codex-multi-auth 2.1.3 → 2.1.5

package/scripts/codex.js

@@ -1,4 +1,4 @@
-#!/usr/bin/env node
+#!/usr/bin/env node
 
 import { spawn } from "node:child_process";
 import { createHash, randomBytes } from "node:crypto";
@@ -41,6 +41,23 @@ const RUNTIME_ROTATION_SHADOW_HOME_OMIT_STATE_FILES = new Set([
 	"auth.json",
 	"accounts.json",
 ]);
+const RUNTIME_ROTATION_SHADOW_HOME_OMIT_ROOT_DIRS = new Set(["multi-auth"]);
+const RUNTIME_ROTATION_SHADOW_HOME_LINK_ONLY_ROOT_DIRS = new Set([
+	".sandbox",
+	".sandbox-bin",
+	".sandbox-secrets",
+	".tmp",
+	"ambient-suggestions",
+	"archived_sessions",
+	"backups",
+	"cache",
+	"generated_images",
+	"log",
+	"sqlite",
+	"tmp",
+	"understand-anything",
+	"vendor_imports",
+]);
 const SHADOW_HOME_STATE_FILE_SET = new Set(SHADOW_HOME_STATE_FILES);
 const SHADOW_HOME_CONFIG_FILE = "config.toml";
 const SHADOW_HOME_SYNC_LOCK_DIR = ".codex-multi-auth-shadow-sync.lock";
@@ -63,8 +80,8 @@ const DEFAULT_APP_RUNTIME_HELPER_DETACH_GRACE_MS = 5_000;
 const APP_RUNTIME_HELPER_LAUNCH_TIMEOUT_MS = 15_000;
 const APP_SERVER_SHIM_DIR_NAME = "app-server-shims";
 const APP_SERVER_SHIM_HELPER_PREFIX = "helper-";
-const DEFAULT_STARTUP_AUTO_UPDATE_BUDGET_MS = 3_000;
-const STARTUP_AUTO_UPDATE_TIMED_OUT = Symbol("startup-auto-update-timed-out");
+const DEFAULT_STARTUP_UPDATE_NOTICE_BUDGET_MS = 3_000;
+const STARTUP_UPDATE_NOTICE_TIMED_OUT = Symbol("startup-update-notice-timed-out");
 let shadowHomeCleanupBusyFailuresRemaining = Number.parseInt(
 	process.env.CODEX_MULTI_AUTH_TEST_SHADOW_CLEANUP_BUSY_FAILURES ?? "0",
 	10,
@@ -89,6 +106,9 @@ const shadowHomeCleanupRetryMarkerDir =
 	(process.env.CODEX_MULTI_AUTH_TEST_SHADOW_RETRY_MARKER_DIR ?? "").trim();
 let warnedInvalidRuntimeRotationProxyEnv = false;
 let warnedPendingAccountReadIdOverflow = false;
+let warnedShadowHomeSqliteLinkFailure = false;
+const warnedShadowHomeLinkOnlyDirectoryFailures = new Set();
+const warnedShadowHomeSqliteSidecarPlaceholderFailures = new Set();
 
 async function loadRuntimeConstants() {
 	const fallback = {
@@ -260,31 +280,27 @@ function readBooleanEnvFlag(name) {
 	return null;
 }
 
-function isStartupAutoUpdateDebugEnabled() {
+function isStartupUpdateNoticeDebugEnabled() {
 	return readBooleanEnvFlag("CODEX_MULTI_AUTH_DEBUG") === true;
 }
 
-function shouldLogStartupAutoUpdateProgress() {
-	return process.stderr.isTTY === true || isStartupAutoUpdateDebugEnabled();
+function shouldLogStartupUpdateNotice() {
+	return process.stderr.isTTY === true || isStartupUpdateNoticeDebugEnabled();
 }
 
