@textcortex/zenocode 0.1.13 → 0.1.15

package/scripts/run-zenocode.mjs

@@ -1,75 +1,86 @@
 #!/usr/bin/env node
-import { spawn } from "node:child_process";
-import { realpathSync } from "node:fs";
-import fs from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import process from "node:process";
-import readline from "node:readline/promises";
-import { fileURLToPath } from "node:url";
-import {
-  patchZenocodeBinaryText,
-  zenocodeLogo,
-} from "./branding-patch.mjs";
-import {
-  openCodePackageName,
-  openCodePackageSpec,
-} from "./opencode-version.mjs";
+import { spawn } from 'node:child_process';
+import { existsSync, realpathSync } from 'node:fs';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import process from 'node:process';
+import readline from 'node:readline/promises';
+import { fileURLToPath } from 'node:url';
+import { zenocodeRuntimePackageSpec } from './opencode-version.mjs';
+import { zenocodeLogo } from './source-branding.mjs';
 
 const currentFilePath = realpathSync(fileURLToPath(import.meta.url));
-const __dirname = path.dirname(currentFilePath);
-const appRoot = path.resolve(__dirname, "..");
 const runtimeDir =
   process.env.ZENOCODE_HOME ||
   process.env.CODECORTEX_HOME ||
-  path.join(os.homedir(), ".zenocode");
+  path.join(os.homedir(), '.zenocode');
 const legacyRuntimeDir =
-  process.env.CODECORTEX_HOME || path.join(os.homedir(), ".codecortex");
-const runtimeCredentialsPath = path.join(runtimeDir, "credentials.json");
+  process.env.CODECORTEX_HOME || path.join(os.homedir(), '.codecortex');
+const runtimeCredentialsPath = path.join(runtimeDir, 'credentials.json');
 const legacyRuntimeCredentialsPath = path.join(
   legacyRuntimeDir,
-  "credentials.json",
+  'credentials.json'
 );
-const logoutMarkerPath = path.join(runtimeDir, "logout-marker.json");
-const modelsPath = path.join(runtimeDir, "models.json");
-const configPath = path.join(runtimeDir, "opencode.jsonc");
-const tuiConfigPath = path.join(runtimeDir, "opencode.tui.json");
-const localBaseUrlDefault = "http://127.0.0.1:8080";
-const cloudBaseUrlDefault = "https://api.textcortex.com";
-const localBaseUrlFlags = new Set(["--local", "--localhost"]);
-
-const providerID = "textcortex";
-const configuredOpencodePackage =
-  process.env.ZENOCODE_OPENCODE_PACKAGE ||
-  process.env.CODECORTEX_OPENCODE_PACKAGE ||
-  process.env.OPENCODE_PACKAGE ||
-  null;
-const defaultBrandedOpencodePackage = openCodePackageSpec;
-const legacyBrandedOpencodePackage = "@textcortex/opencode-ai";
-const fallbackOpencodePackage = openCodePackageName;
-const opencodePackage = configuredOpencodePackage || defaultBrandedOpencodePackage;
+const logoutMarkerPath = path.join(runtimeDir, 'logout-marker.json');
+const modelsPath = path.join(runtimeDir, 'models.json');
+const configPath = path.join(runtimeDir, 'zenocode.jsonc');
+const tuiConfigPath = path.join(runtimeDir, 'zenocode.tui.json');
+const localBaseUrlDefault = 'http://127.0.0.1:8080';
+const cloudBaseUrlDefault = 'https://api.textcortex.com';
+const localBaseUrlFlags = new Set(['--local', '--localhost']);
+
+const providerID = 'textcortex';
+export function resolveConfiguredRuntimePackage(env = process.env) {
+  return (
+    env.ZENOCODE_OPENCODE_PACKAGE || env.CODECORTEX_OPENCODE_PACKAGE || null
+  );
+}
+
+const configuredOpencodePackage = resolveConfiguredRuntimePackage();
+const opencodePackage = configuredOpencodePackage || zenocodeRuntimePackageSpec;
 const opencodeBinaryPath =
   process.env.ZENOCODE_OPENCODE_BIN_PATH ||
   process.env.CODECORTEX_OPENCODE_BIN_PATH ||
-  "";
-const oauthInitiatePath = "/internal/v2/fastapi/zenocode/oauth2/initiate";
-const oauthTokenPath = "/internal/v2/fastapi/zenocode/oauth2/token";
+  '';
+const oauthInitiatePath = '/internal/v2/fastapi/zenocode/oauth2/initiate';
+const oauthTokenPath = '/internal/v2/fastapi/zenocode/oauth2/token';
 const defaultOrder = [
-  "minimax-m3-thinking",
-  "kimi-k2-6",
-  "kimi-k2-5-thinking",
-  "glm-5-1",
-  "gpt-5-2",
-  "gpt-5-1",
-  "gpt-5",
-  "claude-4-6-sonnet",
-  "gpt-5-mini",
+  'gpt-6-luna',
+  'gpt-5-6-luna',
+  'kimi-k3-non-thinking',
+  'kimi-k3-thinking',
+  'kimi-k2p7-code-non-thinking',
+  'kimi-k2p7-code-thinking',
+  'minimax-m3-thinking',
+  'kimi-k2-6-non-thinking',
+  'kimi-k2-6-thinking',
+  'kimi-k2-5',
+  'kimi-k2-5-thinking',
+  'glm-5-3',
+  'glm-5-2-non-thinking',
+  'glm-5-2-thinking',
+  'gpt-5-2',
+  'gpt-5-1',
+  'gpt-5',
+  'claude-sonnet-5-5',
+  'claude-5-sonnet',
+  'claude-opus-5-5',
+  'claude-opus-5',
+  'gpt-5-mini',
 ];
+const retiredModelIDs = new Set([
+  'glm-4-7',
+  'glm-5',
+  'glm-5-1',
+  'glm-5-1-non-thinking',
+  'glm-5-1-thinking',
+]);
 const devCredentialFiles =
-  process.env.ZENOCODE_DEV_MODE === "1"
+  process.env.ZENOCODE_DEV_MODE === '1'
     ? [
-        path.join(process.cwd(), "backend", ".credentials.json"),
-        path.join(process.cwd(), ".credentials.json"),
+        path.join(process.cwd(), 'backend', '.credentials.json'),
+        path.join(process.cwd(), '.credentials.json'),
       ]
     : [];
 const runtimeCredentialFiles = [
@@ -77,53 +88,61 @@ const runtimeCredentialFiles = [
   legacyRuntimeCredentialsPath,
 ].filter((value, index, values) => values.indexOf(value) === index);
 const fallbackCredentialFiles = [
-  path.join(os.homedir(), ".credentials.json"),
+  path.join(os.homedir(), '.credentials.json'),
   ...devCredentialFiles,
 ].filter((value, index, values) => values.indexOf(value) === index);
 const credentialFiles = [...runtimeCredentialFiles, ...fallbackCredentialFiles];
 
 function _decodeEscapedLogoLine(line) {
   return line.replace(/\\u([0-9a-fA-F]{4})/g, (_, codePoint) =>
-    String.fromCharCode(Number.parseInt(codePoint, 16)),
+    String.fromCharCode(Number.parseInt(codePoint, 16))
   );
 }
 
 export function buildZenocodeBanner() {
   const bannerLines = zenocodeLogo.left
     .map((leftLine, index) => {
-      const rightLine = zenocodeLogo.right[index] || "";
+      const rightLine = zenocodeLogo.right[index] || '';
       return `${_decodeEscapedLogoLine(leftLine)} ${_decodeEscapedLogoLine(rightLine)}`.trimEnd();
     })
     .filter((line) => line.trim());
-  return `\n${bannerLines.join("\n")}\n`;
+  return `\n${bannerLines.join('\n')}\n`;
 }
 const privateDirectoryMode = 0o700;
 const privateFileMode = 0o600;
 
+async function _pathExists(pathToCheck) {
+  try {
+    await fs.access(pathToCheck);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 async function readJson(filePath) {
   try {
-    return JSON.parse(await fs.readFile(filePath, "utf-8"));
+    return JSON.parse(await fs.readFile(filePath, 'utf-8'));
   } catch (error) {
-    if (error?.code === "ENOENT") return null;
+    if (error?.code === 'ENOENT') return null;
     throw error;
   }
 }
 
 async function ensurePrivateDirectory(dirPath) {
   await fs.mkdir(dirPath, { recursive: true, mode: privateDirectoryMode });
-  if (process.platform !== "win32") {
+  if (process.platform !== 'win32') {
     await fs.chmod(dirPath, privateDirectoryMode);
   }
 }
 
 export async function writePrivateJsonFile(filePath, payload) {
   await ensurePrivateDirectory(path.dirname(filePath));
-  await fs.writeFile(
-    filePath,
-    `${JSON.stringify(payload, null, 2)}\n`,
-    { encoding: "utf-8", mode: privateFileMode },
-  );
-  if (process.platform !== "win32") {
+  await fs.writeFile(filePath, `${JSON.stringify(payload, null, 2)}\n`, {
+    encoding: 'utf-8',
+    mode: privateFileMode,
+  });
+  if (process.platform !== 'win32') {
     await fs.chmod(filePath, privateFileMode);
   }
 }
@@ -132,7 +151,7 @@ async function clearLogoutMarker() {
   try {
     await fs.unlink(logoutMarkerPath);
   } catch (error) {
-    if (error?.code !== "ENOENT") {
+    if (error?.code !== 'ENOENT') {
       throw error;
     }
   }
@@ -143,24 +162,31 @@ async function writeLogoutMarker() {
   await fs.writeFile(
     logoutMarkerPath,
     `${JSON.stringify({ logged_out_at: new Date().toISOString() }, null, 2)}\n`,
-    { encoding: "utf-8", mode: privateFileMode },
+    {
+      encoding: 'utf-8',
+      mode: privateFileMode,
+    }
   );
-  if (process.platform !== "win32") {
+  if (process.platform !== 'win32') {
     await fs.chmod(logoutMarkerPath, privateFileMode);
   }
 }
 
