@codexapi/codexclaude 2.0.37 → 2.0.39

package/CUSTOMIZATIONS.md

@@ -5,10 +5,10 @@
 ## Runtime
 
 - Customer-facing app name: `MagnetAPI.org Codex CLI`
-- Local launcher version: `2.0.37`
-- Bundled official runtime dependency: `@openai/codex@0.153.4`
+- Local launcher version: `2.0.39`
+- Bundled official runtime dependency: `@openai/codex@0.154.0`
 - Required install command: `npm install -g @codexapi/codexclaude@latest`
-- Hosted fallback: `npm install -g https://codexapi.pro/downloads/codexapi-codexclaude-2.0.37.tgz`
+- Hosted fallback archive: `https://codexapi.pro/downloads/codexapi-codexclaude-2.0.39.tgz`, with its SHA-256 sidecar. The updater installs a verified local copy, not an npm remote URL.
 - Bundled runtime version is managed internally and must not be used for customer update prompts.
 - Launcher update checks may call the CodexAPI.pro version endpoint and `@codexapi/codexclaude` npm metadata only.
 - The launcher must never check `@openai/codex` npm metadata or OpenAI GitHub releases for update notices.
@@ -25,8 +25,8 @@
 - Passes unknown commands directly to the bundled runtime after config is applied.
 - Provides `codexclaude changelog` using the managed version endpoint.
 - Does not expose separate `codexclaude status` or `codexclaude usage` commands; wallet information remains a compact pre-launch line.
-- Version `2.0.37` is forced by the backend minimum version and older clients must show an update-required message.
-- Mandatory updates present a press-Enter `Upgrade Now` action in an interactive terminal, invoke npm with an argument array and no shell interpolation, verify the installed launcher version, use the hosted release if the registry fails or returns a stale version, then relaunch the requested action automatically.
+- The backend minimum controls enforcement. Never require an unpublished or unverified archive.
+- Mandatory updates present a press-Enter `Upgrade Now` action, install the exact managed version through npm-cli.js on Windows, verify npm's actual global package, fall back to a checksum-verified local archive and relaunch its verified entrypoint through Node. Do not weaken npm policies or rely on stale PATH aliases.
 - The npm package manifest exposes only `codexclaude`, preventing npm from colliding with a native `codex` or `claude` command before postinstall runs.
 - Global installation creates optional `codex` and `claude` aliases only when no existing command is present in the npm prefix or anywhere on `PATH`; native clients must never be overwritten.
 - `codexclaude topup` and `codexclaude /topup` authenticate with the saved System Token, map the six fixed packages to the correct site-specific plan ids, and call only `/api/v1/wallet/stripe/checkout` and `/api/v1/wallet/stripe/confirm`.
@@ -48,7 +48,7 @@ The launcher writes a model provider named `codexapi`:
 ## Runtime Defaults
 
 - Default model: `gpt-5.6-sol` displayed as `GPT-5.6 SOL`
-- Supported launcher choices: `gpt-6-astra`, `gpt-daybreak-blue-latest`, `gpt-5.6`, `gpt-5.6-sol-max`, `gpt-5.6-sol-ultra`, `gpt-5.6-sol`, `gpt-5.5`, `claude-opus-5`, `claude-opus-4-8`, `claude-sonnet-5`, `claude-fable-5`, and `gpt-5.6-terra`
+- Picker order: `gpt-6-astra`, `claude-fable-5` (Fable 5.1), `claude-opus-5`, followed by current GPT-5.6, Daybreak and Sonnet variants. GPT-5.5 and Opus 4.8 are hidden compatibility entries, not deleted API identities. Numeric choices are derived from visible order, never stored as stale aliases.
 - Default reasoning effort displayed locally: `Extra High`, stored as `xhigh`; SOL Max and SOL Ultra retain their explicit premium labels.
 - Reasoning hint written to managed runtime config: model-specific
 - Approval policy: `never`
@@ -67,10 +67,12 @@ Before launching the runtime, the launcher calls `/api/v1/wallet/status`, then `
 Expected status line:
 
 ```text
-MagnetAPI.org Codex CLI v2.0.37 · GPT-5.6 SOL Extra High · ~/project · Wallet balance $20.00
-Fable 5 is now available in codexclaude, exclusively.
+MagnetAPI.org Codex CLI v2.0.39 · GPT-5.6 SOL Extra High · ~/project · Wallet balance $20.00
+Fable 5.1 is now available in codexclaude.
 ```
 
+`bin/splash.js` owns the terminal-only binary graphic and launch classification. Preserve `codexclaude, powered by https://magnetapi.org`, own app version, responsive widths, NO_COLOR, TERM=dumb and explicit opt-outs. No sleeps, clearing, network calls or decorations in headless/JSON/server output. `test/frontier.test.js` checks ordering, legacy visibility, numeric selection and splash behavior. `test/update.test.js` covers local verified fallback and Windows npm resolution.
+
 ## Upgrade Checklist
 
 When updating the bundled runtime:

package/README.md

@@ -1,8 +1,8 @@
 # codexclaude
 
-`codexclaude` installs the MagnetAPI.org Codex CLI for customers who want one coding CLI that can use ChatGPT-6 Astra, ChatGPT Daybreak Blue, GPT-5.6, GPT-5.6 Terra, GPT-5.6 SOL, GPT-5.6 SOL Max, GPT-5.6 SOL Ultra, ChatGPT-5.5, Opus 5, Opus 4.8, Sonnet 5, or Fable 5 against the same Token Wallet.
+`codexclaude` installs the MagnetAPI.org Codex CLI for customers who want one coding client for ChatGPT-6-Astra, Fable 5.1, Opus 5, Sonnet 5, Daybreak Blue and GPT-5.6 models, using the same Token Wallet.
 
