aisubs 0.2.0 → 0.3.1

package/dist/providers/chatgpt.js

@@ -92,6 +92,8 @@ function normalizeModel(value) {
         maxOutputTokens: numberValue(value.max_output_tokens),
         reasoningEfforts: levels.length ? levels : stringArray(value.supported_reasoning_efforts),
         inputModalities: stringArray(value.input_modalities),
+        endpoints: ["responses"],
+        supportsToolCall: value.supports_tool_calls === false || value.supports_tools === false ? false : true,
         available: visibility !== "hide" && value.supported_in_api !== false,
         priority: numberValue(value.priority) ?? Number.MAX_SAFE_INTEGER,
     };

package/dist/providers/claude.js

@@ -273,7 +273,9 @@ export function claudeProvider(options = {}) {
                             description: stringValue(value.description),
                             contextWindow: numberValue(value.context_window),
                             maxOutputTokens: numberValue(value.max_output_tokens),
+                            inputModalities: ["text", "image", "document"],
                             endpoints: ["messages"],
+                            supportsToolCall: true,
                             available: true,
                             selectable: true,
                         },

package/dist/providers/copilot.js

@@ -122,8 +122,6 @@ function normalizeModel(value) {
     const capabilities = isRecord(value.capabilities) ? value.capabilities : {};
     const limits = isRecord(capabilities.limits) ? capabilities.limits : {};
     const supports = isRecord(capabilities.supports) ? capabilities.supports : {};
-    if (supports.tool_calls === false)
-        return null;
     const modalities = ["text"];
     if (supports.vision === true || isRecord(limits.vision))
         modalities.push("image");
@@ -385,6 +383,26 @@ export function copilotProvider(options = {}) {
             const session = auto ? await routeAuto(raw, credential, request.signal) : null;
             if (isResponses && raw.store === undefined)
                 raw.store = false;
+            if (isResponses && isRecord(raw.reasoning) && raw.reasoning.summary === "all_turns") {
+                // Codex's cross-turn value is not accepted by Copilot GPT-5 models.
+                raw.reasoning = { ...raw.reasoning, summary: "auto" };
+            }
+            if (isResponses && (!Array.isArray(raw.tools) || raw.tools.length === 0)) {
+                delete raw.tool_choice;
+            }
+            if (isResponses) {
+                delete raw.include;
+                delete raw.prompt_cache_retention;
+                if (Array.isArray(raw.input)) {
+                    for (const item of raw.input) {
+                        if (isRecord(item) &&
+                            isRecord(item.reasoning) &&
+                            item.reasoning.summary === "all_turns") {
+                            item.reasoning = { ...item.reasoning, summary: "auto" };
+                        }
+                    }
+                }
+            }
             if (isResponses && raw.store !== true && Array.isArray(raw.input)) {
                 raw.input = raw.input.flatMap((item) => {
                     if (!isRecord(item))

package/dist/providers/grok.js

@@ -122,8 +122,8 @@ export function grokProvider(options = {}) {
                 signal,
             });
             if (!response.ok) {
-                const raw = (await response.json().catch(() => ({})));
-                throw new GrokTokenError(response.status, stringValue(raw.error));
+                const raw = await response.json().catch(() => null);
+                throw new GrokTokenError(response.status, isRecord(raw) ? stringValue(raw.error) : undefined);
             }
             return credentialFromTokens(await responseJson(response, "Grok token refresh"), credential);
         },

package/dist/realtime.d.ts

@@ -0,0 +1,6 @@
+import type { FastifyInstance, FastifyRequest } from "fastify";
+import type { SubscriptionAuth } from "./auth.js";
+type RealtimeAuth = (request: FastifyRequest) => boolean | Promise<boolean>;
+/** Register a native Realtime WebSocket tunnel for providers that expose one. */
+export declare function registerRealtimeProxy(app: FastifyInstance, auth: SubscriptionAuth, authenticate: RealtimeAuth): void;
+export {};