-function readStartupAutoUpdateBudgetMs() {
+function readStartupUpdateNoticeBudgetMs() {
 	const raw =
-		process.env.CODEX_MULTI_AUTH_AUTO_UPDATE_STARTUP_BUDGET_MS ??
-		process.env.CODEX_MULTI_AUTH_TEST_STARTUP_AUTO_UPDATE_BUDGET_MS;
-	if (!raw) return DEFAULT_STARTUP_AUTO_UPDATE_BUDGET_MS;
+		process.env.CODEX_MULTI_AUTH_UPDATE_NOTICE_STARTUP_BUDGET_MS ??
+		process.env.CODEX_MULTI_AUTH_TEST_STARTUP_UPDATE_NOTICE_BUDGET_MS;
+	if (!raw) return DEFAULT_STARTUP_UPDATE_NOTICE_BUDGET_MS;
 	const parsed = Number.parseInt(raw, 10);
 	return Number.isFinite(parsed) && parsed > 0
 		? parsed
-		: DEFAULT_STARTUP_AUTO_UPDATE_BUDGET_MS;
+		: DEFAULT_STARTUP_UPDATE_NOTICE_BUDGET_MS;
 }
 
-function resolveStartupAutoUpdateTimeouts(budgetMs) {
-	const fetchTimeoutMs = Math.max(1, Math.floor(budgetMs * 0.4));
-	return {
-		fetchTimeoutMs,
-		updateTimeoutMs: Math.max(1, budgetMs - fetchTimeoutMs),
-	};
+function resolveStartupUpdateNoticeTimeoutMs(budgetMs) {
+	return Math.max(1, Math.floor(budgetMs * 0.8));
 }
 
 function isModuleNotFoundError(error) {
@@ -296,7 +312,7 @@ function isModuleNotFoundError(error) {
 	);
 }
 
-function shouldRunStartupAutoUpdate(rawArgs, normalizedArgs) {
+function shouldRunStartupUpdateNotice(rawArgs, normalizedArgs) {
 	if ((process.env.CODEX_MULTI_AUTH_BYPASS ?? "").trim() === "1") {
 		return false;
 	}
@@ -309,7 +325,7 @@ function shouldRunStartupAutoUpdate(rawArgs, normalizedArgs) {
 	return true;
 }
 
-async function withStartupAutoUpdateBudget(promise, budgetMs) {
+async function withStartupUpdateNoticeBudget(promise, budgetMs) {
 	let timeout = null;
 	try {
 		return await Promise.race([
@@ -318,7 +334,7 @@ async function withStartupAutoUpdateBudget(promise, budgetMs) {
 				timeout = setTimeout(
 					() => {
 						timeout?.unref?.();
-						resolve(STARTUP_AUTO_UPDATE_TIMED_OUT);
+						resolve(STARTUP_UPDATE_NOTICE_TIMED_OUT);
 					},
 					budgetMs,
 				);
@@ -329,51 +345,42 @@ async function withStartupAutoUpdateBudget(promise, budgetMs) {
 	}
 }
 
-function logStartupAutoUpdateDebug(message) {
-	if (isStartupAutoUpdateDebugEnabled()) {
+function logStartupUpdateNoticeDebug(message) {
+	if (isStartupUpdateNoticeDebugEnabled()) {
 		console.error(`codex-multi-auth: ${message}`);
 	}
 }
 
