@velum-labs/routekit-tool-codex 1.4.0 → 1.5.0

package/dist/test/install.test.js

@@ -1,9 +1,13 @@
 import assert from "node:assert/strict";
+import fs from "node:fs";
 import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { syncBuiltinESMExports } from "node:module";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { test } from "node:test";
-import { installCodexIntegration, uninstallCodexIntegration } from "../install.js";
+import { parse as tomlParse } from "smol-toml";
+import { acquireLifecycleLockSync } from "@velum-labs/routekit-runtime/service";
+import { acquireCodexConfigLock, installCodexIntegration, uninstallCodexIntegration, withCodexConfigLock } from "../install.js";
 const OWNER = {
     id: "example-host",
     displayName: "Example Host",
@@ -12,6 +16,271 @@ const OWNER = {
     uninstallCommand: "example uninstall codex",
     startCommand: "example serve"
 };
+test("Codex install sets file modes before publishing, without fallible post-commit chmod", () => {
+    const home = mkdtempSync(join(tmpdir(), "routekit-codex-atomic-mode-"));
+    const originalChmod = fs.chmodSync;
+    const publishedPaths = new Set([
+        join(home, "config.toml"),
+        join(home, "routekit.config.toml"),
+        join(home, ".example-host-model-catalog.json"),
+        join(home, ".example-host-install-pending.json")
+    ]);
+    try {
+        fs.chmodSync = (path, mode) => {
+            if (publishedPaths.has(String(path))) {
+                throw new Error(`chmod after publication: ${String(path)}`);
+            }
+            originalChmod(path, mode);
+        };
+        syncBuiltinESMExports();
+        installCodexIntegration({
+            gatewayUrl: "http://127.0.0.1:9999",
+            owner: OWNER,
+            models: [{ modelId: "provider/one" }],
+            codexHome: home
+        });
+        for (const path of publishedPaths) {
+            if (!existsSync(path))
+                continue;
+            assert.equal(fs.statSync(path).mode & 0o777, 0o600);
+        }
+    }
+    finally {
+        fs.chmodSync = originalChmod;
+        syncBuiltinESMExports();
+        rmSync(home, { recursive: true, force: true });
+    }
+});
+test("Codex committed journals survive cleanup failures without rolling back an install or uninstall", async () => {
+    const home = mkdtempSync(join(tmpdir(), "routekit-codex-journal-cleanup-"));
+    const configPath = join(home, "config.toml");
+    const installJournal = join(home, ".example-host-install-pending.json");
+    const uninstallJournal = join(home, ".example-host-uninstall-pending.json");
+    const originalRemove = fs.rmSync;
+    const input = {
+        gatewayUrl: "http://127.0.0.1:9999",
+        owner: OWNER,
+        models: [{ modelId: "provider/one" }],
+        codexHome: home
+    };
+    const failJournalCleanup = (journal) => {
+        fs.rmSync = (path, options) => {
+            if (String(path) === journal)
+                throw new Error("journal cleanup unavailable");
+            originalRemove(path, options);
+        };
+        syncBuiltinESMExports();
+    };
+    const restoreRemove = () => {
+        fs.rmSync = originalRemove;
+        syncBuiltinESMExports();
+    };
+    writeFileSync(configPath, 'model = "user-default"\n');
+    try {
+        failJournalCleanup(installJournal);
+        assert.equal(installCodexIntegration(input).action, "installed");
+        restoreRemove();
+        assert.equal(JSON.parse(readFileSync(installJournal, "utf8")).phase, "committed");
+        const installed = readFileSync(configPath, "utf8");
+        const scope = await acquireCodexConfigLock(home);
+        try {
+            scope.recover(OWNER.id);
+            assert.equal(readFileSync(configPath, "utf8"), installed);
+            assert.equal(existsSync(installJournal), false);
+        }
+        finally {
+            scope.release();
+        }
