@bitkyc08/opencodex 2.84.0 → 2.86.0

package/src/codex/desktop-compatibility/certificate-store.ts

@@ -0,0 +1,193 @@
+import { createHash, createPrivateKey, createPublicKey, randomUUID, X509Certificate } from "node:crypto";
+import { closeSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { createCertificateAuthority, isServerAuthOnlyCertificate, type LocalInterceptCa } from "../../claude/intercept/local-ca";
+import { withClientLifecycle } from "../../client/lifecycle-lock";
+import { hardenSecretDirAsync, hardenSecretPathAsync } from "../../lib/windows-secret-acl";
+import { windowsAuthorityKeyProtection, type AuthorityKeyProtection } from "./windows-key-protection";
+
+const POLICY = "codex-desktop-chatgpt-only/v1";
+const FILE = "authority.json";
+const MAX_FILE = 131_072;
+const VALIDITY_DAYS = 30;
+const DAY = 86_400_000;
+const digest = (value: string) => createHash("sha256").update(value).digest("hex");
+
+export class DesktopAuthorityError extends Error {
+  constructor(readonly code: "unsafe_path" | "unreadable" | "expired" | "renewal_required" | "protection_failed" | "fingerprint_changed") {
+    super(`desktop_compatibility_authority_${code}`); this.name = "DesktopAuthorityError";
+  }
+}
+
+export interface DesktopAuthorityStoreOptions {
+  /** Explicit feature-owned directory; never an OS trust store or existing Claude CA. */
+  directory: string;
+  now?: () => number;
+  /** Test seam; production always uses Windows CurrentUser DPAPI. */
+  protection?: AuthorityKeyProtection;
+}
+
+export interface StoredDesktopAuthority {
+  authority: LocalInterceptCa;
+  commonName: string;
+  fingerprint: string;
+  expiresAt: number;
+  renewalDue: boolean;
+  reused: boolean;
+}
+
+export type DesktopAuthorityInspection =
+  | { status: "missing" | "invalid" }
+  | { status: "present" | "expired" | "renewal-required"; certPem: string; fingerprint: string; expiresAt: number; renewalDue: boolean };
+
+/** Read-only public metadata for status: no key decryption, ACL write, lock or generation. */
+export function inspectDesktopCompatibilityAuthority(directory: string, now = Date.now()): DesktopAuthorityInspection {
+  if (!isAbsolute(directory) || !Number.isFinite(now)) return { status: "invalid" };
+  const path = join(directory, FILE);
+  try {
+    if (!pathPresent(directory)) return { status: "missing" };
+    assertPath(directory, true);
+    if (!pathPresent(path)) return { status: "missing" };
+    assertPath(path, false);
+    const saved = JSON.parse(readFileSync(path, "utf8"));
+    if (saved.version !== 1 || saved.protection !== "windows-current-user-dpapi" || typeof saved.certPem !== "string"
+      || typeof saved.sealed !== "string" || !/^[A-Za-z0-9+/]+={0,2}$/.test(saved.sealed) || saved.sealed.length > MAX_FILE) return { status: "invalid" };
+    const certificate = new X509Certificate(saved.certPem), expiresAt = Date.parse(certificate.validTo);
+    if (!certificate.ca || !Number.isFinite(expiresAt)) return { status: "invalid" };
+    return { status: expiresAt <= now ? "expired" : isServerAuthOnlyCertificate(certificate) ? "present" : "renewal-required", certPem: saved.certPem,
+      fingerprint: certificate.fingerprint256.replaceAll(":", ""), expiresAt, renewalDue: expiresAt - now <= 7 * DAY };
+  } catch { return { status: "invalid" }; }
+}
+
+function assertPath(path: string, directory: boolean): void {
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile() || stat.nlink !== 1 || stat.size > MAX_FILE)) {
+    throw new DesktopAuthorityError("unsafe_path");
+  }
+}
+
+function pathPresent(path: string): boolean {
+  try { lstatSync(path); return true; }
+  catch (error) {
+    if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return false;
+    throw new DesktopAuthorityError("unsafe_path");
+  }
+}
+
+function validatedAuthority(certPem: string, keyPem: string, commonName: string, now: number, reused: boolean, allowExpired = false): StoredDesktopAuthority {
+  try {
+    const certificate = new X509Certificate(certPem);
+    const privateKey = createPrivateKey(keyPem), publicKey = createPublicKey(keyPem);
+    if (!certificate.ca || !certificate.checkPrivateKey(privateKey) || !certificate.verify(publicKey)
+      || certificate.subject !== certificate.issuer
+      || !commonName.startsWith("OpenCodex Codex Desktop ") || !certificate.subject.split("\n").includes(`CN=${commonName}`)) {
+      throw new Error("invalid");
+    }
+    const expiresAt = Date.parse(certificate.validTo), startsAt = Date.parse(certificate.validFrom);
+    if (!Number.isFinite(expiresAt) || !Number.isFinite(startsAt) || startsAt > now
+      || expiresAt - startsAt > (VALIDITY_DAYS + 1) * DAY) throw new Error("invalid");
+    if (expiresAt <= now && !allowExpired) throw new DesktopAuthorityError("expired");
+    if (!allowExpired && !isServerAuthOnlyCertificate(certificate)) throw new DesktopAuthorityError("renewal_required");
+    return { authority: { certPem, keyPem, privateKey, publicKey }, commonName,
+      fingerprint: certificate.fingerprint256.replaceAll(":", ""), expiresAt,
+      renewalDue: expiresAt - now <= 7 * DAY, reused };
+  } catch (error) {
+    if (error instanceof DesktopAuthorityError) throw error;
+    throw new DesktopAuthorityError("unreadable");
+  }
+}
+
+async function readAuthority(path: string, protection: AuthorityKeyProtection, now: number, allowExpired = false): Promise<StoredDesktopAuthority> {
+  assertPath(path, false);
+  await hardenSecretPathAsync(path, { required: true });
+  assertPath(path, false);
+  let cleartext: Uint8Array | undefined;
+  try {
+    const saved = JSON.parse(readFileSync(path, "utf8"));
+    if (saved.version !== 1 || saved.protection !== "windows-current-user-dpapi"
+      || typeof saved.certPem !== "string" || typeof saved.sealed !== "string"