 function extractTokenFromCredentialPayload(parsed) {
   if (!parsed) return null;
-  if (typeof parsed?.access_token === "string" && parsed.access_token) {
+  if (typeof parsed?.access_token === 'string' && parsed.access_token) {
     return parsed.access_token;
   }
   if (Array.isArray(parsed?.accounts)) {
-    const active = parsed.accounts.find((entry) => typeof entry?.access_token === "string" && entry.access_token);
+    const active = parsed.accounts.find(
+      (entry) => typeof entry?.access_token === 'string' && entry.access_token
+    );
     if (active) return active.access_token;
   }
   if (Array.isArray(parsed)) {
-    const match = parsed.find((entry) => typeof entry?.access_token === "string" && entry.access_token);
+    const match = parsed.find(
+      (entry) => typeof entry?.access_token === 'string' && entry.access_token
+    );
     if (match) return match.access_token;
   }
   return null;
@@ -168,17 +194,19 @@ function extractTokenFromCredentialPayload(parsed) {
 
 function extractBaseUrlFromCredentialPayload(parsed) {
   if (!parsed) return null;
-  if (typeof parsed?.base_url === "string" && parsed.base_url) {
+  if (typeof parsed?.base_url === 'string' && parsed.base_url) {
     return parsed.base_url;
   }
   if (Array.isArray(parsed?.accounts)) {
     const active = parsed.accounts.find(
-      (entry) => typeof entry?.base_url === "string" && entry.base_url,
+      (entry) => typeof entry?.base_url === 'string' && entry.base_url
     );
     if (active) return active.base_url;
   }
   if (Array.isArray(parsed)) {
-    const match = parsed.find((entry) => typeof entry?.base_url === "string" && entry.base_url);
+    const match = parsed.find(
+      (entry) => typeof entry?.base_url === 'string' && entry.base_url
+    );
     if (match) return match.base_url;
   }
   return null;
@@ -186,17 +214,17 @@ function extractBaseUrlFromCredentialPayload(parsed) {
 
 export function resolveLoginSuccessIdentifier(tokenData) {
   const authId =
-    typeof tokenData?.auth_id === "string" ? tokenData.auth_id.trim() : "";
-  return authId || "unknown";
+    typeof tokenData?.auth_id === 'string' ? tokenData.auth_id.trim() : '';
+  return authId || 'unknown';
 }
 
 function _isCredentialEntry(entry) {
   return Boolean(
     entry &&
-      typeof entry === "object" &&
+      typeof entry === 'object' &&
       !Array.isArray(entry) &&
-      (typeof entry.access_token === "string" ||
-        typeof entry.refresh_token === "string"),
+      (typeof entry.access_token === 'string' ||
+        typeof entry.refresh_token === 'string')
   );
 }
 
@@ -211,7 +239,9 @@ function _selectCredentialEntry(parsed) {
   }
 
   if (Array.isArray(parsed?.accounts)) {
-    const index = parsed.accounts.findIndex((entry) => _isCredentialEntry(entry));
+    const index = parsed.accounts.findIndex((entry) =>
+      _isCredentialEntry(entry)
+    );
     if (index !== -1) {
       return {
         entry: parsed.accounts[index],
@@ -273,14 +303,14 @@ async function findStoredCredentialState() {
 }
 
 function _decodeBase64Url(value) {
-  const normalized = value.replaceAll("-", "+").replaceAll("_", "/");
-  const padding = "=".repeat((4 - (normalized.length % 4)) % 4);
-  return Buffer.from(`${normalized}${padding}`, "base64").toString("utf-8");
+  const normalized = value.replaceAll('-', '+').replaceAll('_', '/');
+  const padding = '='.repeat((4 - (normalized.length % 4)) % 4);
+  return Buffer.from(`${normalized}${padding}`, 'base64').toString('utf-8');
 }
 
 function extractAccessTokenExpiry(accessToken) {
   try {
-    const [, payloadSegment] = String(accessToken || "").split(".");
+    const [, payloadSegment] = String(accessToken || '').split('.');
     if (!payloadSegment) return null;
     const payload = JSON.parse(_decodeBase64Url(payloadSegment));
     const exp = Number(payload?.exp);
@@ -294,24 +324,24 @@ function extractAccessTokenExpiry(accessToken) {
 }
 
 async function exchangeRefreshToken(baseUrl, refreshToken) {
-  const refreshUrl = new URL("/auth/token/refresh/", baseUrl).toString();
+  const refreshUrl = new URL('/auth/token/refresh/', baseUrl).toString();
   const { response, payload, text } = await requestJson(refreshUrl, {
-    method: "POST",
+    method: 'POST',
     headers: {
       Authorization: `Bearer ${refreshToken}`,
-      Accept: "application/json",
-      "Content-Type": "application/json",
+      Accept: 'application/json',
+      'Content-Type': 'application/json',
     },
   });
 
   if (!response.ok) {
-    const message = extractErrorMessage(payload, text || "request failed");
+    const message = extractErrorMessage(payload, text || 'request failed');
     throw new Error(`Token refresh failed (${response.status}): ${message}`);
   }
 
   const data = unwrapData(payload);
   if (!data?.access_token) {
-    throw new Error("Token refresh failed: invalid response payload.");
+    throw new Error('Token refresh failed: invalid response payload.');
   }
 
   return data;
@@ -320,20 +350,20 @@ async function exchangeRefreshToken(baseUrl, refreshToken) {
 async function refreshStoredCredentials(baseUrl) {
   const state = await findStoredCredentialState();
   const refreshToken =
-    typeof state?.entry?.refresh_token === "string" && state.entry.refresh_token
+    typeof state?.entry?.refresh_token === 'string' && state.entry.refresh_token
       ? state.entry.refresh_token
       : null;
 
   if (!state || !refreshToken) {
-    throw new Error("No refresh token available.");
+    throw new Error('No refresh token available.');
   }
 
   const resolvedBaseUrl =
     process.env.TEXTCORTEX_BASE_URL ||
-    (typeof state.entry.base_url === "string" && state.entry.base_url) ||
+    (typeof state.entry.base_url === 'string' && state.entry.base_url) ||
     baseUrl;
   if (!resolvedBaseUrl) {
-    throw new Error("Missing base URL for token refresh.");
+    throw new Error('Missing base URL for token refresh.');
   }
 
   const refreshed = await exchangeRefreshToken(resolvedBaseUrl, refreshToken);
@@ -342,7 +372,7 @@ async function refreshStoredCredentials(baseUrl) {
     base_url: resolvedBaseUrl,
     access_token: refreshed.access_token,
     refresh_token:
-      typeof refreshed.refresh_token === "string" && refreshed.refresh_token
+      typeof refreshed.refresh_token === 'string' && refreshed.refresh_token
         ? refreshed.refresh_token
         : refreshToken,
     auth_id: refreshed.auth_id || state.entry.auth_id || null,
@@ -363,7 +393,8 @@ async function refreshStoredCredentials(baseUrl) {
 }
 
 async function resolveToken() {
-  const envToken = process.env.TEXTCORTEX_API_KEY || process.env.TEXTCORTEX_API_TOKEN;
+  const envToken =
+    process.env.TEXTCORTEX_API_KEY || process.env.TEXTCORTEX_API_TOKEN;
   if (envToken) return envToken;
 
   for (const filePath of await resolveCredentialFiles()) {
@@ -374,10 +405,10 @@ async function resolveToken() {
 
   throw new Error(
     [
-      "Missing API token.",
-      "Run `zenocode login` first,",
-      "or set TEXTCORTEX_API_KEY / TEXTCORTEX_API_TOKEN.",
-    ].join(" "),
+      'Missing API token.',
+      'Run `zenocode login` first,',
+      'or set TEXTCORTEX_API_KEY / TEXTCORTEX_API_TOKEN.',
+    ].join(' ')
   );
 }
 
@@ -389,34 +420,45 @@ async function resolveStoredBaseUrl() {
   return baseUrl || null;
 }
 
+/** Choose runtime defaults without reviving retired rows from stale catalogs. */
 export function chooseDefaults(models) {
-  const ids = Object.keys(models);
-  if (!ids.length) throw new Error("No models were returned by the backend.");
+  const ids = Object.keys(models).filter((id) => !retiredModelIDs.has(id));
+  if (!ids.length) throw new Error('No models were returned by the backend.');
   const model = defaultOrder.find((id) => ids.includes(id)) || ids[0];
-  const smallModel = ids.find((id) => id.includes("mini") || id.includes("haiku")) || model;
+  const smallModel =
+    ids.find((id) => id.includes('-mini') || id.includes('haiku')) || model;
   return { model, smallModel };
 }
 
-export function buildOpenCodeConfig({ baseUrl, providerID, model, smallModel }) {
+export function buildOpenCodeConfig({
+  baseUrl,
+  providerID,
+  model,
+  smallModel,
+}) {
   return {
-    $schema: "https://opencode.ai/config.json",
+    $schema: 'https://opencode.ai/config.json',
     enabled_providers: [providerID],
+    // Zenocode owns runtime updates. Its source-branded runtime is released with
+    // the launcher, so an independently updating runtime would split the release.
+    autoupdate: false,
     // Keep the legacy theme key populated for older OpenCode builds.
-    theme: "system",
+    theme: 'system',
     model: `${providerID}/${model}`,
     small_model: `${providerID}/${smallModel}`,
     provider: {
       [providerID]: {
-        name: "Zenocode",
+        name: 'Zenocode',
         options: {
-          baseURL: new URL("/internal/v2/fastapi/zenocode/v1", baseUrl).toString(),
+          baseURL: new URL(
+            '/internal/v2/fastapi/zenocode/v1',
+            baseUrl
+          ).toString(),
         },
       },
-      // Older fallback opencode-ai builds can load the Codex auth plugin when
-      // a local OpenAI OAuth session exists. They assume `database.openai`
-      // exists and crash on `provider.models` otherwise, so keep a harmless
-      // empty provider entry around even though Zenocode only enables
-      // `textcortex`.
+      // The inherited Codex auth plugin assumes `database.openai` exists when a
+      // local OpenAI OAuth session is present. Keep a harmless empty entry even
+      // though Zenocode enables only `textcortex`.
       openai: {
         models: {},
       },
@@ -426,27 +468,35 @@ export function buildOpenCodeConfig({ baseUrl, providerID, model, smallModel })
 
