@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/cli/chatgpt-command.ts

@@ -20,7 +20,7 @@ const USAGE = `Usage (experimental, macOS only):
 
 function run(command: string, args: string[]) {
   const result = spawnSync(command, args, { encoding: "utf8", timeout: 5000 });
-  return { ok: result.status === 0, output: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim() };
+  return { ok: result.status === 0, status: result.status, output: `${result.stdout ?? ""}${result.stderr ?? ""}`.trim() };
 }
 
 /**
@@ -42,11 +42,12 @@ function chatgptDesktopIssueInFile(): string | null {
  * desktop restart adapter does. "ChatGPT" is a display name another app can share, so quitting,
  * relaunching and the binary path all key on this verified bundle rather than on the name.
  */
-function discoverApp(): DesktopAppInstall | null {
+function discoverApp(): DesktopAppInstall | null | undefined {
   try {
     return darwinDesktopAppAdapter.discover(darwinDefaultExec);
   } catch {
-    return null;
+    // An inspection error is not evidence that the app is uninstalled.
+    return undefined;
   }
 }
 
@@ -55,14 +56,20 @@ function discoverApp(): DesktopAppInstall | null {
  * `-a` keeps ancestors in the match: when ocx runs inside a ChatGPT/Codex session the app is
  * one of this process's ancestors, and plain `pgrep -x` would report it as not running.
  */
-function appState(install: DesktopAppInstall, launcher: string): { running: boolean; shim: boolean } {
+function appState(install: DesktopAppInstall, launcher: string): { running: boolean | null; shim: boolean | null } {
   const shell = join(install.root, "Contents", "MacOS", "ChatGPT");
   // Only this user's processes: another account's ChatGPT can neither be quit nor relaunched here.
   const uid = typeof process.getuid === "function" ? process.getuid() : undefined;
   const pids = run("pgrep", [...(uid === undefined ? [] : ["-U", String(uid)]), "-a", "-x", "ChatGPT"]);
-  if (!pids.ok) return { running: false, shim: false };
-  for (const pid of pids.output.split(/\s+/).filter(value => /^\d+$/.test(value))) {
+  // pgrep exit 1 means no match; timeout, signal, or command errors are unknown.
+  if (!pids.ok) return pids.status === 1
+    ? { running: false, shim: false } : { running: null, shim: null };
+  const candidates = pids.output.split(/\s+/).filter(value => /^\d+$/.test(value));
+  if (candidates.length === 0) return { running: null, shim: null };
+  let unreadable = false;
+  for (const pid of candidates) {
     const command = run("ps", ["eww", "-o", "command=", "-p", pid]);
+    if (!command.ok || !command.output) unreadable = true;
     if (command.ok && (command.output === shell || command.output.startsWith(`${shell} `))) {
       const marker = `CODEX_CLI_PATH=${launcher}`;
       const start = command.output.indexOf(marker);
@@ -70,20 +77,24 @@ function appState(install: DesktopAppInstall, launcher: string): { running: bool
         && (start + marker.length === command.output.length || command.output[start + marker.length] === " ") };
     }
   }
-  return { running: false, shim: false };
+  return unreadable ? { running: null, shim: null } : { running: false, shim: false };
 }
 
 /** Adapted from #5947: open ignores new launch settings until the previous app exits. */
 async function quitApp(install: DesktopAppInstall, launcher: string): Promise<boolean> {
-  if (!appState(install, launcher).running) return true;
+  const initial = appState(install, launcher).running;
+  if (initial === false) return true;
+  if (initial === null) return false;
   for (let attempt = 0; attempt < 3; attempt++) {
     run("/usr/bin/osascript", ["-e", `quit app id "${install.id}"`]);
     for (let poll = 0; poll < 20; poll++) {
-      if (!appState(install, launcher).running) return true;
+      const running = appState(install, launcher).running;
+      if (running === false) return true;
+      if (running === null) return false;
       await Bun.sleep(250);
     }
   }
-  return !appState(install, launcher).running;
+  return appState(install, launcher).running === false;
 }
 