+      || !/^[A-Za-z0-9+/]+={0,2}$/.test(saved.sealed) || saved.sealed.length > MAX_FILE) throw new Error("invalid");
+    cleartext = await protection.unprotect(Buffer.from(saved.sealed, "base64"));
+    const secret = JSON.parse(Buffer.from(cleartext).toString("utf8"));
+    if (secret.policy !== POLICY || secret.certSha256 !== digest(saved.certPem)
+      || typeof secret.keyPem !== "string" || typeof secret.commonName !== "string") throw new Error("invalid");
+    return validatedAuthority(saved.certPem, secret.keyPem, secret.commonName, now, true, allowExpired);
+  } catch (error) {
+    if (error instanceof DesktopAuthorityError) throw error;
+    // A corrupt or foreign-user key never silently regenerates a new root or trust prompt.
+    throw new DesktopAuthorityError("unreadable");
+  } finally { cleartext?.fill(0); }
+}
+
+/** Loads only existing state. Expired or legacy-purpose keys may be loaded solely for trust removal/renewal. */
+export async function loadDesktopCompatibilityAuthority(options: DesktopAuthorityStoreOptions, allowExpiredForRemoval = false): Promise<StoredDesktopAuthority> {
+  if (!isAbsolute(options.directory)) throw new DesktopAuthorityError("unsafe_path");
+  const now = options.now?.() ?? Date.now();
+  if (!Number.isFinite(now)) throw new DesktopAuthorityError("unreadable");
+  assertPath(options.directory, true);
+  const path = join(options.directory, FILE);
+  if (!pathPresent(path)) throw new DesktopAuthorityError("unreadable");
+  return readAuthority(path, options.protection ?? windowsAuthorityKeyProtection, now, allowExpiredForRemoval);
+}
+
+/** Reuses one user-protected root across restarts; never installs, rotates or removes trust. */
+export async function ensureDesktopCompatibilityAuthority(options: DesktopAuthorityStoreOptions): Promise<StoredDesktopAuthority> {
+  return publishAuthority(options);
+}
+
+/** Deliberate replacement after the caller has removed OS trust and stopped consumers. */
+export async function renewDesktopCompatibilityAuthority(options: DesktopAuthorityStoreOptions, expectedFingerprint: string): Promise<StoredDesktopAuthority> {
+  if (!/^[A-F0-9]{64}$/.test(expectedFingerprint)) throw new DesktopAuthorityError("fingerprint_changed");
+  return publishAuthority(options, expectedFingerprint);
+}
+
+async function publishAuthority(options: DesktopAuthorityStoreOptions, expectedFingerprint?: string): Promise<StoredDesktopAuthority> {
+  if (!isAbsolute(options.directory)) throw new DesktopAuthorityError("unsafe_path");
+  if (!options.protection && process.platform !== "win32") throw new Error("desktop_compatibility_windows_required");
+  const now = options.now?.() ?? Date.now();
+  if (!Number.isFinite(now)) throw new DesktopAuthorityError("unreadable");
+  const protection = options.protection ?? windowsAuthorityKeyProtection;
+  mkdirSync(options.directory, { recursive: true, mode: 0o700 });
+  assertPath(options.directory, true);
+  await hardenSecretDirAsync(options.directory, { required: true });
+  return withClientLifecycle(async () => {
+    assertPath(options.directory, true);
+    const path = join(options.directory, FILE);
+    let original: string | undefined;
+    if (expectedFingerprint !== undefined) {
+      if (!pathPresent(path)) throw new DesktopAuthorityError("fingerprint_changed");
+      const previous = await readAuthority(path, protection, now, true);
+      if (previous.fingerprint !== expectedFingerprint) throw new DesktopAuthorityError("fingerprint_changed");
+      original = readFileSync(path, "utf8");
+    } else if (pathPresent(path)) return readAuthority(path, protection, now);
+    const commonName = `OpenCodex Codex Desktop ${randomUUID()}`;
+    const authority = createCertificateAuthority({ commonName, validityDays: VALIDITY_DAYS,
+      permittedDnsNames: ["chatgpt.com"], excludeAllIpAddresses: true, serverAuthOnly: true });
+    const cleartext = Buffer.from(JSON.stringify({ policy: POLICY, certSha256: digest(authority.certPem), commonName, keyPem: authority.keyPem }));
+    let sealed: Uint8Array;
+    try { sealed = await protection.protect(cleartext); }
+    catch { throw new DesktopAuthorityError("protection_failed"); }
+    finally { cleartext.fill(0); }
+    if (sealed.byteLength === 0 || sealed.byteLength > 65_536) throw new DesktopAuthorityError("protection_failed");
+    const contents = JSON.stringify({ version: 1, protection: "windows-current-user-dpapi", certPem: authority.certPem,
+      sealed: Buffer.from(sealed).toString("base64") });
+    const temporary = join(options.directory, `authority-${randomUUID()}.tmp`);
+    let created = false;
+    try {
+      const fd = openSync(temporary, "wx", 0o600); created = true;
+      try { writeFileSync(fd, contents); fsyncSync(fd); } finally { closeSync(fd); }
+      await hardenSecretPathAsync(temporary, { required: true });
+      assertPath(temporary, false); assertPath(options.directory, true);
+      // Verify the new encrypted envelope before replacing the only recovery source.
+      await readAuthority(temporary, protection, now);
+      if (original !== undefined) {
+        assertPath(path, false);
+        if (readFileSync(path, "utf8") !== original) throw new DesktopAuthorityError("fingerprint_changed");
+      } else if (pathPresent(path)) throw new DesktopAuthorityError("unsafe_path");
+      renameSync(temporary, path); created = false;
+      // Read back the actual persisted pair before reporting a successful setup.
+      const persisted = await readAuthority(path, protection, now);
+      return { ...persisted, reused: false };
+    } finally { if (created) unlinkSync(temporary); }
+  }, { lockPath: join(options.directory, "authority-publication.sqlite") });
+}

