as resolveCodexHomeDirImpl } from "../codex/home";
+import { resolveCodexHomeDir as resolveCodexHomeDirImpl, isWslRuntime, listWslWindowsCodexHomes, wslAutomountRoot, type CodexHomeDeps } from "../codex/home";
+import { findCodexOnPath, isWindowsInteropDir } from "../codex/shim";
 import { countPendingOpencodexHistory } from "../codex/history-provider";
 export { resolveCodexHomeDir } from "../codex/home";
 
@@ -70,6 +72,70 @@ function readMounts(): string | null {
   }
 }
 
+export type WslDualInstallDiagnostic = {
+  wsl: boolean;
+  automountRoot: string;
+  effectiveCodexHome: string;
+  effectiveIsWindowsMount: boolean;
+  linuxCodexConfigured: boolean;
+  windowsCodexHomes: string[];
+  dualInstall: boolean;
+  interopCodexOnPath: string | null;
+};
+
+type WslDualInstallDeps = CodexHomeDeps & {
+  pathValue?: string;
+  effectiveCodexHome?: string;
+};
+
+/**
+ * WSL + Windows dual-install visibility: which `.codex` home each side owns,
+ * whether the effective home sits on a Windows mount, and whether the `codex`
+ * on PATH is actually the Windows launcher reached through drive interop.
+ * Read-only; hints are printed by runDoctor, never applied.
+ */
+export function collectWslDualInstall(deps: WslDualInstallDeps = {}): WslDualInstallDiagnostic {
+  const wsl = isWslRuntime(deps);
+  const effectiveCodexHome = deps.effectiveCodexHome ?? resolveCodexHomeDirImpl(deps);
+  if (!wsl) {
+    return {
+      wsl: false,
+      automountRoot: "/mnt",
+      effectiveCodexHome,
+      effectiveIsWindowsMount: false,
+      linuxCodexConfigured: false,
+      windowsCodexHomes: [],
+      dualInstall: false,
+      interopCodexOnPath: null,
+    };
+  }
+  const automountRoot = wslAutomountRoot(deps);
+  const exists = deps.existsSync ?? existsSync;
+  const home = (deps.homedir ?? homedir)();
+  const linuxCodexConfigured = !!home && exists(join(home, ".codex", "config.toml"));
+  const windowsCodexHomes = listWslWindowsCodexHomes(deps);
+  const onPath = findCodexOnPath({
+    pathValue: deps.pathValue ?? process.env.PATH,
+    wsl: false, // scan everything; classify interop ourselves
+    posixPaths: true, // WSL PATH entries are POSIX regardless of the host running doctor
+    automountRoot,
+    // When a fake fs is injected (tests), the real lstat/readFile would miss its
+    // synthetic paths; treat every injected hit as a plain non-shim file.
+    ...(deps.existsSync ? { exists: deps.existsSync, isShimFile: () => false, isDirectory: () => false } : {}),
+  });
+  const interopCodexOnPath = onPath && isWindowsInteropDir(onPath, automountRoot) ? onPath : null;
+  return {
+    wsl,
+    automountRoot,
+    effectiveCodexHome,
+    effectiveIsWindowsMount: isWindowsInteropDir(effectiveCodexHome, automountRoot),
+    linuxCodexConfigured,
+    windowsCodexHomes,
+    dualInstall: linuxCodexConfigured && windowsCodexHomes.length > 0,
+    interopCodexOnPath,
+  };
+}
+
 const PROXY_KEYS = ["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "NO_PROXY"] as const;
 
 export type ProxyEnvRow = { key: string; present: boolean };
@@ -307,6 +373,21 @@ export async function runDoctor(): Promise<void> {
     console.log(`  --     ${pending.pendingRows} thread(s) still tagged opencodex, ${pending.backupEntries} backup manifest entr${pending.backupEntries === 1 ? "y" : "ies"}`);
   }
 