 export async function handleChatgptCommand(args: string[], platform: NodeJS.Platform = process.platform): Promise<number> {
@@ -105,16 +116,21 @@ export async function handleChatgptCommand(args: string[], platform: NodeJS.Plat
     const launcher = chatgptShimLauncherPath();
     const install = discoverApp();
     if (sub === "status") {
-      const app = install ? appState(install, launcher) : { running: false, shim: false };
+      const app = install ? appState(install, launcher)
+        : install === undefined ? { running: null, shim: null } : { running: false, shim: false };
       const configIssue = config.chatgptDesktop?.appServerShim === true ? null : chatgptDesktopIssueInFile();
       const flag = config.chatgptDesktop?.appServerShim === true ? "on"
         : configIssue ? `off (config.json ${configIssue}; the whole chatgptDesktop block is ignored)` : "off";
       console.log(`app-server shim (experimental): ${flag}
 launcher: ${existsSync(launcher) ? "present" : "absent"}
-app: ${install ? (app.running ? "running" : "not running") : "not installed"}
-CODEX_CLI_PATH launcher: ${app.shim ? "yes" : "no"}`);
+app: ${install === undefined ? "unknown (app discovery failed)" : install ? (app.running === null ? "unknown (process inspection failed)" : app.running ? "running" : "not running") : "not installed"}
+CODEX_CLI_PATH launcher: ${app.shim === null ? "unknown" : app.shim ? "yes" : "no"}`);
       return 0;
     }
+    if (install === undefined) {
+      console.error("ChatGPT app discovery failed; no launcher was changed and no app was opened. Retry after resolving discovery.");
+      return 1;
+    }
     if (!install) {
       if (sub === "restore") rmSync(launcher, { force: true });
       console.error("ChatGPT (com.openai.codex) was not found; install or open it once, then retry.");
@@ -143,9 +159,14 @@ CODEX_CLI_PATH launcher: ${app.shim ? "yes" : "no"}`);
       console.error(`Refusing to ${sub === "launch" ? "launch the shim" : "restore ChatGPT"}: ${untrusted}.`);
       return 1;
     }
+    // Preflight before changing the launcher. quitApp rechecks at the action boundary.
+    if (appState(install, launcher).running === null) {
+      console.error("ChatGPT process inspection failed; no launcher was changed and no app was opened. Retry after resolving inspection.");
+      return 1;
+    }
     if (binary) writeChatgptShimLauncher(undefined, binary);
     if (!(await quitApp(install, launcher))) {
-      console.error("ChatGPT did not quit; quit it manually and retry.");
+      console.error("ChatGPT exit could not be confirmed; no new app was opened. Check the running app and retry.");
       return 1;
     }
     // Remove an inherited override too: restore must launch without CODEX_CLI_PATH.

