patch-cc 0.1.4__tar.gz → 0.2.0__tar.gz

{patch_cc-0.1.4 → patch_cc-0.2.0}/.github/workflows/ci.yml

@@ -11,7 +11,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ["3.11", "3.12", "3.13"]
+        python-version: ["3.11", "3.12", "3.13", "3.14"]
     steps:
       - uses: actions/checkout@v4
 

{patch_cc-0.1.4 → patch_cc-0.2.0}/.gitignore

@@ -20,3 +20,7 @@ build/
 *.patched
 content*.js
 claude-*.bin
+.opencode/
+
+# Build journal, not documentation (see docs/PLAYBOOK.md for the shipped "why")
+CODEX-PLAN.md

patch_cc-0.2.0/AGENTS.md

@@ -0,0 +1,18 @@
+# patch-cc
+
+Interactive patcher for the Claude Code native binary. What it does and how to
+use it: [README.md](README.md).
+
+Before changing anything, read [docs/CONDUCT.md](docs/CONDUCT.md) — how we
+build here: the mindset, the guardrails, and who commits (the user does). Then:
+
+- [docs/PLAYBOOK.md](docs/PLAYBOOK.md) — matcher rules, the patch reference,
+  how to repair a patch after a Claude update, and the map of the bundle's
+  native surfaces (the model registry and its consumers).
+- [docs/INTERNALS.md](docs/INTERNALS.md) — the Bun container format and how
+  the binary is rewritten in place.
+
+Verify with `uv run patch-cc doctor` (every patch against a clean bundle;
+point it at the pristine copies in `~/.local/share/patch-cc/backups/` to sweep
+older builds). There is no test suite by design — doctor against real bundles
+is the check.

patch_cc-0.2.0/CLAUDE.md

@@ -0,0 +1 @@
+AGENTS.md

{patch_cc-0.1.4 → patch_cc-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: patch-cc
-Version: 0.1.4
+Version: 0.2.0
 Summary: Interactive patcher for the Claude Code native binary
 Project-URL: Homepage, https://github.com/anfreire/patch-cc
 Project-URL: Repository, https://github.com/anfreire/patch-cc
@@ -8,7 +8,7 @@ Project-URL: Issues, https://github.com/anfreire/patch-cc/issues
 Author-email: André Freire Ferreira <anfreire.dev@gmail.com>
 License-Expression: MIT
 License-File: LICENSE
-Keywords: bun,claude,claude-code,cli,patch,tui
+Keywords: bun,claude,claude-code,cli,codex,gpt,openai,patch,tui
 Classifier: Development Status :: 3 - Alpha
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -18,6 +18,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
 Classifier: Topic :: Software Development
 Classifier: Topic :: Utilities
 Requires-Python: >=3.11
@@ -52,12 +53,12 @@ uvx patch-cc                   # fullscreen menu, no install needed
 ```
 
 The menu is a single centered panel: move with `↑ ↓`, toggle with `space`,
-press `s` to save. Patches that carry a setting — subagent models, the startup
-name, the `--version` marker — open a centered modal on `enter`, and the row
-then shows what you chose. Everything choosable is a picker: the agent names
-and model aliases are **discovered from your binary itself**, so the menu can
-never offer something your build would reject. Typing exists only for the two
-genuinely free-text values.
+press `s` to save. Patches that carry a setting — subagent models, Codex models,
+the startup name, the `--version` marker — open a centered modal on `enter`, and
+the row then shows what you chose. Everything choosable is a picker: the agent
+names and model aliases are **discovered from your binary itself** (and the
+Codex ones from your plan), so the menu can never offer something your build
+would reject. Typing exists only for the genuinely free-text values.
 
 A patched binary records what was applied inside itself, so the menu always
 comes up showing the real current state, and `patch-cc status` answers
@@ -84,6 +85,7 @@ patch-cc                       # then just run it
 | Chrome | Disable spinner tips | No rotating tips on the spinner |
 | | Custom startup name | Defaults to `<your username>'s Code` |
 | | Mark `--version` | Appends `(patched)` — or any marker you choose |
+| Codex | Codex models | Use OpenAI/Codex-plan models in Claude Code — see [Codex models](#codex-models) |
 
 ## Usage
 
@@ -97,6 +99,7 @@ uvx patch-cc apply --brand                    # + branding as <username>'s Code
 uvx patch-cc apply --brand "Ada's Code"       # + branding, explicit name
 uvx patch-cc apply --model Explore=haiku --model general-purpose=opus
 uvx patch-cc apply --suffix "(mine)"          # custom --version marker
+uvx patch-cc apply --codex gpt-5.6-sol        # + a Codex model (see below)
 uvx patch-cc apply --from-cache               # replay your last remembered selection
 uvx patch-cc status                           # exactly what is applied
 uvx patch-cc doctor                           # do all patches match this build?
@@ -105,8 +108,67 @@ uvx patch-cc list                             # every patch, described
 uvx patch-cc restore                          # put the original back
 ```
 