+  const dual = collectWslDualInstall();
+  if (dual.wsl) {
+    console.log("\nWSL Codex installs");
+    console.log(`  ${dual.linuxCodexConfigured ? "ok " : "-- "} Linux ~/.codex/config.toml`);
+    if (dual.windowsCodexHomes.length > 0) {
+      for (const winHome of dual.windowsCodexHomes) console.log(`  ok  Windows ${winHome}`);
+    } else {
+      console.log("  --  no Windows-profile .codex detected under /mnt/c/Users");
+    }
+    console.log(`      effective CODEX_HOME: ${dual.effectiveCodexHome}${dual.effectiveIsWindowsMount ? " (Windows mount)" : ""}`);
+    if (dual.interopCodexOnPath) {
+      console.log(`  --  codex on PATH is the Windows launcher via interop: ${dual.interopCodexOnPath}`);
+    }
+  }
+
   // Hints, not fixes.
   const hints: string[] = [];
   const anyDrvfs = paths.some(p => detectFsType(p.path, mounts).isDrvfs || detectFsType(p.path, mounts).isMntDrive);
@@ -325,6 +406,13 @@ export async function runDoctor(): Promise<void> {
   if (pending.failed || pending.pendingRows > 0 || pending.backupEntries > 0) {
     hints.push("Legacy chat threads are still tagged opencodex (or the DB was locked). The running proxy retries the migration automatically; to force it now, close the Codex app and run 'ocx sync'.");
   }
+  if (dual.dualInstall && !dual.effectiveIsWindowsMount) {
+    hints.push(`Codex is installed on BOTH WSL and Windows. Each side keeps its own ~/.codex (logins, config, catalog are separate); ocx here manages the Linux one. To share a single home, set CODEX_HOME=${dual.windowsCodexHomes[0] ?? `${dual.automountRoot}/c/Users/<you>/.codex`} in WSL (drvfs file locking is less reliable).`);
+    hints.push("localhost is one-way in WSL2 NAT mode: Windows-side codex reaches this WSL proxy via localhost (localhostForwarding, on by default), but a Windows-side proxy is NOT reachable from WSL via localhost — use networkingMode=mirrored in .wslconfig for both directions.");
+  }
+  if (dual.interopCodexOnPath) {
+    hints.push("The `codex` found on PATH is the Windows launcher reached through WSL interop; ocx will not shim it (a WSL shim breaks Windows invocations). Install codex inside WSL (npm i -g @openai/codex) or run 'ocx ensure' from Windows.");
+  }
   if (hints.length > 0) {
     console.log("\nHints");
     for (const h of hints) console.log(`  - ${h}`);

package/src/codex/home.ts

@@ -1,6 +1,6 @@
 import { existsSync, readFileSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { join, posix, resolve } from "node:path";
 import { expandUserPath } from "../config";
 
 export type CodexHomeDeps = {
@@ -10,18 +10,64 @@ export type CodexHomeDeps = {
   procVersion?: string | null;
   homedir?: () => string;
   usersRoot?: string;
+  /** Raw /etc/wsl.conf content override (tests); null means "no file". */
+  wslConf?: string | null;
   existsSync?: (path: string) => boolean;
   readdirSync?: (path: string) => string[];
   statSync?: typeof statSync;
   realpathSync?: (path: string) => string;
 };
 
