codex-switch-helper 1.0.0

package/README.md

@@ -0,0 +1,170 @@
+# Codex-Switch-Helper (`csw`)
+
+在 **官方 ChatGPT 登录** 和 **各种第三方 API-key 中转**（anyrouter、muyuan、本地代理 …）之间一键切换
+[Codex](https://github.com/openai/codex) 的后端，**不丢失任何现有配置**。纯 bash、零依赖、Mac / Linux 本地。
+
+- **包名**：`codex-switch-helper`（npm）
+- **命令**：`csw`
+
+> 它只动两样东西，其余 `~/.codex/config.toml`（MCP servers、`[features]`、`[projects]` 信任列表、
+> desktop 设置等）**一个字不碰**：
+> 1. `config.toml` 里一小段「受管块」（`model` / `model_provider` / 鉴权方式）
+> 2. `~/.codex/auth.json`（ChatGPT OAuth 令牌 ↔ `sk-` API key）
+
+> 🔐 **密钥从不进仓库。** 真实凭证只存在本机 `~/.codex/profiles/<名字>/auth.json`（权限 600）。
+> 本仓库只有脚本、文档和占位示例；`.gitignore` 还会兜底拦截 `auth.json` / 备份 / `.active`。
+
+---
+
+## 安装
+
+### npm（推荐）
+
+```bash
+npm install -g codex-switch-helper
+csw list
+```
+
+### 从源码
+
+```bash
+git clone https://github.com/VicZhang6/codex-switch.git
+cd codex-switch
+./install.sh            # 把 csw / codex-switch / switch 软链到 PATH（无需 sudo）
+csw list                # 验证
+```
+
+`install.sh` 只创建软链，不碰 `~/.codex/` 里任何现有内容。
+
+---
+
+## 命令速查
+
+| 命令 | 作用 |
+|---|---|
+| `csw` | 交互式选单（↑↓ / j k 移动 · Enter 确认 · 1-9 直选 · q 取消） |
+| `csw <名字>` | 直接切到某 profile，如 `csw official` / `csw anyrouter` |
+| `csw add [名字]` | **向导**：新建一个自定义 API-key provider（见下） |
+| `csw list` | 列出所有 profile，`*` 标当前 |
+| `csw status` | 显示当前 profile + 受管块 + auth 模式 |
+
+> 兼容别名：源码安装后也可使用 `switch` / `codex-switch`（与 `csw` 相同能力）。
+
+> ⚠️ **切换后要重开一个 `codex` 会话 / 重启 Codex App 才生效** —— Codex 在会话启动时读配置，
+> 已开着的会话不会热加载。
+
+---
+
+## 工作机制
+
+一次 `csw <名字>`：
+
+1. 把当前 live `auth.json` 存回**上一个** profile（这样 ChatGPT 的 token 刷新不会丢）；
+2. 备份 `config.toml` 和 `auth.json`（带时间戳，各留最近 10 份）；
+3. 用 `awk` 只重写 `#__CODEX_SWITCH_BEGIN/END__` 标记**之间**的内容；
+4. 把目标 profile 的 `auth.json` 装到 `~/.codex/auth.json`（`install -m 600`）；
+5. 更新 `~/.codex/profiles/.active`。
+
+**可逆**：`csw official` 任何时候都能切回原始 ChatGPT 登录（auth.json 来回切已验证字节级一致）。
+
+### 文件结构
+
+```
+~/.codex/                            # ← 运行时数据（不在本仓库）
+├── csw  codex-switch  switch        # 软链到本仓库（install.sh 创建；npm 只装 csw）
+├── config.toml                      # 你的原配置 + 受管块 + [model_providers.*] 表
+├── auth.json                        # 当前生效凭证（切换时被替换）
+├── *.bak.*                          # 自动备份（各留最近 10 份）
+└── profiles/
+    ├── .active                      # 当前 profile 名
+    ├── official/  { provider.env, auth.json }   # auth.json = 原始 OAuth 快照
+    └── <其它>/    { provider.env, auth.json }
+
+本仓库:
+├── codex-switch      # 主脚本
+├── csw               # 短命令入口（npm bin / 默认无参 = 选单）
+├── switch            # 兼容别名
+├── install.sh        # 软链到 PATH
+├── package.json      # npm 包：codex-switch-helper
+├── examples/         # provider.env / auth.json.example 模板
+└── README.md
+```
+
+`provider.env`：
+```bash
+MODE=apikey            # 或 chatgpt（official）
+MODEL=gpt-5.5
+PROVIDER=anyrouter     # apikey 时必填，且 == config.toml 里 [model_providers.<这里>]
+```
+
+受管块（脚本只改这对标记之间）：
+```toml
+#__CODEX_SWITCH_BEGIN__
+model = "gpt-5.5"
+model_provider = "anyrouter"      # 切到 official 时这两行消失 → 走默认 ChatGPT
+preferred_auth_method = "apikey"
+#__CODEX_SWITCH_END__
+```
+
+provider 端点定义一次，平时**惰性**（只有被 `model_provider` 指向才生效）：
+```toml
+[model_providers.anyrouter]
+name = "Any Router"
+base_url = "https://anyrouter.top/v1"
+wire_api = "responses"
+```
+
+---
+
+## 新增 provider —— `csw add`
+
+```text
+$ csw add CPA
+显示名 (provider name=, 默认 CPA):
+base_url (如 https://anyrouter.top/v1): http://localhost:8317/v1
+wire_api [responses/chat] (默认 responses): chat
+模型 model (如 gpt-5.5): gpt-5.5
+API key (sk-...): sk-....
