@bitkyc08/opencodex 2.79.0 → 2.81.0

package/src/cli/capabilities-integrations.ts

@@ -111,6 +111,22 @@ export const INTEGRATION_CAPABILITIES: readonly Capability[] = [
     json: "payload",
     details: ["With --client, restore requires --profile; only Aside profiles accept that selector. No automatic drift confirmation or retry.","Preview preserves exact opId/profile/confirm-drift intent. Generic restore derives the client on the server; the returned plan does not embed opId or complete command input.","A refused or no-op preview is completed inspection, not applied work. A stale bound mutation exits5 with a fixed re-preview hint; no replacement token is automatically adopted."],
   },
+  {
+    command: ["commandcode", "restore"],
+    usage: "ocx commandcode restore --op <opId> [--confirm-drift] [--preview | --plan-fingerprint <token>] [--json]",
+    summary: "Restore a Command Code rollback operation, retaining client ownership and drift checks.",
+    routes: [{ method: "POST", path: "/api/client-integrations/commandcode/restore" }, { method: "POST", path: "/api/client-integrations/commandcode/restore/preview" }],
+    flags: [
+      { name: "--op", value: "string", summary: "Command Code operation ID; --op-id is an alias.", required: true },
+      { name: "--confirm-drift", value: "boolean", summary: "Explicitly allow replacing edits made after the snapshot." },
+      { name: "--preview", value: "boolean", summary: "Inspect restoration without mutating; exclusive with a commit fingerprint." },
+      { name: "--plan-fingerprint", value: "string", summary: "Optional versioned token from a matching preview; stale intent is refused without retry." },
+      { name: "--json", value: "boolean", summary: "Emit the result as JSON." },
+    ],
+    mutates: true,
+    json: "payload",
+    details: ["cmd restore is an alias. --client and --profile are rejected; the dedicated route binds the operation to Command Code.", "Older proxies without the dedicated route fail without a generic restore fallback. Redirects are refused.", "Preview preserves the operation and drift intent. A stale bound mutation requires a new explicit preview."],
+  },
   {
     command: ["claude", "config", "status"],
     usage: "ocx claude config status [--json]",

package/src/cli/codex-shim-autorestore.ts

@@ -15,11 +15,14 @@ const DEFAULT_DEPS: CodexShimAutoRestoreCliDeps = {
   readConfig: readConfigDiagnostics,
 };
 
+/** Identify command namespaces whose execution must not trigger automatic shim repair. */
 export function skipsCodexShimAutoRestore(command: string | undefined, args: string[]): boolean {
   if (command === "uninstall" || command === "remove") return true;
   if (command === "status" || command === "doctor") return true;
   // `lab` is read-only inspection; it must not trigger shim side effects.
   if (command === "lab") return true;
+  // Local messaging owns its helpers; even malformed usage must not repair/start anything.
+  if (command === "message") return true;
   // `resolve` is read-only inspection for embedding shells: a lookup made to populate
   // a consent surface must not trigger a shim repair side effect first.
   if (command === "resolve") return true;

package/src/cli/dispatch.ts

@@ -145,6 +145,7 @@ const commandRunners: Record<string, CommandRunner> = {
     if (!deps.head.resolveArgs) return 64;
     return await deps.handleResolve(deps.head.resolveArgs);
   },
+  message: async deps => (await import("./message-command")).runMessageCommand(deps.args.slice(1)),
   restore: async deps => {
     const restoreArgs = deps.args.slice(1);
     const restoreJson = takeFlag(restoreArgs, "--json");
@@ -465,7 +466,7 @@ const commandRunners: Record<string, CommandRunner> = {
             },
             config,
             port: live.port,
-          }, ["mcode", "pi", "raycast", "omo", "cline", "droid", "opencode", "kilo"]));
+          }, ["mcode", "pi", "raycast", "omo", "cline", "commandcode", "droid", "opencode", "kilo"]));
         } catch (error) {
           console.warn(`Client integrations were not refreshed: ${error instanceof Error ? error.message : String(error)}`);
         }
@@ -961,6 +962,14 @@ const commandRunners: Record<string, CommandRunner> = {
     const { handleZcodeCommand } = await import("./integrations");
     return await handleZcodeCommand(deps.args.slice(1));
   },
+  commandcode: async deps => {
+    const { handleCommandcodeCommand } = await import("./integrations");
+    return await handleCommandcodeCommand(deps.args.slice(1));
+  },
+  cmd: async deps => {
+    const { handleCommandcodeCommand } = await import("./integrations");
+    return await handleCommandcodeCommand(deps.args.slice(1));
+  },
   help: async () => {
     printUsage();
     return 0;