package/src/cli/claude.ts

@@ -12,7 +12,7 @@ import { spawn } from "node:child_process";
 import { loadConfig } from "../config";
 import { injectClaudeAgentDefs } from "../claude/agents-inject";
 import { CLAUDE_ALIAS_PREFIX_CURRENT, CLAUDE_ALIAS_PREFIX_CURRENT_V2, CLAUDE_ALIAS_PREFIX_V1, CLAUDE_ALIAS_PREFIX_V2 } from "../claude/alias";
-import { claudeToolSearchEnv, effectiveModelEnv, resolveAutoContext } from "../claude/context-windows";
+import { claudeTierDisplayName, claudeToolSearchEnv, effectiveModelEnv, isClaudeTierLabelSlot, resolveAutoContext } from "../claude/context-windows";
 import { claudeConfigDir, fetchGatewayModels, writeGatewayModelCache } from "../claude/gateway-cache";
 import { commandInvocation } from "../lib/win-exec";
 import { isProxyAdmissionSecret } from "../server/auth-cors";
@@ -32,7 +32,8 @@ import { DEFAULT_CATALOG_PATH } from "../codex/paths";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { aliasForNative, aliasForRoute, legacyAliasForNative, legacyAliasForRoute } from "../claude/alias";
-import { desktop3pAlias } from "../claude/desktop-3p";
+import { desktop3pAlias, isRealDesktop3pModelId, resolveDesktop3pAlias } from "../claude/desktop-3p";
+import { desktopProfileWireAlias, legacyDesktopProfileWireAlias } from "../claude/desktop-profile";
 import { inspectDesktopFirstParty } from "../claude/desktop-first-party";
 import { isClaudeInterceptProxyUrl, type ClaudeInterceptSettingsState } from "../claude/intercept/settings";
 import { withoutSiblingMarker } from "../codex/sibling-start";
@@ -211,10 +212,12 @@ export function buildClaudeEnv(
   // real cost to a documented entry point, and the escape hatch is the launcher: run
   // through `ocx` (the published bin) and genuine shell exports are preserved by proof.
   deleteUntrustedAnthropicSlots(env, deps);
-  const setDefault = (name: string, value: string | undefined) => {
-    if (value === undefined || value.length === 0) return;
-    if (env[name] !== undefined && env[name] !== "") return; // user wins
+  /** Returns whether the value was written; a value the user already has wins. */
+  const setDefault = (name: string, value: string | undefined): boolean => {
+    if (value === undefined || value.length === 0) return false;
+    if (env[name] !== undefined && env[name] !== "") return false; // user wins
     env[name] = value;
+    return true;
   };
   if (config.claudeCode?.subagentModelForce !== undefined) {
     const forced = resolveSubagentForceModel(config, contextWindows, deps.forceAvailableSelectors !== undefined ? { selectors: deps.forceAvailableSelectors } : { entries: deps.forceAvailable ?? [] });
@@ -415,7 +418,9 @@ export function buildClaudeEnv(
   // with automatic [1m] context-variant marking when the slot's target model has an
   // authoritative >=1M window (Claude Code then accounts 1M, compaction preserved).
   for (const [name, value] of Object.entries(effectiveModelEnv(config.claudeCode, contextWindows, auto))) {
-    setDefault(name, value);
+    // A tier slot this launch wrote gets its picker label too (#6926). A slot the user exported
+    // stays unlabelled, and a `<slot>_NAME` the user exported wins.
+    if (setDefault(name, value) && isClaudeTierLabelSlot(name)) setDefault(`${name}_NAME`, claudeTierDisplayName(value));
   }
   return env;
 }
@@ -614,11 +619,47 @@ const MODEL_ENV_SLOT_NAMES = [
   "ANTHROPIC_SMALL_FAST_MODEL",
 ] as const;
 
-const DESKTOP_3P_ALIAS = /^claude-opus-4(?:-8)?-[a-z][0-9a-z]{2}$/;
+const DESKTOP_3P_ALIAS = /^claude-(?:opus-4(?:-8)?-[a-z][0-9a-z]{2}|(?:opus-4-8|fable-5)-p[0-9a-z]{3})(?:--fast)?$/;
+
+export function nativeClaudeModelIds(config: OcxConfig): string[] {
+  const assignments = config.claudeCode?.desktopProfile?.assignments ?? {};
+  const routes = Object.keys(assignments);
+  const realProfileIds = new Set(routes.filter(route => route.startsWith("anthropic/claude-"))
+    .map(route => route.slice("anthropic/".length)));
+  // A native CLI starts without the server registry. Persisted profile bindings still
+  // identify proxy selectors, even when an old provider declaration has the same spelling.
+  const proxyProfileIds = new Set(routes.filter(route => !route.startsWith("anthropic/claude-"))
+    .flatMap(route => {
+      const alias = assignments[route]!.alias;
+      const slash = route.indexOf("/");
+      return [alias, desktopProfileWireAlias(alias), legacyDesktopProfileWireAlias(alias),
+        desktop3pAlias(route.slice(0, slash), route.slice(slash + 1))];
+    }));
+  // The configured default is a genuine declaration too: the catalog seeds it for static
+  // providers, so it must be recognized here even without a server registry.
+  const anthropic = config.providers.anthropic;
+  const declaredIds = [
+    ...(anthropic?.defaultModel ? [anthropic.defaultModel] : []),
+    ...(anthropic?.models ?? []), ...(anthropic?.selectedModels ?? []), ...(anthropic?.retainModels ?? []),
+  ];
+  return [...new Set([
+    ...realProfileIds,
+    ...declaredIds
+      .filter(id => {
+        const base = id.endsWith("--fast") ? id.slice(0, -"--fast".length) : id;
+        return id.startsWith("claude-") && (realProfileIds.has(id)
+          || (!proxyProfileIds.has(id) && !proxyProfileIds.has(base)));
+      }),
+  ])];
+}
 