 export function buildOpenCodeTuiConfig() {
   return {
-    $schema: "https://opencode.ai/tui.json",
-    theme: "system",
+    $schema: 'https://opencode.ai/tui.json',
+    theme: 'system',
   };
 }
 
 function unwrapData(payload) {
-  if (payload && typeof payload === "object" && payload.data && typeof payload.data === "object") {
+  if (
+    payload &&
+    typeof payload === 'object' &&
+    payload.data &&
+    typeof payload.data === 'object'
+  ) {
     return payload.data;
   }
   return payload;
 }
 
 function extractErrorMessage(payload, fallbackMessage) {
-  if (payload && typeof payload === "object") {
+  if (payload && typeof payload === 'object') {
     const errorMessage = payload?.error?.message;
-    if (typeof errorMessage === "string" && errorMessage) return errorMessage;
-    if (typeof payload.message === "string" && payload.message) return payload.message;
-    if (typeof payload.detail === "string" && payload.detail) return payload.detail;
-    if (payload.detail && typeof payload.detail === "object") {
+    if (typeof errorMessage === 'string' && errorMessage) return errorMessage;
+    if (typeof payload.message === 'string' && payload.message)
+      return payload.message;
+    if (typeof payload.detail === 'string' && payload.detail)
+      return payload.detail;
+    if (payload.detail && typeof payload.detail === 'object') {
       const detailMessage = payload.detail.message;
-      if (typeof detailMessage === "string" && detailMessage) return detailMessage;
+      if (typeof detailMessage === 'string' && detailMessage)
+        return detailMessage;
     }
     try {
       return JSON.stringify(payload);
@@ -470,28 +520,46 @@ async function requestJson(url, init) {
 }
 
 async function prepareRuntime(baseUrl, token) {
-  const modelsUrl = new URL("/internal/v2/fastapi/zenocode/models/api.json", baseUrl).toString();
+  const modelsUrl = new URL(
+    '/internal/v2/fastapi/zenocode/models/api.json',
+    baseUrl
+  ).toString();
   const { response, payload, text } = await requestJson(modelsUrl, {
-    headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+    headers: { Authorization: `Bearer ${token}`, Accept: 'application/json' },
   });
 
   if (!response.ok) {
     const body = payload ?? text;
-    const message = extractErrorMessage(payload, String(body || "request failed"));
-    if (response.status === 401 && message.includes("Email not confirmed")) {
+    const message = extractErrorMessage(
+      payload,
+      String(body || 'request failed')
+    );
+    if (response.status === 401 && message.includes('Email not confirmed')) {
       throw new Error(
-        "Models fetch failed (401): Email is not confirmed for this account. Please verify the email address and try again.",
+        'Models fetch failed (401): Email is not confirmed for this account. Please verify the email address and try again.'
       );
     }
     throw new Error(`Models fetch failed (${response.status}): ${message}`);
   }
 
   const provider = payload?.[providerID];
-  if (!provider?.models || typeof provider.models !== "object") {
-    throw new Error("Backend models response is missing textcortex provider data.");
+  if (!provider?.models || typeof provider.models !== 'object') {
+    throw new Error(
+      'Backend models response is missing textcortex provider data.'
+    );
   }
 
-  const { model, smallModel } = chooseDefaults(provider.models);
+  const supportedModels = Object.fromEntries(
+    Object.entries(provider.models).filter(([id]) => !retiredModelIDs.has(id))
+  );
+  const supportedPayload = {
+    ...payload,
+    [providerID]: {
+      ...provider,
+      models: supportedModels,
+    },
+  };
+  const { model, smallModel } = chooseDefaults(supportedModels);
   const config = buildOpenCodeConfig({
     baseUrl,
     providerID,
@@ -501,9 +569,21 @@ async function prepareRuntime(baseUrl, token) {
   const tuiConfig = buildOpenCodeTuiConfig();
 
   await fs.mkdir(runtimeDir, { recursive: true });
-  await fs.writeFile(modelsPath, `${JSON.stringify(payload, null, 2)}\n`, "utf-8");
-  await fs.writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf-8");
-  await fs.writeFile(tuiConfigPath, `${JSON.stringify(tuiConfig, null, 2)}\n`, "utf-8");
+  await fs.writeFile(
+    modelsPath,
+    `${JSON.stringify(supportedPayload, null, 2)}\n`,
+    'utf-8'
+  );
+  await fs.writeFile(
+    configPath,
+    `${JSON.stringify(config, null, 2)}\n`,
+    'utf-8'
+  );
+  await fs.writeFile(
+    tuiConfigPath,
+    `${JSON.stringify(tuiConfig, null, 2)}\n`,
+    'utf-8'
+  );
   return model;
 }
 
@@ -512,7 +592,7 @@ function sleep(ms) {
 }
 
 export function hasLocalBaseUrlFlag(args = []) {
-  const normalizedArgs = args[0] === "--" ? args.slice(1) : args;
+  const normalizedArgs = args[0] === '--' ? args.slice(1) : args;
   return normalizedArgs.some((arg) => localBaseUrlFlags.has(arg));
 }
 
@@ -521,7 +601,7 @@ function stripLocalBaseUrlFlags(args = []) {
 }
 
 async function parseLoginArgs(args) {
-  const normalizedArgs = args[0] === "--" ? args.slice(1) : args;
+  const normalizedArgs = args[0] === '--' ? args.slice(1) : args;
   let emailHint = process.env.TEXTCORTEX_LOGIN_EMAIL || null;
   let launchBrowser = true;
 
@@ -530,32 +610,41 @@ async function parseLoginArgs(args) {
     if (localBaseUrlFlags.has(arg)) {
       continue;
     }
-    if (arg === "--no-launch-browser") {
+    if (arg === '--no-launch-browser') {
       launchBrowser = false;
       continue;
     }
-    if (arg === "--email") {
+    if (arg === '--email') {
       emailHint = normalizedArgs[idx + 1] || null;
       idx += 1;
       continue;
     }
-    if (arg.startsWith("--email=")) {
-      emailHint = arg.slice("--email=".length) || null;
+    if (arg.startsWith('--email=')) {
+      emailHint = arg.slice('--email='.length) || null;
       continue;
     }
-    if (arg === "--help" || arg === "-h") {
-      console.log("Zenocode login options:");
-      console.log("  --email <address>      Optional email hint for tenant/SSO routing");
-      console.log(`  --local                Use the local FastAPI backend at ${localBaseUrlDefault}`);
-      console.log("  --no-launch-browser    Do not open browser automatically");
+    if (arg === '--help' || arg === '-h') {
+      console.log('Zenocode login options:');
+      console.log(
+        '  --email <address>      Optional email hint for tenant/SSO routing'
+      );
+      console.log(
+        `  --local                Use the local FastAPI backend at ${localBaseUrlDefault}`
+      );
+      console.log('  --no-launch-browser    Do not open browser automatically');
       process.exit(0);
     }
   }
 
   if (!emailHint && process.stdin.isTTY) {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const rl = readline.createInterface({
+      input: process.stdin,
+      output: process.stdout,
+    });
     try {
-      const response = (await rl.question("Email for tenant routing (optional): ")).trim();
+      const response = (
+        await rl.question('Email for tenant routing (optional): ')
+      ).trim();
       emailHint = response || null;
     } finally {
       rl.close();
@@ -567,15 +656,19 @@ async function parseLoginArgs(args) {
 
 function isFetchFailedError(error) {
   const message = error instanceof Error ? error.message : String(error);
-  return message.includes("fetch failed");
+  return message.includes('fetch failed');
 }
 
 function isLoginRouteNotFoundError(error) {
   const message = error instanceof Error ? error.message : String(error);
-  return message.includes("Login initiate failed (404)");
+  return message.includes('Login initiate failed (404)');
 }
 
-export function shouldFallbackLoginToCloud({ baseUrl, hasExplicitBaseUrl, error }) {
+export function shouldFallbackLoginToCloud({
+  baseUrl,
+  hasExplicitBaseUrl,
+  error,
+}) {
   if (hasExplicitBaseUrl || baseUrl !== localBaseUrlDefault) {
     return false;
   }
@@ -608,28 +701,28 @@ function _loginConnectivityHelp(baseUrl) {
   return [
     `Cannot reach Zenocode auth endpoint at ${baseUrl}.`,
     `Set TEXTCORTEX_BASE_URL to ${cloudBaseUrlDefault} or, for local development, run local backend FastAPI (\`cd backend && uv run dev_fastapi\`).`,
-  ].join(" ");
+  ].join(' ');
 }
 
 async function openBrowser(url) {
   let cmd;
   let args;
-  if (process.platform === "darwin") {
-    cmd = "open";
+  if (process.platform === 'darwin') {
+    cmd = 'open';
     args = [url];
-  } else if (process.platform === "win32") {
-    cmd = "cmd";
-    args = ["/c", "start", "", url];
+  } else if (process.platform === 'win32') {
+    cmd = 'cmd';
+    args = ['/c', 'start', '', url];
   } else {
-    cmd = "xdg-open";
+    cmd = 'xdg-open';
     args = [url];
   }
 
   return new Promise((resolve) => {
     try {
-      const child = spawn(cmd, args, { stdio: "ignore" });
-      child.on("error", () => resolve(false));
-      child.on("exit", (code) => resolve(code === 0));
+      const child = spawn(cmd, args, { stdio: 'ignore' });
+      child.on('error', () => resolve(false));
+      child.on('exit', (code) => resolve(code === 0));
     } catch {
       resolve(false);
     }
@@ -640,49 +733,67 @@ async function initiateDeviceLogin(baseUrl, emailHint) {
   const initiateUrl = new URL(oauthInitiatePath, baseUrl).toString();
   const body = emailHint ? { email_hint: emailHint } : {};
   const { response, payload, text } = await requestJson(initiateUrl, {
-    method: "POST",
-    headers: { "Content-Type": "application/json", Accept: "application/json" },
+    method: 'POST',
+    headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
     body: JSON.stringify(body),
   });
 
   if (!response.ok) {
-    const message = extractErrorMessage(payload, text || "request failed");
+    const message = extractErrorMessage(payload, text || 'request failed');
     throw new Error(`Login initiate failed (${response.status}): ${message}`);
   }
 
   const data = unwrapData(payload);
-  if (!data || typeof data !== "object") {
-    throw new Error("Login initiate failed: invalid response payload.");
+  if (!data || typeof data !== 'object') {
+    throw new Error('Login initiate failed: invalid response payload.');
   }
 
