super-dsh 0.1.10 → 0.1.11

package/agent-codex/dist/codex-native-config.js

@@ -95,9 +95,10 @@ function slugOf(entry) {
  * that we do not already hold, then upserts `models` by slug. Each upserted
  * entry is a CLONE of `template` — an existing entry for the same slug if there
  * is one, else the caller's template, else the first entry either side supplied
- * — with only the identity fields overridden. The other ~35 keys are Codex's
- * and are copied through untouched; see the plan's D5 for why we do not try to
- * synthesize them.
+ * — with identity and declared context window overridden. The other metadata
+ * is copied through except `comp_hash`: this optional opaque compatibility
+ * identifier belongs to the template's model, not an unrelated provider model.
+ * See the plan's D5 for why we do not synthesize the remaining fields.
  */
 export function mergeModelCatalog(existing, absorbed, models, template) {
     // Both sides are a TEMPLATE POOL only — never output. What gets emitted is
@@ -132,6 +133,11 @@ export function mergeModelCatalog(existing, absorbed, models, template) {
             slug: model.id,
             display_name: model.displayName ?? model.id,
         };
+        // A copied OpenAI hash falsely triggers previous-model compaction on
+        // provider switches in Codex 0.160. Our provider model declarations do not
+        // carry verified hashes; remove stale generated values too. Context-limit
+        // compaction and its window/threshold metadata remain unchanged.
+        delete entry["comp_hash"];
         if (model.contextWindow !== undefined) {
             // Codex reads context_window and caps against max_context_window; a stale
             // template value must not silently cap a larger real window.

