Merge pull request #37 from pavelhov/development

release: promote v0.1.5 to main

Author: pavelhov

.github/workflows/cross-platform.yml

@@ -61,8 +61,12 @@ jobs:
         working-directory: gui
         run: bun run test
 
+      - name: Verify Windows account coordination and CLI lifecycle
+        if: matrix.platform == 'windows'
+        run: bun run test:parallel tests/codex-user-identity.test.ts tests/codex-inject-write-lock.test.ts tests/codex-composed-acceptance.test.ts
+
       - name: Test suite
-        run: bun run test
+        run: bun run test:parallel
 
       - name: CLI help smoke
         run: bun run src/cli/index.ts help

app/Sources/MenuBarUITests/main.swift

@@ -1688,9 +1688,16 @@ func runCompanionHeartbeatTests(_ runner: TestRunner) {
         heartbeat.start()
         heartbeat.start()
         heartbeat.start()
+        // Hosted runners may delay the first timer delivery beyond 120ms.
+        // Wait for actual delivery, then measure a fixed window for duplicates.
+        let firstFireDeadline = Date().addingTimeInterval(3)
+        while recorder.count == 0 && Date() < firstFireDeadline {
+            spinMainRunLoop(seconds: 0.01)
+        }
+        runner.expect(recorder.count >= 1, "the repeating timer fires before the deadline")
+        let initialCount = recorder.count
         spinMainRunLoop(seconds: 0.12)
-        let during = recorder.count
-        runner.expect(during >= 1, "the repeating timer fires at least once (got \(during))")
+        let during = recorder.count - initialCount
         // One 20ms timer over 120ms fires ~6 times; stacked duplicates would fire ~18.
         runner.expect(during <= 9, "repeated start() must not duplicate the timer (got \(during))")
         runner.equal(recorder.statuses.first, .enabled, "the sampled status is what gets reported")

docs-site/src/content/docs/guides/codex-app-models.md

@@ -34,6 +34,20 @@ openai-apikey/gpt-5.6-sol           # API key
 
 Fresh installs and configs with no saved mode default to Pool.
 
+## Continuing after a model change
+
+When you switch from a routed model back to OpenAI, the next request uses the newly selected
+model and reasoning effort. For requests with `store: false`, Commander removes lookup IDs
+from unencrypted reasoning summaries carried over in the conversation. This prevents OpenAI
+from trying to retrieve a reasoning item that it never stored. The summaries, messages, and
+tool-call results remain in the replayed history. Proxy-created reasoning envelopes receive
+the same ID repair after their provider-specific payload is removed.
+
+Native OpenAI encrypted history stays unchanged, including across account switches. This repair
+does not guarantee that every backend accepts every prior model's encrypted history, and it does
+not turn storage on or retry a rejected request. It applies to normal Responses requests,
+the WebSocket-to-HTTP bridge, and native compaction.
+
 ## Desktop remote-allowlist limitation
 
 If `codex debug models` and app-server `model/list` contain a routed model but Desktop does not show