-function windowsUserProfileToWslPath(value: string | undefined): string | null {
+function windowsUserProfileToWslPath(value: string | undefined, automountRoot = DEFAULT_WSL_AUTOMOUNT_ROOT): string | null {
   if (!value) return null;
   const normalized = value.replaceAll("\\", "/");
   const match = normalized.match(/^([A-Za-z]):\/Users\/([^/]+)$/);
   if (!match) return null;
-  return `/mnt/${match[1]!.toLowerCase()}/Users/${match[2]}`;
+  const root = normalizeAutomountRoot(automountRoot);
+  return `${root === "/" ? "" : root}/${match[1]!.toLowerCase()}/Users/${match[2]}`;
+}
+
+const DEFAULT_WSL_AUTOMOUNT_ROOT = "/mnt";
+
+function normalizeAutomountRoot(value: string): string {
+  const trimmed = value.replace(/\/+$/, "");
+  return trimmed === "" ? "/" : trimmed;
+}
+
+function readWslConf(): string | null {
+  try {
+    return readFileSync("/etc/wsl.conf", "utf8");
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Windows drive mount root inside WSL: `[automount] root` from /etc/wsl.conf,
+ * default `/mnt` (https://learn.microsoft.com/en-us/windows/wsl/wsl-config).
+ * Returns a path without a trailing slash (or `/` itself).
+ */
+export function wslAutomountRoot(deps: CodexHomeDeps = {}): string {
+  const content = deps.wslConf !== undefined ? deps.wslConf : readWslConf();
+  if (!content) return DEFAULT_WSL_AUTOMOUNT_ROOT;
+  let section = "";
+  for (const rawLine of content.split("\n")) {
+    const line = rawLine.replace(/[#;].*$/, "").trim();
+    if (!line) continue;
+    const sect = line.match(/^\[(.+)\]$/);
+    if (sect) {
+      section = sect[1]!.trim().toLowerCase();
+      continue;
+    }
+    if (section !== "automount") continue;
+    const kv = line.match(/^root\s*=\s*(.+)$/i);
+    if (kv) {
+      const value = kv[1]!.trim().replace(/^["']|["']$/g, "");
+      if (!value.startsWith("/")) return DEFAULT_WSL_AUTOMOUNT_ROOT;
+      return normalizeAutomountRoot(value);
+    }
+  }
+  return DEFAULT_WSL_AUTOMOUNT_ROOT;
 }
 
 function readProcVersion(): string | null {
@@ -40,23 +86,24 @@ export function isWslRuntime(deps: CodexHomeDeps = {}): boolean {
   return /microsoft|wsl/i.test(version);
 }
 
-export function findWslWindowsCodexHome(deps: CodexHomeDeps = {}): string | null {
-  if (!isWslRuntime(deps)) return null;
+/** All Windows-profile `.codex` homes (with config.toml) visible from WSL, resolved real paths. */
+export function listWslWindowsCodexHomes(deps: CodexHomeDeps = {}): string[] {
+  if (!isWslRuntime(deps)) return [];
   const exists = deps.existsSync ?? existsSync;
   const stat = deps.statSync ?? statSync;
   const readdir = deps.readdirSync ?? readdirSync;
   const realpath = deps.realpathSync ?? realpathSync.native;
-  const env = deps.env ?? process.env;
-  const usersRoot = deps.usersRoot ?? "/mnt/c/Users";
-  if (!exists(usersRoot)) return null;
+  const automountRoot = wslAutomountRoot(deps);
+  // WSL mount paths are POSIX by definition; keep separators stable on any host.
+  const usersRoot = deps.usersRoot ?? posix.join(automountRoot, "c", "Users");
+  if (!exists(usersRoot)) return [];
 
-  const explicitProfile = windowsUserProfileToWslPath(env.USERPROFILE);
   const candidates = [];
   try {
     for (const user of readdir(usersRoot)) {
       if (user === "Default" || user === "Default User" || user === "Public" || user === "All Users") continue;
-      const home = join(usersRoot, user, ".codex");
-      const config = join(home, "config.toml");
+      const home = posix.join(usersRoot, user, ".codex");
+      const config = posix.join(home, "config.toml");
       if (!exists(config)) continue;
       try {
         if (stat(home).isDirectory()) candidates.push(realpath(home));
@@ -65,11 +112,19 @@ export function findWslWindowsCodexHome(deps: CodexHomeDeps = {}): string | null
       }
     }
   } catch {
-    return null;
+    return [];
   }
+  return candidates;
+}
+
+export function findWslWindowsCodexHome(deps: CodexHomeDeps = {}): string | null {
+  const env = deps.env ?? process.env;
+  const candidates = listWslWindowsCodexHomes(deps);
+  if (candidates.length === 0) return null;
 