package/src/cli/help.ts

@@ -79,6 +79,7 @@ Usage:
   ocx alias <sub>             Short names for providers and models (list, set, rm, defaults)
   ocx combo <sub>             Combo routing strategies and failover
   ocx agent <sub>             Subagents, injection, effort caps, and sidecars
+  ocx message <sub>           Loaded local Codex sessions and queued peer messages (sessions|send)
   ocx effort [sub]            Inspect and configure reasoning effort caps and defaults
   ocx observe <sub>           Logs, usage, storage, memory, and debug data
   ocx inspect <sub>           Effective config, catalog, analytics, pacing, client-config
@@ -91,7 +92,7 @@ Usage:
   ocx api-key <sub>           Alias of ocx access key
   ocx access <sub>            External API keys and endpoint information
   ocx api <sub>               Protocol paths: vocabulary, request-path preview, and policy
-  ocx export --client <id>    Print a client config wired to the running proxy (17 clients)
+  ocx export --client <id>    Print a client config wired to the running proxy (18 clients)
   ocx integration client <sub> Enable, disable, inspect or roll back a client integration
   ocx grok <sub>              Grok Build model selection and apply
   ocx system <sub>            Runtime settings, startup, sync, OpenCodex updates, and Codex CLI inspection
@@ -105,6 +106,8 @@ Usage:
   ocx mcode [args...]         Launch MiniMax Code through its managed provider
   ocx mmx text <sub> [args]   Launch MiniMax CLI text through the proxy
   ocx zcode [sub]             Connect ZCode to the proxy (managed provider)
+  ocx commandcode [sub]       Connect Command Code CLI to the proxy (managed provider)
+  ocx cmd [sub]               Alias of ocx commandcode
   ocx help [command]          Show help
   ocx --version | -v          Print version
 

package/src/cli/index.ts

@@ -210,11 +210,17 @@ initializeNodeLauncherContext();
 // The compiled executable is also the capture-only MCP server's launcher.
 // Handle this private entrypoint before CLI preflight or command dispatch.
 if (process.argv[2] === "__keyring-load-check") { console.log(JSON.stringify((await import("../lib/keyring-native")).inspectKeyringBinding())); process.exit(0); }
-if (process.argv[2] === "__codebuddy-mcp") {
-  const { runCodeBuddyMcpServer } = await import("../adapters/codebuddy/mcp-server");
-  await runCodeBuddyMcpServer(process.argv[3] ?? "");
-  // The MCP stdio loop owns this process until stdin closes; do not fall through
-  // to ordinary CLI dispatch or exit after the handshake completes.
+
+// The compiled executable also launches the isolated MCP servers.
+// Handle these private entrypoints before CLI preflight or command dispatch.
+if (process.argv[2] === "__codebuddy-mcp" || process.argv[2] === "__qoder-mcp") {
+  if (process.argv[2] === "__codebuddy-mcp") {
+    const { runCodeBuddyMcpServer } = await import("../adapters/codebuddy/mcp-server");
+    await runCodeBuddyMcpServer(process.argv[3] ?? "");
+  } else {
+    const { runCodingAgentMcpServer } = await import("../adapters/coding-agent/mcp-server");
+    await runCodingAgentMcpServer(process.argv[3] ?? "");
+  }
   await new Promise<never>(() => {});
 }
 

package/src/cli/integration-plan-dto.ts

@@ -23,6 +23,7 @@ export const FILE_INTEGRATION_CLIENTS = [
   "raycast",
   "omo",
   "cline",
+  "commandcode",
   "kilo",
   "droid",
 ] as const;

package/src/cli/integration-preview.ts

@@ -1,5 +1,6 @@
 /** Preview and explicitly bound mutations use the existing management authority. */
 import type { IntegrationMutationPlan, IntegrationPlanOperation } from "../integrations/mutation-plan";
+import type { IntegrationClientId } from "../integrations/registry";
 import { redactSecretString, redactUserPath } from "../lib/redact";
 import {
   CliUsageError, RuntimeApiError, printData, runtimeRequest, terminalSafeText,
@@ -186,9 +187,15 @@ function reportError(error: unknown): number {
   return 1;
 }
 