package/agent-codex/dist/codex-oauth.js

@@ -0,0 +1,153 @@
+/** Native OAuth discovery. Tokens stay in Codex's own home; no network/spawn. */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { readNativeSelection } from './codex-native-config.js';
+import { readProviderStore } from './codex-providers.js';
+export const OPENAI_OAUTH_ID = 'openai-oauth';
+export function hasOpenAiOAuth(codexHome) {
+    try {
+        const value = JSON.parse(readFileSync(join(codexHome, 'auth.json'), 'utf8'));
+        const tokens = value?.tokens;
+        return value?.auth_mode === 'chatgpt' && tokens !== null && typeof tokens === 'object'
+            && [tokens.access_token, tokens.refresh_token].some(token => typeof token === 'string' && token.trim() !== '');
+    }
+    catch {
+        return false;
+    }
+}
+function isRecord(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function nonEmpty(value) {
+    return typeof value === 'string' && value.trim() !== '';
+}
+function oneOf(value, choices) {
+    return typeof value === 'string' && choices.includes(value);
+}
+/**
+ * The non-defaulted ModelInfo fields consumed by Codex, including its required
+ * nested metadata. Keep unknown native fields untouched; never repair or
+ * synthesize a catalog. Source: codex-rs/protocol/src/openai_models.rs (0.154 / 0.160).
+ */
+function usableModel(value) {
+    if (!isRecord(value) || !nonEmpty(value['slug']) || typeof value['display_name'] !== 'string')
+        return false;
+    const reasoning = value['supported_reasoning_levels'];
+    const truncation = value['truncation_policy'];
+    const messages = value['model_messages'];
+    if (typeof value['base_instructions'] !== 'string' && !(isRecord(messages) && typeof messages['instructions_template'] === 'string'))
+        return false;
+    return Array.isArray(reasoning) && reasoning.every(level => isRecord(level) && nonEmpty(level['effort']) && typeof level['description'] === 'string')
+        && oneOf(value['shell_type'], ['unified_exec', 'default', 'local', 'shell_command', 'disabled'])
+        && oneOf(value['visibility'], ['list', 'hide', 'none'])
+        && typeof value['supported_in_api'] === 'boolean'
+        && Number.isSafeInteger(value['priority']) && Number(value['priority']) >= -2147483648 && Number(value['priority']) <= 2147483647
+        && typeof value['support_verbosity'] === 'boolean'
+        && isRecord(truncation) && oneOf(truncation['mode'], ['tokens', 'bytes']) && Number.isSafeInteger(truncation['limit'])
+        && Array.isArray(value['experimental_supported_tools']) && value['experimental_supported_tools'].every(tool => typeof tool === 'string');
+}
+/** One bad entry invalidates the file: Codex deserializes the whole catalog. */
+function officialCatalogModels(codexHome) {
+    try {
+        const cache = JSON.parse(readFileSync(join(codexHome, 'models_cache.json'), 'utf8'));
+        if (!isRecord(cache))
+            return undefined;
+        const models = cache['models'];
+        if (Array.isArray(models) && models.length > 0 && models.every(usableModel))
+            return models;
+    }
+    catch { /* Missing/stale cache must not become a forced catalog override. */ }
+    return undefined;
+}
+/**
+ * Conservatively detect configuration that would leak into an official child
+ * without a cache override. Inspect all tables: a profile can supply a catalog
+ * even when the root has none. Accept indentation, quoted and dotted keys. We
+ * only need to know whether a conflicting override exists, not parse its value.
+ */
+function nativeAssignments(codexHome) {
+    let text;
+    try {
+        text = readFileSync(join(codexHome, 'config.toml'), 'utf8');
+    }
+    catch {
+        return [];
+    }
+    const assignments = [];
+    for (const line of text.split('\n')) {
+        const assignment = /^\s*((?:[\w-]+|"[^"\n]+"|'[^'\n]+')(?:\s*\.\s*(?:[\w-]+|"[^"\n]+"|'[^'\n]+'))*)\s*=\s*(.*)$/.exec(line);
+        if (assignment === null)
+            continue;
+        const key = assignment[1].split(/\s*\.\s*/).at(-1)?.replace(/^["']|["']$/g, '');
+        assignments.push({ key, value: assignment[2] });