-`--model` and `--brand` imply their patches; agents and models are validated
-against what your installed binary actually ships.
+`--brand`, `--model` and `--codex` imply their patches; agents and models are
+validated against what your installed binary actually ships, and Codex model ids
+against what your plan offers. `apply --help` lists all three.
+
+## Codex models
+
+Bring your **ChatGPT/Codex-plan** models (GPT-5.x) into Claude Code and use them
+alongside your Claude ones — in the `/model` picker, as a subagent override,
+with `/effort` driving how hard they think. It is two halves: a patch that
+teaches your binary to accept and route the models you pick, and a small
+localhost **gateway** that translates between Claude Code and OpenAI. Only the
+models you pick are diverted — every Anthropic request stays byte-identical,
+so your Claude plan is untouched. Nothing extra to install: the gateway is pure
+Python and ships with patch-cc; you just sign in to a ChatGPT or Codex plan.
+
+```bash
+uvx patch-cc codex login                 # sign in to your ChatGPT/Codex plan
+uvx patch-cc                             # Codex models → pick models → save with `s`
+uvx patch-cc codex serve                 # start the gateway; keep it running
+```
+
+Which models you want is a patch setting like the startup name, so the menu's
+**Codex models** row is where you pick them — it lists what your plan offers,
+live. Everything the menu does the command line does too:
+
+```bash
+uvx patch-cc apply --codex gpt-5.6-sol --codex gpt-5.5
+uvx patch-cc apply --help                # lists the model ids your plan offers
+uvx patch-cc apply --from-cache           # replay your last selection
+```
+
+Then pick a model like any other:
+
+```bash
+claude --model sol                       # shortcut → newest gpt-5.6-sol
+claude --model gpt-5.6-sol               # the full id also works, as does /model
+```
+
+- **Shortcuts** (`sol`, `terra`, `luna`, …) are the last word of the model id;
+  the newest in a family wins, the way `opus` means the latest Claude Opus. They
+  are derived from the ids you picked — there is nothing to configure.
+- **Your binary is the record.** The models and the port live in the patched
+  binary, so `patch-cc status` names exactly what is registered, and
+  `codex serve` finds the right port with nothing to tell it.
+- **They read as native everywhere.** A registered model is added to the
+  binary's own model table, so its real name shows in the status line and the
+  welcome banner, its plan-reported effort levels are declared, and
+  `/advisor sol` works like any other model. Ask for an effort the model
+  doesn't run and the gateway quietly runs the closest lower one — the same
+  clamping Claude Code documents for its own models.
+- **The gateway has to be running.** Every surface that names it says whether it
+  is — the apply report as soon as you bake, `patch-cc status`, and `codex
+  status` — so you never learn it from a request that hangs instead.
+- The gateway holds *your* OpenAI token and listens only on localhost. No
+  Anthropic-model request is ever diverted to it. The Codex ones that *are*
+  still carry Claude Code's own auth header — the gateway ignores it and never
+  forwards it, but treat the port as trusted: whatever binds it first sees it.
+- After a Claude update, **re-bake** — the patch reverts with the binary — but
+  the gateway is separate and keeps running. Until you do, a Codex model you had
+  saved as your default reads as unavailable; the models live in the patch.
+  Change the port and the gateway needs a restart to follow it.
 
 ## After a Claude update
 
@@ -132,6 +194,8 @@ binary is *smaller* than the original (≈113 MB vs 267 MB), not larger.
 
 See [docs/INTERNALS.md](docs/INTERNALS.md) for the container format and
 [docs/PLAYBOOK.md](docs/PLAYBOOK.md) for repairing a patch after an update.
+Changing anything here starts at [docs/CONDUCT.md](docs/CONDUCT.md) — how this
+is built, and what a patch has to prove before it ships.
 
