codex-overleaf-link 1.9.13 → 2.1.0

package/native-host/src/codexProviderLaunch.js

@@ -0,0 +1,213 @@
+'use strict';
+
+const { startChatCompletionsBridge } = require('./chatCompletionsBridge');
+const { startAnthropicMessagesBridge } = require('./anthropicMessagesBridge');
+const { prepareProviderModelCatalog } = require('./providerModelCatalog');
+
+const PROVIDER_CONFIG_ID = 'codex_overleaf_custom';
+const PROVIDER_API_KEY_ENV = 'CODEX_OVERLEAF_PROVIDER_API_KEY';
+const LOOPBACK_NO_PROXY_HOSTS = ['127.0.0.1', 'localhost', '::1'];
+
+function createProviderLaunch({ profile, secret = '', modelId, wireApi, reasoningEffort = '', upstreamResponseMode = '' }) {
+  const model = profile.models.find(item => item.id === modelId) || {};
+  const requestedResponseMode = ['streaming', 'buffered'].includes(upstreamResponseMode)
+    ? upstreamResponseMode
+    : model.upstreamResponseMode || 'auto';
+  const resolvedResponseMode = requestedResponseMode === 'auto'
+    ? (model.resolvedUpstreamResponseMode || 'streaming')
+    : requestedResponseMode;
+  return Object.freeze({
+    providerId: profile.id,
+    providerRevision: profile.revision,
+    providerName: profile.name,
+    baseUrl: profile.baseUrl,
+    modelId,
+    wireApi,
+    upstreamResponseMode: resolvedResponseMode === 'buffered' ? 'buffered' : 'streaming',
+    requestTimeoutMs: profile.requestTimeoutMs,
+    reasoningAdapter: profile.reasoningAdapter || 'auto',
+    reasoningCapability: profile.reasoningCapability || 'auto',
+    reasoningEffort,
+    reasoningEfforts: model.reasoningEfforts?.length
+      ? model.reasoningEfforts.slice()
+      : reasoningEffort
+        ? [reasoningEffort]
+        : [],
+    models: profile.models.map(item => ({ ...item })),
+    contextWindow: model.contextWindow || profile.contextWindow,
+    supportsParallelToolCalls: model.supportsParallelToolCalls ?? profile.supportsParallelToolCalls,
+    supportsStreamOptions: Boolean(profile.supportsStreamOptions),
+    inputModalities: model.inputModalities || profile.inputModalities,
+    authMode: profile.authMode || 'bearer',
+    apiKeyHeaderName: profile.apiKeyHeaderName || '',
+    fullEndpoint: Boolean(profile.fullEndpoint),
+    customHeaders: { ...(profile.customHeaders || {}) },
+    queryParams: { ...(profile.queryParams || {}) },
+    bodyOverrides: { ...(profile.bodyOverrides || {}) },
+    anthropicVersion: profile.anthropicVersion || '2023-06-01',
+    anthropicBeta: profile.anthropicBeta || '',
+    anthropicThinkingMode: profile.anthropicThinkingMode || 'budget',
+    anthropicPromptCaching: profile.anthropicPromptCaching === true,