-  const deviceCode = typeof data.device_code === "string" ? data.device_code : null;
-  const userCode = typeof data.user_code === "string" ? data.user_code : null;
-  const verificationUrl = typeof data.verification_url_complete === "string" ? data.verification_url_complete : null;
-  const interval = Number.isFinite(Number(data.interval)) ? Number(data.interval) : 5;
-  const expiresIn = Number.isFinite(Number(data.expires_in)) ? Number(data.expires_in) : 600;
+  const deviceCode =
+    typeof data.device_code === 'string' ? data.device_code : null;
+  const userCode = typeof data.user_code === 'string' ? data.user_code : null;
+  const verificationUrl =
+    typeof data.verification_url_complete === 'string'
+      ? data.verification_url_complete
+      : null;
+  const interval = Number.isFinite(Number(data.interval))
+    ? Number(data.interval)
+    : 5;
+  const expiresIn = Number.isFinite(Number(data.expires_in))
+    ? Number(data.expires_in)
+    : 600;
 
   if (!deviceCode || !userCode || !verificationUrl) {
-    throw new Error("Login initiate failed: incomplete device authorization payload.");
+    throw new Error(
+      'Login initiate failed: incomplete device authorization payload.'
+    );
   }
 
   return { deviceCode, userCode, verificationUrl, interval, expiresIn };
 }
 
-async function pollDeviceToken(baseUrl, deviceCode, intervalSeconds, expiresInSeconds) {
+async function pollDeviceToken(
+  baseUrl,
+  deviceCode,
+  intervalSeconds,
+  expiresInSeconds
+) {
   const deadline = Date.now() + Math.max(expiresInSeconds, 1) * 1000;
   const pollUrl = new URL(oauthTokenPath, baseUrl).toString();
 
   while (Date.now() <= deadline) {
     const { response, payload, text } = await requestJson(pollUrl, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", Accept: "application/json" },
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        Accept: 'application/json',
+      },
       body: JSON.stringify({ device_code: deviceCode }),
     });
 
     if (response.status === 200) {
       const data = unwrapData(payload);
       if (!data?.access_token || !data?.refresh_token) {
-        throw new Error("Token endpoint returned incomplete credentials.");
+        throw new Error('Token endpoint returned incomplete credentials.');
       }
       return data;
     }
@@ -692,11 +803,13 @@ async function pollDeviceToken(baseUrl, deviceCode, intervalSeconds, expiresInSe
       continue;
     }
 
-    const message = extractErrorMessage(payload, text || "request failed");
-    throw new Error(`Login token exchange failed (${response.status}): ${message}`);
+    const message = extractErrorMessage(payload, text || 'request failed');
+    throw new Error(
+      `Login token exchange failed (${response.status}): ${message}`
+    );
   }
 
-  throw new Error("Device code expired. Please run login again.");
+  throw new Error('Device code expired. Please run login again.');
 }
 
 async function saveRuntimeCredentials(baseUrl, tokenData) {
@@ -716,6 +829,7 @@ async function saveRuntimeCredentials(baseUrl, tokenData) {
   await clearLogoutMarker();
 }
 
+/** Complete device login, persist its credentials, and return that exact session. */
 async function runLoginCommand(baseUrl, args, options = {}) {
   const preferLocalhost = options.preferLocalhost === true;
   const { emailHint, launchBrowser } = await parseLoginArgs(args);
@@ -724,15 +838,17 @@ async function runLoginCommand(baseUrl, args, options = {}) {
   try {
     login = await initiateDeviceLogin(resolvedBaseUrl, emailHint);
   } catch (error) {
-    if (shouldFallbackLoginToCloud({
-      baseUrl: resolvedBaseUrl,
-      hasExplicitBaseUrl:
-        Boolean(process.env.TEXTCORTEX_BASE_URL) || preferLocalhost,
-      error,
-    })) {
+    if (
+      shouldFallbackLoginToCloud({
+        baseUrl: resolvedBaseUrl,
+        hasExplicitBaseUrl:
+          Boolean(process.env.TEXTCORTEX_BASE_URL) || preferLocalhost,
+        error,
+      })
+    ) {
       resolvedBaseUrl = cloudBaseUrlDefault;
       console.log(
-        `Local backend not reachable at ${localBaseUrlDefault}. Falling back to ${cloudBaseUrlDefault}.`,
+        `Local backend not reachable at ${localBaseUrlDefault}. Falling back to ${cloudBaseUrlDefault}.`
       );
       try {
         login = await initiateDeviceLogin(resolvedBaseUrl, emailHint);
@@ -753,16 +869,18 @@ async function runLoginCommand(baseUrl, args, options = {}) {
     }
   }
 
-  console.log("\nComplete authorization in your browser:");
+  console.log('\nComplete authorization in your browser:');
   console.log(`  ${login.verificationUrl}`);
   console.log(`User code: ${login.userCode}\n`);
 
   if (launchBrowser) {
     const launched = await openBrowser(login.verificationUrl);
     if (!launched) {
-      console.log("Unable to open a browser automatically. Open the URL above manually.");
+      console.log(
+        'Unable to open a browser automatically. Open the URL above manually.'
+      );
     } else {
-      console.log("Opened browser for authentication.");
+      console.log('Opened browser for authentication.');
     }
   }
 
@@ -770,13 +888,14 @@ async function runLoginCommand(baseUrl, args, options = {}) {
     resolvedBaseUrl,
     login.deviceCode,
     login.interval,
-    login.expiresIn,
+    login.expiresIn
   );
   await saveRuntimeCredentials(resolvedBaseUrl, tokenData);
 
   const account = resolveLoginSuccessIdentifier(tokenData);
   console.log(`Login successful for ${account}.`);
   console.log(`Credentials saved to ${runtimeCredentialsPath}`);
+  return { token: tokenData.access_token, baseUrl: resolvedBaseUrl };
 }
 
 async function runLogoutCommand() {
@@ -786,7 +905,7 @@ async function runLogoutCommand() {
       await fs.unlink(credentialsPath);
       removedAnyCredentials = true;
     } catch (error) {
-      if (error?.code === "ENOENT") {
+      if (error?.code === 'ENOENT') {
         continue;
       }
       throw error;
@@ -795,25 +914,27 @@ async function runLogoutCommand() {
 
   const fallbackCredentialsPresent = (
     await Promise.all(
-      fallbackCredentialFiles.map((credentialsPath) => _pathExists(credentialsPath)),
+      fallbackCredentialFiles.map((credentialsPath) =>
+        _pathExists(credentialsPath)
+      )
     )
   ).some(Boolean);
 
   if (removedAnyCredentials || fallbackCredentialsPresent) {
     await writeLogoutMarker();
-    console.log("Zenocode session cleared.");
+    console.log('Zenocode session cleared.');
     return;
   }
 
-  console.log("No local Zenocode credentials found.");
+  console.log('No local Zenocode credentials found.');
 }
 
 async function runChild(command, args, options) {
   return new Promise((resolve, reject) => {
     try {
       const child = spawn(command, args, options);
-      child.on("error", reject);
-      child.on("exit", (code, signal) => resolve({ code, signal }));
+      child.on('error', reject);
+      child.on('exit', (code, signal) => resolve({ code, signal }));
     } catch (error) {
       reject(error);
     }
@@ -821,19 +942,19 @@ async function runChild(command, args, options) {
 }
 
 function _buildScriptCommand(runtimeBinaryPath, args, transcriptPath) {
-  if (process.platform === "darwin") {
+  if (process.platform === 'darwin') {
     return {
-      command: "script",
-      args: ["-q", "-F", "-t", "0", transcriptPath, runtimeBinaryPath, ...args],
+      command: 'script',
+      args: ['-q', '-F', '-t', '0', transcriptPath, runtimeBinaryPath, ...args],
     };
   }
-  if (process.platform === "linux") {
+  if (process.platform === 'linux') {
     const shellCommand = [runtimeBinaryPath, ...args]
       .map((value) => `'${String(value).replaceAll("'", `'\\''`)}'`)
-      .join(" ");
+      .join(' ');
     return {
-      command: "script",
-      args: ["-q", "-f", "-c", shellCommand, transcriptPath],
+      command: 'script',
+      args: ['-q', '-f', '-c', shellCommand, transcriptPath],
     };
   }
   return null;
@@ -842,10 +963,10 @@ function _buildScriptCommand(runtimeBinaryPath, args, transcriptPath) {
 async function _readTranscriptUpdate(transcriptPath, offset) {
   let handle;
   try {
-    handle = await fs.open(transcriptPath, "r");
+    handle = await fs.open(transcriptPath, 'r');
   } catch (error) {
-    if (error?.code === "ENOENT") {
-      return { offset, text: "" };
+    if (error?.code === 'ENOENT') {
+      return { offset, text: '' };
     }
     throw error;
   }
@@ -853,13 +974,13 @@ async function _readTranscriptUpdate(transcriptPath, offset) {
   try {
     const stats = await handle.stat();
     if (stats.size <= offset) {
-      return { offset, text: "" };
+      return { offset, text: '' };
     }
 
     const length = stats.size - offset;
     const buffer = Buffer.alloc(length);
     await handle.read(buffer, 0, length, offset);
-    return { offset: stats.size, text: buffer.toString("utf-8") };
+    return { offset: stats.size, text: buffer.toString('utf-8') };
   } finally {
     await handle.close();
   }
@@ -870,44 +991,61 @@ async function _terminateChildProcess(child, exitPromise) {
     return exitPromise;
   }
 
-  child.kill("SIGTERM");
-  const exited = await Promise.race([exitPromise, sleep(1_500).then(() => null)]);
+  child.kill('SIGTERM');
+  const exited = await Promise.race([
+    exitPromise,
+    sleep(1_500).then(() => null),
+  ]);
   if (exited) {
     return exited;
   }
 