-async function autoUpdatePackageIfEnabled(rawArgs, normalizedArgs) {
-	if (!shouldRunStartupAutoUpdate(rawArgs, normalizedArgs)) return;
-	const budgetMs = readStartupAutoUpdateBudgetMs();
-	const { fetchTimeoutMs, updateTimeoutMs } =
-		resolveStartupAutoUpdateTimeouts(budgetMs);
+async function showUpdateNoticeIfAvailable(rawArgs, normalizedArgs) {
+	if (!shouldRunStartupUpdateNotice(rawArgs, normalizedArgs)) return;
+	const budgetMs = readStartupUpdateNoticeBudgetMs();
+	const fetchTimeoutMs = resolveStartupUpdateNoticeTimeoutMs(budgetMs);
 	try {
-		const mod = await import("../dist/lib/auto-update-checker.js");
-		if (typeof mod.autoUpdateIfAvailable !== "function") {
+		const mod = await import("../dist/lib/update-notice.js");
+		if (typeof mod.checkForUpdates !== "function") {
 			return;
 		}
-		const updatePromise = mod.autoUpdateIfAvailable({
-			fetchTimeoutMs,
-			timeoutMs: updateTimeoutMs,
-			onUpdateStart: (update) => {
-				if (!update?.latestVersion) return;
-				if (!shouldLogStartupAutoUpdateProgress()) return;
-				console.error(
-					`codex-multi-auth: auto-update found ${update.latestVersion}; starting npm update -g codex-multi-auth. Startup will continue if it exceeds ${budgetMs}ms.`,
-				);
-			},
-		});
-		const result = await withStartupAutoUpdateBudget(updatePromise, budgetMs);
-		if (result === STARTUP_AUTO_UPDATE_TIMED_OUT) {
-			logStartupAutoUpdateDebug(
-				`auto-update skipped: startup budget exceeded after ${budgetMs}ms`,
+		const checkPromise = mod.checkForUpdates(false, fetchTimeoutMs);
+		const result = await withStartupUpdateNoticeBudget(checkPromise, budgetMs);
+		if (result === STARTUP_UPDATE_NOTICE_TIMED_OUT) {
+			logStartupUpdateNoticeDebug(
+				`update notice skipped: startup budget exceeded after ${budgetMs}ms`,
 			);
 			return;
 		}
-		if (result?.updated && result.latestVersion) {
-			if (shouldLogStartupAutoUpdateProgress()) {
+		if (result?.hasUpdate && result.latestVersion && shouldLogStartupUpdateNotice()) {
+			if (typeof mod.formatManualUpdateNotice === "function") {
+				console.error(mod.formatManualUpdateNotice(result));
+			} else {
 				console.error(
-					`codex-multi-auth: auto-updated to ${result.latestVersion}. New sessions will use the latest package.`,
+					`codex-multi-auth update available: v${result.latestVersion}; current: v${result.currentVersion}; run: ${result.updateCommand}`,
 				);
 			}
 		}
 	} catch (error) {
 		if (isModuleNotFoundError(error)) return;
-		logStartupAutoUpdateDebug(
-			`auto-update skipped: ${error instanceof Error ? error.message : String(error)}`,
+		logStartupUpdateNoticeDebug(
+			`update notice skipped: ${error instanceof Error ? error.message : String(error)}`,
 		);
 	}
 }
@@ -1878,6 +1885,41 @@ function mirrorDirectoryIntoShadowHome(sourcePath, destinationPath) {
 	return "copied";
 }
 
+function linkDirectoryIntoShadowHome(sourcePath, destinationPath) {
+	try {
+		if ((process.env.CODEX_MULTI_AUTH_TEST_FORCE_SHADOW_DIR_COPY ?? "").trim() === "1") {
+			throw new Error("simulated directory link failure");
+		}
+		symlinkSync(
+			sourcePath,
+			destinationPath,
+			process.platform === "win32" ? "junction" : "dir",
+		);
+		return true;
+	} catch {
+		return false;
+	}
+}
+
+function warnSkippedLinkOnlyShadowHomeDirectory(name) {
+	if (warnedShadowHomeLinkOnlyDirectoryFailures.has(name)) {
+		return;
+	}
+	warnedShadowHomeLinkOnlyDirectoryFailures.add(name);
+	console.error(
+		`codex-multi-auth: skipped optional shadow-home directory ${name} because linking failed; refusing to copy generated runtime data.`,
+	);
+}
+
+function shouldCopyRuntimeGeneratedShadowHomeDirectoryFallback() {
+	const normalized = (
+		process.env.CODEX_MULTI_AUTH_RUNTIME_SHADOW_COPY_GENERATED_DIRS ?? ""
+	)
+		.trim()
+		.toLowerCase();
+	return normalized === "1" || normalized === "true" || normalized === "yes";
+}
+
 function linkFileIntoShadowHome(sourcePath, destinationPath) {
 	try {
 		symlinkSync(sourcePath, destinationPath, "file");
@@ -1902,6 +1944,148 @@ function mirrorFileIntoShadowHome(sourcePath, destinationPath, tightenFile) {
 	tightenFile(destinationPath);
 }
 
