@koreanhole/opencodex 2.99.0 → 3.1.0

package/src/adapters/cli-agent/cline/settings.ts

@@ -6,8 +6,10 @@ import { baseScopedEnv } from "../env";
 /** Built-in, subagent, and team tools that a model-only Cline turn must never enable. */
 export const CLINE_DISABLED_TOOL_IDS = Object.freeze([
   "read_files",
+  "list_files",
   "search_codebase",
   "run_commands",
+  "run_terminal_command",
   "fetch_web_content",
   "apply_patch",
   "editor",
@@ -68,6 +70,10 @@ export interface ClineSelection {
   model?: string;
 }
 
+export type ClineMcpLaunch =
+  | { kind: "module"; modulePath: string }
+  | { kind: "entrypoint"; entrypoint: string };
+
 interface ClineSelectionCandidate {
   providerId: string;
   model?: string;
@@ -261,12 +267,13 @@ export async function assertClineSelectionSafe(providerSettingsPath: string): Pr
  * The vendor store is advisory: absence or another schema is Cline's business.
  * Only an explicit route back through this proxy remains a hard refusal.
  */
-export async function assertClineAdvisoryDestinationSafe(providerSettingsPath: string): Promise<void> {
+export async function assertClineAdvisoryDestinationSafe(providerSettingsPath: string): Promise<ClineSelection | undefined> {
   try {
-    await assertClineSelectionSafe(providerSettingsPath);
+    return await assertClineSelectionSafe(providerSettingsPath);
   } catch (error) {
     if (error instanceof ClineSettingsError && error.code === "cli_provider_recursion") throw error;
     if (!(error instanceof ClineSettingsError)) throw error;
+    return undefined;
   }
 }
 
@@ -285,8 +292,25 @@ function clineGlobalSettings(): Record<string, unknown> {
   };
 }
 
-function clineMcpSettings(): Record<string, unknown> {
-  return { mcpServers: {} };
+function clineMcpArgs(launch: ClineMcpLaunch, catalogPath: string): string[] {
+  return launch.kind === "module"
+    ? [launch.modulePath, catalogPath]
+    : [launch.entrypoint, catalogPath];
+}
+
+function clineMcpSettings(launch: ClineMcpLaunch | undefined, catalogPath: string): Record<string, unknown> {
+  if (!launch) return { mcpServers: {} };
+  return {
+    mcpServers: {
+      opencodex: {
+        transport: {
+          type: "stdio",
+          command: process.execPath,
+          args: clineMcpArgs(launch, catalogPath),
+        },
+      },
+    },
+  };
 }
 
 /** Share a staged file at a vendor-default path. */
@@ -346,6 +370,7 @@ async function linkClineSettings(input: {
 export async function stageClineTurn(options: {
   providerSettingsPath: string;
   catalog: readonly Record<string, unknown>[];
+  mcpLaunch?: ClineMcpLaunch;
 }): Promise<ClineStagedTurn> {
   const root = await mkdtemp(join(tmpdir(), "ocx-cline-cli-"));
   const configDir = join(root, "config");
@@ -378,7 +403,7 @@ export async function stageClineTurn(options: {
     ]);
     await Promise.all([
       writeFile(globalSettingsPath, `${JSON.stringify(clineGlobalSettings(), null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" }),
-      writeFile(mcpSettingsPath, `${JSON.stringify(clineMcpSettings(), null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" }),
+      writeFile(mcpSettingsPath, `${JSON.stringify(clineMcpSettings(options.mcpLaunch, catalogPath), null, 2)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" }),
       writeFile(catalogPath, JSON.stringify(options.catalog), { encoding: "utf8", mode: 0o600, flag: "wx" }),
     ]);
     const copiedProviderStore = await copyClineProviderSettings(options.providerSettingsPath, providerSettingsPath);
@@ -409,6 +434,40 @@ export async function stageClineTurn(options: {
   }
 }
 
