@bitkyc08/opencodex 2.7.43 → 2.8.2-preview.20260731

package/src/cli/init.ts

@@ -8,11 +8,28 @@ import type { OcxConfig, OcxProviderConfig } from "../types";
 
 function createPrompt(): { ask(question: string): Promise<string>; close(): void } {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  let closed = false;
+  rl.on("close", () => { closed = true; });
   return {
     ask(question: string): Promise<string> {
-      return new Promise(resolve => rl.question(question, resolve));
+      return new Promise((resolve, reject) => {
+        if (closed) {
+          reject(new Error("stdin closed before the prompt could be answered"));
+          return;
+        }
+        const onClose = () => {
+          reject(new Error("stdin reached EOF while waiting for input"));
+        };
+        rl.once("close", onClose);
+        rl.question(question, answer => {
+          rl.off("close", onClose);
+          resolve(answer);
+        });
+      });
+    },
+    close() {
+      if (!closed) rl.close();
     },
-    close() { rl.close(); },
   };
 }
 
@@ -83,115 +100,125 @@ export function cleanupOpenAiTierBackupAfterInit(configPath = getConfigPath()):
 
 export async function runInit(): Promise<void> {
   const prompt = createPrompt();
-  console.log("\n🔧 opencodex (ocx) setup\n");
-
-  const providers = buildInitProviders();
-  printMenu(providers);
-
-  const choice = await prompt.ask("\nSelect default provider (number): ");
-  const idx = parseInt(choice, 10) - 1;
-
-  let providerName: string;
-  let providerConfig: OcxProviderConfig;
-  let oauthHint = false;
-
-  if (idx >= 0 && idx < providers.length) {
-    const p = providers[idx];
-    providerName = p.id;
-    console.log(`\n📡 ${p.label}`);
-    console.log(`   Base URL: ${p.baseUrl}`);
-
-    if (p.kind === "forward") {
-      providerConfig = { adapter: p.adapter, baseUrl: p.baseUrl, authMode: "forward" };
-      console.log("   No API key needed — forwards your existing `codex login`.");
-    } else if (p.kind === "oauth") {
-      providerConfig = { adapter: p.adapter, baseUrl: p.baseUrl, authMode: "oauth", ...(p.defaultModel ? { defaultModel: p.defaultModel } : {}) };
-      oauthHint = true;
-    } else {
-      // key + local: collect a key (local usually blank).
-      if (p.dashboardUrl) console.log(`   🔑 Get your key: ${p.dashboardUrl}`);
-      // Template URL with placeholders (e.g. Cloudflare's {account_id}) needs a resolved value.
-      let baseUrl = p.baseUrl;
-      if (/\{[^}]*\}/.test(baseUrl)) {
-        const resolved = (await prompt.ask(`   Your endpoint URL (${baseUrl}): `)).trim();
-        if (!resolved) {
-          console.error("   A resolved URL is required — replace the {placeholder} with your actual value.");
-          process.exit(1);
+  try {
+    console.log("\n🔧 opencodex (ocx) setup\n");
+
+    const providers = buildInitProviders();
+    printMenu(providers);
+
+    const choice = await prompt.ask("\nSelect default provider (number): ");
+    const idx = parseInt(choice, 10) - 1;
+
+    let providerName: string;
+    let providerConfig: OcxProviderConfig;
+    let oauthHint = false;
+
+    if (idx >= 0 && idx < providers.length) {
+      const p = providers[idx];
+      providerName = p.id;
+      console.log(`\n📡 ${p.label}`);
+      console.log(`   Base URL: ${p.baseUrl}`);
+
+      if (p.kind === "forward") {
+        providerConfig = { adapter: p.adapter, baseUrl: p.baseUrl, authMode: "forward" };
+        console.log("   No API key needed — forwards your existing `codex login`.");
+      } else if (p.kind === "oauth") {
+        providerConfig = { adapter: p.adapter, baseUrl: p.baseUrl, authMode: "oauth", ...(p.defaultModel ? { defaultModel: p.defaultModel } : {}) };
+        oauthHint = true;
+      } else {
+        // key + local: collect a key (local usually blank).