-export async function handleIntegrationPreviewCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
+export async function handleIntegrationPreviewCommand(argv: string[], deps: RuntimeApiDeps = {}, expectedClientId?: IntegrationClientId): Promise<number> {
   try {
     const intent = parseIntent(argv);
+    if (expectedClientId !== undefined && intent.operation === "restore") {
+      if (intent.client !== undefined || intent.profile !== undefined) throw new CliUsageError("client-specific restore does not accept --client or --profile", USAGE);
+      intent.client = expectedClientId;
+      intent.path = `${clientIntegrationPath(expectedClientId)}/restore${intent.preview ? "/preview" : ""}`;
+      intent.body.expectedClientId = expectedClientId;
+    }
     const result = await runtimeRequest(intent.path, {
       method: intent.preview || intent.operation === "restore" ? "POST" : "PUT",
       redirect: "error", body: JSON.stringify(intent.body),

package/src/cli/integrations.ts

@@ -13,6 +13,7 @@ import {
   type RuntimeApiDeps,
 } from "./runtime-api";
 import { clientIntegrationPath, validateAsideProfile } from "./integration-input";
+import type { IntegrationClientId } from "../integrations/registry";
 
 const CLAUDE_USAGE = `Usage:
   ocx claude config [status] [--json]
@@ -215,7 +216,11 @@ function singleClientStatusLines(result: unknown): string[] {
 export async function handleClientIntegrationCommand(
   argv: string[],
   deps: RuntimeApiDeps = {},
+  expectedClientId?: IntegrationClientId,
 ): Promise<number> {
+  if (expectedClientId !== undefined && argv.some(arg => ["--client", "--profile"].some(flag => arg === flag || arg.startsWith(`${flag}=`)))) {
+    return runCliAction(async () => { throw new CliUsageError("client-specific restore does not accept --client or --profile", CLIENT_USAGE); });
+  }
   if ((argv[0] === "history" || argv[0] === "journal") && argv[1] === "remove") {
     const { handleIntegrationJournalRemove } = await import("./integration-journal");
     return handleIntegrationJournalRemove(argv.slice(2), deps);
@@ -227,7 +232,7 @@ export async function handleClientIntegrationCommand(
   if (argv[0] === "preview" || argv.some(arg => ["--preview", "--plan-fingerprint", "--reasoning-default", "--clear-reasoning-defaults"]
     .some(flag => arg === flag || arg.startsWith(`${flag}=`)))) {
     const { handleIntegrationPreviewCommand } = await import("./integration-preview");
-    return handleIntegrationPreviewCommand(argv, deps);
+    return handleIntegrationPreviewCommand(argv, deps, expectedClientId);
   }
   return runCliAction(async () => {
     const args = [...argv];
@@ -289,9 +294,12 @@ export async function handleClientIntegrationCommand(
       if (client !== undefined && profile === undefined) throw new CliUsageError("restore --client requires --profile", CLIENT_USAGE);
       rejectArgs(args, CLIENT_USAGE);
       if (!opId) throw new CliUsageError("--op <opId> is required", CLIENT_USAGE);
-      const result = await runtimeRequest(profile === undefined ? "/api/client-integrations/restore" : `${clientIntegrationPath("aside", profile)}/restore`, {
+      const restorePath = expectedClientId !== undefined ? `${clientIntegrationPath(expectedClientId)}/restore`
+        : profile === undefined ? "/api/client-integrations/restore" : `${clientIntegrationPath("aside", profile)}/restore`;
+      const result = await runtimeRequest(restorePath, {
         method: "POST",
-        body: JSON.stringify({ opId, confirmDrift }),
+        ...(expectedClientId === undefined ? {} : { redirect: "error" as const }),
+        body: JSON.stringify({ opId, confirmDrift, ...(expectedClientId === undefined ? {} : { expectedClientId }) }),
       }, deps);
       printData(result, wantsJson, [String((result as Record<string, unknown>).message ?? "Restored.")]);
       return;
@@ -387,3 +395,24 @@ export async function handleClaudeInterceptCommand(argv: string[], deps: Runtime
     printData(result, wantsJson, summaryLines(result));
   });
 }
+
+const COMMANDCODE_USAGE = "Usage: ocx commandcode [status|show|list|enable|disable|history|journal|restore] [--json]";
+
+export async function handleCommandcodeCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
+  const args = [...argv];
+  const verbIndex = args.findIndex(arg => !arg.startsWith("-"));
+  const action = (verbIndex === -1 ? "status" : args[verbIndex]).toLowerCase();
+  const known = ["status", "show", "list", "enable", "disable", "history", "journal", "restore"];
+  if (!known.includes(action)) {
+    console.error(`unknown commandcode command ${action}`);
+    console.error(COMMANDCODE_USAGE);
+    return 2;
+  }
+  const rest = verbIndex === -1 ? args : [...args.slice(0, verbIndex), ...args.slice(verbIndex + 1)];
+  const forwarded = action === "restore" ? [action, ...rest] : [action, ...rest, "--client", "commandcode"];
+  const code = await handleClientIntegrationCommand(forwarded, deps, action === "restore" ? "commandcode" : undefined);
+  if (code === 0 && (action === "enable" || action === "disable")) {
+    console.error("Command Code reads providers on startup.");
+  }
+  return code;
+}