-  child.kill("SIGKILL");
+  child.kill('SIGKILL');
   return exitPromise;
 }
 
-async function _runRuntimeWithTranscriptMonitor(runtimeBinaryPath, args, options) {
-  const transcriptDir = await fs.mkdtemp(path.join(os.tmpdir(), "zenocode-runtime-"));
-  const transcriptPath = path.join(transcriptDir, "session.log");
+async function _runRuntimeWithTranscriptMonitor(
+  runtimeBinaryPath,
+  args,
+  options
+) {
+  const transcriptDir = await fs.mkdtemp(
+    path.join(os.tmpdir(), 'zenocode-runtime-')
+  );
+  const transcriptPath = path.join(transcriptDir, 'session.log');
   const command = _buildScriptCommand(runtimeBinaryPath, args, transcriptPath);
   if (!command) {
-    const result = await runChild(runtimeBinaryPath, args, { ...options, stdio: "inherit" });
+    const result = await runChild(runtimeBinaryPath, args, {
+      ...options,
+      stdio: 'inherit',
+    });
     return { ...result, expiredSession: false };
   }
 
   try {
     const child = spawn(command.command, command.args, {
       ...options,
-      stdio: "inherit",
+      stdio: 'inherit',
     });
     const exitPromise = new Promise((resolve, reject) => {
-      child.on("error", reject);
-      child.on("exit", (code, signal) => resolve({ code, signal, expiredSession: false }));
+      child.on('error', reject);
+      child.on('exit', (code, signal) =>
+        resolve({ code, signal, expiredSession: false })
+      );
     });
     let transcriptOffset = 0;
-    let transcriptTail = "";
+    let transcriptTail = '';
 
     while (true) {
       const outcome = await Promise.race([
-        exitPromise.then((result) => ({ type: "exit", result })),
-        sleep(250).then(() => ({ type: "poll" })),
+        exitPromise.then((result) => ({ type: 'exit', result })),
+        sleep(250).then(() => ({ type: 'poll' })),
       ]);
 
-      const update = await _readTranscriptUpdate(transcriptPath, transcriptOffset);
+      const update = await _readTranscriptUpdate(
+        transcriptPath,
+        transcriptOffset
+      );
       transcriptOffset = update.offset;
       if (update.text) {
         transcriptTail = _appendTranscriptTail(transcriptTail, update.text);
@@ -918,15 +1056,18 @@ async function _runRuntimeWithTranscriptMonitor(runtimeBinaryPath, args, options
         return { expiredSession: true };
       }
 
-      if (outcome.type === "exit") {
+      if (outcome.type === 'exit') {
         return canRecoverRuntimeSessionFromTranscript(transcriptTail)
           ? { expiredSession: true }
           : outcome.result;
       }
     }
   } catch (error) {
-    if (error?.code === "ENOENT") {
-      const result = await runChild(runtimeBinaryPath, args, { ...options, stdio: "inherit" });
+    if (error?.code === 'ENOENT') {
+      const result = await runChild(runtimeBinaryPath, args, {
+        ...options,
+        stdio: 'inherit',
+      });
       return { ...result, expiredSession: false };
     }
     throw error;
@@ -935,9 +1076,17 @@ async function _runRuntimeWithTranscriptMonitor(runtimeBinaryPath, args, options
   }
 }
 
-async function runRuntimeBinary(runtimeBinaryPath, args, options, monitorRuntimeSession) {
+async function runRuntimeBinary(
+  runtimeBinaryPath,
+  args,
+  options,
+  monitorRuntimeSession
+) {
   if (!monitorRuntimeSession) {
-    const result = await runChild(runtimeBinaryPath, args, { ...options, stdio: "inherit" });
+    const result = await runChild(runtimeBinaryPath, args, {
+      ...options,
+      stdio: 'inherit',
+    });
     return { ...result, expiredSession: false };
   }
   return _runRuntimeWithTranscriptMonitor(runtimeBinaryPath, args, options);
@@ -951,396 +1100,106 @@ function exitWithChildResult(result) {
   process.exit(result.code ?? 0);
 }
 
-function _runnerCommand(command) {
-  return process.platform === "win32" ? `${command}.cmd` : command;
-}
-
-function _runtimeBrandedBinaryPath() {
-  const binaryName = process.platform === "win32" ? "opencode-runtime.exe" : "opencode-runtime";
-  return path.join(runtimeDir, "bin", binaryName);
-}
-
-export function packageNameFromSpecifier(packageSpecifier) {
-  if (!packageSpecifier.includes("@")) {
-    return packageSpecifier;
-  }
-  if (!packageSpecifier.startsWith("@")) {
-    return packageSpecifier.split("@")[0];
-  }
-
-  const versionSeparator = packageSpecifier.lastIndexOf("@");
-  return versionSeparator > packageSpecifier.indexOf("/")
-    ? packageSpecifier.slice(0, versionSeparator)
-    : packageSpecifier;
-}
-
-function shouldPatchOpencodeRuntimePackage(packageName) {
-  const runtimePackageName = packageNameFromSpecifier(packageName);
-  return (
-    runtimePackageName.endsWith("/opencode-ai") ||
-    runtimePackageName.endsWith("/zenocode-ai") ||
-    runtimePackageName === openCodePackageName
-  );
-}
-
-async function _pathExists(pathToCheck) {
-  try {
-    await fs.access(pathToCheck);
-    return true;
-  } catch {
-    return false;
-  }
-}
-
-async function _collectPnpmDlxPnpmDirs(rootDir) {
-  const queue = [{ dir: rootDir, depth: 0 }];
-  const pnpmDirs = [];
-
-  while (queue.length) {
-    const current = queue.shift();
-    const nodeModulesPnpm = path.join(current.dir, "node_modules", ".pnpm");
-    if (await _pathExists(nodeModulesPnpm)) {
-      pnpmDirs.push(nodeModulesPnpm);
-    }
-
-    if (current.depth >= 3) continue;
-    let entries = [];
-    try {
-      entries = await fs.readdir(current.dir, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      if (entry.name === "node_modules") continue;
-      queue.push({ dir: path.join(current.dir, entry.name), depth: current.depth + 1 });
-    }
-  }
-
-  return pnpmDirs;
-}
-
-async function _collectNodeModulesDirs(rootDir) {
-  const queue = [{ dir: rootDir, depth: 0 }];
-  const nodeModulesDirs = [];
-
-  while (queue.length) {
-    const current = queue.shift();
-    const nodeModulesPath = path.join(current.dir, "node_modules");
-    if (await _pathExists(nodeModulesPath)) {
-      nodeModulesDirs.push(nodeModulesPath);
-    }
-
-    if (current.depth >= 3) continue;
-    let entries = [];
-    try {
-      entries = await fs.readdir(current.dir, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const entry of entries) {
-      if (!entry.isDirectory()) continue;
-      if (entry.name === "node_modules") continue;
-      queue.push({ dir: path.join(current.dir, entry.name), depth: current.depth + 1 });
-    }
-  }
-
-  return nodeModulesDirs;
-}
-
-async function _collectOpencodeBinariesFromNodeModules(nodeModulesPath) {
-  const binaryName = process.platform === "win32" ? "opencode.exe" : "opencode";
-  const hiddenCachedBinaryName = ".opencode";
-  const candidates = [];
-
-  let topLevel = [];
-  try {
-    topLevel = await fs.readdir(nodeModulesPath, { withFileTypes: true });
-  } catch {
-    return candidates;
-  }
-
-  for (const moduleEntry of topLevel) {
-    if (!moduleEntry.isDirectory()) continue;
-
-    if (moduleEntry.name === openCodePackageName) {
-      const cachedPath = path.join(nodeModulesPath, openCodePackageName, "bin", hiddenCachedBinaryName);
-      if (await _pathExists(cachedPath)) candidates.push(cachedPath);
-      continue;
-    }
-
-    if (moduleEntry.name.startsWith("opencode-")) {
-      const binaryPath = path.join(nodeModulesPath, moduleEntry.name, "bin", binaryName);
-      if (await _pathExists(binaryPath)) candidates.push(binaryPath);
-      continue;
-    }
-
-    if (!moduleEntry.name.startsWith("@")) continue;
-    const scopePath = path.join(nodeModulesPath, moduleEntry.name);
-    let scopedPackages = [];
-    try {
-      scopedPackages = await fs.readdir(scopePath, { withFileTypes: true });
-    } catch {
-      continue;
-    }
-    for (const scopedPackage of scopedPackages) {
-      if (!scopedPackage.isDirectory()) continue;
-      const scopedNodeModulesPath = path.join(scopePath, scopedPackage.name);
-
-      if (scopedPackage.name === "opencode-ai") {
-        const cachedPath = path.join(scopedNodeModulesPath, "bin", hiddenCachedBinaryName);
-        if (await _pathExists(cachedPath)) candidates.push(cachedPath);
-        continue;
-      }
-
-      if (!scopedPackage.name.startsWith("opencode-")) continue;
-      const binaryPath = path.join(scopedNodeModulesPath, "bin", binaryName);
-      if (await _pathExists(binaryPath)) candidates.push(binaryPath);
-    }
+function _windowsNpxCliCandidates(execPath, env) {
+  const candidates = [
+    path.win32.join(
+      path.win32.dirname(execPath),
+      'node_modules',
+      'npm',
+      'bin',
+      'npx-cli.js'
+    ),
+  ];
+  const npmExecPath = env.npm_execpath || '';
+  if (/npm-cli\.js$/i.test(npmExecPath)) {
+    candidates.push(
+      path.win32.join(path.win32.dirname(npmExecPath), 'npx-cli.js')
+    );
   }
-
   return candidates;
 }
 
