@yansigit/opencodex 2.33.0 → 2.35.0

package/src/chat/inbound.ts

@@ -10,6 +10,21 @@ export class ChatCompletionsRequestError extends Error {}
 type Rec = Record<string, unknown>;
 type ChatCompletionsRoutingBody = Rec & { model: string; messages: unknown[] };
 
+/** Session/thread headers the Chat -> Responses bridge must preserve for provider affinity. */
+export const CHAT_RESPONSES_SESSION_HEADERS = [
+  "session_id",
+  "session-id",
+  "x-session-id",
+  "thread-id",
+] as const;
+
+export function copyChatResponsesSessionHeaders(source: Headers, target: Headers): void {
+  for (const name of CHAT_RESPONSES_SESSION_HEADERS) {
+    const value = source.get(name);
+    if (value) target.set(name, value);
+  }
+}
+
 function isRec(v: unknown): v is Rec {
   return !!v && typeof v === "object" && !Array.isArray(v);
 }
@@ -53,6 +68,14 @@ function imageUrlFromPart(part: Rec): string | null {
   return null;
 }
 
+function videoUrlFromPart(part: Rec): string | null {
+  if (part.type !== "video_url") return null;
+  const videoUrl = part.video_url;
+  if (typeof videoUrl === "string" && videoUrl.length > 0) return videoUrl;
+  if (isRec(videoUrl) && typeof videoUrl.url === "string" && videoUrl.url.length > 0) return videoUrl.url;
+  return null;
+}
+
 function userContentToBlocks(content: unknown): Rec[] {
   if (typeof content === "string") {
     return content.length > 0 ? [{ type: "input_text", text: content }] : [];
@@ -70,7 +93,12 @@ function userContentToBlocks(content: unknown): Rec[] {
       continue;
     }
     const imageUrl = imageUrlFromPart(raw);
-    if (imageUrl) blocks.push({ type: "input_image", image_url: imageUrl });
+    if (imageUrl) {
+      blocks.push({ type: "input_image", image_url: imageUrl });
+      continue;
+    }
+    const videoUrl = videoUrlFromPart(raw);
+    if (videoUrl) blocks.push({ type: "input_video", video_url: videoUrl });
   }
   return blocks;
 }

package/src/chat/outbound.ts

@@ -9,7 +9,14 @@ type Rec = Record<string, unknown>;
 
 import { decodeServerSentEvents, sseFieldValue } from "../lib/sse-decoder";
 import { isTranslatorBudgetExceededError, type TranslatorBudget } from "../lib/translator-budget";
-import { classifyError, CYBER_POLICY_ERROR_CODE, isCyberPolicyCode, isCyberPolicyMessage } from "../lib/errors";
+import {
+  classifyError,
+  cyberPolicyErrorType,
+  CYBER_POLICY_ERROR_CODE,
+  isCyberPolicyCode,
+  isCyberPolicyMessage,
+} from "../lib/errors";
+import { redactSecretString } from "../lib/redact";
 
 function isRec(v: unknown): v is Rec {
   return !!v && typeof v === "object" && !Array.isArray(v);
@@ -48,14 +55,14 @@ export function chatCompletionsUsage(usage: unknown): Rec {
 export function chatCompletionsErrorBody(
   status: number,
   message: string,
-  type = "invalid_request_error",
+  type?: string,
   code?: string | null,
 ): Rec {
   if (isCyberPolicyCode(code) || isCyberPolicyMessage(message)) {
     return {
       error: {
         message,
-        type: "invalid_request_error",
+        type: cyberPolicyErrorType(type),
         param: null,
         code: CYBER_POLICY_ERROR_CODE,
       },
@@ -64,7 +71,7 @@ export function chatCompletionsErrorBody(
   return {
     error: {
       message,
-      type,
+      type: type ?? "invalid_request_error",
       param: null,
       code: code !== undefined
         ? code
@@ -311,8 +318,9 @@ export function responsesSseToChatCompletionsSse(
         // Deliver the error frame then close the stream abnormally (no [DONE]).
         // Do not controller.error() — that can drop already-enqueued bytes from consumers
         // like response.text().
-        const statusHint = details?.status ?? streamErrorStatus(message);
-        const classified = classifyError(statusHint, details?.type ?? "upstream_error", message);
+        const safeMessage = redactSecretString(message);
+        const statusHint = details?.status ?? streamErrorStatus(safeMessage);
+        const classified = classifyError(statusHint, details?.type ?? "upstream_error", safeMessage);
         const translatorOverflow = details?.code === "translation_buffer_limit";
         if (translatorOverflow) {
           upstreamAbort.abort(new Error("upstream translation buffer exceeded the safe limit"));
@@ -324,7 +332,7 @@ export function responsesSseToChatCompletionsSse(
           classified.type = "upstream_error";
         } else if (isCyberPolicyCode(details?.code) || classified.code === CYBER_POLICY_ERROR_CODE) {
           classified.code = CYBER_POLICY_ERROR_CODE;
-          classified.type = "invalid_request_error";
+          classified.type = cyberPolicyErrorType(details?.type);
         } else if (details?.code !== undefined && details.code !== null && !classified.code) {
           classified.code = details.code;
         }