package/src/cli/message-args.ts

@@ -0,0 +1,34 @@
+import type { MessageKind } from "../messaging/envelope";
+import { isThreadId } from "../messaging/types";
+
+export type MessageArgs = { action: "sessions"; json: boolean }
+  | { action: "send"; json: boolean; kind: MessageKind; thread?: string; name?: string; inReplyTo?: string };
+
+/** Pure pre-parse: unknown/duplicate options and unsupported remote surfaces fail closed. */
+export function parseMessageArgs(argv: readonly string[]): MessageArgs | null {
+  const action = argv[0];
+  if (action !== "sessions" && action !== "send") return null;
+  const seen = new Set<string>();
+  const values: Record<string, string> = {};
+  for (let index = 1; index < argv.length; index++) {
+    const flag = argv[index]!;
+    if (seen.has(flag)) return null;
+    seen.add(flag);
+    if (flag === "--json" || (action === "send" && flag === "--stdin")) continue;
+    if (action !== "send" || !["--thread", "--name", "--kind", "--in-reply-to"].includes(flag)) return null;
+    const value = argv[++index];
+    if (!value || value.startsWith("--")) return null;
+    values[flag] = value;
+  }
+  const json = seen.has("--json");
+  if (action === "sessions") return { action, json };
+  const thread = values["--thread"], name = values["--name"], inReplyTo = values["--in-reply-to"];
+  const kind = values["--kind"] ?? "request";
+  if (!seen.has("--stdin") || (thread !== undefined) === (name !== undefined)
+    || (thread !== undefined && !isThreadId(thread))
+    || (name !== undefined && (!name.trim() || name.length > 4096 || /[\x00-\x1f\x7f-\x9f]/.test(name)))
+    || !["request", "response", "notification"].includes(kind)
+    || (kind === "response" ? !isThreadId(inReplyTo) : inReplyTo !== undefined)) return null;
+  return { action, json, kind: kind as MessageKind, ...(thread ? { thread } : {}),
+    ...(name ? { name } : {}), ...(inReplyTo ? { inReplyTo } : {}) };
+}