+        failJournalCleanup(uninstallJournal);
+        assert.equal(uninstallCodexIntegration({ ownerId: OWNER.id, codexHome: home }).removed, true);
+        restoreRemove();
+        assert.equal(JSON.parse(readFileSync(uninstallJournal, "utf8")).phase, "committed");
+        const uninstalled = readFileSync(configPath, "utf8");
+        assert.equal(uninstalled, 'model = "user-default"\n');
+        const nextScope = await acquireCodexConfigLock(home);
+        try {
+            nextScope.recover(OWNER.id);
+            assert.equal(readFileSync(configPath, "utf8"), uninstalled);
+            assert.equal(existsSync(join(home, "routekit.config.toml")), false);
+            assert.equal(existsSync(uninstallJournal), false);
+        }
+        finally {
+            nextScope.release();
+        }
+    }
+    finally {
+        restoreRemove();
+        rmSync(home, { recursive: true, force: true });
+    }
+});
+test("Codex config scope can retry release when lock unlink fails", async () => {
+    const home = mkdtempSync(join(tmpdir(), "routekit-codex-release-retry-"));
+    const lockPath = join(home, ".routekit-codex-config.lock");
+    const originalRemove = fs.rmSync;
+    try {
+        const scope = await acquireCodexConfigLock(home);
+        fs.rmSync = (path, options) => {
+            if (String(path) === lockPath)
+                throw new Error("lock unlink unavailable");
+            originalRemove(path, options);
+        };
+        syncBuiltinESMExports();
+        assert.throws(() => scope.release(), /lock unlink unavailable/);
+        assert.throws(() => acquireLifecycleLockSync(lockPath), /lock is busy/);
+        fs.rmSync = originalRemove;
+        syncBuiltinESMExports();
+        scope.release();
+        assert.equal(existsSync(lockPath), false);
+        assert.throws(() => scope.recover(OWNER.id), /already been released/);
+    }
+    finally {
+        fs.rmSync = originalRemove;
+        syncBuiltinESMExports();
+        rmSync(home, { recursive: true, force: true });
+    }
+});
+test("Codex install and uninstall share an owner-neutral home lock and fail closed on contention", () => {
+    const home = mkdtempSync(join(tmpdir(), "routekit-codex-config-lock-"));
+    const path = join(home, ".routekit-codex-config.lock");
+    const configPath = join(home, "config.toml");
+    const original = 'model = "user-default"\n';
+    writeFileSync(configPath, original);
+    const input = {
+        gatewayUrl: "http://127.0.0.1:9999",
+        owner: OWNER,
+        models: [{ modelId: "provider/one" }],
+        codexHome: home
+    };
+    try {
+        const first = acquireLifecycleLockSync(path);
+        try {
+            assert.throws(() => installCodexIntegration(input), /lifecycle lock is busy/);
+            assert.throws(() => uninstallCodexIntegration({ ownerId: OWNER.id, codexHome: home }), /lifecycle lock is busy/);
+            assert.equal(readFileSync(configPath, "utf8"), original);
+        }
+        finally {
+            first.release();
+        }
+        installCodexIntegration(input);
+        assert.equal(uninstallCodexIntegration({ ownerId: OWNER.id, codexHome: home }).removed, true);
+        assert.equal(readFileSync(configPath, "utf8"), original);
+    }
+    finally {
+        rmSync(home, { recursive: true, force: true });
+    }
+});
+test("async Codex scope composes owner installs without reacquiring the sync lock", async () => {
+    const home = mkdtempSync(join(tmpdir(), "routekit-codex-async-lock-"));
+    const otherHome = mkdtempSync(join(tmpdir(), "routekit-codex-other-lock-"));
+    const configPath = join(home, "config.toml");
+    const cloudOwner = {
+        ...OWNER, id: "example-cloud", providerId: "example_cloud"
+    };
+    const input = {
+        gatewayUrl: "http://127.0.0.1:9999",
+        models: [{ modelId: "provider/one" }],
+        codexHome: home
+    };
+    try {