+    }
+    return assignments;
+}
+function nativeCatalogConflict(codexHome) {
+    return nativeAssignments(codexHome).some(({ key, value }) => key === 'model_catalog_json' || key === 'profile'
+        || (key === 'model_provider' && !/^(?:"openai"|'openai')\s*(?:#.*)?$/.test(value)));
+}
+/** Official runtime cache only: never consume a third-party custom catalog. */
+export function readOpenAiModels(codexHome) {
+    const models = [];
+    for (const raw of officialCatalogModels(codexHome) ?? []) {
+        if (raw['visibility'] !== 'list')
+            continue;
+        const slug = raw['slug'];
+        if (models.some(model => model.id === slug))
+            continue;
+        const displayName = raw['display_name'];
+        const contextWindow = raw['context_window'];
+        models.push({ id: slug,
+            ...(nonEmpty(displayName) ? { displayName } : {}),
+            ...(Number.isSafeInteger(contextWindow) && Number(contextWindow) > 0 ? { contextWindow: Number(contextWindow) } : {}),
+        });
+    }
+    // A different binary can leave a valid, older catalog in the shared home.
+    // Preserve the user's official configured choice as an identity, without
+    // inventing metadata or claiming that this cache/binary supports that model.
+    if (!nativeCatalogConflict(codexHome)) {
+        const native = readNativeSelection(codexHome);
+        if ((native.providerId === undefined || native.providerId === 'openai') && nonEmpty(native.model)
+            && !models.some(model => model.id === native.model))
+            models.push({ id: native.model });
+    }
+    return models;
+}
+/** Internal catalog shape; disk serialization stores just its native identity. */
+export function openAiOAuthEntry(codexHome) {
+    return { id: OPENAI_OAUTH_ID, label: 'OpenAI OAuth', kind: 'openai-oauth', origin: 'native',
+        baseUrl: '', protocol: 'responses', auth: { kind: 'apiKey', value: '' }, models: readOpenAiModels(codexHome) };
+}
+export function readEffectiveProviderStore(worldHome, codexHome) {
+    const store = readProviderStore(worldHome);
+    const aliasEntries = store.providers.filter(entry => entry.id === OPENAI_OAUTH_ID);
+    const ambiguous = aliasEntries.length > 1;
+    const blocked = store.blockedNativeIds?.includes(OPENAI_OAUTH_ID) === true;
+    return { ...store, providers: store.providers.flatMap(entry => entry.id === OPENAI_OAUTH_ID && ambiguous ? [] : entry.kind === 'openai-oauth'
+            ? !blocked && hasOpenAiOAuth(codexHome) ? [openAiOAuthEntry(codexHome)] : [] : [entry]) };
+}
+/** A usable runtime-owned catalog path, excluding malformed/empty cache files. */
+export function openAiCatalogPath(codexHome) {
+    return officialCatalogModels(codexHome) === undefined ? undefined : join(codexHome, 'models_cache.json');
+}
+/** Do not let an official child inherit a third-party model_catalog_json. */
+export function officialCatalogForLaunch(codexHome) {
+    if (!hasOpenAiOAuth(codexHome))
+        throw new Error('OpenAI OAuth authentication is unavailable; sign in using Codex');
+    if (nativeAssignments(codexHome).some(({ key, value }) => key === 'forced_login_method' && !/^(?:"chatgpt"|'chatgpt')\s*(?:#.*)?$/.test(value))) {
+        throw new Error('OpenAI OAuth cannot use a conflicting forced_login_method; choose ChatGPT login in your Codex configuration');
+    }
+    // A forced catalog is static in Codex and disables version/identity/TTL
+    // refresh. Let the selected binary own discovery when native config is safe;
+    // only override a conflicting native catalog with the validated official one.
+    if (!nativeCatalogConflict(codexHome))
+        return undefined;
+    const catalog = openAiCatalogPath(codexHome);
+    if (catalog !== undefined)
+        return catalog;
+    const native = readNativeSelection(codexHome);
+    if (nativeCatalogConflict(codexHome) || (native.providerId !== undefined && native.providerId !== 'openai'))
+        throw new Error('OpenAI OAuth model cache unavailable; open Codex with the official provider to refresh its models');
+    return undefined;
+}