+    impersonateClaudeCode: profile.impersonateClaudeCode === true,
+    maxOutputTokens: profile.maxOutputTokens || 32768,
+    apiKey: secret
+  });
+}
+
+async function prepareProviderLaunch(launch, { signal } = {}) {
+  const catalog = prepareProviderModelCatalog(launch);
+  if (!catalog.launch || !['chat', 'anthropic'].includes(catalog.launch.wireApi)) {
+    return { launch: catalog.launch, close: async () => catalog.close() };
+  }
+  try {
+    const routedWireApi = catalog.launch.wireApi;
+    const bridge = routedWireApi === 'anthropic'
+      ? await startAnthropicMessagesBridge({ launch: catalog.launch, signal })
+      : await startChatCompletionsBridge({ launch: catalog.launch, signal });
+    return {
+      launch: Object.freeze({
+        ...catalog.launch,
+        upstreamBaseUrl: catalog.launch.baseUrl,
+        baseUrl: bridge.baseUrl,
+        wireApi: 'responses',
+        routedWireApi,
+        apiKey: bridge.clientToken,
+        authMode: 'bearer',
+        apiKeyHeaderName: '',
+        fullEndpoint: false,
+        customHeaders: {},
+        queryParams: {},
+        bodyOverrides: {}
+      }),
+      close: async () => {
+        await bridge.close();
+        catalog.close();
+      }
+    };
+  } catch (error) {
+    catalog.close();
+    throw error;
+  }
+}
+
+function buildProviderConfigArgs(launch) {
+  if (!launch) {
+    return [];
+  }
+  const values = [
+    ['model', launch.modelId],
+    ['model_provider', PROVIDER_CONFIG_ID],
+    [`model_providers.${PROVIDER_CONFIG_ID}.name`, launch.providerName],
+    [`model_providers.${PROVIDER_CONFIG_ID}.base_url`, launch.baseUrl],
+    [`model_providers.${PROVIDER_CONFIG_ID}.wire_api`, launch.wireApi]
+  ];
+  if (launch.apiKey && (launch.authMode || 'bearer') === 'bearer') {
+    values.push([`model_providers.${PROVIDER_CONFIG_ID}.env_key`, PROVIDER_API_KEY_ENV]);
+  }
+  const args = [];
+  for (const [key, value] of values) {
+    args.push('-c', `${key}=${encodeTomlString(value)}`);
+  }
+  args.push('-c', `model_providers.${PROVIDER_CONFIG_ID}.requires_openai_auth=false`);
+  if (launch.modelCatalogPath) {
+    args.push('-c', `model_catalog_json=${encodeTomlString(launch.modelCatalogPath)}`);
+  }
+  if (Object.keys(launch.customHeaders || {}).length) {
+    args.push('-c', `model_providers.${PROVIDER_CONFIG_ID}.http_headers=${encodeTomlTable(launch.customHeaders)}`);
+  }
+  if (Object.keys(launch.queryParams || {}).length) {
+    args.push('-c', `model_providers.${PROVIDER_CONFIG_ID}.query_params=${encodeTomlTable(launch.queryParams)}`);
+  }
+  const authHeader = resolveAuthHeader(launch);
+  if (launch.apiKey && authHeader) {