+        const scope = await acquireCodexConfigLock(home);
+        try {
+            assert.throws(() => installCodexIntegration({ ...input, owner: OWNER }), /lock is busy/);
+            assert.throws(() => scope.install({
+                ...input, owner: OWNER, codexHome: otherHome
+            }), /does not match the locked home/);
+            scope.install({ ...input, owner: OWNER });
+            scope.install({ ...input, owner: cloudOwner, profileId: "routekit-cloud" });
+            assert.match(readFileSync(configPath, "utf8"), /model_providers\.example_route/);
+            assert.match(readFileSync(configPath, "utf8"), /model_providers\.example_cloud/);
+            scope.uninstall({ ownerId: cloudOwner.id, codexHome: home });
+        }
+        finally {
+            scope.release();
+        }
+        assert.throws(() => scope.install({ ...input, owner: OWNER }), /already been released/);
+        assert.equal(uninstallCodexIntegration({ ownerId: OWNER.id, codexHome: home }).removed, true);
+        await assert.rejects(withCodexConfigLock(home, async (held) => {
+            held.install({ ...input, owner: OWNER });
+            throw new Error("callback failed");
+        }), /callback failed/);
+        assert.equal(uninstallCodexIntegration({ ownerId: OWNER.id, codexHome: home }).removed, true);
+    }
+    finally {
+        rmSync(home, { recursive: true, force: true });
+        rmSync(otherHome, { recursive: true, force: true });
+    }
+});
+test("async Codex scope creates a missing home before acquiring its lock", async () => {
+    const root = mkdtempSync(join(tmpdir(), "routekit-codex-new-home-"));
+    const home = join(root, "codex");
+    try {
+        assert.equal(existsSync(home), false);
+        await withCodexConfigLock(home, (scope) => {
+            scope.install({
+                gatewayUrl: "http://127.0.0.1:9999",
+                models: [{ modelId: "provider/one" }],
+                owner: OWNER,
+                codexHome: home
+            });
+        });
+        assert.equal(existsSync(join(home, "config.toml")), true);
+        assert.equal(existsSync(join(home, ".routekit-codex-config.lock")), false);
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+});
+test("Codex scope recovers interrupted install and uninstall without starting another operation", async () => {
+    const testingGlobal = globalThis;
+    const home = mkdtempSync(join(tmpdir(), "routekit-codex-scoped-recovery-"));
+    const configPath = join(home, "config.toml");
+    const original = 'model = "user-default"\n';
+    const input = {
+        gatewayUrl: "http://127.0.0.1:9999",
+        models: [{ modelId: "provider/one" }],
+        owner: OWNER,
+        codexHome: home
+    };
+    writeFileSync(configPath, original);
+    try {
+        const scope = await acquireCodexConfigLock(home);
+        try {
+            testingGlobal.__routekitCodexInstallFaultInjector = (boundary) => {
+                if (boundary === "profile")
+                    throw new Error("interrupted install");
+            };
+            assert.throws(() => scope.install(input), /interrupted install/);
+            delete testingGlobal.__routekitCodexInstallFaultInjector;
+            scope.recover(OWNER.id);
+            assert.equal(readFileSync(configPath, "utf8"), original);
+            assert.equal(existsSync(join(home, "routekit.config.toml")), false);
+            assert.equal(existsSync(join(home, ".example-host-model-catalog.json")), false);
+            assert.equal(existsSync(join(home, ".example-host-install-pending.json")), false);
+            scope.install(input);
+            const installed = readFileSync(configPath, "utf8");
+            testingGlobal.__routekitCodexUninstallFaultInjector = (boundary) => {
+                if (boundary === "catalog")
+                    throw new Error("interrupted uninstall");
+            };