+        if (p.dashboardUrl) console.log(`   🔑 Get your key: ${p.dashboardUrl}`);
+        // Template URL with placeholders (e.g. Cloudflare's {account_id}) needs a resolved value.
+        let baseUrl = p.baseUrl;
+        if (/\{[^}]*\}/.test(baseUrl)) {
+          const resolved = (await prompt.ask(`   Your endpoint URL (${baseUrl}): `)).trim();
+          if (!resolved) {
+            console.error("   A resolved URL is required — replace the {placeholder} with your actual value.");
+            process.exit(1);
+          }
+          baseUrl = resolved;
         }
-        baseUrl = resolved;
+        const env = envKeyFor(p.id);
+        const hint = p.kind === "local" ? "API key (usually blank — press Enter): " : `API key (paste, or env var $${env}): `;
+        const apiKey = (await prompt.ask(`\n${hint}`)).trim();
+        const modelChoice = (await prompt.ask(`Default model${p.defaultModel ? ` [${p.defaultModel}]` : " (optional)"}: `)).trim();
+        const defaultModel = modelChoice || p.defaultModel;
+        providerConfig = {
+          adapter: p.adapter,
+          baseUrl,
+          ...(p.kind === "key" ? { apiKey: apiKey || `\${${env}}` } : apiKey ? { apiKey } : {}),
+          ...(defaultModel ? { defaultModel } : {}),
+        };
+        // Apply the catalog's models / vision classification (same enrichment as the GUI).
+        enrichProviderFromCatalog(p.id, providerConfig);
+      }
+    } else {
+      providerName = (await prompt.ask("Provider name: ")).trim();
+      if (!isValidProviderName(providerName)) {
+        console.error("Provider name must use letters, numbers, dot, underscore, or hyphen and cannot be a reserved object key.");
+        process.exit(1);
       }
-      const env = envKeyFor(p.id);
-      const hint = p.kind === "local" ? "API key (usually blank — press Enter): " : `API key (paste, or env var $${env}): `;
-      const apiKey = (await prompt.ask(`\n${hint}`)).trim();
-      const modelChoice = (await prompt.ask(`Default model${p.defaultModel ? ` [${p.defaultModel}]` : " (optional)"}: `)).trim();
-      const defaultModel = modelChoice || p.defaultModel;
+      const baseUrl = await prompt.ask("Base URL (e.g. http://localhost:11434/v1): ");
+      const adapter = await prompt.ask("Adapter [openai-chat]: ") || "openai-chat";
+      const apiKey = await prompt.ask("API key (optional): ");
+      const defaultModel = await prompt.ask("Default model: ");
       providerConfig = {
-        adapter: p.adapter,
-        baseUrl,
-        ...(p.kind === "key" ? { apiKey: apiKey || `\${${env}}` } : apiKey ? { apiKey } : {}),
-        ...(defaultModel ? { defaultModel } : {}),
+        adapter: adapter.trim(),
+        baseUrl: baseUrl.trim(),
+        ...(apiKey.trim() ? { apiKey: apiKey.trim() } : {}),
+        ...(defaultModel.trim() ? { defaultModel: defaultModel.trim() } : {}),
       };
-      // Apply the catalog's models / vision classification (same enrichment as the GUI).
-      enrichProviderFromCatalog(p.id, providerConfig);
-    }
-  } else {
-    providerName = (await prompt.ask("Provider name: ")).trim();
-    if (!isValidProviderName(providerName)) {
-      console.error("Provider name must use letters, numbers, dot, underscore, or hyphen and cannot be a reserved object key.");
-      prompt.close();
-      process.exit(1);
     }
-    const baseUrl = await prompt.ask("Base URL (e.g. http://localhost:11434/v1): ");
-    const adapter = await prompt.ask("Adapter [openai-chat]: ") || "openai-chat";
-    const apiKey = await prompt.ask("API key (optional): ");
-    const defaultModel = await prompt.ask("Default model: ");
-    providerConfig = {
-      adapter: adapter.trim(),
-      baseUrl: baseUrl.trim(),
-      ...(apiKey.trim() ? { apiKey: apiKey.trim() } : {}),
-      ...(defaultModel.trim() ? { defaultModel: defaultModel.trim() } : {}),
-    };
-  }
 