docs-site/src/content/docs/guides/codex-integration.md

@@ -147,6 +147,10 @@ $CODEX_HOME/codexcommander-catalog.json
 $CODEX_HOME/models_cache.json
 ```
 
+On Windows, processes using the same Codex home coordinate writes through the effective Windows
+account's LocalAppData directory. Overriding `HOME`, `USERPROFILE`, or `LOCALAPPDATA` in a launcher
+does not move that coordination state; `CODEX_HOME` still selects the Codex files to manage.
+
 On WSL, if `CODEX_HOME` is unset and the Linux `~/.codex/config.toml` is absent, CodexCommander also
 checks for a single Windows Codex Desktop home at `/mnt/c/Users/*/.codex/config.toml`. When exactly
 one candidate exists, it uses that directory so WSL app-server mode and Windows Codex Desktop share

package.json

@@ -1,6 +1,6 @@
 {
   "name": "codexcommander",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "private": true,
   "description": "CodexCommander — universal provider proxy for OpenAI Codex & Claude Code — use any LLM with Codex CLI/App/SDK and Claude Code",
   "type": "module",

src/adapters/openai-responses.ts

@@ -168,16 +168,28 @@ function scrubCodexCommanderCompactionItems(body: unknown): unknown {
   return changed ? { ...body, input } : body;
 }
 
-/** Repair only proxy-created items; native encrypted and readable siblings stay identical. */
+/** Repair proxy envelopes and unstored readable reasoning; native ciphertext stays identical. */
 export function normalizeNativeResponsesHistory(body: unknown): unknown {
   if (!isPlainObject(body) || !Array.isArray(body.input)) return body;
   let changed = false;
   const input = body.input.map(item => {
-    if (!isPlainObject(item) || typeof item.encrypted_content !== "string"
-      || !/^(?:ccx1:|ccxr1:)/.test(item.encrypted_content)) return item;
-    const repaired = sanitizeReasoningInputContent(scrubCodexCommanderCompactionItems({ input: [item] })) as { input: unknown[] };
-    if (repaired.input[0] !== item) changed = true;
-    return repaired.input[0];
+    if (!isPlainObject(item)) return item;
+    const proxyEnvelope = typeof item.encrypted_content === "string"
+      && /^(?:ccx1:|ccxr1:)/.test(item.encrypted_content);
+    // A routed model can emit summary-only reasoning with a proxy-minted rs_ id.
+    // With storage disabled OpenAI cannot resolve that id. Replay the supplied
+    // summary instead, without altering opaque native history or id-only references.
+    const unstoredReasoning = body.store === false && item.type === "reasoning"
+      && !item.encrypted_content && (Array.isArray(item.summary) || Array.isArray(item.content));
+    if (!proxyEnvelope && !unstoredReasoning) return item;
+    const repaired = sanitizeReasoningInputContent(scrubCodexCommanderCompactionItems({ input: [item] })) as { input: Record<string, unknown>[] };
+    let next = repaired.input[0]!;
+    if (next.type === "reasoning" && "id" in next) {
+      next = { ...next };
+      delete next.id;
+    }
+    if (next !== item) changed = true;
+    return next;
   });
   return changed ? { ...body, input } : body;
 }

src/codex/auth-api.ts

@@ -613,6 +613,12 @@ interface PoolQuotaRefreshFlight {
 
 const poolQuotaRefreshInFlight = new Map<string, Set<PoolQuotaRefreshFlight>>();
 const MAX_POOL_QUOTA_FLIGHTS = 16;
+let poolQuotaFlightJoinedForTests: (() => void) | null = null;
+
+/** Observe a real compatible-flight join without changing quota admission. */
+export function setPoolQuotaFlightJoinedForTests(observer: (() => void) | null): void {
+  poolQuotaFlightJoinedForTests = observer;
+}
 
 export class PoolQuotaProbeBusyError extends ResourceAdmissionError {
   constructor() {
@@ -803,7 +809,10 @@ async function fetchPoolAccountQuota(accountId: string, forceRefresh = false, co
       ?? flight.state.startCredentialGeneration;
     return generation !== undefined && isCodexAccountGenerationLive(accountId, generation);
   });
-  if (current) return current.promise;
+  if (current) {
