@iislee/opencodex 2.11.0

package/src/codex/injected-marker.ts

@@ -0,0 +1,72 @@
+/**
+ * Ownership predicates for `~/.codex/config.toml`: does opencodex own the routing
+ * currently written there?
+ *
+ * These live in their own leaf module rather than in `inject.ts` because
+ * `journal.ts` needs them and `inject.ts` already imports `journal.ts`. Keeping
+ * them here breaks that cycle. `inject.ts` imports them back and re-exports the
+ * two public predicates, so external callers see no change.
+ */
+export const OCX_SECTION_MARKER = "# Auto-injected by opencodex";
+
+export function isRootOpenaiBaseUrlLine(line: string): boolean {
+  return /^\s*openai_base_url\s*=/.test(line);
+}
+
+export function tomlStringPattern(key: string): RegExp {
+  const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const keyToken = `(?:${escaped}|"${escaped}"|'${escaped}')`;
+  return new RegExp(`^\\s*${keyToken}\\s*=\\s*["']([^"']+)["']\\s*(?:#.*)?$`);
+}
+
+export function rootTomlString(content: string, key: string): string | null {
+  const lines = content.split("\n");
+  const firstTable = lines.findIndex(line => /^\s*\[/.test(line));
+  const rootLines = lines.slice(0, firstTable === -1 ? lines.length : firstTable);
+  const pattern = tomlStringPattern(key);
+  for (const line of rootLines) {
+    const match = pattern.exec(line);
+    if (match?.[1]) return match[1].trim();
+  }
+  return null;
+}
+
+export function providerTableStart(lines: string[], provider: string): number {
+  const escapedProvider = provider.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const providerToken = `(?:${escapedProvider}|"${escapedProvider}"|'${escapedProvider}')`;
+  const header = new RegExp(`^\\s*\\[\\s*(?:model_providers|"model_providers"|'model_providers')\\s*\\.\\s*${providerToken}\\s*\\]\\s*(?:#.*)?$`);
+  return lines.findIndex(line => header.test(line));
+}
+
+export function providerTableString(content: string, provider: string, key: string): string | null {
+  const lines = content.split("\n");
+  const start = providerTableStart(lines, provider);
+  if (start === -1) return null;
+  const pattern = tomlStringPattern(key);
+  for (let index = start + 1; index < lines.length && !/^\s*\[/.test(lines[index]); index += 1) {
+    const match = pattern.exec(lines[index]);
+    if (match?.[1]) return match[1].trim();
+  }
+  return null;
+}
+
+export function hasInjectedOpenaiBaseUrl(content: string): boolean {
+  const lines = content.split("\n");
+  const firstTable = lines.findIndex(l => /^\s*\[/.test(l));
+  const rootEnd = firstTable === -1 ? lines.length : firstTable;
+  for (let i = 1; i < rootEnd; i++) {
+    if (isRootOpenaiBaseUrlLine(lines[i]!) && lines[i - 1]!.includes(OCX_SECTION_MARKER)) return true;
+  }
+  return false;
+}
+
+/**
+ * True when the active Codex config is owned by opencodex routing. Covers the
+ * loopback Design B root override and the legacy/non-loopback provider table.
+ * A user-owned `openai_base_url` is intentionally not classified as injected.
+ */
+export function hasInjectedCodexRouting(content: string): boolean {
+  if (hasInjectedOpenaiBaseUrl(content)) return true;
+  return rootTomlString(content, "model_provider") === "opencodex"
+    && providerTableString(content, "opencodex", "base_url") !== null;
+}