-async function _collectPnpmDlxOpencodeBinaries() {
-  const dlxRoots = [
-    path.join(os.homedir(), "Library", "Caches", "pnpm", "dlx"),
-    path.join(os.homedir(), ".cache", "pnpm", "dlx"),
-    path.join(process.env.LOCALAPPDATA || "", "pnpm", "dlx"),
-  ].filter(Boolean);
-
-  const candidates = [];
-
-  for (const root of dlxRoots) {
-    if (!(await _pathExists(root))) continue;
-    const pnpmDirs = await _collectPnpmDlxPnpmDirs(root);
-    for (const pnpmDir of pnpmDirs) {
-      let entries = [];
-      try {
-        entries = await fs.readdir(pnpmDir, { withFileTypes: true });
-      } catch {
-        continue;
-      }
-
-      for (const entry of entries) {
-        if (!entry.isDirectory()) continue;
-        const nodeModulesPath = path.join(pnpmDir, entry.name, "node_modules");
-        if (!(await _pathExists(nodeModulesPath))) continue;
-
-        candidates.push(...await _collectOpencodeBinariesFromNodeModules(nodeModulesPath));
-      }
-    }
-  }
-
-  return [...new Set(candidates)];
-}
-
-async function _collectNpxOpencodeBinaries() {
-  const npxRoots = [
-    path.join(os.homedir(), ".npm", "_npx"),
-    path.join(process.env.LOCALAPPDATA || "", "npm-cache", "_npx"),
-  ].filter(Boolean);
-  const candidates = [];
-
-  for (const root of npxRoots) {
-    if (!(await _pathExists(root))) continue;
-    const nodeModulesDirs = await _collectNodeModulesDirs(root);
-    for (const nodeModulesDir of nodeModulesDirs) {
-      candidates.push(...await _collectOpencodeBinariesFromNodeModules(nodeModulesDir));
-    }
-  }
-
-  return [...new Set(candidates)];
-}
-
-function _buildPackageWarmupArgs(packageName, runner) {
-  if (runner.command === _runnerCommand("pnpm")) {
-    return ["dlx", packageName, "--version"];
-  }
-  if (runner.command === _runnerCommand("npx")) {
-    return ["--yes", packageName, "--version"];
-  }
-  return null;
-}
-
-async function _collectRunnerOpencodeBinaries(runner) {
-  if (runner.command === _runnerCommand("pnpm")) {
-    return _collectPnpmDlxOpencodeBinaries();
-  }
-  if (runner.command === _runnerCommand("npx")) {
-    return _collectNpxOpencodeBinaries();
+/**
+ * Return the package runners to try, in order, for launching `packageName`.
+ *
+ * On Windows, pnpm/npx are installed as `.cmd` shims, and Node >= 18.20.2 /
+ * 20.12.2 refuses to spawn batch files without a shell (CVE-2024-27980),
+ * failing with `spawn EINVAL`. Windows runners are therefore real executables:
+ * the standalone `pnpm.exe`, then npm's `npx-cli.js` run through the current
+ * Node binary. A shell is deliberately avoided so user arguments never pass
+ * through cmd.exe parsing.
+ */
+export function resolvePackageRunners(
+  packageName,
+  args,
+  {
+    platform = process.platform,
+    execPath = process.execPath,
+    env = process.env,
+    fileExists = existsSync,
+  } = {}
+) {
+  if (platform !== 'win32') {
+    return [
+      { command: 'pnpm', args: ['dlx', packageName, ...args] },
+      { command: 'npx', args: ['--yes', packageName, ...args] },
+    ];
   }
-  return [];
-}
 
-async function _adHocSignBinary(binaryPath) {
-  if (process.platform !== "darwin") return;
-  try {
-    await runChild("codesign", ["--force", "--sign", "-", binaryPath], {
-      stdio: "ignore",
+  const runners = [
+    { command: 'pnpm.exe', args: ['dlx', packageName, ...args] },
+  ];
+  const npxCli = _windowsNpxCliCandidates(execPath, env).find((candidate) =>
+    fileExists(candidate)
+  );
+  if (npxCli) {
+    runners.push({
+      command: execPath,
+      args: [npxCli, '--yes', packageName, ...args],
     });
-  } catch {
-    // If ad-hoc signing fails, keep going; runtime may still work on systems that do not enforce signatures.
-  }
-}
-
-async function _patchOpencodeBinaryBranding(binaryPath) {
-  let buffer;
-  try {
-    buffer = await fs.readFile(binaryPath);
-  } catch {
-    return false;
-  }
-
-  const originalLength = buffer.length;
-  let text = buffer.toString("latin1");
-  const patch = patchZenocodeBinaryText(text);
-  text = patch.text;
-  const patched = patch.patched;
-
-  if (!patched) {
-    return false;
-  }
-
-  buffer = Buffer.from(text, "latin1");
-  if (buffer.length !== originalLength) {
-    return false;
-  }
-
-  await fs.writeFile(binaryPath, buffer);
-  if (process.platform !== "win32") {
-    await fs.chmod(binaryPath, 0o755);
-  }
-  await _adHocSignBinary(binaryPath);
-  return true;
-}
-
-async function _preparePinnedRuntimeBinary(binaryCandidates) {
-  if (!binaryCandidates.length) return null;
-  const runtimeBinaryPath = _runtimeBrandedBinaryPath();
-  const stats = await Promise.all(binaryCandidates.map(async (binaryPath) => ({
-    binaryPath,
-    mtimeMs: (await fs.stat(binaryPath)).mtimeMs,
-  })));
-  stats.sort((a, b) => b.mtimeMs - a.mtimeMs);
-
-  await fs.mkdir(path.dirname(runtimeBinaryPath), { recursive: true });
-  await fs.copyFile(stats[0].binaryPath, runtimeBinaryPath);
-  if (process.platform !== "win32") {
-    await fs.chmod(runtimeBinaryPath, 0o755);
-  }
-  await _patchOpencodeBinaryBranding(runtimeBinaryPath);
-  await _adHocSignBinary(runtimeBinaryPath);
-  return runtimeBinaryPath;
-}
-
-async function _ensurePatchedOpencodeDlxBinaries(packageName, runner, options) {
-  if (!shouldPatchOpencodeRuntimePackage(packageName)) {
-    return null;
-  }
-  if (
-    process.env.ZENOCODE_DISABLE_OPENCODE_LOGO_PATCH === "1" ||
-    process.env.CODECORTEX_DISABLE_OPENCODE_LOGO_PATCH === "1"
-  ) {
-    return null;
-  }
-
-  const warmupArgs = _buildPackageWarmupArgs(packageName, runner);
-  try {
-    if (warmupArgs) {
-      await runChild(runner.command, warmupArgs, {
-        ...options,
-        stdio: "ignore",
-      });
-    }
-  } catch {
-    // ignore warm-up failures and continue with best effort patching
   }
-  const binaryCandidates = await _collectRunnerOpencodeBinaries(runner);
-
-  if (!binaryCandidates.length) {
-    return null;
-  }
-
-  let patchedCount = 0;
-  for (const binaryPath of binaryCandidates) {
-    const patched = await _patchOpencodeBinaryBranding(binaryPath);
-    if (patched) patchedCount += 1;
-  }
-
-  if (patchedCount > 0) {
-    console.log(`Patched Zenocode branding in ${patchedCount} OpenCode runtime ${patchedCount > 1 ? "binaries" : "binary"}.`);
-  }
-
-  return _preparePinnedRuntimeBinary(binaryCandidates);
+  return runners;
 }
 
-/**
- * Mirror direct runtime launches so fallback package runners stay interactive.
- */
-export function buildPackageLauncherChildOptions(options, pinnedRuntimePath) {
+export function buildPackageLauncherChildOptions(options) {
   return {
     ...options,
-    stdio: "inherit",
+    stdio: 'inherit',
     env: {
       ...(options.env || {}),
-      ...(pinnedRuntimePath ? { OPENCODE_BIN_PATH: pinnedRuntimePath } : {}),
     },
   };
 }
 
-export function buildPackageLauncherInvocation({ runner, args, pinnedRuntimePath }) {
-  if (pinnedRuntimePath) {
-    return {
-      command: pinnedRuntimePath,
-      args,
-      usePinnedRuntime: true,
-    };
-  }
-
+export function buildPackageLauncherInvocation({ runner }) {
   return {
     command: runner.command,
     args: runner.args,
-    usePinnedRuntime: false,
   };
 }
 
-async function runPackageLauncher(packageName, args, options) {
-  const runners = [
-    { command: _runnerCommand("pnpm"), args: ["dlx", packageName, ...args] },
-    { command: _runnerCommand("npx"), args: ["--yes", packageName, ...args] },
-  ];
+async function runPackageLauncher(
+  packageName,
+  args,
+  options,
+  monitorRuntimeSession = false
+) {
+  const runners = resolvePackageRunners(packageName, args);
   const missingRunners = [];
 
   for (const runner of runners) {
     try {
-      let pinnedRuntimePath = await _ensurePatchedOpencodeDlxBinaries(packageName, runner, options);
-      if (!pinnedRuntimePath && shouldPatchOpencodeRuntimePackage(packageName)) {
-        const existingPinnedPath = _runtimeBrandedBinaryPath();
-        if (await _pathExists(existingPinnedPath)) {
-          pinnedRuntimePath = existingPinnedPath;
-        }
-      }
-
       const invocation = buildPackageLauncherInvocation({
         runner,
-        args,
-        pinnedRuntimePath,
       });
-      const childOptions = buildPackageLauncherChildOptions(
-        options,
-        invocation.usePinnedRuntime ? null : pinnedRuntimePath,
+      return await runRuntimeBinary(
+        invocation.command,
+        invocation.args,
+        buildPackageLauncherChildOptions(options),
+        monitorRuntimeSession
       );
-
-      const result = await runChild(invocation.command, invocation.args, childOptions);
-      if (result.signal) {
-        process.kill(process.pid, result.signal);
-        return;
-      }
-      process.exit(result.code ?? 0);
-      return;
     } catch (error) {
-      if (error?.code === "ENOENT") {
+      if (error?.code === 'ENOENT') {
         missingRunners.push(runner.command);
         continue;
       }
@@ -1349,48 +1208,11 @@ async function runPackageLauncher(packageName, args, options) {
   }
 
   throw new Error(
-    `No package runner found (${missingRunners.join(", ")}). Install pnpm or npm, or set ZENOCODE_OPENCODE_BIN_PATH/CODECORTEX_OPENCODE_BIN_PATH.`,
+    `No package runner found (${missingRunners.join(', ')}). Install pnpm or npm, or set ZENOCODE_OPENCODE_BIN_PATH/CODECORTEX_OPENCODE_BIN_PATH.`
   );
 }
 