package/src/claude/agents-inject.ts

@@ -218,7 +218,14 @@ function isOwnedFile(path: string): boolean {
 export function syncClaudeAgentDefs(defs: readonly ClaudeAgentDef[], configDir = claudeConfigDir()): string[] | null {
   try {
     const dir = join(configDir, "agents");
-    mkdirSync(dir, { recursive: true });
+    if (defs.length === 0) {
+      try { lstatSync(dir); } catch (error) {
+        if ((error as NodeJS.ErrnoException).code === "ENOENT") return [];
+        throw error;
+      }
+    } else {
+      mkdirSync(dir, { recursive: true });
+    }
     const keep = new Set(defs.map(d => d.file));
     for (const existing of readdirSync(dir)) {
       if (!existing.startsWith(OWNED_PREFIX) || !existing.endsWith(".md")) continue;

package/src/claude/outbound.ts

@@ -2,8 +2,9 @@
  * Claude Code outbound: internal /v1/responses output -> Anthropic Messages API shapes.
  *
  * Wire contract pinned in devlog/260711_claude_inbound/003_evidence.md (all Tier 2):
- *  - SSE order: message_start -> (content_block_start -> deltas -> content_block_stop)*
- *    -> message_delta -> message_stop; any number of `ping`.
+ *  - Transport-only `ping` events may appear at any point, including before
+ *    message_start. Semantic framing stays message_start ->
+ *    (content_block_start -> deltas -> content_block_stop)* -> message_delta -> message_stop.
  *  - thinking blocks get thinking_delta(s) then ONE synthetic signature_delta just
  *    before content_block_stop (CCR precedent: Claude Code does not verify signatures).
  *  - message_delta.usage is cumulative; message_start embeds a full message snapshot.
@@ -267,12 +268,12 @@ export function responsesSseToAnthropicSse(
         emit("message_start", { type: "message_start", message: messageSnapshot(model) });
         emit("ping", { type: "ping" });
       };
-      // Once a semantic Anthropic message has started, keepalive pings protect remote
-      // deployments behind LB/NAT idle timeouts. Transport-only Responses prelude frames
-      // must not manufacture a message before a possible initial error.
+      // Keepalive pings protect remote deployments behind LB/NAT idle timeouts even
+      // before semantic output. They are transport-only and must not manufacture a
+      // message before a possible initial error.
       if (pingIntervalMs > 0) {
         pingTimer = setInterval(() => {
-          if (terminated || !started) return;
+          if (terminated || (controller.desiredSize ?? 0) <= 0) return;
           try {
             emit("ping", { type: "ping" });
           } catch { /* controller torn down; the read loop is ending anyway */ }
@@ -352,7 +353,8 @@ export function responsesSseToAnthropicSse(
         const type = upstreamDerived && isTransientUpstreamStatus(status) ? "overloaded_error" : undefined;
         if (!started) {
           // An initial upstream failure is an Anthropic error stream, not a partial message.
-          // Do not manufacture message_start/ping before the terminal error.
+          // Do not manufacture message_start before the terminal error. Earlier transport-only
+          // pings remain valid and do not turn the failure into a partial message.
           emit("error", anthropicErrorBody(status, message, type, code));
           return;
         }
@@ -366,7 +368,7 @@ export function responsesSseToAnthropicSse(
             // Transport prelude only. Start Anthropic framing on semantic output or completion.
             break;
           case "response.heartbeat":
-            if (started) emit("ping", { type: "ping" });
+            if ((controller.desiredSize ?? 0) > 0) emit("ping", { type: "ping" });
             break;
           case "response.output_text.delta": {
             if (typeof data.delta !== "string" || data.delta.length === 0) break;

