codex-multi-auth 2.15.0 → 2.17.0

package/scripts/codex.js

@@ -26,7 +26,9 @@ import process from "node:process";
 import { StringDecoder } from "node:string_decoder";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import {
+	isWindowsShimPath,
 	resolveRealCodexBin as resolveRealCodexBinFromEnvironment,
+	resolveWindowsShimPackageEntry,
 	splitPathEntries,
 } from "./codex-bin-resolver.js";
 import { normalizeAuthAlias, shouldHandleMultiAuthAuth } from "./codex-routing.js";
@@ -686,15 +688,15 @@ function resolveModelFamilyForStatus(model) {
 		return "gpt-5.2";
 	}
 	if (normalized.includes("daybreak")) return "gpt-5.2";
-	// GPT-5.6 general tiers share the gpt-5.2 prompt family (see
-	// lib/request/helpers/model-map.ts MODEL_PROFILES). Check before the generic
-	// gpt-5 catch-all, which would otherwise mis-bucket them as codex.
-	if (normalized.startsWith("gpt-5.6")) return "gpt-5.2";
-	if (normalized.startsWith("gpt-5.2")) return "gpt-5.2";
-	if (normalized.startsWith("gpt-5.1")) return "gpt-5.1";
-	if (normalized.includes("codex-max")) return "codex-max";
-	if (normalized.includes("codex")) return "codex";
-	if (normalized.startsWith("gpt-5")) return "gpt-5-codex";
+	// The proxy keys a /codex/responses request by `getModelFamily(model)`
+	// (lib/runtime-rotation-proxy.ts), i.e. the replacement's prompt family.
+	// Every codex model is retired and runs on `gpt-5.6-sol`/`terra`, and every
+	// live or retired general GPT-5 id runs on a model in the gpt-5.2 family, so
+	// status reads that family. The old `codex`/`codex-max`/`gpt-5.1`/
+	// `gpt-5-codex` answers named keys the proxy does not write for these ids.
+	if (normalized.includes("codex") || normalized.startsWith("gpt-5")) {
+		return "gpt-5.2";
+	}
 	return null;
 }
 