-export function isProxyOnlyModelId(value: string, providerNames: readonly string[] = []): boolean {
+export function isProxyOnlyModelId(value: string, providerNames: readonly string[] = [], realAnthropicIds: readonly string[] = []): boolean {
   const id = value.trim().replace(/\[1m\]$/, "");
   if (!id) return false;
+  if (isRealDesktop3pModelId(id)) return false;
+  const base = id.endsWith("--fast") ? id.slice(0, -"--fast".length) : id;
+  if (resolveDesktop3pAlias(id) || resolveDesktop3pAlias(base)) return true;
+  if (realAnthropicIds.includes(id)) return false;
   const aliasPrefixes = [CLAUDE_ALIAS_PREFIX_CURRENT, CLAUDE_ALIAS_PREFIX_CURRENT_V2, CLAUDE_ALIAS_PREFIX_V1, CLAUDE_ALIAS_PREFIX_V2];
   if (aliasPrefixes.some(prefix => id.startsWith(prefix)) || DESKTOP_3P_ALIAS.test(id)) {
     return true;
@@ -680,9 +721,15 @@ export function buildNativeClaudeEnv(
   // otherwise settings.env can replace the destination while retaining the credential.
   if (hasOwnedAdmission) delete env.CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST;
   const providerNames = Object.keys(config.providers);
+  const realAnthropicIds = nativeClaudeModelIds(config);
   for (const name of MODEL_ENV_SLOT_NAMES) {
     const value = env[name];
-    if (value && isProxyOnlyModelId(value, providerNames)) delete env[name];
+    if (!value || !isProxyOnlyModelId(value, providerNames, realAnthropicIds)) continue;
+    delete env[name];
+    // The label opencodex paired with this slot names a proxy route the native session cannot use.
+    const labelName = `${name}_NAME`;
+    const label = claudeTierDisplayName(value);
+    if (isClaudeTierLabelSlot(name) && label !== undefined && env[labelName] === label) delete env[labelName];
   }
   if (deps.allowRootSkipPermissions === true && !env.IS_SANDBOX) env.IS_SANDBOX = "1";
   return env;
@@ -693,11 +740,12 @@ export function nativeModelOverride(
   configuredModel: string | undefined,
   args: readonly string[],
   providerNames: readonly string[] = [],
+  realAnthropicIds: readonly string[] = [],
 ): { flag?: string[]; warning?: string } {
-  if (!pickedModel || !isProxyOnlyModelId(pickedModel, providerNames)) return {};
+  if (!pickedModel || !isProxyOnlyModelId(pickedModel, providerNames, realAnthropicIds)) return {};
   if (args.some(arg => arg === "--model" || arg.startsWith("--model="))) return {};
   const fallback = configuredModel?.trim();
-  if (fallback && !isProxyOnlyModelId(fallback, providerNames)) {
+  if (fallback && !isProxyOnlyModelId(fallback, providerNames, realAnthropicIds)) {
     return {
       flag: ["--model", fallback],
       warning: `ℹ️ The saved model (${pickedModel}) requires the proxy. This native session will use ${fallback}.`,
@@ -858,6 +906,7 @@ async function launchNativeClaude(config: OcxConfig, args: string[], notice: str
     config.claudeCode?.model,
     args,
     providerNames,
+    nativeClaudeModelIds(config),
   );
   if (override.warning) console.error(override.warning);
   const allowRootSkipPermissions = shouldAllowRootSkipPermissions(args);