package/src/cli/account-api.ts

@@ -141,6 +141,8 @@ export interface FamilyRows {
 }
 
 export interface CodexQuotaDto {
+  fiveHourPercent?: number;
+  fiveHourResetAt?: number;
   weeklyPercent?: number;
   monthlyPercent?: number;
   weeklyResetAt?: number;
@@ -158,8 +160,6 @@ export interface ProviderQuotaWindowDto {
 }
 
 export interface ProviderQuotaDto extends CodexQuotaDto {
-  fiveHourPercent?: number;
-  fiveHourResetAt?: number;
   customWindows?: ProviderQuotaWindowDto[];
   updatedAt?: number;
 }
@@ -187,7 +187,7 @@ interface CodexAccountDto {
 function projectQuota(quota: CodexQuotaDto | null | undefined): CodexQuotaDto | null {
   if (!quota) return null;
   const projected: CodexQuotaDto = {};
-  for (const key of ["weeklyPercent", "monthlyPercent", "weeklyResetAt", "monthlyResetAt", "shortPercent", "shortResetAt", "shortWindowSeconds"] as const) {
+  for (const key of ["fiveHourPercent", "fiveHourResetAt", "weeklyPercent", "monthlyPercent", "weeklyResetAt", "monthlyResetAt", "shortPercent", "shortResetAt", "shortWindowSeconds"] as const) {
     if (typeof quota[key] === "number" && Number.isFinite(quota[key])) projected[key] = quota[key];
   }
   return projected;
@@ -240,10 +240,22 @@ interface OAuthAccountDto {
   email?: string;
   active?: boolean;
   needsReauth?: boolean;
+  quota?: CodexQuotaDto | null;
+  quotaUnavailable?: boolean;
 }
 
-async function fetchOAuthRows(deps: AccountDeps, baseUrl: string, name: string): Promise<FamilyRows> {
-  const res = await apiJson(deps, baseUrl, "GET", `/api/oauth/accounts?provider=${encodeURIComponent(name)}`);
+async function fetchOAuthRows(
+  deps: AccountDeps,
+  baseUrl: string,
+  name: string,
+  quota?: { refresh?: boolean },
+): Promise<FamilyRows> {
+  // Quota is opt-in: the server probes the upstream once per stored credential when `quota=1`
+  // is present, so the default listing must stay a cheap local read (#2566).
+  const query = quota
+    ? `?provider=${encodeURIComponent(name)}&quota=1${quota.refresh ? "&refresh=1" : ""}`
+    : `?provider=${encodeURIComponent(name)}`;
+  const res = await apiJson(deps, baseUrl, "GET", `/api/oauth/accounts${query}`);
   if (res.status === 0) return { rows: [], activeId: null, status: 0, networkDown: true };
   if (res.status !== 200) return { rows: [], activeId: null, status: res.status, errorJson: res.json };
   const activeId = typeof res.json.activeAccountId === "string" ? res.json.activeAccountId : null;
@@ -256,6 +268,8 @@ async function fetchOAuthRows(deps: AccountDeps, baseUrl: string, name: string):
     email: a.email,
     active: a.active ?? a.id === activeId,
     needsReauth: a.needsReauth,
+    ...(a.quota !== undefined ? { quota: a.quota } : {}),
+    ...(a.quotaUnavailable !== undefined ? { quotaUnavailable: a.quotaUnavailable } : {}),
   }));
   return { rows, activeId, status: 200 };
 }
@@ -284,9 +298,15 @@ async function fetchKeyRows(deps: AccountDeps, baseUrl: string, name: string): P
   return { rows, activeId, status: 200 };
 }
 