-Version `2.0.37` bundles the exact Codex runtime dependency `@openai/codex@0.153.4` and adds ChatGPT-6 Astra with its supported reasoning levels and complete model metadata. GPT-5.6 SOL with visible Extra High reasoning remains the default for new or invalid configurations, and existing valid model selections remain unchanged. The release preserves the collision-safe updater, platform-native runtime launch, managed account and wallet integration, Full Access defaults, upstream update suppression, and every MagnetAPI customization.
+Version `2.0.39` bundles the exact Codex runtime dependency `@openai/codex@0.154.0`. The model picker starts with ChatGPT-6-Astra, Fable 5.1 and Opus 5. GPT-5.6 SOL with Extra High reasoning remains the default; existing valid selections are preserved. The release retains four-site authentication, wallet integration, Full Access defaults, local tools, safe configuration merging and managed updates.
 
 ## Install Or Update
 
@@ -16,7 +16,7 @@ This does not delete local session history. The update replaces the `codexclaude
 
 The launcher checks CodexAPI.pro's managed version endpoint and the `@codexapi/codexclaude` npm package metadata only. It must never check `@openai/codex` npm metadata or OpenAI GitHub releases for customer update prompts.
 
-Version `2.0.37` is enforced as the minimum supported version. A compatible older launcher presents `✨ Update now available`; pressing Enter installs `@codexapi/codexclaude@latest` and relaunches the requested action automatically. If the npm registry install fails, the updater tries the hosted release before asking the user to intervene. Non-interactive terminals print the same npm command instead of hanging for input.
+The service's release metadata determines the minimum supported version. When an update is required, pressing Enter at `Upgrade Now` installs the exact managed release and restarts the requested action. If npm is unavailable or stale, this release downloads and verifies the hosted package before installing it as a local file. Native `codex` and `claude` commands are never overwritten. Non-interactive commands fail clearly rather than waiting for input.
 
 ## First Login
 
@@ -44,7 +44,7 @@ Switch model:
 codexclaude model
 ```
 
-Available model labels are `ChatGPT-6 Astra`, `ChatGPT Daybreak Blue`, `GPT-5.6`, `GPT-5.6 SOL Max`, `GPT-5.6 SOL Ultra`, `GPT-5.6 SOL`, `ChatGPT-5.5`, `Opus 5`, `Opus 4.8`, `Sonnet 5`, `Fable 5`, and `GPT-5.6 Terra`. All models use a Responses-compatible endpoint and the same customer Token Wallet. Selecting ChatGPT-6 Astra displays its billing notice before the choice is saved; native signed-in Astra usage is charged at 2x the normal Codex rate, while managed cross-model execution follows that route's normal billing.
+The first three choices are `ChatGPT-6-Astra`, `Fable 5.1` and `Opus 5`, followed by GPT-5.6, Daybreak Blue, SOL Max, SOL Ultra, SOL, Sonnet 5 and Terra. `codexclaude model`, `models`, `/model` and `/models` open the same launcher selector; the native in-session command remains `/model`. Legacy GPT-5.5 and Opus 4.8 metadata is hidden from new selection but retained for existing configurations. Fable 5.1 uses the compatible API id `claude-fable-5`; billing remains server-managed.
 
 ## Launch Commands
 
@@ -80,14 +80,17 @@ Card numbers, CVCs, and bank authentication challenges are entered only on Strip
 Before launching the coding runtime, the app prints a compact status line like:
 