+用 GET .../models 验证 key? [Y/n]
+现在就切到 CPA? [y/N]
+```
+
+向导会：写好 `profiles/<名>/{provider.env,auth.json}`（600）→ 往 `config.toml` 追加
+`[model_providers.<名>]`（已存在则跳过）→ 追加前先备份 config → 可选 `GET /models` 验证 →
+可选当场切过去。名字只允许 `字母/数字/-/_`，挡保留字，已存在会问是否覆盖。
+
+### `base_url` / `wire_api` 怎么填（重要）
+
+> 新版 Codex（[codex#7782](https://github.com/openai/codex/discussions/7782)）**只支持 `wire_api = "responses"`**，
+> `chat` 已废弃 —— 配了 `chat` 整个 `config.toml` 会**拒绝加载**（codex 起不来）。
+> 因此 provider 必须支持 **Responses API**（`<base_url>/responses`）；只提供 `/v1/chat/completions` 的中转用不了。
+
+| 配置 | 填法 |
+|---|---|
+| `base_url` | 带版本前缀，如 `https://host/v1`（codex 会 POST 到 `<base_url>/responses`） |
+| `wire_api` | 固定 `responses` |
+
+- 漏了 `/v1` → codex POST 到错路径报 **404**。
+- 验证某中转是否支持 Responses：
+  `curl -X POST http://host/v1/responses -H "Authorization: Bearer <key>" -H 'content-type: application/json' -d '{"model":"gpt-5.5","input":"hi"}'` → 200 即可用。
+
+---
+
+## 排错
+
+| 现象 | 处理 |
+|---|---|
+| `⚠ MCP client for 'paper' failed to start` | **无害**，与切 provider 无关；Codex 桌面端 paper MCP 没在跑而已，codex 照常继续。要消掉就在 `config.toml` 把 `[mcp_servers.paper]` 设 `enabled = false`。 |
+| `wire_api = "chat" is no longer supported`（codex 起不来） | 新版 Codex 删了 chat（codex#7782）；把该 provider 改 `wire_api = "responses"`（provider 须支持 Responses API）。 |
+| `unexpected status 404 ... /responses` | `base_url` 漏 `/v1`；codex 会 POST 到 `<base_url>/responses`，确认中转支持该端点，再**重开 codex 会话**。 |
+| 改了配置但没变 | 旧会话不热加载，**重开 `codex` / 重启 App**。 |
+| `csw add` 里 `GET /models` 非 200 | 不一定 key 无效 —— 有些中转不实现 `/models` 或严格校验格式。anyrouter 这类 `/responses` 通道只能用真实 codex 客户端验证（手搓 curl 会被判 `invalid codex request` 假阴性）。最终以 `codex` 真跑一把为准。 |
+| 验证某中转能用 | `csw <名>` 后：`codex exec --skip-git-repo-check -c 'mcp_servers={}' "print: OK"` |
+
+---
+
+## 和 `Loongphy/codex-auth` 的区别
+
+- `codex-auth`：多 **ChatGPT/OpenAI 账号**切换（换身份、看额度），**不改 `config.toml`**，做不到指向第三方中转。
+- **Codex-Switch-Helper（`csw` / 本项目）**：多 **provider** 切换（官方登录 ↔ 第三方中转 key，连 `base_url`/模型一起换）。
+  解决的是不同问题，命令也不撞名，可共存。

package/codex-switch

@@ -0,0 +1,545 @@
+#!/usr/bin/env bash
+# codex-switch — toggle Codex between the official ChatGPT login and custom API-key
+# providers WITHOUT losing any configuration.
+#
+# It only swaps two things, leaving the rest of config.toml (MCP servers, features,
+# [projects] trust list, desktop settings, ...) completely untouched:
+#   1. a small managed block in ~/.codex/config.toml  (model / model_provider / auth method)
+#   2. ~/.codex/auth.json                              (ChatGPT OAuth tokens  vs  sk- API key)
+#
+# Profiles live in ~/.codex/profiles/<name>/ as { provider.env, auth.json }.
+# Provider endpoints are defined once as [model_providers.<name>] in config.toml.