+            assert.throws(() => scope.uninstall({ ownerId: OWNER.id, codexHome: home }), /interrupted uninstall/);
+            delete testingGlobal.__routekitCodexUninstallFaultInjector;
+            scope.recover(OWNER.id);
+            assert.equal(readFileSync(configPath, "utf8"), installed);
+            assert.equal(existsSync(join(home, "routekit.config.toml")), true);
+            assert.equal(existsSync(join(home, ".example-host-model-catalog.json")), true);
+            assert.equal(existsSync(join(home, ".example-host-uninstall-pending.json")), false);
+        }
+        finally {
+            scope.release();
+        }
+        assert.throws(() => scope.recover(OWNER.id), /already been released/);
+    }
+    finally {
+        delete testingGlobal.__routekitCodexInstallFaultInjector;
+        delete testingGlobal.__routekitCodexUninstallFaultInjector;
+        rmSync(home, { recursive: true, force: true });
+    }
+});
 test("Codex managed install adds one picker-backed profile and removes only owner-marked config", () => {
     const home = mkdtempSync(join(tmpdir(), "routekit-codex-install-"));
     const configPath = join(home, "config.toml");
@@ -30,6 +299,7 @@ test("Codex managed install adds one picker-backed profile and removes only owne
         assert.equal(installed.action, "installed");
         assert.deepEqual(installed.profiles, ["routekit"]);
         assert.match(readFileSync(configPath, "utf8"), /model = "user-default"/);
+        assert.match(readFileSync(configPath, "utf8"), /cli_auth_credentials_store = "file"/);
         assert.match(readFileSync(configPath, "utf8"), /base_url = "http:\/\/127\.0\.0\.1:9999\/v1"/);
         assert.match(readFileSync(configPath, "utf8"), /codex --profile routekit/);
         assert.equal(existsSync(join(home, "routekit.config.toml")), true);
@@ -81,6 +351,55 @@ test("Codex managed install can use a command-backed bearer token", () => {
         rmSync(home, { recursive: true, force: true });
     }
 });
+test("Codex repository-bound provider sends only the validated context header", () => {
+    const home = mkdtempSync(join(tmpdir(), "routekit-codex-repository-header-"));
+    const connectionId = "A2B9B2DD-83D4-4F04-904B-49D5BEB7B431";
+    try {
+        const input = {
+            gatewayUrl: "http://127.0.0.1:9999",
+            owner: OWNER,
+            models: [{ modelId: "auto" }, { modelId: "provider/explicit" }],
+            defaultModel: "auto",
+            repositoryConnectionId: connectionId,
+            codexHome: home
+        };
+        installCodexIntegration(input);
+        const config = readFileSync(join(home, "config.toml"), "utf8");
+        const parsed = tomlParse(config);
+        assert.deepEqual(parsed.model_providers.example_route?.http_headers, { "X-RouteKit-Repository-Connection-Id": connectionId.toLowerCase() });
+        assert.match(config, /\[model_providers\.example_route\.http_headers\]/);
+        assert.match(readFileSync(join(home, "routekit.config.toml"), "utf8"), /model = "auto"/);
+        assert.doesNotMatch(config, /A2B9B2DD/);
+        installCodexIntegration({ ...input, repositoryConnectionId: undefined });
+        const unbound = tomlParse(readFileSync(join(home, "config.toml"), "utf8"));
+        assert.equal(unbound.model_providers.example_route?.http_headers, undefined);
+    }
+    finally {
+        rmSync(home, { recursive: true, force: true });
+    }
+});
+test("Codex repository binding rejects malformed IDs before publishing configuration", () => {
+    const home = mkdtempSync(join(tmpdir(), "routekit-codex-invalid-repository-header-"));
+    const configPath = join(home, "config.toml");
+    const original = 'model = "user-default"\n';
+    writeFileSync(configPath, original);
+    try {
+        for (const connectionId of ["", "not-a-uuid", "a\nX-Api-Key: secret", "00000000-0000-0000-0000-000000000000 "]) {
