jbai-cli 1.5.4 → 1.7.0

package/README.md

@@ -2,7 +2,7 @@
 
 **Use AI coding tools with your JetBrains AI subscription** — no separate API keys needed.
 
-One token, all tools: Claude Code, Codex, Aider, Gemini CLI, OpenCode.
+One token, all tools: Claude Code, Codex, Aider, Gemini CLI, OpenCode, **Codex Desktop, Cursor**.
 
 ## Install
 
@@ -41,7 +41,99 @@ Testing JetBrains AI Platform (staging)
 4. Google Proxy (Gemini): ✅ Working
 ```
 
-## Usage
+## Local Proxy (for Codex Desktop, Cursor, and other GUI tools)
+
+jbai-cli includes a **local reverse proxy** that lets any tool with custom base URL support work through JetBrains AI Platform — no per-tool wrappers needed.
+
+### One-liner setup
+
+```bash
+jbai proxy setup
+```
+
+This single command:
+- Starts the proxy on `localhost:18080` (auto-starts on login via launchd)
+- Configures **Codex Desktop** (`~/.codex/config.toml`)
+- Adds the `JBAI_PROXY_KEY` env var to your shell
+
+### How it works
+
+```
+Codex Desktop / Cursor / any tool
+    │  standard OpenAI / Anthropic API calls
+    ▼
+http://localhost:18080
+    │  injects Grazie-Authenticate-JWT header
+    │  routes to correct provider endpoint
+    ▼
+https://api.jetbrains.ai/user/v5/llm/{provider}/v1
+    │
+    ▼
+Actual LLM (GPT, Claude, Gemini)
+```
+
+### Codex Desktop
+
+After `jbai proxy setup`, Codex Desktop works automatically. The setup configures `~/.codex/config.toml` with:
+```toml
+model_provider = "jbai-proxy"
+
+[model_providers.jbai-proxy]
+name = "JetBrains AI (Proxy)"
+base_url = "http://localhost:18080/openai/v1"
+env_key = "JBAI_PROXY_KEY"
+wire_api = "responses"
+```
+
+### Cursor
+
+Cursor requires manual configuration via its UI:
+1. Open **Cursor** → **Settings** (gear icon) → **Models**
+2. Enable **"Override OpenAI Base URL"**
+3. Set:
+   - **Base URL**: `http://localhost:18080/openai/v1`
+   - **API Key**: `placeholder`
+4. Click **Verify**
+
+### Any OpenAI-compatible tool
+
+Point it to the proxy:
+```bash
+export OPENAI_BASE_URL=http://localhost:18080/openai/v1
+export OPENAI_API_KEY=placeholder
+```
+
+For Anthropic-compatible tools:
+```bash
+export ANTHROPIC_BASE_URL=http://localhost:18080/anthropic
+export ANTHROPIC_API_KEY=placeholder
+```
+
+### Proxy commands
+
+| Command | Description |
+|---------|-------------|
+| `jbai proxy setup` | One-liner: configure everything + start |
+| `jbai proxy status` | Check if proxy is running |
+| `jbai proxy stop` | Stop the proxy |
+| `jbai proxy --daemon` | Start proxy in background |
+| `jbai proxy install-service` | Auto-start on login (macOS launchd) |
+| `jbai proxy uninstall-service` | Remove auto-start |
+
+### Proxy routes
+
+| Route | Target |
+|-------|--------|
+| `/openai/v1/*` | Grazie OpenAI endpoint |
+| `/anthropic/v1/*` | Grazie Anthropic endpoint |
+| `/google/v1/*` | Grazie Google endpoint |
+| `/v1/chat/completions` | OpenAI (auto-detect) |
+| `/v1/responses` | OpenAI (auto-detect) |
+| `/v1/messages` | Anthropic (auto-detect) |
+| `/v1/models` | Synthetic model list |
+| `/health` | Proxy status |
+
+## CLI Tool Wrappers
 
 ### Claude Code
 ```bash
@@ -76,6 +168,16 @@ jbai-opencode
 jbai handoff --task "continue this work in orca-lab"
 ```
 
+### Handoff to Orca Lab (nightly/staging)
+```bash
+export ORCA_LAB_URL="https://orca-lab-nightly.labs.jb.gg"
+export FACADE_JWT_TOKEN="..."        # required for /api/handoff
+export GITHUB_TOKEN="..."            # repo clone during provisioning
+
+jbai handoff --task "add new e2e test" \
+  --repo "https://github.com/JetBrains/jcp-orca-facade.git"
+```
+
 ### In-session handoff (interactive tools)
 While running `jbai-codex`, `jbai-claude`, `jbai-gemini`, or `jbai-opencode`:
 - Press `Ctrl+]` to trigger a handoff to Orca Lab.