package/agent-codex/dist/codex-provider-gateway.js

@@ -1,34 +1,3 @@
-/**
- * codex-provider-gateway.ts — the adapter-owned Remote behind the Hub's Codex
- * settings panel (2026-10-03 user ruling; reworked 2026-10-04).
- *
- * Why a Remote and not a hub route: the provider list is ADAPTER config
- * (dev-rules §12), so the adapter owns it and the hub only forwards.
- * `TypertRemoteService` + `@Remote` is the whole mechanism — standard (TC39)
- * method decorators recorded on the class prototype, read back at dispatch time
- * by the gateway's source-claim scan. No codegen, no compiler-injected metadata,
- * which is why a plain `tsc` adapter build can ship one.
- *
- * Wire contract (`superd-hub/src/client/runtime-settings-api.ts` builds each
- * envelope; the hub carrier forwards `envelope.method` verbatim):
- *
- *   request   POST /hub/api?agent=codex
- *             { type:'client-request', rpcId, method:'codexProviders/<op>',
- *               payload: { args: { request?: … } } }
- *   response  { type:'server-response', rpcId, result:{ ok:true, value:<view> } }
- *
- * There is no `select`: which provider a SESSION runs on is DSH's own
- * per-session `model/selection`, chosen from the harness's model selector. This
- * panel is a list editor — add, edit, remove — plus the reconcile with the
- * user's `config.toml` that {@link syncFromNative} performs.
- *
- * The class is a delegation shell on purpose: every operation is a plain
- * function over (worldHome, codexHome), so the entire contract — the key
- * privacy rule, the validation, the sync, the view projection — is pinnable
- * under `node --test` with no Cordis Context and no real home.
- *
- * @module agent-codex/codex-provider-gateway
- */
 var __runInitializers = (this && this.__runInitializers) || function (thisArg, initializers, value) {
     var useValue = arguments.length > 2;
     for (var i = 0; i < initializers.length; i++) {
@@ -63,6 +32,7 @@ var __esDecorate = (this && this.__esDecorate) || function (ctor, descriptorIn,
     if (target) Object.defineProperty(target, contextIn.name, descriptor);
     done = true;
 };
+import { OPENAI_OAUTH_ID, hasOpenAiOAuth, openAiOAuthEntry } from "./codex-oauth.js";
 import { Remote, TypertRemoteService } from "@deepseek-ai/dsh-typert-protocol";
 import { isProviderId, isWireProtocol, providerStorePath, readProviderStore, removeProvider, syncNativeProviders, upsertProvider, writeProviderStore, } from "./codex-providers.js";
 import { providerCatalogDir, readNativeProviders, readNativeSelection, } from "./codex-native-config.js";
@@ -134,6 +104,8 @@ function keyAvailable(codexHome, entry) {
     return nonEmpty(process.env[entry.auth.name]) !== undefined;
 }
 function project(codexHome, entry) {
+    if (entry.kind === "openai-oauth")
+        return { id: entry.id, label: entry.label, protocol: "responses", models: openAiOAuthEntry(codexHome).models, authKind: "oauth", hasKey: hasOpenAiOAuth(codexHome) };
     return {
         id: entry.id,
         label: entry.label,
@@ -172,10 +144,22 @@ export function syncFromNative(worldHome, codexHome) {
     const store = readProviderStore(worldHome);
     const imported = readNativeProviders(codexHome).map(toImport);
     const result = syncNativeProviders(store, imported);
-    if (result.added.length > 0 || result.updated.length > 0) {
-        writeProviderStore(worldHome, result.store);
-    }
-    return result;
+    const legacyAlias = result.store.providers.some(entry => entry.id === OPENAI_OAUTH_ID && entry.kind !== "openai-oauth");
+    const blockedNativeIds = [...new Set([...(result.store.blockedNativeIds ?? []), ...(legacyAlias ? [OPENAI_OAUTH_ID] : [])])];
+    const oauth = hasOpenAiOAuth(codexHome) && !blockedNativeIds.includes(OPENAI_OAUTH_ID);
+    const existed = store.providers.some(entry => entry.kind === "openai-oauth");
+    // Keep collided identities on disk so ambiguous old routes fail closed. They
+    // are quarantined by readEffectiveProviderStore, not silently repurposed.
+    const providers = result.store.providers.flatMap(entry => entry.kind === "openai-oauth"
+        ? legacyAlias || oauth ? [openAiOAuthEntry(codexHome)] : [] : [entry]);
+    if (oauth && !existed)
+        providers.push(openAiOAuthEntry(codexHome));
+    const effective = { ...result.store, providers, ...(blockedNativeIds.length === 0 ? {} : { blockedNativeIds }) };
+    const blockedChanged = JSON.stringify(blockedNativeIds) !== JSON.stringify(store.blockedNativeIds ?? []);
