@bitkyc08/opencodex 2.64.0-preview.20260923 → 2.65.0-preview.20260925

package/src/claude/model-info.ts

@@ -80,9 +80,14 @@ export interface AnthropicModelInfo {
   capabilities: ReturnType<typeof modelCapabilities>;
   max_input_tokens: number | null;
   max_tokens: null;
+  /**
+   * Claude Code (>= 2.1.257) shows this under the picker row instead of the generic
+   * "From gateway". Readable (CLI) rows only; Desktop 3P rows keep the ModelInfo shape.
+   */
+  description?: string;
 }
 
-function modelInfo(id: string, displayName: string, ladder: readonly string[], imageInput: boolean, contextWindow?: number): AnthropicModelInfo {
+function modelInfo(id: string, displayName: string, ladder: readonly string[], imageInput: boolean, contextWindow?: number, description?: string): AnthropicModelInfo {
   return {
     id,
     display_name: displayName,
@@ -91,6 +96,7 @@ function modelInfo(id: string, displayName: string, ladder: readonly string[], i
     capabilities: modelCapabilities(ladder, imageInput),
     max_input_tokens: typeof contextWindow === "number" && contextWindow > 0 ? contextWindow : null,
     max_tokens: null,
+    ...(description === undefined ? {} : { description }),
   };
 }
 
@@ -182,7 +188,13 @@ export function buildAnthropicModelInfos(
     // A real model always wins its own id, whatever the iteration order.
     if (realDiscoveryIds.has(id) || seen.has(id)) return;
     seen.add(id);
-    out.push({ ...base, id, display_name: `${base.display_name} · Fast` });
+    out.push({
+      ...base,
+      id,
+      display_name: `${base.display_name} · Fast`,
+      // Fast picks a different tier/variant, so the picker line says so like the name does.
+      ...(base.description === undefined ? {} : { description: `${base.description} · Fast` }),
+    });
   };
   for (const slug of nativeSlugs) {
     const id = idStyle === "readable" ? claudeCodeNativeAlias(slug) : aliasForRoute("native", slug);
@@ -192,7 +204,8 @@ export function buildAnthropicModelInfos(
     const nativeMaxInput = nativeOpenAiMaxInputTokens(slug, nativeContextCap);
     // max_input_tokens is an INPUT limit, so it follows the measured input ceiling rather
     // than the total window whenever the model publishes one.
-    const info = modelInfo(id, `${slug} (native)`, nativeEffectiveLadder(slug), true, nativeMaxInput ?? nativeWindow);
+    const description = idStyle === "readable" ? `Routed by OpenCodex to native ${slug}` : undefined;
+    const info = modelInfo(id, `${slug} (native)`, nativeEffectiveLadder(slug), true, nativeMaxInput ?? nativeWindow, description);
     out.push(info);
     push1mVariant(info, nativeWindow, nativeMaxInput);
     // Natives too, not only routed rows: gpt-5.6-sol is the flagship Fast model, and
@@ -225,7 +238,8 @@ export function buildAnthropicModelInfos(
         ? Math.min(m.maxInputTokens, m.contextWindow)
         : m.maxInputTokens)
       : undefined;
-    const info = modelInfo(id, `${listedModelId} (${m.provider})`, ladder, imageInput, routedMaxInput ?? m.contextWindow);
+    const description = idStyle === "readable" ? `Routed by OpenCodex to ${m.provider}/${listedModelId}` : undefined;
+    const info = modelInfo(id, `${listedModelId} (${m.provider})`, ladder, imageInput, routedMaxInput ?? m.contextWindow, description);
     out.push(info);
     // Anthropic passthrough guard (audit 021 #3): never auto-widen canonical claude
     // routes — only a genuine >=1M window earns the variant row there.