package/src/codex/desktop-compatibility/connection-store.ts

@@ -0,0 +1,87 @@
+import { randomUUID } from "node:crypto";
+import { closeSync, fsyncSync, linkSync, lstatSync, openSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { isAbsolute, join } from "node:path";
+import { withClientLifecycle } from "../../client/lifecycle-lock";
+import { hardenSecretDirAsync, hardenSecretPathAsync } from "../../lib/windows-secret-acl";
+
+export interface DesktopConnectionIdentity {
+  version: 1;
+  id: string;
+  connectPort: number;
+  pacPort: number;
+}
+export interface DesktopConnectionStore {
+  read(): DesktopConnectionIdentity | null;
+  publish(value: DesktopConnectionIdentity): Promise<DesktopConnectionIdentity>;
+}
+const FILE = "connection.json";
+const fail = (reason: "invalid" | "changed" | "cleanup_required", cause?: unknown) => new Error(`desktop_compatibility_connection_${reason}`, { cause });
+const port = (value: unknown): value is number => Number.isSafeInteger(value) && Number(value) >= 1024 && Number(value) <= 65535;
+function validate(value: unknown): DesktopConnectionIdentity {
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw fail("invalid");
+  const row = value as Record<string, unknown>;
+  if (Object.keys(row).length !== 4 || row.version !== 1 || typeof row.id !== "string"
+    || !/^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/.test(row.id)
+    || !port(row.connectPort) || !port(row.pacPort) || row.connectPort === row.pacPort) throw fail("invalid");
+  return { version: 1, id: row.id, connectPort: row.connectPort, pacPort: row.pacPort };
+}
+function assertPath(path: string, directory: boolean): void {
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile() || stat.nlink !== 1 || stat.size > 4096)) throw fail("invalid");
+}
+function present(path: string): boolean {
+  try { lstatSync(path); return true; }
+  catch (error) { if (error && typeof error === "object" && "code" in error && error.code === "ENOENT") return false; throw fail("invalid"); }
+}
+function same(left: DesktopConnectionIdentity, right: DesktopConnectionIdentity): boolean {
+  return left.version === right.version && left.id === right.id && left.connectPort === right.connectPort && left.pacPort === right.pacPort;
+}
+
+/** Public endpoint identity only. No token, account, private key or expiry is persisted here. */
+export function createDesktopConnectionStore(directory: string): DesktopConnectionStore {
+  if (!isAbsolute(directory)) throw fail("invalid");
+  const path = join(directory, FILE);
+  const read = (): DesktopConnectionIdentity | null => {
+    try {
+      if (!present(directory)) return null;
+      assertPath(directory, true);
+      if (!present(path)) return null;
+      assertPath(path, false);
+      return validate(JSON.parse(readFileSync(path, "utf8")));
+    } catch { throw fail("invalid"); }
+  };
+  const verifyExisting = (value: DesktopConnectionIdentity): DesktopConnectionIdentity | null => {
+    const existing = read();
+    if (existing && !same(existing, value)) throw fail("changed");
+    return existing;
+  };
+  return { read, async publish(input) {
+    const value = validate(input);
+    const existing = verifyExisting(value); if (existing) return existing;
+    // A trusted authority must already own this directory. Never create a replacement home.
+    assertPath(directory, true); await hardenSecretDirAsync(directory, { required: true });
+    return withClientLifecycle(async () => {
+      const raced = verifyExisting(value); if (raced) return raced;
+      const temporary = join(directory, `connection-${randomUUID()}.tmp`);
+      let created = false;
+      try {
+        const fd = openSync(temporary, "wx", 0o600); created = true;
+        try { writeFileSync(fd, JSON.stringify(value)); fsyncSync(fd); } finally { closeSync(fd); }
+        await hardenSecretPathAsync(temporary, { required: true });
+        assertPath(directory, true); assertPath(temporary, false);
+        // Create-only publication cannot overwrite another process's endpoint identity.
+        try { linkSync(temporary, path); }
+        catch (error) {
+          const winner = verifyExisting(value); if (!winner) throw error;
+        }
+        unlinkSync(temporary); created = false;
+        const published = verifyExisting(value); if (!published) throw fail("changed");
+        return published;
+      } catch (error) {
+        try { if (created && present(temporary)) unlinkSync(temporary); }
+        catch (cleanupError) { throw fail("cleanup_required", new AggregateError([error, cleanupError], "Endpoint publication and cleanup failed")); }
+        throw error;
+      }
+    }, { lockPath: join(directory, "connection-publication.sqlite") });
+  } };
+}