 ## Credits
 
@@ -139,6 +203,9 @@ The patch set is a Python port of
 [a-connoisseur/patch-claude-code](https://github.com/a-connoisseur/patch-claude-code),
 with the subagent-model override idea from
 [aleks-apostle/claude-code-patches](https://github.com/aleks-apostle/claude-code-patches).
+Registering Codex models inside the bundle follows
+[clodex](https://github.com/gxjansen/clodex); the routing here is done in the
+bundle rather than with clodex's TLS interception.
 
 ## License
 

{patch_cc-0.1.4 → patch_cc-0.2.0}/README.md

@@ -24,12 +24,12 @@ uvx patch-cc                   # fullscreen menu, no install needed
 ```
 
 The menu is a single centered panel: move with `↑ ↓`, toggle with `space`,
-press `s` to save. Patches that carry a setting — subagent models, the startup
-name, the `--version` marker — open a centered modal on `enter`, and the row
-then shows what you chose. Everything choosable is a picker: the agent names
-and model aliases are **discovered from your binary itself**, so the menu can
-never offer something your build would reject. Typing exists only for the two
-genuinely free-text values.
+press `s` to save. Patches that carry a setting — subagent models, Codex models,
+the startup name, the `--version` marker — open a centered modal on `enter`, and
+the row then shows what you chose. Everything choosable is a picker: the agent
+names and model aliases are **discovered from your binary itself** (and the
+Codex ones from your plan), so the menu can never offer something your build
+would reject. Typing exists only for the genuinely free-text values.
 
 A patched binary records what was applied inside itself, so the menu always
 comes up showing the real current state, and `patch-cc status` answers
@@ -56,6 +56,7 @@ patch-cc                       # then just run it
 | Chrome | Disable spinner tips | No rotating tips on the spinner |
 | | Custom startup name | Defaults to `<your username>'s Code` |
 | | Mark `--version` | Appends `(patched)` — or any marker you choose |
+| Codex | Codex models | Use OpenAI/Codex-plan models in Claude Code — see [Codex models](#codex-models) |
 
 ## Usage
 
@@ -69,6 +70,7 @@ uvx patch-cc apply --brand                    # + branding as <username>'s Code
 uvx patch-cc apply --brand "Ada's Code"       # + branding, explicit name
 uvx patch-cc apply --model Explore=haiku --model general-purpose=opus
 uvx patch-cc apply --suffix "(mine)"          # custom --version marker
+uvx patch-cc apply --codex gpt-5.6-sol        # + a Codex model (see below)
 uvx patch-cc apply --from-cache               # replay your last remembered selection
 uvx patch-cc status                           # exactly what is applied
 uvx patch-cc doctor                           # do all patches match this build?
@@ -77,8 +79,67 @@ uvx patch-cc list                             # every patch, described
 uvx patch-cc restore                          # put the original back
 ```
 