@@ -1350,6 +1352,17 @@ function resolveRealCodexBin() {
 			);
 			return null;
 		}
+		if (
+			process.platform === "win32" &&
+			isWindowsShimPath(override) &&
+			!resolveWindowsShimPackageEntry(override)
+		) {
+			console.error(
+				`CODEX_MULTI_AUTH_REAL_CODEX_BIN points at a script shim that cannot be launched directly on Windows: ${override}\n` +
+					"Point it at codex.exe or @openai/codex/bin/codex.js instead.",
+			);
+			return null;
+		}
 		return resolveRealCodexBinFromEnvironment({
 			moduleUrl: import.meta.url,
 			env: process.env,
@@ -1368,8 +1381,36 @@ const MODEL_ACCESS_DENIED_PATTERN =
 	/the model [`'"]([^`'"]+)[`'"] does not exist or you do not have access to it/i;
 const DIRECT_UNSUPPORTED_MODEL_PATTERN =
 	/['"]([^'"]+)['"]\s+model is not supported when using codex with a chatgpt account/i;
-const CURRENT_CODEX_MODEL = "gpt-5.3-codex";
-const LEGACY_CODEX_MODEL = "gpt-5-codex";
+// Every codex model is retired; codex ids run on the replacement OpenAI names
+// for them. Mirrors lib/request/helpers/model-map.ts CURRENT_CODEX_MODEL and
+// RETIRED_MODEL_REPLACEMENTS, pinned in parity by test/retired-models.test.ts.
+const CURRENT_CODEX_MODEL = "gpt-5.6-sol";
+const CODEX_MINI_REPLACEMENT_MODEL = "gpt-5.6-terra";
+const RETIRED_MODEL_REPLACEMENTS = {
+	"gpt-5.4": "gpt-6-sol",
+	"gpt-5.4-mini": "gpt-6-luna",
+	"gpt-5.4-nano": "gpt-6-luna",
+	"gpt-5.4-pro": "gpt-5.5-pro",
+	"gpt-5.2": "gpt-5.6-sol",
+	"gpt-5.2-pro": "gpt-5.5-pro",
+	"gpt-5.1": "gpt-5.6-sol",
+	"gpt-5-mini": "gpt-5.6-terra",
+	"gpt-5-nano": "gpt-5.6-luna",
+	"gpt-5-chat-latest": "gpt-5.6-sol",
+	"gpt-5.1-chat-latest": "gpt-5.6-sol",
+	"gpt-5.2-chat-latest": "gpt-5.6-sol",
+	"gpt-5.3-chat-latest": "gpt-5.6-sol",
+	"gpt-5.3-codex": CURRENT_CODEX_MODEL,
+	"gpt-5.3-codex-spark": CURRENT_CODEX_MODEL,
+	"gpt-5.2-codex": CURRENT_CODEX_MODEL,
+	"gpt-5.1-codex": CURRENT_CODEX_MODEL,
+	"gpt-5.1-codex-max": CURRENT_CODEX_MODEL,
+	"gpt-5-codex": CURRENT_CODEX_MODEL,
+	"codex-max": CURRENT_CODEX_MODEL,
+	"gpt-5.1-codex-mini": CODEX_MINI_REPLACEMENT_MODEL,
+	"gpt-5-codex-mini": CODEX_MINI_REPLACEMENT_MODEL,
+	"codex-mini-latest": CODEX_MINI_REPLACEMENT_MODEL,
+};
 // Mirrors the GPT-6 rows of lib/request/error-classification.ts
 // `DEFAULT_UNSUPPORTED_CODEX_FALLBACK_CHAIN`. This table is walked differently
 // from lib's: `resolveUnsupportedModelRetryTarget` keys on the model named in
@@ -1381,25 +1422,25 @@ const LEGACY_CODEX_MODEL = "gpt-5-codex";
 const WRAPPER_UNSUPPORTED_MODEL_FALLBACK_CHAIN = {
 	"gpt-6-astra": ["gpt-5.6-sol", "gpt-5.5"],
 	"gpt-6-astra-aeon": ["gpt-6-astra", "gpt-5.6-sol"],
+	"gpt-6-sol": ["gpt-5.6-sol"],
+	"gpt-6-luna": ["gpt-5.6-luna"],
 	"gpt-5.6-sol": ["gpt-5.5"],
+	"gpt-5.6-luna": ["gpt-5.5"],
+	"gpt-5.6-terra": ["gpt-5.5"],
 	"gpt-5": ["gpt-5.5"],
 	"gpt-5-pro": ["gpt-5.5-pro"],
-	"gpt-5-chat-latest": ["gpt-5.5"],
-	"gpt-5.5": ["gpt-5.4"],
-	"gpt-5.5-pro": ["gpt-5.4"],
-	"gpt-5.5-2026-04-23": ["gpt-5.4"],
-	"gpt-5.5-pro-2026-04-23": ["gpt-5.4"],
-	"gpt-5.5-20260423": ["gpt-5.4"],
-	"gpt-5.5-pro-20260423": ["gpt-5.4"],
-	"gpt-5.3-codex-spark": [CURRENT_CODEX_MODEL],
-	"codex-max": [CURRENT_CODEX_MODEL],
-	"gpt-5.1-codex-max": [CURRENT_CODEX_MODEL],
-	"codex-mini-latest": [CURRENT_CODEX_MODEL],
-	"gpt-5-codex-mini": [CURRENT_CODEX_MODEL],
-	"gpt-5.1-codex-mini": [CURRENT_CODEX_MODEL],
-	[LEGACY_CODEX_MODEL]: [CURRENT_CODEX_MODEL],
-	"gpt-5.2-codex": [CURRENT_CODEX_MODEL],
-	"gpt-5.1-codex": [CURRENT_CODEX_MODEL],
+	"gpt-5.5-2026-04-23": ["gpt-5.5"],
+	"gpt-5.5-20260423": ["gpt-5.5"],
+	"gpt-5.5-pro-2026-04-23": ["gpt-5.5-pro"],
+	"gpt-5.5-pro-20260423": ["gpt-5.5-pro"],
+	// `gpt-5.5`/`gpt-5.5-pro` are the floor; `gpt-5.4` is retired. A retired id
+	// steps once to its replacement.
+	...Object.fromEntries(
+		Object.entries(RETIRED_MODEL_REPLACEMENTS).map(([retired, replacement]) => [
+			retired,
+			[replacement],
+		]),
+	),
 };
 