-async function resolvePinnedRuntimeBinary(packageName, options) {
-  const runners = [
-    { command: _runnerCommand("pnpm"), args: ["dlx", packageName] },
-    { command: _runnerCommand("npx"), args: ["--yes", packageName] },
-  ];
-  const missingRunners = [];
-
-  for (const runner of runners) {
-    try {
-      let pinnedRuntimePath = await _ensurePatchedOpencodeDlxBinaries(packageName, runner, options);
-      if (!pinnedRuntimePath && shouldPatchOpencodeRuntimePackage(packageName)) {
-        const existingPinnedPath = _runtimeBrandedBinaryPath();
-        if (await _pathExists(existingPinnedPath)) {
-          pinnedRuntimePath = existingPinnedPath;
-        }
-      }
-
-      if (pinnedRuntimePath) {
-        return pinnedRuntimePath;
-      }
-    } catch (error) {
-      if (error?.code === "ENOENT") {
-        missingRunners.push(runner.command);
-        continue;
-      }
-      throw error;
-    }
-  }
-
-  if (missingRunners.length === runners.length) {
-    throw new Error(
-      `No package runner found (${missingRunners.join(", ")}). Install pnpm or npm, or set ZENOCODE_OPENCODE_BIN_PATH/CODECORTEX_OPENCODE_BIN_PATH.`,
-    );
-  }
-
-  return null;
-}
-
+/** Relaunch the runtime with a refreshed or newly issued session after auth expiry. */
 export async function runRuntimeWithSessionRecovery({
   args,
   baseUrl,
@@ -1431,7 +1253,7 @@ export async function runRuntimeWithSessionRecovery({
 
     if (recoveryAttempts >= maxRecoveryAttempts) {
       throw new Error(
-        `Zenocode session recovery failed after ${maxRecoveryAttempts} attempts. Run \`zenocode login\` and try again.`,
+        `Zenocode session recovery failed after ${maxRecoveryAttempts} attempts. Run \`zenocode login\` and try again.`
       );
     }
     recoveryAttempts += 1;
@@ -1443,7 +1265,7 @@ export async function runRuntimeWithSessionRecovery({
       await prepareRuntimeFn(activeBaseUrl, activeToken);
       const retryDelayMs = Math.min(
         Math.max(recoveryDelayMs, 0) * recoveryAttempts,
-        3_000,
+        3_000
       );
       if (retryDelayMs > 0) {
         await sleepFn(retryDelayMs);
@@ -1455,21 +1277,30 @@ export async function runRuntimeWithSessionRecovery({
       }
     }
 
-    console.log("Zenocode session expired. Starting login flow...\n");
-    await runLogin(activeBaseUrl, buildAutoLoginArgs({ preferLocalhost }), {
-      preferLocalhost,
-    });
-    activeToken = await resolveTokenFn();
-    activeBaseUrl =
-      resolveTextCortexBaseUrl({
-        envBaseUrl: process.env.TEXTCORTEX_BASE_URL,
-        storedBaseUrl: await resolveStoredBaseUrlFn(),
+    console.log('Zenocode session expired. Starting login flow...\n');
+    const loginResult = await runLogin(
+      activeBaseUrl,
+      buildAutoLoginArgs({ preferLocalhost }),
+      {
         preferLocalhost,
-      }) || activeBaseUrl;
+      }
+    );
+    if (loginResult?.token && loginResult?.baseUrl) {
+      activeToken = loginResult.token;
+      activeBaseUrl = loginResult.baseUrl;
+    } else {
+      activeToken = await resolveTokenFn();
+      activeBaseUrl =
+        resolveTextCortexBaseUrl({
+          envBaseUrl: process.env.TEXTCORTEX_BASE_URL,
+          storedBaseUrl: await resolveStoredBaseUrlFn(),
+          preferLocalhost,
+        }) || activeBaseUrl;
+    }
     await prepareRuntimeFn(activeBaseUrl, activeToken);
     const retryDelayMs = Math.min(
       Math.max(recoveryDelayMs, 0) * recoveryAttempts,
-      3_000,
+      3_000
     );
     if (retryDelayMs > 0) {
       await sleepFn(retryDelayMs);
@@ -1477,71 +1308,57 @@ export async function runRuntimeWithSessionRecovery({
   }
 }
 
-async function packageExistsOnNpm(packageName) {
-  const packageSpecName = packageNameFromSpecifier(packageName);
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), 4_000);
-  try {
-    const response = await fetch(`https://registry.npmjs.org/${encodeURIComponent(packageSpecName)}`, {
-      method: "GET",
-      headers: { Accept: "application/json" },
-      signal: controller.signal,
-    });
-    return response.ok;
-  } catch {
-    return false;
-  } finally {
-    clearTimeout(timeout);
-  }
+export function resolveLaunchPackage() {
+  return opencodePackage;
 }
 
-async function resolveLaunchPackage() {
-  if (configuredOpencodePackage) {
-    return configuredOpencodePackage;
+/** Return launcher-owned guidance for runtime package-management commands. */
+export function zenocodeOwnedCommandMessage(args) {
+  if (args[0] === 'upgrade') {
+    return [
+      'Zenocode updates are managed by the @textcortex/zenocode package.',
+      'Run `npm install -g @textcortex/zenocode@latest` to update Zenocode and its managed runtime together.',
+    ].join('\n');
   }
-
-  const brandedAvailable = await packageExistsOnNpm(defaultBrandedOpencodePackage);
-  if (brandedAvailable) {
-    return defaultBrandedOpencodePackage;
+  if (args[0] === 'uninstall') {
+    return 'Run `npm uninstall -g @textcortex/zenocode` to uninstall Zenocode.';
   }
-
-  const legacyBrandedAvailable = await packageExistsOnNpm(
-    legacyBrandedOpencodePackage,
-  );
-  if (legacyBrandedAvailable) {
-    console.warn(
-      `Package ${defaultBrandedOpencodePackage} was not found on npm. Falling back to ${legacyBrandedOpencodePackage}.`,
-    );
-    return legacyBrandedOpencodePackage;
-  }
-
-  console.warn(
-    `Package ${defaultBrandedOpencodePackage} was not found on npm. Falling back to ${fallbackOpencodePackage}.`,
-  );
-  return fallbackOpencodePackage;
+  return null;
 }
 
 function shouldRenderBanner(args) {
   if (
-    process.env.ZENOCODE_NO_BANNER === "1" ||
-    process.env.CODECORTEX_NO_BANNER === "1"
+    process.env.ZENOCODE_NO_BANNER === '1' ||
+    process.env.CODECORTEX_NO_BANNER === '1'
   ) {
     return false;
   }
   if (
     !process.stdout.isTTY &&
-    process.env.ZENOCODE_FORCE_BANNER !== "1" &&
-    process.env.CODECORTEX_FORCE_BANNER !== "1"
+    process.env.ZENOCODE_FORCE_BANNER !== '1' &&
+    process.env.CODECORTEX_FORCE_BANNER !== '1'
   ) {
     return false;
   }
 
-  const suppressFlags = new Set(["--help", "-h", "--version", "-v", "completion"]);
+  const suppressFlags = new Set([
+    '--help',
+    '-h',
+    '--version',
+    '-v',
+    'completion',
+  ]);
   return !args.some((arg) => suppressFlags.has(arg));
 }
 
 export function shouldBypassZenocodePreparation(args) {
-  const metadataFlags = new Set(["--help", "-h", "--version", "-v", "completion"]);
+  const metadataFlags = new Set([
+    '--help',
+    '-h',
+    '--version',
+    '-v',
+    'completion',
+  ]);
   return metadataFlags.has(args[0]);
 }
 
@@ -1555,39 +1372,48 @@ function maybeRenderBanner(args) {
 function buildAutoLoginArgs({ preferLocalhost = false } = {}) {
   const loginArgs = [];
   if (preferLocalhost) {
-    loginArgs.push("--local");
+    loginArgs.push('--local');
   }
   if (
-    process.env.ZENOCODE_AUTO_LOGIN_NO_BROWSER === "1" ||
-    process.env.CODECORTEX_AUTO_LOGIN_NO_BROWSER === "1"
+    process.env.ZENOCODE_AUTO_LOGIN_NO_BROWSER === '1' ||
+    process.env.CODECORTEX_AUTO_LOGIN_NO_BROWSER === '1'
   ) {
-    loginArgs.push("--no-launch-browser");
+    loginArgs.push('--no-launch-browser');
   }
   return loginArgs;
 }
 
 function isMissingTokenError(error) {
   const message = error instanceof Error ? error.message : String(error);
-  return message.includes("Missing API token");
+  return message.includes('Missing API token');
 }
 