package/src/cli/message-command.ts

@@ -0,0 +1,43 @@
+import { MessageBudget } from "../messaging/budget";
+import { readMessageInput } from "../messaging/input";
+import { localSessions, messageFailure, sendLocalMessage } from "../messaging/send";
+import { parseMessageArgs } from "./message-args";
+import { terminalSafeText } from "./runtime-api";
+
+/** Run one local messaging operation after pure syntax validation, then release owned resources. */
+export async function runMessageCommand(argv: readonly string[], env: NodeJS.ProcessEnv = process.env): Promise<number> {
+  const args = parseMessageArgs(argv);
+  if (!args) {
+    console.error("Usage: ocx message sessions [--json] | send (--thread <uuid> | --name <exact-name>) --stdin [--kind request|response|notification] [--in-reply-to <uuid>] [--json]");
+    return 64;
+  }
+  const controller = new AbortController();
+  const cancel = () => controller.abort();
+  process.once("SIGINT", cancel); process.once("SIGTERM", cancel);
+  const budget = new MessageBudget(30_000, controller.signal);
+  try {
+    // Keep home selection on this command path and after syntax validation.
+    const { messageCodexHome } = await import("./message-runtime");
+    const home = messageCodexHome(env);
+    if (args.action === "sessions") {
+      const sessions = await localSessions(home, budget);
+      if (args.json) console.log(JSON.stringify({ schema: "ocx-message-sessions/1", sessions }));
+      else for (const session of sessions) console.log(terminalSafeText(`${session.id}\t${session.status}\t${session.name ?? "(unnamed)"}`));
+      return 0;
+    }
+    const body = await readMessageInput(Bun.stdin.stream(), budget);
+    const receipt = await sendLocalMessage({ ...args, body },
+      { home, senderId: env.CODEX_THREAD_ID }, budget);
+    if (args.json) console.log(JSON.stringify(receipt));
+    else console.log(terminalSafeText(`${receipt.status}: ${receipt.messageId}${receipt.error ? ` — ${receipt.error.message}` : " (submitted, not proof of processing)"}`));
+    return receipt.status === "queued" ? 0 : receipt.status === "unknown" ? 3 : 1;
+  } catch (error) {
+    const failure = { schema: "ocx-message-error/1", ...(args.action === "send" ? { status: "not_sent" } : {}), error: messageFailure(error) };
+    if (args.json) console.log(JSON.stringify(failure));
+    else console.error(failure.error.message);
+    return 1;
+  } finally {
+    budget.dispose();
+    process.removeListener("SIGINT", cancel); process.removeListener("SIGTERM", cancel);
+  }
+}

package/src/cli/message-runtime.ts

@@ -0,0 +1,6 @@
+import { resolveCodexHomeDir } from "../codex/home";
+
+/** Resolve the effective existing Codex home using the shared policy, without creating it. */
+export function messageCodexHome(env: NodeJS.ProcessEnv): string {
+  return resolveCodexHomeDir({ env });
+}

package/src/cli/observe.ts

@@ -129,7 +129,9 @@ async function explain(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   rejectArgs(args, USAGE);
   const encoded = encodeURIComponent(requestId);
   const result = await runtimeRequest(`/api/request-history/${encoded}/route-decision`, {}, deps);
-  printData(result, wantsJson, wantsJson ? undefined : [JSON.stringify(result, null, 2)]);
+  // One entry per line: printData escapes control characters per entry, so a single
+  // pretty-printed string would print its line breaks as literal `\x0a`.
+  printData(result, wantsJson, wantsJson ? undefined : JSON.stringify(result, null, 2).split("\n"));
 }
 
 async function rebuildIndex(argv: string[], deps: RuntimeApiDeps): Promise<void> {

package/src/cli/provider.ts

@@ -8,11 +8,12 @@
  *   show <name>   Show provider config details (secrets masked)
  *   set-default <name>  Change the default provider
  */
-import { hasOwnProvider, isValidProviderName, loadConfig, sanitizeModelCostsForDisplay, saveConfig, validateConfigCandidate } from "../config";
+import { hasOwnProvider, isValidProviderName, loadConfig, sanitizeModelCostsForDisplay, saveConfig, validateConfigCandidate, withConfigMutationLockSync } from "../config";
 import { apiKeyTransportConfigError, modelCapabilitiesConfigError, mergeModelCapabilities } from "../config/provider-validation";
 import { hasHelpFlag, printSubcommandUsage } from "./help";
 import { getProviderRegistryEntry, PROVIDER_REGISTRY } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
+import { assertAnthropicInstanceLoginConfig } from "../oauth/store-anthropic-instance";
 import { dropProviderCustomModels } from "../providers/provider-id-rewrite";
 import type { OcxProviderConfig } from "../types";
 import { findLiveProxy } from "../server/proxy-liveness";
@@ -249,6 +250,17 @@ async function handleAdd(args: string[], deps: ProviderCommandDeps): Promise<voi
 