+    args.push('-c', `model_providers.${PROVIDER_CONFIG_ID}.env_http_headers=${encodeTomlTable({
+      [authHeader]: PROVIDER_API_KEY_ENV
+    })}`);
+  }
+  return args;
+}
+
+function applyProviderEnvironment(env, launch) {
+  const result = { ...(env || process.env) };
+  delete result[PROVIDER_API_KEY_ENV];
+  if (launch?.apiKey) {
+    result[PROVIDER_API_KEY_ENV] = launch.apiKey;
+  }
+  if (isLoopbackBaseUrl(launch?.baseUrl)) {
+    const noProxy = mergeNoProxyValues(result.NO_PROXY, result.no_proxy, LOOPBACK_NO_PROXY_HOSTS);
+    result.NO_PROXY = noProxy;
+    result.no_proxy = noProxy;
+  }
+  return result;
+}
+
+function isLoopbackBaseUrl(value) {
+  try {
+    const hostname = new URL(String(value || '')).hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    return LOOPBACK_NO_PROXY_HOSTS.includes(hostname);
+  } catch (_error) {
+    return false;
+  }
+}
+
+function mergeNoProxyValues(...values) {
+  const entries = [];
+  const seen = new Set();
+  for (const value of values.flat()) {
+    for (const entry of String(value || '').split(',')) {
+      const normalized = entry.trim();
+      const key = normalized.toLowerCase();
+      if (!normalized || seen.has(key)) continue;
+      seen.add(key);
+      entries.push(normalized);
+    }
+  }
+  return entries.includes('*') ? '*' : entries.join(',');
+}
+
+function buildProviderSnapshot(launch) {
+  if (!launch) {
+    return {
+      providerId: 'builtin',
+      providerRevision: 0,
+      providerName: 'Built-in Codex',
+      providerKind: 'builtin'
+    };
+  }
+  return {
+    providerId: launch.providerId,
+    providerRevision: launch.providerRevision,
+    providerName: launch.providerName,
+    providerKind: 'custom',
+    modelId: launch.modelId,
+    wireApi: launch.routedWireApi || launch.wireApi,
+    upstreamResponseMode: launch.upstreamResponseMode || 'streaming',
+    requestTimeoutMs: launch.requestTimeoutMs
+  };
+}
+
+function encodeTomlString(value) {
+  return JSON.stringify(String(value ?? ''));
+}
+
+function encodeTomlTable(value) {
+  return `{${Object.entries(value || {}).map(([key, item]) => (
+    `${encodeTomlString(key)}=${encodeTomlString(item)}`
+  )).join(',')}}`;
+}
+
+function resolveAuthHeader(launch) {
+  if (!launch || launch.authMode === 'none' || (launch.authMode || 'bearer') === 'bearer') return '';
+  if (launch.authMode === 'x-api-key') return 'x-api-key';
+  if (launch.authMode === 'api-key') return 'api-key';
+  return launch.apiKeyHeaderName || '';
+}
+
+module.exports = {
+  PROVIDER_API_KEY_ENV,
+  applyProviderEnvironment,
+  buildProviderConfigArgs,
+  buildProviderSnapshot,
+  createProviderLaunch,
+  prepareProviderLaunch
+};