+            assert.throws(() => installCodexIntegration({
+                gatewayUrl: "http://127.0.0.1:9999",
+                owner: OWNER,
+                models: [{ modelId: "auto" }],
+                repositoryConnectionId: connectionId,
+                codexHome: home
+            }), /repository connection id must be a UUID/);
+            assert.equal(readFileSync(configPath, "utf8"), original);
+            assert.equal(existsSync(join(home, ".example-host-model-catalog.json")), false);
+        }
+    }
+    finally {
+        rmSync(home, { recursive: true, force: true });
+    }
+});
 test("Codex's single persistent profile can use a safe custom selector", () => {
     const home = mkdtempSync(join(tmpdir(), "routekit-codex-opaque-"));
     try {
@@ -117,3 +436,154 @@ test("Codex install refuses to overwrite a user-owned routekit profile", () => {
         rmSync(home, { recursive: true, force: true });
     }
 });
+test("Codex install recovers each interrupted write boundary without losing user settings", () => {
+    const testingGlobal = globalThis;
+    for (const boundary of ["pending", "catalog", "profile", "config"]) {
+        const home = mkdtempSync(join(tmpdir(), `routekit-codex-interrupted-${boundary}-`));
+        const original = 'model = "user-default"\n';
+        writeFileSync(join(home, "config.toml"), original);
+        try {
+            testingGlobal.__routekitCodexInstallFaultInjector = (reached) => {
+                if (reached === boundary)
+                    throw new Error(`interrupted at ${boundary}`);
+            };
+            assert.throws(() => installCodexIntegration({
+                gatewayUrl: "http://127.0.0.1:9999",
+                owner: OWNER,
+                models: [{ modelId: "provider/one" }],
+                codexHome: home
+            }), new RegExp(`interrupted at ${boundary}`));
+            delete testingGlobal.__routekitCodexInstallFaultInjector;
+            assert.equal(existsSync(join(home, ".example-host-install-pending.json")), true);
+            if (boundary === "config") {
+                assert.match(readFileSync(join(home, "config.toml"), "utf8"), /example_route/);
+                assert.match(readFileSync(join(home, "routekit.config.toml"), "utf8"), /provider\/one/);
+            }
+            const result = installCodexIntegration({
+                gatewayUrl: "http://127.0.0.1:9999",
+                owner: OWNER,
+                models: [{ modelId: "provider/two" }],
+                codexHome: home
+            });
+            assert.equal(result.action, "installed");
+            assert.match(readFileSync(join(home, "config.toml"), "utf8"), /user-default/);
+            assert.match(readFileSync(join(home, "routekit.config.toml"), "utf8"), /provider\/two/);
+            assert.equal(existsSync(join(home, ".example-host-install-pending.json")), false);
+        }
+        finally {
+            delete testingGlobal.__routekitCodexInstallFaultInjector;
+            rmSync(home, { recursive: true, force: true });
+        }
+    }
+});
+test("Codex uninstall recovers each interrupted write boundary and preserves another owner", () => {
+    const testingGlobal = globalThis;
+    const cloudOwner = {
+        ...OWNER, id: "example-cloud", providerId: "example_cloud"
+    };
+    for (const boundary of ["pending", "config", "profile", "catalog"]) {
+        const home = mkdtempSync(join(tmpdir(), `routekit-codex-uninstall-${boundary}-`));
+        const original = 'model = "user-default"\n';
+        const configPath = join(home, "config.toml");
+        writeFileSync(configPath, original);
+        try {
+            installCodexIntegration({
+                gatewayUrl: "http://127.0.0.1:9999",
+                owner: OWNER,
+                models: [{ modelId: "provider/one" }],
+                codexHome: home
+            });
+            installCodexIntegration({