+#
+# Usage:
+#   codex-switch                 # show current status
+#   codex-switch list            # list profiles
+#   codex-switch doctor          # check/repair the managed block (e.g. after Codex rewrote config.toml)
+#   codex-switch pick            # interactive arrow-key picker (also: `switch`)
+#   codex-switch add [name]      # wizard: create a new custom API-key profile
+#   codex-switch official        # back to ChatGPT login (your original setup)
+#   codex-switch anyrouter       # custom key via anyrouter.top
+#   codex-switch muyuan          # custom key via muyuan.do (free/temp)
+set -euo pipefail
+
+CODEX_HOME="${CODEX_HOME:-$HOME/.codex}"
+CONFIG="$CODEX_HOME/config.toml"
+AUTH="$CODEX_HOME/auth.json"
+PROFILES="$CODEX_HOME/profiles"
+ACTIVE_FILE="$PROFILES/.active"
+BEGIN='#__CODEX_SWITCH_BEGIN__'
+END='#__CODEX_SWITCH_END__'
+
+die(){ echo "codex-switch: error: $*" >&2; exit 1; }
+current(){ [ -f "$ACTIVE_FILE" ] && cat "$ACTIVE_FILE" || echo official; }
+
+list(){
+  echo "profiles (current: $(current)):"
+  for d in "$PROFILES"/*/; do
+    [ -d "$d" ] || continue
+    n=$(basename "$d")
+    mark="  "; [ "$n" = "$(current)" ] && mark="* "
+    info=$( unset MODE MODEL PROVIDER; . "$d/provider.env" 2>/dev/null
+            if [ "${MODE:-}" = chatgpt ]; then echo "ChatGPT login   model=$MODEL"
+            else echo "apikey  provider=$PROVIDER  model=$MODEL"; fi )
+    printf "%s%-12s %s\n" "$mark" "$n" "$info"
+  done
+}
+
+build_block(){ # $1 = profile dir -> prints the managed config block
+  ( unset MODE MODEL PROVIDER; . "$1/provider.env"
+    echo "model = \"$MODEL\""
+    if [ "${MODE:-}" = apikey ]; then
+      echo "model_provider = \"$PROVIDER\""
+      echo "preferred_auth_method = \"apikey\""
+    fi )
+}
+
+replace_block(){ # $1 = file holding the new block; rewrites region between markers
+  grep -q "$BEGIN" "$CONFIG" || die "managed markers missing in $CONFIG (run: codex-switch doctor)"
+  # Read the replacement from a file (not -v): BSD awk rejects a multi-line -v value.
+  awk -v b="$BEGIN" -v e="$END" -v rf="$1" '
+    $0==b{print; while((getline line < rf) > 0) print line; close(rf); skip=1; next}
+    $0==e{skip=0; print; next}
+    skip{next}
+    {print}' "$CONFIG" > "$CONFIG.tmp" && mv "$CONFIG.tmp" "$CONFIG"
+}
+
+# doctor — check the managed markers. If they're present, do NOTHING (the block
+# content is whatever you last selected — via codex-switch OR the Codex app — and
+# is none of doctor's business). Only if the markers were dropped (e.g. Codex
+# rewrote config.toml and stripped all comments) do we rebuild them, preferring
+# the real values left behind in the file over the active-profile fallback.
+doctor(){
+  [ -f "$CONFIG" ] || die "no config at $CONFIG"
+
+  if grep -q "$BEGIN" "$CONFIG" && grep -q "$END" "$CONFIG"; then
+    echo "✓ markers present in $CONFIG — nothing to fix (current: $(current))"
+    awk -v b="$BEGIN" -v e="$END" '$0==b{p=1} p{print} $0==e{p=0}' "$CONFIG" | sed 's/^/    /'
+    return 0
+  fi
+
+  echo "managed markers missing — likely Codex rewrote $CONFIG and dropped the comment markers."
+
+  # Backup config (keep newest 10), same policy as use()/add().
+  cp -p "$CONFIG" "$CONFIG.bak.$(date +%Y%m%d-%H%M%S)"
+  ls -t "$CONFIG".bak.* 2>/dev/null | tail -n +11 | xargs -r rm -f
+
+  # Prefer re-wrapping the model keys the rewrite LEFT BEHIND (your real current
+  # values), so doctor never overrides a choice you made in the Codex app. Only
+  # fall back to the active profile if even a top-level `model` key is gone.
+  if awk '/^[[:space:]]*\[/{exit} /^[[:space:]]*model[[:space:]]*=/{f=1} END{exit !f}' "$CONFIG"; then
+    echo "re-wrapping the existing top-level model keys (values preserved)."
+    awk -v b="$BEGIN" -v e="$END" '
+      BEGIN { intop=1; done=0; m=""; mp=""; pa="" }
+      intop && /^[[:space:]]*model[[:space:]]*=/                 { m=$0;  next }
+      intop && /^[[:space:]]*model_provider[[:space:]]*=/        { mp=$0; next }
+      intop && /^[[:space:]]*preferred_auth_method[[:space:]]*=/ { pa=$0; next }
+      /^[[:space:]]*\[/ && intop {
+        if (!done) { print b; if(m!="")print m; if(mp!="")print mp; if(pa!="")print pa; print e; done=1 }
+        intop=0
+      }
+      { print }
+      END { if(!done){ print b; if(m!="")print m; if(mp!="")print mp; if(pa!="")print pa; print e } }
+    ' "$CONFIG" > "$CONFIG.tmp" && mv "$CONFIG.tmp" "$CONFIG"
+  else
+    local active d; active="$(current)"; d="$PROFILES/$active"
+    { [ -d "$d" ] && [ -f "$d/provider.env" ]; } || die "no top-level model key in $CONFIG AND active profile '$active' is unusable (run: codex-switch use <name>)"
+    echo "no top-level model key found — rebuilding from active profile: $active"
+    local blk; blk=$(mktemp); build_block "$d" > "$blk"
+    awk -v rf="$blk" -v b="$BEGIN" -v e="$END" '
+      BEGIN { intop=1; done=0 }
+      /^[[:space:]]*\[/ && intop {
+        if (!done) { print b; while ((getline ln < rf) > 0) print ln; close(rf); print e; done=1 }
+        intop=0
+      }
+      intop && /^[[:space:]]*(model|model_provider|preferred_auth_method)[[:space:]]*=/ { next }
+      { print }
+      END { if (!done) { print b; while ((getline ln < rf) > 0) print ln; close(rf); print e } }
+    ' "$CONFIG" > "$CONFIG.tmp" && mv "$CONFIG.tmp" "$CONFIG"
+    rm -f "$blk"
+  fi
+
+  echo "✓ repaired. managed block now:"
+  awk -v b="$BEGIN" -v e="$END" '$0==b{p=1} p{print} $0==e{p=0}' "$CONFIG" | sed 's/^/    /'
+  echo "Restart the Codex app / start a new \`codex\` session to pick it up."