 ```text
-MagnetAPI.org Codex CLI v2.0.37 · GPT-5.6 SOL Extra High · ~/project · Wallet balance $20.00
-Fable 5 is now available in codexclaude, exclusively.
+codexclaude, powered by https://magnetapi.org
+MagnetAPI.org Codex CLI v2.0.39 · GPT-5.6 SOL Extra High · ~/project · Wallet balance $20.00
+Fable 5.1 is now available in codexclaude.
 ```
 
+Interactive startup includes a gold-and-cyan binary graphic. Narrow terminals use a compact design. `NO_COLOR` and `TERM=dumb` disable color; `CODEXCLAUDE_NO_SPLASH=1` hides the graphic, and `CODEXCLAUDE_QUIET_STATUS=1` hides all launcher startup decoration. Exec/JSON, completion, server protocols, pipes and version/help output never receive splash or wallet text.
+
 ## Preserved Customizations
 
 - Dashboard Username or Email Address plus password login for CodexAPI.pro, ChatPlus.chat, MyAPI.world, and MagnetAPI.org.
-- ChatGPT-6 Astra, ChatGPT Daybreak Blue, Opus 5, GPT-5.6, GPT-5.6 Terra, GPT-5.6 SOL Max, GPT-5.6 SOL Ultra, GPT-5.6 SOL, ChatGPT-5.5, Opus 4.8, Sonnet 5, or Fable 5 model selection, with GPT-5.6 SOL/Extra High as the default.
+- Frontier-first model selection, with GPT-5.6 SOL/Extra High as the default and legacy configuration compatibility.
 - Service-specific Responses-compatible provider for the dashboard account that logged in.
 - Full Access defaults: approval policy `never` and sandbox mode `danger-full-access`.
 - Model-specific visible reasoning in the local UI while the API server keeps upstream runtime effort server-managed.

package/bin/codexclaude.js

@@ -2,18 +2,21 @@
 
 import { spawn, spawnSync } from "node:child_process";
 import { createRequire } from "node:module";
-import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, chmodSync, unlinkSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, chmodSync, unlinkSync, renameSync } from "node:fs";
+import TOML from "@iarna/toml";
 import { homedir } from "node:os";
 import path from "node:path";
 import readline from "node:readline/promises";
 import { stdin as input, stdout as output } from "node:process";
 import { fileURLToPath } from "node:url";
 import { installSafeCommandAliases } from "../scripts/install-safe-aliases.js";
+import { renderSplash, isInteractiveLaunch } from "./splash.js";
+import { installedPackage, npmInvocation, performUpdate, releaseTarget } from "./update.js";
 
 const require = createRequire(import.meta.url);
 
-const APP_VERSION = "2.0.37";
-const CODEX_VERSION = "0.153.4";
+const APP_VERSION = "2.0.39";
+const CODEX_VERSION = "0.154.0";
 const APP_DISPLAY_NAME = "MagnetAPI.org Codex CLI";
 const DEFAULT_MODEL_ID = "gpt-5.6-sol";
 const DEFAULT_DISPLAY_REASONING_EFFORT = "xhigh";
@@ -36,7 +39,7 @@ const CODEX_CONFIG_FILE = path.join(CODEX_DIR, "config.toml");
 const CODEX_UPDATE_CACHE_FILE = path.join(CODEX_DIR, "version.json");
 const PROVIDER_ID = "codexapi";
 const MODEL_CATALOG_CONTEXT_WINDOW = 272000;
-const FABLE_ANNOUNCEMENT = "Fable 5 is now available in codexclaude, exclusively.";
+const FABLE_ANNOUNCEMENT = "Fable 5.1 is now available in codexclaude.";
 const ANSI_GREEN = "\x1b[32m";
 const ANSI_RESET = "\x1b[0m";
 const SERVICE_CATALOG = [
@@ -91,80 +94,84 @@ const TOPUP_POLL_INTERVAL_MS = positiveInteger(process.env.CODEXCLAUDE_TOPUP_POL
 const TOPUP_TIMEOUT_MS = positiveInteger(process.env.CODEXCLAUDE_TOPUP_TIMEOUT_MS, 30 * 60 * 1000);
 
 const MODELS = {
+  "gpt-6-astra": {
+    id: "gpt-6-astra",
+    label: "ChatGPT-6-Astra",
+    aliases: ["astra", "gpt-6", "gpt-6-astra", "gpt6-astra", "chatgpt-6-astra"],
+    reasoningEffort: "xhigh",
+    contextWindow: 1050000,
+    maxOutputTokens: 128000,
+    premium: true,
+    supportedReasoningLevels: SUPPORTED_REASONING_LEVELS.filter(({ effort }) => effort !== "ultra"),
+  },
+  "claude-fable-5": {
+    id: "claude-fable-5",
+    label: "Fable 5.1",
+    aliases: ["fable", "fable-5.1", "claude-fable-5.1", "fable-5", "fabel", "fabel-5", "claude-fable-5", "claude-fabel-5"],
+    premium: true,
+  },
   "claude-opus-5": {
     id: "claude-opus-5",
     label: "Opus 5",
-    aliases: ["1", "opus", "opus-5", "claude", "claude-opus-5"],
+    aliases: ["opus", "opus-5", "claude", "claude-opus-5"],
   },
   "gpt-5.6": {
     id: "gpt-5.6",
     label: "GPT-5.6",
-    aliases: ["2", "gpt", "gpt-5.6", "chatgpt", "chatgpt-5.6", "gpt56"],
+    aliases: ["gpt", "gpt-5.6", "chatgpt", "chatgpt-5.6", "gpt56"],
     reasoningEffort: "xhigh",
   },
   "gpt-daybreak-blue-latest": {
     id: "gpt-daybreak-blue-latest",
     label: "ChatGPT Daybreak Blue",
-    aliases: ["3", "daybreak", "daybreak-blue", "chatgpt-daybreak-blue", "gpt-daybreak-blue-latest"],
+    aliases: ["daybreak", "daybreak-blue", "chatgpt-daybreak-blue", "gpt-daybreak-blue-latest"],
     reasoningEffort: "xhigh",
   },
   "gpt-5.6-sol-max": {
     id: "gpt-5.6-sol-max",
     label: "GPT-5.6 SOL Max",
