codex

#!/usr/bin/env bash
# codex — wrapper for Codex CLI against the apro LiteLLM proxy.
#
# Mirrors ~/.local/share/claude-wrapper/claude: it sources the SAME remote
# claude-env.sh (reusing its get_api_key/1Password caching and detect_github_repo)
# so the key and per-repo attribution stay identical to Claude Code. On top of
# that it does the two codex-specific things:
#   1. ensures the local TLS-1.3 shim (litellm_shim.py) is running, because
#      Codex's bundled TLS stack can't reach the proxy directly;
#   2. exports LITELLM_API_KEY + CODEX_GITHUB_REPO for config.toml.
#
# Update:  rm ~/.cache/claude/env-remote.sh    (forces remote-config refetch)
# Debug:   CLAUDE_DEBUG=1 codex
set -euo pipefail

# ── Codex-specific config ────────────────────────────────────────────────────
SHIM_SCRIPT="$HOME/.codex/litellm_shim.py"
SHIM_PYTHON="${SHIM_PYTHON:-/opt/homebrew/bin/python3}"
SHIM_PORT="${SHIM_PORT:-8787}"

# ── Portable realpath (macOS lacks readlink -f) ─────────────────────────────
_realpath() {
  local p="$1"
  while [[ -L "$p" ]]; do
    local dir
    dir="$(cd -P "$(dirname "$p")" && pwd)"
    p="$(readlink "$p")"
    [[ "$p" != /* ]] && p="$dir/$p"
  done
  cd -P "$(dirname "$p")" && echo "$(pwd)/$(basename "$p")"
}

# ── Find the real codex binary on PATH (skip this wrapper) ───────────────────
_find_real_codex() {
  local self
  self="$(_realpath "$0")"
  local IFS=:
  for dir in $PATH; do
    local candidate="$dir/codex"
    [[ -x "$candidate" ]] || continue
    [[ "$(_realpath "$candidate")" == "$self" ]] && continue
    echo "$candidate"
    return
  done
  return 1
}
CODEX_BIN="${CODEX_REAL_BIN:-$(_find_real_codex || true)}"
[[ -z "$CODEX_BIN" ]] && CODEX_BIN="/opt/homebrew/bin/codex"

# ── Ensure the TLS-1.3 shim is listening ─────────────────────────────────────
_port_open() { (exec 3<>"/dev/tcp/127.0.0.1/$SHIM_PORT") 2>/dev/null; }
ensure_shim() {
  _port_open && return
  if [[ ! -x "$SHIM_PYTHON" ]]; then
    echo "ERROR: $SHIM_PYTHON not found — need a TLS 1.3 Python (brew install python)" >&2
    exit 1
  fi
  nohup "$SHIM_PYTHON" "$SHIM_SCRIPT" >"${XDG_CACHE_HOME:-$HOME/.cache}/codex-shim.log" 2>&1 &
  disown || true
  for _ in $(seq 1 30); do _port_open && return; sleep 0.1; done
  echo "ERROR: shim did not come up on 127.0.0.1:$SHIM_PORT" >&2
  exit 1
}

# ── Reuse the claude wrapper's remote env (key + repo detection) ─────────────
# Skip entirely if both values are already provided (override / fast path).
if [[ -z "${LITELLM_API_KEY:-}" || -z "${CODEX_GITHUB_REPO:-}" ]]; then
  CLAUDE_ENV_REMOTE_URL="${CLAUDE_ENV_URL:-https://raw.githubusercontent.com/aproorg/claude-wrapper/main/claude-env.sh}"
  _CACHE_DIR="${XDG_CACHE_HOME:-$HOME/.cache}/claude"
  _CACHE_FILE="$_CACHE_DIR/env-remote.sh"
  _UPDATE_TTL="${CLAUDE_ENV_UPDATE_TTL:-300}"

  _needs_update() {
    [[ ! -f "$_CACHE_FILE" ]] && return 0
    local age
    age=$(($(date +%s) - $(stat -f %m "$_CACHE_FILE" 2>/dev/null || stat -c %Y "$_CACHE_FILE" 2>/dev/null || echo 0)))
    [[ $age -ge $_UPDATE_TTL ]]
  }

  if _needs_update; then
    (umask 077; mkdir -p "$_CACHE_DIR")
    tmp="$_CACHE_FILE.tmp.$$"
    if (umask 077; curl -fsSL --connect-timeout 3 --max-time 10 "$CLAUDE_ENV_REMOTE_URL" -o "$tmp") 2>/dev/null; then
      if grep -qE '(rm\s+-rf\s+/|curl.*\|\s*(ba)?sh|eval\s)' "$tmp" 2>/dev/null; then
        echo "ERROR: Remote config failed integrity check — refusing to source" >&2
        rm -f "$tmp"; exit 1
      fi
      mv "$tmp" "$_CACHE_FILE"
    else
      rm -f "$tmp"
      [[ ! -f "$_CACHE_FILE" ]] && { echo "ERROR: cannot fetch $CLAUDE_ENV_REMOTE_URL (no cache)" >&2; exit 1; }
    fi
  fi

  # shellcheck disable=SC1090
  source "$_CACHE_FILE"   # defines get_api_key/detect_github_repo, exports ANTHROPIC_AUTH_TOKEN

  : "${LITELLM_API_KEY:=${ANTHROPIC_AUTH_TOKEN:-}}"
  : "${CODEX_GITHUB_REPO:=$(detect_github_repo 2>/dev/null || true)}"
fi

: "${CODEX_GITHUB_REPO:=aproorg/code}"   # final fallback (e.g. non-git dir)
export CODEX_GITHUB_REPO

if [[ -z "${LITELLM_API_KEY:-}" ]]; then
  echo "ERROR: no LITELLM_API_KEY (1Password fetch failed). Try: op signin --account aproorg.1password.eu" >&2
  exit 1
fi
export LITELLM_API_KEY

ensure_shim
exec "$CODEX_BIN" "$@"