+    const identityChanged = !legacyAlias && oauth !== existed;
+    if (result.added.length > 0 || result.updated.length > 0 || identityChanged || blockedChanged)
+        writeProviderStore(worldHome, effective);
+    return { ...result, store: effective };
 }
 /** The view for one (already loaded) store. */
 function viewOf(worldHome, codexHome, store, syncedAt, note) {
@@ -189,13 +173,19 @@ function viewOf(worldHome, codexHome, store, syncedAt, note) {
     // Only a SEEDED keyed entry defers to auth.json, so only it can be shadowed
     // by a ChatGPT login. An entry holding its own key bypasses the auth manager
     // entirely through the launch's synthetic `env_key`.
-    const deferred = store.providers.some((entry) => entry.auth.kind === "apiKey" && entry.auth.value === "");
+    const deferred = store.providers.some((entry) => entry.kind !== "openai-oauth" && entry.auth.kind === "apiKey" && entry.auth.value === "");
     const shadowed = deferred && chatgptAuthMode(codexHome)
         ? 'Codex is signed in with a ChatGPT account, which takes precedence over a saved API key — a provider that relies on auth.json will not run until you sign out (`codex logout`) or give this provider its own key.'
         : undefined;
-    const combined = [note, shadowed].filter((part) => part !== undefined).join(" ");
+    const nativeAlias = readNativeProviders(codexHome).some(entry => entry.id === OPENAI_OAUTH_ID);
+    const blocked = store.blockedNativeIds?.includes(OPENAI_OAUTH_ID) === true;
+    const duplicate = store.providers.filter(entry => entry.id === OPENAI_OAUTH_ID).length > 1;
+    const collision = blocked || duplicate || (nativeAlias && store.providers.some(entry => entry.kind === "openai-oauth"))
+        ? 'OpenAI OAuth discovery is blocked by an openai-oauth provider ID conflict. Existing third-party routes and keys are preserved. Rename the conflicting native provider table; historical session routes need explicit repair before this ID can be reused.'
+        : undefined;
+    const combined = [note, shadowed, collision].filter((part) => part !== undefined).join(" ");
     return {
-        providers: store.providers.map((entry) => project(codexHome, entry)),
+        providers: store.providers.filter(entry => !(duplicate && entry.id === OPENAI_OAUTH_ID)).map((entry) => project(codexHome, entry)),
         native,
         protocols: PROTOCOL_OPTIONS,
         paths: {
@@ -243,6 +233,8 @@ export function normalizeSaveRequest(request, existing) {
     }
     const raw = request["provider"];
     const id = raw["id"];
+    if (id === OPENAI_OAUTH_ID && (existing === undefined || existing.kind === "openai-oauth"))
+        throw new TypeError("OpenAI OAuth is a reserved native provider; configure authentication in Codex");
     if (!isProviderId(id)) {
         throw new TypeError(`codexProviders/save: id must match /^[a-z0-9][a-z0-9-]*$/ (got ${JSON.stringify(id)})`);
     }
@@ -328,6 +320,8 @@ export function normalizeSaveRequest(request, existing) {
 export function saveProvider(worldHome, codexHome, request, syncedAt) {
     const store = readProviderStore(worldHome);
     const id = isRecord(request) && isRecord(request["provider"]) ? request["provider"]["id"] : undefined;
+    if (store.providers.filter(entry => entry.id === id).length > 1)
+        throw new TypeError("codexProviders/save: duplicate provider ID is ambiguous; explicitly repair the conflicting identities before editing");
     const existing = store.providers.find((entry) => entry.id === id);
     const entry = normalizeSaveRequest(request, existing);
     const next = upsertProvider(store, entry);
@@ -340,6 +334,10 @@ export function removeProviderEntry(worldHome, codexHome, request, syncedAt) {
     if (id === undefined)
         throw new TypeError("codexProviders/remove: id must be a non-empty string");
     const store = readProviderStore(worldHome);
+    if (id === OPENAI_OAUTH_ID && store.providers.some(entry => entry.id === id && entry.kind === "openai-oauth"))
+        throw new TypeError("OpenAI OAuth is a read-only native provider");
+    if (store.providers.filter(entry => entry.id === id).length > 1)
+        throw new TypeError("codexProviders/remove: duplicate provider ID is ambiguous; explicitly repair the conflicting identities before removing");
     const next = removeProvider(store, id);
     writeProviderStore(worldHome, next);
     return viewOf(worldHome, codexHome, next, syncedAt);