   if (responsesPath !== undefined) provConfig.responsesPath = responsesPath;
   if (authMode !== undefined) provConfig.authMode = authMode as OcxProviderConfig["authMode"];
+  if (name === "anthropic2") {
+    if (provConfig.adapter !== "anthropic" || provConfig.authMode !== "oauth") delete provConfig.anthropicOAuthInstance;
+    if (provConfig.anthropicOAuthInstance) {
+      try { assertAnthropicInstanceLoginConfig(config, name); }
+      catch {
+        console.error("Error: cannot add Pool 2 over an existing custom or unreadable provider configuration; resolve it first.");
+        process.exitCode = 2;
+        return;
+      }
+    }
+  }
   if (name === "openai" && (authMode !== undefined || responsesPath !== undefined)
     && !isCanonicalOpenAiForwardProvider(provConfig)) {
     console.error("Error: Canonical OpenAI must keep its built-in forward destination and authentication. Use a separate provider name for a custom endpoint.");
@@ -315,11 +327,22 @@ async function handleAdd(args: string[], deps: ProviderCommandDeps): Promise<voi
     return;
   }
   const { initializeProviderModelSelection } = await import("../providers/initial-model-selection");
-  initializeProviderModelSelection(name, provConfig, existingProvider, config);
-  config.providers[name] = provConfig;
-  if (setDefault) config.defaultProvider = name;
-
-  validateAndSave(config);
+  let markerCollision = false;
+  withConfigMutationLockSync(() => {
+    if (provConfig.anthropicOAuthInstance) {
+      try { assertAnthropicInstanceLoginConfig(config, name); }
+      catch { markerCollision = true; return; }
+    }
+    initializeProviderModelSelection(name, provConfig, existingProvider, config);
+    config.providers[name] = provConfig;
+    if (setDefault) config.defaultProvider = name;
+    validateAndSave(config);
+  });
+  if (markerCollision) {
+    console.error("Error: provider configuration changed while adding Pool 2; resolve the ownership collision first.");
+    process.exitCode = 2;
+    return;
+  }
 
   let sync: LocalSyncResult | undefined;
   if (wantsSync) {

package/src/cli/registry.ts

@@ -8,6 +8,12 @@ export interface CliCommandEntry {
 }
 
 export const CLI_COMMANDS: CliCommandEntry[] = [
+  {
+    name: "message",
+    usage: "ocx message <sessions|send> [options]",
+    summary: "Discover loaded local Codex sessions and submit one queued peer message.",
+    details: ["Local Unix transport only; starts no daemon. queued is submission, not processing; never replay an unknown send."],
+  },
   {
     name: "chatgpt",
     usage: "ocx chatgpt <launch|restore|status>",
@@ -467,8 +473,8 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
   },
   {
     name: "export",
-    usage: "ocx export --client <opencode|pi|omp|hermes|openclaw|kimi|gajae|dsh|mcode|zcode|prime|aside|raycast|omo|cline|kilo|droid> [--json] [--out <path>] [--force]",
-    summary: "Print a client config (OpenCode, Pi, OMP, Hermes, OpenClaw, Kimi Code, gjc, DeepSeek Harness, MiniMax Code, ZCode, Prime Agent, Aside, Raycast, omo, Cline, Kilo, Factory Droid) wired to the running proxy.",
+    usage: "ocx export --client <opencode|pi|omp|hermes|openclaw|kimi|gajae|dsh|mcode|zcode|commandcode|prime|aside|raycast|omo|cline|kilo|droid> [--json] [--out <path>] [--force]",
+    summary: "Print a client config (OpenCode, Pi, OMP, Hermes, OpenClaw, Kimi Code, gjc, DeepSeek Harness, MiniMax Code, ZCode, Command Code, Prime Agent, Aside, Raycast, omo, Cline, Kilo, Factory Droid) wired to the running proxy.",
     details: [
       "--json prints the generated document as JSON on stdout; use --out for the client's native format.",
       "--out <path> writes the native config there and refuses to replace an existing file without --force.",
@@ -598,6 +604,22 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
       "Select OpenCodex Proxy/<provider>/<model> from ZCode's model picker.",
     ],
   },
+  {
+    name: "commandcode",
+    usage: "ocx commandcode [status|show|list|enable|disable|history|journal|restore --op <opId>] [--json]",
+    summary: "Connect Command Code CLI to the proxy via its managed provider.",
+    details: [
+      "Alias of ocx integration client <sub> --client commandcode.",
+      "enable manages the opencodex block under the existing provider or providers root in ~/.commandcode/providers.json; disable removes only that block.",
+      "Command Code reads providers on startup.",
+      "`restore --op <opId>` replays the exact previous managed block; take the id from `ocx commandcode history`.",
+    ],
+  },
+  {
+    name: "cmd",
+    usage: "ocx cmd [status|show|list|enable|disable|history|journal|restore --op <opId>] [--json]",
+    summary: "Alias of ocx commandcode.",
+  },
   {
     name: "restart",
     usage: "ocx restart",