+/** Merge newly discovered built-in IDs into the private staged disable list. */
+export async function mergeClineDisabledTools(
+  staged: Pick<ClineStagedTurn, "globalSettingsPath">,
+  ids: readonly string[],
+): Promise<void> {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(await readFile(staged.globalSettingsPath, "utf8"));
+  } catch {
+    throw new ClineSettingsError(
+      "Cline global settings are malformed; the tool preflight cannot be repaired.",
+      500,
+      "cline_cli_setup_failed",
+    );
+  }
+  const settings = asRecord(parsed);
+  if (!settings) {
+    throw new ClineSettingsError(
+      "Cline global settings are malformed; the tool preflight cannot be repaired.",
+      500,
+      "cline_cli_setup_failed",
+    );
+  }
+  const current = Array.isArray(settings.disabledTools)
+    ? settings.disabledTools.filter((value): value is string => typeof value === "string")
+    : [];
+  const merged = [...new Set([...current, ...ids])];
+  await writeFile(
+    staged.globalSettingsPath,
+    `${JSON.stringify({ ...settings, disabledTools: merged }, null, 2)}\n`,
+    { encoding: "utf8", mode: 0o600 },
+  );
+}
+
 export function buildClineChildEnv(staged: ClineStagedTurn, sourceEnv: NodeJS.ProcessEnv = process.env): Record<string, string> {
   const env = baseScopedEnv();
   env.HOME = staged.homeDir;

package/src/adapters/cli-agent/cline/stream.ts

@@ -1,6 +1,9 @@
-import type { AdapterEvent } from "../../../types";
+import type { AdapterEvent, OcxUsage } from "../../../types";
 import type { CliAgentStreamState } from "../types";
 import { mapToolIntent, ToolIntentError } from "../tool-intent";
+import { redactSecretString } from "../../../lib/redact";
+
+const MAX_ERROR_CHARS = 2_048;
 
