@iislee/opencodex 2.11.0 → 2.35.0

package/src/cli/init.ts

@@ -1,7 +1,7 @@
 import * as readline from "node:readline";
-import { constants as fsConstants, copyFileSync, existsSync, readFileSync, unlinkSync } from "node:fs";
+import { existsSync, readFileSync, unlinkSync } from "node:fs";
 import { injectCodexConfig } from "../codex/inject";
-import { classifyOpenAiTierBackup, getConfigPath, getDefaultConfig, isValidProviderName, saveConfig } from "../config";
+import { classifyOpenAiTierBackup, getConfigPath, getDefaultConfig, isValidProviderName, preserveOpenAiTierRollbackSnapshot, saveConfig } from "../config";
 import { enrichProviderFromCatalog } from "../oauth/key-providers";
 import { deriveInitProviders } from "../providers/derive";
 import type { OcxConfig, OcxProviderConfig } from "../types";
@@ -80,21 +80,8 @@ export function cleanupOpenAiTierBackupAfterInit(configPath = getConfigPath()):
       unlinkSync(backup);
       return;
     }
-    // Publish the preserved snapshot with a no-replace copy (COPYFILE_EXCL) so a
-    // destination collision (frozen/rolled-back clock, pre-created file) can never
-    // silently overwrite another rollback snapshot; retry with a sequence suffix.
-    for (let attempt = 0; attempt < 16; attempt++) {
-      const preserved = `${configPath}.pre-openai-tiers-v1-rollback.${Date.now()}${attempt ? `-${attempt}` : ""}.bak`;
-      try {
-        copyFileSync(backup, preserved, fsConstants.COPYFILE_EXCL);
-      } catch (error) {
-        if ((error as NodeJS.ErrnoException).code === "EEXIST") continue;
-        throw error;
-      }
-      unlinkSync(backup);
-      console.warn(`⚠️  Kept your pre-migration config rollback snapshot at ${preserved}`);
-      return;
-    }
+    const preserved = preserveOpenAiTierRollbackSnapshot(configPath);
+    console.warn(`⚠️  Kept your pre-migration config rollback snapshot at ${preserved}`);
   } catch { /* cleanup is best-effort; never block init on backup housekeeping */ }
 }
 
@@ -178,6 +165,7 @@ export async function runInit(): Promise<void> {
       port,
       providers: { [providerName]: providerConfig },
       defaultProvider: providerName,
+      modelDiscovery: { newModelPolicy: "off" },
     };
 
     saveConfig(config);