+function isSqliteMainFile(name) {
+	return /\.sqlite$/i.test(name);
+}
+
+function isSqliteSidecarFile(name) {
+	return /\.sqlite-(?:shm|wal)$/i.test(name);
+}
+
+function normalizeRuntimeShadowHomeEntryName(name) {
+	return process.platform === "win32" || process.platform === "darwin"
+		? name.toLowerCase()
+		: name;
+}
+
+function isCodexRuntimeLocalSqliteFile(name) {
+	const normalizedName = normalizeRuntimeShadowHomeEntryName(name);
+	return /^(?:state|logs)_\d+\.sqlite(?:-(?:shm|wal))?$/.test(normalizedName);
+}
+
+function isCodexRuntimeTransientStateFile(name) {
+	const normalizedName = normalizeRuntimeShadowHomeEntryName(name);
+	return (
+		/^(?:auth|accounts)\.json\.\d+\.[a-z0-9]+\.tmp$/.test(
+			normalizedName,
+		) ||
+		/^\.codex-global-state\.json\.tmp-[a-z0-9-]+$/.test(normalizedName)
+	);
+}
+
+function isRuntimeRotationShadowHomeOmittedEntry(name) {
+	const normalizedName = normalizeRuntimeShadowHomeEntryName(name);
+	return (
+		RUNTIME_ROTATION_SHADOW_HOME_OMIT_ROOT_DIRS.has(normalizedName) ||
+		isCodexRuntimeLocalSqliteFile(name) ||
+		isCodexRuntimeTransientStateFile(name)
+	);
+}
+
+function isRuntimeRotationShadowHomeLinkOnlyDirectory(name) {
+	const normalizedName = normalizeRuntimeShadowHomeEntryName(name);
+	return RUNTIME_ROTATION_SHADOW_HOME_LINK_ONLY_ROOT_DIRS.has(normalizedName);
+}
+
+function shouldMaterializeFileIntoShadowHome(name) {
+	return isSqliteMainFile(name) || isSqliteSidecarFile(name);
+}
+
+function warnSkippedSqliteShadowHomeMaterialization() {
+	if (!warnedShadowHomeSqliteLinkFailure) {
+		warnedShadowHomeSqliteLinkFailure = true;
+		console.error(
+			"codex-multi-auth: skipped SQLite shadow-home materialization because linking failed; refusing to copy active SQLite state.",
+		);
+	}
+}
+
+function warnSkippedSqliteShadowHomeSidecarPlaceholder(error, destinationPath) {
+	if (!warnedShadowHomeSqliteSidecarPlaceholderFailures.has(destinationPath)) {
+		warnedShadowHomeSqliteSidecarPlaceholderFailures.add(destinationPath);
+		console.error(
+			`codex-multi-auth: skipped SQLite shadow-home sidecar placeholder for ${destinationPath} because linking failed: ${error instanceof Error ? error.message : String(error)}`,
+		);
+	}
+}
+
+function materializeSqliteSidecarPlaceholder(sourceSidecarPath, destinationSidecarPath) {
+	try {
+		if (
+			(process.env.CODEX_MULTI_AUTH_TEST_FORCE_SHADOW_SIDECAR_PLACEHOLDER_FAILURE ??
+				""
+			).trim() === "1"
+		) {
+			const error = new Error("simulated SQLite sidecar placeholder failure");
+			error.code = "EPERM";
+			throw error;
+		}
+		symlinkSync(sourceSidecarPath, destinationSidecarPath, "file");
+		return true;
+	} catch (error) {
+		if (error?.code === "EEXIST") {
+			return true;
+		}
+		warnSkippedSqliteShadowHomeSidecarPlaceholder(error, destinationSidecarPath);
+		return false;
+	}
+}
+
+function materializeFileIntoShadowHome(sourcePath, destinationPath) {
+	try {
+		if (
+			(process.env.CODEX_MULTI_AUTH_TEST_FORCE_SHADOW_SQLITE_SIDECAR_LINK_FAILURE ??
+				""
+			).trim() === "1" &&
+			isSqliteSidecarFile(basename(sourcePath))
+		) {
+			throw new Error("simulated SQLite sidecar link failure");
+		}
+		if (linkFileIntoShadowHome(sourcePath, destinationPath)) {
+			return true;
+		}
+		warnSkippedSqliteShadowHomeMaterialization();
+	} catch {
+		warnSkippedSqliteShadowHomeMaterialization();
+	}
+	return false;
+}
+
+function materializeSqliteSidecarsIntoShadowHome(sourcePath, destinationPath) {
+	for (const suffix of ["-wal", "-shm"]) {
+		const sourceSidecarPath = `${sourcePath}${suffix}`;
+		const destinationSidecarPath = `${destinationPath}${suffix}`;
+		if (existsSync(destinationSidecarPath)) {
+			continue;
+		}
+		if (existsSync(sourceSidecarPath)) {
+			if (!materializeFileIntoShadowHome(sourceSidecarPath, destinationSidecarPath)) {
+				if (!materializeSqliteSidecarPlaceholder(
+					sourceSidecarPath,