-`--model` and `--brand` imply their patches; agents and models are validated
-against what your installed binary actually ships.
+`--brand`, `--model` and `--codex` imply their patches; agents and models are
+validated against what your installed binary actually ships, and Codex model ids
+against what your plan offers. `apply --help` lists all three.
+
+## Codex models
+
+Bring your **ChatGPT/Codex-plan** models (GPT-5.x) into Claude Code and use them
+alongside your Claude ones — in the `/model` picker, as a subagent override,
+with `/effort` driving how hard they think. It is two halves: a patch that
+teaches your binary to accept and route the models you pick, and a small
+localhost **gateway** that translates between Claude Code and OpenAI. Only the
+models you pick are diverted — every Anthropic request stays byte-identical,
+so your Claude plan is untouched. Nothing extra to install: the gateway is pure
+Python and ships with patch-cc; you just sign in to a ChatGPT or Codex plan.
+
+```bash
+uvx patch-cc codex login                 # sign in to your ChatGPT/Codex plan
+uvx patch-cc                             # Codex models → pick models → save with `s`
+uvx patch-cc codex serve                 # start the gateway; keep it running
+```
+
+Which models you want is a patch setting like the startup name, so the menu's
+**Codex models** row is where you pick them — it lists what your plan offers,
+live. Everything the menu does the command line does too:
+
+```bash
+uvx patch-cc apply --codex gpt-5.6-sol --codex gpt-5.5
+uvx patch-cc apply --help                # lists the model ids your plan offers
+uvx patch-cc apply --from-cache           # replay your last selection
+```
+
+Then pick a model like any other:
+
+```bash
+claude --model sol                       # shortcut → newest gpt-5.6-sol
+claude --model gpt-5.6-sol               # the full id also works, as does /model
+```
+
+- **Shortcuts** (`sol`, `terra`, `luna`, …) are the last word of the model id;
+  the newest in a family wins, the way `opus` means the latest Claude Opus. They
+  are derived from the ids you picked — there is nothing to configure.
+- **Your binary is the record.** The models and the port live in the patched
+  binary, so `patch-cc status` names exactly what is registered, and
+  `codex serve` finds the right port with nothing to tell it.
+- **They read as native everywhere.** A registered model is added to the
+  binary's own model table, so its real name shows in the status line and the
+  welcome banner, its plan-reported effort levels are declared, and
+  `/advisor sol` works like any other model. Ask for an effort the model
+  doesn't run and the gateway quietly runs the closest lower one — the same
+  clamping Claude Code documents for its own models.
+- **The gateway has to be running.** Every surface that names it says whether it
+  is — the apply report as soon as you bake, `patch-cc status`, and `codex
+  status` — so you never learn it from a request that hangs instead.
+- The gateway holds *your* OpenAI token and listens only on localhost. No
+  Anthropic-model request is ever diverted to it. The Codex ones that *are*
+  still carry Claude Code's own auth header — the gateway ignores it and never
+  forwards it, but treat the port as trusted: whatever binds it first sees it.
+- After a Claude update, **re-bake** — the patch reverts with the binary — but
+  the gateway is separate and keeps running. Until you do, a Codex model you had
+  saved as your default reads as unavailable; the models live in the patch.
+  Change the port and the gateway needs a restart to follow it.
 
 ## After a Claude update
 
@@ -104,6 +165,8 @@ binary is *smaller* than the original (≈113 MB vs 267 MB), not larger.
 
 See [docs/INTERNALS.md](docs/INTERNALS.md) for the container format and
 [docs/PLAYBOOK.md](docs/PLAYBOOK.md) for repairing a patch after an update.
+Changing anything here starts at [docs/CONDUCT.md](docs/CONDUCT.md) — how this
+is built, and what a patch has to prove before it ships.
 
 ## Credits
 
@@ -111,6 +174,9 @@ The patch set is a Python port of
 [a-connoisseur/patch-claude-code](https://github.com/a-connoisseur/patch-claude-code),
 with the subagent-model override idea from
 [aleks-apostle/claude-code-patches](https://github.com/aleks-apostle/claude-code-patches).
+Registering Codex models inside the bundle follows
+[clodex](https://github.com/gxjansen/clodex); the routing here is done in the
+bundle rather than with clodex's TLS interception.
 
 ## License
 

{patch_cc-0.1.4 → patch_cc-0.2.0}/docs/INTERNALS.md

@@ -88,10 +88,12 @@ edit is followed by an ad-hoc `codesign` (mandatory on Apple Silicon).
 
 ## The manifest
 
-Every patched bundle ends with a single comment line:
+Every patched bundle ends with a single comment line — the one description of
+its shape; [PLAYBOOK.md](PLAYBOOK.md) covers what it means for matcher health:
 
 ```
-//patch-cc {"v":1,"tool":"0.1.0","patches":[...],"brand":...,"models":{...}}
+//patch-cc {"v":1,"tool":"<version>","patches":[...],"brand":...,"models":{...},
+            "codex":{"port":8817,"models":["gpt-5.6-sol", ...]}}
 ```
 
 That line is why `patch-cc status` can name exactly what is applied: several
@@ -100,6 +102,18 @@ can't collide with code and travels with the bundle through extract/repack.
 The menu also reads it to pre-select the current patch set — the binary is the
 state.
 