package/src/cli/config-command.ts

@@ -60,11 +60,14 @@ export function remoteHubConfigNote(
   // alone describes a machine that cannot read its hub, and `ocx status` is still the command
   // that has the facts — so the note points there in every case, connected or not.
   const connected = connection.state === "connected" && connection.token === "owned";
+  const link = config.client.transport === "link";
   const note = connection.state !== "connected"
     ? `this machine is configured as a client but its connection is ${connection.state}${connection.reason ? ` (${connection.reason})` : ""}; run ocx connect status`
     : connection.token !== "owned"
-      ? `this machine is configured as a client but its hub data-plane token is ${connection.token}; run ocx connect status`
-      : "provider credentials and model availability live on the hub; run ocx status";
+      ? `this machine is configured as a client but its ${link ? "Remote Link key" : "hub data-plane token"} is ${connection.token}; run ocx connect status`
+      : link
+        ? "this machine is a Remote Link Child: provider credentials, model availability and the Codex settings OpenCodex writes come from its Home; the settings in this file are local and inactive while linked; run ocx status"
+        : "provider credentials and model availability live on the hub; run ocx status";
   return { connected, origin: config.client.serverUrl, note };
 }
 
@@ -235,6 +238,7 @@ export async function handleConfigCommand(argv: string[]): Promise<number> {
       const path = args.shift();
       if (!path) throw new CliUsageError("config path is required", USAGE);
       rejectArgs(args, USAGE);
+      await (await import("./link-child")).printLinkChildLocalNotice("The values");
       const diagnostics = readConfigDiagnostics();
       if (diagnostics.source === "fallback" || diagnostics.error) {
         console.error(`Warning: Config at ${getConfigPath()} is invalid or unreadable; defaults are being shown for invalid settings. Run: ocx config validate. Inspect: ocx config show --source.`);
@@ -246,6 +250,7 @@ export async function handleConfigCommand(argv: string[]): Promise<number> {
       return;
     }
     if (action === "set" || action === "unset") {
+      await (await import("./link-child")).printLinkChildLocalWriteNotice();
       const path = args.shift();
       const raw = action === "set" ? args.shift() : undefined;
       if (!path || (action === "set" && raw === undefined)) throw new CliUsageError(action === "unset" ? "config path is required" : "config path and value are required", USAGE);
@@ -316,6 +321,7 @@ export async function handleConfigCommand(argv: string[]): Promise<number> {
       return;
     }
     if (action === "import") {
+      await (await import("./link-child")).printLinkChildLocalWriteNotice();
       const path = args.shift();
       const yes = takeFlag(args, "--yes");
       if (!path) throw new CliUsageError("import path is required", USAGE);

package/src/cli/debug.ts

@@ -10,6 +10,14 @@ async function requireLiveProxy() {
     console.error("Proxy is not running. Start it with: ocx start");
     process.exit(1);
   }
+  if (live.role === "client") {
+    // Debug capture is the serving proxy's; a connected client has no management API (#6957).
+    const { readLinkChildContext, linkChildRefusal } = await import("./link-child");
+    const link = readLinkChildContext();
+    console.error(link ? linkChildRefusal(link, "ocx debug")
+      : "This listener runs in the client role and has no management API. Run this command on its serving hub. No request was sent.");
+    process.exit(1);
+  }
   return live;
 }
 