-  const portStr = await prompt.ask("\nProxy port [10100]: ");
-  const port = parseInt(portStr, 10) || 10100;
+    const portStr = await prompt.ask("\nProxy port [10100]: ");
+    const port = parseInt(portStr, 10) || 10100;
 
-  const config: OcxConfig = {
-    ...getDefaultConfig(),
-    port,
-    providers: { [providerName]: providerConfig },
-    defaultProvider: providerName,
-  };
+    const config: OcxConfig = {
+      ...getDefaultConfig(),
+      port,
+      providers: { [providerName]: providerConfig },
+      defaultProvider: providerName,
+    };
 
-  saveConfig(config);
-  // Init writes a fresh config, so a stale pre-migration backup from a previous
-  // installation would make the next `ocx start` crash on a stale-backup
-  // collision (issue #257). But only a STALE backup (unparseable, or already a
-  // post-migration v2 snapshot) may be deleted; a backup that still parses as a
-  // valid pre-migration (v1) config is a user-intentional rollback point and is
-  // preserved by renaming it out of the collision path (sol review 260722).
-  cleanupOpenAiTierBackupAfterInit();
-  console.log(`\n✅ Config saved to ~/.opencodex/config.json`);
-  if (oauthHint) console.log(`🔐 Authenticate this provider with:  ocx login ${providerName}`);
-
-  const injectAnswer = await prompt.ask("Inject into Codex config.toml? [Y/n]: ");
-  if (injectAnswer.trim().toLowerCase() !== "n") {
-    console.log("Fetching available models from provider...");
-    const result = await injectCodexConfig(port, config);
-    console.log(result.success ? `✅ ${result.message}` : `⚠️  ${result.message}`);
-  }
+    saveConfig(config);
+    // Init writes a fresh config, so a stale pre-migration backup from a previous
+    // installation would make the next `ocx start` crash on a stale-backup
+    // collision (issue #257). But only a STALE backup (unparseable, or already a
+    // post-migration v2 snapshot) may be deleted; a backup that still parses as a
+    // valid pre-migration (v1) config is a user-intentional rollback point and is
+    // preserved by renaming it out of the collision path (sol review 260722).
+    cleanupOpenAiTierBackupAfterInit();
+    console.log(`\n✅ Config saved to ~/.opencodex/config.json`);
+    if (oauthHint) console.log(`🔐 Authenticate this provider with:  ocx login ${providerName}`);
+
+    const injectAnswer = await prompt.ask("Inject into Codex config.toml? [Y/n]: ");
+    if (injectAnswer.trim().toLowerCase() !== "n") {
+      console.log("Fetching available models from provider...");
+      const result = await injectCodexConfig(port, config);
+      console.log(result.success ? `✅ ${result.message}` : `⚠️  ${result.message}`);
+    }
 
-  const shimAnswer = await prompt.ask("Install Codex autostart shim? [Y/n]: ");
-  if (shimAnswer.trim().toLowerCase() !== "n") {
-    try {
-      const { installCodexShim } = await import("../codex/shim");
-      const result = installCodexShim();
-      console.log(result.installed ? `✅ ${result.message}` : `⚠️  ${result.message}`);
-    } catch (err) {
-      console.log(`⚠️  Codex autostart shim skipped: ${err instanceof Error ? err.message : String(err)}`);
+    const shimAnswer = await prompt.ask("Install Codex autostart shim? [Y/n]: ");
+    if (shimAnswer.trim().toLowerCase() !== "n") {
+      try {
+        const { installCodexShim } = await import("../codex/shim");
+        const result = installCodexShim();
+        console.log(result.installed ? `✅ ${result.message}` : `⚠️  ${result.message}`);
+      } catch (err) {
+        console.log(`⚠️  Codex autostart shim skipped: ${err instanceof Error ? err.message : String(err)}`);
+      }
     }
-  }
 