-export function fetchRows(deps: AccountDeps, baseUrl: string, name: string, type: AccountType): Promise<FamilyRows> {
+export function fetchRows(
+  deps: AccountDeps,
+  baseUrl: string,
+  name: string,
+  type: AccountType,
+  quota?: { refresh?: boolean },
+): Promise<FamilyRows> {
   if (type === "codex") return fetchCodexRows(deps, baseUrl);
-  if (type === "oauth") return fetchOAuthRows(deps, baseUrl, name);
+  if (type === "oauth") return fetchOAuthRows(deps, baseUrl, name, quota);
   return fetchKeyRows(deps, baseUrl, name);
 }
 

package/src/cli/account-extended.ts

@@ -250,9 +250,16 @@ function resetIso(value: number | undefined): string | null {
 function refreshLine(row: FamilyRows["rows"][number]): string {
   const parts = [row.id === MAIN_ID ? "main" : row.id, row.email, row.plan];
   const quota = row.quota;
-  if (!quota || (quota.weeklyPercent === undefined && quota.monthlyPercent === undefined)) {
+  const fiveHourPercent = quota?.fiveHourPercent ?? quota?.shortPercent;
+  const fiveHourResetAt = quota?.fiveHourResetAt ?? quota?.shortResetAt;
+  if (!quota || (quota.weeklyPercent === undefined && quota.monthlyPercent === undefined && fiveHourPercent === undefined)) {
     parts.push("quota: unknown");
   } else {
+    if (fiveHourPercent !== undefined) {
+      parts.push(`5h ${fiveHourPercent}%`);
+      const fiveHourReset = resetIso(fiveHourResetAt);
+      if (fiveHourReset) parts.push(`resets ${fiveHourReset}`);
+    }
     if (quota.weeklyPercent !== undefined) parts.push(`weekly ${quota.weeklyPercent}%`);
     const weeklyReset = resetIso(quota.weeklyResetAt);
     if (weeklyReset) parts.push(`resets ${weeklyReset}`);
@@ -272,14 +279,14 @@ function quotaParts(quota: ProviderQuotaDto): string[] {
     const reset = resetIso(resetAt);
     if (reset) parts.push(`resets ${reset}`);
   };
-  add("5h", quota.fiveHourPercent, quota.fiveHourResetAt);
+  add("5h", quota.fiveHourPercent ?? quota.shortPercent, quota.fiveHourResetAt ?? quota.shortResetAt);
   add("weekly", quota.weeklyPercent, quota.weeklyResetAt);
   add("monthly", quota.monthlyPercent, quota.monthlyResetAt);
   for (const window of quota.customWindows ?? []) add(window.label, window.percent, window.resetAt);
   return parts;
 }
 
-function providerQuotaLine(name: string, report: ProviderQuotaReportDto): string {
+export function providerQuotaLine(name: string, report: ProviderQuotaReportDto): string {
   return [name, ...quotaParts(report.quota)].join(" ");
 }
 

package/src/cli/account.ts

@@ -16,7 +16,7 @@ const MAIN_CODEX_ID = "__main__";
 const REPLACEMENT_STYLE_OAUTH = new Set(["kiro"]);
 
 const ACCOUNT_USAGE = `Usage:
-  ocx account list [provider] [--json] [--all]
+  ocx account list [provider] [--json] [--all] [--quota [--refresh]]
   ocx account current <provider> [--json]
   ocx account use <provider> <account-or-key-id|main> [--json]
   ocx account refresh <provider> [--json]
@@ -75,11 +75,29 @@ function priorityText(row: AccountRow): string {
   return row.priority > 0 ? `+${row.priority}` : String(row.priority);
 }
 