+    poolQuotaFlightJoinedForTests?.();
+    return current.promise;
+  }
   if (poolQuotaFlightCount() >= MAX_POOL_QUOTA_FLIGHTS) throw new PoolQuotaProbeBusyError();
 
   const state: PoolQuotaRefreshFlight["state"] = {

src/codex/user-identity.ts

@@ -48,17 +48,30 @@ function powershellValue(expression: string): string {
       "-NoLogo",
       "-NoProfile",
       "-NonInteractive",
-      "-Command",
-      expression,
+      "-EncodedCommand",
+      Buffer.from(
+        "$ErrorActionPreference = 'Stop'; [Console]::OutputEncoding = [System.Text.Encoding]::UTF8;\n" + expression,
+        "utf16le",
+      ).toString("base64"),
     ], {
       stdin: "ignore",
       stdout: "pipe",
       stderr: "pipe",
+      timeout: 10_000,
     });
   } catch (cause) {
     refuse("Windows effective-account lookup could not start.", cause);
   }
-  if (result.exitCode !== 0) refuse("Windows effective-account lookup failed.");
+  if (result.exitCode !== 0) {
+    // Only this fixed diagnostic grammar may cross the subprocess boundary.
+    // Compiler messages and native errors can contain paths or account details.
+    const diagnostic = new TextDecoder().decode(result.stderr).match(
+      /^CCX_IDENTITY_FAILURE:(compile|token-environment|registered-folder):([A-Za-z0-9_.]{1,80}):([0-9A-F]{8})\r?$/m,
+    );
+    refuse(diagnostic
+      ? `Windows effective-account lookup failed (${diagnostic[1]}, ${diagnostic[2]}, HRESULT 0x${diagnostic[3]}).`
+      : `Windows effective-account lookup failed (exit ${Number.isSafeInteger(result.exitCode) ? result.exitCode : "unknown"}).`);
+  }
   const value = new TextDecoder().decode(result.stdout).trim();
   if (!value) refuse("Windows effective-account lookup returned an empty value.");
   return value;
@@ -143,12 +156,94 @@ function resolvePosixRuntimeRoot(uid: number): string {
 
 function resolveWindowsRuntimeRoot(identity: Extract<UserIdentity, { platform: "win32" }>): string {
   if (!SID_PATTERN.test(identity.sid)) refuse("The coordinator identity contains an invalid SID.");
-  const localAppData = powershellValue(
-    "[Environment]::GetFolderPath([Environment+SpecialFolder]::LocalApplicationData)",
-  );
+  // Shell folder expansion can retain the launcher's ambient USERPROFILE.
+  // Expand the raw registered location against the OS token's environment,
+  // without consulting or mutating this process's environment.
+  const localAppData = powershellValue(String.raw`
+$stage = 'compile'
+try {
+Add-Type -TypeDefinition @'
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Runtime.InteropServices;
+using System.Security.Principal;
+using System.Text.RegularExpressions;
+using Microsoft.Win32;
+public static class CodexCommanderKnownFolders {
+  public static string Stage = "token-environment";
+  [DllImport("userenv.dll", SetLastError = true, ExactSpelling = true)]
+  [return: MarshalAs(UnmanagedType.Bool)]
+  private static extern bool CreateEnvironmentBlock(out IntPtr block, IntPtr token, [MarshalAs(UnmanagedType.Bool)] bool inherit);
+  [DllImport("userenv.dll", ExactSpelling = true)]
+  [return: MarshalAs(UnmanagedType.Bool)]
+  private static extern bool DestroyEnvironmentBlock(IntPtr block);
+  public static string LocalAppData(string expectedSid) {
+    using (WindowsIdentity identity = WindowsIdentity.GetCurrent()) {
+      if (!String.Equals(identity.User.Value, expectedSid, StringComparison.OrdinalIgnoreCase))
+        throw new InvalidOperationException("Effective account changed during environment resolution.");
+      IntPtr block = IntPtr.Zero;
+      try {
+        if (!CreateEnvironmentBlock(out block, identity.Token, false))
+          throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
+        var values = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
+        IntPtr cursor = block;
+        while (Marshal.ReadInt16(cursor) != 0) {
+          string entry = Marshal.PtrToStringUni(cursor);