package/native-host/src/codexProviderTest.js

@@ -0,0 +1,196 @@
+'use strict';
+
+const { spawn, spawnSync } = require('node:child_process');
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+const { resolveCodexCommand, shouldUseShellForCommand } = require('./codexCommand');
+const { applyProviderEnvironment, buildProviderConfigArgs, prepareProviderLaunch } = require('./codexProviderLaunch');
+const { providerError } = require('./providerProfile');
+
+const MAX_OUTPUT_BYTES = 256 * 1024;
+
+async function runProviderConnectionTest({ launch, env = process.env, signal } = {}) {
+  const prepared = await prepareProviderLaunch(launch, { signal });
+  try {
+    return await runProviderConnectionTestProcess({ launch: prepared.launch, env, signal });
+  } finally {
+    await prepared.close();
+  }
+}
+
+function runProviderConnectionTestProcess({ launch, env = process.env, signal } = {}) {
+  return new Promise((resolve, reject) => {
+    const root = fs.mkdtempSync(path.join(os.tmpdir(), 'codex-overleaf-provider-test-'));
+    const codexHome = path.join(root, 'codex-home');
+    const workspace = path.join(root, 'workspace');
+    fs.mkdirSync(codexHome, { recursive: true, mode: 0o700 });
+    fs.mkdirSync(workspace, { recursive: true, mode: 0o700 });
+    const verificationToken = `provider-tool-check-${crypto.randomUUID()}`;
+    const secondFileName = `provider-check-${crypto.randomUUID()}.txt`;
+    fs.writeFileSync(path.join(workspace, 'provider-step-one.txt'), `${secondFileName}\n`, { mode: 0o600 });
+    fs.writeFileSync(path.join(workspace, secondFileName), `${verificationToken}\n`, { mode: 0o600 });
+    const childEnv = applyProviderEnvironment({
+      ...env,
+      CODEX_HOME: codexHome
+    }, launch);
+    const command = resolveCodexCommand(childEnv);
+    if (!command) {
+      cleanup(root);
+      reject(providerError('codex_not_found', 'Codex CLI was not found locally.'));
+      return;
+    }
+    const args = [
+      ...buildProviderConfigArgs(launch),
+      'exec',
+      '--skip-git-repo-check',
+      '--sandbox',
+      'read-only',
+      'Use the shell tool to read provider-step-one.txt. It contains the name of a second file. Then use a separate shell tool call to read that second file. Reply only with the exact contents of the second file.'
+    ];
+    const startedAt = Date.now();
+    let child;
+    try {
+      child = spawn(command, args, {
+        cwd: workspace,
+        env: childEnv,
+        shell: shouldUseShellForCommand(command, childEnv),
+        detached: process.platform !== 'win32',
+        stdio: ['ignore', 'pipe', 'pipe']
+      });
+    } catch (error) {
+      cleanup(root);
+      reject(providerError('provider_test_spawn_failed', 'Codex could not start the provider connection test.', { cause: error }));
+      return;
+    }
+    let stdout = '';
+    let stderr = '';
+    let settled = false;
+    const timeoutMs = Math.min(120000, Math.max(5000, Number(launch.requestTimeoutMs) || 30000));
+    const timer = setTimeout(() => finish(providerError('provider_connection_timeout', 'The provider connection test timed out.')), timeoutMs);
+    const onAbort = () => finish(providerError('provider_test_cancelled', 'Provider connection test was cancelled.'));
+    signal?.addEventListener('abort', onAbort, { once: true });
+
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', chunk => appendOutput('stdout', chunk));
+    child.stderr.on('data', chunk => appendOutput('stderr', chunk));
+    child.on('error', error => finish(providerError('provider_test_spawn_failed', 'Codex could not start the provider connection test.', { cause: error })));
+    child.on('close', code => {
+      if (hasLeakedToolControlTokens(`${stdout}\n${stderr}`)) {
+        finish(providerError(
+          'provider_stream_tool_parse_failed',
+          'The provider leaked unparsed tool-call control tokens while streaming.'
+        ));
+        return;
+      }
+      if (code === 0 && stdout.includes(verificationToken)) {
+        finish(null, {
+          durationMs: Date.now() - startedAt,
+          capabilities: {
+            text: true,
+            streaming: true,
+            agentTools: true,
+            toolRoundTrip: true
+          }
+        });
+        return;