@@ -83,7 +185,7 @@ While running `jbai-codex`, `jbai-claude`, `jbai-gemini`, or `jbai-opencode`:
 
 Optional environment variables:
 - `ORCA_LAB_URL` (default: `http://localhost:3000`)
-- `FACADE_JWT_TOKEN` (local facade auth)
+- `FACADE_JWT_TOKEN` (required for /api/handoff on hosted Orca Lab)
 - `GITHUB_TOKEN` / `GH_TOKEN` (private repos)
 - `JBAI_HANDOFF_TASK` (fallback task if no prompt captured)
 - `JBAI_HANDOFF_REPO` (override repo URL)
@@ -116,8 +218,6 @@ jbai-aider --super
 | Gemini CLI | `--yolo` |
 | OpenCode | N/A (run mode is already non-interactive) |
 
-⚠️ **Use with caution** - super mode allows the AI to make changes without confirmation.
-
 ## Using Different Models
 
 Each tool has a sensible default, but you can specify any available model:
@@ -180,6 +280,9 @@ jbai-aider --model gemini/gemini-2.5-pro
 | `jbai token set` | Set/update token |
 | `jbai test` | Test API connections |
 | `jbai models` | List all models |
+| `jbai proxy setup` | Setup proxy + configure Codex Desktop |
+| `jbai proxy status` | Check proxy status |
+| `jbai proxy stop` | Stop proxy |
 | `jbai handoff` | Continue a task in Orca Lab |
 | `jbai install` | Install all AI tools |
 | `jbai install claude` | Install specific tool |
@@ -247,6 +350,10 @@ jbai-cli uses JetBrains AI Platform's **Guarded Proxy**, which provides API-comp
 
 Your JetBrains AI token authenticates all requests via the `Grazie-Authenticate-JWT` header.
 
+**CLI wrappers** (`jbai-claude`, `jbai-codex`, etc.) set environment variables and launch the underlying tool directly.
+
+**Local proxy** (`jbai proxy`) runs an HTTP server on localhost that forwards requests to Grazie, injecting the JWT header automatically. This enables GUI tools like Codex Desktop and Cursor that don't support custom headers but do support custom base URLs.
+
 ## Troubleshooting
 
 ### "Token expired"
@@ -269,6 +376,21 @@ jbai test
 jbai token
 ```
 
+### Proxy not working
+```bash
+# Check proxy status
+jbai proxy status
+
+# Check proxy health
+curl http://localhost:18080/health
+
+# Check logs
+cat ~/.jbai/proxy.log
+
+# Restart proxy
+jbai proxy stop && jbai proxy --daemon
+```
+
 ### Wrong environment
 ```bash
 # Staging token won't work with production

package/bin/jbai-opencode.js

@@ -109,6 +109,11 @@ config.MODELS.claude.available.forEach(model => {
   };
 });
 
+// NOTE: Gemini models are NOT available via Grazie OpenAI-compatible proxy.
+// The /user/v5/llm/google/v1/vertex endpoint only works with native Google API
+// format (used by jbai-gemini), not OpenAI chat/completions format.
+// Use `jbai gemini` instead for Gemini models.
+
 // Write config
 fs.writeFileSync(configFile, JSON.stringify(opencodeConfig, null, 2));
 

package/bin/jbai-proxy.js

@@ -0,0 +1,810 @@
+#!/usr/bin/env node
+
+/**
+ * jbai-proxy - Local reverse proxy for JetBrains AI Platform (Grazie)
+ *
+ * Runs a local HTTP server that transparently proxies OpenAI / Anthropic / Google
+ * API calls to Grazie, injecting the JWT authentication header automatically.
+ *
+ * This allows ANY tool that supports custom base URLs (Codex Desktop, Cursor,
+ * Continue, etc.) to work through JetBrains AI Platform without per-tool wrappers.
+ *
+ * Routes:
+ *   /openai/v1/*       → Grazie OpenAI endpoint   (explicit)
+ *   /anthropic/v1/*    → Grazie Anthropic endpoint (explicit)
+ *   /google/v1/*       → Grazie Google endpoint    (explicit)
+ *
+ *   /v1/chat/completions → OpenAI   (auto-detect)
+ *   /v1/completions      → OpenAI   (auto-detect)
+ *   /v1/responses        → OpenAI   (auto-detect)
+ *   /v1/embeddings       → OpenAI   (auto-detect)
+ *   /v1/models           → synthetic model list
+ *   /v1/messages         → Anthropic (auto-detect)
+ *
+ * Usage:
+ *   jbai proxy                     # start on default port 18080
+ *   jbai proxy --port 9090         # custom port
+ *   jbai proxy --daemon            # run in background
+ *   jbai proxy stop                # stop background daemon
+ *   jbai proxy status              # check if running
+ */
+
+const http = require('http');
+const https = require('https');
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const config = require('../lib/config');
+
+const DEFAULT_PORT = 18080;
+const PID_FILE = path.join(config.CONFIG_DIR, 'proxy.pid');
+const LOG_FILE = path.join(config.CONFIG_DIR, 'proxy.log');
+
+// ---------------------------------------------------------------------------
+// Token management - re-reads from disk on each request for hot-refresh
+// ---------------------------------------------------------------------------
+let cachedToken = null;
+let tokenMtime = 0;
+
+function getToken() {
+  try {
+    const stat = fs.statSync(config.TOKEN_FILE);
+    if (stat.mtimeMs !== tokenMtime) {
+      cachedToken = fs.readFileSync(config.TOKEN_FILE, 'utf-8').trim();
+      tokenMtime = stat.mtimeMs;
+    }
+  } catch {
+    cachedToken = null;
+  }
+  return cachedToken;
+}
+
+// ---------------------------------------------------------------------------
+// Route resolution
+// ---------------------------------------------------------------------------
+
+function resolveRoute(method, urlPath) {
+  const endpoints = config.getEndpoints();
+
+  // Explicit provider prefix routes
+  if (urlPath.startsWith('/openai/')) {
+    const rest = urlPath.slice('/openai'.length); // keeps /v1/...