-    aliases: ["4", "gpt-5.6-sol-max", "gpt-5.6-max", "gpt56-max", "sol-max", "max"],
+    aliases: ["gpt-5.6-sol-max", "gpt-5.6-max", "gpt56-max", "sol-max", "max"],
     reasoningEffort: "max",
   },
   "gpt-5.6-sol-ultra": {
     id: "gpt-5.6-sol-ultra",
     label: "GPT-5.6 SOL Ultra",
-    aliases: ["5", "gpt-5.6-sol-ultra", "gpt-5.6-ultra", "gpt56-ultra", "sol-ultra", "ultra"],
+    aliases: ["gpt-5.6-sol-ultra", "gpt-5.6-ultra", "gpt56-ultra", "sol-ultra", "ultra"],
     reasoningEffort: "ultra",
   },
   "gpt-5.6-sol": {
     id: "gpt-5.6-sol",
     label: "GPT-5.6 SOL",
-    aliases: ["6", "gpt-5.6-sol", "sol"],
+    aliases: ["gpt-5.6-sol", "sol"],
     reasoningEffort: "xhigh",
   },
   "gpt-5.5": {
     id: "gpt-5.5",
     label: "ChatGPT-5.5",
-    aliases: ["7", "gpt-5.5", "chatgpt-5.5"],
+    aliases: ["gpt-5.5", "chatgpt-5.5"],
+    legacy: true,
   },
   "claude-opus-4-8": {
     id: "claude-opus-4-8",
     label: "Opus 4.8",
-    aliases: ["8", "opus-4.8", "opus-4.7", "claude-opus-4-8", "claude-opus-4-7"],
+    aliases: ["opus-4.8", "opus-4.7", "claude-opus-4-8", "claude-opus-4-7"],
+    legacy: true,
   },
   "claude-sonnet-5": {
     id: "claude-sonnet-5",
     label: "Sonnet 5",
-    aliases: ["9", "sonnet", "sonnet-5", "sonnet-4.6", "sonnet-4-6", "claude-sonnet-5", "claude-sonnet-4-6", "claude-sonnet-4.6"],
-  },
-  "claude-fable-5": {
-    id: "claude-fable-5",
-    label: "Fable 5",
-    aliases: ["10", "fable", "fable-5", "fabel", "fabel-5", "claude-fable-5", "claude-fabel-5"],
-    premium: true,
+    aliases: ["sonnet", "sonnet-5", "sonnet-4.6", "sonnet-4-6", "claude-sonnet-5", "claude-sonnet-4-6", "claude-sonnet-4.6"],
   },
   "gpt-5.6-terra": {
     id: "gpt-5.6-terra",
     label: "GPT-5.6 Terra",
-    aliases: ["11", "terra", "gpt-5.6-terra", "gpt56-terra"],
+    aliases: ["terra", "gpt-5.6-terra", "gpt56-terra"],
     reasoningEffort: "xhigh",
   },
-  "gpt-6-astra": {
-    id: "gpt-6-astra",
-    label: "ChatGPT-6 Astra",
-    aliases: ["12", "astra", "gpt-6", "gpt-6-astra", "gpt6-astra", "chatgpt-6-astra"],
-    reasoningEffort: "xhigh",
-    contextWindow: 1050000,
-    maxOutputTokens: 128000,
-    premium: true,
-    supportedReasoningLevels: SUPPORTED_REASONING_LEVELS.filter(({ effort }) => effort !== "ultra"),
-  },
 };
 
+const PICKER_MODELS = Object.values(MODELS).filter((model) => !model.legacy);
+
 async function main() {
   ensureExecutable();
   ensureSafeCommandAliases();
@@ -192,7 +199,7 @@ async function main() {
     logout();
     return;
   }
-  if (command === "model") {
+  if (["model", "models", "/model", "/models"].includes(command)) {
     await modelFlow();
     return;
   }
@@ -226,7 +233,7 @@ ${APP_DISPLAY_NAME} v${APP_VERSION}
 
 Commands:
   codexclaude login       Login with dashboard username/email and password
-  codexclaude model       Select GPT-6 Astra, Daybreak Blue, GPT-5.6, Opus 5, Terra, SOL modes, Opus 4.8, Sonnet 5, or Fable 5
+  codexclaude models      Select ChatGPT-6-Astra, Fable 5.1, Opus 5, or another current model
   codexclaude changelog   Show the latest CodexAPI.pro launcher changes
   codexclaude setup       Rewrite ~/.codex/config.toml with Full Access defaults
   codexclaude topup       Select an API Coding Credit package and securely complete payment
@@ -564,7 +571,7 @@ async function ensureReady() {
 async function askModel(rl, current) {
   const currentLabel = MODELS[current]?.label || MODELS[DEFAULT_MODEL_ID].label;
   console.log("\nChoose your coding model:");
-  Object.values(MODELS).forEach((model, index) => {
+  PICKER_MODELS.forEach((model, index) => {
     console.log(`  ${index + 1}. ${model.label}`);
   });
   const answer = (await rl.question(`Model [${currentLabel}]: `)).trim().toLowerCase();
@@ -573,7 +580,7 @@ async function askModel(rl, current) {
     printModelSelectionWarning(selected);
     return selected;
   }
-  const match = Object.values(MODELS).find((model) => model.aliases.includes(answer));
+  const match = PICKER_MODELS.find((model, index) => String(index + 1) === answer || model.aliases.includes(answer));
   if (!match) {
     throw new Error("Unknown model choice. Run codexclaude model and choose one of the numbered options.");
   }
@@ -641,7 +648,6 @@ async function enforceLauncherVersion() {
 async function runMandatoryUpgrade(metadata) {
   const latest = metadata?.latestVersion || "latest";
   const minimum = metadata?.minimumVersion || latest;
-  const hostedTarballUrl = metadata?.hostedTarballUrl || HOSTED_TARBALL_URL;
   const changes = Array.isArray(metadata?.changes) ? metadata.changes.slice(0, 4) : [];
   console.error(`\n✨ Update now available · ${APP_DISPLAY_NAME} v${latest}`);
   console.error(`${APP_DISPLAY_NAME} v${latest} is required before your next coding session.`);
@@ -671,28 +677,21 @@ async function runMandatoryUpgrade(metadata) {
   }
 