-  console.log(`\n🚀 Setup complete! Run 'ocx start' to start the proxy.`);
-  prompt.close();
+    console.log(`\n🚀 Setup complete! Run 'ocx start' to start the proxy.`);
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    if (/stdin (closed|reached EOF)/i.test(message)) {
+      console.error(`\n❌ ${message}. Re-run \`ocx init\` in an interactive terminal.`);
+      process.exitCode = 1;
+      return;
+    }
+    throw error;
+  } finally {
+    prompt.close();
+  }
 }

package/src/cli/interactive-confirm.ts

@@ -25,7 +25,11 @@ export interface InteractiveConfirmOptions {
   output?: NodeJS.WriteStream;
 }
 
-const REVERSE = "\x1b[7m";
+// The highlight sets an explicit black-on-white pair rather than bare reverse
+// video (\x1b[7m). Reverse alone inherits whatever foreground colour is in
+// effect, so on some themes the selected label rendered as black text on a black
+// block and the choice became invisible.
+const REVERSE = "\x1b[30;47m";
 const DIM = "\x1b[2m";
 const RESET = "\x1b[0m";
 const CLEAR_LINE = "\r\x1b[K";

package/src/cli/star-prompt.ts

@@ -3,6 +3,7 @@ import { join } from "node:path";
 import { spawnSync } from "node:child_process";
 import { getConfigDir } from "../config";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
+import { commandInvocation } from "../lib/win-exec";
 import { isAgentDriven } from "./agent-driven";
 import { interactiveConfirm } from "./interactive-confirm";
 
@@ -29,16 +30,37 @@ export function hasStarPromptRun(): boolean {
  * that case the prompt stays silent instead of asking for something it would
  * then fail to do.
  */
+/**
+ * On Windows `gh` is a `.cmd` shim; a shell-less spawn of the bare name skips
+ * PATHEXT and refuses `.cmd` targets, so it stalls until the timeout instead of
+ * failing fast. Route every call through the launcher the rest of the CLI uses.
+ */
+/** Resolve `gh` once; callers keep their own spawnSync overload. */
+function ghInvocation(args: string[]) {
+  const invocation = commandInvocation("gh", args);
+  return {
+    file: invocation.file,
+    args: invocation.args,
+    verbatim: invocation.options.windowsVerbatimArguments === true,
+  };
+}
+
 function ghAvailable(): boolean {
-  const version = spawnSync("gh", ["--version"], { stdio: "ignore", timeout: 3000, windowsHide: true });
+  const v = ghInvocation(["--version"]);
+  const version = spawnSync(v.file, v.args,
+    { stdio: "ignore", timeout: 3000, windowsHide: true, windowsVerbatimArguments: v.verbatim });
   if (version.error || version.status !== 0) return false;
-  const auth = spawnSync("gh", ["auth", "status"], { stdio: "ignore", timeout: 5000, windowsHide: true });
+  const a = ghInvocation(["auth", "status"]);
+  const auth = spawnSync(a.file, a.args,
+    { stdio: "ignore", timeout: 5000, windowsHide: true, windowsVerbatimArguments: a.verbatim });
   return !auth.error && auth.status === 0;
 }
 
 function starRepo(): { ok: boolean; error?: string } {
-  const r = spawnSync("gh", ["api", "-X", "PUT", `/user/starred/${REPO}`],
-    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 10000, windowsHide: true });
+  const star = ghInvocation(["api", "-X", "PUT", `/user/starred/${REPO}`]);
+  const r = spawnSync(star.file, star.args,
+    { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 10000, windowsHide: true,
+      windowsVerbatimArguments: star.verbatim });
   if (r.error) return { ok: false, error: r.error.message };
   if (r.status !== 0) return { ok: false, error: (r.stderr || r.stdout || "").trim() || `gh exited ${r.status}` };
   return { ok: true };

package/src/cli/v2.ts

@@ -11,7 +11,7 @@
  *  - nothing in the catalog build path calls this module; no auto-flip exists.
  */
 import { execFileSync } from "node:child_process";
-import { getLogicalMaxThreads, hasAgentsMaxThreads, isMultiAgentV2Enabled, transitionMultiAgentV2 } from "../codex/features";
+import { getAgentsEnabled, getAgentsMaxDepth, getLogicalMaxThreads, getSubagentDeveloperInstructions, hasAgentsMaxThreads, isMultiAgentV2Enabled, transitionMultiAgentV2 } from "../codex/features";
 