 function canonicalizeRequestedModelName(model) {
@@ -2022,9 +2063,10 @@ function hasCliAuthCredentialsStoreOverride(args) {
 // and its GPT-5 normalization helpers.
 // This wrapper runs before the TypeScript build, so it cannot import that source.
 const SUPPORTED_REASONING_EFFORTS_BY_MODEL = {
-	[CURRENT_CODEX_MODEL]: ["low", "medium", "high", "xhigh"],
 	"gpt-6-astra": ["low", "medium", "high", "xhigh", "max", "ultra"],
 	"gpt-6-astra-aeon": ["low", "medium", "high", "xhigh", "max", "ultra"],
+	"gpt-6-sol": ["low", "medium", "high", "xhigh", "max", "ultra"],
+	"gpt-6-luna": ["low", "medium", "high", "xhigh", "max"],
 	"gpt-daybreak-blue-latest": ["low", "medium", "high", "xhigh", "max", "ultra"],
 	"gpt-daybreak-red-latest": ["low", "medium", "high", "xhigh", "max", "ultra"],
 	"gpt-5.6-sol": ["low", "medium", "high", "xhigh", "max", "ultra"],
@@ -2032,15 +2074,6 @@ const SUPPORTED_REASONING_EFFORTS_BY_MODEL = {
 	"gpt-5.6-luna": ["low", "medium", "high", "xhigh", "max"],
 	"gpt-5.5": ["none", "low", "medium", "high", "xhigh"],
 	"gpt-5.5-pro": ["medium", "high", "xhigh"],
-	"gpt-5.4": ["none", "low", "medium", "high", "xhigh"],
-	"gpt-5.4-pro": ["medium", "high", "xhigh"],
-	"gpt-5.4-mini": ["medium"],
-	"gpt-5.4-nano": ["medium"],
-	"gpt-5.2-pro": ["medium", "high", "xhigh"],
-	"gpt-5.2": ["none", "low", "medium", "high", "xhigh"],
-	"gpt-5.1": ["none", "low", "medium", "high"],
-	"gpt-5-mini": ["medium"],
-	"gpt-5-nano": ["medium"],
 };
 