package/src/cli/agent.ts

@@ -1,6 +1,7 @@
 import {
   CliUsageError,
   csv,
+  desktopSwitchApplyReason,
   printData,
   rejectArgs,
   runCliAction,
@@ -29,7 +30,7 @@ const USAGE = `Usage:
   ocx agent fallback <status|set|clear> [model,model...] [--poll-ms <5000-600000>] [--json]
   ocx agent sidecar <status|web|vision> [--list] [--model <id|->]
       [--backend web:<openai|anthropic|xai|gemini|exa|-> vision:<openai|anthropic|routed|->]
-      [--reasoning <level>] [--max-descriptions <n>] [--json]
+      [--reasoning <level>] [--max-descriptions <n>] [--enabled <on|off>] [--json]
   ocx agent request-user-input [on|off] [--json]`;
 
 function clearable(value: string | undefined): string | null | undefined {
@@ -188,12 +189,14 @@ async function sidecar(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const backend = takeOption(args, "--backend");
   const reasoning = takeOption(args, "--reasoning");
   const maxDescriptionsPerTurn = takeIntegerOption(args, "--max-descriptions", { min: 1 });
+  const enabled = takeBooleanOption(args, "--enabled");
   rejectArgs(args, USAGE);
   const settings: Record<string, unknown> = {};
   if (model !== undefined) settings.model = model === "-" ? "" : model;
   if (backend !== undefined) settings.backend = backend === "-" ? null : backend;
   if (reasoning !== undefined) settings.reasoning = reasoning;
   if (maxDescriptionsPerTurn !== undefined) settings.maxDescriptionsPerTurn = maxDescriptionsPerTurn;
+  if (enabled !== undefined) settings.enabled = enabled;
   if (Object.keys(settings).length === 0) throw new CliUsageError("at least one sidecar option is required", USAGE);
   if (section === "web" && model !== undefined && model !== "-") {
     const offered = await runtimeRequest("/api/sidecar-settings", {}, deps) as {
@@ -210,7 +213,18 @@ async function sidecar(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   }
   const body = section === "web" ? { webSearch: settings } : { vision: settings };
   const result = await runtimeRequest("/api/sidecar-settings", { method: "PUT", body: JSON.stringify(body) }, deps);
-  printData(result, wantsJson, [`${section} sidecar settings updated.`]);
+  const lines = [`${section} sidecar settings updated.`];
+  // Only a switch that MOVED owes a Codex-side write, and only the server can say whether that
+  // write happened — silence here would read as "the native tool is off now" either way. The
+  // wording is the Desktop switches' one vocabulary for the same report.
+  const apply = (result as { codexWebSearch?: { applied?: boolean; reason?: string; detail?: string } } | null)?.codexWebSearch;
+  if (apply && apply.reason !== "not_requested") {
+    const detail = typeof apply.detail === "string" && apply.detail.length > 0 ? ` Details: ${apply.detail}` : "";
+    lines.push(apply.applied === true
+      ? "Codex config: ~/.codex/config.toml was rewritten."
+      : `Codex config: ~/.codex/config.toml was not rewritten because ${desktopSwitchApplyReason(apply.reason)}.${detail} Run 'ocx sync' to apply the stored settings.`);
+  }
+  printData(result, wantsJson, lines);
 }
 
 export async function handleAgentCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {

package/src/cli/capabilities.ts

@@ -784,7 +784,7 @@ export const CAPABILITIES: readonly Capability[] = [
     summary: "Restart the Codex desktop app and app-servers.",
     routes: [{ method: "POST", path: "/api/system/codex-restart" }],
     flags: [
-      { name: "--yes", value: "boolean", summary: "Required: fully quits and relaunches the operator's Codex desktop app and restarts its app-servers." },
+      { name: "--yes", value: "boolean", summary: "Required: fully quits and relaunches the operator's Codex desktop app, which may discard unsaved composer drafts, model-picker selections, and pending approval prompts; also restarts its app-servers." },
       { name: "--json", value: "boolean", summary: "Emit the restart result as JSON." },
     ],
     mutates: true,
@@ -792,7 +792,7 @@ export const CAPABILITIES: readonly Capability[] = [
     details: [
       "`sync --restart-codex` is not a substitute: it restarts only as a side effect after a catalog or cache write, so it cannot restart a healthy install on request.",
       "Restarts the Codex desktop app as well as the app-servers, through the same module the CLI uses. When the proxy itself runs inside the Codex app it refuses instead, because restarting the app would kill the request.",
-      "--yes is mandatory because this interrupts a running editor session, which must never happen because an agent guessed a subcommand.",
+      "--yes is mandatory because this interrupts a running editor session and may discard unsaved composer drafts, model-picker selections, and pending approval prompts; it must never happen because an agent guessed a subcommand.",
     ],
   },
   {
@@ -806,6 +806,75 @@ export const CAPABILITIES: readonly Capability[] = [
       "Distinct from `claude desktop show`, which reports what this machine WOULD write; this reports what is actually in effect, which only the running proxy knows.",
     ],
   },
+  {
+    command: ["claude", "desktop", "bind"],
+    summary: "First-party: serve a Claude Desktop Code tab picker model with an opencodex route.",
+    routes: [{ method: "PUT", path: "/api/claude-desktop/first-party-bindings" }],
+    flags: [],
+    mutates: true,
+    json: "none",
+    details: [
+      "Takes a picker model id (claude-sonnet-4-6) and a route in the Desktop route vocabulary (provider/model or native/<slug>); the route must be one the Desktop profile can offer.",
+      "Only Claude Code traffic that reaches the proxy through the first-party intercept (Desktop's Code tab, the claude CLI) honours it; ocx claude and the public Messages endpoint are unaffected.",
+      "The Desktop picker keeps Anthropic's label; the binding changes which model answers, starting with the next request.",
+    ],
+  },
+  {
+    command: ["claude", "desktop", "unbind"],
+    summary: "Remove a first-party Claude Desktop Code tab picker binding.",
+    routes: [{ method: "PUT", path: "/api/claude-desktop/first-party-bindings" }],
+    flags: [],
+    mutates: true,
+    json: "none",
+    details: [
+      "Removing an id that is not bound is a no-op; the remaining bindings are printed.",
+    ],
+  },
+  {
+    command: ["claude", "desktop", "picker", "status"],
+    summary: "First-party picker mode: whether Claude Desktop's Code tab lists opencodex models, and what is missing if not.",
+    routes: [{ method: "GET", path: "/api/claude-desktop/picker" }],
+    flags: [],
+    mutates: false,
+    json: "none",
+    details: [
+      "Reports desired, effective, keychain trust, the Desktop egress profile, the model count and a reason with the next command to run.",
+    ],
+  },
+  {
+    command: ["claude", "desktop", "picker", "on"],
+    summary: "Turn first-party picker mode on and remember the choice.",
+    routes: [{ method: "PUT", path: "/api/claude-desktop/picker" }],
+    flags: [],
+    mutates: true,
+    json: "none",
+    details: [
+      "Needs a running proxy, first-party mode and macOS. The first time, macOS asks to trust a local certificate authority limited to claude.ai; when the server cannot show that prompt the command runs the trust step in this terminal.",
+      "Claude Desktop then reaches the network through opencodex; fully quit and reopen Desktop afterwards.",
+    ],
+  },
+  {
+    command: ["claude", "desktop", "picker", "off"],
+    summary: "Turn first-party picker mode off, remove its Desktop egress profile and certificate trust, and remember the choice.",
+    routes: [{ method: "PUT", path: "/api/claude-desktop/picker" }],
+    flags: [],
+    mutates: true,
+    json: "none",
+    details: [
+      "Works without a running proxy: the preference is saved and the picker profile and trust are removed locally.",
+    ],
+  },
+  {
+    command: ["claude", "desktop", "picker", "trust"],
+    summary: "Run the macOS keychain step for picker mode in this terminal, then ask the server to finish enabling it.",
+    routes: [{ method: "PUT", path: "/api/claude-desktop/picker" }],
+    flags: [],
+    mutates: true,
+    json: "none",
+    details: [
+      "The server removes trust this command added if the enable is refused; if the request is lost, trust is left alone and picker status tells what happened.",
+    ],
+  },
   {
     command: ["integration", "native"],
     summary: "Show or toggle the native Claude, Claude Desktop, Codex, and Grok integrations, and read the Cursor status (which builds are installed, gateway values, last request seen).",