+                gatewayUrl: "http://127.0.0.1:9999",
+                owner: cloudOwner,
+                profileId: "routekit-cloud",
+                models: [{ modelId: "provider/cloud" }],
+                codexHome: home
+            });
+            testingGlobal.__routekitCodexUninstallFaultInjector = (reached) => {
+                if (reached === boundary)
+                    throw new Error(`uninstall interrupted at ${boundary}`);
+            };
+            assert.throws(() => uninstallCodexIntegration({ ownerId: OWNER.id, codexHome: home }), new RegExp(`uninstall interrupted at ${boundary}`));
+            delete testingGlobal.__routekitCodexUninstallFaultInjector;
+            assert.equal(existsSync(join(home, ".example-host-uninstall-pending.json")), true);
+            if (boundary === "catalog") {
+                assert.equal(existsSync(join(home, ".example-host-model-catalog.json")), false);
+                assert.doesNotMatch(readFileSync(configPath, "utf8"), /example_route/);
+            }
+            assert.equal(uninstallCodexIntegration({ ownerId: OWNER.id, codexHome: home }).removed, true);
+            assert.equal(existsSync(join(home, ".example-host-uninstall-pending.json")), false);
+            assert.equal(existsSync(join(home, "routekit.config.toml")), false);
+            assert.equal(existsSync(join(home, ".example-host-model-catalog.json")), false);
+            assert.match(readFileSync(configPath, "utf8"), /user-default/);
+            assert.doesNotMatch(readFileSync(configPath, "utf8"), /example_route/);
+            assert.match(readFileSync(configPath, "utf8"), /example_cloud/);
+            assert.match(readFileSync(join(home, "routekit-cloud.config.toml"), "utf8"), /provider\/cloud/);
+        }
+        finally {
+            delete testingGlobal.__routekitCodexUninstallFaultInjector;
+            rmSync(home, { recursive: true, force: true });
+        }
+    }
+});
+test("Codex interrupted-uninstall recovery refuses an intervening user edit", () => {
+    const testingGlobal = globalThis;
+    const home = mkdtempSync(join(tmpdir(), "routekit-codex-uninstall-edit-"));
+    const configPath = join(home, "config.toml");
+    try {
+        installCodexIntegration({
+            gatewayUrl: "http://127.0.0.1:9999",
+            owner: OWNER,
+            models: [{ modelId: "provider/one" }],
+            codexHome: home
+        });
+        testingGlobal.__routekitCodexUninstallFaultInjector = (boundary) => {
+            if (boundary === "config")
+                throw new Error("interrupted after config");
+        };
+        assert.throws(() => uninstallCodexIntegration({ ownerId: OWNER.id, codexHome: home }), /interrupted after config/);
+        delete testingGlobal.__routekitCodexUninstallFaultInjector;
+        const edit = 'model = "user-edited-after-crash"\n';
+        writeFileSync(configPath, edit);
+        assert.throws(() => uninstallCodexIntegration({ ownerId: OWNER.id, codexHome: home }), /refused to overwrite the external edit/);
+        assert.equal(readFileSync(configPath, "utf8"), edit);
+        assert.equal(existsSync(join(home, ".example-host-uninstall-pending.json")), true);
+    }
+    finally {
+        delete testingGlobal.__routekitCodexUninstallFaultInjector;
+        rmSync(home, { recursive: true, force: true });
+    }
+});
+test("Codex interrupted-install recovery refuses to overwrite an intervening user edit", () => {
+    const testingGlobal = globalThis;
+    const home = mkdtempSync(join(tmpdir(), "routekit-codex-interrupted-edit-"));
+    const configPath = join(home, "config.toml");
+    writeFileSync(configPath, 'model = "before"\n');
+    try {
+        testingGlobal.__routekitCodexInstallFaultInjector = (boundary) => {
+            if (boundary === "catalog")
+                throw new Error("interrupted after catalog");
+        };
+        assert.throws(() => installCodexIntegration({