+    return { target: endpoints.openai.replace(/\/v1$/, '') + rest, provider: 'openai' };
+  }
+  if (urlPath.startsWith('/anthropic/')) {
+    const rest = urlPath.slice('/anthropic'.length);
+    return { target: endpoints.anthropic.replace(/\/v1$/, '') + rest, provider: 'anthropic' };
+  }
+  if (urlPath.startsWith('/google/')) {
+    const rest = urlPath.slice('/google'.length);
+    return { target: endpoints.google + rest, provider: 'google' };
+  }
+
+  // Auto-detect routes based on standard SDK paths
+  // Anthropic SDK always calls /v1/messages
+  if (urlPath.startsWith('/v1/messages')) {
+    const rest = urlPath.slice('/v1'.length);
+    return { target: endpoints.anthropic + rest, provider: 'anthropic' };
+  }
+
+  // Everything else under /v1/* goes to OpenAI
+  if (urlPath.startsWith('/v1/')) {
+    // Special: /v1/models returns synthetic list
+    if (urlPath === '/v1/models') {
+      return { target: null, provider: 'models' };
+    }
+    const rest = urlPath.slice('/v1'.length);
+    return { target: endpoints.openai + rest, provider: 'openai' };
+  }
+
+  return null;
+}
+
+// ---------------------------------------------------------------------------
+// Synthetic /v1/models response
+// ---------------------------------------------------------------------------
+
+function buildModelsResponse() {
+  const models = [];
+  const now = Math.floor(Date.now() / 1000);
+
+  for (const m of config.MODELS.openai.available) {
+    models.push({ id: m, object: 'model', created: now, owned_by: 'openai' });
+  }
+  for (const m of config.MODELS.claude.available) {
+    models.push({ id: m, object: 'model', created: now, owned_by: 'anthropic' });
+  }
+  for (const m of config.MODELS.gemini.available) {
+    models.push({ id: m, object: 'model', created: now, owned_by: 'google' });
+  }
+
+  return { object: 'list', data: models };
+}
+
+// ---------------------------------------------------------------------------
+// Proxy handler
+// ---------------------------------------------------------------------------
+
+function proxy(req, res) {
+  const startTime = Date.now();
+
+  // CORS preflight
+  if (req.method === 'OPTIONS') {
+    res.writeHead(204, {
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
+      'Access-Control-Allow-Headers': '*',
+    });
+    res.end();
+    return;
+  }
+
+  // Parse URL (strip query string for routing, preserve for forwarding)
+  const [urlPath, query] = (req.url || '/').split('?');
+  const route = resolveRoute(req.method, urlPath);
+
+  if (!route) {
+    // Health / info endpoint
+    if (urlPath === '/' || urlPath === '/health') {
+      const token = getToken();
+      const info = {
+        service: 'jbai-proxy',
+        status: 'ok',
+        environment: config.getEnvironment(),
+        tokenPresent: !!token,
+        tokenExpired: token ? config.isTokenExpired(token) : null,
+        routes: {
+          openai: 'http://localhost:' + (res.socket?.localPort || DEFAULT_PORT) + '/openai/v1  OR  /v1/chat/completions',
+          anthropic: 'http://localhost:' + (res.socket?.localPort || DEFAULT_PORT) + '/anthropic/v1  OR  /v1/messages',
+          google: 'http://localhost:' + (res.socket?.localPort || DEFAULT_PORT) + '/google/v1',
+        }
+      };
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify(info, null, 2));
+      return;
+    }
+
+    res.writeHead(404, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: { message: `Unknown route: ${urlPath}`, type: 'invalid_request_error' } }));
+    return;
+  }
+
+  // Synthetic models endpoint
+  if (route.provider === 'models') {
+    res.writeHead(200, {
+      'Content-Type': 'application/json',
+      'Access-Control-Allow-Origin': '*',
+    });
+    res.end(JSON.stringify(buildModelsResponse()));
+    log(`[models] GET /v1/models → 200 (${Date.now() - startTime}ms)`);
+    return;
+  }
+
+  // Get token
+  const token = getToken();
+  if (!token) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: { message: 'No Grazie token found. Run: jbai token set', type: 'authentication_error' } }));
+    return;
+  }
+
+  if (config.isTokenExpired(token)) {
+    res.writeHead(401, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify({ error: { message: 'Grazie token expired. Run: jbai token set', type: 'authentication_error' } }));
+    return;
+  }
+
+  // Read request body
+  const chunks = [];
+  req.on('data', (chunk) => chunks.push(chunk));
+  req.on('end', () => {
+    const body = Buffer.concat(chunks);
+    const targetUrl = new URL(route.target + (query ? '?' + query : ''));
+
+    // Build forwarded headers - pass through everything except host/authorization
+    const fwdHeaders = {};