 export class ClineStreamProtocolError extends Error {
   readonly code = "cli_protocol_error";
@@ -42,3 +45,200 @@ export function mapClineToolIntent(
     throw error;
   }
 }
+
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : undefined;
+}
+
+function asString(value: unknown): string | undefined {
+  return typeof value === "string" ? value : undefined;
+}
+
+function safeMessage(value: unknown): string {
+  const raw = typeof value === "string"
+    ? value
+    : value instanceof Error
+      ? value.message
+      : value === undefined
+        ? "Cline reported an error."
+        : JSON.stringify(value) ?? String(value);
+  return redactSecretString(raw).slice(0, MAX_ERROR_CHARS);
+}
+
+function classifyError(message: string): { status: number; errorType: string; code: string; retryable: boolean } {
+  if (/not logged in|please (?:run )?\/?login|sign in|authentication (?:failed|required)|unauthorized|invalid (?:api )?key/i.test(message)) {
+    return { status: 401, errorType: "authentication_error", code: "cline_cli_not_logged_in", retryable: false };
+  }
+  if (/rate limit|too many requests|quota|credit|usage limit|daily limit/i.test(message)) {
+    return { status: 429, errorType: "rate_limit_error", code: "rate_limit_exceeded", retryable: true };
+  }
+  if (/model (?:is )?(?:not found|unavailable|unsupported)|invalid model/i.test(message)) {
+    return { status: 400, errorType: "invalid_request_error", code: "model_not_found", retryable: false };
+  }
+  return { status: 502, errorType: "upstream_error", code: "cli_protocol_error", retryable: false };
+}
+
+function usageFrom(value: unknown): OcxUsage | undefined {
+  const record = asRecord(value);
+  if (!record) return undefined;
+  const count = (input: unknown): number =>
+    typeof input === "number" && Number.isFinite(input) && input >= 0 ? Math.floor(input) : 0;
+  const inputTokens = count(record.inputTokens);
+  const outputTokens = count(record.outputTokens);
+  const cacheRead = count(record.cacheReadTokens);
+  const cacheWrite = count(record.cacheWriteTokens);
+  if (inputTokens === 0 && outputTokens === 0 && cacheRead === 0 && cacheWrite === 0) return undefined;
+  return {
+    inputTokens,
+    outputTokens,
+    totalTokens: inputTokens + outputTokens,
+    ...(cacheRead > 0 ? { cachedInputTokens: cacheRead, cacheReadInputTokens: cacheRead } : {}),
+    ...(cacheWrite > 0 ? { cacheCreationInputTokens: cacheWrite } : {}),
+  };
+}
+
+function mapAgentEvent(
+  event: Record<string, unknown>,
+  state: CliAgentStreamState,
+  options: ClineStreamOptions,
+): AdapterEvent[] {
+  const type = asString(event.type);
+  if (type === "content_start") {
+    const contentType = asString(event.contentType);
+    if (contentType === "text") {
+      const text = asString(event.text);
+      if (!text) return [];
+      state.sawText = true;
+      return [{ type: "text_delta", text }];
+    }
+    if (contentType === "reasoning") {
+      const thinking = asString(event.reasoning);
+      if (!thinking) return [];
+      state.sawThinking = true;
+      return [{ type: "thinking_delta", thinking }];
+    }
+    if (contentType === "tool") {
+      const vendorName = asString(event.toolName);
+      if (!vendorName) throw new ClineStreamProtocolError("Cline returned a tool call without a name.");
+      return mapClineToolIntent(vendorName, asString(event.toolCallId), event.input, state, options);
+    }
+    return [];
+  }
+
+  if (type === "content_end") {
+    const contentType = asString(event.contentType);
+    if (contentType === "text" && !state.sawText) {
+      const text = asString(event.text);
+      if (text) {
+        state.sawText = true;
+        return [{ type: "text_delta", text }];
+      }
+    }
+    if (contentType === "reasoning" && !state.sawThinking) {
+      const thinking = asString(event.reasoning);
+      if (thinking) {
+        state.sawThinking = true;
+        return [{ type: "thinking_delta", thinking }];
+      }
+    }
+    return [];
+  }
+
+  if (type === "usage") {
+    const usage = usageFrom(event);
+    if (usage) state.usage = usage;
+    return [];
+  }
+
+  if (type === "error") {
+    if (event.recoverable === true) return [];
+    const message = safeMessage(asRecord(event.error)?.message ?? event.error ?? "Cline reported an error.");
+    state.lastError = message;
+    state.terminal = true;
+    return [{ type: "error", message, ...classifyError(message) }];
+  }
+
+  if (type === "done") {
+    state.terminal = true;
+    if (state.toolCalls > 0) return [];
+    const events: AdapterEvent[] = [];
+    if (!state.sawText) {
+      const text = asString(event.text);
+      if (text) {
+        state.sawText = true;
+        events.push({ type: "text_delta", text });
+      }
+    }
+    const usage = usageFrom(event.usage) ?? state.usage;
+    events.push({ type: "done", stopReason: "stop", ...(usage ? { usage } : {}) });
+    return events;
+  }
+
+  return [];
+}
+
+/** Map one bounded Cline JSON frame to provider-neutral events. */
+export function mapClineMessage(
+  message: Record<string, unknown>,
+  state: CliAgentStreamState,
+  options: ClineStreamOptions,
+): AdapterEvent[] {
+  if (state.terminal) return [];
+  const type = asString(message.type);
+  if (type === "agent_event") {
+    const event = asRecord(message.event);
+    return event ? mapAgentEvent(event, state, options) : [];
+  }
+
+  if (type === "run_result") {
+    if (state.toolCalls > 0) return [];
+    const usage = usageFrom(message.usage) ?? state.usage;
+    if (usage) state.usage = usage;
+    const finishReason = asString(message.finishReason);
+    if (finishReason && finishReason !== "completed" && finishReason !== "stop") {
+      const messageText = safeMessage(message.text ?? `Cline finished with ${finishReason}.`);
+      state.terminal = true;
+      return [{ type: "error", message: messageText, ...classifyError(messageText) }];
+    }
+    state.terminal = true;
+    const events: AdapterEvent[] = [];
+    if (!state.sawText) {
+      const text = asString(message.text);
+      if (text) {
+        state.sawText = true;
+        events.push({ type: "text_delta", text });
+      }
+    }
+    events.push({ type: "done", stopReason: "stop", ...(usage ? { usage } : {}) });
+    return events;
+  }
+
+  if (type === "run_aborted") {
+    state.terminal = true;
+    return [{
+      type: "error",
+      message: safeMessage(message.message ?? "Cline aborted the turn."),
+      status: 499,
+      errorType: "invalid_request_error",
+      code: "client_cancelled",
+      retryable: false,
+    }];
+  }
+
+  if (type === "error") {
+    const detail = safeMessage(message.message ?? "Cline reported an error.");
+    state.lastError = detail;
+    state.terminal = true;
+    return [{ type: "error", message: detail, ...classifyError(detail) }];
+  }
+
+  return [];
+}
+
+/** Convert a nonzero process exit into a stable terminal error. */
+export function classifyClineFailure(exitCode: number, stderr: string): Extract<AdapterEvent, { type: "error" }> {
+  const detail = safeMessage(stderr.trim() || `Cline exited with code ${exitCode}.`);
+  return { type: "error", message: detail, ...classifyError(detail) };
+}

package/src/adapters/cli-agent/gemini/acp.ts

@@ -177,7 +177,10 @@ async function runGeminiHelp(binary: string, env: Record<string, string>, deps:
 }
 