+  const explicitProfile = windowsUserProfileToWslPath(env.USERPROFILE, wslAutomountRoot(deps));
   if (explicitProfile) {
-    const explicitHome = join(explicitProfile, ".codex");
+    const explicitHome = posix.join(explicitProfile, ".codex");
     const match = candidates.find(candidate => candidate === explicitHome || candidate.endsWith(`/${explicitProfile.split("/").pop()}/.codex`));
     if (match) return match;
   }

package/src/codex/shim.ts

@@ -1,12 +1,17 @@
-import { delimiter, dirname, extname, join } from "node:path";
+import { delimiter, dirname, extname, join, posix } from "node:path";
 import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { getConfigDir } from "../config";
 import { durableBunPath } from "../lib/bun-runtime";
 import { serviceApiTokenFilePath } from "../lib/service-secrets";
 import { windowsEnvIndirectBatchValue } from "../lib/win-paths";
+import { isWslRuntime, wslAutomountRoot } from "./home";
 
 const SHIM_MARKER = "opencodex codex autostart shim";
 let lastShimDiscoveryError: string | null = null;
+/** Last human-readable reason discovery returned null (exposed for doctor/tests). */
+export function lastCodexDiscoveryError(): string | null {
+  return lastShimDiscoveryError;
+}
 const CODEX_INTERNAL_COMMANDS = [
   "app-server",
   "archive",
@@ -66,18 +71,77 @@ function isShim(path: string): boolean {
   }
 }
 
-function findCodexOnPath(): string | null {
-  for (const dir of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
-    for (const name of commandNames("codex")) {
-      const path = join(dir, name);
-      if (!existsSync(path) || isShim(path)) continue;
-      try {
-        if (!lstatSync(path).isDirectory()) return path;
-      } catch {
-        continue;
+/**
+ * A PATH entry that reaches Windows through WSL drive interop
+ * (`<automount-root>/<drive>/...`; root defaults to /mnt, configurable via
+ * /etc/wsl.conf [automount] root).
+ */
+export function isWindowsInteropDir(dir: string, automountRoot = "/mnt"): boolean {
+  const root = automountRoot.replace(/\/+$/, "");
+  const escaped = root.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  return new RegExp(`^${escaped}/[a-z](/|$)`, "i").test(dir);
+}
+
+export type CodexPathScanDeps = {
+  pathValue?: string;
+  wsl?: boolean;
+  /** Treat PATH entries as POSIX paths (WSL context). Defaults to wsl || non-win32. */
+  posixPaths?: boolean;
+  automountRoot?: string;
+  exists?: (path: string) => boolean;
+  isShimFile?: (path: string) => boolean;
+  isDirectory?: (path: string) => boolean;
+};
+
+function realIsDirectory(path: string): boolean {
+  try {
+    return lstatSync(path).isDirectory();
+  } catch {
+    return true; // unreadable -> treat as unusable
+  }
+}
+
+export function findCodexOnPath(deps: CodexPathScanDeps = {}): string | null {
+  lastShimDiscoveryError = null;
+  const exists = deps.exists ?? existsSync;
+  const shimFile = deps.isShimFile ?? isShim;
+  const isDir = deps.isDirectory ?? realIsDirectory;
+  const wsl = deps.wsl ?? (process.platform === "linux" && isWslRuntime());
+  const usePosix = deps.posixPaths ?? (wsl || process.platform !== "win32");
+  const joinPath = usePosix ? posix.join : join;
+  const pathSep = usePosix ? ":" : delimiter;
+  const automountRoot = deps.automountRoot ?? (wsl ? wslAutomountRoot() : "/mnt");
+  // Windows npm prefixes ship codex.exe/codex.cmd next to the extensionless sh launcher.
+  const interopNames = ["codex", "codex.exe", "codex.cmd", "codex.ps1"];
+  let skippedInterop: string | null = null;
+
+  for (const dir of (deps.pathValue ?? process.env.PATH ?? "").split(pathSep).filter(Boolean)) {
+    if (wsl && isWindowsInteropDir(dir, automountRoot)) {
+      // A Windows-side codex reached through WSL PATH interop: a Unix shim written
+      // here would embed WSL-only paths and break every Windows-side invocation.
+      if (!skippedInterop) {
+        for (const name of interopNames) {
+          const path = joinPath(dir, name);
+          if (exists(path) && !shimFile(path) && !isDir(path)) { skippedInterop = path; break; }
+        }
       }
+      continue;
+    }
+    // Interop dirs carry Windows launcher names even when the scan is not skipping them.
+    const names = isWindowsInteropDir(dir, automountRoot) ? interopNames : commandNames("codex");
+    for (const name of names) {
+      const path = joinPath(dir, name);
+      if (!exists(path) || shimFile(path)) continue;
+      if (!isDir(path)) return path;
     }
   }
+
+  if (skippedInterop) {
+    lastShimDiscoveryError =
+      `Found a Windows codex at ${skippedInterop} via WSL PATH interop, but no Linux-side codex. ` +
+      "Refusing to shim a Windows launcher from WSL (a WSL shim breaks Windows invocations). " +
+      "Install codex inside WSL (npm i -g @openai/codex), or run 'ocx ensure' from Windows to shim the Windows side.";
+  }
   return null;
 }
 