+    for (const [key, value] of Object.entries(req.headers)) {
+      const lower = key.toLowerCase();
+      // Skip hop-by-hop and host headers
+      if (['host', 'connection', 'keep-alive', 'transfer-encoding', 'te', 'trailer', 'upgrade'].includes(lower)) continue;
+      // Skip authorization (we inject our own)
+      if (lower === 'authorization') continue;
+      fwdHeaders[key] = value;
+    }
+
+    // Inject Grazie auth
+    fwdHeaders['Grazie-Authenticate-JWT'] = token;
+
+    // Ensure content-length is correct for the body we have
+    if (body.length > 0) {
+      fwdHeaders['content-length'] = body.length;
+    }
+
+    const proxyReq = https.request({
+      hostname: targetUrl.hostname,
+      port: 443,
+      path: targetUrl.pathname + targetUrl.search,
+      method: req.method,
+      headers: fwdHeaders,
+    }, (proxyRes) => {
+      // Forward status and headers
+      const resHeaders = { ...proxyRes.headers, 'Access-Control-Allow-Origin': '*' };
+      res.writeHead(proxyRes.statusCode, resHeaders);
+
+      // Stream response (supports SSE streaming)
+      proxyRes.pipe(res);
+
+      proxyRes.on('end', () => {
+        const elapsed = Date.now() - startTime;
+        log(`[${route.provider}] ${req.method} ${urlPath} → ${proxyRes.statusCode} (${elapsed}ms)`);
+      });
+    });
+
+    proxyReq.on('error', (err) => {
+      log(`[${route.provider}] ${req.method} ${urlPath} → ERROR: ${err.message}`);
+      if (!res.headersSent) {
+        res.writeHead(502, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ error: { message: `Proxy error: ${err.message}`, type: 'proxy_error' } }));
+      }
+    });
+
+    if (body.length > 0) {
+      proxyReq.write(body);
+    }
+    proxyReq.end();
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Logging
+// ---------------------------------------------------------------------------
+
+let logToFile = false;
+
+function log(msg) {
+  const line = `${new Date().toISOString()} ${msg}`;
+  if (logToFile) {
+    fs.appendFileSync(LOG_FILE, line + '\n');
+  } else {
+    console.log(line);
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Daemon management
+// ---------------------------------------------------------------------------
+
+function writePid(port) {
+  config.ensureConfigDir();
+  fs.writeFileSync(PID_FILE, JSON.stringify({ pid: process.pid, port }), { mode: 0o600 });
+}
+
+function readPid() {
+  try {
+    return JSON.parse(fs.readFileSync(PID_FILE, 'utf-8'));
+  } catch {
+    return null;
+  }
+}
+
+function removePid() {
+  try { fs.unlinkSync(PID_FILE); } catch {}
+}
+
+function isRunning(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function stopDaemon() {
+  const info = readPid();
+  if (!info) {
+    console.log('No proxy daemon found');
+    return;
+  }
+  if (!isRunning(info.pid)) {
+    console.log('Proxy daemon not running (stale pid file)');
+    removePid();
+    return;
+  }
+  try {
+    process.kill(info.pid, 'SIGTERM');
+    console.log(`Stopped proxy daemon (pid ${info.pid})`);
+    removePid();
+  } catch (e) {
+    console.log(`Failed to stop daemon: ${e.message}`);
+  }
+}
+
+function showStatus() {
+  const info = readPid();
+  if (!info) {
+    console.log('Proxy: not running');
+    return;
+  }
+  if (!isRunning(info.pid)) {
+    console.log('Proxy: not running (stale pid file)');
+    removePid();
+    return;
+  }
+  console.log(`Proxy: running on port ${info.port} (pid ${info.pid})`);
+  console.log(`  OpenAI:    http://localhost:${info.port}/openai/v1`);
+  console.log(`  Anthropic: http://localhost:${info.port}/anthropic/v1`);
+  console.log(`  Auto:      http://localhost:${info.port}/v1/...`);
+  console.log(`  Logs:      ${LOG_FILE}`);
+}
+
+function startDaemon(port) {
+  const { spawn } = require('child_process');
+  const child = spawn(process.execPath, [__filename, '--port', String(port), '--_daemon'], {
+    detached: true,
+    stdio: 'ignore',
+    env: { ...process.env }
+  });
+  child.unref();
+  // Give it a moment to start
+  setTimeout(() => {
+    const info = readPid();
+    if (info && isRunning(info.pid)) {
+      console.log(`Proxy daemon started on port ${port} (pid ${info.pid})`);
+      console.log('');
+      printUsage(port);
+    } else {
+      console.log('Failed to start daemon. Check logs: ' + LOG_FILE);
+    }
+  }, 500);
+}
+
+// ---------------------------------------------------------------------------
+// macOS launchd service
+// ---------------------------------------------------------------------------
+
+const LAUNCHD_LABEL = 'com.jetbrains.jbai-proxy';
+
+function getLaunchdPlistPath() {
+  return path.join(os.homedir(), 'Library', 'LaunchAgents', `${LAUNCHD_LABEL}.plist`);