+					destinationSidecarPath,
+				)) {
+					return false;
+				}
+			}
+			continue;
+		}
+		if (!materializeSqliteSidecarPlaceholder(sourceSidecarPath, destinationSidecarPath)) {
+			return false;
+		}
+	}
+	return true;
+}
+
+function removeSqliteShadowHomeMaterialization(destinationPath) {
+	for (const path of [destinationPath, `${destinationPath}-wal`, `${destinationPath}-shm`]) {
+		try {
+			rmSync(path, { force: true });
+		} catch {
+			// Best-effort cleanup; keep removing the remaining SQLite siblings.
+		}
+	}
+}
+
 function collectShadowHomeSyncFileNames(shadowCodexHome, syncFileNames) {
 	try {
 		for (const entry of readdirSync(shadowCodexHome, { withFileTypes: true })) {
@@ -2011,9 +2195,14 @@ function syncAdditionalShadowHomeFiles(
 	originalFileStates,
 	tightenFile,
 	skipSyncBackNames = new Set(),
+	skipSyncBackPredicate = () => false,
 ) {
 	for (const name of names) {
-		if (SHADOW_HOME_STATE_FILE_SET.has(name) || skipSyncBackNames.has(name)) {
+		if (
+			SHADOW_HOME_STATE_FILE_SET.has(name) ||
+			skipSyncBackNames.has(name) ||
+			skipSyncBackPredicate(name)
+		) {
 			continue;
 		}
 		const shadowPath = join(shadowCodexHome, name);
@@ -2049,6 +2238,10 @@ function createShadowHomeMirror(
 ) {
 	const syncFileNames = new Set(SHADOW_HOME_STATE_FILES);
 	const skipSyncBackNames = new Set(options.skipSyncBackNames ?? []);
+	const skipMirrorPredicate = options.skipMirrorPredicate ?? (() => false);
+	const skipSyncBackPredicate = options.skipSyncBackPredicate ?? (() => false);
+	const linkOnlyDirectoryPredicate =
+		options.linkOnlyDirectoryPredicate ?? (() => false);
 	const originalFileStates = new Map();
 	const copiedDirectoryNames = new Set();
 	const rememberSyncFile = (name) => {
@@ -2070,11 +2263,13 @@ function createShadowHomeMirror(
 			if (
 				name === SHADOW_HOME_CONFIG_FILE ||
 				name === SHADOW_HOME_SYNC_STATE_FILE ||
-				name === SHADOW_HOME_SYNC_LOCK_DIR
+				name === SHADOW_HOME_SYNC_LOCK_DIR ||
+				skipMirrorPredicate(name)
 			) {
 				continue;
 			}
 			const isKnownStateFile = SHADOW_HOME_STATE_FILE_SET.has(name);
+			const shouldMaterializeFile = shouldMaterializeFileIntoShadowHome(name);
 			const sourcePath = join(originalCodexHome, name);
 			const destinationPath = join(shadowCodexHome, name);
 			if (existsSync(destinationPath)) {
@@ -2093,6 +2288,15 @@ function createShadowHomeMirror(
 					throw new Error(`Expected ${name} to be a file`);
 				}
 				if (directoryLike) {
+					if (
+						linkOnlyDirectoryPredicate(name) &&
+						!shouldCopyRuntimeGeneratedShadowHomeDirectoryFallback()
+					) {
+						if (!linkDirectoryIntoShadowHome(sourcePath, destinationPath)) {
+							warnSkippedLinkOnlyShadowHomeDirectory(name);
+						}
+						continue;
+					}
 					if (mirrorDirectoryIntoShadowHome(sourcePath, destinationPath) === "copied") {
 						copiedDirectoryNames.add(name);
 					}
@@ -2103,6 +2307,15 @@ function createShadowHomeMirror(
 					if (isKnownStateFile) {
 						copyFileSync(sourcePath, destinationPath);
 						tightenFile(destinationPath);
+					} else if (shouldMaterializeFile) {
+						if (isSqliteSidecarFile(name)) {
+							continue;
+						}
+						if (materializeFileIntoShadowHome(sourcePath, destinationPath) && isSqliteMainFile(name)) {
+							if (!materializeSqliteSidecarsIntoShadowHome(sourcePath, destinationPath)) {
+								removeSqliteShadowHomeMaterialization(destinationPath);
+							}
+						}
 					} else {
 						mirrorFileIntoShadowHome(sourcePath, destinationPath, tightenFile);
 					}
@@ -2141,6 +2354,7 @@ function createShadowHomeMirror(
 				originalFileStates,
 				tightenFile,
 				skipSyncBackNames,
+				skipSyncBackPredicate,
 			);
 		} catch {
 			// Best-effort only; runtime auth refreshes should not fail cleanup.
@@ -2197,6 +2411,10 @@ function resolveOriginalMultiAuthDir(env) {
 	return undefined;
 }
 