+          int separator = entry.IndexOf('=');
+          if (separator > 0) values[entry.Substring(0, separator)] = entry.Substring(separator + 1);
+          cursor = IntPtr.Add(cursor, checked((entry.Length + 1) * 2));
+        }
+        Stage = "registered-folder";
+        string path;
+        bool expand;
+        using (RegistryKey users = RegistryKey.OpenBaseKey(RegistryHive.Users, RegistryView.Registry64))
+        using (RegistryKey key = users.OpenSubKey(identity.User.Value + @"\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders")) {
+          if (key == null) throw new InvalidOperationException("Registered folder key is unavailable.");
+          var kind = key.GetValueKind("Local AppData");
+          if (kind != RegistryValueKind.String && kind != RegistryValueKind.ExpandString)
+            throw new InvalidOperationException("Registered folder value is not a string.");
+          expand = kind == RegistryValueKind.ExpandString;
+          path = key.GetValue("Local AppData", null, RegistryValueOptions.DoNotExpandEnvironmentNames) as string;
+        }
+        if (String.IsNullOrWhiteSpace(path)) throw new InvalidOperationException("Registered folder is empty.");
+        var seen = new HashSet<string>(StringComparer.Ordinal);
+        for (int depth = 0; expand && path.IndexOf('%') >= 0; depth++) {
+          if (depth >= 16 || path.Length > 32767 || !seen.Add(path))
+            throw new InvalidOperationException("Registered folder expansion did not converge.");
+          bool replaced = false;
+          path = Regex.Replace(path, @"%([^%]+)%", match => {
+            string value;
+            if (!values.TryGetValue(match.Groups[1].Value, out value))
+              throw new InvalidOperationException("Registered folder references an unavailable variable.");
+            replaced = true;
+            return value;
+          });
+          if (!replaced) throw new InvalidOperationException("Registered folder has an unresolved variable.");
+        }
+        string root = Path.GetPathRoot(path);
+        if (path.Length > 32767 || path.IndexOf('\0') >= 0 || String.IsNullOrEmpty(root) || root.Length < 3 || root.EndsWith(":"))
+          throw new InvalidOperationException("Registered folder is not an absolute path.");
+        return Path.GetFullPath(path);
+      } finally {
+        if (block != IntPtr.Zero) DestroyEnvironmentBlock(block);
+      }
+    }
+  }
+}
+'@
+$stage = 'token-environment'
+[CodexCommanderKnownFolders]::LocalAppData('${identity.sid}')
+} catch {
+  if ($stage -ne 'compile') { $stage = [CodexCommanderKnownFolders]::Stage }
+  $failure = $_.Exception.GetBaseException()
+  [Console]::Error.WriteLine('CCX_IDENTITY_FAILURE:' + $stage + ':' + $failure.GetType().FullName + ':' + $failure.HResult.ToString('X8'))
+  exit 1
+}
+`);
   if (!isAbsolute(localAppData)) refuse("Windows LocalAppData resolution returned a relative path.");
 
-  // The SID and known-folder values come from the effective token/.NET OS APIs,
+  // The SID and registered folder values come from the effective token/registry,
   // never USERPROFILE or LOCALAPPDATA. WP11 adds descriptor/reparse/ACL checks at
   // the stable-database open boundary where those checks can cover SQLite too.
   const root = resolve(localAppData, "CodexCommander", "Runtime", "v1", identity.sid.toUpperCase());

src/lib/service-files.ts

@@ -83,7 +83,8 @@ export function writePrivateServiceFile(path: string, content: string | Uint8Arr
     writeFileSync(temp, content, { encoding, mode, flag: "wx" });
     // Best effort on filesystems that do not support fsync; failure is surfaced
     // rather than silently declaring an on-disk credential durable.
-    const fd = openSync(temp, "r");
+    // Windows requires a writable handle for FlushFileBuffers (fsync).
+    const fd = openSync(temp, "r+");
     try { fsyncSync(fd); } finally { closeSync(fd); }
     if (existing) {
       const now = assertPrivateServiceFile(path);