package/src/codex/desktop-compatibility/installed-build.ts

@@ -0,0 +1,55 @@
+import { execFile } from "node:child_process";
+import { win32 } from "node:path";
+import { isTestHomeGuardArmed } from "../../lib/test-home-guard";
+import { resolveTrustedWindowsPowerShellExe } from "../../lib/windows-elevation";
+import { parseWindowsDesktopPackage, WINDOWS_PACKAGE_DISCOVERY_SCRIPT } from "../desktop-app/windows";
+import type { DesktopAppInstall } from "../desktop-app/types";
+
+export const DESKTOP_COMPATIBILITY_ASSESSED_VERSION = "26.924.2738.0";
+export const DESKTOP_COMPATIBILITY_ASSESSED_FAMILY = "OpenAI.Codex_2p2nqsd0c76g0";
+
+function matchesAssessedPackage(install: DesktopAppInstall): boolean {
+  const name = win32.basename(install.root);
+  const parts = /^OpenAI\.Codex_(\d+\.\d+\.\d+\.\d+)_(x64|arm64|x86|neutral)_([A-Za-z0-9.-]*)_([A-Za-z0-9]+)$/.exec(name);
+  return install.id === DESKTOP_COMPATIBILITY_ASSESSED_FAMILY && install.relaunch === `${install.id}!App`
+    && !!parts && parts[1] === DESKTOP_COMPATIBILITY_ASSESSED_VERSION && `OpenAI.Codex_${parts[4]}` === install.id;
+}
+
+/** Resolve only after the exact asynchronous child has closed, including abort/timeout. */
+function queryInstalledPackage(signal: AbortSignal): Promise<DesktopAppInstall | null> {
+  if (process.platform !== "win32" || isTestHomeGuardArmed() || signal.aborted) return Promise.resolve(null);
+  return new Promise(resolve => {
+    let completed = false, closed = false, result: DesktopAppInstall | null = null;
+    const finish = () => { if (completed && closed) { signal.removeEventListener("abort", abort); resolve(result); } };
+    const child = execFile(resolveTrustedWindowsPowerShellExe(), ["-NoProfile", "-NonInteractive", "-Command", WINDOWS_PACKAGE_DISCOVERY_SCRIPT], {
+      timeout: 10000, maxBuffer: 65536, encoding: "utf8", windowsHide: true,
+    }, (error, stdout) => { result = error ? null : parseWindowsDesktopPackage(stdout); completed = true; finish(); });
+    const abort = () => { try { child.kill(); } catch { /* Keep ownership until execFile reports close. */ } };
+    child.once("close", () => { closed = true; finish(); });
+    signal.addEventListener("abort", abort, { once: true });
+    if (signal.aborted) abort();
+  });
+}
+
+/** Coalesce concurrent fresh probes; never cache a positive verdict across requests. */
+export function createInstalledBuildProbe(query: (signal: AbortSignal) => Promise<DesktopAppInstall | null> = queryInstalledPackage) {
+  let pending: Promise<boolean> | null = null, controller: AbortController | null = null, closed = false;
+  return {
+    check(): Promise<boolean> {
+      if (closed) return Promise.resolve(false);
+      if (pending) return pending;
+      const current = new AbortController(); controller = current;
+      pending = Promise.resolve().then(() => current.signal.aborted ? null : query(current.signal))
+        .then(install => !closed && !current.signal.aborted && !!install
+          && matchesAssessedPackage(install))
+        .catch(() => false).finally(() => { pending = null; controller = null; });
+      return pending;
+    },
+    async close(): Promise<void> { closed = true; controller?.abort(); await pending; },
+  };
+}
+
+export async function isAssessedDesktopInstalled(): Promise<boolean> {
+  const probe = createInstalledBuildProbe();
+  try { return await probe.check(); } finally { await probe.close(); }
+}