 const REASONING_FALLBACKS = {
@@ -2086,45 +2119,53 @@ const GPT_5_6_LUNA_MODEL = "gpt-5.6-luna";
 const GPT_5_6_FLAGSHIP_ALIAS = "gpt-5.6";
 const GPT_5_6_SOL_TERRA_EFFORTS = ["low", "medium", "high", "xhigh", "max", "ultra"];
 const GPT_5_6_LUNA_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
-// GPT-6 Astra (2026-09-03). No Sol/Terra/Luna split this generation: the
-// flagship plus `aeon`, a long-horizon variant. Same frontier effort ladder as
-// 5.6 (no `none`/`minimal`, `ultra` at the top). Bare `gpt-6` -> flagship.
+// GPT-6 Astra (2026-09-03): the flagship plus `aeon`, a long-horizon variant.
+// Same frontier effort ladder as 5.6 (no `none`/`minimal`, `ultra` at the
+// top). Bare `gpt-6` -> flagship.
 const GPT_6_ASTRA_MODEL = "gpt-6-astra";
 const GPT_6_ASTRA_AEON_MODEL = "gpt-6-astra-aeon";
 const GPT_6_FLAGSHIP_ALIAS = "gpt-6";
 const GPT_6_ASTRA_EFFORTS = ["low", "medium", "high", "xhigh", "max", "ultra"];
+// GPT-6 Sol and Luna (upstream catalog, 2026-09-22). Sol reaches `ultra`, Luna
+// stops at `max`. No GPT-6 Terra. Mirrors lib/request/helpers/model-map.ts.
+const GPT_6_SOL_MODEL = "gpt-6-sol";
+const GPT_6_LUNA_MODEL = "gpt-6-luna";
+const GPT_6_SOL_EFFORTS = GPT_6_ASTRA_EFFORTS;
+const GPT_6_LUNA_EFFORTS = ["low", "medium", "high", "xhigh", "max"];
 // Daybreak cyber models from the upstream Codex catalog. `red` is the
 // cyber-permissive variant, `blue` the defensive one.
 const DAYBREAK_BLUE_MODEL = "gpt-daybreak-blue-latest";
 const DAYBREAK_RED_MODEL = "gpt-daybreak-red-latest";
 const DAYBREAK_EFFORTS = ["low", "medium", "high", "xhigh", "max", "ultra"];
+// Retired minors map to the replacement OpenAI names for them. Mirrors lib.
 const GENERAL_GPT5_VERSION_CATALOG = {
 	1: {
-		base: "gpt-5.1",
+		base: GPT_5_6_SOL_MODEL,
+		pro: GPT_5_5_PRO_CANONICAL_MODEL,
 	},
 	2: {
-		base: "gpt-5.2",
-		pro: "gpt-5.2-pro",
+		base: GPT_5_6_SOL_MODEL,
+		pro: GPT_5_5_PRO_CANONICAL_MODEL,
 	},
 	4: {
-		base: DEFAULT_GENERAL_GPT5_MODEL,
-		pro: "gpt-5.4-pro",
-		mini: "gpt-5.4-mini",
-		nano: "gpt-5.4-nano",
+		base: GPT_6_SOL_MODEL,
+		pro: GPT_5_5_PRO_CANONICAL_MODEL,
+		mini: GPT_6_LUNA_MODEL,
+		nano: GPT_6_LUNA_MODEL,
 	},
 	5: {
 		base: GPT_5_5_CANONICAL_MODEL,
 		pro: GPT_5_5_PRO_CANONICAL_MODEL,
-		mini: "gpt-5-mini",
-		nano: "gpt-5-nano",
+		mini: GPT_5_6_TERRA_MODEL,
+		nano: GPT_5_6_LUNA_MODEL,
 	},
 };
 const GENERAL_GPT5_STABLE_VARIANTS = GENERAL_GPT5_VERSION_CATALOG[5];
 const GENERAL_GPT5_GENERIC_VARIANTS = {
 	base: DEFAULT_GENERAL_GPT5_MODEL,
 	pro: GPT_5_5_PRO_CANONICAL_MODEL,
-	mini: "gpt-5-mini",
-	nano: "gpt-5-nano",
+	mini: GPT_5_6_TERRA_MODEL,
+	nano: GPT_5_6_LUNA_MODEL,
 };
 