+Every key after `patches` belongs to a patch and is written only when *that*
+patch landed, so `status` can never assert a name, marker, or model the bundle
+does not contain.
+
+Each key records what was *asked for*, never what was derived from it. `codex`
+carries model ids and a port and nothing else: a Codex model's display name and
+context window are already baked into the bundle, and repeating them here would
+be a second copy — one that a relabelling upstream could make disagree with the
+binary it claims to describe. That is also what makes the manifest the single
+home for the gateway port: `codex serve` and `codex status` read it from here
+rather than from a store of their own.
+
 ## Safety
 
 - Before the first patch of a version, the pristine binary is copied to
@@ -112,4 +126,6 @@ state.
 - Every write is verified: patch-cc re-extracts the JS from the binary it just
   wrote and asserts it equals what it meant to write.
 - Patching a binary that is already marked, when no pristine backup exists, is
-  refused unless `--force` — there is nothing clean to start from.
+  refused outright — there is nothing clean to start from, and our edits change
+  lengths, so a second pass would corrupt rather than update. `restore` or a
+  reinstall are the only honest fixes; there is deliberately no override.

{patch_cc-0.1.4 → patch_cc-0.2.0}/docs/PLAYBOOK.md

@@ -43,27 +43,37 @@ Anything the binary can enumerate for us, it does:
   `"Internal` are plumbing and are not offered.
 - **Model aliases** come from the Task tool's own input schema: the
   `model:<zod>.enum([...])` whose describe-string starts
-  `Optional model override` (`agents.discover_models`).
+  `Optional model override` — `agents.MODEL_ENUM`, one compiled anchor because
+  `codex-models` splices the chosen Codex ids into the very group
+  `discover_models` reads back out.
 
 A new upstream agent or model appears in `patch-cc list`, the menu, and
 `--model` validation without a code change. If the enum anchor ever vanishes,
 discovery falls back to `haiku/sonnet/opus` — `doctor` prints both lists, so a
 missing agent or alias is visible at a glance.
 
-## The manifest
-
-Every patched bundle ends with one comment line:
+**The one hardcoded list, and why it may stay one.**
+`models._RESERVED` names Claude's short built-ins so `apply --codex opus` is
+refused, and so a *derived* family shortcut can never take one of those names
+either (a pathological `gpt-5.6-opus` is the only way it could try). It is a
+snapshot, so upstream can outgrow it — and it does not matter, because it is a
+courtesy, not the guard. A name the bundle already knows makes `enum` and
+`validator` find it *present*, so both rewrite nothing; they are `expect=True`,
+so the patch reports broken, the fixpoint drops it, and nothing is written. The
+bundle refuses the collision at bake time, derived rather than remembered.
+Reserving the discovered set instead would buy a friendlier message for a hazard
+that cannot land, at the price of reading a 275 MB binary before argument parsing
+can finish.
 
-```
-//patch-cc {"v":1,"tool":"0.1.0","patches":[...],"brand":...,"models":{...}}
-```
+## The manifest
 
-A comment cannot collide with code, survives re-extraction, and makes `status`
-a parse instead of a guess — several patches are value flips
-(`verbose:!0`) that leave no other fingerprint. `is_patched` also still
-recognises the legacy fingerprints (`__cc_` identifiers, the old `--version`
-marker) so binaries patched by pre-manifest versions are not mistaken for
-clean.
+Every patched bundle ends with one comment line recording what was applied; its
+shape lives in [INTERNALS.md](INTERNALS.md#the-manifest). What matters here is
+that it makes `status` a parse instead of a guess — several patches are value
+flips (`verbose:!0`) that leave no other fingerprint — and that `is_patched`
+also still recognises the legacy fingerprints (`__cc_` identifiers, the old
+`--version` marker), so binaries patched by pre-manifest versions are not
+mistaken for clean.
 
 ## How resilience is detected
 
@@ -308,6 +318,13 @@ anchor, and where it lives.
   definition (discovered as above): rewrite the `model:"..."` literal when the
   definition has one, insert `model:"...",` right after `agentType:"...",`
   when it doesn't. Both splice at offsets from a fresh discovery pass.
+  Every requested override is a **required step**: each one reaching this patch
+  has already been validated against the bundle by whichever surface asked for
+  it, so a pin that cannot be written is not a shape this build lacks — it is
+  the asked-for change failing, and the patch is dropped rather than shipping a
+  manifest that claims it. An override whose target the definition already
+  carries counts as landed: the step is judged on what it achieved, not on
+  whether bytes moved.
   **The bypass:** one helper ignores the definition's model for a single
   pinned agent (Explore today) — shape
   `function f(def,main){if(def.agentType!==X.agentType||def.source!=="built-in")return def.model;…;return g(main)?PIN:"inherit"}`.
@@ -338,6 +355,152 @@ anchor, and where it lives.
   build that pins two agents gets both handled, rewritten last-first so earlier
   offsets stay valid.
 