+            gatewayUrl: "http://127.0.0.1:9999",
+            owner: OWNER,
+            models: [{ modelId: "provider/one" }],
+            codexHome: home
+        }), /interrupted after catalog/);
+        delete testingGlobal.__routekitCodexInstallFaultInjector;
+        const edit = 'model = "user-edited-after-crash"\n';
+        writeFileSync(configPath, edit);
+        assert.throws(() => installCodexIntegration({
+            gatewayUrl: "http://127.0.0.1:9999",
+            owner: OWNER,
+            models: [{ modelId: "provider/one" }],
+            codexHome: home
+        }), /refused to overwrite the external edit/);
+        assert.equal(readFileSync(configPath, "utf8"), edit);
+        assert.equal(existsSync(join(home, ".example-host-install-pending.json")), true);
+    }
+    finally {
+        delete testingGlobal.__routekitCodexInstallFaultInjector;
+        rmSync(home, { recursive: true, force: true });
+    }
+});

package/dist/test/launch.test.js

@@ -1,9 +1,10 @@
 import assert from "node:assert/strict";
-import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { EventEmitter } from "node:events";
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { test } from "node:test";
-import { codexAgentRoleToml, codexCatalogEntries, codexLaunchConfigToml, codexModelCatalogJson, codexPersistentModelCatalogJson, createIsolatedCodexHome, launchCodex, resolveCodexHome } from "../launch.js";
+import { codexAgentRoleToml, codexCatalogEntries, codexLaunchConfigToml, codexModelCatalogJson, codexPersistentModelCatalogJson, createIsolatedCodexHome, launchCodex, resolveRouteKitCodexHome } from "../launch.js";
 const SPEC = {
     gatewayUrl: "http://127.0.0.1:9999",
     defaultModel: "opaque-primary",
@@ -157,6 +158,38 @@ test("Codex launcher neutralizes stock-model behavior for gateway-routed models"
     assert.equal(entry.base_instructions, "You are a coding agent.");
     assert.deepEqual(entry.model_messages, { instructions_template: "You are a coding agent." });
 });
+test("Codex exposes authoritative service tiers for gateway-routed models", () => {
+    const spec = {
+        gatewayUrl: "http://127.0.0.1:9999",
+        defaultModel: "codex/gpt-tiered",
+        models: [
+            {
+                id: "codex/gpt-tiered",
+                serviceTiers: {
+                    tiers: [
+                        { id: "priority", name: "Fast", description: "1.5x speed, increased usage" },
+                        { id: "flex", name: "Flex" }
+                    ],
+                    defaultTier: "priority",
+                    wireShape: "openai-service-tier"
+                }
+            }
+        ],
+        args: []
+    };
+    const [entry] = codexCatalogEntries(spec, {
+        slug: "stock",
+        additional_speed_tiers: [],
+        service_tiers: [],
+        default_service_tier: null
+    });
+    assert.deepEqual(entry?.additional_speed_tiers, ["fast"]);
+    assert.deepEqual(entry?.service_tiers, [
+        { id: "priority", name: "Fast", description: "1.5x speed, increased usage" },
+        { id: "flex", name: "Flex", description: "Flex service tier." }
+    ]);
+    assert.equal(entry?.default_service_tier, "priority");
+});
 test("Codex keeps real stock ModelInfo only for Codex-native models", () => {
     const spec = {
         gatewayUrl: "http://127.0.0.1:9999",
@@ -177,6 +210,7 @@ test("Codex launcher serializes a gateway provider and generic agent profiles",
         role
     ]);
     assert.match(config, /model = "opaque-primary"/);
+    assert.match(config, /cli_auth_credentials_store = "file"/);
     assert.match(config, /base_url = "http:\/\/127\.0\.0\.1:9999\/v1"/);
     assert.match(config, /env_key = "ROUTEKIT_GATEWAY_TOKEN"/);
     assert.match(config, /config_file = "\/tmp\/reviewer\.toml"/);
@@ -191,6 +225,10 @@ test("persistent Codex profiles carry matching model metadata", () => {
