relmio 0.5.0 → 0.6.0

package/src/services/codex-login.js

@@ -9,7 +9,7 @@ import {
 
 const COMPOSE_FILE_NAME = "docker-compose.yml";
 const PROJECT_NAME_PATTERN =
-  /^relmio-codex-chatgpt-[a-f0-9]{32}$/u;
+  /^relmio-codex-(chatgpt|chat)-[a-f0-9]{32}$/u;
 const DEFAULT_RESPONSE_TIMEOUT_MS = 15_000;
 const DEFAULT_COMPLETION_TIMEOUT_MS = 300_000;
 const DEFAULT_TERMINATION_GRACE_MS = 2_000;
@@ -88,7 +88,12 @@ function validateOptions({
   if (maxLineBytes > maxStdoutBytes) {
     throw new TypeError("maxLineBytes cannot exceed maxStdoutBytes.");
   }
-  return { dockerHost: validatedDockerHost, projectName };
+  const projectKind = PROJECT_NAME_PATTERN.exec(projectName)?.[1];
+  return {
+    dockerHost: validatedDockerHost,
+    projectName,
+    serviceName: projectKind === "chat" ? "codex-chat" : "codex",
+  };
 }
 
 function validateVerificationUrl(value) {
@@ -205,7 +210,10 @@ export async function startCodexDeviceLogin({
         "run",
         "--rm",
         "--no-deps",
-        "codex",
+        ...(validated.serviceName === "codex-chat"
+          ? ["--entrypoint", "codex"]
+          : []),
+        validated.serviceName,
         "app-server",
         "--strict-config",
         "--stdio",

package/src/services/local-installer.js

@@ -6,6 +6,10 @@ import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 
 import {
   createCodexComposeFile,
+  createCodexChatComposeFile,
+  createCodexChatConfig,
+  createCodexChatDockerfile,
+  createCodexChatRequirements,
   createCodexConfig,
   createCodexDockerfile,
   createCodexRequirements,
@@ -39,6 +43,11 @@ const PROJECTS = Object.freeze({
     serviceName: "codex",
     containerPort: 4_500,
   }),
+  "codex-chat": Object.freeze({
+    projectPrefix: "relmio-codex-chat",
+    serviceName: "codex-chat",
+    containerPort: 14_501,
+  }),
 });
 const DOCKER_SELECTION_VARIABLES = Object.freeze([
   "DOCKER_HOST",
@@ -613,10 +622,9 @@ function replaceClientCredentialVerifier({ target, composeFile, tokenSha256 }) {
     throw new Error("The managed local endpoint configuration is invalid.");
   }
 
-  const pattern =
-    target === "openai-api"
-      ? /^([ \t]*RELMIO_GATEWAY_TOKEN_SHA256:[ \t]*)[a-f0-9]{64}([ \t]*)$/gmu
-      : /^([ \t]*-[ \t]+--ws-token-sha256[ \t]*\n[ \t]*-[ \t]+)[a-f0-9]{64}([ \t]*)$/gmu;
+  const pattern = target === "openai-api" || target === "codex-chat"
+    ? /^([ \t]*RELMIO_GATEWAY_TOKEN_SHA256:[ \t]*)[a-f0-9]{64}([ \t]*)$/gmu
+    : /^([ \t]*-[ \t]+--ws-token-sha256[ \t]*\n[ \t]*-[ \t]+)[a-f0-9]{64}([ \t]*)$/gmu;
   const matches = [...composeFile.matchAll(pattern)];
   if (matches.length !== 1) {
     throw new Error("The managed local endpoint configuration is invalid.");
@@ -745,30 +753,34 @@ export async function getLocalDockerStatus({
 }
 
 export async function restartLocalCodex(
-  { installDirectory },
+  { installDirectory, target = "codex-chatgpt" },
   dependencies = {},
 ) {
+  const safeTarget = validateLocalTarget(target);
+  if (safeTarget !== "codex-chatgpt" && safeTarget !== "codex-chat") {
+    throw new TypeError("The Codex login target is invalid.");
+  }
   const runProcess = dependencies.runProcess ?? runLocalProcess;
   const releaseLock = dependencies.changeLockHeld === true
     ? async () => {}
     : await acquireLocalProjectLock(
-        { installRoot: installDirectory, target: "codex-chatgpt" },
+        { installRoot: installDirectory, target: safeTarget },
         dependencies,
       );
   try {
   const attested = await attestLocalCodexInstallation(
-    { installDirectory },
+    { installDirectory, target: safeTarget },
     dependencies,
   );
 