 import { commandInvocation, type SpawnInvocation } from "../lib/win-exec";
 import { loadConfig, saveConfig } from "../config";
@@ -85,6 +85,15 @@ export async function cmdV2(args: string[], deps: V2CliDeps = {}, findPort?: ()
     log.log(multiAgentModeLine(cfg.multiAgentMode ?? "default"));
     const threads = getLogicalMaxThreads();
     log.log(`max_threads: ${threads ?? "(unset — codex default)"}`);
+    const v2Active = isEnabled();
+    const agentsEnabled = getAgentsEnabled();
+    log.log(`agents.enabled: ${agentsEnabled === null ? "(unset — upstream default true)" : agentsEnabled}`);
+    const maxDepth = getAgentsMaxDepth();
+    // max_depth is V1-only upstream; say so whenever V2 is active so the number
+    // cannot be misread as an effective V2 limit.
+    log.log(`agents.max_depth: ${maxDepth ?? "(unset — upstream default 1)"}${v2Active ? " (V1-only — ignored while multi_agent_v2 is enabled)" : ""}`);
+    const instructions = getSubagentDeveloperInstructions();
+    log.log(`subagent_developer_instructions: ${instructions === null ? "(unset — children inherit)" : instructions === "" ? '"" (clears inherited instructions)' : JSON.stringify(instructions)}`);
     if (isEnabled() && hasMaxThreads()) {
       log.log("WARNING: [agents] max_threads is set — codex refuses to start while multi_agent_v2 is enabled. Remove it from config.toml (concurrency lives in features.multi_agent_v2.max_concurrent_threads_per_session).");
     }

package/src/codex/account-store.ts

@@ -2,6 +2,7 @@ import { createHash } from "node:crypto";
 import { closeSync, existsSync, readFileSync, mkdirSync, openSync, unlinkSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir, atomicWriteFile, backupInvalidConfig, hardenConfigDir, hardenExistingSecret } from "../config";
+import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import type { CodexAccountCredentialRecord, CodexAccountCredentials } from "../types";
 
 type LegacyCodexAccountStore = Record<string, CodexAccountCredentials>;
@@ -97,6 +98,7 @@ function loadCodexAccountRecordStore(): CodexAccountStore {
 
 function persist(store: CodexAccountStore): void {
   const dir = getConfigDir();
+  assertNotRealHomeUnderTest(dir);
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 0o700 });
   atomicWriteFile(codexAccountsPath(), JSON.stringify(store, null, 2) + "\n");
 }

package/src/codex/catalog/bundled.ts

@@ -151,14 +151,21 @@ export function loadBundledCodexCatalog(deps: BundledCatalogDeps = {}): RawCatal
   let cacheKey: string | null = null;
   const candidates = deps.commandCandidates?.() ?? (() => {
     const resolved = resolveAndPersistCodexRuntime({
-      execFileSync: execFile,
+      // Forward an INJECTED execFileSync only. Passing the real one unconditionally made
+      // resolveCacheKey() bail out (it refuses to memoize injected-dep resolves), so every
+      // catalog read re-ran the ~1s `codex --version` probe even on a warm cache hit.
+      ...(deps.execFileSync ? { execFileSync: deps.execFileSync } : {}),
       configDir: deps.configDir,
       env: deps.env,
       platform: deps.platform,
       existsSync: deps.existsSync,
       readFileSync: deps.readFileSync,
       now: deps.now,
-      discoverAlternatives: deps.discoverAlternatives,
+      // Catalog loading only consumes `resolved.runtime.command`, never `newerAvailable`.
+      // Full PATH discovery probes every candidate launcher (100+ on a dev machine, ~1.2s),
+      // which alone can exceed the 3s budget `ocx claude` allows /api/claude-code. Priority
+      // selection is identical either way; callers wanting discovery diagnostics opt in.
+      discoverAlternatives: deps.discoverAlternatives ?? false,
     });
     if (useCache) {
       cacheKey = [

package/src/codex/catalog/metadata.ts

@@ -123,6 +123,12 @@ export function visibleNativeSlugs(config: Pick<OcxConfig, "disabledModels">): s
   return nativeOpenAiSlugs().filter(slug => !disabled.has(slug));
 }
 