package/dist/realtime.js

@@ -0,0 +1,165 @@
+import WebSocket from "ws";
+import { errorMessage } from "./utils.js";
+function rawDataBytes(data) {
+    if (Array.isArray(data))
+        return data.reduce((total, item) => total + item.byteLength, 0);
+    return data.byteLength;
+}
+function closeSocket(socket, code, reason) {
+    if (code >= 1000 && code <= 4999 && ![1004, 1005, 1006, 1015].includes(code)) {
+        socket.close(code, reason);
+    }
+    else
+        socket.close();
+}
+function upstreamHeaders(request) {
+    const headers = {};
+    request.headers.forEach((value, name) => {
+        if (![
+            "connection",
+            "content-length",
+            "host",
+            "sec-websocket-extensions",
+            "sec-websocket-key",
+            "sec-websocket-protocol",
+            "sec-websocket-version",
+            "upgrade",
+        ].includes(name)) {
+            headers[name] = value;
+        }
+    });
+    return headers;
+}
+function clientHeaders(request) {
+    const local = new Set([
+        "authorization",
+        "connection",
+        "cookie",
+        "host",
+        "origin",
+        "proxy-authorization",
+        "sec-websocket-extensions",
+        "sec-websocket-key",
+        "sec-websocket-protocol",
+        "sec-websocket-version",
+        "upgrade",
+        "x-api-key",
+        "x-goog-api-key",
+    ]);
+    return Object.fromEntries(Object.entries(request.headers).flatMap(([name, value]) => value == null || local.has(name)
+        ? []
+        : [[name, Array.isArray(value) ? value.join(", ") : String(value)]]));
+}
+/** Register a native Realtime WebSocket tunnel for providers that expose one. */
+export function registerRealtimeProxy(app, auth, authenticate) {
+    app.route({
+        method: "GET",
+        url: "/aisubs/:provider/:account/v1/realtime",
+        async preValidation(request, reply) {
+            if (!(await authenticate(request))) {
+                await reply.code(401).send({
+                    error: {
+                        message: "Unauthorized",
+                        type: "authentication_error",
+                        code: "invalid_api_key",
+                    },
+                });
+            }
+        },
+        async handler(_request, reply) {
+            await reply.code(426).send({
+                error: {
+                    message: "Use a WebSocket connection for the Realtime endpoint",
+                    type: "invalid_request_error",
+                    code: "websocket_required",
+                },
+            });
+        },
+        wsHandler(socket, request) {
+            const params = request.params;
+            const url = new URL(request.url, "http://aisubs.local");
+            url.searchParams.delete("key");
+            const search = url.search;
+            const pending = [];
+            let pendingBytes = 0;
+            let upstream;
+            socket.on("message", (data, binary) => {
+                if (upstream?.readyState === WebSocket.OPEN) {
+                    upstream.send(data, { binary });
+                    return;
+                }
+                const bytes = rawDataBytes(data);
+                pendingBytes += bytes;
+                if (pending.length >= 100 || pendingBytes > 1024 * 1024) {
+                    socket.close(1009, "Realtime startup queue exceeded");
+                    return;
+                }
+                pending.push({ data, binary });
+            });
+            socket.once("close", (code, reason) => {
+                if (upstream?.readyState === WebSocket.OPEN)
+                    closeSocket(upstream, code, reason);
+                else
+                    upstream?.terminate();
+            });
+            void auth
+                .authorizeProxyRequest(params.provider, params.account, `realtime${search}`, {
+                method: "GET",
+                headers: clientHeaders(request),
+            })
+                .then((authorized) => {
+                if (socket.readyState !== WebSocket.OPEN)
+                    return;
+                const target = new URL(authorized.url);
+                target.protocol = target.protocol === "https:" ? "wss:" : "ws:";
+                const protocols = request.headers["sec-websocket-protocol"]
+                    ?.split(",")
+                    .map((value) => value.trim())
+                    .filter(Boolean);
+                upstream = protocols?.length
+                    ? new WebSocket(target, protocols, { headers: upstreamHeaders(authorized) })
+                    : new WebSocket(target, { headers: upstreamHeaders(authorized) });
+                upstream.on("open", () => {
+                    for (const item of pending)
+                        upstream.send(item.data, { binary: item.binary });
+                    pending.length = 0;
+                    pendingBytes = 0;
+                });
+                upstream.on("message", (data, binary) => {
+                    if (socket.readyState === WebSocket.OPEN)
+                        socket.send(data, { binary });
+                });
+                upstream.on("close", (code, reason) => {
+                    if (socket.readyState === WebSocket.OPEN)
+                        closeSocket(socket, code, reason);
+                });
+                upstream.on("error", (error) => {
+                    if (socket.readyState === WebSocket.OPEN) {
+                        socket.send(JSON.stringify({
+                            type: "error",
+                            error: {
+                                type: "provider_error",
+                                code: "realtime_connection_failed",
+                                message: errorMessage(error),
+                            },
+                        }));
+                        socket.close(1011, "Provider Realtime connection failed");
+                    }
+                });
+            })
+                .catch((error) => {
+                if (socket.readyState === WebSocket.OPEN) {
+                    socket.send(JSON.stringify({
+                        type: "error",
+                        error: {
+                            type: "provider_error",
+                            code: "realtime_connection_failed",
+                            message: errorMessage(error),
+                        },
+                    }));
+                    socket.close(1011, "Provider Realtime connection failed");
+                }
+            });
+        },
+    });
+}