   await runOrThrow(runProcess, {
     label: "Codex credential reload",
     file: "docker",
-    args: createComposeArgs("codex-chatgpt", attested.projectName, [
+    args: createComposeArgs(safeTarget, attested.projectName, [
       "restart",
       "--timeout",
       "10",
-      "codex",
+      PROJECTS[safeTarget].serviceName,
     ]),
     cwd: installDirectory,
     dockerHost: attested.dockerHost,
@@ -776,14 +788,14 @@ export async function restartLocalCodex(
   await runOrThrow(runProcess, {
     label: "Codex readiness wait",
     file: "docker",
-    args: createComposeArgs("codex-chatgpt", attested.projectName, [
+    args: createComposeArgs(safeTarget, attested.projectName, [
       "up",
       "-d",
       "--wait",
       "--wait-timeout",
       "90",
       "--no-deps",
-      "codex",
+      PROJECTS[safeTarget].serviceName,
     ]),
     cwd: installDirectory,
     dockerHost: attested.dockerHost,
@@ -1111,7 +1123,7 @@ function parseModelIds(value) {
 }
 
 async function verifyHttpEndpoint({ plan, clientCredential, fetchImpl }) {
-  const healthPath = plan.target === "openai-api" ? "/health" : "/readyz";
+  const healthPath = plan.target === "codex-chatgpt" ? "/readyz" : "/health";
   const httpEndpoint = `http://127.0.0.1:${plan.port}${healthPath}`;
   let health;
   try {
@@ -1126,6 +1138,29 @@ async function verifyHttpEndpoint({ plan, clientCredential, fetchImpl }) {
     throw new Error("The local endpoint did not pass its readiness check.");
   }
 
+  if (plan.target === "codex-chat" && clientCredential !== undefined) {
+    let verification;
+    try {
+      verification = await fetchImpl(
+        `http://127.0.0.1:${plan.port}/auth/verify`,
+        {
+          method: "GET",
+          headers: { Authorization: `Bearer ${clientCredential}` },
+          signal: AbortSignal.timeout(10_000),
+        },
+      );
+    } catch {
+      throw new Error(
+        "The Codex Chat client credential could not be verified.",
+      );
+    }
+    if (!verification.ok) {
+      throw new Error(
+        "The Codex Chat client credential could not be verified.",
+      );
+    }
+  }
+
   if (plan.target !== "openai-api" || clientCredential === undefined) {
     return [];
   }
@@ -1275,6 +1310,13 @@ async function defaultReadGatewaySource() {
   );
 }
 
+async function defaultReadCodexChatSource() {
+  return defaultFileSystem.readFile(
+    new URL("../gateway/codex-chat.js", import.meta.url),
+    "utf8",
+  );
+}
+
 async function attestManagedLocalEndpoint(
   { target, installDirectory, missingMessage, notRunningMessage },
   {
@@ -1334,12 +1376,16 @@ async function attestManagedLocalEndpoint(
 }
 