package/src/codex/desktop-compatibility/json-body.ts

@@ -0,0 +1,29 @@
+/** Buffer small JSON only; large bodies pass through without collecting the remainder. */
+export async function boundedJsonBody(body: ReadableStream<Uint8Array> | null, maxBytes = 262144): Promise<{ bytes: Buffer } | { stream: ReadableStream<Uint8Array> }> {
+  if (!body) return { bytes: Buffer.alloc(0) };
+  const reader = body.getReader();
+  const chunks: Uint8Array[] = [];
+  let count = 0;
+  try {
+    while (true) {
+      const next = await reader.read();
+      if (next.done) { reader.releaseLock(); return { bytes: Buffer.concat(chunks, count) }; }
+      chunks.push(next.value); count += next.value.byteLength;
+      if (count <= maxBytes && chunks.length < 1024) continue;
+      let index = 0;
+      return { stream: new ReadableStream<Uint8Array>({
+        async pull(controller) {
+          if (index < chunks.length) {
+            const value = chunks[index]!; chunks[index++] = new Uint8Array(0); controller.enqueue(value); return;
+          }
+          try {
+            const part = await reader.read();
+            if (part.done) { reader.releaseLock(); controller.close(); }
+            else controller.enqueue(part.value);
+          } catch (error) { reader.releaseLock(); controller.error(error); }
+        },
+        async cancel(reason) { try { await reader.cancel(reason); } finally { reader.releaseLock(); } },
+      }) };
+    }
+  } catch (error) { reader.releaseLock(); throw error; }
+}

package/src/codex/desktop-compatibility/native-identity.ts

@@ -0,0 +1,62 @@
+import { readFileSync, statSync, type BigIntStats } from 'node:fs';
+import { createHash, randomUUID } from 'node:crypto';
+import type { UsageIdentity } from './usage-controller';
+
+type Credential = { identity: UsageIdentity; accessToken: string };
+const equal = (a: UsageIdentity, b: UsageIdentity) => a.id === b.id && a.userId === b.userId && a.plan === b.plan
+  && a.credentialGeneration === b.credentialGeneration;
+
+/** Local native credentials remain in memory and are never returned by the public reader. */
+export function createNativeIdentityReader(authPath: string, upstreamFetch: typeof fetch = fetch) {
+  const readerId = randomUUID(); let generation = 0, previousSnapshot: string | undefined;
+  const stamp = (value: BigIntStats) =>
+    `${value.dev}:${value.ino}:${value.size}:${value.mtimeNs}:${value.ctimeNs}`;
+  const readCredential = (): Credential => {
+    const before = statSync(authPath, { bigint: true });
+    if (before.size > 1048576n) throw new Error('Unexpected native auth size');
+    const text = readFileSync(authPath, 'utf8'), after = statSync(authPath, { bigint: true });
+    if (stamp(before) !== stamp(after)) throw new Error('Native credentials changed during read');
+    const snapshot = `${stamp(after)}:${createHash('sha256').update(text).digest('hex')}`;
+    if (snapshot !== previousSnapshot) { previousSnapshot = snapshot; generation++; }
+    const auth = JSON.parse(text);
+    if (auth.auth_mode !== 'chatgpt' || typeof auth.tokens?.id_token !== 'string'
+      || typeof auth.tokens?.access_token !== 'string' || !auth.tokens.access_token
+      || typeof auth.tokens?.account_id !== 'string') throw new Error('Native login required');
+    // These local claims are only a binding hint. Activation additionally verifies upstream.
+    const claims = JSON.parse(Buffer.from(auth.tokens.id_token.split('.')[1], 'base64url').toString('utf8'))['https://api.openai.com/auth'];
+    if (!claims || claims.chatgpt_account_id !== auth.tokens.account_id
+      || typeof claims.chatgpt_user_id !== 'string' || !claims.chatgpt_user_id
+      || !['plus', 'pro'].includes(claims.chatgpt_plan_type)) throw new Error('Unsupported identity');
+    return { identity: { id: auth.tokens.account_id, userId: claims.chatgpt_user_id,
+      plan: claims.chatgpt_plan_type, structure: 'personal', credentialGeneration: `${readerId}:${generation}` }, accessToken: auth.tokens.access_token };
+  };
+  const readCurrentIdentity = async (): Promise<UsageIdentity | null> => {
+    try { return readCredential().identity; } catch { return null; }
+  };
+  const verifyFreshIdentity = async (): Promise<UsageIdentity | null> => {
+    try {
+      const before = readCredential();
+      const response = await upstreamFetch('https://chatgpt.com/backend-api/wham/usage', {
+        headers: { authorization: 'Bearer ' + before.accessToken, 'ChatGPT-Account-ID': before.identity.id },
+        redirect: 'manual', signal: AbortSignal.timeout(10000),
+      });
+      if (response.status !== 200 || !response.body) { await response.body?.cancel(); return null; }
+      const reader = response.body.getReader(); const chunks: Uint8Array[] = []; let size = 0;
+      try {
+        for (;;) {
+          const part = await reader.read(); if (part.done) break;
+          size += part.value.length;
+          if (size > 65536) { await reader.cancel(); return null; }
+          chunks.push(part.value);
+        }
+      } finally { reader.releaseLock(); }
+      const usage = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+      const after = readCredential();
+      if (!equal(before.identity, after.identity) || before.accessToken !== after.accessToken
+        || usage.account_id !== before.identity.id || usage.user_id !== before.identity.userId
+        || usage.plan_type !== before.identity.plan) return null;
+      return before.identity;
+    } catch { return null; }
+  };
+  return { readCurrentIdentity, verifyFreshIdentity };
+}