package/dist/store.js

@@ -5,6 +5,24 @@ import { dirname, join, resolve } from "node:path";
 import { abortableDelay, isRecord } from "./utils.js";
 const LOCK_TIMEOUT_MS = 15_000;
 const LOCK_STALE_MS = 120_000;
+function isCredential(value) {
+    if (!isRecord(value) || typeof value.accessToken !== "string")
+        return false;
+    if (typeof value.expiresAt !== "number" || !Number.isFinite(value.expiresAt))
+        return false;
+    if (value.refreshToken != null && typeof value.refreshToken !== "string")
+        return false;
+    if (value.account != null &&
+        (!isRecord(value.account) ||
+            ![value.account.id, value.account.label, value.account.email, value.account.plan].every((item) => item == null || typeof item === "string")))
+        return false;
+    return (value.metadata == null ||
+        (isRecord(value.metadata) &&
+            Object.values(value.metadata).every((item) => item == null ||
+                typeof item === "string" ||
+                typeof item === "number" ||
+                typeof item === "boolean")));
+}
 export function defaultAiSubsDataDir() {
     const override = process.env.AISUBS_DATA_DIR?.trim();
     return override ? resolve(override) : join(homedir(), ".aisubs");
@@ -61,7 +79,15 @@ export class FileApiKeyStore {
 async function readEnvelope(file) {
     try {
         const parsed = JSON.parse(await readFile(file, "utf8"));
-        return isRecord(parsed) ? parsed : {};
+        if (!isRecord(parsed))
+            throw new Error("Credential store must contain a JSON object");
+        const credentials = {};
+        for (const [key, value] of Object.entries(parsed)) {
+            if (!isCredential(value))
+                throw new Error(`Credential store entry ${key} is invalid`);
+            credentials[key] = value;
+        }
+        return credentials;
     }
     catch (error) {
         if (error.code === "ENOENT")

package/dist/usage.js

@@ -412,7 +412,7 @@ export function parseGrokUsage(raw, userRaw, settingsRaw) {
             ...(unified ? [{ label: "Usage pool", value: "Shared across Grok products" }] : []),
         ],
         note: percentUsed == null
-            ? "For this Free account, xAI provides only the reset time, not current usage or remaining allowance. Access may stop before the reset if the included allowance is exhausted."
+            ? "xAI provides only the reset time for this account, not current usage or remaining allowance. Access may stop before the reset if the included allowance is exhausted."
             : undefined,
     };
 }

package/examples/direct.mjs

@@ -3,25 +3,49 @@ import { join } from "node:path";
 import {
   FileCredentialStore,
   chatGptProvider,
+  claudeProvider,
   copilotProvider,
   createSubscriptionAuth,
   grokProvider,
+  openCodeGoProvider,
+  openCodeZenProvider,
 } from "aisubs";
 
 const provider = process.argv[2] ?? "chatgpt";
 const accountKey = process.argv[3] ?? "default";
-if (!["chatgpt", "copilot", "grok"].includes(provider)) {
-  throw new Error("Use chatgpt, copilot, or grok");
+const providers = [
+  chatGptProvider(),
+  claudeProvider(),
+  copilotProvider(),
+  grokProvider(),
+  openCodeGoProvider(),
+  openCodeZenProvider(),
+];
+if (!providers.some((candidate) => candidate.id === provider)) {
+  throw new Error(`Use one of: ${providers.map((candidate) => candidate.id).join(", ")}`);
 }
 
 const auth = createSubscriptionAuth({
   store: new FileCredentialStore(join(homedir(), ".aisubs-demo", "credentials.json")),
-  providers: [chatGptProvider(), copilotProvider(), grokProvider()],
+  providers,
 });
 const account = auth.account(provider, accountKey);
 