+}
+
+function installService(port) {
+  if (process.platform !== 'darwin') {
+    console.log('Auto-start service is only supported on macOS.');
+    console.log('On Linux, create a systemd user service manually.');
+    return;
+  }
+
+  const nodePath = process.execPath;
+  const proxyPath = path.resolve(__filename);
+  const home = os.homedir();
+  const plistPath = getLaunchdPlistPath();
+
+  const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${LAUNCHD_LABEL}</string>
+    <key>ProgramArguments</key>
+    <array>
+        <string>${nodePath}</string>
+        <string>${proxyPath}</string>
+        <string>--port</string>
+        <string>${port}</string>
+        <string>--_daemon</string>
+    </array>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>${home}/.jbai/proxy.log</string>
+    <key>StandardErrorPath</key>
+    <string>${home}/.jbai/proxy.log</string>
+</dict>
+</plist>`;
+
+  const launchAgentsDir = path.join(home, 'Library', 'LaunchAgents');
+  if (!fs.existsSync(launchAgentsDir)) {
+    fs.mkdirSync(launchAgentsDir, { recursive: true });
+  }
+
+  fs.writeFileSync(plistPath, plist);
+  console.log(`Written: ${plistPath}`);
+
+  // Load the service
+  const { execSync } = require('child_process');
+  try {
+    // Unload first in case it's already loaded
+    try { execSync(`launchctl unload "${plistPath}" 2>/dev/null`); } catch {}
+    execSync(`launchctl load "${plistPath}"`);
+    console.log(`Service loaded and started on port ${port}`);
+    console.log('');
+    console.log('The proxy will now auto-start on login.');
+    console.log(`  Logs:    ${home}/.jbai/proxy.log`);
+    console.log(`  Remove:  jbai proxy uninstall-service`);
+    console.log('');
+    printUsage(port);
+  } catch (e) {
+    console.log(`Written plist but failed to load: ${e.message}`);
+    console.log(`Try: launchctl load "${plistPath}"`);
+  }
+}
+
+function uninstallService() {
+  if (process.platform !== 'darwin') {
+    console.log('Auto-start service is only supported on macOS.');
+    return;
+  }
+
+  const plistPath = getLaunchdPlistPath();
+  if (!fs.existsSync(plistPath)) {
+    console.log('No launchd service installed.');
+    return;
+  }
+
+  const { execSync } = require('child_process');
+  try {
+    execSync(`launchctl unload "${plistPath}"`);
+  } catch {}
+  fs.unlinkSync(plistPath);
+  console.log('Service uninstalled. Proxy will no longer auto-start.');
+}
+
+// ---------------------------------------------------------------------------
+// One-liner setup: proxy + codex + shell env
+// ---------------------------------------------------------------------------
+
+function setup(port) {
+  console.log('Setting up jbai-proxy...\n');
+
+  // 1. Check token
+  const token = config.getToken();
+  if (!token) {
+    console.log('No token found. Let\'s set one up first.\n');
+    console.log('  1. Go to https://platform.jetbrains.ai/ (or staging: https://platform.stgn.jetbrains.ai/)');
+    console.log('  2. Click Profile → "Copy Developer Token"');
+    console.log('  3. Run: jbai token set\n');
+    console.log('Then re-run: jbai proxy setup');
+    process.exit(1);
+  }
+
+  if (config.isTokenExpired(token)) {
+    console.log('Your token is expired. Run: jbai token set');
+    console.log('Then re-run: jbai proxy setup');
+    process.exit(1);
+  }
+
+  console.log(`Token: valid`);
+  console.log(`Environment: ${config.getEnvironment()}\n`);
+
+  let steps = 0;
+
+  // 2. Configure Codex Desktop (config.toml)
+  steps += configureCodexDesktop(port);
+
+  // 3. Add JBAI_PROXY_KEY to shell rc
+  steps += configureShellEnv();
+
+  // 4. Install launchd service (macOS) or start daemon
+  steps += configureAutoStart(port);
+
+  // 5. Verify proxy is running
+  console.log('');
+  verifyProxy(port);
+
+  console.log(`\n--- Setup complete (${steps} changes) ---\n`);
+  printUsage(port);
+
+  console.log(`Cursor (manual step):
+  Open Cursor → Settings → Models → enable "Override OpenAI Base URL"
+    Base URL:  http://localhost:${port}/openai/v1
+    API Key:   placeholder
+`);
+}
+
+function configureCodexDesktop(port) {
+  const codexDir = path.join(os.homedir(), '.codex');
+  const codexConfig = path.join(codexDir, 'config.toml');
+  let changed = 0;
+
+  if (!fs.existsSync(codexDir)) {
+    fs.mkdirSync(codexDir, { recursive: true });
+  }
+
+  let content = '';
+  if (fs.existsSync(codexConfig)) {
+    content = fs.readFileSync(codexConfig, 'utf-8');
+  }
+
+  // Add jbai-proxy provider if missing
+  if (!content.includes('[model_providers.jbai-proxy]')) {
+    const providerBlock = `
+# JetBrains AI via local proxy (for Codex Desktop)
+[model_providers.jbai-proxy]