+function resolveRuntimeRotationOriginalMultiAuthDir(originalCodexHome, env) {
+	return resolveOriginalMultiAuthDir(env) ?? join(originalCodexHome, "multi-auth");
+}
+
 function parseRuntimeRotationProxyEnv(value) {
 	if (value === undefined) return undefined;
 	const normalized = value.trim().toLowerCase();
@@ -2266,6 +2484,16 @@ function resolveRuntimeRotationProxyOriginalCodexHome(baseEnv) {
 	return override || resolveCodexHomeDir(baseEnv);
 }
 
+function createRuntimeRotationShadowHome(originalCodexHome) {
+	const shadowRoot = join(
+		originalCodexHome,
+		"multi-auth",
+		"runtime-shadow-homes",
+	);
+	mkdirSync(shadowRoot, { recursive: true });
+	return mkdtempSync(join(shadowRoot, "codex-multi-auth-runtime-home-"));
+}
+
 function createRuntimeRotationProxyCodexHome(
 	baseEnv,
 	proxyBaseUrl,
@@ -2273,7 +2501,7 @@ function createRuntimeRotationProxyCodexHome(
 	configTomlModule,
 ) {
 	const originalCodexHome = resolveRuntimeRotationProxyOriginalCodexHome(baseEnv);
-	const shadowCodexHome = mkdtempSync(join(tmpdir(), "codex-multi-auth-runtime-home-"));
+	const shadowCodexHome = createRuntimeRotationShadowHome(originalCodexHome);
 	let syncShadowHomeStateBack = () => {};
 	const cleanup = () => {
 		try {
@@ -2296,7 +2524,10 @@ function createRuntimeRotationProxyCodexHome(
 			shadowCodexHome,
 			tightenShadowHomePermissions,
 			{
+				skipMirrorPredicate: isRuntimeRotationShadowHomeOmittedEntry,
 				skipSyncBackNames: RUNTIME_ROTATION_SHADOW_HOME_OMIT_STATE_FILES,
+				skipSyncBackPredicate: isRuntimeRotationShadowHomeOmittedEntry,
+				linkOnlyDirectoryPredicate: isRuntimeRotationShadowHomeLinkOnlyDirectory,
 			},
 		);
 		omitRuntimeRotationShadowHomeStateFiles(shadowCodexHome);
@@ -2321,11 +2552,11 @@ function createRuntimeRotationProxyCodexHome(
 		...baseEnv,
 		CODEX_HOME: shadowCodexHome,
 		OPENAI_API_KEY: clientApiKey,
+		CODEX_MULTI_AUTH_DIR: resolveRuntimeRotationOriginalMultiAuthDir(
+			originalCodexHome,
+			baseEnv,
+		),
 	};
-	const originalMultiAuthDir = resolveOriginalMultiAuthDir(baseEnv);
-	if (originalMultiAuthDir) {
-		forwardedEnv.CODEX_MULTI_AUTH_DIR = originalMultiAuthDir;
-	}
 