+      }
+      if (code === 0) {
+        finish(providerError(
+          'provider_agent_tools_incompatible',
+          'The provider returned text but did not complete the required Codex tool call.'
+        ));
+        return;
+      }
+      finish(classifyProviderFailure(stderr || stdout, code));
+    });
+
+    function appendOutput(target, chunk) {
+      if (settled) return;
+      if (target === 'stdout') stdout += chunk;
+      else stderr += chunk;
+      if (Buffer.byteLength(stdout) + Buffer.byteLength(stderr) > MAX_OUTPUT_BYTES) {
+        finish(providerError('provider_response_invalid', 'Provider connection test exceeded the output limit.'));
+      }
+    }
+
+    function finish(error, result) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      signal?.removeEventListener('abort', onAbort);
+      if (error) terminateProcessTree(child);
+      cleanup(root);
+      if (error) reject(error);
+      else resolve(result);
+    }
+  });
+}
+
+function classifyProviderFailure(text, exitCode) {
+  const message = String(text || '');
+  if (hasLeakedToolControlTokens(message) || /provider_stream_tool_parse_failed/i.test(message)) {
+    return providerError('provider_stream_tool_parse_failed', 'The provider failed to parse streaming tool calls.');
+  }
+  if (/\b401\b|unauthori[sz]ed|invalid api key|incorrect api key|authentication/i.test(message)) {
+    return providerError('provider_auth_rejected', 'The provider rejected the API key.');
+  }
+  if (/\b403\b|forbidden/i.test(message)) {
+    return providerError('provider_auth_rejected', 'The provider denied access for this credential.');
+  }
+  if (/\b429\b|rate.?limit|too many requests/i.test(message)) {
+    return providerError('provider_rate_limited', 'The provider rate limit was reached.');
+  }
+  if (/model.{0,40}(not found|does not exist|unknown)|\b404\b.{0,80}model/i.test(message)) {
+    return providerError('provider_model_not_found', 'The configured model was not found.');
+  }
+  if (/certificate|self.signed|tls|ssl/i.test(message)) {
+    return providerError('provider_tls_failed', 'TLS verification failed for the provider endpoint.');
+  }
+  if (/enotfound|eai_again|name or service not known|dns/i.test(message)) {
+    return providerError('provider_dns_failed', 'The provider hostname could not be resolved.');
+  }
+  if (/\b404\b|\b405\b|cannot\s+(?:post|get)|(?:route|endpoint).{0,40}(?:not found|unsupported)|unsupported.{0,30}(?:endpoint|api|protocol)|responses.{0,30}(?:unsupported|not found)|chat\/completions.{0,30}(?:unsupported|not found)|v1\/messages.{0,30}(?:unsupported|not found)/i.test(message)) {
+    return providerError('provider_protocol_incompatible', 'The endpoint is incompatible with this API protocol.');
+  }
+  if (/\b400\b|\b415\b|\b422\b|invalid.{0,30}(?:request|parameter|field)|unknown.{0,20}(?:field|parameter)|unsupported.{0,30}(?:field|parameter|tool|schema)|max[_ -]?tokens|context.{0,30}(?:length|window|limit)/i.test(message)) {
+    return providerError('provider_request_rejected', 'The provider rejected this protocol probe request. Review the model and compatibility settings.');
+  }
+  if (/timed?\s*out|timeout/i.test(message)) {
+    return providerError('provider_connection_timeout', 'The provider connection timed out.');
+  }
+  return providerError('provider_response_invalid', `Provider connection test failed with exit code ${exitCode}.`);
+}
+
+function hasLeakedToolControlTokens(value) {
+  return /<\|tool_call_(?:begin|argument_begin|end)\|>/i.test(String(value || ''));
+}
+
+function terminateProcessTree(child) {
+  if (!child?.pid) return;
+  try {
+    if (process.platform === 'win32') {
+      spawnSync('taskkill', ['/pid', String(child.pid), '/t', '/f'], { stdio: 'ignore', windowsHide: true });
+    } else {
+      process.kill(-child.pid, 'SIGTERM');
+      setTimeout(() => {
+        try { process.kill(-child.pid, 'SIGKILL'); } catch (_error) {}
+      }, 500).unref?.();
+    }
+  } catch (_error) {
+    try { child.kill('SIGKILL'); } catch (_killError) {}
+  }
+}
+
+function cleanup(root) {
+  try {
+    fs.rmSync(root, { recursive: true, force: true });
+  } catch (_error) {}
+}
+
+module.exports = {
+  classifyProviderFailure,
+  runProviderConnectionTest
+};

