@remodex/rmx 1.0.2 → 1.0.4

package/README.md

@@ -1,6 +1,6 @@
 <h3 align="center">Remodex</h3>
 <p align="center"><b>Universal provider proxy for OpenAI Codex, Claude Code, Claude Desktop &amp; Grok Build</b><br>
-Two commands, and every one of them runs any LLM you point it at.</p>
+One command to start, and every request can use any LLM you point it at.</p>
 
 <p align="center">
   <a href="https://x.com/claudeebum"><img src="https://img.shields.io/badge/%40claudeebum-000000?logo=x&logoColor=white" alt="Follow @claudeebum on X"></a>
@@ -11,7 +11,7 @@ Two commands, and every one of them runs any LLM you point it at.</p>
 
 ```bash
 npm install -g @remodex/rmx
-rmx start        # proxy + dashboard on localhost:10100
+rmx onboard      # configure Codex, background service, and Android Remote
 ```
 
 <table align="center">
@@ -56,10 +56,14 @@ account while existing threads stay pinned to the account that started them.
 
 ```bash
 npm install -g @remodex/rmx   # Node 18+; the Bun runtime is bundled automatically
-rmx start                            # or `rmx service` to run it in the background
+rmx onboard                           # complete setup and open the phone pairing QR
 ```
 
-Open **http://localhost:10100** and configure everything in the web dashboard — add providers
+`rmx onboard` safely creates the Remodex config, preserves an existing provider such as `codex-lb`,
+enables Android Remote, installs or repairs the OS background service, installs the Windows tray on
+Windows, waits for a verified public tunnel, and opens a fresh QR code. It is safe to rerun.
+
+Open **http://localhost:10100** to configure anything else in the web dashboard — add providers
 (40+ built-ins, or any OpenAI-compatible endpoint), pick models, manage accounts. `rmx gui`
 re-opens the dashboard at any time.
 It can also manage a **ChatGPT account pool** for Codex auth. Add multiple ChatGPT / Codex accounts,
@@ -75,11 +79,12 @@ once the others are drained.
 
 ```bash
 npm install -g @remodex/rmx
-rmx start     # or `rmx service`
-rmx init      # interactive setup: writes ~/.remodex/config.json and wires Codex
+rmx onboard   # idempotent config + Codex + service + Android Remote setup
 ```
 
-`rmx init` never starts the proxy; start it first (or after — either order works, but headless
+`rmx` with no arguments is shorthand for `rmx service`: it installs or refreshes the supervised
+background service and starts the proxy. Use `rmx --help` for the command list. `rmx init` never
+starts the proxy; start it first (or after — either order works, but headless
 commands like `rmx provider add` and `rmx combo set` talk to the **live** proxy and exit nonzero
 when it is unreachable). `rmx status` / `rmx doctor` / `rmx health` report the running state.
 
@@ -92,14 +97,19 @@ when it is unreachable). `rmx status` / `rmx doctor` / `rmx health` report the r
 
 | OS | Status | Service manager |
 |---|---|---|
-| macOS (arm64 / x64) | Fully supported | launchd |
-| Linux (x64 / arm64) | Fully supported | systemd (user unit) |
-| Windows (x64) | Fully supported | Task Scheduler (hidden) / opt-in native service (`--native`, WinSW) |
+| macOS (arm64 / x64) | Fully supported | launchd (service + daily updater) |
+| Linux (x64 / arm64) | Fully supported | systemd user units (service + daily updater) |
+| Windows (x64) | Fully supported | Task Scheduler (service + hidden daily updater) / optional WinSW service (`--native`) |
 
 Requires [Node](https://nodejs.org) 18+. The Bun runtime is bundled on `npm install` — no separate
 Bun install needed, no WSL needed on Windows. If npm blocked the bundled runtime's install scripts,
 see the [installation docs](https://opencodex.me/getting-started/installation/).
 