 	return {
 		env: forwardedEnv,
@@ -2780,6 +3011,10 @@ function startRuntimeRotationAppHelper(baseContext) {
 			{
 				env: {
 					...baseContext.env,
+					CODEX_MULTI_AUTH_DIR: resolveRuntimeRotationOriginalMultiAuthDir(
+						realCodexHome,
+						baseContext.env,
+					),
 					[APP_RUNTIME_HELPER_OWNER_PID_ENV]: String(process.pid),
 					[APP_RUNTIME_HELPER_REAL_CODEX_HOME_ENV]: realCodexHome,
 				},
@@ -2841,7 +3076,11 @@ function startRuntimeRotationAppHelper(baseContext) {
 	});
 }
 
-async function createRuntimeRotationAppHelperContext(baseContext, configTomlModule) {
+async function createRuntimeRotationAppHelperContext(
+	baseContext,
+	configTomlModule,
+	options = {},
+) {
 	const startedAt = Date.now();
 	const { helper, message } = await startRuntimeRotationAppHelper(baseContext);
 	const helperEnv = message.env ?? {};
@@ -2849,7 +3088,7 @@ async function createRuntimeRotationAppHelperContext(baseContext, configTomlModu
 
 	const cleanup = async ({ exitCode } = {}) => {
 		const livedMs = Date.now() - startedAt;
-		if (exitCode === 0 && livedMs < detachGraceMs) {
+		if (exitCode === 0 && (options.detachOnExit === true || livedMs < detachGraceMs)) {
 			helper.stdout?.destroy();
 			helper.stderr?.destroy();
 			helper.unref();
@@ -2898,6 +3137,11 @@ async function createRuntimeRotationProxyContextIfEnabled(
 	if (isCodexAppCommand(rawArgs)) {
 		return createRuntimeRotationAppHelperContext(baseContext, configTomlModule);
 	}
+	if (isCodexInteractiveTuiCommand(rawArgs)) {
+		return createRuntimeRotationAppHelperContext(baseContext, configTomlModule, {
+			detachOnExit: true,
+		});
+	}
 
 	const proxyModule = await loadRuntimeRotationProxyModule();
 	if (!proxyModule) {
@@ -3092,6 +3336,10 @@ function isCodexAppServerCommand(rawArgs) {
 	return findForwardedCommand(rawArgs)?.command === "app-server";
 }
 
+function isCodexInteractiveTuiCommand(rawArgs) {
+	return findForwardedCommand(rawArgs) === null;
+}
+
 function shouldUseRuntimeRoutingForForwardedArgs(rawArgs) {
 	if (!Array.isArray(rawArgs) || rawArgs.length === 0) {
 		return true;
@@ -3495,6 +3743,8 @@ function repairCodexSessionIndex(codexHome) {
 
 		const additions = [];
 		for (const rolloutPath of collectRolloutFiles(sessionsDir)) {
+			const idFromName = extractRolloutIdFromFilename(basename(rolloutPath));
+			if (idFromName && seen.has(idFromName)) continue;
 			const entry = parseRolloutIndexEntry(rolloutPath);
 			if (!entry || seen.has(entry.id)) continue;
 			seen.add(entry.id);
@@ -3825,7 +4075,7 @@ async function main() {
 	}
 
 	const normalizedArgs = normalizeAuthAlias(rawArgs);
-	await autoUpdatePackageIfEnabled(rawArgs, normalizedArgs);
+	await showUpdateNoticeIfAvailable(rawArgs, normalizedArgs);
 	ensureWindowsShellShimGuards();
 
 	const bypass = (process.env.CODEX_MULTI_AUTH_BYPASS ?? "").trim() === "1";