-export function formatAccountTable(rows: AccountRow[]): string {
+/**
+ * Compact per-account quota for the opt-in QUOTA column: the two windows an operator actually
+ * decides on before a long session. The full breakdown stays in `--json`.
+ */
+function quotaText(row: AccountRow): string {
+  if ((row as { quotaUnavailable?: boolean }).quotaUnavailable) return "unavailable";
+  const quota = row.quota;
+  if (!quota) return "-";
+  const parts: string[] = [];
+  // Two spellings reach this DTO: the per-account provider probe reports `fiveHourPercent`,
+  // while the Codex pool reports the same idea as `shortPercent`.
+  const short = quota.fiveHourPercent ?? quota.shortPercent;
+  if (typeof short === "number") parts.push(`5h ${short}%`);
+  if (typeof quota.weeklyPercent === "number") parts.push(`wk ${quota.weeklyPercent}%`);
+  return parts.length > 0 ? parts.join(" ") : "-";
+}
+
+export function formatAccountTable(rows: AccountRow[], withQuota = false): string {
   const header = ["PROVIDER", "TYPE", "ID", "PLAN/LABEL", "PRIORITY", "STATUS"];
+  if (withQuota) header.push("QUOTA");
   const data = rows.map(r => {
     const keyLabel = r.masked && r.label !== r.masked ? `${r.masked} (${r.label})` : r.masked;
-    return [
+    const cols = [
       r.provider,
       r.type,
       displayId(r.id),
@@ -87,6 +105,8 @@ export function formatAccountTable(rows: AccountRow[]): string {
       priorityText(r),
       statusText(r),
     ];
+    if (withQuota) cols.push(quotaText(r));
+    return cols;
   });
   const widths = header.map((h, i) => Math.max(h.length, ...data.map(d => d[i]!.length)));
   const line = (cols: string[]) => cols.map((c, i) => c.padEnd(widths[i]!)).join("  ").trimEnd();
@@ -96,6 +116,10 @@ export function formatAccountTable(rows: AccountRow[]): string {
 async function cmdList(rest: string[], deps: AccountDeps): Promise<number> {
   const wantsJson = consumeFlag(rest, "--json");
   const showAll = consumeFlag(rest, "--all");
+  // Opt-in: the server probes the upstream once per stored credential, so the default listing
+  // stays a cheap local read (#2566). --refresh bypasses the server-side TTL.
+  const wantsQuota = consumeFlag(rest, "--quota");
+  const refreshQuota = consumeFlag(rest, "--refresh");
   const name = rest.shift();
   const leftover = leftoverArgsError(rest);
   if (leftover) {
@@ -139,7 +163,7 @@ async function cmdList(rest: string[], deps: AccountDeps): Promise<number> {
   const rows: AccountRow[] = [];
   const notes: string[] = [];
   for (const t of targets) {
-    const r = await fetchRows(deps, baseUrl, t.name, t.type);
+    const r = await fetchRows(deps, baseUrl, t.name, t.type, wantsQuota ? { refresh: refreshQuota } : undefined);
     if (r.networkDown) return proxyUnreachable();
     if (r.errorJson) {
       if (name) return apiError(r.errorJson, `failed to list ${t.name}`);
@@ -174,7 +198,7 @@ async function cmdList(rest: string[], deps: AccountDeps): Promise<number> {
     console.log(JSON.stringify({ accounts: rows, notes }, null, 2));
     return 0;
   }
-  if (rows.length > 0) console.log(formatAccountTable(rows));
+  if (rows.length > 0) console.log(formatAccountTable(rows, wantsQuota));
   for (const n of notes) console.log(n);
   if (rows.length === 0 && notes.length === 0) console.log("No stored accounts or keys.");
   return 0;