+}
+
+use(){
+  local name="$1" d="$PROFILES/$1"
+  [ -d "$d" ] || die "no such profile: $name (try: codex-switch list)"
+  [ -f "$d/provider.env" ] || die "$name is missing provider.env"
+  [ -f "$d/auth.json" ]    || die "$name is missing auth.json"
+  if grep -q REPLACE_WITH "$d/auth.json"; then
+    die "$name still has a placeholder key. Edit $d/auth.json and paste your sk- key first."
+  fi
+
+  local cur ts; cur="$(current)"; ts=$(date +%Y%m%d-%H%M%S)
+  # Preserve the live (possibly token-refreshed) creds back into the outgoing profile,
+  # so switching back to 'official' restores fresh ChatGPT tokens — not a stale snapshot.
+  [ -f "$AUTH" ] && [ -d "$PROFILES/$cur" ] && cp -p "$AUTH" "$PROFILES/$cur/auth.json"
+  # Safety backups of the live files, keeping only the newest 10 of each.
+  cp -p "$CONFIG" "$CONFIG.bak.$ts"
+  [ -f "$AUTH" ] && cp -p "$AUTH" "$AUTH.bak.$ts"
+  ls -t "$CONFIG".bak.* 2>/dev/null | tail -n +11 | xargs -r rm -f
+  ls -t "$AUTH".bak.*   2>/dev/null | tail -n +11 | xargs -r rm -f
+
+  local blk; blk=$(mktemp); build_block "$d" > "$blk"
+  replace_block "$blk"; rm -f "$blk"
+  install -m 600 "$d/auth.json" "$AUTH"
+  echo "$name" > "$ACTIVE_FILE"
+
+  echo "✓ switched to: $name"
+  build_block "$d" | sed 's/^/    /'
+  echo "Restart the Codex app / start a new \`codex\` session to pick it up."
+}
+
+status(){
+  echo "active profile : $(current)"
+  echo "config block   :"; awk -v b="$BEGIN" -v e="$END" '$0==b{p=1} p{print} $0==e{p=0}' "$CONFIG" | sed 's/^/    /'
+  if grep -q '"auth_mode"[[:space:]]*:[[:space:]]*"chatgpt"' "$AUTH" 2>/dev/null; then
+    echo "auth.json      : ChatGPT login (OAuth tokens)"
+  else
+    local k; k=$(grep -o 'sk-[A-Za-z0-9]\{6\}' "$AUTH" 2>/dev/null | head -1)
+    echo "auth.json      : apikey  ${k:+($k…redacted)}"
+  fi
+}
+
+# Full-screen interactive picker.
+#   keyboard: ↑/↓ j/k move · Enter confirm · 1-9 direct · q/Esc cancel
+#   mouse:    click to select · wheel to scroll · selection auto-copied to clipboard
+pick(){
+  local profiles=() cur sel=0 i d
+  cur="$(current)"
+  for d in "$PROFILES"/*/; do [ -d "$d" ] || continue; profiles+=("$(basename "$d")"); done
+  [ ${#profiles[@]} -gt 0 ] || die "no profiles found in $PROFILES"
+  for i in "${!profiles[@]}"; do [ "${profiles[$i]}" = "$cur" ] && sel=$i; done
+  local rows=${#profiles[@]}
+
+  _info(){ ( unset MODE MODEL PROVIDER; . "$PROFILES/$1/provider.env" 2>/dev/null
+    if [ "${MODE:-}" = chatgpt ]; then printf 'ChatGPT 登录 · model=%s' "$MODEL"
+    else printf 'API key · %s · model=%s' "$PROVIDER" "$MODEL"; fi ); }
+
+  # Copy text to system clipboard: OSC 52 (iTerm2/Alacritty/kitty/Windows Terminal)
+  # with pbcopy fallback for macOS Terminal.app.
+  _copy(){
+    local b64; b64=$(printf '%s' "$1" | base64 | tr -d '\n')
+    printf '\e]52;c;%s\a' "$b64"
+    command -v pbcopy >/dev/null 2>&1 && printf '%s' "$1" | pbcopy 2>/dev/null || true
+  }
+
+  # Restore terminal: mouse off, cursor visible, leave alternate screen.
+  _cleanup_tui(){
+    printf '\e[?1002l\e[?1006l'
+    tput cnorm 2>/dev/null || true
+    printf '\e[?1049l'
+  }
+  trap '_cleanup_tui' INT TERM
+
+  local cols clip_msg="" cmd_sel=0 focus="profiles"
+  cols=$(tput cols 2>/dev/null || echo 80)
+  local lines_t=$(tput lines 2>/dev/null || echo 24)
+
+  # Input reader that distinguishes arrow keys from SGR mouse events.
+  # Sets: KEY (the char/sequence), MOUSE_EVENT (0/1), MOUSE_BTN, MOUSE_X, MOUSE_Y.
+  # macOS ships bash 3.2 which doesn't support fractional read timeouts; use 1s there.