 if (!(await account.status()).authenticated) {
-  const login = await account.signIn();
+  const apiKey =
+    provider === "opencode-go"
+      ? process.env.OPENCODE_GO_API_KEY
+      : provider === "opencode-zen"
+        ? process.env.OPENCODE_API_KEY
+        : undefined;
+  if (provider.startsWith("opencode-") && !apiKey) {
+    throw new Error(
+      provider === "opencode-go"
+        ? "Set OPENCODE_GO_API_KEY before signing in"
+        : "Set OPENCODE_API_KEY before signing in",
+    );
+  }
+  const login = await account.signIn(apiKey ? { apiKey } : undefined);
   if (login.prompt.mode === "browser") {
     console.log(`Open ${login.prompt.authorizationUri}`);
   } else if (login.prompt.mode === "device") {
@@ -32,7 +56,6 @@ if (!(await account.status()).authenticated) {
   console.log("Signed in; refresh credentials were saved securely.");
 }
 
-// In-process request: no localhost server, port, CORS, or control API key.
-const response = await account.proxy("models");
-console.log(`Provider response: ${response.status}`);
-console.log((await response.text()).slice(0, 1000));
+// In-process SDK request: no localhost server, port, CORS, or control API key.
+const catalog = await account.getModels();
+console.log(catalog?.models ?? []);

package/examples/server.mjs

@@ -4,9 +4,12 @@ import {
   FileCredentialStore,
   FileApiKeyStore,
   chatGptProvider,
+  claudeProvider,
   copilotProvider,
   createSubscriptionAuth,
   grokProvider,
+  openCodeGoProvider,
+  openCodeZenProvider,
 } from "aisubs";
 import { createSubscriptionAuthServer } from "aisubs/http";
 
@@ -16,7 +19,14 @@ const apiKey =
   (await new FileApiKeyStore(join(directory, "api-key")).readOrCreate());
 const auth = createSubscriptionAuth({
   store: new FileCredentialStore(join(directory, "credentials.json")),
-  providers: [chatGptProvider(), copilotProvider(), grokProvider()],
+  providers: [
+    chatGptProvider(),
+    claudeProvider(),
+    copilotProvider(),
+    grokProvider(),
+    openCodeGoProvider(),
+    openCodeZenProvider(),
+  ],
 });
 const server = await createSubscriptionAuthServer({ auth, apiKey, port: 4319 });
 console.log(`AI Subs API: ${server.url}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aisubs",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Connect AI provider accounts and use those subscriptions from any local tool or as api.",
   "keywords": [
     "ai",
@@ -38,6 +38,8 @@
     "dashboard/public/aisubs-mark.svg",
     "examples",
     "public",
+    "scripts/codex-catalog.mjs",
+    "CHANGELOG.md",
     "README.md"
   ],
   "type": "module",
@@ -83,6 +85,7 @@
   },
   "scripts": {
     "dev": "node --run build && node scripts/dev.mjs",
+    "codex:catalog": "node scripts/codex-catalog.mjs",
     "prepare": "node --run build",
     "build": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.json && tsc -p dashboard/tsconfig.json --noEmit && vite build --config dashboard/vite.config.ts",
     "prepack": "node --run check",
@@ -93,11 +96,18 @@
     "fmt:check": "oxfmt --check .",
     "check": "node --run typecheck && node --run lint && node --run fmt:check && node --run test && node --run build"
   },
+  "dependencies": {
+    "@fastify/cors": "^11.3.0",
+    "@fastify/websocket": "^11.3.0",
+    "fastify": "^5.12.0",
+    "ws": "^8.18.3"
+  },
   "devDependencies": {
     "@tailwindcss/vite": "^4.3.3",
     "@types/node": "^26.2.0",
     "@types/react": "^19.2.18",
     "@types/react-dom": "^19.2.4",
+    "@types/ws": "^8.18.1",
     "@vitejs/plugin-react": "^6.0.5",
     "lucide-react": "^1.31.0",
     "oxfmt": "^0.63.0",