   console.log(`\nDownloading and installing ${NPM_PACKAGE_NAME}@latest...`);
-  const npmCommand = process.platform === "win32" ? "npm.cmd" : "npm";
-  let exitCode = await spawnAndWait(npmCommand, ["install", "-g", `${NPM_PACKAGE_NAME}@latest`]);
-  const installedAfterRegistry = exitCode === 0 ? installedLauncherVersion() : null;
-  if (exitCode !== 0 || isOlderVersion(installedAfterRegistry, minimum)) {
-    if (exitCode === 0) {
-      console.log(`\nThe npm registry returned v${installedAfterRegistry || "unknown"}, below required v${minimum}.`);
-    }
-    console.log("\nThe npm registry install did not complete. Trying the hosted release automatically...");
-    exitCode = await spawnAndWait(npmCommand, ["install", "-g", hostedTarballUrl]);
-  }
-  const installedVersion = exitCode === 0 ? installedLauncherVersion() : null;
-  if (exitCode !== 0 || isOlderVersion(installedVersion, minimum)) {
-    throw new Error(
-      `Automatic upgrade failed with exit code ${exitCode} and installed version ${installedVersion || "unknown"}. Run ${UPDATE_COMMAND}. ` +
-        `If npm is unavailable, use: npm install -g ${hostedTarballUrl}`,
-    );
-  }
+  const npm = npmInvocation();
+  const installed = await performUpdate({
+    release: releaseTarget(metadata, null),
+    runNpm: args => spawnAndWait(npm.command, [...npm.args, ...args]),
+    readInstalled: () => {
+      const result = spawnSync(npm.command, [...npm.args, "root", "-g"], {
+        encoding: "utf8", timeout: 30000, shell: false,
+      });
+      return result.status === 0 ? installedPackage(String(result.stdout || "")) : null;
+    },
+  });
   console.log(`\nUpgrade complete. Restarting ${APP_DISPLAY_NAME} now...`);
   const relaunchArgs = process.argv.slice(2);
-  const relaunchCommand = process.platform === "win32" ? "codexclaude.cmd" : "codexclaude";
   try {
-    const relaunchExitCode = await spawnAndWait(relaunchCommand, relaunchArgs);
+    const relaunchExitCode = await spawnAndWait(process.execPath, [installed.entrypoint, ...relaunchArgs]);
     if (relaunchExitCode !== 0) {
       throw new Error(`updated client exited with code ${relaunchExitCode}`);
     }
@@ -704,24 +703,6 @@ async function runMandatoryUpgrade(metadata) {
   }
 }
 
-function installedLauncherVersion() {
-  const command = process.platform === "win32" ? "codexclaude.cmd" : "codexclaude";
-  const result = spawnSync(command, ["--version"], {
-    encoding: "utf8",
-    env: {
-      ...process.env,
-      CODEXCLAUDE_DISABLE_UPDATE_CHECK: "1",
-      CODEXCLAUDE_SKIP_COMMAND_ALIASES: "1",
-    },
-    shell: false,
-  });
-  if (result.error || result.status !== 0) {
-    return null;
-  }
-  const match = String(result.stdout || "").match(/\bv(\d+(?:\.\d+){2})\b/i);
-  return match?.[1] || null;
-}
-
 async function spawnAndWait(command, args) {
   return await new Promise((resolve, reject) => {
     const child = spawn(command, args, { stdio: "inherit", env: process.env, shell: false });
@@ -945,6 +926,8 @@ function isTruthy(value) {
 
 function writeCodexConfig(config) {
   mkdirSync(CODEX_DIR, { recursive: true });
+  const existing = existsSync(CODEX_CONFIG_FILE)
+    ? TOML.parse(readFileSync(CODEX_CONFIG_FILE, "utf8").replace(/^\uFEFF/, "")) : {};
   if (existsSync(CODEX_CONFIG_FILE)) {
     const backup = `${CODEX_CONFIG_FILE}.backup.${timestamp()}`;
     copyFileSync(CODEX_CONFIG_FILE, backup);
@@ -981,7 +964,16 @@ function writeCodexConfig(config) {
     'terminal_title = ["project-name", "model-with-reasoning", "run-state"]',
     "",
   ].join("\n");
-  writeFileSync(CODEX_CONFIG_FILE, toml, { encoding: "utf8", mode: 0o600 });
+  const managed = TOML.parse(toml);
+  const merged = {
+    ...existing,
+    ...managed,
+    model_providers: { ...existing.model_providers, ...managed.model_providers },
+    tui: { ...existing.tui, ...managed.tui },
+  };
+  const temporary = `${CODEX_CONFIG_FILE}.tmp.${process.pid}`;
+  writeFileSync(temporary, TOML.stringify(merged), { encoding: "utf8", mode: 0o600 });
+  renameSync(temporary, CODEX_CONFIG_FILE);
 }
 
 function clearUpstreamUpdateCache() {
@@ -997,7 +989,8 @@ function clearUpstreamUpdateCache() {
 function writeModelCatalog() {
   mkdirSync(CONFIG_DIR, { recursive: true });
   const catalog = {
-    models: Object.values(MODELS).map((model, index) => modelCatalogEntry(model, index)),
+    models: [...PICKER_MODELS, ...Object.values(MODELS).filter((model) => model.legacy)]
+      .map((model, index) => modelCatalogEntry(model, index)),
   };
   writeFileSync(MODEL_CATALOG_FILE, `${JSON.stringify(catalog, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
   return MODEL_CATALOG_FILE;
@@ -1026,7 +1019,7 @@ function modelCatalogEntry(model, index) {
     default_reasoning_level: reasoningEffortForModel(model.id),
     supported_reasoning_levels: model.supportedReasoningLevels || SUPPORTED_REASONING_LEVELS,