+  local _T="1"
+  [ "${BASH_VERSINFO[0]:-0}" -ge 4 ] 2>/dev/null && _T="0.05"
+  local KEY MOUSE_EVENT=0 MOUSE_BTN="" MOUSE_X="" MOUSE_Y=""
+  _read_input(){
+    KEY=""; MOUSE_EVENT=0
+    local c c1 c2 ch seq
+    IFS= read -rsn1 c 2>/dev/null || { KEY="EOF"; return 0; }
+    [ "$c" != $'\e' ] && { KEY="$c"; return 0; }
+    IFS= read -rsn1 -t "$_T" c1 2>/dev/null || { KEY="ESC"; return 0; }
+    if [ "$c1" = "[" ]; then
+      IFS= read -rsn1 -t "$_T" c2 2>/dev/null || { KEY="ESC"; return 0; }
+      if [ "$c2" = "<" ]; then
+        seq=""
+        while IFS= read -rsn1 -t "$_T" ch 2>/dev/null; do
+          [ "$ch" = "M" ] || [ "$ch" = "m" ] && break
+          seq+="$ch"
+        done
+        IFS=';' read -r MOUSE_BTN MOUSE_X MOUSE_Y <<< "$seq" || true
+        MOUSE_EVENT=1
+        return 0
+      else
+        KEY=$'\e['"$c2"; return 0
+      fi
+    elif [ "$c1" = "O" ]; then
+      IFS= read -rsn1 -t "$_T" c2 2>/dev/null || { KEY="ESC"; return 0; }
+      KEY=$'\eO'"$c2"; return 0
+    else
+      KEY="ESC"; return 0
+    fi
+  }
+
+  # Command bar: clickable actions shown below the profile list.
+  local cmds=("list" "status" "add" "doctor" "help" "quit")
+  local cmd_actions=("list" "status" "add" "doctor" "help" "quit")
+  local ncmds=${#cmds[@]}
+  local cmd_pos=() cpos=3 ci
+  for ci in "${!cmds[@]}"; do
+    local clen=$(( ${#cmds[$ci]} + 2 ))
+    cmd_pos+=("$cpos $((cpos + clen - 1))")
+    cpos=$(( cpos + clen + 1 ))
+  done
+
+  # ── ASCII banner ──
+  _banner(){
+    cat <<'BANNER'
+   ___ ___  ___  ___    _ _       ___           _
+  / __|   \| _ \/ __|  | | | ___ | __|_ _ ___ _(_)_ __
+ | (__| |) |   / (__   | | |/ _ \| _|| '_/ _ \ |_| \ \ /
+  \___|___/|_|_\\___|  |_|_|\___/|___|_| \___/_(_)_\_\
+BANNER
+  }
+
+  # ── Spinner frames for loading animation ──
+  local spin_frames=('⠋' '⠙' '⠹' '⠸' '⠼' '⠴' '⠦' '⠧' '⠇' '⠏')
+
+  # ── Decorative separators ──
+  _sep(){
+    local w=$1 char="${2:-─}"
+    local s=""
+    while [ ${#s} -lt "$w" ]; do s+="$char"; done
+    printf '%s' "${s:0:$w}"
+  }
+
+  # Layout rows (1-based):
+  #   1: banner line 1     2: banner line 2     3: banner line 3     4: banner line 4
+  #   5: subtitle/cur      6: blank             7: section label
+  #   8..8+rows-1: profiles
+  #   8+rows: blank        9+rows: sep          10+rows: command bar
+  #   11+rows: blank       12+rows: help line 1  13+rows: help line 2
+  local sec_row=7
+  local prof_start=8
+  local cmd_row=$(( 8 + rows + 2 ))
+
+  _draw(){
+    printf '\e[H\e[2J'
+    # ASCII banner (gradient cyan → dim)
+    printf '\e[38;5;44m%s\e[0m\n' "$(_banner | head -1)"
+    printf '\e[38;5;38m%s\e[0m\n' "$(_banner | sed -n 2p)"
+    printf '\e[38;5;31m%s\e[0m\n' "$(_banner | sed -n 3p)"
+    printf '\e[38;5;24m%s\e[0m\n' "$(_banner | sed -n 4p)"
+    # Subtitle + current
+    printf '  \e[2m选择 Codex 配置\e[0m'
+    [ -n "$cur" ] && printf '    \e[2m●\e[0m 当前: \e[1;33m%s\e[0m' "$cur"
+    printf '\n'
+    printf '\n'
+    # Section label
+    printf '  \e[2m╭%s╮\e[0m\n' "$(_sep 32)"
+    printf '  \e[2m│\e[0m \e[1;36mPROFILES\e[0m%*s\e[2m│\e[0m\n' 23 ""
+    printf '  \e[2m╰%s╯\e[0m\n' "$(_sep 32)"
+    # Profile list — first item at row prof_start (8)
+    local j n info dot marker body