package/scripts/codex-catalog.mjs

@@ -0,0 +1,203 @@
+#!/usr/bin/env node
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+
+const home = homedir();
+const base = (process.env.AISUBS_URL ?? "http://127.0.0.1:4319").replace(/\/+$/, "");
+const keyPath = join(home, ".aisubs", "api-key");
+const key = (
+  process.env.AISUBS_API_KEY ?? (await readFile(keyPath, "utf8").catch(() => ""))
+).trim();
+const output = process.env.CODEX_CATALOG ?? join(home, ".codex", "aisubs-catalog.json");
+const codexConfig = process.env.CODEX_CONFIG ?? join(home, ".codex", "config.toml");
+const providers = (
+  process.env.AISUBS_PROVIDERS ?? "chatgpt,claude,copilot,grok,opencode-go,opencode-zen"
+)
+  .split(",")
+  .map((value) => value.trim())
+  .filter(Boolean);
+
+if (!key) throw new Error(`AISubs API key not found in ${keyPath}`);
+
+const message = (error) => (error instanceof Error ? error.message : String(error));
+
+const headers = { authorization: `Bearer ${key}`, accept: "application/json" };
+async function get(path) {
+  const response = await fetch(`${base}${path}`, { headers });
+  const text = await response.text();
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    body = text;
+  }
+  if (!response.ok) {
+    const failure = body?.error;
+    const detail =
+      typeof body === "string"
+        ? body.slice(0, 240)
+        : typeof failure === "string"
+          ? failure
+          : (failure?.message ?? body?.message ?? response.status);
+    throw new Error(`${path}: ${detail}`);
+  }
+  return body;
+}
+
+try {
+  await get("/health");
+} catch (error) {
+  throw new Error(
+    `AISubs is not reachable at ${base}. Start it with "nub run dev" and run this command again. ${message(error)}`,
+  );
+}
+
+const native = await readFile(join(home, ".codex", "models_cache.json"), "utf8")
+  .then(JSON.parse)
+  .catch(() => ({ models: [] }));
+const template = native.models?.[0] ?? {
+  default_reasoning_level: "medium",
+  supported_reasoning_levels: ["low", "medium", "high"].map((effort) => ({ effort })),
+  shell_type: "shell_command",
+  visibility: "list",
+  supported_in_api: true,
+};
+const entries = new Map();
+const failures = [];
+const usable = (model) => {
+  const endpoints = model.capabilities?.endpoints ?? model.endpoints ?? [];
+  return endpoints.some((endpoint) => {
+    const normalized = String(endpoint).replace(/^\/?(?:v1\/)?/, "");
+    return (
+      ["responses", "chat/completions", "messages"].includes(normalized) ||
+      normalized.startsWith("models/")
+    );
+  });
+};
+for (const provider of providers) {
+  let accounts;
+  try {
+    accounts = await get(`/v1/auth/${provider}/accounts`);
+  } catch (error) {
+    failures.push(`${provider}: ${message(error)}`);
+    continue;
+  }
+  for (const account of accounts.accounts ?? accounts) {
+    // The account-list API returns the route key as `accountKey`; `account`
+    // is the nested display/identity object.
+    const accountId = account.accountKey ?? account.account ?? account.name;
+    if (!accountId) continue;
+    let catalog;
+    try {
+      catalog = await get(`/aisubs/${provider}/${encodeURIComponent(accountId)}/v1/models`);
+    } catch (error) {
+      failures.push(`${provider}/${accountId}: ${message(error)}`);
+      continue;
+    }
+    for (const model of catalog.data ?? catalog.models ?? []) {
+      const id = model.id;
+      if (!id) continue;
+      if (!usable(model)) continue;
+      // GitHub currently advertises this legacy alias but rejects it at
+      // generation time (the backend asks for gpt-5-mini-2025-08-07).
+      // Omitting it prevents Codex from presenting a model that cannot run.
+      if (provider === "copilot" && id === "gpt-5-mini") continue;
+      // Keep OpenAI/ChatGPT's official catalog entries native. Re-emitting
+      // them as `chatgpt/<model>` makes Codex treat them as third-party IDs
+      // and reject them for ChatGPT-authenticated sessions.
+      if (provider === "chatgpt") continue;
+      const slug = `${provider}/${id}`;
+      if (entries.has(slug)) continue;
+      entries.set(slug, {