 export async function attestLocalCodexInstallation(
-  { installDirectory },
+  { installDirectory, target = "codex-chatgpt" },
   dependencies = {},
 ) {
+  const safeTarget = validateLocalTarget(target);
+  if (safeTarget !== "codex-chatgpt" && safeTarget !== "codex-chat") {
+    throw new TypeError("The Codex login target is invalid.");
+  }
   const attested = await attestManagedLocalEndpoint(
     {
-      target: "codex-chatgpt",
+      target: safeTarget,
       installDirectory,
       missingMessage: "Install the local Codex endpoint before signing in.",
       notRunningMessage: "The managed local Codex endpoint is not running.",
@@ -1611,6 +1657,7 @@ export async function installLocalEndpoint(
     randomBytes = createRandomBytes,
     isPortAvailable = isLoopbackPortAvailable,
     readGatewaySource = defaultReadGatewaySource,
+    readCodexChatSource = defaultReadCodexChatSource,
     fetchImpl = fetch,
     verifyCodexCapability = verifyCodexWebSocketCapability,
     platform = process.platform,
@@ -1727,6 +1774,39 @@ export async function installLocalEndpoint(
       gatewaySource,
       0o600,
     );
+  } else if (normalizedPlan.target === "codex-chat") {
+    const gatewaySource = await readCodexChatSource();
+    if (
+      typeof gatewaySource !== "string" ||
+      gatewaySource.length === 0 ||
+      gatewaySource.length > 512 * 1024
+    ) {
+      throw new Error("The packaged Codex Chat runtime is invalid.");
+    }
+    dockerfile = createCodexChatDockerfile();
+    composeFile = createCodexChatComposeFile({
+      port: normalizedPlan.port,
+      tokenSha256,
+      installId,
+    });
+    await writeManagedFile(
+      fileSystem,
+      join(installRoot, "gateway.mjs"),
+      gatewaySource,
+      0o600,
+    );
+    await writeManagedFile(
+      fileSystem,
+      join(installRoot, "config.toml"),
+      createCodexChatConfig(),
+      0o600,
+    );
+    await writeManagedFile(
+      fileSystem,
+      join(installRoot, "requirements.toml"),
+      createCodexChatRequirements(),
+      0o600,
+    );
   } else {
     dockerfile = createCodexDockerfile();
     composeFile = createCodexComposeFile({

package/src/ui/local.html

@@ -92,8 +92,8 @@
         <section class="intro" aria-labelledby="page-title">
           <h1 id="page-title">Run Relmio on localhost</h1>
           <p class="lede">
-            Choose the official credential path that matches your client. Both
-            options run in a hardened Docker container and bind only to
+            Choose the official credential path that matches your client. All
+            three options run in hardened Docker containers and bind only to
             <code>127.0.0.1</code>.
           </p>
         </section>
@@ -200,6 +200,20 @@
                 </span>
               </span>
             </label>
+
+            <label class="target-card warning-card">
+              <input type="radio" name="target" value="codex-chat" />
+              <span class="target-card-copy">
+                <strong>Codex Chat Adapter</strong>
+                <span class="target-meta">Experimental · trusted local backends or development servers only</span>
+                <span>
+                  Relmio-specific authenticated <code>POST /chat</code>, backed by
+                  official Codex App Server and ChatGPT sign-in. This is not an
+                  OpenAI-compatible <code>/v1</code> endpoint and browser bundles
+                  must never connect to it.
+                </span>
+              </span>
+            </label>
           </fieldset>
 
           <div class="field-grid local-fields">
@@ -358,8 +372,8 @@
         </div>
 
         <aside id="codex-install-warning" class="high-trust-warning" hidden>
-          <strong>High-trust capability</strong>
-          <p>
+          <strong id="codex-install-warning-title">High-trust capability</strong>
+          <p id="codex-install-warning-detail">
             Anyone holding the generated client credential can control Codex
             inside its isolated container, act through your signed-in ChatGPT
             session, and may be able to recover that container's ChatGPT session
@@ -445,10 +459,8 @@
         </dl>
 
         <aside id="codex-production-warning" class="high-trust-warning" hidden>
-          <strong>Experimental WebSocket transport</strong>
-          <p>
-            Codex App Server WebSocket is experimental and unsupported for production workloads.
-          </p>
+          <strong id="codex-production-warning-title">Experimental Codex integration</strong>
+          <p id="codex-production-warning-detail"></p>
         </aside>
 
         <section id="codex-login" class="codex-login" aria-labelledby="codex-login-title" hidden>

package/src/ui/local.js

@@ -129,6 +129,14 @@ function readAllowedOrigins() {
     .filter((value) => value !== "");
 }
 
+function isCodexChat(target) {
+  return target === "codex-chat";
+}
+
+function isOpenAiApi(target) {
+  return target === "openai-api";
+}
+
 function invalidatePlan() {
   state.planId = null;
   state.plan = null;
@@ -140,15 +148,24 @@ function renderTarget() {
   state.target = selectedTarget();
   invalidatePlan();
 