     shell_type: "shell_command",
-    visibility: "list",
+    visibility: model.legacy ? "hide" : "list",
     minimal_client_version: "0.124.0",
     supported_in_api: true,
     availability_nux: null,
@@ -1044,7 +1037,7 @@ function modelCatalogEntry(model, index) {
 
 function modelCatalogDescription(modelId) {
   if (modelId === "gpt-6-astra") {
-    return "ChatGPT-6 Astra coding route with local coding tools, configurable reasoning, and wallet billing.";
+    return "ChatGPT-6-Astra: coding tools, configurable reasoning, and image input.";
   }
   if (modelId === "gpt-5.6") {
     return "GPT-5.6 coding route with local coding tools and wallet billing.";
@@ -1074,7 +1067,7 @@ function modelCatalogDescription(modelId) {
     return "Sonnet 5 coding route with local coding tools and wallet billing.";
   }
   if (modelId === "claude-fable-5") {
-    return "Fable 5 premium coding route with local coding tools and wallet billing.";
+    return "Fable 5.1: coding tools and image input, using the compatible Fable 5 API id.";
   }
   return "ChatGPT-5.5 coding route with local coding tools and wallet billing.";
 }
@@ -1107,17 +1100,28 @@ function logout() {
 
 async function runCodex(args) {
   const config = requireConfig();
+  const interactive = isInteractiveLaunch(args, {
+    stdinTTY: input.isTTY, stdoutTTY: output.isTTY,
+    quiet: isTruthy(process.env.CODEXCLAUDE_QUIET_STATUS),
+  });
+  if (interactive && !isTruthy(process.env.CODEXCLAUDE_NO_SPLASH)) {
+    process.stderr.write(renderSplash({
+      version: APP_VERSION, columns: output.columns,
+      color: process.env.NO_COLOR === undefined && process.env.TERM !== "dumb",
+    }));
+  }
   let wallet = null;
   try {
     wallet = await walletSnapshot(config);
   } catch {
     // Wallet lookup should never block the user from starting a local coding session.
   }
-  if (!isTruthy(process.env.CODEXCLAUDE_QUIET_STATUS)) {
+  if (interactive) {
     console.log(formatStatusLine(config, wallet, process.cwd()));
-    console.log(`${ANSI_GREEN}${FABLE_ANNOUNCEMENT}${ANSI_RESET}`);
+    const color = process.env.NO_COLOR === undefined && process.env.TERM !== "dumb";
+    console.log(color ? `${ANSI_GREEN}${FABLE_ANNOUNCEMENT}${ANSI_RESET}` : FABLE_ANNOUNCEMENT);
+    if (color) process.stdout.write(`\x1b]0;${APP_DISPLAY_NAME} v${APP_VERSION}\x07`);
   }
-  process.stdout.write(`\x1b]0;${APP_DISPLAY_NAME} v${APP_VERSION}\x07`);
   const launch = resolveCodexLaunch();
   const env = {
     ...process.env,
@@ -1350,7 +1354,7 @@ function normalizeConfig(config) {
   if (["claude-sonnet-4.6", "claude-sonnet-4-6", "sonnet-4.6", "sonnet-4-6", "sonnet-5"].includes(normalized.model)) {
     normalized.model = "claude-sonnet-5";
   }
-  if (["claude-fabel-5", "fable-5", "fabel-5"].includes(normalized.model)) {
+  if (["claude-fabel-5", "fable-5", "fabel-5", "fable-5.1", "claude-fable-5.1"].includes(normalized.model)) {
     normalized.model = "claude-fable-5";
   }
   if (["gpt-5.6-sol-max", "gpt-5.6-max", "gpt56-max", "sol-max", "max"].includes(normalized.model)) {

package/bin/splash.js

@@ -0,0 +1,36 @@
+// Terminal-only artwork. Never delay startup or mix it into machine-readable output.
+export function isInteractiveLaunch(args, { stdinTTY, stdoutTTY, quiet = false }) {
+  if (!stdinTTY || !stdoutTTY || quiet) return false;
+  if (args.some((arg) => /^(?:--json(?:=|$)|--help$|-h$|--version$|-V$)/.test(arg))) return false;
+  return !["exec", "e", "review", "app-server", "mcp-server", "completion", "mcp", "debug", "features"].includes(args[0]);
+}
+
+export function renderSplash({ version, columns = 80, color = true }) {
+  const width = Math.max(1, Math.min(Number(columns) || 80, 74));
+  const gold = color ? "\x1b[93m" : "";
+  const cyan = color ? "\x1b[36m" : "";
+  const bold = color ? "\x1b[1m" : "";
+  const reset = color ? "\x1b[0m" : "";
+  const lines = [];
+  const add = (value, style = "") => {
+    for (let offset = 0; offset < value.length; offset += width) {
+      lines.push(style + value.slice(offset, offset + width) + reset);
+    }
+  };
+  add("-".repeat(width), cyan);
+  if (width >= 40) {
+    [
+      "   011110   011110     010   101   001",
+      "  01       01         101   010   110",
+      "  10       10         010   101   001",
+      "  01       01         101   010   110",
+      "   100111   100111     010   101   001",
+    ].forEach((line) => add(line, gold));
+  } else {
+    add("0101  CODE + CREATE  1010", gold);
+  }
+  add(`codexclaude v${version}`, bold + gold);
+  add("codexclaude, powered by https://magnetapi.org", cyan);
+  add("-".repeat(width), cyan);
+  return "\n" + lines.join("\n") + "\n\n";
+}

package/bin/update.js

@@ -0,0 +1,94 @@
+import { createHash } from "node:crypto";
+import { mkdtemp, writeFile, rm } from "node:fs/promises";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+