package/src/cli/alias.ts

@@ -0,0 +1,66 @@
+import { CliUsageError, printData, rejectArgs, runtimeRequest, takeFlag, takeOption, type RuntimeApiDeps } from "./runtime-api";
+
+const USAGE = `Usage:
+  ocx alias list [--json]
+  ocx alias set <provider> <alias>
+  ocx alias set <provider>/<native-model-id> <alias>
+  ocx alias rm <provider>[/<native-model-id>]
+  ocx alias defaults <on|off> [--provider <name>]`;
+
+function selector(value: string): { provider: string; model?: string } {
+  const slash = value.indexOf("/");
+  return slash < 0 ? { provider: value } : { provider: value.slice(0, slash), model: value.slice(slash + 1) };
+}
+
+export async function handleAliasCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
+  const args = [...argv];
+  const action = (args.shift() ?? "list").toLowerCase();
+  const wantsJson = takeFlag(args, "--json");
+  if (action === "list") {
+    rejectArgs(args, USAGE);
+    const result = await runtimeRequest<Record<string, unknown>>("/api/aliases", {}, deps);
+    const lines: string[] = [];
+    for (const [target, alias] of Object.entries((result.providers ?? {}) as Record<string, string>)) lines.push(`provider  ${target}  ${alias}  user`);
+    for (const [provider, rows] of Object.entries((result.models ?? {}) as Record<string, Record<string, { alias: string; source: string }>>)) {
+      for (const [model, value] of Object.entries(rows)) lines.push(`model     ${provider}/${model}  ${value.alias}  ${value.source}`);
+    }
+    printData(result, wantsJson, lines.length ? lines : ["No aliases configured."]);
+    return 0;
+  }
+  if (action === "defaults") {
+    const state = args.shift()?.toLowerCase();
+    const provider = takeOption(args, "--provider");
+    rejectArgs(args, USAGE);
+    if (state !== "on" && state !== "off") throw new CliUsageError("defaults requires on or off", USAGE);
+    const result = await runtimeRequest("/api/default-aliases", { method: "PUT", body: JSON.stringify({ enabled: state === "on", ...(provider ? { provider } : {}) }) }, deps);
+    printData(result, wantsJson, [`Default aliases ${state}${provider ? ` for ${provider}` : " globally"}.`]);
+    return 0;
+  }
+  const target = args.shift()?.trim();
+  if (!target) throw new CliUsageError("alias target is required", USAGE);
+  const parsed = selector(target);
+  if (!parsed.provider || parsed.model === "") throw new CliUsageError("target must be provider or provider/native-model-id", USAGE);
+  if (action === "set") {
+    const alias = args.shift()?.trim();
+    rejectArgs(args, USAGE);
+    if (!alias) throw new CliUsageError("alias value is required", USAGE);
+    const path = parsed.model === undefined
+      ? `/api/providers/${encodeURIComponent(parsed.provider)}/alias`
+      : `/api/providers/${encodeURIComponent(parsed.provider)}/model-aliases`;
+    const body = parsed.model === undefined ? { alias } : { set: { [parsed.model]: alias } };
+    const result = await runtimeRequest(path, { method: "PUT", body: JSON.stringify(body) }, deps);
+    printData(result, wantsJson, [`${target} → ${alias}`]);
+    return 0;
+  }
+  if (action === "rm") {
+    rejectArgs(args, USAGE);
+    const path = parsed.model === undefined
+      ? `/api/providers/${encodeURIComponent(parsed.provider)}/alias`
+      : `/api/providers/${encodeURIComponent(parsed.provider)}/model-aliases`;
+    const body = parsed.model === undefined ? { alias: null } : { remove: [parsed.model] };
+    const result = await runtimeRequest(path, { method: "PUT", body: JSON.stringify(body) }, deps);
+    printData(result, wantsJson, [`Removed alias for ${target}.`]);
+    return 0;
+  }
+  throw new CliUsageError(`unknown alias action '${action}'`, USAGE);
+}

package/src/cli/claude.ts

@@ -34,6 +34,8 @@ export type ClaudeEnvDeps = {
   authDetect?: Omit<Partial<AuthDetectDeps>, "env" | "ownTokens">;
   /** Test seam; production uses the authenticated Node-launcher context. */
   preBunAnthropicSlots?: readonly AnthropicParentEnvSlot[] | null;
+  /** Explicit unsafe opt-in from a root `--dangerously-skip-permissions` launch. */
+  allowRootSkipPermissions?: boolean;
 };
 
 function isClaudeLoopbackHostname(hostname: string): boolean {
@@ -115,6 +117,9 @@ export function buildClaudeEnv(
     if (env[name] !== undefined && env[name] !== "") return; // user wins
     env[name] = value;
   };
+  if (deps.allowRootSkipPermissions === true) {
+    setDefault("IS_SANDBOX", "1");
+  }
   setDefault("ANTHROPIC_BASE_URL", `http://127.0.0.1:${port}`);
   const existingBaseUrl = env.ANTHROPIC_BASE_URL;
   if (existingBaseUrl) {
@@ -301,6 +306,22 @@ export function claudeNotFoundHint(
   return platform === "win32" && code === 9009 && !signal ? CLAUDE_INSTALL_HINT : null;
 }
 