+        ...template,
+        slug,
+        display_name: `${provider} / ${id}`,
+        description: `AISubs ${provider} account ${accountId}`,
+        visibility: "list",
+        supported_in_api: true,
+        priority: 10,
+        additional_speed_tiers: undefined,
+        service_tiers: undefined,
+        aisubs_provider: provider,
+        aisubs_account: accountId,
+        aisubs_model: id,
+      });
+    }
+  }
+}
+
+const clean = [...entries.values()].map((entry) =>
+  Object.fromEntries(Object.entries(entry).filter(([, value]) => value !== undefined)),
+);
+if (!clean.length) {
+  const detail = failures.length ? `\n${failures.join("\n")}` : "";
+  throw new Error(
+    `No non-ChatGPT models were discovered; refusing to overwrite the existing catalog.${detail}`,
+  );
+}
+// Codex has one active provider per configuration. Keep this catalog scoped to
+// AISubs models; native models are restored by the dashboard's Restore action.
+// Mixing native IDs here makes Codex probe them through the AISubs provider.
+await mkdir(dirname(output), { recursive: true });
+await writeFile(output, `${JSON.stringify({ models: clean }, null, 2)}\n`, { mode: 0o600 });
+await syncCodexConfig();
+console.log(`Wrote ${clean.length} models to ${output}`);
+if (failures.length) console.warn(`Some accounts were skipped:\n${failures.join("\n")}`);
+
+function setRootSetting(config, name, value) {
+  const firstTable = config.search(/^\[/m);
+  const rootEnd = firstTable < 0 ? config.length : firstTable;
+  const root = config.slice(0, rootEnd);
+  const rest = config.slice(rootEnd);
+  const pattern = new RegExp(`^${name}\\s*=.*$`, "m");
+  if (pattern.test(root)) return `${root.replace(pattern, value)}${rest}`;
+
+  const updatedRoot = `${root.trimEnd()}${root.trim() ? "\n" : ""}${value}\n`;
+  return rest ? `${updatedRoot}\n${rest}` : updatedRoot;
+}
+
+async function syncCodexConfig() {
+  await mkdir(dirname(codexConfig), { recursive: true });
+  let config = await readFile(codexConfig, "utf8").catch(() => "");
+  const previousKey = config.match(/^AISUBS_API_KEY\s*=\s*"([^"]+)"/m)?.[1];
+  const keyRotated = previousKey && previousKey !== key;
+  config = setRootSetting(
+    config,
+    "model_catalog_json",
+    `model_catalog_json = ${JSON.stringify(output)}`,
+  );
+  // Codex has one active model_provider per config. Native models are restored
+  // by switching back to the official provider/profile.
+  config = setRootSetting(config, "model_provider", 'model_provider = "aisubs-codex"');
+  const providerBlock = `[model_providers.aisubs-codex]\nname = "AISubs Codex Router"\nbase_url = "${base}/aisubs-codex/v1"\nwire_api = "responses"\nrequires_openai_auth = false\nenv_key = "AISUBS_API_KEY"\n`;
+  const providerPattern = /\[model_providers\.aisubs-codex\][\s\S]*?(?=\n\[|$)/;
+  config = providerPattern.test(config)
+    ? config.replace(providerPattern, providerBlock.trimEnd())
+    : `${config.trimEnd()}\n\n${providerBlock}`;
+
+  const envLine = `AISUBS_API_KEY = ${JSON.stringify(key)}`;
+  if (/^\[shell_environment_policy\.set\]$/m.test(config)) {
+    const marker = "[shell_environment_policy.set]";
+    const start = config.indexOf(marker) + marker.length;
+    const next = config.indexOf("\n[", start);
+    const end = next < 0 ? config.length : next;
+    const section = config.slice(start, end);
+    config = /^AISUBS_API_KEY\s*=.*$/m.test(section)
+      ? `${config.slice(0, start)}${section.replace(/^AISUBS_API_KEY\s*=.*$/m, envLine)}${config.slice(end)}`
+      : `${config.slice(0, end)}\n${envLine}${config.slice(end)}`;
+  } else {
+    config += `\n\n[shell_environment_policy.set]\n${envLine}\n`;
+  }
+  await writeFile(codexConfig, config, { mode: 0o600 });
+  console.log(`Updated ${codexConfig}`);
+  if (keyRotated) {
+    console.log(
+      `\nAISubs API key changed. Next steps:\n` +
+        `1. Restart the AISubs server (nub run dev).\n` +
+        `2. Restart Codex Desktop completely.\n` +
+        `3. Run this sync again if the model catalog is stale.\n` +
+        `4. Send a small test prompt before normal use.\n`,
+    );
+  }
+}