package/src/clients/config-export/commandcode.ts

@@ -0,0 +1,131 @@
+// Command Code config export.
+import type { ExportContext, ManagedContribution } from "./contracts";
+import { normalizeExportModels, authoritativeContextWindow, singleFragment } from "./model-metadata";
+import { OPENCODE_PROVIDER_ID, LOOPBACK_API_KEY_PLACEHOLDER } from "./constants";
+import { sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
+
+export interface CommandCodeModelEntry {
+  reasoningEfforts?: string[];
+  contextWindow?: number;
+}
+
+export interface CommandCodeProviderBlock {
+  name: "OpenCodex";
+  api: "openai-completions";
+  baseURL: string;
+  apiKey: string | boolean;
+  models: Record<string, CommandCodeModelEntry>;
+}
+
+export interface CommandCodeGeneratedConfig {
+  provider: Record<string, CommandCodeProviderBlock>;
+  /** The root a pre-existing target already uses; see {@link commandCodeProviderRoot}. */
+  providers?: Record<string, CommandCodeProviderBlock>;
+}
+
+/**
+ * LOSSY spelling-collision key for a routed selector — not model identity.
+ *
+ * One provider model reaches this exporter under interchangeable spellings: the raw
+ * selector keeps inner slashes (`command-code/deepseek/deepseek-v4.1-flash`, what
+ * `/v1/models` publishes) while the Codex-facing form encodes them as dashes
+ * (`command-code/deepseek-deepseek-v4.1-flash`, what `~/.codex/config.toml` stores and
+ * what an operator typing `--model` copies). Command Code addresses models by exact key,
+ * so a catalog that carries both spellings can resolve the active model against one and
+ * miss it in the other.
+ *
+ * The slash is meaningful: it separates the provider from the model id, and a provider id
+ * never contains one. But the encoding is NOT bijective — `p/a/b` and `p/a-b` are
+ * different model ids that encode to the same string. That is the same lossy relation
+ * `slugEquivalenceKey` documents in src/providers/slug-codec.ts and the same ambiguity
+ * `resolveSlugAliasCollisions` guards in the catalog. Callers must therefore never drop
+ * a row on this key alone; buildCommandCodeClientConfig additionally compares provider
+ * and id before folding two rows into one.
+ */
+function canonicalSpellingOf(namespaced: string): string {
+  const slash = namespaced.indexOf("/");
+  if (slash <= 0) return namespaced;
+  return namespaced.slice(0, slash) + "/" + namespaced.slice(slash + 1).replaceAll("/", "-");
+}
+
+export function buildCommandCodeClientConfig(ctx: ExportContext): CommandCodeGeneratedConfig {
+  const models: Record<string, CommandCodeModelEntry> = {};
+  // Fold interchangeable spellings of one model onto a single key. The first
+  // occurrence wins per provider+id identity; distinct model ids that happen to
+  // share a lossy spelling collision must both remain addressable.
+  const emittedIdentitiesByCollision = new Map<string, Set<string>>();
+  for (const model of normalizeExportModels(ctx.models)) {
+    const emittedKey = model.namespaced;
+    const collisionKey = canonicalSpellingOf(model.namespaced);
+    const identity = `${model.provider}\u0000${model.id}`;
+    const identities = emittedIdentitiesByCollision.get(collisionKey) ?? new Set<string>();
+    if (identities.has(identity)) continue;
+    identities.add(identity);
+    emittedIdentitiesByCollision.set(collisionKey, identities);
+    const entry: CommandCodeModelEntry = {};
+    const context = authoritativeContextWindow(model.contextWindow);
+    if (context !== undefined) {
+      entry.contextWindow = context;
+    }
+    const efforts = sanitizeCodexReasoningEfforts(model.reasoningEfforts)
+      ?.filter(effort => ["low", "medium", "high", "xhigh", "max"].includes(effort));
+    if (efforts && efforts.length > 0) {