package/src/codex/desktop-compatibility/relay-listener.ts

@@ -0,0 +1,93 @@
+import { createServer } from "node:https";
+import { Readable, type Duplex } from "node:stream";
+import type { PemKeyPair } from "../../claude/intercept/local-ca";
+import { forwardHeadersForUpstream } from "../../claude/intercept/listener";
+import { dialDesktopUpstream, type DesktopTunnelOptions } from "../../lib/desktop-upstream-tunnel";
+
+const ORIGIN = "https://chatgpt.com";
+const STRIP = new Set(["connection", "keep-alive", "transfer-encoding", "content-encoding", "content-length", "alt-svc", "proxy-authenticate"]);
+export interface DesktopRelayOptions {
+  leaf: PemKeyPair;
+  fetchImpl: typeof fetch;
+  /** Test-only TLS peer; the production destination is fixed, never taken from a request. */
+  websocketPeer?: { host: string; port: number; ca: string };
+  websocketTransport?: Pick<DesktopTunnelOptions, "proxy" | "proxyCa" | "timeoutMs">;
+}
+
+/** Transparent HTTP and raw upgraded-socket relay. Only fetchImpl owns usage policy. */
+export async function startDesktopRelay(options: DesktopRelayOptions) {
+  const sockets = new Set<Duplex>(), requests = new Set<AbortController>();
+  const server = createServer({ cert: options.leaf.certPem, key: options.leaf.keyPem, ALPNProtocols: ["http/1.1"] });
+  server.on("connection", socket => { sockets.add(socket); socket.once("close", () => sockets.delete(socket)); });
+  const valid = (host: string | undefined, path: string | undefined) =>
+    (host?.toLowerCase() === "chatgpt.com" || host?.toLowerCase() === "chatgpt.com:443") && !!path && path.startsWith("/") && !path.startsWith("//");
+  server.on("request", (req, res) => {
+    if (!valid(req.headers.host, req.url)) { res.writeHead(421); res.end(); return; }
+    const abort = new AbortController(); requests.add(abort);
+    const finish = () => { requests.delete(abort); abort.abort(); };
+    res.once("close", finish); req.once("error", finish);
+    void (async () => {
+      const headers = new Headers();
+      for (let i = 0; i < req.rawHeaders.length; i += 2) headers.append(req.rawHeaders[i]!, req.rawHeaders[i + 1]!);
+      const method = req.method ?? "GET";
+      const response = await options.fetchImpl(ORIGIN + req.url, {
+        method, headers: forwardHeadersForUpstream(headers), redirect: "manual", signal: abort.signal,
+        // Node's and Bun's declarations disagree on BYOB overloads; both implement Web streams.
+        body: method === "GET" || method === "HEAD" ? undefined : Readable.toWeb(req) as unknown as ReadableStream<Uint8Array>,
+        // @ts-expect-error Node-compatible streaming fetch requires half duplex.
+        duplex: "half",
+      });
+      if (res.destroyed) { await response.body?.cancel(); return; }
+      const output: Record<string, string | string[]> = {};
+      response.headers.forEach((value, key) => { if (!STRIP.has(key) && key !== "set-cookie") output[key] = value; });
+      const cookies = response.headers.getSetCookie(); if (cookies.length) output["set-cookie"] = cookies;
+      res.writeHead(response.status, output);
+      if (!response.body || method === "HEAD") { await response.body?.cancel(); res.end(); return; }
+      const body = Readable.fromWeb(response.body as unknown as import("node:stream/web").ReadableStream<Uint8Array>);
+      body.once("error", () => res.destroy()); res.once("close", () => body.destroy()); body.pipe(res);
+    })().catch(() => {
+      if (res.headersSent) res.destroy(); else { res.writeHead(502, { "Content-Length": "0" }); res.end(); }
+    });
+  });
+  server.on("upgrade", (req, client, head) => {
+    if (!valid(req.headers.host, req.url)) { client.end("HTTP/1.1 421 Misdirected Request\r\nContent-Length: 0\r\nConnection: close\r\n\r\n"); return; }
+    const peer = options.websocketPeer;
+    const abort = new AbortController(); requests.add(abort);
+    client.once("close", () => { requests.delete(abort); abort.abort(); });
+    client.once("error", () => abort.abort());
+    void dialDesktopUpstream({ ...options.websocketTransport, ...(peer ? { target: { host: peer.host, port: peer.port }, ca: peer.ca } : {}), signal: abort.signal }).then(upstream => {
+      requests.delete(abort);
+      if (client.destroyed || abort.signal.aborted) { upstream.destroy(); return; }
+      sockets.add(upstream);
+      upstream.once("error", () => client.destroy());
+      upstream.once("close", () => { sockets.delete(upstream); client.destroy(); });
+      client.once("close", () => upstream.destroy());
+      const lines = [`${req.method ?? "GET"} ${req.url} HTTP/1.1`];
+      for (let i = 0; i < req.rawHeaders.length; i += 2) {
+        if (!/^proxy-(?:authorization|connection)$/i.test(req.rawHeaders[i]!)) lines.push(`${req.rawHeaders[i]}: ${req.rawHeaders[i + 1]}`);
+      }
+      upstream.write(lines.join("\r\n") + "\r\n\r\n");
+      if (head.length) upstream.write(head);
+      client.pipe(upstream).pipe(client);
+    }).catch(() => {
+      requests.delete(abort);
+      if (!client.destroyed) client.end("HTTP/1.1 502 Bad Gateway\r\nContent-Length: 0\r\nConnection: close\r\n\r\n");
+    });
+  });
+  try {
+    await new Promise<void>((resolve, reject) => {
+      server.once("error", reject);
+      server.listen(0, "127.0.0.1", () => { server.off("error", reject); resolve(); });
+    });
+  } catch (error) { server.close(); throw error; }
+  const address = server.address();
+  if (!address || typeof address === "string") throw new Error("desktop_compatibility_listener_unavailable");
+  let closing: Promise<void> | null = null;
+  return { port: address.port, close() {
+    if (closing) return closing;
+    for (const abort of requests) abort.abort();
+    for (const socket of sockets) socket.destroy();
+    closing = new Promise<void>((resolve, reject) => server.close(error => error ? reject(error) : resolve()));
+    server.closeAllConnections(); return closing;
+  } };
+}