 function addRequestedModelAlias(alias, normalizedModel) {
@@ -2268,19 +2309,8 @@ function seedRequestedModelAliases() {
 		GPT_5_5_PRO_RELEASE_COMPAT_MODEL,
 		GPT_5_5_PRO_CANONICAL_MODEL,
 	);
-	addRequestedModelReasoningAliases("gpt-5.4", "gpt-5.4");
-	addRequestedModelReasoningAliases("gpt-5.4-pro", "gpt-5.4-pro");
-	addRequestedModelReasoningAliases("gpt-5.4-mini", "gpt-5.4-mini");
-	addRequestedModelReasoningAliases("gpt-5.4-nano", "gpt-5.4-nano");
-	addRequestedModelReasoningAliases("gpt-5.2-pro", "gpt-5.2-pro");
 	addRequestedModelReasoningAliases("gpt-5-pro", GPT_5_5_PRO_CANONICAL_MODEL);
-	addRequestedModelReasoningAliases("gpt-5.2", "gpt-5.2");
-	addRequestedModelReasoningAliases("gpt-5.1", "gpt-5.1");
 	addRequestedModelReasoningAliases("gpt-5", DEFAULT_GENERAL_GPT5_MODEL);
-	addRequestedModelReasoningAliases("gpt-5-mini", "gpt-5-mini");
-	addRequestedModelReasoningAliases("gpt-5-nano", "gpt-5-nano");
-	addRequestedModelReasoningAliases("gpt-5.1-chat-latest", "gpt-5.1");
-	addRequestedModelReasoningAliases("gpt-5-chat-latest", DEFAULT_GENERAL_GPT5_MODEL);
 	addRequestedModelEffortAliases(
 		GPT_5_6_SOL_MODEL,
 		GPT_5_6_SOL_MODEL,
@@ -2322,6 +2352,13 @@ function seedRequestedModelAliases() {
 		GPT_6_ASTRA_AEON_MODEL,
 		GPT_6_ASTRA_EFFORTS,
 	);
+	// No bare `sol`/`luna` aliases: those already mean the 5.6 tiers.
+	addRequestedModelEffortAliases(GPT_6_SOL_MODEL, GPT_6_SOL_MODEL, GPT_6_SOL_EFFORTS);
+	addRequestedModelEffortAliases(
+		GPT_6_LUNA_MODEL,
+		GPT_6_LUNA_MODEL,
+		GPT_6_LUNA_EFFORTS,
+	);
 	addRequestedModelEffortAliases(
 		DAYBREAK_BLUE_MODEL,
 		DAYBREAK_BLUE_MODEL,
@@ -2342,17 +2379,10 @@ function seedRequestedModelAliases() {
 		DAYBREAK_RED_MODEL,
 		DAYBREAK_EFFORTS,
 	);
-	addRequestedModelReasoningAliases(CURRENT_CODEX_MODEL, CURRENT_CODEX_MODEL);
-	addRequestedModelReasoningAliases("gpt-5.3-codex-spark", CURRENT_CODEX_MODEL);
-	addRequestedModelReasoningAliases(LEGACY_CODEX_MODEL, CURRENT_CODEX_MODEL);
-	addRequestedModelReasoningAliases("gpt-5.2-codex", CURRENT_CODEX_MODEL);
-	addRequestedModelReasoningAliases("gpt-5.1-codex", CURRENT_CODEX_MODEL);
+	for (const [retired, replacement] of Object.entries(RETIRED_MODEL_REPLACEMENTS)) {
+		addRequestedModelReasoningAliases(retired, replacement);
+	}
 	addRequestedModelAlias("gpt_5_codex", CURRENT_CODEX_MODEL);
-	addRequestedModelReasoningAliases("codex-max", CURRENT_CODEX_MODEL);
-	addRequestedModelReasoningAliases("gpt-5.1-codex-max", CURRENT_CODEX_MODEL);
-	addRequestedModelAlias("codex-mini-latest", CURRENT_CODEX_MODEL);
-	addRequestedModelReasoningAliases("gpt-5-codex-mini", CURRENT_CODEX_MODEL);
-	addRequestedModelReasoningAliases("gpt-5.1-codex-mini", CURRENT_CODEX_MODEL);
 }
 