package/agent-codex/dist/codex-providers.js

@@ -99,6 +99,9 @@ export function providerEntry(value) {
     if (value === null || typeof value !== "object")
         return undefined;
     const record = value;
+    if (record["kind"] === "openai-oauth" && record["id"] === "openai-oauth") {
+        return { id: "openai-oauth", label: "OpenAI OAuth", kind: "openai-oauth", origin: "native", baseUrl: "", protocol: "responses", auth: { kind: "apiKey", value: "" }, models: [] };
+    }
     const id = record["id"];
     const label = str(record["label"]);
     const baseUrl = str(record["baseUrl"]);
@@ -144,7 +147,9 @@ export function readProviderStore(worldHome) {
     const rawRemoved = record["removed"];
     const removed = (Array.isArray(rawRemoved) ? rawRemoved : [])
         .filter((value) => typeof value === "string" && value.trim() !== "");
-    return { version: 1, providers, ...(removed.length === 0 ? {} : { removed }) };
+    const blockedNativeIds = Array.isArray(record["blockedNativeIds"])
+        ? [...new Set(record["blockedNativeIds"].filter((id) => id === "openai-oauth"))] : [];
+    return { version: 1, providers, ...(removed.length === 0 ? {} : { removed }), ...(blockedNativeIds.length === 0 ? {} : { blockedNativeIds }) };
 }
 /**
  * Persist the store atomically (tmp + rename) and 0600 — the file holds API
@@ -155,7 +160,7 @@ export function writeProviderStore(worldHome, store) {
     const path = providerStorePath(worldHome);
     mkdirSync(dirname(path), { recursive: true });
     const temp = `${path}.tmp-${process.pid}`;
-    writeFileSync(temp, `${JSON.stringify(store, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    writeFileSync(temp, `${JSON.stringify({ ...store, providers: store.providers.map(entry => entry.kind === "openai-oauth" ? { id: entry.id, label: entry.label, kind: entry.kind, origin: "native" } : entry) }, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
     renameSync(temp, path);
 }
 /**
@@ -176,7 +181,8 @@ export function upsertProvider(store, entry) {
     // carry the tombstone forward, and the next sync would keep skipping the
     // endpoint the user just re-added.
     const { removed: _stale, ...rest } = store;
-    return { ...rest, providers, ...(removed.length === 0 ? {} : { removed }) };
+    const blockedNativeIds = [...new Set([...(store.blockedNativeIds ?? []), ...(entry.id === "openai-oauth" && entry.kind !== "openai-oauth" ? [entry.id] : [])])];
+    return { ...rest, providers, ...(removed.length === 0 ? {} : { removed }), ...(blockedNativeIds.length === 0 ? {} : { blockedNativeIds }) };
 }
 /**
  * Drop one provider, and TOMBSTONE its endpoint so the reconcile cannot bring
@@ -193,7 +199,8 @@ export function removeProvider(store, id) {
         return { ...store, providers };
     const key = endpointKey(entry.baseUrl);
     const removed = store.removed?.includes(key) === true ? store.removed : [...store.removed ?? [], key];
-    return { ...store, providers, removed };
+    const blockedNativeIds = [...new Set([...(store.blockedNativeIds ?? []), ...(entry.id === "openai-oauth" && entry.kind !== "openai-oauth" ? [entry.id] : [])])];
+    return { ...store, providers, removed, ...(blockedNativeIds.length === 0 ? {} : { blockedNativeIds }) };
 }
 /**
  * The comparison key for "the same endpoint". Codex itself treats two provider
@@ -330,7 +337,13 @@ export function syncNativeProviders(store, imported) {
         if (store.removed?.includes(key) === true)
             continue;
         const wantedId = incoming.nativeId !== undefined && isProviderId(incoming.nativeId) ? incoming.nativeId : undefined;
-        const at = providers.findIndex((entry) => (wantedId !== undefined && entry.id === wantedId) || endpointKey(entry.baseUrl) === key);
+        // A native identity is not an endpoint table. Never refresh it, rename a
+        // conflicting native table behind the user's back, or select a duplicate id.
+        if (wantedId === "openai-oauth" && (providers.some(entry => entry.id === wantedId && entry.kind === "openai-oauth")
+            || providers.filter(entry => entry.id === wantedId).length > 1))
+            continue;
+        const at = providers.findIndex((entry) => entry.kind !== "openai-oauth" &&
+            ((wantedId !== undefined && entry.id === wantedId) || endpointKey(entry.baseUrl) === key));
         if (at === -1) {
             const id = uniqueProviderId(wantedId ?? providerIdFromEndpoint(baseUrl), providers.map((entry) => entry.id));
             providers.push({
@@ -370,7 +383,7 @@ export function syncNativeProviders(store, imported) {
     }
     const removed = store.removed ?? [];
     const next = removed.length === 0
-        ? { version: 1, providers }
-        : { version: 1, providers, removed };
+        ? { ...store, version: 1, providers }
+        : { ...store, version: 1, providers, removed };
     return { store: next, added, updated };
 }