+    for j in "${!profiles[@]}"; do
+      n="${profiles[$j]}"; info=$(_info "$n")
+      dot=' '; [ "$n" = "$cur" ] && dot='\e[1;33m●\e[0m'
+      [ "$j" -eq "$sel" ] && marker='\e[1;36m▶\e[0m' || marker=' '
+      if [ "$j" -eq "$sel" ]; then
+        printf '  %b \e[7m %-12s %s \e[0m\n' "$marker" "$n" "$info"
+      else
+        printf '  %b   \e[2m%-12s\e[0m \e[2m%s\e[0m\n' "$marker" "$n" "$info"
+      fi
+    done
+    printf '\n'
+    # Command bar separator
+    printf '  \e[2m%s\e[0m\n' "$(_sep $((cols-4)) ─)"
+    # Command bar — clickable buttons with icons
+    local ci btn icon
+    printf '  '
+    for ci in "${!cmds[@]}"; do
+      btn="${cmds[$ci]}"
+      case "$btn" in
+        list)   icon='☰' ;;
+        status) icon='◉' ;;
+        add)    icon='✚' ;;
+        doctor) icon='✕' ;;
+        help)   icon='?' ;;
+        quit)   icon='⏻' ;;
+        *)      icon=' ' ;;
+      esac
+      if [ "$ci" -eq "$cmd_sel" ] && [ "$focus" = "cmds" ]; then
+        printf '\e[1;7;36m %s %s \e[0m ' "$icon" "$btn"
+      else
+        printf '\e[36m%s[%s]\e[0m ' "$icon" "$btn"
+      fi
+    done
+    printf '\n'
+    printf '\n'
+    # Help lines
+    if [ "$focus" = "profiles" ]; then
+      printf '  \e[1;36m▶\e[0m \e[2m↑/↓ j/k 移动 · Enter 切换 · 1-9 直选 · Tab 切到命令栏 · q 取消\e[0m\n'
+    else
+      printf '  \e[2m↑/↓ j/k 移动 · Enter 切换 · 1-9 直选 ·\e[0m \e[1;36mTab 切到命令栏\e[0m \e[2m· q 取消\e[0m\n'
+    fi
+    printf '  \e[2m🖱  点击/滚轮选择 · 点击命令执行 · 选中自动复制到剪贴板\e[0m\n'
+    [ -n "$clip_msg" ] && printf '\n  \e[32m✓ %s\e[0m\n' "$clip_msg"
+  }
+
+  # ── Boot animation: spinner + banner reveal ──
+  _boot_anim(){
+    local i frame
+    printf '\e[H\e[2J'
+    for i in 0 1 2 3 4 5 6 7 8 9; do
+      frame="${spin_frames[$((i % 10))]}"
+      printf '\e[H'
+      printf '\n\n  \e[36m%s\e[0m \e[2mloading profiles...\e[0m\n\n' "$frame"
+      printf '  \e[2m%s\e[0m\n' "$(_sep 40 ─)"
+      printf '\n'
+      # Reveal banner lines progressively
+      if [ "$i" -ge 1 ]; then printf '  \e[38;5;44m%s\e[0m\n' "$(_banner | head -1)"; fi
+      if [ "$i" -ge 3 ]; then printf '  \e[38;5;38m%s\e[0m\n' "$(_banner | sed -n 2p)"; fi
+      if [ "$i" -ge 5 ]; then printf '  \e[38;5;31m%s\e[0m\n' "$(_banner | sed -n 3p)"; fi
+      if [ "$i" -ge 7 ]; then printf '  \e[38;5;24m%s\e[0m\n' "$(_banner | sed -n 4p)"; fi
+      printf '\e[?25l'
+      sleep 0.06
+    done
+  }
+
+  # Change selection + copy to clipboard + redraw.
+  _move_sel(){
+    sel=$1
+    _copy "${profiles[$sel]}"
+    clip_msg="已复制: ${profiles[$sel]}"
+    _draw
+  }
+
+  # Run a command from the command bar. Exits TUI first, then dispatches.
+  # Return 0 means the picker should return (caller exits). Return 1 means
+  # the command was informational and we should re-enter the TUI.
+  _run_cmd(){
+    local action="$1"
+    _cleanup_tui; trap - INT TERM
+    printf '\n'
+    case "$action" in
+      list)   list; printf '\n'; return 1 ;;
+      status) status; printf '\n'; return 1 ;;
+      add)    add; printf '\n'; return 1 ;;
+      doctor) doctor; printf '\n'; return 1 ;;
+      help)   sed -n '2,32p' "$0"; printf '\n'; return 1 ;;
+      quit)   printf '已取消。\n'; return 0 ;;
+    esac
+    return 1
+  }
+
+  # Enter full-screen mode.