+Global installs enable unattended package updates by default after the first normal `rmx` bootstrap.
+The updater runs once daily, verifies an exact registry version and integrity metadata, confirms
+proxy health after restart, and records rollback information under `~/.remodex`. Use
+`rmx system update auto off` to opt out, or `rmx system update auto status` to inspect it.
+
 ## Highlights
 
 - **Use any LLM with Codex, Claude Code, Claude Desktop, and Grok Build** — 40+ providers out of
@@ -204,6 +214,18 @@ loopback (`"hostname": "0.0.0.0"`) **requires** a bearer token — the proxy ref
 without `OPENCODEX_API_AUTH_TOKEN`, and every client request must carry it as
 `x-opencodex-api-key`. Details: [configuration reference](https://opencodex.me/reference/configuration/).
 
+Android Remote offers two encrypted Cloudflare Tunnel choices:
+
+| Choice | Best for | Tradeoff |
+|---|---|---|
+| **Quick Tunnel** (default) | Fast first-time or occasional use; no Cloudflare account, domain, or token | Temporary address changes after a tunnel restart; Cloudflare provides it for testing without an uptime SLA |
+| **Use my domain** | Regular use with a stable address | Requires a Cloudflare domain and one-time authorization; setup takes longer |
+
+Both choices still require an authorized Remodex phone. For a custom domain, keep the generated
+random subdomain (for example, `rmx-072ab490ff.example.com`) to reduce casual discovery. The random
+name is not the access control; phone authorization is. See Cloudflare's
+[Quick Tunnel limitations](https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/do-more-with-tunnels/trycloudflare/).
+
 ## Documentation
 
 The public docs — install, providers, routing, combos, sub-agents, sidecars, integrations, and

package/bin/ocx.mjs

@@ -100,6 +100,11 @@ function hasLegacyRemodexEvidence(path) {
     ".opencodex-uninstall.json",
     "admin-api-token",
     "android-remote.json",
+    "auto-update.cmd",
+    "auto-update-task.xml",
+    "auto-update.json",
+    "auto-update.lock",
+    "auto-update.log",
     "catalog-backup.json",
     "codex-runtime.json",
     "codex-shim.json",
@@ -178,28 +183,64 @@ function runTrayLifecycle(launcher, action) {
   });
 }
 
-function runNpmSelfUpdate() {
+function isSafePackageVersion(value) {
+  return typeof value === "string"
+    && value.length <= 64
+    && /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?(?:\+[0-9A-Za-z.-]+)?$/.test(value);
+}
+
+function verifyExactNpmIntegrity(version) {
+  const metadata = npmInvocation(["view", `${PKG}@${version}`, "dist.integrity"]);
+  if (!metadata) return false;
+  const result = spawnSync(metadata.file, metadata.args, {
+    encoding: "utf8",
+    timeout: 12000,
+    windowsHide: true,
+    ...metadata.options,
+  });
+  if (result.status !== 0) return false;
+  return /sha512-[A-Za-z0-9+/=]+/.test(String(result.stdout ?? "").replace(/["']/g, ""));
+}
+
+function runNpmSelfUpdate(options = {}) {
+  const exactVersion = options.exactVersion;
+  if (exactVersion !== undefined && !isSafePackageVersion(exactVersion)) {
+    console.error("Remodex: the exact update target is not a valid package version.");
+    process.exit(1);
+  }
   const current = currentPackageVersion();
   const tag = updateTag(current);
-  const latestInvocation = npmInvocation(["view", `${PKG}@${tag}`, "version"]);
-  const installInvocation = npmInvocation(["install", "-g", `${PKG}@${tag}`]);
+  const latestInvocation = npmInvocation(
+    ["view", `${PKG}@${exactVersion ?? tag}`, "version"],
+  );
+  const installSpec = exactVersion ? `${PKG}@${exactVersion}` : `${PKG}@${tag}`;
+  const installInvocation = npmInvocation(
+    exactVersion ? ["install", "-g", installSpec] : ["install", "-g", `${PKG}@${tag}`],
+  );
   if (!latestInvocation || !installInvocation) {
     console.error("Remodex: could not resolve npm from a trusted absolute PATH entry; aborting before stopping the proxy.");
     process.exit(1);
   }
-  const latestResult = spawnSync(latestInvocation.file, latestInvocation.args, {
-    encoding: "utf8",
-    timeout: 12000,
-    windowsHide: true,
-    ...latestInvocation.options,
-  });
-  const latest = latestResult.status === 0 ? latestResult.stdout.trim() : "";
+  let latest = exactVersion ?? "";
+  if (!exactVersion) {
+    const latestResult = spawnSync(latestInvocation.file, latestInvocation.args, {
+      encoding: "utf8",
+      timeout: 12000,
+      windowsHide: true,
+      ...latestInvocation.options,
+    });
+    latest = latestResult.status === 0 ? latestResult.stdout.trim() : "";
+  }
 