+export function shouldAllowRootSkipPermissions(
+  args: readonly string[],
+  getuid: (() => number) | null | undefined = process.getuid,
+): boolean {
+  return args.includes("--dangerously-skip-permissions")
+    && typeof getuid === "function"
+    && getuid() === 0;
+}
+
+export function rootSkipPermissionsNotice(env: ClaudeLaunchEnv): string {
+  if (env.IS_SANDBOX === "1") {
+    return "⚠ Root --dangerously-skip-permissions requested: OpenCodex set IS_SANDBOX=1 to bypass Claude Code's root guard. OpenCodex did not create an OS sandbox; prefer running as a non-root user.";
+  }
+  return `⚠ Root --dangerously-skip-permissions requested: preserving user IS_SANDBOX=${env.IS_SANDBOX}; Claude Code's root guard remains in control.`;
+}
+
 export async function cmdClaude(args: string[]): Promise<number> {
   const config = loadConfig();
   if (config.claudeCode?.enabled === false) {
@@ -313,7 +334,11 @@ export async function cmdClaude(args: string[]): Promise<number> {
     return 1;
   }
   const contextWindows = await fetchClaudeContextWindows(config, port);
-  const env = buildClaudeEnv(config, port, process.env, contextWindows);
+  const allowRootSkipPermissions = shouldAllowRootSkipPermissions(args);
+  const env = buildClaudeEnv(config, port, process.env, contextWindows, { allowRootSkipPermissions });
+  if (allowRootSkipPermissions) {
+    console.error(rootSkipPermissionsNotice(env));
+  }
   // Pre-write the CLI's gateway-model cache (devlog 030): without a token the CLI
   // never refreshes it, so the picker would keep showing yesterday's aliases.
   try {

package/src/cli/dispatch.ts

@@ -430,6 +430,10 @@ const commandRunners: Record<string, CommandRunner> = {
     await handleModels(deps.args.slice(1));
     return 0;
   },
+  alias: async deps => {
+    const { handleAliasCommand } = await import("./alias");
+    return await handleAliasCommand(deps.args.slice(1));
+  },
   combo: async deps => {
     const { handleComboCommand } = await import("./combo");
     return await handleComboCommand(deps.args.slice(1));
@@ -615,6 +619,15 @@ async function handleDesktopAppRestart(log: Pick<Console, "log" | "error">): Pro
         + "Run 'ocx sync --restart-desktop-app' from an external terminal instead.",
       );
       return;
+    case "process_probe_failed":
+      // Distinct from `no_targets`: we could not look, which is not the same as looking and
+      // finding nothing. Saying "not running" here sent users away believing there was nothing
+      // to restart (#2557).
+      log.error(
+        "Could not enumerate Codex desktop processes, so the app was not restarted. "
+        + "Quit and relaunch the desktop app manually to refresh the model picker.",
+      );
+      return;
     case "no_targets":
       log.log("Codex desktop app is not running; nothing to restart.");
       return;
@@ -630,4 +643,3 @@ async function handleDesktopAppRestart(log: Pick<Console, "log" | "error">): Pro
       }
   }
 }
-

package/src/cli/help.ts

@@ -52,6 +52,7 @@ Usage:
   ocx provider <sub>          Providers, connectivity, quota, and selected models
   ocx account <sub>           Accounts, login/reauth, key pools, and quota controls
   ocx models <sub>            Live/custom models, visibility, context, and shadow calls
+  ocx alias <sub>             Short names for providers and models (list, set, rm, defaults)
   ocx combo <sub>             Combo failover/round-robin routing
   ocx agent <sub>             Subagents, roles, injection, effort caps, and sidecars
   ocx observe <sub>           Logs, usage, storage, memory, and debug data

package/src/cli/index.ts

@@ -101,6 +101,11 @@ const head = await runCli(process.argv.slice(2));
 const args = head.args;
 const command = head.command;
 
+if (command === "telemetry") {
+  const { runTelemetryCommand } = await import("./telemetry-commands");
+  process.exit(runTelemetryCommand(args.slice(1), loadConfig()));
+}
+
 function parsePortOption(): number | undefined {
   if (args.length === 1) return undefined;
   if (args.length !== 3 || args[1] !== "--port") {
@@ -164,7 +169,7 @@ async function chooseListenPort(requestedPort?: number): Promise<number> {
       // Ghost LISTEN rows with a dead PID can outlive the process for a while.
       // SetTcpEntry(DELETE_TCB) needs elevation (often returns 317), so the only
       // reliable non-admin recovery is to wait for the OS to release the TCB.
-      timeoutMs: 60_000,
+      timeoutMs: process.platform === "win32" ? 60_000 : 10_000,
       intervalMs: 100,
       scanIntervalMs: 500,
       killOcxHolders: false,

package/src/cli/init.ts

@@ -165,6 +165,7 @@ export async function runInit(): Promise<void> {
       port,
       providers: { [providerName]: providerConfig },
       defaultProvider: providerName,
+      modelDiscovery: { newModelPolicy: "off" },
     };
 
     saveConfig(config);