+/** Native slugs exposed to Claude Desktop show/export/apply (opt-out via claudeCode.desktopNativeModels). */
+export function desktopVisibleNativeSlugs(config: Pick<OcxConfig, "claudeCode" | "disabledModels">): string[] {
+  if (config.claudeCode?.desktopNativeModels === false) return [];
+  return visibleNativeSlugs(config);
+}
+
 export function nativeModelRows(config: Pick<OcxConfig, "disabledModels">): Array<{ slug: string; disabled: boolean; contextWindow?: number }> {
   const disabled = disabledNativeSlugs(config);
   return NATIVE_OPENAI_MODELS.map(slug => {

package/src/codex/catalog/parsing.ts

@@ -110,6 +110,8 @@ export interface CatalogModel {
   /** Whether Codex may send Responses text.verbosity for this routed model. */
   supportsVerbosity?: boolean;
   supportsReasoningSummaries?: boolean;
+  /** Normalized upstream capability names retained for management/API consumers (#485 follow-up). */
+  capabilities?: string[];
 }
 
 export type RawEntry = Record<string, unknown>;
@@ -272,6 +274,16 @@ export function ensureStrictCatalogFields(
   if (!Array.isArray(entry.input_modalities) && !options.preserveExactInputModalities) {
     entry.input_modalities = ["text"];
   }
+  // Codex parses `input_modalities` as a closed enum. One out-of-enum value (zenmux advertises
+  // "video") makes its config loader reject the entire catalog, which takes down plugins, apps and
+  // MCP servers — not just that model. Normalize at the single point every entry passes through,
+  // because provider metadata, jawcode metadata and effort sync each write this field.
+  if (Array.isArray(entry.input_modalities)) {
+    const accepted = entry.input_modalities.filter(value =>
+      value === "text" || value === "image" || value === "audio");
+    // Never leave it empty: an entry with no modality at all is worse than a text-only one.
+    entry.input_modalities = accepted.length > 0 ? accepted : ["text"];
+  }
   const contextWindow = typeof entry.context_window === "number" && entry.context_window > 0 ? entry.context_window : 128000;
   entry.context_window = contextWindow;
   if (
@@ -288,7 +300,18 @@ export function ensureStrictCatalogFields(
 
 export type MultiAgentMode = "v1" | "default" | "v2";
 
-export function applyMultiAgentMode(entries: RawEntry[], mode: MultiAgentMode): RawEntry[] {
+/**
+ * @param v2FeatureEnabled When the native multi_agent_v2 feature is on, "default"
+ *   mode stamps unpinned entries as "v2" instead of deleting the key. The native
+ *   binary validates spawn_agent models against THIS catalog with its own
+ *   `multi_agent_version == Some(V2)` test (codex-rs multi_agents_common.rs), so an
+ *   absent pin means a clean refusal at spawn time — exactly the cross-provider
+ *   spawns opencodex exists to enable (option B, devlog
+ *   260730_codex_rs_upstream_v2_live_handoff/060). Upstream pins are always
+ *   preserved: a genuine "v1" pin is a real capability statement and stays excluded.
+ *   With the feature off the output is byte-identical to the historical behavior.
+ */
+export function applyMultiAgentMode(entries: RawEntry[], mode: MultiAgentMode, v2FeatureEnabled = false): RawEntry[] {
   if (mode === "default") {
     // Restore upstream defaults: clear any stale forced multi_agent_version and
     // re-apply upstream pins from the snapshot for native entries that have one.
@@ -298,6 +321,8 @@ export function applyMultiAgentMode(entries: RawEntry[], mode: MultiAgentMode):
       const upstreamPin = upstream?.multi_agent_version;
       if (typeof upstreamPin === "string") {
         entry.multi_agent_version = upstreamPin;
+      } else if (v2FeatureEnabled) {
+        entry.multi_agent_version = "v2";
       } else {
         delete entry.multi_agent_version;
       }