-  const isOpenAiApi = state.target === "openai-api";
-  element("local-port").value = isOpenAiApi ? "12435" : "14500";
-  element("origins-field").hidden = !isOpenAiApi;
-  element("target-guidance-title").textContent = isOpenAiApi
+  const openAiApi = isOpenAiApi(state.target);
+  const codexChat = isCodexChat(state.target);
+  element("local-port").value = openAiApi
+    ? "12435"
+    : codexChat
+      ? "14501"
+      : "14500";
+  element("origins-field").hidden = !openAiApi;
+  element("target-guidance-title").textContent = openAiApi
     ? "Uses an OpenAI Platform API key"
-    : "Uses the official Codex ChatGPT sign-in";
-  element("target-guidance-detail").textContent = isOpenAiApi
+    : codexChat
+      ? "Uses official Codex ChatGPT sign-in through the experimental Relmio-specific Chat Adapter"
+      : "Uses the official Codex ChatGPT sign-in";
+  element("target-guidance-detail").textContent = openAiApi
     ? "Your Platform key is seeded over stdin into a private Docker volume and is never returned to the browser. A separate local client credential is generated for your apps."
-    : "This runs Codex App Server as its own experimental protocol. It does not translate the ChatGPT session into a generic OpenAI /v1 API and it does not accept direct browser connections.";
+    : codexChat
+      ? "This exposes Relmio-specific HTTP POST /chat for a trusted local backend or development server. It is not OpenAI /v1, has no CORS, and browser bundles must never connect directly."
+      : "This runs Codex App Server as its own experimental protocol. It does not translate the ChatGPT session into a generic OpenAI /v1 API and it does not accept direct browser connections.";
 }
 
 function appendPolicyNotice(container, heading, detail) {
@@ -160,33 +177,44 @@ function appendPolicyNotice(container, heading, detail) {
 }
 
 function renderPlan(plan) {
-  const isOpenAiApi = plan.target === "openai-api";
+  const openAiApi = isOpenAiApi(plan.target);
+  const codexChat = isCodexChat(plan.target);
   element("review-endpoint").textContent = plan.endpoint;
-  element("review-protocol").textContent = isOpenAiApi
+  element("review-protocol").textContent = openAiApi
     ? "OpenAI-compatible HTTP /v1"
-    : "Codex App Server JSON-RPC over WebSocket";
-  element("review-auth").textContent = isOpenAiApi
+    : codexChat
+      ? "Relmio Codex Chat HTTP: POST /chat"
+      : "Codex App Server JSON-RPC over WebSocket";
+  element("review-auth").textContent = openAiApi
     ? "OpenAI Platform API key"
     : "ChatGPT sign-in through official Codex";
-  element("review-browser").textContent = isOpenAiApi
+  element("review-browser").textContent = openAiApi
     ? plan.allowedOrigins.length > 0
       ? `Only ${plan.allowedOrigins.length} exact allowed origin(s)`
       : "Native clients only until exact origins are added"
-    : "No — trusted native local clients only";
-  element("review-origins-row").hidden = !isOpenAiApi;
-  element("review-origins").textContent = isOpenAiApi
+    : codexChat
+      ? "No — trusted local backends and development servers only"
+      : "No — trusted native local clients only";
+  element("review-origins-row").hidden = !openAiApi;
+  element("review-origins").textContent = openAiApi
     ? plan.allowedOrigins.length > 0
       ? plan.allowedOrigins.join(", ")
       : "None"
     : "";
   element("review-path").textContent = plan.managedPath;
 
-  if (isOpenAiApi) {
+  if (openAiApi) {
     appendPolicyNotice(
       element("review-policy"),
       "OpenAI Platform terms and billing apply",
       "This option sends requests to the OpenAI API with your developer Platform key. ChatGPT subscriptions and open-source program benefits do not turn a ChatGPT credential into an API key.",
     );
+  } else if (codexChat) {
+    appendPolicyNotice(
+      element("review-policy"),
+      "Experimental Codex Chat Adapter — trusted local backends or development servers only",
+      "This option runs a small authenticated Relmio HTTP adapter on loopback. It accepts only POST /chat from a trusted local backend or development server. It has no CORS and is not OpenAI /v1. ChatGPT credentials stay in the isolated Codex Docker volume and never become Platform API keys.",
+    );
   } else {
     appendPolicyNotice(
       element("review-policy"),
@@ -197,18 +225,31 @@ function renderPlan(plan) {
 }
 