 seedRequestedModelAliases();
@@ -2405,39 +2435,13 @@ function resolveStableGeneralGpt5Variant(variant) {
 // between the two, which is exactly what test/codex-model-resolution.test.ts
 // exists to prevent.
 function resolveCodexRequestedModel(normalized) {
-	if (
-		normalized.includes("gpt-5.1-codex-max") ||
-		normalized.includes("gpt 5.1 codex max") ||
-		normalized.includes("codex-max")
-	) {
-		return CURRENT_CODEX_MODEL;
+	// Every codex model is retired: a mini codex id goes to Terra, any other id
+	// carrying `codex` to Sol. Mirrors lib resolveCodexCatalogModel.
+	if (!normalized.includes("codex")) return "";
+	if (/codex[- ]mini(?!mal)/.test(normalized)) {
+		return CODEX_MINI_REPLACEMENT_MODEL;
 	}
-	if (
-		normalized.includes("gpt-5.1-codex-mini") ||
-		normalized.includes("gpt 5.1 codex mini") ||
-		normalized.includes("gpt-5-codex-mini") ||
-		normalized.includes("gpt 5 codex mini") ||
-		normalized.includes("codex-mini-latest")
-	) {
-		return CURRENT_CODEX_MODEL;
-	}
-	if (
-		normalized.includes("gpt-5.3-codex-spark") ||
-		normalized.includes("gpt 5.3 codex spark") ||
-		normalized.includes("gpt-5.3-codex") ||
-		normalized.includes("gpt 5.3 codex") ||
-		normalized.includes("gpt-5.2-codex") ||
-		normalized.includes("gpt 5.2 codex") ||
-		normalized.includes("gpt-5.1-codex") ||
-		normalized.includes("gpt 5.1 codex") ||
-		normalized.includes("gpt-5-codex") ||
-		normalized.includes("gpt 5 codex") ||
-		normalized.includes("codex")
-	) {
-		return CURRENT_CODEX_MODEL;
-	}
-
-	return "";
+	return CURRENT_CODEX_MODEL;
 }
 
 // Resolve GPT-5.6 identifiers, including ones that are not exact aliases (e.g. a
@@ -2473,6 +2477,11 @@ function resolveGpt6RequestedModel(stripped) {
 		return "";
 	}
 	if (tokens.includes("aeon")) return GPT_6_ASTRA_AEON_MODEL;
+	if (isAstra) return GPT_6_ASTRA_MODEL;
+	// `terra` goes to Sol: there is no GPT-6 Terra, and upstream migrates
+	// `gpt-5.6-terra` users to Sol.
+	if (tokens.includes("luna")) return GPT_6_LUNA_MODEL;
+	if (tokens.includes("sol") || tokens.includes("terra")) return GPT_6_SOL_MODEL;
 	return GPT_6_ASTRA_MODEL;
 }
 
@@ -2546,6 +2555,14 @@ function normalizeRequestedModel(model) {
 	if (exactMatch) {
 		return exactMatch;
 	}
+	// Mirrors lib: retry the alias lookup without a `-max`/`-ultra` suffix.
+	const withoutTopEffort = normalized.replace(/-(max|ultra)$/, "");
+	if (withoutTopEffort !== normalized) {
+		const effortlessMatch = REQUESTED_MODEL_ALIASES.get(withoutTopEffort);
+		if (effortlessMatch) {
+			return effortlessMatch;
+		}
+	}
 
 	const daybreakModel = resolveDaybreakRequestedModel(stripped);
 	if (daybreakModel) {
@@ -3595,7 +3612,16 @@ function parseRuntimeRotationProxyEnv(value) {
 	return undefined;
 }
 