-function isExpiredSessionError(error) {
+/** Return whether a models 401 can be repaired by refreshing or replacing auth. */
+export function isRecoverableSessionError(error) {
   const message = error instanceof Error ? error.message : String(error);
-  if (!message.includes("Models fetch failed (401)")) return false;
-  return /token has expired|expired token|token expired/i.test(message);
+  if (!message.includes('Models fetch failed (401)')) return false;
+  return /token has expired|expired token|token expired|invalid token format/i.test(
+    message
+  );
 }
 
 function canAutoLogin(args) {
   if (
-    process.env.ZENOCODE_AUTO_LOGIN === "0" ||
-    process.env.CODECORTEX_AUTO_LOGIN === "0"
+    process.env.ZENOCODE_AUTO_LOGIN === '0' ||
+    process.env.CODECORTEX_AUTO_LOGIN === '0'
   ) {
     return false;
   }
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
-  if (process.env.CI === "1" || process.env.CI === "true") return false;
-
-  const suppressFlags = new Set(["--help", "-h", "--version", "-v", "completion"]);
+  if (process.env.CI === '1' || process.env.CI === 'true') return false;
+
+  const suppressFlags = new Set([
+    '--help',
+    '-h',
+    '--version',
+    '-v',
+    'completion',
+  ]);
   if (args.some((arg) => suppressFlags.has(arg))) return false;
   return true;
 }
@@ -1596,16 +1422,16 @@ const ansiSequencePattern =
   /\u001B(?:\[[0-?]*[ -/]*[@-~]|\][^\u0007]*(?:\u0007|\u001B\\)|[@-Z\\-_])/g;
 
 function _stripTerminalControlCharacters(text) {
-  let normalized = "";
+  let normalized = '';
   for (const char of text) {
-    if (char === "\b" || char === "\u007f") {
+    if (char === '\b' || char === '\u007f') {
       normalized = normalized.slice(0, -1);
       continue;
     }
-    if (char === "\r") {
+    if (char === '\r') {
       continue;
     }
-    if (char < " " && char !== "\n" && char !== "\t") {
+    if (char < ' ' && char !== '\n' && char !== '\t') {
       continue;
     }
     normalized += char;
@@ -1614,13 +1440,17 @@ function _stripTerminalControlCharacters(text) {
 }
 
 export function normalizeRuntimeTranscript(text) {
-  return _stripTerminalControlCharacters(text.replaceAll(ansiSequencePattern, ""));
+  return _stripTerminalControlCharacters(
+    text.replaceAll(ansiSequencePattern, '')
+  );
 }
 
 export function canRecoverRuntimeSessionFromTranscript(text) {
   const normalized = normalizeRuntimeTranscript(text);
   return (
-    /Unauthorized:\s*\{\s*"detail"\s*:\s*"Token has expired"\s*\}/i.test(normalized) ||
+    /Unauthorized:\s*\{\s*"detail"\s*:\s*"Token has expired"\s*\}/i.test(
+      normalized
+    ) ||
     /authentication token may be missing or expired/i.test(normalized) ||
     /server returned 401 after successful authentication/i.test(normalized)
   );
@@ -1636,6 +1466,7 @@ function shouldAttemptAutoLogin(error, args) {
   return canAutoLogin(args);
 }
 
+/** Resolve credentials, returning the exact session produced by automatic login. */
 async function resolveTokenWithAutoLogin(baseUrl, args, options = {}) {
   const preferLocalhost = options.preferLocalhost === true;
   try {
@@ -1646,27 +1477,23 @@ async function resolveTokenWithAutoLogin(baseUrl, args, options = {}) {
       throw error;
     }
 
-    console.log("No local Zenocode credentials found. Starting login flow...\n");
-    await runLoginCommand(baseUrl, buildAutoLoginArgs({ preferLocalhost }), {
-      preferLocalhost,
-    });
-    const token = await resolveToken();
-    const persistedBaseUrl = resolveTextCortexBaseUrl({
-      envBaseUrl: process.env.TEXTCORTEX_BASE_URL,
-      storedBaseUrl: await resolveStoredBaseUrl(),
+    console.log(
+      'No local Zenocode credentials found. Starting login flow...\n'
+    );
+    return runLoginCommand(baseUrl, buildAutoLoginArgs({ preferLocalhost }), {
       preferLocalhost,
     });
-    return { token, baseUrl: persistedBaseUrl };
   }
 }
 
+/** Prepare the runtime, refreshing or replacing rejected credentials when possible. */
 async function prepareRuntimeWithAutoLogin(baseUrl, token, args, options = {}) {
   const preferLocalhost = options.preferLocalhost === true;
   try {
     const model = await prepareRuntime(baseUrl, token);
     return { model, token, baseUrl };
   } catch (error) {
-    if (!isExpiredSessionError(error)) {
+    if (!isRecoverableSessionError(error)) {
       throw error;
     }
 
@@ -1680,33 +1507,31 @@ async function prepareRuntimeWithAutoLogin(baseUrl, token, args, options = {}) {
       };
     } catch {
       if (!canAutoLogin(args)) {
-        throw new Error("Zenocode session expired. Run `zenocode login` and try again.");
+        throw new Error(
+          'Zenocode session expired. Run `zenocode login` and try again.'
+        );
       }
     }
 
-    console.log("Zenocode session expired. Starting login flow...\n");
-    await runLoginCommand(baseUrl, buildAutoLoginArgs({ preferLocalhost }), {
-      preferLocalhost,
-    });
-    const refreshedToken = await resolveToken();
-    const refreshedBaseUrl = resolveTextCortexBaseUrl({
-      envBaseUrl: process.env.TEXTCORTEX_BASE_URL,
-      storedBaseUrl: await resolveStoredBaseUrl(),
-      preferLocalhost,
-    });
-    const model = await prepareRuntime(refreshedBaseUrl, refreshedToken);
-    return { model, token: refreshedToken, baseUrl: refreshedBaseUrl };
+    console.log('Zenocode session expired. Starting login flow...\n');
+    const loginResult = await runLoginCommand(
+      baseUrl,
+      buildAutoLoginArgs({ preferLocalhost }),
+      { preferLocalhost }
+    );
+    const model = await prepareRuntime(loginResult.baseUrl, loginResult.token);
+    return { model, token: loginResult.token, baseUrl: loginResult.baseUrl };
   }
 }
 
 async function main() {
   const args = process.argv.slice(2);
-  const prepareOnly = args.includes("--prepare-only");
-  const passthrough = args.filter((arg) => arg !== "--prepare-only");
+  const prepareOnly = args.includes('--prepare-only');
+  const passthrough = args.filter((arg) => arg !== '--prepare-only');
 
   // `pnpm run <script> -- ...` can forward a leading `--`; drop it so subcommands
   // like `run` / `models` / `login` are parsed here first.
-  if (passthrough[0] === "--") {
+  if (passthrough[0] === '--') {
     passthrough.shift();
   }
 
@@ -1719,42 +1544,54 @@ async function main() {
     preferLocalhost,
   });
   const subcommand = runtimeArgs[0];
+  let loginResult = null;
 
-  if (subcommand === "login") {
-    await runLoginCommand(
+  const ownedCommandMessage = zenocodeOwnedCommandMessage(runtimeArgs);
+  if (ownedCommandMessage) {
+    console.log(ownedCommandMessage);
+    return;
+  }
+
+  if (subcommand === 'login') {
+    loginResult = await runLoginCommand(
       resolveLoginBaseUrl({
         envBaseUrl: process.env.TEXTCORTEX_BASE_URL,
         preferLocalhost,
       }),
       runtimeArgs.slice(1),
-      { preferLocalhost },
+      { preferLocalhost }
     );
     runtimeArgs = [];
   }
 
-  if (subcommand === "logout") {
+  if (subcommand === 'logout') {
     await runLogoutCommand();
     return;
   }
 
   maybeRenderBanner(runtimeArgs);
   if (shouldBypassZenocodePreparation(runtimeArgs)) {
-    const launchPackage = await resolveLaunchPackage();
-    await runPackageLauncher(launchPackage, runtimeArgs, {
+    const launchPackage = resolveLaunchPackage();
+    const result = await runPackageLauncher(launchPackage, runtimeArgs, {
       cwd: process.cwd(),
       env: { ...process.env },
     });
+    exitWithChildResult(result);
     return;
   }
 
-  const tokenResolution = await resolveTokenWithAutoLogin(baseUrl, runtimeArgs, {
-    preferLocalhost,
-  });
+  const tokenResolution =
+    loginResult ||
+    (await resolveTokenWithAutoLogin(baseUrl, runtimeArgs, {
+      preferLocalhost,
+    }));
   const runtime = await prepareRuntimeWithAutoLogin(
     tokenResolution.baseUrl,
     tokenResolution.token,
     runtimeArgs,
-    { preferLocalhost },
+    {
+      preferLocalhost,
+    }
   );
   const token = runtime.token;
   const model = runtime.model;
@@ -1769,6 +1606,7 @@ async function main() {
       OPENCODE_MODELS_PATH: modelsPath,
       OPENCODE_CONFIG: configPath,
       OPENCODE_TUI_CONFIG: tuiConfigPath,
+      OPENCODE_DISABLE_AUTOUPDATE: 'true',
       TEXTCORTEX_API_KEY: token,
     },
   };
@@ -1783,29 +1621,34 @@ async function main() {
       preferLocalhost,
       canAutoLoginRuntime: monitorRuntimeSession,
       launchRuntimeFn: ({ args, childOptions }) =>
-        runRuntimeBinary(opencodeBinaryPath, args, childOptions, monitorRuntimeSession),
+        runRuntimeBinary(
+          opencodeBinaryPath,
+          args,
+          childOptions,
+          monitorRuntimeSession
+        ),
     });
     exitWithChildResult(result);
     return;
   }
 
-  const launchPackage = await resolveLaunchPackage();
-  const pinnedRuntimePath = await resolvePinnedRuntimeBinary(launchPackage, childOptions);
-  if (pinnedRuntimePath) {
-    const result = await runRuntimeWithSessionRecovery({
-      args: runtimeArgs,
-      baseUrl: runtime.baseUrl,
-      token,
-      childOptions,
-      preferLocalhost,
-      canAutoLoginRuntime: monitorRuntimeSession,
-      launchRuntimeFn: ({ args, childOptions }) =>
-        runRuntimeBinary(pinnedRuntimePath, args, childOptions, monitorRuntimeSession),
-    });
-    exitWithChildResult(result);
-    return;
-  }
-  await runPackageLauncher(launchPackage, runtimeArgs, childOptions);
+  const launchPackage = resolveLaunchPackage();
+  const result = await runRuntimeWithSessionRecovery({
+    args: runtimeArgs,
+    baseUrl: runtime.baseUrl,
+    token,
+    childOptions,
+    preferLocalhost,
+    canAutoLoginRuntime: monitorRuntimeSession,
+    launchRuntimeFn: ({ args, childOptions }) =>
+      runPackageLauncher(
+        launchPackage,
+        args,
+        childOptions,
+        monitorRuntimeSession
+      ),
+  });
+  exitWithChildResult(result);
 }
 
 const resolveExecutablePath = (value) => {
@@ -1816,7 +1659,10 @@ const resolveExecutablePath = (value) => {
   }
 };
 
-if (process.argv[1] && resolveExecutablePath(process.argv[1]) === currentFilePath) {
+if (
+  process.argv[1] &&
+  resolveExecutablePath(process.argv[1]) === currentFilePath
+) {
   main().catch((error) => {
     console.error(error instanceof Error ? error.message : String(error));
     process.exit(1);