                 efforts: [{ id: "low" }, { id: "high" }],
                 defaultEffort: "low",
                 provenance: "provider"
+            },
+            serviceTiers: {
+                tiers: [{ id: "priority", name: "Fast", description: "Faster responses" }],
+                wireShape: "openai-service-tier"
             }
         },
         { id: "codex/gpt-5.6" }
@@ -204,10 +242,48 @@ test("persistent Codex profiles carry matching model metadata", () => {
         { effort: "high", description: "high" }
     ]);
     assert.equal(catalog.models[0]?.supports_reasoning_summaries, true);
+    assert.deepEqual(catalog.models[0]?.additional_speed_tiers, ["fast"]);
+    assert.deepEqual(catalog.models[0]?.service_tiers, [
+        { id: "priority", name: "Fast", description: "Faster responses" }
+    ]);
+});
+test("Codex launch home is RouteKit-scoped unless an absolute CODEX_HOME is explicit", () => {
+    assert.equal(resolveRouteKitCodexHome({ CODEX_HOME: "/private/codex" }), "/private/codex");
+    assert.equal(resolveRouteKitCodexHome({ ROUTEKIT_HOME: "/private/routekit" }), "/private/routekit/codex");
+    assert.throws(() => resolveRouteKitCodexHome({ CODEX_HOME: "relative" }), /absolute path/);
 });
-test("Codex normal home honors absolute CODEX_HOME and rejects relative values", () => {
-    assert.equal(resolveCodexHome({ CODEX_HOME: "/private/codex" }), "/private/codex");
-    assert.throws(() => resolveCodexHome({ CODEX_HOME: "relative" }), /absolute path/);
+test("Codex launch writes private file-auth config under RouteKit home", async () => {
+    const root = mkdtempSync(join(tmpdir(), "routekit-codex-launch-home-"));
+    const routekitHome = join(root, "routekit");
+    let spawnedEnv;
+    const child = new EventEmitter();
+    queueMicrotask(() => child.emit("exit", 0, null));
+    try {
+        const result = await launchCodex({
+            spec: SPEC,
+            log: () => { },
+            prepareForPassthrough: () => { },
+            registerPort: () => "",
+            unregisterPort: () => { },
+            registerDisposer: () => { }
+        }, {
+            env: { HOME: join(root, "home"), ROUTEKIT_HOME: routekitHome },
+            spawnProcess: ((_command, _args, options) => {
+                spawnedEnv = options?.env;
+                return child;
+            })
+        });
+        const codexHome = join(routekitHome, "codex");
+        const configPath = join(codexHome, "config.toml");
+        assert.equal(result, 0);
+        assert.equal(spawnedEnv?.CODEX_HOME, codexHome);
+        assert.match(readFileSync(configPath, "utf8"), /cli_auth_credentials_store = "file"/);
+        assert.equal(statSync(codexHome).mode & 0o777, 0o700);
+        assert.equal(statSync(configPath).mode & 0o777, 0o600);
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
 });
 test("isolated Codex homes used by the harness live under the user cache", () => {
     const root = mkdtempSync(join(tmpdir(), "routekit-codex-home-test-"));

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@velum-labs/routekit-tool-codex",
   "private": false,
-  "version": "1.4.0",
+  "version": "1.5.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/velum-labs/routekit.git",
@@ -39,13 +39,13 @@
   },
   "dependencies": {
     "@openai/codex-sdk": "0.145.0",
-    "smol-toml": "1.7.0",
+    "smol-toml": "1.7.1",
     "zod": "4.4.3",
-    "@velum-labs/routekit-contracts": "1.4.0",
-    "@velum-labs/routekit-harness-core": "1.4.0",
-    "@velum-labs/routekit-registry": "1.4.0",
-    "@velum-labs/routekit-runtime": "1.4.0",
-    "@velum-labs/routekit-tools": "1.4.0"
+    "@velum-labs/routekit-contracts": "1.5.0",
+    "@velum-labs/routekit-harness-core": "1.5.0",
+    "@velum-labs/routekit-registry": "1.5.0",
+    "@velum-labs/routekit-runtime": "1.5.0",
+    "@velum-labs/routekit-tools": "1.5.0"
   },
   "keywords": [
     "llm",