package/src/lib/gcp-adc.ts

@@ -4,7 +4,8 @@
  * Direct WebCrypto + REST implementation (no `google-auth-library`). Sources, in priority order:
  *   1. `GOOGLE_APPLICATION_CREDENTIALS` env → file with `type: "service_account"` (RS256 JWT
  *      exchange) or `type: "authorized_user"` (refresh-token exchange).
- *   2. `~/.config/gcloud/application_default_credentials.json` (user ADC; authorized_user flow).
+ *   2. gcloud user ADC (`CLOUDSDK_CONFIG`, else `%APPDATA%\gcloud` on Windows, else
+ *      `~/.config/gcloud`) `application_default_credentials.json` (authorized_user flow).
  *   3. GCE / Cloud Run metadata server.
  *
  * Tokens are cached per source key and refreshed `GOOGLE_VERTEX_REFRESH_SKEW_MS` (default 60s)
@@ -65,8 +66,18 @@ function getRefreshSkewMs(): number {
   return Number.isFinite(raw) && raw > 0 ? raw : 60_000;
 }
 
+/** gcloud config dir, matching the SDK's own resolution order. */
+function gcloudConfigDir(): string {
+  const explicit = process.env.CLOUDSDK_CONFIG?.trim();
+  if (explicit) return explicit;
+  if (process.platform === "win32" && process.env.APPDATA) {
+    return path.join(process.env.APPDATA, "gcloud");
+  }
+  return path.join(os.homedir(), ".config", "gcloud");
+}
+
 function userAdcPath(): string {
-  return path.join(os.homedir(), ".config", "gcloud", "application_default_credentials.json");
+  return path.join(gcloudConfigDir(), "application_default_credentials.json");
 }
 
 /**

package/src/oauth/anthropic.ts

@@ -137,8 +137,8 @@ export async function loginAnthropic(
     } else if (importLocal === "only") {
       throw new Error(
         process.platform === "darwin"
-          ? "No Claude Code token found in the keychain. Run 'ocx login anthropic' for browser OAuth."
-          : "Claude Code auto-import is macOS-only. Run 'ocx login anthropic' for browser OAuth.",
+          ? "No Claude Code token found (Keychain or ~/.claude/.credentials.json). Run 'ocx login anthropic' for browser OAuth."
+          : "No Claude Code token found (~/.claude/.credentials.json). Run 'ocx login anthropic' for browser OAuth.",
       );
     }
   }

package/src/oauth/local-token-detect.ts

@@ -39,8 +39,14 @@ export function detectGrokCliToken(): OAuthCredentials | null {
   }
 }
 