package/native-host/src/codexSessionRunner.js

@@ -19,6 +19,9 @@ const {
   loadSelectedProjectSkills
 } = require('./localSkills');
 const { createSubagentBroker } = require('./subagentBroker');
+const { resolveCodexCommand, shouldUseShellForCommand } = require('./codexCommand');
+const { applyProviderEnvironment, buildProviderConfigArgs, prepareProviderLaunch } = require('./codexProviderLaunch');
+const { buildReadProgressRules, createReadProgressController } = require('./readProgressGuard');
 
 const PARALLEL_SUBAGENTS_SKILL_ID = 'parallel-subagents';
 
@@ -27,7 +30,7 @@ const MAX_TURN_ATTACHMENT_BYTES = 12 * 1024 * 1024;
 const MAX_TURN_ATTACHMENTS = 8;
 const MAX_TURN_ATTACHMENT_TOTAL_BYTES = MAX_TURN_ATTACHMENT_BYTES * MAX_TURN_ATTACHMENTS;
 
-async function runCodexSession({ params = {}, env = process.env, emit = () => {}, rootDir, executeCodex, signal } = {}) {
+async function runCodexSession({ params = {}, env = process.env, emit = () => {}, rootDir, executeCodex, providerLaunch, signal } = {}) {
   throwIfAborted(signal);
   const projectId = params.projectId || params.project?.projectId || params.project?.id || params.project?.url || 'overleaf-project';
   const skillInvocation = normalizeSkillInvocation(params.skillInvocation);
@@ -117,6 +120,7 @@ async function runCodexSession({ params = {}, env = process.env, emit = () => {}
         disableCodexOverleafSkillIds: [PARALLEL_SUBAGENTS_SKILL_ID],
         sandboxMode: settings.sandboxMode,
         approvalPolicy: settings.approvalPolicy,
+        providerLaunch,
         env,
         // Worker raw events stay out of the parent timeline (spec §8);
         // lifecycle events come from the broker, full text from result files.
@@ -152,6 +156,7 @@ async function runCodexSession({ params = {}, env = process.env, emit = () => {}
       projectLocalSkills: null,
       sandboxMode: settings.sandboxMode,
       approvalPolicy: settings.approvalPolicy,
+      providerLaunch,
       env,
       emit,
       // While subagent workers are active, the parent idle watchdog resets
@@ -281,7 +286,7 @@ function buildCodexTurnPrompt(params = {}, mirror = {}, projectLocalSkills, turn
     turnAttachments,
     codexSkillInvocationContext
   });
-  return [prompt.systemPrompt, prompt.userPrompt].filter(Boolean).join('\n\n');
+  return [prompt.systemPrompt, buildReadProgressRules(), prompt.userPrompt].filter(Boolean).join('\n\n');
 }
 
 function materializeTurnAttachments(attachments = [], workspacePath = '') {
@@ -585,7 +590,8 @@ function buildThreadResumeParams(input = {}) {
 
 function buildCodexAppServerArgs(input = {}) {
   const args = [
-    ...buildCodexSpeedArgs(normalizeSpeedTier(input.speedTier))
+    ...buildCodexSpeedArgs(normalizeSpeedTier(input.speedTier)),
+    ...buildProviderConfigArgs(input.providerLaunch)
   ];
   if (input.loadCodexLocalSkills === false) {
     args.push('--disable', 'plugins');
@@ -764,18 +770,27 @@ function supportsReasoningSummary(model) {
   return String(model || '').toLowerCase() !== 'gpt-5.3-codex-spark';
 }
 
-function runCodexAppServerSession(input) {
+async function runCodexAppServerSession(input) {
+  const prepared = await prepareProviderLaunch(input.providerLaunch, { signal: input.signal });
+  try {
+    return await runCodexAppServerProcess({ ...input, providerLaunch: prepared.launch });
+  } finally {
+    await prepared.close();
+  }
+}
+
+function runCodexAppServerProcess(input) {
   return new Promise((resolve, reject) => {
     if (input.signal?.aborted) {
       reject(getAbortReason(input.signal));
       return;
     }
-    const childEnv = buildCodexHomeEnv(input.env || process.env, {
+    const childEnv = applyProviderEnvironment(buildCodexHomeEnv(input.env || process.env, {
       loadCodexLocalSkills: input.loadCodexLocalSkills !== false,
       loadCodexOverleafSkills: input.loadCodexOverleafSkills !== false,
       installCodexOverleafSkillsTarget: input.installCodexOverleafSkillsTarget === true,
       projectLocalSkills: input.projectLocalSkills || null
-    });
+    }), input.providerLaunch);
     const codexCommand = resolveCodexCommand(childEnv);
     if (!codexCommand) {
       reject(new Error('Codex CLI was not found. Install Codex or make sure the `codex` command is available in your login shell.'));
@@ -795,6 +810,11 @@ function runCodexAppServerSession(input) {
     let activeTurnId = '';
     const assistantMessages = new Map();
     const assistantMessageOrder = [];
+    const readProgressController = createReadProgressController({
+      input, request, fail,
+      getTurn: () => ({ threadId: activeThreadId, turnId: activeTurnId }),
+      emitEvent: (...args) => emitCodexEvent(input.emit, ...args)
+    });
     let settled = false;
     // Two-layer timeout strategy:
     //   1. Optional absolute deadline (CODEX_OVERLEAF_CODEX_TIMEOUT_MS) —
@@ -890,6 +910,7 @@ function runCodexAppServerSession(input) {
 