 /** Build the Gemini ACP environment while leaving vendor auth in its real home. */
-export function buildGeminiAcpEnv(sourceEnv: NodeJS.ProcessEnv = process.env): Record<string, string> {
+export function buildGeminiAcpEnv(
+  sourceEnv: NodeJS.ProcessEnv = process.env,
+  platform: NodeJS.Platform = process.platform,
+): Record<string, string> {
   const env = baseScopedEnv();
   const realHome = nonEmpty(sourceEnv.HOME) ?? nonEmpty(sourceEnv.USERPROFILE) ?? homedir();
   env.HOME = realHome;
@@ -192,6 +195,8 @@ export function buildGeminiAcpEnv(sourceEnv: NodeJS.ProcessEnv = process.env): R
     NO_UPDATE_NOTIFIER: "1",
     NO_COLOR: "1",
   });
+  // Windows Node needs the OS store for corporate TLS roots.
+  if (platform === "win32") env.NODE_USE_SYSTEM_CA = "1";
   return env;
 }
 

package/src/adapters/cli-agent/gemini/adapter.ts

@@ -287,7 +287,7 @@ export async function runGeminiTurn(
     ...(deps.reapTimeoutMs !== undefined ? { reapTimeoutMs: deps.reapTimeoutMs } : {}),
     ...(deps.killWindowsProcessTree ? { killWindowsProcessTree: deps.killWindowsProcessTree } : {}),
   };
-  const acpEnv = buildGeminiAcpEnv(sourceEnv);
+  const acpEnv = buildGeminiAcpEnv(sourceEnv, deps.platform ?? process.platform);
   let mode;
   try {
     mode = await (deps.probeAcp ?? probeGeminiAcpSupport)(binary, acpEnv, acpDeps);

package/src/adapters/cli-agent/gemini/live-models.ts

@@ -105,7 +105,7 @@ export async function discoverGeminiLiveModels(options: GeminiLiveModelsOptions
       ?? { ok: false, reason: "backoff", detail: "Gemini model discovery is cooling down after a failure.", fingerprint };
   }
 
-  const env = buildGeminiAcpEnv(sourceEnv);
+  const env = buildGeminiAcpEnv(sourceEnv, options.deps?.platform ?? process.platform);
   const mode = await probeGeminiAcpSupport(binary, env, { ...options.deps, env: sourceEnv });
   if (!mode.acp) {
     failureCache.set(fingerprint, timestamp);

package/src/adapters/cli-agent/types.ts

@@ -23,5 +23,6 @@ export interface CliAgentTurnDeps {
   timeoutMs?: number;
   killGraceMs?: number;
   reapTimeoutMs?: number;
+  toolBatchIdleMs?: number;
   killWindowsProcessTree?: (pid: number) => void;
 }