+### Codex — `codex.py`
+
+- **`codex-models`** — make Claude Code accept and show the chosen Codex models,
+  and divert *only* those models' requests to the localhost gateway.
+  Eight sub-steps; with nothing chosen the patch is a no-op, like
+  `subagent-models`. The ids and the port are ordinary patch configuration
+  (`Options.codex_models` / `codex_port`) — chosen in the menu or with
+  `--codex`/`--codex-port`, never read from a store of the patch's own.
+
+  | step | what it changes | anchor |
+  |---|---|---|
+  | `enum`\* | the Task tool's `model` enum, so a subagent can be pinned to a Codex id | `agents.MODEL_ENUM` — the same anchor `discover_models` reads |
+  | `validator`\* | the known-model array — it gates *resolution*, not just acceptance | `["sonnet","opus","haiku","fable",…,"opusplan",…]` |
+  | `resolver`\* | the override resolver `J9n` | its `case"best":{…}` block |
+  | `general-resolver`\* | the resolver every ordinary request uses, `Ei` | `case"best":return X();default:}` |
+  | `redirect`\* | swaps the request origin to `127.0.0.1:<port>` | the SDK's `buildRequest`, up to `let u=this.buildURL(…)` |
+  | `picker` | the `/model` list | `?[n,r]:[r];for(let i of o)push(e,i,t);` |
+  | `context` | the real context window | the brace-free `(e,t)` body reading `CLAUDE_CODE_MAX_CONTEXT_TOKENS` |
+  | `registry` | the binary's own model table — the status-line name, effort capabilities, `/advisor` eligibility | `],aliases:{` closing the `models:[...]` registry |
+
+  \* required (`expect=True`) — without any one of them the feature is dead.
+  `picker`, `context` and `registry` are refinements: absent, you can still
+  type `/model <id>` and get the 200k default under the model's raw id.
+  `context` has no step at all when no chosen model reports a window — there
+  is no rewrite owed, and reporting that as either a missing shape or a missed
+  rewrite would blame the build for having nothing to do.
+
+  **An id is a model's whole identity.** There is no second name to carry: the id
+  is what `--codex` takes, what the manifest records, what the enum and the
+  picker and the redirect array hold, and what a diverted request already names
+  by the time the gateway sees it. Everything else is derived — the display name
+  and the window from the plan, the shortcut from the id — so nothing downstream
+  keeps a mapping that could disagree with the bundle. That is why the gateway
+  needs only the port, and it is structural rather than a rule to remember:
+  there is no map left to read.
+
+  **The picker's label rule is one rule.** Every row's label is its handle
+  *spelled as a name* — `_display_name` turns `sol` into `Sol` and
+  `gpt-5.6-sol` into `GPT 5.6 Sol` — because the binary's own rows are named,
+  not slugged. Labelling id rows with the raw id instead made them the only
+  entries in the list wearing a different sort of name than their neighbours
+  (`gpt-5.6-sol` sitting under `Opus`). Two label rules is what let that
+  through, so there is one.
+
+  **The registry is the binary's own model table, and the sharpest splice
+  here.** Everything Claude Code knows about a model it did not hardcode a
+  check for lives in one embedded object — `models:[{id, family, display_name,
+  provider_ids, context, capabilities:[...], default_effort, advisor_rank,
+  ...}]` plus the `aliases` map its resolvers read — validated by a zod
+  `safeParse` whose fallback is **empty** (`models:[]`): one malformed entry
+  strips every model, Claude's included, of its metadata. So the step emits
+  only fields the schema declares — the required four (`id`, `family`,
+  `display_name`, `provider_ids.first_party`) plus values with something true
+  to record. `default_effort` is deliberately not among them: the binary
+  resolves a missing default as `high` (`?.default_effort??"high"` — the very
+  default its own flagships declare), so omission makes `/effort auto` and an
+  untouched session mean on these models exactly what they mean on Opus,
+  instead of importing Codex-the-product's own default (`low` on sol). An
+  entry is what turns "accepted" into "first-class": the status line resolves
+  `display_name` through it (raw id without one), `/advisor` eligibility is
+  exactly "has an `advisor_rank`", the effort gates read `capabilities`, and
+  surfaces nobody has enumerated inherit the same answers. `/advisor sol` on a
+  freshly baked binary is the cheap end-to-end check that the entry parsed.
+
+  **What the entry deliberately leaves out.** `pricing` and
+  `max_output_tokens` (readers guard for absence; a subscription has no
+  per-token price; the cap never reaches the wire), `context` (the window
+  resolver ends on a flat 200k without consulting the registry — the `context`
+  step stays the one home for the window), and the `aliases` /
+  `latest_per_family` maps (shortcuts already resolve through the spliced
+  arms; a second mechanism would be a second home — and `latest_per_family`