+function hasNativeAppBinding(env = process.env) {
+	try {
+		const config = readFileSync(join(resolveCodexHomeDir(env), "config.toml"), "utf8");
+		return config.includes("# codex-multi-auth native provider begin") &&
+			extractConfigAssignmentValue(config, "model_provider") === "openai";
+	} catch { return false; }
+}
+
 async function isRuntimeRotationProxyEnabled(rawArgs, baseEnv = process.env) {
+	if (hasNativeAppBinding(baseEnv)) return false;
 	if ((baseEnv.CODEX_MULTI_AUTH_BYPASS ?? "").trim() === "1") {
 		return false;
 	}
@@ -4017,29 +4043,20 @@ function installRuntimeRotationAppServerCliShim(forwardedEnv, configArgs = []) {
 			// Best-effort stale shim cleanup only; the copy below will report a
 			// persistent failure without leaving a partially-created helper.
 		}
-		if (
-			process.platform === "win32" ||
-			(process.env.CODEX_MULTI_AUTH_TEST_FORCE_APP_SERVER_SHIM_COPY ?? "") === "1"
-		) {
-			// A Windows hard link to the running node.exe remains locked by the
-			// helper process itself, which prevents the shim directory from being
-			// removed during graceful helper shutdown. Use an independent image so
-			// the helper can clean up its app-server shim before exiting.
+		if (process.platform === "win32") {
+			// A running hard-linked node.exe prevents helper cleanup on Windows.
 			withSynchronousFileOperationRetry(() => {
 				maybeThrowSimulatedAppServerShimFileError("copy");
 				copyFileSync(process.execPath, executablePath);
 			});
 		} else {
-			try {
-				linkSync(process.execPath, executablePath);
-			} catch {
-				withSynchronousFileOperationRetry(() => {
-					maybeThrowSimulatedAppServerShimFileError("copy");
-					copyFileSync(process.execPath, executablePath);
-				});
-			}
-		}
-		if (process.platform !== "win32") {
+			// Relocating Node breaks installations with executable-relative shared
+			// libraries (including Homebrew). Invoke the original image in place.
+			const quotedNode = "'" + process.execPath.replace(/'/g, "'\\''") + "'";
+			withSynchronousFileOperationRetry(() => {
+				maybeThrowSimulatedAppServerShimFileError("copy");
+				writeFileSync(executablePath, `#!/bin/sh\nexec ${quotedNode} "$@"\n`, { mode: 0o755 });
+			});
 			chmodSync(executablePath, 0o755);
 		}
 		writeFileSync(
@@ -5960,8 +5977,13 @@ function createCompatibilityCodexHome(
 	};
 }
 
-function buildForwardArgs(rawArgs) {
-	const { args: compatibilityArgs, requestedModel } = rewriteReasoningConfigArgs(rawArgs);
+function buildForwardArgs(rawArgs, { preserveNativeSettings = false } = {}) {
+	// Native app binding keeps the caller's model and reasoning settings verbatim;
+	// it still needs the file auth store, because the router authenticates the
+	// desktop token it reads from auth.json.
+	const { args: compatibilityArgs, requestedModel } = preserveNativeSettings
+		? { args: [...rawArgs], requestedModel: extractRequestedModel(rawArgs) }
+		: rewriteReasoningConfigArgs(rawArgs);
 	const forceFileAuthStore = (process.env.CODEX_MULTI_AUTH_FORCE_FILE_AUTH_STORE ?? "1").trim() !== "0";
 	if (!forceFileAuthStore) {
 		return { args: compatibilityArgs, requestedModel };
@@ -6469,6 +6491,33 @@ function ensureWindowsShellShimGuards() {
 	}
 }
 
+export function getResumePickerRequest(args, cwd = process.cwd()) {
+	const baseCwd = cwd;
+	const command = findForwardedCommand(args);
+	if (command?.command !== "resume" || findForwardedSubcommand(args, command.index)) return null;
+	const configArgs = [];
+	let showAll = false;
+	let includeNonInteractive = false;
+	for (let i = 0; i < args.length; i += 1) {
+		const arg = args[i];
+		if (arg === "--") break;
+		if (consumesNextArg(arg) && args[i + 1] === undefined) return null;
+		if (["--last", "--help", "-h", "--remote"].includes(arg) || arg.startsWith("--remote=")) return null;
+		if (arg === "--all") showAll = true;
+		if (arg === "--include-non-interactive") includeNonInteractive = true;
+		if (arg === "-C" || arg === "--cd") cwd = resolvePath(baseCwd, args[i + 1]);
+		else if (arg.startsWith("--cd=")) cwd = resolvePath(baseCwd, arg.slice(5));
+		else if (arg.startsWith("-C") && arg.length > 2) cwd = resolvePath(baseCwd, arg.slice(2));
+		if (["-c", "--config", "-p", "--profile", "--enable", "--disable"].includes(arg)) {
+			configArgs.push(arg, args[i + 1]);
+		} else if (/^--(config|profile|enable|disable)=/.test(arg) || /^-[cp].+/.test(arg)) {
+			configArgs.push(arg);
+		}
+		i = skipOptionValueSpan(args, i);
+	}
+	return { commandIndex: command.index, cwd, configArgs, showAll, includeNonInteractive };
+}
+
 async function main() {
 	hydrateCliVersionEnv();
 