package/src/cli/entry.ts

@@ -0,0 +1,230 @@
+#!/usr/bin/env bun
+import { randomBytes } from "node:crypto";
+import { rmSync } from "node:fs";
+import {
+  ADAPTER_DEFAULT_PORT,
+  ADAPTER_PROVIDER_IDS,
+  ADAPTER_TOKEN_ENV,
+  AdapterConfigError,
+  adapterRuntimePath,
+  discoverManagedProviderMetadata,
+  readAdapterRuntime,
+  readUpstreamConfig,
+  removeAdapterRuntimeIfPid,
+  restoreManagedProviderRows,
+  setAdapterDefaultProvider,
+  syncManagedProviderRows,
+  writeAdapterRuntime,
+  type AdapterProviderId,
+} from "../adapter-runtime/config";
+import { startAdapterGateway, type AdapterGateway } from "../adapter-runtime/gateway";
+import { ConfigError } from "../config";
+import { UpstreamPackageError, resolveUpstreamPackage } from "../upstream/package";
+import { loadUpstreamCli } from "../upstream/cli";
+import { runAdapterCli } from "./index";
+import packageInfo from "../../package.json";
+
+type AdapterCli = (argv: string[]) => Promise<number>;
+type UpstreamLoader = () => Promise<void>;
+type StartPreparer = (env: NodeJS.ProcessEnv) => Promise<unknown>;
+
+export interface EntryDeps {
+  adapterCli?: AdapterCli;
+  loadUpstream?: UpstreamLoader;
+  prepareStart?: StartPreparer;
+}
+
+const DISTRIBUTION_PACKAGE = "@koreanhole/opencodex";
+
+function isAdapterId(value: string | undefined): value is AdapterProviderId {
+  return value === "gemini-cli" || value === "cline-cli";
+}
+
+export function isAdapterOwnedCommand(argv: readonly string[]): boolean {
+  const command = argv[0];
+  if (command === "__cli-agent-mcp") return true;
+  if (command === "version" || command === "--version" || command === "-v") return true;
+  if (command === "update") return true;
+  if (command === "system" && argv.slice(1).includes("update")) return true;
+  if (command === "login" && (argv[1] === "cline-cli" || argv[1] === "gemini-cli")) return true;
+  if (command === "adapter" && argv[1] === "detach") return true;
+  if (command !== "provider") return false;
+  if (argv[1] === "add" && isAdapterId(argv[2])) return true;
+  if (argv[1] === "use" && isAdapterId(argv[2])) return true;
+  return false;
+}
+
+function takeFlag(args: string[], flag: string): boolean {
+  const index = args.indexOf(flag);
+  if (index < 0) return false;
+  args.splice(index, 1);
+  return true;
+}
+
+async function adapterProviderCommand(args: string[], env: NodeJS.ProcessEnv): Promise<number> {
+  const sub = args.shift();
+  if (sub !== "add" && sub !== "use") throw new ConfigError("Unknown provider command: " + String(sub ?? "(missing)"));
+  const provider = args.shift();
+  if (!isAdapterId(provider)) throw new ConfigError("Only gemini-cli and cline-cli are handled for provider " + sub + ".");
+  if (sub === "add") {
+    const setDefault = takeFlag(args, "--set-default");
+    if (args.length > 0) throw new ConfigError("Unknown provider add option: " + args[0]);
+    const runtime = await readAdapterRuntime(env);
+    await syncManagedProviderRows({
+      env,
+      gatewayPort: runtime?.port ?? ADAPTER_DEFAULT_PORT,
+      ...(setDefault ? { defaultProvider: provider } : {}),
+    });
+    console.log("Configured " + provider + ".");
+    return 0;
+  }
+  if (args.length > 0) throw new ConfigError("Unknown provider use option: " + args[0]);
+  await setAdapterDefaultProvider(provider, env);
+  console.log("Default provider: " + provider);
+  return 0;
+}
+
+async function detachAdapter(env: NodeJS.ProcessEnv): Promise<number> {
+  const result = await restoreManagedProviderRows(env);
+  if (!result.restored) {
+    console.log("CLI adapters are not attached.");
+    return 0;
+  }
+  if (result.preservedUserRows.length > 0) {
+    console.log("Preserved user-owned provider rows: " + result.preservedUserRows.join(", "));
+  }
+  console.log("CLI adapter provider rows detached.");
+  return 0;
+}
+
+function printDistributionUpdate(argv: readonly string[]): number {
+  const command = "npm install -g " + DISTRIBUTION_PACKAGE + "@latest";
+  if (argv.includes("--json")) {
+    console.log(JSON.stringify({
+      ok: false,
+      reason: "distribution_managed",
+      package: DISTRIBUTION_PACKAGE,
+      command,
+    }));
+  } else {
+    console.error("ocx: updates are managed by " + DISTRIBUTION_PACKAGE + ".");
+    console.error("Run: " + command);
+  }
+  return 2;
+}
+
+function printVersion(): number {
+  console.log("opencodex " + packageInfo.version);
+  return 0;
+}
+
+async function runAdapterCommand(argv: string[], env: NodeJS.ProcessEnv, adapterCli: AdapterCli): Promise<number> {
+  if (argv[0] === "__cli-agent-mcp") return adapterCli(argv);
+  if (argv[0] === "version" || argv[0] === "--version" || argv[0] === "-v") return printVersion();