package/src/cli/inspect.ts

@@ -0,0 +1,230 @@
+/**
+ * `ocx system-surface` — the remaining routes that had no CLI caller at all (wp7).
+ *
+ * These are grouped by what an operator is trying to do, not by which server module owns them:
+ * inspecting effective configuration, reading the generated client-config snippet, toggling the
+ * native client integrations, checking request pacing and routing analytics, and reading the
+ * Codex system prompt.
+ *
+ * One route here is deliberately READ-ONLY forever. `POST /api/github/star` spends the operator's
+ * GitHub identity, and no CLI flag can carry that consent — the server requires a real dashboard
+ * session for it. So `star` reads status and says what it cannot do, rather than offering a
+ * `--yes` that would be a lie.
+ */
+import {
+  CliUsageError,
+  printData,
+  rejectArgs,
+  runCliAction,
+  runtimeRequest,
+  summaryLines,
+  takeFlag,
+  takeOption,
+  type RuntimeApiDeps,
+} from "./runtime-api";
+
+const USAGE = `Usage:
+  ocx inspect config [--json]
+  ocx inspect catalog [--json]
+  ocx inspect routing-analytics [--json]
+  ocx inspect pacing [--name <provider>] [--json]
+  ocx inspect key-providers [--json]
+  ocx inspect codex-prompt [--text] [--json]
+  ocx inspect client-config --client <id> [--json]
+  ocx inspect star [--json]
+  ocx inspect windows-tray [--json]
+  ocx integration native [list] [--json]
+  ocx integration native <claude|claude-desktop|codex|grok> <on|off> [--json]
+  ocx agent request-user-input [on|off] [--json]`;
+
+/** A read that takes no arguments beyond `--json`. */
+async function read(path: string, argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  rejectArgs(args, USAGE);
+  const result = await runtimeRequest(path, {}, deps);
+  printData(result, wantsJson, summaryLines(result));
+}
+
+const NATIVE_CLIENTS = ["claude", "claude-desktop", "codex", "grok"] as const;
+
+interface NativeClientRow {
+  clientId?: string;
+  state?: string;
+  installed?: boolean;
+  desiredEnabled?: boolean;
+  configPath?: string;
+  disableBlocked?: unknown;
+}
+
+/**
+ * The shared depth-1 flattener renders an array as "N item(s)", so a bare
+ * `integration native list` printed `clients: 4 item(s)` -- the per-client state the operator
+ * asked for was in the payload and discarded before the terminal. Same defect class wp4 fixed
+ * for the account and key tables.
+ */
+function nativeLines(payload: unknown): string[] {
+  const clients = (payload as { clients?: NativeClientRow[] } | null)?.clients;
+  if (!Array.isArray(clients) || clients.length === 0) return ["No native client integrations reported."];
+  const lines = ["CLIENT           STATE      INSTALLED  DESIRED  CONFIG"];
+  for (const row of clients) {
+    lines.push([
+      (row.clientId ?? "?").padEnd(16),
+      (row.state ?? "?").padEnd(10),
+      (row.installed === true ? "yes" : row.installed === false ? "no" : "?").padEnd(10),
+      (row.desiredEnabled === true ? "on" : row.desiredEnabled === false ? "off" : "?").padEnd(8),
+      row.configPath ?? "",
+    ].join(" ").trimEnd());
+    // A blocked disable is the reason a toggle did not take effect, so it is never silent.
+    if (row.disableBlocked !== null && row.disableBlocked !== undefined) {
+      lines.push(`  disable blocked: ${typeof row.disableBlocked === "string" ? row.disableBlocked : JSON.stringify(row.disableBlocked)}`);
+    }
+  }
+  return lines;
+}
+
+async function nativeIntegration(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const action = argv[0] && !argv[0].startsWith("-") ? argv[0] : "list";
+  const rest = argv[0] && !argv[0].startsWith("-") ? argv.slice(1) : argv;
+
+  if (action === "list") {
+    const args = [...rest];
+    const wantsJson = takeFlag(args, "--json");
+    rejectArgs(args, USAGE);
+    const result = await runtimeRequest("/api/native-integrations", {}, deps);
+    printData(result, wantsJson, nativeLines(result));
+    return;
+  }
+
+  if (!(NATIVE_CLIENTS as readonly string[]).includes(action)) {
+    throw new CliUsageError(`unknown native client ${action}; expected one of ${NATIVE_CLIENTS.join(", ")}`, USAGE);
+  }
+
+  const args = [...rest];
+  const wantsJson = takeFlag(args, "--json");
+  const state = args.shift();
+  rejectArgs(args, USAGE);
+  if (state !== "on" && state !== "off") {
+    throw new CliUsageError(`expected on or off after ${action}`, USAGE);
+  }
+
+  // Toggling rewrites the client's own config file, which is why each client has its own route
+  // rather than one route with a client parameter.
+  const result = await runtimeRequest(`/api/native-integrations/${action}`, {
+    method: "PUT",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ enabled: state === "on" }),
+  }, deps);
+  printData(result, wantsJson, summaryLines(result));
+}
+
+/**