package/agent-codex/dist/codex-runtime.js

@@ -0,0 +1,120 @@
+/** Resolve an installed Codex runtime at first use, without modifying its home. */
+import { accessSync, constants, realpathSync, statSync } from "node:fs";
+import { createRequire } from "node:module";
+import { homedir } from "node:os";
+import { posix, win32 } from "node:path";
+function readableFile(path) {
+    try {
+        accessSync(path, constants.R_OK);
+        return statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function executable(path) {
+    try {
+        accessSync(path, constants.X_OK);
+        return statSync(path).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function desktopPaths(discovery) {
+    if (discovery.desktopCandidates !== undefined)
+        return discovery.desktopCandidates;
+    const explicit = discovery.env.CODEX_DESKTOP_BIN?.trim();
+    const paths = explicit ? [explicit] : [];
+    if (discovery.platform === "linux") {
+        paths.push("/usr/lib/chatgpt/resources/codex", "/usr/lib/codex/resources/codex", "/opt/Codex/resources/codex", "/opt/codex/resources/codex");
+    }
+    else if (discovery.platform === "darwin") {
+        for (const root of ["/Applications", posix.join(discovery.homeDir, "Applications")]) {
+            for (const app of ["Codex.app", "ChatGPT.app"])
+                paths.push(posix.join(root, app, "Contents/Resources/codex"));
+        }
+    }
+    else if (discovery.platform === "win32") {
+        const local = discovery.env.LOCALAPPDATA;
+        if (local) {
+            for (const app of ["Codex", "ChatGPT"])
+                paths.push(win32.join(local, "Programs", app, "resources", "codex.exe"));
+        }
+    }
+    return paths;
+}
+function isNodeScript(command, discovery) {
+    let target = command;
+    try {
+        target = discovery.realpath(command);
+    }
+    catch {
+        // Explicit nonexistent paths are rejected by the file check below.
+    }
+    return /\.(?:[cm]?js)$/i.test(target);
+}
+export function resolveCodexRuntime(options = {}) {
+    const platform = options.platform ?? process.platform;
+    const env = options.env ?? process.env;
+    const isFile = options.isFile ?? readableFile;
+    const isExecutable = options.isExecutable ?? executable;
+    const path = platform === "win32" ? win32 : posix;
+    const shellWrapper = (command) => platform === "win32" && /\.(?:cmd|bat)$/i.test(command);
+    const discovery = {
+        platform,
+        env,
+        homeDir: options.homeDir ?? homedir(),
+        ...(options.desktopCandidates === undefined ? {} : { desktopCandidates: options.desktopCandidates }),
+        isFile,
+        isExecutable,
+        realpath: options.realpath ?? realpathSync,
+        findCommand: options.findCommand ?? ((name) => {
+            const suffixes = platform === "win32" ? ["", ...(env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";")] : [""];
+            for (const directory of (env.PATH ?? "").split(platform === "win32" ? ";" : ":")) {
+                if (directory === "")
+                    continue;
+                for (const suffix of suffixes) {
+                    const candidate = path.join(directory, `${name}${suffix}`);
+                    if (shellWrapper(candidate))
+                        continue;
+                    if (isFile(candidate) && isExecutable(candidate))
+                        return candidate;
+                }
+            }
+            return undefined;
+        }),
+        resolvePackageEntry: options.resolvePackageEntry ?? (() => createRequire(import.meta.url).resolve("@openai/codex/bin/codex.js")),
+    };
+    const usable = (command) => !shellWrapper(command) && isFile(command) && (isNodeScript(command, discovery) || isExecutable(command));
+    const selected = (command, source) => ({ command, nodeScript: isNodeScript(command, discovery), source });
+    const override = env.CODEX_BIN?.trim();
+    if (override) {
+        const command = /[\\/]/.test(override) ? override : discovery.findCommand(override) ?? override;
+        if (shellWrapper(command))
+            throw new Error(`CODEX_BIN ${override} is a Windows .cmd/.bat shell wrapper. Set CODEX_BIN to the native codex.exe executable or the @openai/codex JavaScript entry instead.`);
+        if (!usable(command))
+            throw new Error(`CODEX_BIN ${override} is not a readable JavaScript entry or executable Codex runtime. Fix CODEX_BIN or remove the override.`);
+        return selected(command, "override");
+    }
+    for (const candidate of desktopPaths(discovery)) {
+        if (!shellWrapper(candidate) && isFile(candidate) && isExecutable(candidate))
+            return selected(candidate, "desktop");
+    }
+    const cli = discovery.findCommand("codex");
+    if (cli !== undefined && usable(cli))
+        return selected(cli, "cli");
+    try {
+        const entry = discovery.resolvePackageEntry();
+        if (isFile(entry))
+            return { command: entry, nodeScript: true, source: "package" };
+    }
+    catch {
+        // Installation fallback only; authentication/generation never reaches here.
+    }
+    throw new Error("cannot locate a Codex runtime: install Codex desktop or a user CLI on PATH, restore the exact-pin @openai/codex package, or set CODEX_BIN to its executable or JavaScript entry.");
+}
+/** Compatibility interface for callers that need only the selected path. */
+export function resolveCodexCommand(options = {}) {
+    return resolveCodexRuntime(options).command;
+}