+name = "JetBrains AI (Proxy)"
+base_url = "http://localhost:${port}/openai/v1"
+env_key = "JBAI_PROXY_KEY"
+wire_api = "responses"
+`;
+    fs.appendFileSync(codexConfig, providerBlock);
+    console.log('Codex Desktop: added jbai-proxy provider to ~/.codex/config.toml');
+    changed++;
+  } else {
+    console.log('Codex Desktop: jbai-proxy provider already configured');
+  }
+
+  // Set model_provider = "jbai-proxy" if not already set
+  if (content.includes('model_provider')) {
+    if (!content.includes('model_provider = "jbai-proxy"')) {
+      // Replace existing model_provider line
+      const updated = content.replace(/^model_provider\s*=\s*"[^"]*"/m, 'model_provider = "jbai-proxy"');
+      fs.writeFileSync(codexConfig, updated);
+      console.log('Codex Desktop: switched model_provider to jbai-proxy');
+      changed++;
+    } else {
+      console.log('Codex Desktop: already using jbai-proxy provider');
+    }
+  } else {
+    // Add model_provider after model = line, or at top
+    if (content.includes('model =')) {
+      const updated = content.replace(/^(model\s*=\s*"[^"]*")/m, '$1\nmodel_provider = "jbai-proxy"');
+      fs.writeFileSync(codexConfig, updated);
+    } else {
+      const updated = 'model_provider = "jbai-proxy"\n' + content;
+      fs.writeFileSync(codexConfig, updated);
+    }
+    console.log('Codex Desktop: set model_provider = "jbai-proxy"');
+    changed++;
+  }
+
+  return changed;
+}
+
+function configureShellEnv() {
+  const home = os.homedir();
+  // Detect shell rc file
+  const shell = process.env.SHELL || '/bin/zsh';
+  let rcFile;
+  if (shell.includes('zsh')) {
+    rcFile = path.join(home, '.zshrc');
+  } else if (shell.includes('bash')) {
+    // macOS uses .bash_profile, Linux uses .bashrc
+    const profile = path.join(home, '.bash_profile');
+    const bashrc = path.join(home, '.bashrc');
+    rcFile = fs.existsSync(profile) ? profile : bashrc;
+  } else {
+    rcFile = path.join(home, '.profile');
+  }
+
+  if (!fs.existsSync(rcFile)) {
+    fs.writeFileSync(rcFile, '');
+  }
+
+  const rcContent = fs.readFileSync(rcFile, 'utf-8');
+  if (rcContent.includes('JBAI_PROXY_KEY')) {
+    console.log(`Shell: JBAI_PROXY_KEY already in ${path.basename(rcFile)}`);
+    return 0;
+  }
+
+  const envLine = '\n# jbai-proxy: placeholder key for Codex Desktop / Cursor\nexport JBAI_PROXY_KEY="placeholder"\n';
+  fs.appendFileSync(rcFile, envLine);
+  console.log(`Shell: added JBAI_PROXY_KEY to ~/${path.basename(rcFile)}`);
+
+  // Also set it in current process for immediate use
+  process.env.JBAI_PROXY_KEY = 'placeholder';
+  return 1;
+}
+
+function configureAutoStart(port) {
+  if (process.platform === 'darwin') {
+    const plistPath = getLaunchdPlistPath();
+    if (fs.existsSync(plistPath)) {
+      // Check if proxy is already running
+      const info = readPid();
+      if (info && isRunning(info.pid)) {
+        console.log(`Proxy: already running on port ${info.port} (pid ${info.pid})`);
+        return 0;
+      }
+    }
+    // Install service (starts proxy + auto-start on login)
+    installService(port);
+    return 1;
+  } else {
+    // Non-macOS: just start daemon
+    startDaemon(port);
+    return 1;
+  }
+}
+
+function verifyProxy(port) {
+  const http = require('http');
+  const req = http.get(`http://127.0.0.1:${port}/health`, { timeout: 2000 }, (res) => {
+    let body = '';
+    res.on('data', chunk => body += chunk);
+    res.on('end', () => {
+      try {
+        const info = JSON.parse(body);
+        if (info.status === 'ok' && info.tokenPresent) {
+          console.log(`Proxy: running on port ${port}`);
+        } else {
+          console.log(`Proxy: running but token issue — ${JSON.stringify(info)}`);
+        }
+      } catch {
+        console.log(`Proxy: running on port ${port} (health check returned non-JSON)`);
+      }
+    });
+  });
+  req.on('error', () => {
+    console.log('Proxy: not responding yet (may need a moment to start)');
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Usage instructions
+// ---------------------------------------------------------------------------
+
+function printUsage(port) {
+  console.log(`Configure your tools to use these base URLs:
+
+  OpenAI tools (Codex Desktop, Cursor, etc.):
+    OPENAI_BASE_URL=http://localhost:${port}/openai/v1
+    OPENAI_API_KEY=placeholder
+
+  Anthropic tools (Claude Desktop, etc.):
+    ANTHROPIC_BASE_URL=http://localhost:${port}/anthropic
+    ANTHROPIC_API_KEY=placeholder
+
+  Auto-detect mode (works for most tools):
+    Base URL: http://localhost:${port}/v1
+    API Key:  placeholder
+
+  The API key can be any non-empty string — auth is handled by your Grazie JWT.