+export const PACKAGE = "@codexapi/codexclaude";
+const VERSION = /^\d+\.\d+\.\d+$/;
+
+export function atLeast(actual, required) {
+  if (!VERSION.test(actual || "") || !VERSION.test(required || "")) return false;
+  const a = actual.split(".").map(Number), b = required.split(".").map(Number);
+  for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] > b[i];
+  return true;
+}
+
+export function releaseTarget(service, registry) {
+  const versions = [service?.latestVersion, service?.minimumVersion, registry?.version].filter(v => VERSION.test(v || ""));
+  const version = versions.reduce((a, b) => atLeast(a, b) ? a : b, null);
+  if (!version) throw new Error("No valid managed release version is available. Please retry shortly.");
+  const hostedTarballUrl = `https://codexapi.pro/downloads/codexapi-codexclaude-${version}.tgz`;
+  return { version, hostedTarballUrl, sha256: service?.latestVersion === version ? service.hostedTarballSha256 : null };
+}
+
+export async function downloadVerified(release, fetchImpl = fetch) {
+  const expectedUrl = `https://codexapi.pro/downloads/codexapi-codexclaude-${release.version}.tgz`;
+  if (!VERSION.test(release.version) || release.hostedTarballUrl !== expectedUrl) throw new Error("Untrusted managed update location.");
+  const request = async url => {
+    const response = await fetchImpl(url, { redirect: "error", signal: AbortSignal.timeout(60000) });
+    if (!response.ok) throw new Error(`Managed update download failed (HTTP ${response.status}).`);
+    return response;
+  };
+  const hash = release.sha256 || (await (await request(`${expectedUrl}.sha256`)).text()).trim().split(/\s+/)[0];
+  if (!/^[a-f0-9]{64}$/i.test(hash || "")) throw new Error("Managed update checksum is unavailable. No package was installed.");
+  const response = await request(expectedUrl);
+  const chunks = [];
+  let size = 0;
+  for await (const chunk of response.body) {
+    size += chunk.length;
+    if (size > 25 * 1024 * 1024) throw new Error("Managed update exceeds the download size limit.");
+    chunks.push(chunk);
+  }
+  const contents = Buffer.concat(chunks);
+  if (createHash("sha256").update(contents).digest("hex") !== hash.toLowerCase()) throw new Error("Managed update checksum mismatch. No package was installed.");
+  const directory = await mkdtemp(path.join(tmpdir(), "codexclaude-update-"));
+  const file = path.join(directory, `codexclaude-${release.version}.tgz`);
+  try { await writeFile(file, contents, { mode: 0o600, flag: "wx" }); }
+  catch (error) { await rm(directory, { recursive: true, force: true }); throw error; }
+  return { file, cleanup: () => rm(directory, { recursive: true, force: true }) };
+}
+
+export function npmInvocation(env = process.env, platform = process.platform, executable = process.execPath) {
+  const candidates = [env.npm_execpath, path.join(path.dirname(executable), "node_modules/npm/bin/npm-cli.js")].filter(Boolean);
+  if (platform === "win32" && env.APPDATA) candidates.push(path.join(env.APPDATA, "npm/node_modules/npm/bin/npm-cli.js"));
+  for (const directory of (env.PATH || env.Path || "").split(platform === "win32" ? ";" : ":")) {
+    if (!directory) continue;
+    candidates.push(path.join(directory, "node_modules/npm/bin/npm-cli.js"));
+    if (platform !== "win32") candidates.push(path.join(directory, "npm"));
+  }
+  for (const candidate of candidates) {
+    try {
+      const real = realpathSync(candidate);
+      if (path.basename(real) === "npm-cli.js") return { command: executable, args: [real] };
+    } catch {}
+  }
+  if (platform === "win32") throw new Error("npm could not be located. Repair your Node.js installation, then retry the update.");
+  return { command: "npm", args: [] };
+}
+
+export function installedPackage(globalRoot) {
+  try {
+    const root = path.join(globalRoot.trim(), "@codexapi", "codexclaude");
+    const pkg = JSON.parse(readFileSync(path.join(root, "package.json"), "utf8"));
+    const entrypoint = path.join(root, "bin/codexclaude.js");
+    if (pkg.name !== PACKAGE || !VERSION.test(pkg.version) || !existsSync(entrypoint)) return null;
+    return { version: pkg.version, entrypoint };
+  } catch { return null; }
+}
+
+export async function performUpdate({ release, runNpm, readInstalled, download = downloadVerified }) {
+  let code = await runNpm(["install", "-g", `${PACKAGE}@${release.version}`]);
+  let installed = code === 0 ? await readInstalled() : null;
+  if (!installed || !atLeast(installed.version, release.version)) {
+    const artifact = await download(release);
+    try {
+      code = await runNpm(["install", "-g", artifact.file]);
+      installed = code === 0 ? await readInstalled() : null;
+    } finally { await artifact.cleanup(); }
+  }
+  if (code !== 0 || !installed || !atLeast(installed.version, release.version)) {