package/src/codex/desktop-compatibility/routing-binding.ts

@@ -0,0 +1,10 @@
+import type { OcxConfig } from "../../types";
+
+export interface NativeCompatibilityOwner { hostname: string; port: number; loopbackPort?: number; config: OcxConfig }
+let owner: NativeCompatibilityOwner | null = null;
+/** Bound sockets, not persisted desired ports, identify this process's native routing target. */
+export function bindNativeCompatibilityOwner(value: NativeCompatibilityOwner): () => void {
+  owner = value;
+  return () => { if (owner === value) owner = null; };
+}
+export function nativeCompatibilityOwner(): NativeCompatibilityOwner | null { return owner; }

package/src/codex/desktop-compatibility/routing-preflight.ts

@@ -0,0 +1,69 @@
+import { lstatSync, readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+import { join } from "node:path";
+import type { OcxConfig } from "../../types";
+import { nativeCompatibilityOwner, type NativeCompatibilityOwner } from "./routing-binding";
+
+const record = (value: unknown): value is Record<string, unknown> => !!value && typeof value === "object" && !Array.isArray(value);
+// These are routing inputs, not proof of a conversation's final provider. Their
+// changes revoke the observed context even if the loopback URL stays the same.
+const ROUTING_KEYS = ["providers", "defaultProvider", "defaultModelAliases", "customModels", "combos", "routingProfiles",
+  "subagentModelFallback", "subagentModelFallbackByModel", "injectionModel", "compactionRouting", "compactionRecovery",
+  "blockedModelRedirects", "shadowCallIntercept", "protocols", "memoryModels"] as const satisfies readonly (keyof OcxConfig)[];
+function routingDigest(text: string, owner: NativeCompatibilityOwner): string {
+  const native = Bun.TOML.parse(text) as Record<string, unknown>;
+  // Desktop refreshes MCP endpoints after launch. Tool transport metadata and TOML
+  // formatting do not select the model transport. Keep all other (including unknown)
+  // native fields bound, rather than an allowlist that could miss a new routing key.
+  const { mcp_servers: _mcpServers, ...nativeContext } = native;
+  const projection = Object.fromEntries(ROUTING_KEYS.map(key => [key, owner.config[key]]));
+  const serialized = JSON.stringify([nativeContext, owner.hostname, owner.port, owner.loopbackPort, projection], (_key, value) =>
+    record(value) ? Object.fromEntries(Object.keys(value).sort().map(key => [key, value[key]])) : value);
+  if (Buffer.byteLength(serialized) > 1048576) throw new Error("Routing snapshot too large");
+  return createHash("sha256").update(serialized).digest("hex");
+}
+/** Validates the effective root/profile routing only; it does not prove a thread's selected provider. */
+export function matchesNativeCompatibilityRouting(text: string, owner: NativeCompatibilityOwner | null): boolean {
+  if (!owner || owner.config.codexDesktopAuthless === true || owner.config.runtimeRole === "client") return false;
+  try {
+    const root: unknown = Bun.TOML.parse(text);
+    if (!record(root)) return false;
+    let effective = root;
+    if (root.profile !== undefined) {
+      if (typeof root.profile !== "string" || !record(root.profiles)) return false;
+      const profile = root.profiles[root.profile];
+      if (!record(profile)) return false;
+      effective = { ...root, ...profile };
+    }
+    if ((effective.model_provider ?? "openai") !== "openai" || effective.forced_login_method === "api") return false;
+    if (typeof effective.openai_base_url !== "string") return false;
+    const url = new URL(effective.openai_base_url);
+    if (url.protocol !== "http:" || !["127.0.0.1", "[::1]"].includes(url.hostname) || url.username || url.password