+  feeds Claude's own system-prompt text). The `/model` picker does not iterate
+  the registry either — its rows are hand-built per family upstream, which is
+  why `picker` exists — and our row push is the same `{value,label,description}`
+  + `.some()` idiom the binary itself uses for `ANTHROPIC_CUSTOM_MODEL_OPTION`.
+
+  **Capabilities can only say yes.** The binary reads an *absent* capability
+  as "ask the provider fallback", which on the first-party API is permissive —
+  upstream's own choice for models it does not know. That is why the `/effort`
+  menu offers the whole ladder on any imported model, and why an entry cannot
+  *hide* a level; hiding would mean splicing the per-level exclusion chains,
+  a new matcher surface bought for a cosmetic win. Which levels a model
+  actually runs is the backend's per-model ruling, refused with a structured
+  400 (`param:"reasoning.effort"`, `code:"invalid_value"`) before any
+  generation — measured: gpt-5.5 runs `xhigh` and refuses `max`. Baking that
+  ruling would be a copy free to go stale between bake and runtime, so the
+  gateway clamps off the refusal itself (`translate.clamp_effort`): one rung
+  down per retry, mirroring Claude Code's documented "highest supported level
+  at or below" rule for its own models. A menu that over-offers costs one
+  extra round-trip, never a dead turn.
+
+  **It runs before `subagent-models`, and that ordering is load-bearing.**
+  `enum` registers the ids in the very schema `discover_models` reads, so a
+  subagent pinned to a Codex model is offered exactly when that model is really
+  in the bundle. Registering *after* meant `subagent-models` had to be told
+  about the ids out of band, so it landed a pin whether or not
+  `codex-models` did: drop `codex-models` for a drifted anchor and the binary
+  kept `model:"gpt-5.6-sol"` on an agent, pointing at a model nothing had
+  registered, with the manifest asserting the override. Now the dropped patch
+  takes its pins down with it.
+
+  **Two resolvers, and why both.** `Ei` is the general one — it turns `opus`
+  into `claude-opus-4-8`, its return value *replaces* the model before the
+  request is built, and it passes an unknown-but-valid name straight through
+  (`return e`). `J9n` runs only when managed `availableModels` are active and
+  defaults to `null`, not passthrough. An id needs neither arm (identity
+  *is* passthrough); a **family shortcut** (`sol` → the newest
+  `gpt-<ver>-sol`) needs one in both, and `Ei`'s is what makes it work on the
+  ordinary path.
+
+  **The shortcut gate.** Shortcuts are registered only when the `Ei` anchor is
+  present. Absent it, none are registered anywhere and the ids — which need none
+  of this — carry on. Accepted-but-unresolved is the failure worth engineering
+  against: it leaves the redirect (which matches ids only), reaches Anthropic as
+  an unknown model, and 404s.
+
+  **Why the "already added?" checks are bounded.** The resolver check matches
+  only the contiguous arms *at the insertion point* (`_RESOLVER_ARMS`), never
+  the whole bundle: a short word like `auto` occurs as `case"auto":return` in
+  stock code, so a global check would skip its arm while the id arms still
+  marked the step applied — a shortcut that resolves nowhere. The picker drops
+  its build-time check for the same reason and leans on the runtime `.some()`
+  guard it injects. `Ei`'s own idempotency is the `default:}` adjacency: it
+  matches the pristine arm only.
+
+  **Routing knows nothing about shortcuts.** The redirect tests `body.model`
+  against the baked id array, and the context table is keyed the same way — by
+  the time either runs, `Ei` has already rewritten the shortcut. Measured on the
+  wire: `claude --model sol` arrives at the gateway as `"gpt-5.6-sol"`. That is
+  why a drift in the shortcuts costs shortcuts and nothing else.
+
+  **A diverted request still carries Claude Code's auth header.** Measured, not
+  assumed: point a listener at the gateway port and a Codex turn arrives with
+  `Authorization: Bearer sk-ant-oat01-…` and the whole prompt. The gateway
+  ignores it and never forwards it, so the exposure is to whatever holds the
+  port. Stripping it from `redirect` does **not** work — don't retry it blind.
+  `options.headers` is the last source `buildHeaders` merges and its merge
+  treats `null` as delete, so setting a null (or an inert value) there ought to
+  win; neither reaches the wire. With the injected block proven to run — a
+  marker spliced into the replacement URL came through in the path — a probe
+  header set on the options object *and* on the local copy was absent from the
+  request both times, so something between `buildRequest` and `fetch` discards
+  `options.headers` on this build. A real fix needs its own anchor further
+  down, in `prepareRequest` (it receives the final `Headers` and the URL): a new
+  required step and new matcher surface, deliberately not taken for 0.2.0.
+
 ### Chrome & branding — `chrome.py`
 