 function prepareInstallPanel() {
-  const isOpenAiApi = state.plan.target === "openai-api";
+  const openAiApi = isOpenAiApi(state.plan.target);
+  const codexChat = isCodexChat(state.plan.target);
   const apiKey = element("platform-api-key");
-  element("api-key-field").hidden = !isOpenAiApi;
-  element("codex-install-warning").hidden = isOpenAiApi;
-  apiKey.required = isOpenAiApi;
+  element("api-key-field").hidden = !openAiApi;
+  element("codex-install-warning").hidden = openAiApi;
+  element("codex-install-warning-title").textContent = codexChat
+    ? "Credential for trusted local backends or development servers only"
+    : "High-trust capability";
+  element("codex-install-warning-detail").textContent = codexChat
+    ? "The generated bearer authorizes chat turns through your signed-in Codex container. Keep it only in a trusted local backend or development server; never put it in browser code."
+    : "Anyone holding the generated client credential can control Codex inside its isolated container, act through your signed-in ChatGPT session, and may be able to recover that container's ChatGPT session credential. Treat this capability like your ChatGPT password and give it only to a trusted native local app.";
+  apiKey.required = openAiApi;
   apiKey.value = "";
-  element("install-intro").textContent = isOpenAiApi
+  element("install-intro").textContent = openAiApi
     ? "Enter the OpenAI Platform API key this endpoint will use upstream. It is sent only to this local Relmio process."
-    : "Relmio will install the official Codex App Server first. You will complete ChatGPT device sign-in after the container is ready.";
+    : codexChat
+      ? "Relmio will install the experimental Codex Chat Adapter and official Codex App Server first. You will complete ChatGPT device sign-in after the container is ready."
+      : "Relmio will install the official Codex App Server first. You will complete ChatGPT device sign-in after the container is ready.";
   setButtonLabel(
     element("install-button"),
-    isOpenAiApi ? "Install OpenAI API endpoint" : "Install Codex App Server",
+    openAiApi
+      ? "Install OpenAI API endpoint"
+      : codexChat
+        ? "Install Codex Chat Adapter"
+        : "Install Codex App Server",
   );
 }
 
@@ -216,29 +257,46 @@ function renderInstallResult(result) {
   if (
     typeof result.endpoint !== "string" ||
     typeof result.clientCredential !== "string" ||
-    !["openai-api", "codex-chatgpt"].includes(result.target)
+    !["openai-api", "codex-chatgpt", "codex-chat"].includes(result.target)
   ) {
     throw new Error("The local installer returned an unexpected response.");
   }
 
-  const isOpenAiApi = result.target === "openai-api";
+  const openAiApi = isOpenAiApi(result.target);
+  const codexChat = isCodexChat(result.target);
   state.installedTarget = result.target;
   element("result-endpoint").textContent = result.endpoint;
   element("result-credential").textContent = result.clientCredential;
-  element("codex-production-warning").hidden = isOpenAiApi;
-  element("codex-login").hidden = isOpenAiApi;
-  element("done-title").textContent = isOpenAiApi
+  element("codex-production-warning").hidden = openAiApi;
+  element("codex-login").hidden = openAiApi;
+  element("codex-production-warning-title").textContent = codexChat
+    ? "Experimental Chat Adapter — trusted local backends or development servers only"
+    : "Experimental WebSocket transport";
+  element("codex-production-warning-detail").textContent = codexChat
+    ? "The adapter is for trusted local backends or development servers only. It has a Relmio-specific POST /chat contract, no CORS, and is not OpenAI /v1."
+    : "Codex App Server WebSocket is experimental and unsupported for production workloads.";
+  element("done-title").textContent = openAiApi
     ? "OpenAI API endpoint is ready"
-    : "Codex App Server is installed";
-  element("done-detail").textContent = isOpenAiApi
+    : codexChat
+      ? "Codex Chat Adapter is installed"
+      : "Codex App Server is installed";
+  element("done-detail").textContent = openAiApi
     ? "Copy the endpoint and generated bearer credential into your local app."
-    : "Copy the endpoint and capability, then sign the isolated Codex container in to ChatGPT.";
+    : codexChat
+      ? "Copy the endpoint and generated bearer credential into your trusted local backend or development server, then sign the isolated Codex container in to ChatGPT."
+      : "Copy the endpoint and capability, then sign the isolated Codex container in to ChatGPT.";
   appendPolicyNotice(
     element("client-warning"),
-    isOpenAiApi ? "For local OpenAI-compatible clients" : "For trusted native Codex clients only",
-    isOpenAiApi
+    openAiApi
+      ? "For local OpenAI-compatible clients"
+      : codexChat
+        ? "For trusted local backends or development servers only"
+        : "For trusted native Codex clients only",
+    openAiApi
       ? "Use the generated client credential as the bearer API key. Your upstream Platform key remains private in the managed Docker volume."
-      : "This capability is not an OpenAI API key. Treat it like your ChatGPT password: the client is trusted to control the isolated container and may recover its ChatGPT session credential. It must speak official Codex App Server JSON-RPC over WebSocket.",
+      : codexChat
+        ? "Use this one-time credential only as a Bearer token for the Relmio-specific POST /chat endpoint. It is not an OpenAI API key, has no browser CORS support, and must remain in a trusted local backend or development server."
+        : "This capability is not an OpenAI API key. Treat it like your ChatGPT password: the client is trusted to control the isolated container and may recover its ChatGPT session credential. It must speak official Codex App Server JSON-RPC over WebSocket.",
   );
 }
 