+      || url.search || url.hash || !["/v1", "/v1/"].includes(url.pathname) || !url.port) return false;
+    const port = Number(url.port), matchesPort = (value: number | undefined) => Number.isInteger(value) && Number(value) > 0 && value === port;
+    // The companion always binds IPv4. localhost can resolve to another address family.
+    if (matchesPort(owner.loopbackPort) && url.hostname === "127.0.0.1") return true;
+    if (!matchesPort(owner.port)) return false;
+    return url.hostname === "127.0.0.1" ? ["127.0.0.1", "0.0.0.0"].includes(owner.hostname)
+      : ["::1", "[::1]", "::", "[::]"].includes(owner.hostname);
+  } catch { return false; }
+}
+export function createNativeRoutingVerifier(codexHome: string, readOwner = nativeCompatibilityOwner) {
+  const path = join(codexHome, "config.toml");
+  let baseline: string | undefined, invalidated = false;
+  return () => {
+    if (invalidated) return false;
+    try {
+      // Process-level overrides could put the app on another transport despite its TOML.
+      if (["CODEX_API_BASE_URL", "CODEX_APP_SERVER_WS_URL", "CODEX_ELECTRON_USER_DATA_PATH", "ELECTRON_RUN_AS_NODE"].some(key => process.env[key]?.trim())) { invalidated = true; return false; }
+      const stat = lstatSync(path);
+      if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 1048576) { invalidated = true; return false; }
+      const text = readFileSync(path, "utf8"), owner = readOwner();
+      if (!owner || !matchesNativeCompatibilityRouting(text, owner)) { invalidated = true; return false; }
+      const current = routingDigest(text, owner);
+      if (baseline !== undefined && current !== baseline) { invalidated = true; return false; }
+      baseline ??= current;
+      return true;
+    } catch { invalidated = true; return false; }
+  };
+}

package/src/codex/desktop-compatibility/runtime-ownership.ts

@@ -0,0 +1,28 @@
+import { randomUUID } from "node:crypto";
+
+interface LaunchContext { pacUrl: string; generation: string; current(): boolean }
+/** Process-local ownership; the management sibling guard owns the cross-instance boundary. */
+let owner: { token: symbol; kind: "runtime" | "certificate"; launch?: LaunchContext } | null = null;
+export function desktopCompatibilityRuntimeActive(): boolean { return owner?.kind === "runtime"; }
+function acquire(kind: "runtime" | "certificate"): () => void {
+  if (owner !== null) throw new Error("desktop_compatibility_busy");
+  const token = Symbol(); owner = { token, kind };
+  return () => { if (owner?.token === token) owner = null; };
+}
+export const acquireDesktopCompatibilityRuntime = () => acquire("runtime");
+export const acquireDesktopCertificateMutation = () => acquire("certificate");
+
+/** Published only by a successfully started runtime, never reconstructed from disk or app arguments. */
+export function bindDesktopCompatibilityLaunch(pacUrl: string, current: () => boolean): () => void {
+  if (owner?.kind !== "runtime" || owner.launch) throw new Error("desktop_compatibility_launch_owner_unverified");
+  const lease = owner, launch = { pacUrl, generation: randomUUID(), current };
+  lease.launch = launch;
+  return () => { if (lease.launch === launch) delete lease.launch; };
+}
+
+/** No key loading, socket discovery, or optional-runtime construction on the ordinary restart path. */
+export function readDesktopCompatibilityLaunch(): { pacUrl: string; generation: string } | null {
+  const launch = owner?.kind === "runtime" ? owner.launch : undefined;
+  try { return launch?.current() ? { pacUrl: launch.pacUrl, generation: launch.generation } : null; }
+  catch { return null; }
+}