package/agent-codex/dist/index.js

@@ -1,3 +1,4 @@
+import { OPENAI_OAUTH_ID, readEffectiveProviderStore } from "./codex-oauth.js";
 /**
  * agent-codex provider — Codex provider plugin for DeepSeek Harness
  * (Super D, app-server line).
@@ -29,7 +30,6 @@ import { CodexLlmAdapter, routeIds } from "./adapter.js";
 import { registerCodexPreset } from "./agent-preset-codex.js";
 import { readRolloutHead, resolveCodexHome } from "./codex-store.js";
 import { CodexProvidersGateway, syncFromNative } from "./codex-provider-gateway.js";
-import { readProviderStore } from "./codex-providers.js";
 import { readNativeSelection } from "./codex-native-config.js";
 import { seedRoute } from "./codex-route.js";
 import { providerLaunch } from "./codex-launch.js";
@@ -159,12 +159,12 @@ export class CodexProvider extends Service {
      */
     syncNow() {
         try {
-            const { store, added, updated } = syncFromNative(this.home, resolveCodexHome());
+            const { added, updated } = syncFromNative(this.home, resolveCodexHome());
             if (added.length > 0 || updated.length > 0) {
                 this.runtime.ctx.logger.info(`codex-provider: config.toml sync — added ${added.join(", ") || "none"}, refreshed ${updated.join(", ") || "none"}`);
             }
             this.syncedAt = Date.now();
-            this.#applyRoutes(store.providers);
+            this.#applyRoutes(readEffectiveProviderStore(this.home, resolveCodexHome()).providers);
         }
         catch (error) {
             this.runtime.ctx.logger.warn(`codex-provider: provider sync failed: ${String(error)}`);
@@ -173,7 +173,7 @@ export class CodexProvider extends Service {
     /** Re-register the `ctx.llm` routes from the current store (panel mutation path). */
     refreshRoutes() {
         try {
-            this.#applyRoutes(readProviderStore(this.home).providers);
+            this.#applyRoutes(readEffectiveProviderStore(this.home, resolveCodexHome()).providers);
         }
         catch (error) {
             this.runtime.ctx.logger.warn(`codex-provider: route refresh failed: ${String(error)}`);
@@ -188,14 +188,14 @@ export class CodexProvider extends Service {
     nativeProviderId() {
         const native = readNativeSelection(resolveCodexHome());
         const wanted = native.providerId;
-        if (wanted === undefined)
-            return undefined;
-        const providers = readProviderStore(this.home).providers;
-        return providers.find((entry) => entry.id === wanted)?.id ?? undefined;
+        if (wanted === undefined || wanted === "openai")
+            return readEffectiveProviderStore(this.home, resolveCodexHome()).providers.some(entry => entry.kind === "openai-oauth") ? OPENAI_OAUTH_ID : undefined;
+        const providers = readEffectiveProviderStore(this.home, resolveCodexHome()).providers;
+        return providers.find((entry) => entry.kind !== "openai-oauth" && entry.id === wanted)?.id ?? undefined;
     }
     /** The store entry a DSH route id names. */
     providerEntry(providerId) {
-        return readProviderStore(this.home).providers.find((entry) => entry.id === providerId);
+        return readEffectiveProviderStore(this.home, resolveCodexHome()).providers.find((entry) => entry.id === providerId);
     }
     /**
      * The factory's session-level route fallback — always ONE coherent pair.
@@ -217,8 +217,13 @@ export class CodexProvider extends Service {
     sessionAgentOptions(requested) {
         const native = readNativeSelection(resolveCodexHome());
         const wanted = requested?.provider !== undefined && typeof requested.model === "string" ? requested : undefined;
+        const requestedEntry = wanted === undefined ? undefined : this.providerEntry(wanted.provider);
+        // An explicitly selected native identity must survive unavailable auth or
+        // metadata. Its launch fails honestly instead of seeding a third-party route.
+        if (wanted?.provider === OPENAI_OAUTH_ID && (requestedEntry === undefined || requestedEntry.kind === "openai-oauth"))
+            return { ...wanted };
         const serves = wanted !== undefined
-            && this.providerEntry(wanted.provider)?.models.some((model) => model.id === wanted.model) === true;
+            && requestedEntry?.models.some((model) => model.id === wanted.model) === true;
         if (wanted !== undefined && serves)
             return { ...wanted, provider: wanted.provider, model: wanted.model };
         const provider = this.nativeProviderId();
@@ -274,6 +279,8 @@ export class CodexProvider extends Service {
             // the user's home (the per-provider model catalog is ours).
             launchFor: (providerId) => {
                 const entry = this.providerEntry(providerId);
+                if (entry === undefined && providerId === OPENAI_OAUTH_ID)
+                    throw new Error("OpenAI OAuth authentication is unavailable; sign in using Codex");
                 return entry === undefined ? undefined : providerLaunch(this.home, codexHome, entry);
             },
             contextWindowFor: (providerId, model) => {
@@ -379,7 +386,7 @@ export class CodexProvider extends Service {
      * picker would be noise.
      */
     #registerModelCatalog() {
-        this.#applyRoutes(readProviderStore(this.home).providers);
+        this.#applyRoutes(readEffectiveProviderStore(this.home, resolveCodexHome()).providers);
     }
     /** Register or atomically re-point the codex routes at the given providers. */
     #applyRoutes(providers) {

package/agent-codex/package.json

@@ -22,7 +22,7 @@
     "test": "node --test test/*.test.mjs"
   },
   "dependencies": {
-    "@openai/codex": "0.154.0",
+    "@openai/codex": "0.160.0",
     "zod": "4.4.3"
   },
   "peerDependencies": {

package/agent-codex-sdk/dist/adapter.js

@@ -1,3 +1,5 @@
+import { readEffectiveProviderStore } from "./codex-oauth.js";
+import { resolveCodexHome } from "./codex-store.js";
 /**
  * Codex-backed `LlmAdapter` registered on `ctx.llm` by the Codex provider.
  *
@@ -23,7 +25,6 @@
  * @module agent-codex/adapter
  */
 import { LlmAdapter, LlmError, } from "@deepseek-ai/dsh-llm";
-import { readProviderStore } from "./codex-providers.js";
 /**
  * The single route every Codex model was served under before the multi-provider
  * rework. No longer registered (a session pinned to it falls back to whatever
@@ -41,7 +42,7 @@ export function routeIds(store) {
 }
 /** The provider entry a route id names, or `undefined`. */
 export function providerFor(worldHome, providerId) {
-    return readProviderStore(worldHome).providers.find((entry) => entry.id === providerId);
+    return readEffectiveProviderStore(worldHome, resolveCodexHome()).providers.find((entry) => entry.id === providerId);
 }
 export class CodexLlmAdapter extends LlmAdapter {
     worldHome;