+    throw new Error(`Automatic update did not install v${release.version}. Run: npm install -g ${PACKAGE}@${release.version}`);
+  }
+  return installed;
+}

package/codexclaude.md

@@ -4,6 +4,65 @@ This file is the durable handoff for the `@codexapi/codexclaude` package in `/ro
 
 ## Current Release
 
+### 2026-09-10 Frontier Picker And Binary Splash: 2.0.39
+
+This section supersedes older release snapshots below. Source/package version
+is `2.0.39`, with exact `@openai/codex@0.154.0`. Release deployment state and npm
+verification are recorded in `/root/codexapi/STATE.md`; never infer registry
+publication or minimum enforcement from the source version alone.
+
+The first three choices in the launcher selector and native catalog are
+`ChatGPT-6-Astra` (`gpt-6-astra`), `Fable 5.1` (`claude-fable-5`) and `Opus 5`
+(`claude-opus-5`). Remaining current choices retain their API ids. GPT-5.5 and
+Opus 4.8 are compatibility-only: hidden from new selection, with full metadata
+retained so upgrades do not change existing customer configurations or history.
+Do not invent `claude-fable-5.1` upstream. A display alias normalizes to the stable
+Fable id. Numeric choices are calculated from visible order to avoid selecting
+the wrong model after reordering. `model`, `models`, `/model` and `/models` are
+launcher aliases; the native interactive command remains `/model`.
+
+Default model remains `gpt-5.6-sol`, Extra High. Full Access, four-site login,
+customer wallet display, top-up, reasoning metadata, tool/image transport,
+client headers and native-safe command aliases are preserved. Setup parses TOML,
+backs up and atomically merges only owned fields. No runtime routing, billing,
+provider credentials or regional native Codex installation is changed by this
+launcher release.
+
+`bin/splash.js` renders gold/cyan binary artwork and the exact line
+`codexclaude, powered by https://magnetapi.org`, with app version 2.0.39.
+It adapts to narrow terminals, has no animation delay and honors NO_COLOR,
+TERM=dumb, CODEXCLAUDE_NO_SPLASH and CODEXCLAUDE_QUIET_STATUS. Launcher notices,
+wallet text and terminal-title escapes are now excluded from exec/JSON, server
+protocols, completions and pipes. Never pollute machine-readable stdout.
+
+`bin/update.js` ports the tested claudecodex updater: exact registry target,
+checksum-verified temporary local archive on fallback, bounded HTTPS downloads,
+Windows npm-cli.js through Node, actual global package verification and direct
+relaunch of that installed entrypoint. No npm --force/remote-policy override.
+Only CodexAPI and our npm package may provide update metadata. Publish and verify
+archives, SHA-256 sidecars, registry and dashboard scripts before raising the
+minimum version. Preserve native binaries, local tools, providers and projects.
+
+Run `npm test` for config preservation, frontier metadata, aliases, splash,
+wallet/top-up and updater behavior. Then test the packed installation with actual
+0.154.0 exec JSON, native model picker and bounded live test-account calls.
+All four websites, VIP setup and generated wizard checksums must match the final
+archive; do not repack changed files after publishing its hash.
+
+### 2026-09-09 Configuration Safety Build
+
+`2.0.38` is a hosted safety build for the MagnetAPI v2 Setup Wizard. npm `latest`
+and the global mandatory minimum remain `2.0.37`; npm authentication must be
+renewed before publishing `2.0.38` to the registry. Do not force a registry update
+until that publication is verified. The wizard downloads the exact hosted archive,
+verifies SHA-256, and installs the local file, avoiding npm remote-fetch restrictions.
+The runtime remains Codex `0.153.4`; model, routing, authentication and billing
+behavior are unchanged. `writeCodexConfig` now parses TOML with pinned
+`@iarna/toml@2.2.5`, merges only managed root fields, the owned provider and owned
+TUI fields, preserves other providers/MCP/projects, backs up the original, and
+replaces the file atomically. Invalid existing TOML stops setup without changing it.
+Run `npm test`, including the real-launcher configuration-preservation tests.
+
 - Package name: `@codexapi/codexclaude`
 - Launcher version: `2.0.37`
 - Customer-facing app name: `MagnetAPI.org Codex CLI`

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@codexapi/codexclaude",
-  "version": "2.0.37",
-  "description": "MagnetAPI.org Codex CLI for ChatGPT-6 Astra, ChatGPT Daybreak Blue, GPT-5.6, Opus 5, Sonnet 5, and Fable 5.",
+  "version": "2.0.39",
+  "description": "MagnetAPI.org Codex CLI for ChatGPT-6-Astra, Fable 5.1, Opus 5, Sonnet 5, Daybreak Blue, and GPT-5.6.",
   "license": "Apache-2.0",
   "type": "module",
   "bin": {
@@ -22,7 +22,8 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@openai/codex": "0.153.4"
+    "@iarna/toml": "2.2.5",
+    "@openai/codex": "0.154.0"
   },
   "publishConfig": {
     "access": "public"