package/src/codex/journal.ts

@@ -0,0 +1,163 @@
+import { createHash } from "node:crypto";
+import { existsSync, readFileSync, unlinkSync } from "node:fs";
+import { join } from "node:path";
+import { atomicWriteFile } from "../config";
+import { hasInjectedCodexRouting } from "./injected-marker";
+import { CODEX_HOME, CODEX_CONFIG_PATH, CODEX_PROFILE_PATH } from "./paths";
+
+const JOURNAL_PATH = join(CODEX_HOME, "opencodex-journal.json");
+
+interface Journal {
+  version: 1;
+  originalConfig: string;
+  originalProfile: string | null;
+  injectedConfigHash?: string;
+  injectedProfileHash?: string | null;
+  pid: number;
+  timestamp: string;
+}
+
+interface RestoreJournalResult {
+  configRestored: boolean;
+  profileRestored: boolean;
+  configChanged: boolean;
+  profileChanged: boolean;
+  complete: boolean;
+}
+
+function sha256(content: string | null): string | null {
+  return content === null ? null : createHash("sha256").update(content).digest("hex");
+}
+
+export interface WriteJournalOptions {
+  /**
+   * The caller's verdict on the config it is about to transform: false when
+   * `hasInjectedCodexRouting` matched. This does NOT decide whether the content
+   * may be journaled — that is checked below, from the bytes themselves. It only
+   * authorizes REPLACING an existing snapshot, which is why omitting it still
+   * allows a first snapshot but never an overwrite.
+   */
+  currentStateIsNative?: boolean;
+  /**
+   * The exact bytes the caller classified. Journaling these rather than re-reading
+   * the file keeps the snapshot and the verdict describing the same content when
+   * another process rewrites config.toml mid-flight.
+   */
+  configContent?: string;
+}
+
+/**
+ * Snapshot the pre-injection Codex state.
+ *
+ * Only native (non-opencodex-owned) config may be journaled, and native config
+ * always supersedes an older snapshot. The first half stops a re-inject from
+ * recording opencodex's own routing as the user's original — which would survive
+ * `ocx stop` and make the injection unremovable. The second half is the #477 fix:
+ * without it the first snapshot a machine ever takes is the only one it ever has,
+ * so an unclean shutdown days later replays a day-one config over the user's
+ * plugins, model choice, and trusted projects.
+ */
+export function writeJournal(options: WriteJournalOptions = {}): void {
+  if (!existsSync(CODEX_CONFIG_PATH)) return;
+  const config = options.configContent ?? readFileSync(CODEX_CONFIG_PATH, "utf-8");
+  // Ownership is decided HERE, from the bytes about to be journaled — never taken
+  // on the caller's word. A caller that says "native" about injected content would
+  // otherwise make opencodex's own routing the user's permanent "original".
+  if (hasInjectedCodexRouting(config)) return;
+  // The caller's verdict only authorizes REPLACEMENT. It is weaker evidence than
+  // the check above (it may describe bytes read a moment earlier), so an
+  // unclassified call creates a first snapshot but never overwrites one.
+  if (existsSync(JOURNAL_PATH) && readJournal() && options.currentStateIsNative !== true) return;
+  const profile = existsSync(CODEX_PROFILE_PATH)
+    ? readFileSync(CODEX_PROFILE_PATH, "utf-8")
+    : null;
+  const journal: Journal = {
+    version: 1,
+    originalConfig: Buffer.from(config).toString("base64"),
+    originalProfile: profile ? Buffer.from(profile).toString("base64") : null,
+    pid: process.pid,
+    timestamp: new Date().toISOString(),
+  };
+  atomicWriteFile(JOURNAL_PATH, JSON.stringify(journal));
+}
+
+export function markJournalInjectedState(config: string, profile: string | null): void {
+  const journal = readJournal();
+  if (!journal) return;
+  if (journal.injectedConfigHash) return;
+  journal.injectedConfigHash = sha256(config) ?? undefined;
+  journal.injectedProfileHash = sha256(profile);
+  atomicWriteFile(JOURNAL_PATH, JSON.stringify(journal));
+}
+
+export function removeJournal(): void {
+  try { unlinkSync(JOURNAL_PATH); } catch { /* ignore */ }
+}
+
+function readJournal(): Journal | null {
+  if (!existsSync(JOURNAL_PATH)) return null;
+  try {
+    const journal = JSON.parse(readFileSync(JOURNAL_PATH, "utf-8")) as Journal;
+    if (journal.version !== 1) throw new Error("unknown version");
+    return journal;
+  } catch {
+    removeJournal();
+    return null;
+  }
+}
+
+export function restoreJournalState(): RestoreJournalResult {
+  const journal = readJournal();
+  if (!journal) {
+    return { configRestored: false, profileRestored: false, configChanged: false, profileChanged: false, complete: false };
+  }
+  const currentConfig = existsSync(CODEX_CONFIG_PATH) ? readFileSync(CODEX_CONFIG_PATH, "utf-8") : "";
+  const currentProfile = existsSync(CODEX_PROFILE_PATH) ? readFileSync(CODEX_PROFILE_PATH, "utf-8") : null;
+  const configUnchanged = !journal.injectedConfigHash || sha256(currentConfig) === journal.injectedConfigHash;
+  const profileUnchanged = journal.injectedProfileHash === undefined || sha256(currentProfile) === (journal.injectedProfileHash ?? null);
+
+  let configRestored = false;
+  let profileRestored = false;
+  if (configUnchanged) {
+    atomicWriteFile(CODEX_CONFIG_PATH, Buffer.from(journal.originalConfig, "base64").toString("utf-8"));
+    configRestored = true;
+  }
+  if (profileUnchanged) {
+    if (journal.originalProfile !== null) {
+      atomicWriteFile(CODEX_PROFILE_PATH, Buffer.from(journal.originalProfile, "base64").toString("utf-8"));
+    } else if (existsSync(CODEX_PROFILE_PATH)) {
+      try { unlinkSync(CODEX_PROFILE_PATH); } catch { /* ignore */ }
+    }
+    profileRestored = true;
+  }
+  const complete = configRestored && profileRestored;
+  if (complete) removeJournal();
+  return {
+    configRestored,
+    profileRestored,
+    configChanged: !configUnchanged,
+    profileChanged: !profileUnchanged,
+    complete,
+  };
+}
+
+export function restoreJournal(): boolean {
+  return restoreJournalState().complete;
+}
+
+export function reconcileJournal(): boolean {
+  const journal = readJournal();
+  if (!journal) return false;
+  try {
+    process.kill(journal.pid, 0);
+    return false;
+  } catch (e: unknown) {
+    if ((e as NodeJS.ErrnoException).code === "EPERM") {
+      return false;
+    }
+  }
+  const restored = restoreJournalState();
+  if (!restored.configRestored && !restored.profileRestored) return false;
+  console.error(`⚠️  Previous session (PID ${journal.pid}) did not shut down cleanly. Codex state restored from journal.`);
+  return true;
+}