package/src/cli/dispatch.ts

@@ -31,7 +31,7 @@ import { restoreNativeCodexAsync, type CodexNativeRestoreResult } from "../codex
 import { stripGrokConfig } from "../grok/inject";
 import { handleRestartScopeAfterWrite, readRestartScope, type RestartScope } from "./restart-scope";
 import { normalizeUpdateChannel, runGuiUpdateWorker } from "../update/job";
-import { isJsonOption, takeFlag, terminalSafeError } from "./runtime-api";
+import { isJsonOption, takeFlag, terminalSafeError, terminalSafeText } from "./runtime-api";
 import { printStopSummary, type StopOutcome } from "./stop-report";
 import { parseStopApproval, type StopApproval } from "./stop-approval";
 import type { ResolveArgs } from "./resolve";
@@ -407,9 +407,22 @@ const commandRunners: Record<string, CommandRunner> = {
       try {
         const { syncConnectedClient } = await import("../client/connect");
         const result = await syncConnectedClient({ restartCodex });
+        const link = clientState.value.transport === "link";
         console.log(result.stale
-          ? "Hub unavailable; retained and applied the last-known-good remote catalog (stale)."
-          : "Remote hub catalog synchronized.");
+          ? `${link ? "Home" : "Hub"} unavailable; retained and applied the last-known-good remote catalog (stale).`
+          : link ? "Remote Link Home catalog synchronized." : "Remote hub catalog synchronized.");
+        if (result.homeSettings) {
+          const { describeHomeCodexSettings } = await import("../link/codex-settings");
+          const settings = result.homeSettings;
+          if (settings.source === "local") {
+            console.log(`Codex settings: kept this machine's local values (${terminalSafeText(settings.reason)}).`);
+          } else {
+            console.log(settings.source === "home"
+              ? `Codex settings applied from Home ${terminalSafeText(settings.document.home.name)}:`
+              : `Codex settings applied from the last recorded Home read (${terminalSafeText(settings.reason)}):`);
+            for (const line of describeHomeCodexSettings(settings.document.settings)) console.log(`  ${terminalSafeText(line)}`);
+          }
+        }
         await handleConnectedSyncCatalogWrite(result, restartScope);
         // `process.exitCode` rather than a literal 0, for the same reason every other
         // runner does it (tests/cli/cli-transport-honesty.test.ts): the catalog-write helper
@@ -471,7 +484,7 @@ const commandRunners: Record<string, CommandRunner> = {
             },
             config,
             port: live.port,
-          }, ["mcode", "pi", "raycast", "omo", "cline", "commandcode", "droid", "opencode", "kilo"]));
+          }, ["mcode", "pi", "raycast", "omo", "cline", "commandcode", "droid", "opencode", "kilo", "qoder"]));
         } catch (error) {
           console.warn(`Client integrations were not refreshed: ${error instanceof Error ? error.message : String(error)}`);
         }
@@ -821,6 +834,10 @@ const commandRunners: Record<string, CommandRunner> = {
     const { handleComboCommand } = await import("./combo");
     return await handleComboCommand(deps.args.slice(1));
   },
+  advisor: async deps => {
+    const { handleAdvisorCommand } = await import("./advisor");
+    return await handleAdvisorCommand(deps.args.slice(1));
+  },
   companion: async deps => {
     const { handleCompanionCommand } = await import("./companion");
     return await handleCompanionCommand(deps.args.slice(1), { findLiveProxy: deps.findLiveProxy });

package/src/cli/doctor.ts

@@ -1428,6 +1428,15 @@ export async function runDoctor(args: string[] = []): Promise<void> {
     }
   }
 
+  // #2999: which process refreshes the native main login in CODEX_HOME.
+  console.log("\nNative main refresh");
+  {
+    const { loadConfig } = await import("../config");
+    const { formatNativeMainRefreshDoctorLines, resolveNativeMainRefreshMode } = await import("../codex/native-main-refresh-mode");
+    const resolution = await resolveNativeMainRefreshMode(loadConfig());
+    for (const line of formatNativeMainRefreshDoctorLines(resolution)) console.log(line);
+  }
+
   // Mirrors `ocx status` through the same comparison rather than a second implementation:
   // two diagnostics disagreeing about whether an install is stale is worse than one (#2701).
   // No extra probe -- findLiveProxy already carried the version back.