+ * Exported unwrapped so `ocx agent request-user-input` can call it INSIDE its own
+ * `runCliAction`. Wrapping an already-wrapped handler reports one failure twice: the inner
+ * wrapper prints the error and returns a code, and the outer one prints again on the rethrow.
+ */
+export async function requestUserInputAction(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  const state = args.shift();
+  rejectArgs(args, USAGE);
+
+  const path = "/api/codex-auth/features/default-mode-request-user-input";
+  // No argument means show. A read must not write the value it is reporting.
+  if (state === undefined) {
+    const result = await runtimeRequest(path, {}, deps);
+    printData(result, wantsJson, summaryLines(result));
+    return;
+  }
+  if (state !== "on" && state !== "off") throw new CliUsageError("expected on or off", USAGE);
+
+  const result = await runtimeRequest(path, {
+    method: "PUT",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ enabled: state === "on" }),
+  }, deps);
+  printData(result, wantsJson, summaryLines(result));
+}
+
+async function clientConfig(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  const client = takeOption(args, "--client");
+  rejectArgs(args, USAGE);
+  if (!client) throw new CliUsageError("--client is required", USAGE);
+  // The valid client list is not duplicated here: the route answers 400 naming every accepted id,
+  // which is more useful than a local list that can drift out of date.
+  const result = await runtimeRequest(`/api/client-config?client=${encodeURIComponent(client)}`, {}, deps);
+  printData(result, wantsJson, summaryLines(result));
+}
+
+async function pacing(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  const name = takeOption(args, "--name");
+  rejectArgs(args, USAGE);
+  const suffix = name ? `?name=${encodeURIComponent(name)}` : "";
+  const result = await runtimeRequest(`/api/provider-request-pacing${suffix}`, {}, deps);
+  printData(result, wantsJson, summaryLines(result));
+}
+
+async function codexPrompt(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  const asText = takeFlag(args, "--text");
+  rejectArgs(args, USAGE);
+  if (asText && wantsJson) throw new CliUsageError("--text and --json cannot be combined", USAGE);
+  if (asText) {
+    // The /text variant answers the prompt body itself, so it is printed verbatim rather than
+    // flattened through the summary renderer.
+    const result = await runtimeRequest<unknown>("/api/codex-prompt/text", {}, deps);
+    console.log(typeof result === "string" ? result : JSON.stringify(result, null, 2));
+    return;
+  }
+  const result = await runtimeRequest("/api/codex-prompt", {}, deps);
+  printData(result, wantsJson, summaryLines(result));
+}
+
+async function star(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  rejectArgs(args, USAGE);
+  const result = await runtimeRequest<Record<string, unknown>>("/api/github/star", {}, deps);
+  if (wantsJson) {
+    printData(result, true);
+    return;
+  }
+  printData(result, false, summaryLines(result));
+  // Said plainly, because the natural next question is "then star it", and the answer is that no
+  // CLI invocation can: the POST requires a dashboard session precisely so an agent cannot spend
+  // the operator's identity on their behalf.
+  console.log("Starring is not available from the CLI: it uses your GitHub identity, so only you can do it from the dashboard.");
+}
+
+export async function handleInspectCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
+  return runCliAction(async () => {
+    const hasSub = argv[0] !== undefined && !argv[0].startsWith("-");
+    const sub = hasSub ? argv[0]! : "config";
+    const rest = hasSub ? argv.slice(1) : argv;
+    if (sub === "config") await read("/api/config", rest, deps);
+    else if (sub === "catalog") await read("/api/catalog", rest, deps);
+    else if (sub === "routing-analytics") await read("/api/routing-analytics", rest, deps);
+    else if (sub === "key-providers") await read("/api/key-providers", rest, deps);
+    else if (sub === "windows-tray") await read("/api/windows-tray", rest, deps);
+    else if (sub === "pacing") await pacing(rest, deps);
+    else if (sub === "client-config") await clientConfig(rest, deps);
+    else if (sub === "codex-prompt") await codexPrompt(rest, deps);
+    else if (sub === "star") await star(rest, deps);
+    else throw new CliUsageError(`unknown inspect command ${sub}`, USAGE);
+  });
+}
+
+export async function handleIntegrationCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
+  return runCliAction(async () => {
+    const [sub, ...rest] = argv;
+    if (sub === "native" || sub === undefined) await nativeIntegration(sub === undefined ? [] : rest, deps);
+    else throw new CliUsageError(`unknown integration command ${sub}`, USAGE);
+  });
+}
+
+export const INSPECT_USAGE = USAGE;