+  printf '\e[?1049h'
+  printf '\e[?1002h\e[?1006h'
+  tput civis 2>/dev/null || true
+  # Boot animation
+  _boot_anim
+  _copy "${profiles[$sel]}"
+  clip_msg="已复制: ${profiles[$sel]}"
+  _draw
+
+  while true; do
+    _read_input
+    # Mouse events: SGR mode reports \e[<btn;x;yM
+    if [ "$MOUSE_EVENT" = 1 ]; then
+      case "$MOUSE_BTN" in
+        0|1|2) # left click — profiles start at row prof_start (8)
+          local row=$(( MOUSE_Y - prof_start ))
+          if [ "$row" -ge 0 ] && [ "$row" -lt "$rows" ]; then
+            _move_sel "$row"
+          elif [ "$MOUSE_Y" -eq "$cmd_row" ]; then
+            # Click on the command bar — hit-test each button
+            local ci hit=0
+            for ci in "${!cmds[@]}"; do
+              local pos="${cmd_pos[$ci]}"
+              local start="${pos%% *}" end="${pos##* }"
+              if [ "$MOUSE_X" -ge "$start" ] && [ "$MOUSE_X" -le "$end" ]; then
+                cmd_sel=$ci; focus="cmds"
+                _draw
+                _run_cmd "${cmd_actions[$ci]}" || return 0
+                printf '\e[?1049h'; tput civis 2>/dev/null || true; _draw
+                hit=1; break
+              fi
+            done
+          fi
+          ;;
+        64) _move_sel $(( (sel-1+rows) % rows )) ;;  # wheel up
+        65) _move_sel $(( (sel+1) % rows )) ;;       # wheel down
+      esac
+      continue
+    fi
+    # Keyboard
+    case "$KEY" in
+      $'\e[A'|$'\eOA')
+        if [ "$focus" = "profiles" ]; then _move_sel $(( (sel-1+rows) % rows ))
+        else cmd_sel=$(( (cmd_sel-1+ncmds) % ncmds )); _draw; fi ;;
+      $'\e[B'|$'\eOB')
+        if [ "$focus" = "profiles" ]; then _move_sel $(( (sel+1) % rows ))
+        else cmd_sel=$(( (cmd_sel+1) % ncmds )); _draw; fi ;;
+      $'\e[C'|$'\eOC') # right arrow — move focus to command bar, or right within it
+        if [ "$focus" = "profiles" ]; then focus="cmds"; _draw
+        else cmd_sel=$(( (cmd_sel+1) % ncmds )); _draw; fi ;;
+      $'\e[D'|$'\eOD') # left arrow
+        if [ "$focus" = "cmds" ] && [ "$cmd_sel" -eq 0 ]; then focus="profiles"; _draw
+        elif [ "$focus" = "cmds" ]; then cmd_sel=$(( (cmd_sel-1+ncmds) % ncmds )); _draw
+        fi ;;
+      k|K) _move_sel $(( (sel-1+rows) % rows )) ;;
+      j|J) _move_sel $(( (sel+1) % rows )) ;;
+      h|H) # vim-style left
+        if [ "$focus" = "cmds" ] && [ "$cmd_sel" -eq 0 ]; then focus="profiles"; _draw
+        elif [ "$focus" = "cmds" ]; then cmd_sel=$(( (cmd_sel-1+ncmds) % ncmds )); _draw
+        fi ;;
+      l|L) # vim-style right
+        if [ "$focus" = "profiles" ]; then focus="cmds"; _draw
+        else cmd_sel=$(( (cmd_sel+1) % ncmds )); _draw; fi ;;
+      $'\t') # Tab — toggle focus between profiles and command bar
+        if [ "$focus" = "profiles" ]; then focus="cmds"; else focus="profiles"; fi
+        _draw ;;
+      [1-9])
+        local k="$KEY"
+        if [ "$k" -ge 1 ] 2>/dev/null && [ "$k" -le "$rows" ]; then
+          sel=$((k-1)); break
+        fi
+        ;;
+      '')
+        if [ "$focus" = "profiles" ]; then break  # Enter — confirm selection
+        else _run_cmd "${cmd_actions[$cmd_sel]}" || return 0
+             printf '\e[?1049h'; tput civis 2>/dev/null || true; _draw
+        fi ;;
+      q|Q|ESC)
+        _cleanup_tui; trap - INT TERM
+        printf '已取消。\n'; return 0
+        ;;
+    esac
+  done
+
+  _cleanup_tui; trap - INT TERM
+  local chosen="${profiles[$sel]}"
+  printf '\n'
+  if [ "$chosen" = "$cur" ]; then printf '仍是当前配置：%s（未改动）。\n' "$chosen"; return 0; fi
+  use "$chosen"
+}
+
+# Interactive wizard: create a new custom API-key profile + its config.toml provider table.
+add(){
+  local name="${1:-}" reserved=" list ls status st pick menu i p use add new official help doctor fix "
+  while :; do
+    [ -n "$name" ] || read -r -p "新 profile 名称 (字母/数字/-/_): " name
+    if ! [[ "$name" =~ ^[A-Za-z0-9_-]+$ ]]; then echo "  ✗ 只能含字母、数字、- 、_"; name=""; continue; fi
+    if [[ "$reserved" == *" $name "* ]]; then echo "  ✗ '$name' 是保留字,换一个"; name=""; continue; fi
+    break
+  done
+  local d="$PROFILES/$name"
+  if [ -d "$d" ]; then
+    read -r -p "profile '$name' 已存在,覆盖? [y/N] " yn
+    [[ "$yn" =~ ^[Yy]$ ]] || { echo "已取消。"; return 0; }
+  fi
+
+  local label base wire model key
+  read -r -p "显示名 (provider name=, 默认 $name): " label; label="${label:-$name}"
+  read -r -p "base_url (如 https://anyrouter.top/v1): " base
+  base="${base%/}"; [ -n "$base" ] || { echo "✗ base_url 不能为空"; return 1; }
+  read -r -p "wire_api (默认 responses;新版 Codex 仅支持 responses): " wire; wire="${wire:-responses}"
+  if [ "$wire" != "responses" ]; then echo "  ⚠️ Codex 已废弃 '$wire'(见 codex#7782),强制用 responses"; wire="responses"; fi