+`);
+}
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+function parseProxyArgs(argv) {
+  const opts = { port: DEFAULT_PORT, daemon: false, _daemon: false };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--port' || arg === '-p') {
+      opts.port = parseInt(argv[++i], 10) || DEFAULT_PORT;
+    } else if (arg === '--daemon' || arg === '-d') {
+      opts.daemon = true;
+    } else if (arg === '--_daemon') {
+      opts._daemon = true;
+    } else if (arg === 'stop') {
+      opts.stop = true;
+    } else if (arg === 'status') {
+      opts.status = true;
+    } else if (arg === 'setup') {
+      opts.setup = true;
+    } else if (arg === 'install-service') {
+      opts.installService = true;
+    } else if (arg === 'uninstall-service') {
+      opts.uninstallService = true;
+    } else if (arg === 'help' || arg === '--help' || arg === '-h') {
+      opts.help = true;
+    }
+  }
+  return opts;
+}
+
+const PROXY_HELP = `
+jbai proxy - Local reverse proxy for JetBrains AI Platform
+
+USAGE:
+  jbai proxy setup             One-liner: configure everything + start proxy
+  jbai proxy                   Start proxy (foreground, port ${DEFAULT_PORT})
+  jbai proxy --port 9090       Start on custom port
+  jbai proxy --daemon          Start in background
+  jbai proxy stop              Stop background daemon
+  jbai proxy status            Check proxy status
+  jbai proxy install-service   Auto-start on login (macOS launchd)
+  jbai proxy uninstall-service Remove auto-start
+
+ROUTES:
+  /openai/v1/*                 → Grazie OpenAI endpoint
+  /anthropic/v1/*              → Grazie Anthropic endpoint
+  /google/v1/*                 → Grazie Google endpoint
+  /v1/chat/completions         → OpenAI (auto)
+  /v1/responses                → OpenAI (auto)
+  /v1/messages                 → Anthropic (auto)
+  /v1/models                   → Synthetic model list
+  /health                      → Proxy status
+
+TOOL SETUP:
+  Codex Desktop:   OPENAI_BASE_URL=http://localhost:${DEFAULT_PORT}/openai/v1
+  Cursor:          Set base URL to http://localhost:${DEFAULT_PORT}/openai/v1
+  Claude tools:    ANTHROPIC_BASE_URL=http://localhost:${DEFAULT_PORT}/anthropic
+  API Key:         Use any non-empty string (e.g. "placeholder")
+`;
+
+// ---------------------------------------------------------------------------
+// Main
+// ---------------------------------------------------------------------------
+
+function main() {
+  // When invoked directly (not via jbai.js), parse from argv[2]
+  // When invoked via jbai.js, args are passed from the caller
+  const args = process.argv.slice(2);
+  const opts = parseProxyArgs(args);
+
+  if (opts.help) {
+    console.log(PROXY_HELP);
+    return;
+  }
+
+  if (opts.stop) {
+    stopDaemon();
+    return;
+  }
+
+  if (opts.status) {
+    showStatus();
+    return;
+  }
+
+  if (opts.setup) {
+    setup(opts.port);
+    return;
+  }
+
+  if (opts.installService) {
+    installService(opts.port);
+    return;
+  }
+
+  if (opts.uninstallService) {
+    uninstallService();
+    return;
+  }
+
+  if (opts.daemon && !opts._daemon) {
+    startDaemon(opts.port);
+    return;
+  }
+
+  // Actual server startup
+  if (opts._daemon) {
+    logToFile = true;
+  }
+
+  const server = http.createServer(proxy);
+
+  server.listen(opts.port, '127.0.0.1', () => {
+    writePid(opts.port);
+    log(`jbai-proxy listening on http://127.0.0.1:${opts.port}`);
+    log(`Environment: ${config.getEnvironment()}`);
+    log(`Token file: ${config.TOKEN_FILE}`);
+
+    if (!opts._daemon) {
+      console.log(`\njbai-proxy running on http://localhost:${opts.port}\n`);
+      printUsage(opts.port);
+      console.log('Press Ctrl+C to stop.\n');
+    }
+  });
+
+  // Graceful shutdown
+  const shutdown = () => {
+    log('Shutting down...');
+    removePid();
+    server.close(() => process.exit(0));
+    setTimeout(() => process.exit(0), 2000);
+  };
+  process.on('SIGTERM', shutdown);
+  process.on('SIGINT', shutdown);
+}
+
+// Allow both direct execution and require() from jbai.js
+if (require.main === module) {
+  main();
+} else {
+  module.exports = { main, parseProxyArgs, PROXY_HELP, stopDaemon, showStatus, startDaemon, DEFAULT_PORT };
+}

package/bin/jbai.js

@@ -51,6 +51,12 @@ COMMANDS:
   jbai doctor          Check which tools are installed
   jbai help            Show this help
 