package/src/codex/main-account-cache.ts

@@ -0,0 +1,32 @@
+import type { StoredAccountQuota } from "./quota";
+import { truncateRetainedUtf8 } from "../lib/admission";
+
+const MAX_DIAGNOSTIC_VALUE_BYTES = 8 * 1024;
+
+export interface MainAccountInfo {
+  email: string | null;
+  plan: string | null;
+  quota: Omit<StoredAccountQuota, "updatedAt"> | null;
+}
+
+export interface CachedMainAccountInfo extends MainAccountInfo {
+  ts: number;
+}
+
+let cachedMainAccountInfo: CachedMainAccountInfo | null = null;
+
+export function getMainAccountInfoCache(): CachedMainAccountInfo | null {
+  return cachedMainAccountInfo;
+}
+
+export function setMainAccountInfoCache(value: CachedMainAccountInfo): void {
+  cachedMainAccountInfo = {
+    ...value,
+    email: value.email === null ? null : truncateRetainedUtf8(value.email, MAX_DIAGNOSTIC_VALUE_BYTES),
+    plan: value.plan === null ? null : truncateRetainedUtf8(value.plan, MAX_DIAGNOSTIC_VALUE_BYTES),
+  };
+}
+
+export function clearMainAccountInfoCache(): void {
+  cachedMainAccountInfo = null;
+}

package/src/codex/main-account.ts

@@ -0,0 +1,40 @@
+import { readCodexTokens } from "./auth-collision";
+import { decodeJwtPayload } from "../oauth/chatgpt";
+import { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
+
+export { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
+
+/**
+ * Main account plan (e.g. "plus", "go", "free", "team"), populated from the WHAM usage
+ * fetch. Used by the rotation usage-score so go/free main accounts score on monthly
+ * percent, matching pool-account behavior.
+ */
+let mainAccountPlan: string | null = null;
+
+export function setMainAccountPlan(plan: string | null): void {
+  mainAccountPlan = plan;
+}
+
+export function getMainAccountPlan(): string | undefined {
+  return mainAccountPlan ?? undefined;
+}
+
+/** Read-only main account token from ~/.codex/auth.json, or null when not logged in. */
+export function getMainAccountToken(): { accessToken: string; chatgptAccountId: string } | null {
+  const tokens = readCodexTokens();
+  if (!tokens?.access_token) return null;
+  return { accessToken: tokens.access_token, chatgptAccountId: tokens.account_id };
+}
+
+/**
+ * The main token is usable when it exists and — if its JWT carries a decodable `exp` — is
+ * not expired. When `exp` cannot be decoded we treat the token as live (best-effort); an
+ * actually-invalid token then surfaces via the upstream 401 → cooldown path.
+ */
+export function isMainAccountTokenLive(now = Date.now()): boolean {
+  const tokens = readCodexTokens();
+  if (!tokens?.access_token) return false;
+  const payload = decodeJwtPayload(tokens.access_token);
+  const exp = typeof payload?.exp === "number" ? payload.exp * 1000 : undefined;
+  return exp === undefined || exp > now;
+}