@@ -432,7 +490,9 @@ element("install-button").addEventListener("click", async (event) => {
     setMessage(
       result.target === "openai-api"
         ? "Local OpenAI API endpoint verified. Copy its one-time client credential now."
-        : "Codex App Server verified. Copy its one-time capability and complete ChatGPT sign-in.",
+        : result.target === "codex-chat"
+          ? "Codex Chat Adapter for trusted local backends or development servers verified. Copy its one-time bearer and complete ChatGPT sign-in."
+          : "Codex App Server verified. Copy its one-time capability and complete ChatGPT sign-in.",
     );
   } catch (error) {
     invalidatePlan();
@@ -494,7 +554,7 @@ element("codex-login-button").addEventListener("click", async (event) => {
   try {
     const result = await api("/api/local/codex/login", {
       method: "POST",
-      body: {},
+      body: { target: state.installedTarget },
     });
     const verificationUrl = validateVerificationUrl(result.verificationUrl);
     const userCode = validateDeviceCode(result.userCode);
@@ -504,7 +564,9 @@ element("codex-login-button").addEventListener("click", async (event) => {
     resultBox.hidden = false;
     setMessage("Open the official OpenAI page and enter the displayed device code.");
     await waitForCodexLogin();
-    status.textContent = "ChatGPT sign-in completed. Codex is ready for your trusted native client.";
+    status.textContent = isCodexChat(state.installedTarget)
+      ? "ChatGPT sign-in completed. Codex Chat Adapter is ready for your trusted local backend or development server."
+      : "ChatGPT sign-in completed. Codex is ready for your trusted native client.";
     setMessage("Codex ChatGPT sign-in completed successfully.");
   } catch (error) {
     status.textContent = "ChatGPT sign-in did not complete.";

package/src/web/server.js

@@ -776,6 +776,10 @@ async function handleApi(request, response, path, state) {
       );
     }
 
+    const target = validateLocalTarget(body?.target ?? "codex-chatgpt");
+    if (target !== "codex-chatgpt" && target !== "codex-chat") {
+      throw new Error("Choose a Codex local endpoint before signing in.");
+    }
     state.codexLoginStartInFlight = true;
     let finishStart;
     const startPromise = new Promise((resolvePromise) => {
@@ -802,7 +806,7 @@ async function handleApi(request, response, path, state) {
       }
 
       releaseChangeLock = await state.services.acquireLocalEndpointChangeLock({
-        target: "codex-chatgpt",
+        target,
       });
       if (state.closing) {
         throw Object.assign(new Error("The local wizard is closing."), {
@@ -810,11 +814,12 @@ async function handleApi(request, response, path, state) {
         });
       }
       const installDirectory = await state.services.resolveLocalInstallRoot({
-        target: "codex-chatgpt",
+        target,
       });
       const { dockerHost, projectName } =
         await state.services.attestLocalCodexInstallation({
           installDirectory,
+          ...(target === "codex-chat" ? { target } : {}),
         });
 
       const attempt = await state.services.startCodexDeviceLogin({
@@ -847,7 +852,10 @@ async function handleApi(request, response, path, state) {
             return;
           }
           await state.services.restartLocalCodex(
-            { installDirectory },
+            {
+              installDirectory,
+              ...(target === "codex-chat" ? { target } : {}),
+            },
             { changeLockHeld: true },
           );
           if (state.codexLogin === login && !state.closing) {