+  if (argv[0] === "login") return adapterCli(argv);
+  if (argv[0] === "update" || (argv[0] === "system" && argv.slice(1).includes("update"))) {
+    return printDistributionUpdate(argv);
+  }
+  if (argv[0] === "adapter" && argv[1] === "detach") return detachAdapter(env);
+  if (argv[0] === "provider") return adapterProviderCommand(argv.slice(1), env);
+  throw new ConfigError("Internal adapter dispatch error.");
+}
+
+function pidAlive(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Attach the two managed rows and keep the gateway in the serving process. */
+export async function prepareAdapterStart(
+  env: NodeJS.ProcessEnv = process.env,
+  deps: {
+    discoverMetadata?: typeof discoverManagedProviderMetadata;
+    startGateway?: typeof startAdapterGateway;
+    syncRows?: typeof syncManagedProviderRows;
+  } = {},
+): Promise<AdapterGateway | undefined> {
+  const existing = await readAdapterRuntime(env);
+  const inheritedToken = env[ADAPTER_TOKEN_ENV]?.trim();
+  if (existing && existing.pid !== process.pid && pidAlive(existing.pid) && !inheritedToken) {
+    throw new AdapterConfigError(
+      "The CLI adapter gateway is already running in another process; restart it from that process or stop it first.",
+    );
+  }
+  const token = inheritedToken || randomBytes(32).toString("base64url");
+  env[ADAPTER_TOKEN_ENV] = token;
+  let gateway: AdapterGateway | undefined;
+  let gatewayPort: number;
+  if (existing && existing.pid !== process.pid && pidAlive(existing.pid)) {
+    gatewayPort = existing.port;
+  } else {
+    if (existing) await removeAdapterRuntimeIfPid(existing.pid, env);
+    gateway = (deps.startGateway ?? startAdapterGateway)({ token, env });
+    gatewayPort = gateway.port;
+    await writeAdapterRuntime({
+      version: 1,
+      pid: process.pid,
+      host: "127.0.0.1",
+      port: gatewayPort,
+      tokenEnv: ADAPTER_TOKEN_ENV,
+      providers: [...ADAPTER_PROVIDER_IDS],
+      startedAt: new Date().toISOString(),
+    }, env);
+    process.once("exit", () => {
+      try {
+        rmSync(adapterRuntimePath(env), { force: true });
+      } catch {
+        // best effort
+      }
+    });
+  }
+
+  try {
+    const metadata = await (deps.discoverMetadata ?? discoverManagedProviderMetadata)(env).catch(() => undefined);
+    const synced = await (deps.syncRows ?? syncManagedProviderRows)({
+      env,
+      gatewayPort,
+      ...(metadata ? { metadata } : {}),
+    });
+    if (synced.providerEnvToken) env.OPENCODEX_API_AUTH_TOKEN ??= synced.providerEnvToken;
+    return gateway;
+  } catch (error) {
+    await gateway?.stop().catch(() => undefined);
+    await removeAdapterRuntimeIfPid(process.pid, env).catch(() => undefined);
+    throw error;
+  }
+}
+
+export async function runEntry(argv: string[], deps: EntryDeps = {}): Promise<void> {
+  const env = process.env;
+  env.OCX_DISABLE_UPDATE_CHECK ??= "1";
+  if (isAdapterOwnedCommand(argv)) {
+    process.exitCode = await runAdapterCommand(argv, env, deps.adapterCli ?? runAdapterCli);
+    return;
+  }
+  if (argv[0] === "start") {
+    await (deps.prepareStart ?? prepareAdapterStart)(env);
+  }
+  const entry = process.argv[1] ?? "ocx";
+  const executable = process.argv[0] ?? "bun";
+  process.argv = [executable, entry, ...argv];
+  await (deps.loadUpstream ?? (() => loadUpstreamCli()))();
+}
+
+function printError(error: unknown): number {
+  const message = error instanceof Error ? error.message : String(error);
+  console.error("ocx: " + message);
+  return error instanceof ConfigError || error instanceof AdapterConfigError || error instanceof UpstreamPackageError ? 2 : 1;
+}
+
+if (import.meta.main) {
+  try {
+    await runEntry(process.argv.slice(2));
+  } catch (error) {
+    process.exitCode = printError(error);
+  }
+}

package/src/cli/index.ts

@@ -348,7 +348,7 @@ async function stopCommand(args: string[]): Promise<number> {
   return restored.success ? 0 : 1;
 }
 
-async function main(argv: string[]): Promise<number> {
+export async function runAdapterCli(argv: string[]): Promise<number> {
   if (argv[0] === "__cli-agent-mcp") {
     await runCodingAgentMcpServer(argv[1] ?? "", argv[2]);
     return 0;
@@ -372,8 +372,10 @@ async function main(argv: string[]): Promise<number> {
   throw new ConfigError(`Unknown command: ${command}. Expected login, provider, codex, start, status, stop, restore, eject, version, or help.`);
 }
 
-try {
-  process.exitCode = await main(process.argv.slice(2));
-} catch (error) {
-  process.exitCode = printError(error);
+if (import.meta.main) {
+  try {
+    process.exitCode = await runAdapterCli(process.argv.slice(2));
+  } catch (error) {
+    process.exitCode = printError(error);
+  }
 }