@@ -6509,7 +6558,9 @@ async function main() {
 			[
 				"Could not locate the official Codex CLI.",
 				"Install it with npm, Homebrew, or an official native release so `codex` is on PATH.",
-				"Or set CODEX_MULTI_AUTH_REAL_CODEX_BIN to the full path of either codex or @openai/codex/bin/codex.js.",
+				process.platform === "win32"
+					? "Or set CODEX_MULTI_AUTH_REAL_CODEX_BIN to the full path of codex.exe or @openai/codex/bin/codex.js."
+					: "Or set CODEX_MULTI_AUTH_REAL_CODEX_BIN to the full path of either codex or @openai/codex/bin/codex.js.",
 			].join("\n"),
 		);
 		return 1;
@@ -6518,12 +6569,42 @@ async function main() {
 	// Resolve `--account` / CODEX_MULTI_AUTH_FORCE_ACCOUNT before forwarding: strip
 	// the launcher-only flag from the Codex args and publish the resolved pin, or
 	// fail hard so a forced account can never silently fall back to another one.
+	if (hasNativeAppBinding(process.env)) {
+        const forced = resolveForcedAccountSelector(rawArgs, process.env);
+        if (forced.error || forced.selector !== null) {
+            console.error(forced.error ?? "Native app binding uses the persistent inference selection. Use codex-multi-auth switch instead of --account.");
+            return 1;
+        }
+        delete process.env.CODEX_MULTI_AUTH_FORCE_ACCOUNT_INDEX;
+        // Best effort: a locked or read-only config.toml (Windows EPERM/EBUSY)
+        // must not block the launch; the per-invocation override below still applies.
+        await ensurePersistedCodexFileAuthStore();
+        const { args: nativeArgs } = buildForwardArgs(forced.strippedArgs, { preserveNativeSettings: true });
+        const result = await forwardToRealCodexOnce(realCodexBin, nativeArgs, process.env);
+        return result.exitCode;
+    }
 	const forcedAccount = await applyForcedAccountSelection(rawArgs, process.env);
 	if (forcedAccount.error) {
 		console.error(forcedAccount.error);
 		return 1;
 	}
-	const forwardArgs = forcedAccount.forwardArgs;
+	const forwardArgs = [...forcedAccount.forwardArgs];
+
+
+	if (process.stdin.isTTY && process.stdout.isTTY && !bypass) {
+		const pickerRequest = getResumePickerRequest(forwardArgs);
+		if (pickerRequest && await isRuntimeRotationProxyEnabled(forwardArgs)) {
+			try {
+				const { pickResumeThread } = await import("../dist/lib/runtime/resume-picker.js");
+				const id = await pickResumeThread({ ...pickerRequest, codexBin: realCodexBin });
+				if (!id) return 0;
+				forwardArgs.splice(pickerRequest.commandIndex + 1, 0, id);
+			} catch (error) {
+				// Discovery is optional: fall back to native `codex resume` with the original args.
+				console.error(`Could not list saved Codex sessions: ${error instanceof Error ? error.message : String(error)}`);
+			}
+		}
+	}
 
 	await ensurePersistedCodexFileAuthStore();
 	await autoSyncManagerActiveSelectionIfEnabled();
@@ -6542,11 +6623,13 @@ async function main() {
 // lib/request/helpers/model-map.ts (see test/codex-model-resolution.test.ts,
 // which asserts wrapper<->lib parity).
 export {
+	isRuntimeRotationProxyEnabled,
 	normalizeRequestedModel,
 	coerceReasoningEffortForModel,
 	resolveModelFamilyForStatus,
 	canonicalizeRequestedModelName,
 	WRAPPER_UNSUPPORTED_MODEL_FALLBACK_CHAIN,
+	RETIRED_MODEL_REPLACEMENTS,
 };
 
 // Run the wrapper only when actually launched (as the `codex-multi-auth-codex`