package/src/cli/integrations.ts

@@ -18,7 +18,7 @@ const CLAUDE_USAGE = `Usage:
       [--system-env <on|off>] [--fast-mode <on|off>] [--auto-context <on|off>]
       [--compact-window <tokens|default>] [--inject-agents <on|off>]
       [--small-fast-model <id|->] [--model-map <from=to,from=to|->]
-      [--blocked-skills <name,name|->] [--web-model <id|->] [--web-backend <openai|anthropic|->]
+      [--blocked-skills <name,name|->] [--web-model <id|->] [--web-backend <openai|anthropic|xai|gemini|exa|->]
       [--vision-model <id|->] [--vision-backend <openai|anthropic|->] [--json]`;
 
 const GROK_USAGE = `Usage:
@@ -27,6 +27,12 @@ const GROK_USAGE = `Usage:
   ocx grok clear [--json]
   ocx grok apply [--json]`;
 
+const CLIENT_USAGE = `Usage:
+  ocx integration client [status] [--client <id>] [--json]
+  ocx integration client <enable|disable> --client <id> [--json]
+  ocx integration client history [--client <id>] [--json]
+  ocx integration client restore --op <opId> [--confirm-drift] [--json]`;
+
 function parseMap(raw: string): Record<string, string> {
   if (raw === "-") return {};
   const map: Record<string, string> = {};
@@ -139,4 +145,116 @@ export async function handleGrokCommand(argv: string[], deps: RuntimeApiDeps = {
   });
 }
 