package/src/codex/model-cache.ts

@@ -0,0 +1,227 @@
+/**
+ * In-memory, per-provider TTL cache for live `/models` results.
+ *
+ * Ported in spirit from jawcode's packages/ai/src/model-manager.ts (the "always load the latest
+ * model list" resolver): live fetch when the cache is stale, serve the cache while it is fresh,
+ * and fall back to the last-known-good list when a live fetch fails. opencodex's proxy is a single
+ * long-running process and the on-disk Codex catalog already persists the last sync across
+ * restarts, so an in-memory cache is sufficient here (no SQLite layer needed).
+ */
+import type { CatalogModel } from "./catalog";
+import type { GenerationContext } from "../lib/state-store-sweeper";
+import { enforceAppOwnedMemoryBudget, type RetainedStoreSnapshot } from "../lib/app-owned-memory";
+
+/** Default freshness window. Matches Codex's own 5-min models cache so the two stay in step. */
+export const DEFAULT_MODEL_CACHE_TTL_MS = 5 * 60 * 1000;
+
+interface CacheEntry {
+  models: CatalogModel[];
+  fetchedAt: number;
+  sizeBytes: number;
+}
+
+export type ProviderModelDiscoveryFailureReason =
+  | "http"
+  | "blocked"
+  | "invalid_response"
+  | "network"
+  | "provider";
+
+export type ProviderModelDiscoveryStatus =
+  | { status: "ok" }
+  | { status: "failed"; reason: "http"; httpStatus: number }
+  | {
+      status: "failed";
+      reason: Exclude<ProviderModelDiscoveryFailureReason, "http">;
+      httpStatus?: never;
+    };
+
+export type ProviderModelDiscoveryFailure = ProviderModelDiscoveryStatus extends infer Status
+  ? Status extends { status: "failed" }
+    ? Omit<Status, "status">
+    : never
+  : never;
+
+const cache = new Map<string, CacheEntry>();
+let cacheBytes = 0;
+let oldestCachedProvider: string | undefined;
+let oldestCachedAt: number | null = null;
+const modelCacheEncoder = new TextEncoder();
+
+function recomputeOldestCachedProvider(): void {
+  oldestCachedProvider = undefined;
+  oldestCachedAt = null;
+  for (const [provider, entry] of cache) {
+    if (oldestCachedAt !== null && entry.fetchedAt >= oldestCachedAt) continue;
+    oldestCachedProvider = provider;
+    oldestCachedAt = entry.fetchedAt;
+  }
+}
+
+function deleteCachedProvider(provider: string): number {
+  const entry = cache.get(provider);
+  if (!entry) return 0;
+  cache.delete(provider);
+  cacheBytes = Math.max(0, cacheBytes - entry.sizeBytes);
+  if (oldestCachedProvider === provider) recomputeOldestCachedProvider();
+  return entry.sizeBytes;
+}
+
+/** Cooldown after a failed live `/models` fetch, so a dead/unreachable provider doesn't re-pay
+ * the full fetch timeout on every catalog poll (issue #54: UI stalls behind corporate proxies). */
+export const MODELS_FETCH_FAILURE_COOLDOWN_MS = 30_000;
+
+const failureAt = new Map<string, number>();
+const discoveryStatus = new Map<string, ProviderModelDiscoveryStatus>();
+/**
+ * How many models the last successful discovery actually returned, before any configured-alias
+ * augmentation or custom-model merge. Consumers cannot recover this by subtracting known custom
+ * ids: a custom id that later also appears upstream would make a real live catalog look
+ * custom-only, and the provider's configured fallback would wrongly stay authoritative.
+ */
+const liveModelCounts = new Map<string, number>();
+let lastReconciledGeneration = 0;
+
+export function markModelsFetchFailure(provider: string, now = Date.now()): void {
+  failureAt.set(provider, now);
+}
+
+/** `liveModelCount` is required so a caller that forgets to pass it fails typecheck instead of
+ * silently recording zero and misclassifying the provider as having no live catalog. */
+export function markProviderDiscoveryOk(provider: string, liveModelCount: number): void {
+  discoveryStatus.set(provider, { status: "ok" });
+  liveModelCounts.set(provider, Math.max(0, Math.floor(liveModelCount)));
+}
+
+export function markProviderDiscoveryFailed(
+  provider: string,
+  failure: ProviderModelDiscoveryFailure,
+): void {
+  discoveryStatus.set(provider, { status: "failed", ...failure });
+}
+
+/**
+ * Decide whether a discovery FAILURE should be logged, to avoid flooding the log with an identical
+ * warning on every poll (#395: an anthropic-adapter baseUrl without `/v1/models`, e.g. Azure AI
+ * Foundry, returns HTTP 404 forever; the 30s cooldown re-probes and previously re-logged each time).
+ *
+ * Returns true only when the failure SIGNATURE changed since the last observed status — i.e. the