       const turnResponse = await startTurnWithSummaryFallback(activeThreadId);
       activeTurnId = turnResponse?.turn?.id || '';
+      readProgressController.flush();
     }
 
     async function startTurnWithSummaryFallback(threadId) {
@@ -976,6 +997,8 @@ function runCodexAppServerSession(input) {
           method: message.method,
           params: message.params || {}
         }, inferNotificationStatus(message));
+        if (message.method === 'item/completed' &&
+          !readProgressController.observe(message.params?.item || {})) return;
         if (message.method === 'turn/completed' && (!activeTurnId || message.params?.turn?.id === activeTurnId || message.params?.turnId === activeTurnId)) {
           succeed();
         }
@@ -1378,25 +1401,6 @@ function getAbortReason(signal) {
   return error;
 }
 
-function resolveCodexCommand(env = process.env) {
-  if (
-    env.CODEX_OVERLEAF_ENV_READY === '1' ||
-    Object.prototype.hasOwnProperty.call(env, 'CODEX_OVERLEAF_CODEX_PATH')
-  ) {
-    return env.CODEX_OVERLEAF_CODEX_PATH || '';
-  }
-  return 'codex';
-}
-
-function shouldUseShellForCommand(command, env = process.env) {
-  const platform = env.CODEX_OVERLEAF_PLATFORM || process.platform;
-  if (platform !== 'win32') {
-    return false;
-  }
-  const text = String(command || '');
-  return text === 'codex' || /\.(?:cmd|bat)$/i.test(text);
-}
-
 function buildFinalAssistantMessage(messages = new Map(), order = []) {
   const values = [];
   const seenIds = new Set();

package/native-host/src/managedInstall.js

@@ -131,6 +131,7 @@ function buildManagedExtensionTree(options = {}) {
   copyPackageTree(packageRoot, 'extension/assets', targetRoot, 'assets', { allowedFiles });
   copyPackageTree(packageRoot, 'extension/src', targetRoot, 'runtime/src', { allowedFiles });
   copyPackageTree(packageRoot, 'extension/styles', targetRoot, 'runtime/styles', { allowedFiles });
+  copyPackageTree(packageRoot, 'extension/vendor', targetRoot, 'runtime/vendor', { allowedFiles });
   copyPackageFile(packageRoot, 'extension/runtime-manifest.json', targetRoot, 'runtime/runtime-manifest.json', allowedFiles);
   fs.writeFileSync(path.join(targetRoot, EXTENSION_MARKER), JSON.stringify({
     managedBy: MANAGED_BY,

package/native-host/src/providerBridgeRoutes.js

@@ -0,0 +1,11 @@
+'use strict';
+
+function classifyResponsesRoute(method, pathname) {
+  if (String(method || '').toUpperCase() !== 'POST') return '';
+  const path = String(pathname || '');
+  if (/\/responses\/compact\/?$/.test(path)) return 'compact';
+  if (/\/responses\/?$/.test(path)) return 'responses';
+  return '';
+}
+
+module.exports = { classifyResponsesRoute };