+  read -r -p "模型 model (如 gpt-5.5): " model; [ -n "$model" ] || { echo "✗ model 不能为空"; return 1; }
+  read -r -p "API key (sk-...): " key;          [ -n "$key" ]   || { echo "✗ key 不能为空"; return 1; }
+
+  mkdir -p "$d"
+  { echo "MODE=apikey"; echo "MODEL=$model"; echo "PROVIDER=$name"; } > "$d/provider.env"
+  printf '{\n  "OPENAI_API_KEY": "%s",\n  "auth_mode": "apikey"\n}\n' "$key" > "$d/auth.json"
+  chmod 600 "$d/auth.json"
+
+  cp -p "$CONFIG" "$CONFIG.bak.$(date +%Y%m%d-%H%M%S)"
+  ls -t "$CONFIG".bak.* 2>/dev/null | tail -n +11 | xargs -r rm -f
+  if grep -q "^\[model_providers\.$name\]" "$CONFIG"; then
+    echo "  config.toml 已有 [model_providers.$name],沿用现有端点(改 base_url 去那里改)。"
+  else
+    { echo ""; echo "[model_providers.$name]"; echo "name = \"$label\""
+      echo "base_url = \"$base\""; echo "wire_api = \"$wire\""; } >> "$CONFIG"
+    echo "  ✓ 已写入 [model_providers.$name] 到 config.toml"
+  fi
+  echo "✓ 已创建 profile: $name  (model=$model · $base · $wire)"
+
+  read -r -p "用 GET $base/models 验证 key? [Y/n] " v
+  if ! [[ "$v" =~ ^[Nn]$ ]]; then
+    local code; code=$(curl -sS -o /dev/null -w '%{http_code}' --max-time 20 "$base/models" -H "Authorization: Bearer $key" 2>/dev/null || echo ERR)
+    case "$code" in
+      200)     echo "  ✅ key 有效 (HTTP 200)" ;;
+      401|403) echo "  ❌ 鉴权失败 (HTTP $code) — key 可能不对" ;;
+      *)       echo "  ⚠️ HTTP $code(端点未必支持 /models,不代表 key 无效;可之后 codex exec 实测)" ;;
+    esac
+  fi
+
+  read -r -p "现在就切到 $name? [y/N] " s
+  if [[ "$s" =~ ^[Yy]$ ]]; then echo; use "$name"; else echo "之后用:  switch $name"; fi
+}
+
+cmd="${1:-status}"
+case "$cmd" in
+  list|ls)          list ;;
+  status|st|"")     status ;;
+  pick|menu|i|-i|p) pick ;;
+  add|new)          shift; add "${1:-}" ;;
+  doctor|fix)       doctor ;;
+  use)              shift; use "${1:?profile name required}" ;;
+  -h|--help|help)   sed -n '2,32p' "$0" ;;
+  *)                if [ -d "$PROFILES/$cmd" ]; then use "$cmd"
+                    else echo "unknown: $cmd"; echo; list
+                         echo; echo "usage: codex-switch [pick|add|list|status|doctor|<profile>]"; exit 1; fi ;;
+esac

package/csw

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# csw — short CLI for Codex-Switch-Helper (package: codex-switch-helper).
+#   csw              -> interactive arrow-key picker
+#   csw <profile>    -> switch directly (e.g. csw official)
+#   csw add [name]   -> wizard to create a new API-key profile
+#   csw list|status|doctor
+#
+# Resolves through symlinks so this works for both:
+#   - npm install -g  (bin symlink into global prefix)
+#   - ./install.sh    (symlink into PATH)
+set -euo pipefail
+
+resolve_dir() {
+  local src="$1"
+  while [ -L "$src" ]; do
+    local dir link
+    dir="$(cd -P "$(dirname "$src")" && pwd)"
+    link="$(readlink "$src")"
+    case "$link" in
+      /*) src="$link" ;;
+      *)  src="$dir/$link" ;;
+    esac
+  done
+  cd -P "$(dirname "$src")" && pwd
+}
+
+here="$(resolve_dir "${BASH_SOURCE[0]}")"
+exec "$here/codex-switch" "${1:-pick}" "${@:2}"

package/examples/anyrouter/auth.json.example

@@ -0,0 +1,4 @@
+{
+  "OPENAI_API_KEY": "sk-REPLACE_WITH_YOUR_KEY",
+  "auth_mode": "apikey"
+}

package/examples/anyrouter/provider.env

@@ -0,0 +1,5 @@
+# Example API-key profile. Copy to ~/.codex/profiles/<name>/provider.env
+# (or just run `switch add` which writes this for you).
+MODE=apikey
+MODEL=gpt-5.5
+PROVIDER=anyrouter          # MUST equal the [model_providers.<name>] key in config.toml

package/examples/official/provider.env

@@ -0,0 +1,4 @@
+# The 'official' profile = your original ChatGPT login (OAuth).
+# Its auth.json is a snapshot of your ~/.codex/auth.json (OAuth tokens) — NOT in this repo.
+MODE=chatgpt
+MODEL=gpt-5.5

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "codex-switch-helper",
+  "version": "1.0.0",
+  "description": "Codex-Switch-Helper: one-command switch between official ChatGPT login and third-party API-key providers for OpenAI Codex (zero deps, pure bash)",
+  "bin": {
+    "csw": "./csw"
+  },
+  "files": [
+    "csw",
+    "codex-switch",
+    "examples",
+    "README.md"
+  ],
+  "scripts": {
+    "prepublishOnly": "chmod +x csw codex-switch"
+  },
+  "keywords": [
+    "codex",
+    "openai",
+    "cli",
+    "provider",
+    "switch",
+    "api-key",
+    "csw"
+  ],
+  "author": "VicZhang6 <realviczhang@gmail.com>",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/VicZhang6/codex-switch.git"
+  },
+  "bugs": {
+    "url": "https://github.com/VicZhang6/codex-switch/issues"
+  },
+  "homepage": "https://github.com/VicZhang6/codex-switch#readme",
+  "os": [
+    "darwin",
+    "linux"
+  ],
+  "engines": {
+    "node": ">=14"
+  },
+  "preferGlobal": true
+}