+ * previous state was ok/undefined, or a different reason/httpStatus. Repeated identical failures
+ * stay observable through `getProviderDiscoveryStatus()` / the providers API without log spam.
+ * Call this BEFORE `markProviderDiscoveryFailed` so it can see the prior state.
+ */
+export function shouldLogDiscoveryFailure(
+  provider: string,
+  failure: ProviderModelDiscoveryFailure,
+): boolean {
+  const prev = discoveryStatus.get(provider);
+  if (!prev || prev.status !== "failed") return true;
+  if (prev.reason !== failure.reason) return true;
+  if (prev.reason === "http" && failure.reason === "http") {
+    return prev.httpStatus !== failure.httpStatus;
+  }
+  return false;
+}
+
+export function clearProviderDiscoveryStatus(provider: string): void {
+  discoveryStatus.delete(provider);
+  liveModelCounts.delete(provider);
+}
+
+export function getProviderDiscoveryStatus(provider: string): ProviderModelDiscoveryStatus | undefined {
+  return discoveryStatus.get(provider);
+}
+
+/** Undefined when discovery has never succeeded for this provider. A failed refresh keeps the
+ * last successful count so a stale catalog is still recognised as live-origin. */
+export function getProviderLiveModelCount(provider: string): number | undefined {
+  return liveModelCounts.get(provider);
+}
+
+export function isModelsFetchCoolingDown(provider: string, cooldownMs = MODELS_FETCH_FAILURE_COOLDOWN_MS, now = Date.now()): boolean {
+  const at = failureAt.get(provider);
+  return at !== undefined && now - at < cooldownMs;
+}
+
+/** Fresh cached models for a provider, or null when absent/stale (caller should re-fetch). */
+export function getFreshCached(provider: string, ttlMs: number, now = Date.now()): CatalogModel[] | null {
+  const entry = cache.get(provider);
+  if (!entry) return null;
+  return now - entry.fetchedAt < ttlMs ? entry.models : null;
+}
+
+/** Last-known-good models regardless of age — the fallback when a live fetch fails. */
+export function getStaleCached(provider: string): CatalogModel[] | null {
+  return cache.get(provider)?.models ?? null;
+}
+
+export function setCached(provider: string, models: CatalogModel[], now = Date.now()): void {
+  deleteCachedProvider(provider);
+  const sizeBytes = modelCacheEncoder.encode(provider).byteLength
+    + modelCacheEncoder.encode(JSON.stringify(models)).byteLength;
+  cache.set(provider, { models, fetchedAt: now, sizeBytes });
+  cacheBytes += sizeBytes;
+  if (oldestCachedAt === null || now < oldestCachedAt) {
+    oldestCachedProvider = provider;
+    oldestCachedAt = now;
+  }
+  enforceAppOwnedMemoryBudget();
+}
+
+/** Drop one provider's cache (or all) so the next resolve forces a live re-fetch. */
+export function clearModelCache(provider?: string): void {
+  if (provider) {
+    deleteCachedProvider(provider);
+    failureAt.delete(provider);
+    discoveryStatus.delete(provider);
+    liveModelCounts.delete(provider);
+  } else {
+    cache.clear();
+    cacheBytes = 0;
+    oldestCachedProvider = undefined;
+    oldestCachedAt = null;
+    failureAt.clear();
+    discoveryStatus.clear();
+    liveModelCounts.clear();
+  }
+}
+
+export function reconcileModelCacheProviders(
+  validProviders: ReadonlySet<string>,
+  generation = lastReconciledGeneration + 1,
+): number {
+  if (generation <= lastReconciledGeneration) return 0;
+  const removedProviders = new Set<string>();
+  for (const store of [failureAt, discoveryStatus, liveModelCounts]) {
+    for (const provider of store.keys()) {
+      if (validProviders.has(provider)) continue;
+      store.delete(provider);
+      removedProviders.add(provider);
+    }
+  }
+  for (const provider of cache.keys()) {
+    if (validProviders.has(provider)) continue;
+    deleteCachedProvider(provider);
+    removedProviders.add(provider);
+  }
+  lastReconciledGeneration = generation;
+  return removedProviders.size;
+}
+
+export function reconcileModelCacheGeneration(context: GenerationContext): number {
+  return reconcileModelCacheProviders(context.providerNames, context.generation);
+}
+
+export function modelCacheRetainedStoreSnapshot(): RetainedStoreSnapshot {
+  return {
+    count: cache.size,
+    bytes: cacheBytes,
+    evictableBytes: cacheBytes,
+    pinnedBytes: 0,
+    oldestAt: oldestCachedAt,
+  };
+}
+
+export function evictOldestModelCacheForBudget(): number {
+  return oldestCachedProvider === undefined ? 0 : deleteCachedProvider(oldestCachedProvider);
+}