   console.log(`Remodex v${current} (installed via npm, tag ${tag})`);
   if (latest && latest === current) {
-    console.log(`Already on the latest ${tag} version (v${latest}).`);
+    console.log(`Already on the ${exactVersion ? "requested" : `latest ${tag}`} version (v${latest}).`);
     process.exit(0);
   }
+  if (exactVersion && !verifyExactNpmIntegrity(exactVersion)) {
+    console.error("Remodex: exact update integrity metadata could not be verified; refusing package replacement.");
+    process.exit(1);
+  }
 
   const cachePreflight = runNpmCachePreflight();
   if (!cachePreflight.ok) {
@@ -328,7 +369,7 @@ function runNpmSelfUpdate() {
     }
   }
 
-  console.log(`Updating${latest ? ` to v${latest}` : ""}...\n$ npm install -g ${PKG}@${tag}`);
+  console.log(`Updating${latest ? ` to v${latest}` : ""}...\n$ npm install -g ${installSpec}`);
   const res = spawnSync(installInvocation.file, installInvocation.args, {
     stdio: "inherit",
     timeout: 180000,
@@ -422,7 +463,7 @@ function runNpmSelfUpdate() {
     process.exit(0);
   }
   if (trayBeforeUpdate.restoreOnFailure) runTrayLifecycle(launcher, "start");
-  console.error(`\nUpdate failed (npm exit ${res.status ?? "?"}). Try manually:  npm install -g ${PKG}@${tag}`);
+  console.error(`\nUpdate failed (npm exit ${res.status ?? "?"}). Try manually:  npm install -g ${installSpec}`);
   process.exit(1);
 }
 
@@ -506,12 +547,27 @@ if (updateHelpRequested) {
   process.exit(0);
 }
 
+if (process.argv[2] === "__exact-update") {
+  const exactVersion = process.argv[3];
+  if (process.argv.length !== 4 || !isSafePackageVersion(exactVersion)) {
+    console.error("Remodex: invalid exact update target.");
+    process.exit(64);
+  }
+  runNpmSelfUpdate({ exactVersion });
+}
+
 if (process.argv[2] === "update" && isNodeModulesInstall() && !isBunGlobalInstall()) {
   runNpmSelfUpdate();
 }
 
 const bunRuntime = resolveBun();
 const bun = bunRuntime.path;
+// The installed npm command is intentionally useful with no arguments:
+// `rmx` is the one-command bootstrap for the supervised backend. Keep explicit
+// help/version/subcommands untouched; only an empty user argv becomes
+// `rmx service` (which installs/refreshes and starts the background service).
+const userCliArgs = process.argv.slice(2);
+const forwardedCliArgs = userCliArgs.length === 0 ? ["service"] : userCliArgs;
 
 // Run the Bun child asynchronously and FORWARD termination signals to it, then wait
 // for its graceful shutdown before this launcher exits. The previous blocking
@@ -540,11 +596,14 @@ const launchContext = JSON.stringify({
   proof: launchProof,
   anthropicEnvSlots: preBunAnthropicSlots,
 });
-const child = spawn(bun, [cliPath, `${NODE_LAUNCH_PROOF_PREFIX}${launchProof}`, ...process.argv.slice(2)], {
+const child = spawn(bun, [cliPath, `${NODE_LAUNCH_PROOF_PREFIX}${launchProof}`, ...forwardedCliArgs], {
   stdio: "inherit",
   env: {
     ...process.env,
     [NODE_LAUNCH_CONTEXT_ENV]: launchContext,
+    // The Bun child needs the stable Node executable when it creates a
+    // scheduler entry. `process.execPath` inside that child is Bun.
+    OCX_NODE_LAUNCHER_PATH: process.execPath,
     [BUN_RUNTIME_SOURCE_ENV]: bunRuntime.source,
     [BUN_RUNTIME_PATH_ENV]: bunRuntime.path,
   },