-export const INTEGRATION_USAGE = { claude: CLAUDE_USAGE, grok: GROK_USAGE };
+/**
+ * The headless half of the client-integration toggle.
+ *
+ * Every safety property lives behind the management API — ownership, the
+ * pre-write snapshot, the journal, the drift refusal — so this command is a
+ * thin caller and deliberately re-implements none of it. That is also why
+ * `restore` surfaces the drift refusal as an error telling the user to pass
+ * `--confirm-drift` rather than retrying on their behalf: replacing edits a
+ * user made after the snapshot is exactly the decision they have to make.
+ */
+export async function handleClientIntegrationCommand(
+  argv: string[],
+  deps: RuntimeApiDeps = {},
+): Promise<number> {
+  return runCliAction(async () => {
+    const args = [...argv];
+    const action = (args.shift() ?? "status").toLowerCase();
+    const wantsJson = takeFlag(args, "--json");
+
+    if (action === "status" || action === "show" || action === "list") {
+      const client = takeOption(args, "--client");
+      rejectArgs(args, CLIENT_USAGE);
+      const path = client
+        ? `/api/client-integrations/${encodeURIComponent(client)}`
+        : "/api/client-integrations";
+      const result = await runtimeRequest(path, {}, deps);
+      const rows = (result as { clients?: Array<Record<string, unknown>> }).clients;
+      printData(result, wantsJson, rows
+        ? rows.map(row => `${String(row.clientId)}: ${String(row.state)}${row.installed ? "" : " (not installed)"}`)
+        : summaryLines(result));
+      return;
+    }
+
+    if (action === "history" || action === "journal") {
+      const client = takeOption(args, "--client");
+      rejectArgs(args, CLIENT_USAGE);
+      const query = client ? `?client=${encodeURIComponent(client)}` : "";
+      const result = await runtimeRequest(`/api/client-integrations/journal${query}`, {}, deps);
+      const operations = (result as { operations?: Array<Record<string, unknown>> }).operations ?? [];
+      printData(result, wantsJson, operations.length === 0
+        ? ["No integration operations recorded yet."]
+        : operations.map(row => {
+          // `snapshot` is resolved against the disk by the route, so "expired"
+          // here means the bytes are genuinely gone, not merely old.
+          const backup = row.snapshot === "expired" ? "backup expired" : `op ${String(row.opId)}`;
+          return `${String(row.at)}  ${String(row.clientId)}  ${String(row.kind)}  (${backup})`;
+        }));
+      return;
+    }
+
+    if (action === "restore") {
+      const opId = takeOption(args, "--op") ?? takeOption(args, "--op-id");
+      const confirmDrift = takeFlag(args, "--confirm-drift");
+      rejectArgs(args, CLIENT_USAGE);
+      if (!opId) throw new CliUsageError("--op <opId> is required", CLIENT_USAGE);
+      const result = await runtimeRequest("/api/client-integrations/restore", {
+        method: "POST",
+        body: JSON.stringify({ opId, confirmDrift }),
+      }, deps);
+      printData(result, wantsJson, [String((result as Record<string, unknown>).message ?? "Restored.")]);
+      return;
+    }
+
+    if (action !== "enable" && action !== "disable") {
+      throw new CliUsageError(`unknown client integration command ${action}`, CLIENT_USAGE);
+    }
+    const client = takeOption(args, "--client");
+    rejectArgs(args, CLIENT_USAGE);
+    if (!client) throw new CliUsageError("--client <id> is required", CLIENT_USAGE);
+    const result = await runtimeRequest(`/api/client-integrations/${encodeURIComponent(client)}`, {
+      method: "PUT",
+      body: JSON.stringify({ enabled: action === "enable" }),
+    }, deps);
+    printData(result, wantsJson, [String((result as Record<string, unknown>).message ?? `${client} ${action}d.`)]);
+  });
+}
+
+export const INTEGRATION_USAGE = { claude: CLAUDE_USAGE, grok: GROK_USAGE, client: CLIENT_USAGE };
+
+const ZCODE_USAGE = `Usage:
+  ocx zcode [status] [--json]
+  ocx zcode <enable|disable> [--json]
+  ocx zcode history [--json]
+  ocx zcode restore --op <opId> [--confirm-drift] [--json]`;
+
+/**
+ * Thin alias over the client-integration surface for ZCode (Z.ai's desktop
+ * client). ZCode is a GUI app with no launch surface to wrap, so unlike
+ * `ocx mcode` there is no exec step: connecting the managed provider block is
+ * the whole integration, and every safety property (ownership, snapshots,
+ * journal, drift refusal) stays behind the shared management API. ZCode reads
+ * its config at startup, so enable/disable print a restart reminder.
+ */
+export async function handleZcodeCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
+  const args = [...argv];
+  // Find the first non-flag token so `ocx zcode --json enable` still enables.
+  const verbIndex = args.findIndex(arg => !arg.startsWith("-"));
+  const action = (verbIndex === -1 ? "status" : args[verbIndex]).toLowerCase();
+  const known = ["status", "show", "list", "enable", "disable", "history", "journal", "restore"];
+  if (!known.includes(action)) {
+    console.error(`unknown zcode command ${action}`);
+    console.error(ZCODE_USAGE);
+    return 2;
+  }
+  const rest = verbIndex === -1 ? args : [...args.slice(0, verbIndex), ...args.slice(verbIndex + 1)];
+  // `restore` addresses an operation id, not a client, so nothing is injected.
+  const forwarded = action === "restore" ? [action, ...rest] : [action, ...rest, "--client", "zcode"];
+  const code = await handleClientIntegrationCommand(forwarded, deps);
+  if (code === 0 && (action === "enable" || action === "disable")) {
+    console.error("Restart ZCode to pick up the provider change.");
+  }
+  return code;
+}