package/src/codex/paths.ts

@@ -0,0 +1,65 @@
+import { realpathSync, statSync } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+import { expandUserPath } from "../config";
+import { defaultCodexHome } from "./home";
+
+function resolveCodexHome(): string {
+  const raw = process.env.CODEX_HOME?.trim();
+  if (raw) {
+    const path = resolve(expandUserPath(raw));
+    let stat;
+    try {
+      stat = statSync(path);
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      throw new Error(`CODEX_HOME points to ${raw}, but that path could not be read: ${message}`);
+    }
+    if (!stat.isDirectory()) {
+      throw new Error(`CODEX_HOME points to ${raw}, but that path is not a directory`);
+    }
+    return realpathSync.native(path);
+  }
+
+  return defaultCodexHome();
+}
+
+export const CODEX_HOME = resolveCodexHome();
+export const CODEX_CONFIG_PATH = join(CODEX_HOME, "config.toml");
+export const CODEX_PROFILE_PATH = join(CODEX_HOME, "opencodex.config.toml");
+export const DEFAULT_CATALOG_PATH = join(CODEX_HOME, "opencodex-catalog.json");
+export const CODEX_MODELS_CACHE_PATH = join(CODEX_HOME, "models_cache.json");
+
+/** Runtime CODEX_HOME lookup (honors CODEX_HOME env changes after import). */
+export function getCodexHome(): string {
+  return resolveCodexHome();
+}
+
+export function tomlString(value: string): string {
+  return JSON.stringify(value);
+}
+
+export function parseTomlString(raw: string): string {
+  if (raw.startsWith("\"")) {
+    try {
+      return JSON.parse(raw) as string;
+    } catch {
+      return raw.slice(1, -1);
+    }
+  }
+  return raw.slice(1, -1);
+}
+
+export function readRootTomlString(content: string, key: string): string | null {
+  const lines = content.split("\n");
+  const firstTable = lines.findIndex(l => /^\s*\[/.test(l));
+  const rootLines = firstTable === -1 ? lines : lines.slice(0, firstTable);
+  for (const line of rootLines) {
+    const m = line.match(new RegExp(`^\\s*${key}\\s*=\\s*(\"(?:\\\\.|[^\"])*\"|'[^']*')`));
+    if (m) return parseTomlString(m[1]);
+  }
+  return null;
+}
+
+export function resolveCodexConfigPath(path: string): string {
+  return isAbsolute(path) ? path : join(CODEX_HOME, path);
+}