package/native-host/src/providerModelCatalog.js

@@ -0,0 +1,107 @@
+'use strict';
+
+const fs = require('node:fs');
+const os = require('node:os');
+const path = require('node:path');
+
+const DEFAULT_CONTEXT_WINDOW = 262144;
+
+function buildProviderModelCatalogData(launch = {}) {
+  const configured = Array.isArray(launch.models) ? launch.models : [];
+  const fallbackId = String(launch.modelId || '').trim();
+  const models = configured.length > 0
+    ? configured
+    : fallbackId
+      ? [{ id: fallbackId, label: fallbackId }]
+      : [];
+  return {
+    models: models
+      .filter(model => model && typeof model.id === 'string' && model.id.trim())
+      .map((model, index) => buildModelEntry(model, launch, index))
+  };
+}
+
+function prepareProviderModelCatalog(launch) {
+  if (!launch) {
+    return { launch, close() {} };
+  }
+  const catalog = buildProviderModelCatalogData(launch);
+  if (!catalog.models.length) {
+    return { launch, close() {} };
+  }
+  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'codex-overleaf-models-'));
+  const modelCatalogPath = path.join(directory, 'models.json');
+  fs.writeFileSync(modelCatalogPath, `${JSON.stringify(catalog, null, 2)}\n`, { mode: 0o600 });
+  return {
+    launch: Object.freeze({ ...launch, modelCatalogPath }),
+    close() {
+      fs.rmSync(directory, { recursive: true, force: true });
+    }
+  };
+}
+
+function buildModelEntry(model, launch, index) {
+  const id = String(model.id || '').trim();
+  const efforts = normalizeEfforts(model.reasoningEfforts, launch.reasoningEfforts);
+  const defaultReasoning = efforts.find(effort => effort !== 'none') || efforts[0] || 'none';
+  const contextWindow = normalizeContextWindow(model.contextWindow || launch.contextWindow);
+  return {
+    slug: id,
+    display_name: String(model.label || id),
+    description: `Custom provider model ${id}`,
+    base_instructions: String(model.baseInstructions || launch.baseInstructions || (
+      'You are a coding agent. Use the available shell tool to inspect and modify files, follow the user request precisely, and report the result concisely.'
+    )),
+    default_reasoning_level: defaultReasoning,
+    supported_reasoning_levels: efforts.map(effort => ({
+      effort,
+      description: effort === 'none' ? 'Reasoning disabled' : `${effort} reasoning effort`
+    })),
+    shell_type: 'shell_command',
+    visibility: 'list',
+    supported_in_api: true,
+    priority: 10000 - index,
+    supports_reasoning_summaries: efforts.some(effort => effort !== 'none'),
+    default_reasoning_summary: 'none',
+    support_verbosity: false,
+    truncation_policy: { mode: 'bytes', limit: 10000 },
+    supports_parallel_tool_calls: Boolean(
+      model.supportsParallelToolCalls ?? launch.supportsParallelToolCalls
+    ),
+    supports_image_detail_original: false,
+    context_window: contextWindow,
+    max_context_window: contextWindow,
+    effective_context_window_percent: 95,
+    experimental_supported_tools: [],
+    input_modalities: normalizeInputModalities(model.inputModalities || launch.inputModalities),
+    supports_search_tool: false
+  };
+}
+
+function normalizeEfforts(...values) {
+  const allowed = new Set(['none', 'minimal', 'low', 'medium', 'high', 'xhigh']);
+  const normalized = values
+    .flatMap(value => Array.isArray(value) ? value : [])
+    .map(value => String(value || '').trim().toLowerCase())
+    .filter(value => allowed.has(value));
+  return Array.from(new Set(normalized.length ? normalized : ['none']));
+}
+
+function normalizeContextWindow(value) {
+  const parsed = Number.parseInt(String(value ?? ''), 10);
+  if (!Number.isFinite(parsed)) return DEFAULT_CONTEXT_WINDOW;
+  return Math.min(4000000, Math.max(8192, parsed));
+}
+
+function normalizeInputModalities(values) {
+  const normalized = (Array.isArray(values) ? values : ['text'])
+    .map(value => String(value || '').trim().toLowerCase())
+    .filter(value => value === 'text' || value === 'image');
+  const unique = Array.from(new Set(normalized));
+  return unique.includes('text') ? unique : ['text', ...unique];
+}
+
+module.exports = {
+  buildProviderModelCatalogData,
+  prepareProviderModelCatalog
+};