+PROXY (for Codex Desktop, Cursor, etc.):
+  jbai proxy setup             One-liner setup: proxy + Codex + shell env
+  jbai proxy --daemon          Start proxy in background
+  jbai proxy stop              Stop background proxy
+  jbai proxy status            Check proxy status
+
 TOOL WRAPPERS:
   jbai-claude   Launch Claude Code with JetBrains AI
   jbai-codex    Launch Codex CLI with JetBrains AI
@@ -586,6 +592,13 @@ switch (command) {
   case 'status':
     doctor();
     break;
+  case 'proxy': {
+    const proxyMod = require('./jbai-proxy');
+    // Re-set argv so jbai-proxy sees the right args
+    process.argv = [process.argv[0], process.argv[1], ...args];
+    proxyMod.main();
+    break;
+  }
   case 'help':
   case '--help':
   case '-h':

package/lib/config.js

@@ -77,21 +77,10 @@ const MODELS = {
   // Codex CLI uses OpenAI models via the "responses" API (wire_api = "responses")
   // Uses the same models as openai, just different API wire format
   codex: {
-    default: 'o3-2025-04-16',
+    default: 'gpt-5.2-2025-12-11',
     available: [
-      // O-series models (best for coding tasks)
-      'o3-2025-04-16',
-      'o3-mini-2025-01-31',
-      'o4-mini-2025-04-16',
-      // GPT-5.x series
       'gpt-5.2-2025-12-11',
-      'gpt-5.2',
-      'gpt-5.1-2025-11-13',
-      'gpt-5-2025-08-07',
-      // GPT-4.x series
-      'gpt-4.1-2025-04-14',
-      'gpt-4o-2024-11-20',
-      'gpt-4-turbo-2024-04-09'
+      'gpt-5.2'
     ]
   },
   gemini: {

package/lib/interactive-handoff.js

@@ -54,13 +54,33 @@ function runWithHandoff({
 
   process.stderr.write(`ℹ️  Handoff trigger: ${label}\n`);
 
-  const ptyProcess = pty.spawn(command, args, {
-    name: 'xterm-256color',
-    cols: process.stdout.columns || 80,
-    rows: process.stdout.rows || 24,
-    cwd: process.cwd(),
-    env,
-  });
+  let ptyProcess;
+  try {
+    ptyProcess = pty.spawn(command, args, {
+      name: 'xterm-256color',
+      cols: process.stdout.columns || 80,
+      rows: process.stdout.rows || 24,
+      cwd: process.cwd(),
+      env,
+    });
+  } catch (err) {
+    // node-pty throws synchronous errors (e.g., posix_spawnp failed) when executable not found
+    const error = new Error(err.message || 'Failed to spawn process');
+    // Check if this is likely a "command not found" error
+    const isNotFound = err.message && (
+      err.message.includes('posix_spawnp failed') ||
+      err.message.includes('ENOENT') ||
+      err.message.includes('not found')
+    );
+    error.code = isNotFound ? 'ENOENT' : 'SPAWN_ERROR';
+    error.command = command;
+    error.originalError = err;
+    // Return a minimal event emitter that immediately emits the error
+    const { EventEmitter } = require('events');
+    const fakeChild = new EventEmitter();
+    setImmediate(() => fakeChild.emit('error', error));
+    return fakeChild;
+  }
 
   let lineBuffer = '';
   let lastPrompt = '';

package/lib/postinstall.js

@@ -1,7 +1,30 @@
 #!/usr/bin/env node
 
+const fs = require('fs');
+const path = require('path');
 const config = require('./config');
 
+// Fix node-pty spawn-helper permissions (macOS/Linux)
+// The prebuilt binary sometimes loses execute permissions during npm install
+try {
+  const platform = process.platform === 'darwin' ? 'darwin' : process.platform;
+  const arch = process.arch;
+  const spawnHelperPath = path.join(
+    __dirname,
+    '..',
+    'node_modules',
+    'node-pty',
+    'prebuilds',
+    `${platform}-${arch}`,
+    'spawn-helper'
+  );
+  if (fs.existsSync(spawnHelperPath)) {
+    fs.chmodSync(spawnHelperPath, 0o755);
+  }
+} catch {
+  // Ignore errors - this is a best-effort fix
+}
+
 console.log(`
 ╔══════════════════════════════════════════════════════════════╗
 ║                    jbai-cli installed!                       ║

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jbai-cli",
-  "version": "1.5.4",
+  "version": "1.7.0",
   "description": "CLI wrappers to use AI coding tools (Claude Code, Codex, Gemini CLI, OpenCode) with JetBrains AI Platform",
   "keywords": [
     "jetbrains",
@@ -26,6 +26,7 @@
   "homepage": "https://github.com/JetBrains/jbai-cli#readme",
   "bin": {
     "jbai": "bin/jbai.js",
+    "jbai-proxy": "bin/jbai-proxy.js",
     "jbai-claude": "bin/jbai-claude.js",
     "jbai-codex": "bin/jbai-codex.js",
     "jbai-gemini": "bin/jbai-gemini.js",