+      entry.reasoningEfforts = efforts;
+    }
+    models[emittedKey] = entry;
+  }
+  return {
+    provider: {
+      [OPENCODE_PROVIDER_ID]: {
+        name: "OpenCodex",
+        api: "openai-completions",
+        baseURL: ctx.baseUrl.replace(/\/v1\/?$/, "") + "/v1",
+        apiKey: false,
+        models,
+      },
+    },
+  };
+}
+
+/**
+ * The root key Command Code actually reads: `provider`, else `providers`.
+ *
+ * Verified against the published client (`command-code@1.66.0`, `dist/cli.mjs`):
+ * `const o = e.provider ?? e.providers;` — singular wins, and the plural branch is
+ * only reached when the singular root is nullish (`null` or `undefined`). Adding a
+ * singular root to a document that already carries a plural one therefore does not
+ * merge the two: the old entries stay on disk, byte for byte, and become invisible
+ * to the consumer.
+ *
+ * Evaluates nullish precedence before container validation so that non-nullish
+ * invalid singular values (such as strings or arrays) remain selected and are refused
+ * by the container guard rather than falling through to write an unreachable plural block.
+ */
+export function commandCodeProviderRoot(document: unknown): "provider" | "providers" {
+  const doc = document as { provider?: unknown; providers?: unknown } | null | undefined;
+  if (doc?.provider !== undefined && doc?.provider !== null) return "provider";
+  if (doc?.providers !== undefined && doc?.providers !== null) return "providers";
+  // Nothing established yet: the singular root is the one this exporter writes.
+  return "provider";
+}
+
+export function summarizeCommandCode(document: unknown): { modelCount: number; modelsWithoutLimits: number } {
+  const doc = document as CommandCodeGeneratedConfig | undefined;
+  const root = commandCodeProviderRoot(document);
+  const models = Object.values(doc?.[root]?.[OPENCODE_PROVIDER_ID]?.models ?? {}) as CommandCodeModelEntry[];
+  return { modelCount: models.length, modelsWithoutLimits: models.filter(model => model.contextWindow === undefined).length };
+}
+
+/**
+ * The provider block, written under whichever root the target document already uses.
+ *
+ * `ExportContext` carries the parsed target document so the root can be chosen from
+ * what is on disk rather than assumed. A fresh file gets the singular root this
+ * exporter has always written; a document that already carries a plural root keeps
+ * it, so enabling OpenCodex never makes the user's other providers unreadable.
+ */
+export function buildCommandCodeContribution(ctx: ExportContext): ManagedContribution {
+  const doc = buildCommandCodeClientConfig(ctx);
+  const root = commandCodeProviderRoot(ctx.document);
+  return singleFragment("commandcode", [root, OPENCODE_PROVIDER_ID], doc.provider[OPENCODE_PROVIDER_ID]);
+}

package/src/clients/config-export/contracts.ts

@@ -185,6 +185,17 @@ export interface ExportContext {
    */
   config?: OcxConfig;
   droidReasoningDefaults?: DroidReasoningDefaults;
+  /**
+   * The parsed target document, when the caller has one in hand.
+   *
+   * A client whose reader picks between two roots needs the bytes on disk to
+   * choose: Command Code resolves `document.provider ?? document.providers`, so
+   * writing the singular root into a document that already carries the plural one
+   * leaves the user's providers unreadable rather than merging with them. Absent
+   * for `ocx export`, which has no target file — the builder then writes its
+   * default root, exactly as before.
+   */
+  document?: unknown;
 }
 
 /** Namespaced model selector to one of that model's declared reasoning efforts. */
@@ -206,6 +217,7 @@ export type ExportClientId =
   | "raycast"
   | "omo"
   | "cline"
+  | "commandcode"
   | "kilo"
   | "droid";