-/** Read the Claude Code OAuth credential from macOS Keychain. Windows/Linux: use `ocx login`. */
-function readClaudeSecureStorage(): string | null {
+/** Claude Code config dir: `CLAUDE_CONFIG_DIR` override, else `~/.claude`. */
+function claudeConfigDir(): string {
+  const explicit = process.env.CLAUDE_CONFIG_DIR?.trim();
+  return explicit ? explicit : join(homedir(), ".claude");
+}
+
+/** Read the Claude Code OAuth credential from the macOS Keychain (darwin only). */
+function readClaudeKeychain(): string | null {
   if (process.platform !== "darwin") return null;
   try {
     return execSync(`security find-generic-password -s "${CLAUDE_KEYCHAIN_SERVICE}" -w`, {
@@ -51,9 +57,28 @@ function readClaudeSecureStorage(): string | null {
   }
 }
 
-export function detectClaudeCodeToken(): OAuthCredentials | null {
-  const raw = readClaudeSecureStorage();
-  if (!raw) return null;
+/**
+ * Read the Claude Code credential file (`<config-dir>/.credentials.json`).
+ * Claude Code writes this on Linux/Windows (and on macOS when the Keychain is
+ * unavailable); it carries the same `claudeAiOauth` payload as the Keychain item.
+ * Exported for tests.
+ */
+export function readClaudeCredentialsFile(): string | null {
+  const path = join(claudeConfigDir(), ".credentials.json");
+  try {
+    if (!existsSync(path)) return null;
+    return readFileSync(path, "utf8").trim();
+  } catch {
+    return null;
+  }
+}
+
+/** Keychain first on macOS, then the cross-platform credentials file. */
+function readClaudeSecureStorage(): string | null {
+  return readClaudeKeychain() ?? readClaudeCredentialsFile();
+}
+
+export function parseClaudeOauthPayload(raw: string): OAuthCredentials | null {
   try {
     const data = JSON.parse(raw) as { claudeAiOauth?: { accessToken?: string; refreshToken?: string; expiresAt?: number } };
     const o = data.claudeAiOauth;
@@ -63,3 +88,9 @@ export function detectClaudeCodeToken(): OAuthCredentials | null {
     return null;
   }
 }
+
+export function detectClaudeCodeToken(): OAuthCredentials | null {
+  const raw = readClaudeSecureStorage();
+  if (!raw) return null;
+  return parseClaudeOauthPayload(raw);
+}

package/src/service.ts

@@ -12,6 +12,7 @@ import { dirname, join, resolve } from "node:path";
 import { expandUserPath, getConfigDir, readPid, removePid, removeRuntimePort } from "./config";
 import { loadConfig } from "./config";
 import { restoreNativeCodex } from "./codex/inject";
+import { isWslRuntime } from "./codex/home";
 import { durableBunPath, durableBunRuntime } from "./lib/bun-runtime";
 import { isProcessAlive, stopProxy } from "./lib/process-control";
 import { serviceApiTokenFilePath } from "./lib/service-secrets";
@@ -572,6 +573,9 @@ function platformOps(): ServiceOps | null {
     }
     if (!isSystemd() && !existsSync(unitPath())) {
       console.error("systemd not found. Run 'ocx start' under your process supervisor.");
+      if (isWslRuntime()) {
+        console.error("WSL detected: enable systemd by adding [boot] systemd=true to /etc/wsl.conf, then run 'wsl --shutdown' from Windows and reopen the distro (WSL 0.67.6+).");
+      }
       process.exit(1);
     }
     return { install: installSystemd, start: startSystemd, stop: stopSystemd, status: statusSystemd, uninstall: uninstallSystemd };