 - **`spinner-tips`** — force spinner tips off. Anchors: `spinnerTipsEnabled===!1`

{patch_cc-0.1.4 → patch_cc-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "patch-cc"
-version = "0.1.4"
+version = "0.2.0"
 description = "Interactive patcher for the Claude Code native binary"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -13,7 +13,7 @@ license-files = ["LICENSE"]
 authors = [
     { name = "André Freire Ferreira", email = "anfreire.dev@gmail.com" },
 ]
-keywords = ["claude", "claude-code", "patch", "bun", "cli", "tui"]
+keywords = ["claude", "claude-code", "codex", "openai", "gpt", "patch", "bun", "cli", "tui"]
 classifiers = [
     "Development Status :: 3 - Alpha",
     "Environment :: Console",
@@ -24,6 +24,7 @@ classifiers = [
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
     "Topic :: Software Development",
     "Topic :: Utilities",
 ]

{patch_cc-0.1.4 → patch_cc-0.2.0}/src/patch_cc/__init__.py

@@ -1,3 +1,3 @@
 """patch-cc: an interactive patcher for the Claude Code native binary."""
 
-__version__ = "0.1.4"
+__version__ = "0.2.0"

{patch_cc-0.1.4 → patch_cc-0.2.0}/src/patch_cc/bun/blob.py

@@ -90,9 +90,14 @@ class Blob:
         return self.payload(self.entry_module().ranges["contents"])
 
     def bytecode_size(self) -> int:
-        return (
-            self.entry_module().ranges["bytecode"][1] if self.struct_size == 52 else 0
-        )
+        """Bytes of precompiled bytecode on the entrypoint, for either layout.
+
+        ``bytecode`` is the fourth pair, so *both* record formats carry it --
+        ``FIELDS_OLD`` is the first four of ``FIELDS_NEW``. Reporting zero for the
+        36-byte layout said "already stripped" about a module that had 154 MB of
+        it, which is the one thing ``status`` reads this for.
+        """
+        return self.entry_module().ranges["bytecode"][1]
 
 
 def _detect_struct_size(modules_len: int) -> int:

{patch_cc-0.1.4 → patch_cc-0.2.0}/src/patch_cc/bun/container.py

@@ -127,3 +127,13 @@ def verify(path: str, expected: str) -> None:
             "patched binary did not round-trip: extracted source differs from "
             f"what we wrote ({len(written.source):,} vs {len(expected):,} bytes)"
         )
+    if written.bytecode_size:
+        # Read back off the written file, not asserted in memory. Bun runs the
+        # bytecode in preference to the source, so any left behind would run the
+        # *unpatched* program while every check above agreed the source was ours
+        # -- every patch a silent no-op. docs/INTERNALS.md calls this the tripwire
+        # for a Bun that makes bytecode authoritative; this is where it trips.
+        raise ContainerError(
+            f"patched binary still carries {written.bytecode_size:,} bytes of "
+            "entrypoint bytecode, which would run instead of our edits"
+        )