Merge dev into main

Author: lidge-jun

README.ko.md

@@ -202,15 +202,15 @@ ocx login <xai|anthropic|kimi> # OAuth 로그인
 ocx logout <provider>          # 저장된 로그인 정보 삭제
 ocx gui                        # 웹 대시보드 열기
 ocx codex-shim install         # codex 실행 시 `ocx ensure` 실행
-ocx service <install|start|stop|status|uninstall>   # 백그라운드 서비스 (launchd/systemd/schtasks)
+ocx service [install|start|stop|status|uninstall]   # 백그라운드 서비스 설치/갱신/시작
 ocx update [--tag preview]     # opencodex 업데이트; preview 설치는 @preview 유지
 ```
 
 ### 자동 시작: service vs shim
 
 opencodex에는 프록시를 자동 시작하는 두 가지 방법이 있습니다:
 
-| | `ocx service install` | `ocx codex-shim install` |
+| | `ocx service` / `ocx service install` | `ocx codex-shim install` |
 |---|---|---|
 | **방식** | OS 서비스 관리자 (launchd / systemd / schtasks) | `codex` 스크립트 런처를 래핑하며 실제 `codex.exe`는 건드리지 않음 |
 | **시점** | 로그인 후 항상 실행 | 온디맨드 — `codex` 실행 시 `ocx ensure` 실행 |

README.md

@@ -186,7 +186,7 @@ next Codex session. opencodex keeps two separate behaviors:
 | Kimi (Moonshot) | `openai-chat` | oauth / key |
 | Google Gemini | `google` | key |
 | Azure OpenAI | `azure-openai` | key |
-| Cursor (experimental) | `cursor` | dashboard/local config; live transport + native exec |
+| Cursor (experimental) | `cursor` | dashboard/local config; live transport; unsafe native local exec is opt-in |
 | Ollama Cloud + 17-provider catalog | `openai-chat` | key |
 | Ollama / vLLM / LM Studio (local) | `openai-chat` | key (usually blank) |
 | Any OpenAI-compatible endpoint | `openai-chat` | key |
@@ -195,11 +195,14 @@ Plus DeepSeek, Groq, OpenRouter, Together, Fireworks, Cerebras, Mistral, Hugging
 
 Cursor support is a staged experimental bridge: it appears in `ocx init` and the dashboard Add
 Provider picker as a local config with Cursor's static public model catalog. Live
-HTTP/2 transport is enabled when a Cursor access token is configured, and Cursor native
-read/write/delete/ls/grep/shell/fetch requests are handled by opencodex. MCP, screen recording,
-and computer-use are exposed through executor hooks; when no local executor is configured,
-opencodex returns typed no-executor results instead of policy-blocking the request. Cursor OAuth
-and live model discovery remain separate future phases.
+HTTP/2 transport is enabled when a Cursor access token is configured. Cursor server-driven native
+read/write/delete/ls/grep/shell/fetch execution is disabled by default because it bypasses Codex's
+approval and sandbox path; set `unsafeAllowNativeLocalExec: true` only for trusted local
+experiments. The older `allowNativeLocalExec` spelling is accepted as a deprecated transition
+alias.
+MCP, screen recording, and computer-use are exposed through executor hooks; when no local executor
+is configured, opencodex returns typed no-executor results instead of policy-blocking the request.
+Cursor OAuth and live model discovery are enabled for the experimental Cursor adapter.
 
 ## CLI
 
@@ -213,18 +216,18 @@ ocx ensure                     # start if needed + refresh Codex config/cache
 ocx sync                       # refresh models + re-inject into Codex
 ocx codex-shim install         # run `ocx ensure` whenever `codex` is launched
 ocx status                     # is the proxy running?
-ocx login <xai|anthropic|kimi> # OAuth login
+ocx login <provider>          # OAuth login (xai, anthropic, kimi, cursor, ...)
 ocx logout <provider>          # remove a stored login
 ocx gui                        # open the web dashboard
-ocx service <install|start|stop|status|uninstall>   # background service (launchd/systemd/schtasks)
+ocx service [install|start|stop|status|uninstall]   # install/update/start background service
 ocx update [--tag preview]     # update opencodex; preview installs stay on @preview
 ```
 
 ### Autostart: service vs shim
 
 opencodex has two ways to auto-start the proxy:
 
-| | `ocx service install` | `ocx codex-shim install` |
+| | `ocx service` / `ocx service install` | `ocx codex-shim install` |
 |---|---|---|
 | **How** | OS service manager (launchd / systemd / schtasks) | Wraps script launchers for `codex`; real `codex.exe` is left untouched |
 | **When** | Always running after login | On-demand — runs `ocx ensure` when `codex` is launched |

README.zh-CN.md

@@ -197,15 +197,15 @@ ocx login <xai|anthropic|kimi> # OAuth 登录
 ocx logout <provider>          # 移除已保存的登录
 ocx gui                        # 打开 Web 仪表盘
 ocx codex-shim install         # 运行 codex 时自动启动代理
-ocx service <install|start|stop|status|uninstall>   # 后台服务（launchd/systemd/schtasks）
+ocx service [install|start|stop|status|uninstall]   # 安装/更新/启动后台服务
 ocx update [--tag preview]     # 更新 opencodex；preview 安装保持 @preview
 ```
 
 ### 自动启动：service vs shim
 
 opencodex 提供两种自动启动代理的方式：
 
-| | `ocx service install` | `ocx codex-shim install` |
+| | `ocx service` / `ocx service install` | `ocx codex-shim install` |
 |---|---|---|
 | **方式** | OS 服务管理器（launchd / systemd / schtasks） | 包装 `codex` 脚本启动器；不会改动真实 `codex.exe` |
 | **时机** | 登录后始终运行 | 按需 — 仅在运行 `codex` 时启动 |

docs-site/src/content/docs/guides/codex-integration.md

@@ -49,6 +49,11 @@ $CODEX_HOME/opencodex-catalog.json
 $CODEX_HOME/models_cache.json
 ```
 
+On WSL, if `CODEX_HOME` is unset and the Linux `~/.codex/config.toml` is absent, opencodex also
+checks for a single Windows Codex Desktop home at `/mnt/c/Users/*/.codex/config.toml`. When exactly
+one candidate exists, it uses that directory so WSL app-server mode and Windows Codex Desktop share
+the same config and auth files. Set `CODEX_HOME` explicitly to override this detection.
+
 `requires_openai_auth = true` keeps Codex App/TUI account-gated surfaces aligned with native Codex.
 WebSocket transport is different: opencodex serves `/v1/responses` over WebSocket, but only advertises
 `supports_websockets = true` when `"websockets": true` is set in `~/.opencodex/config.json`.

docs-site/src/content/docs/guides/providers.md

@@ -97,11 +97,14 @@ Gateway** needs your account + gateway ids filled into the URL.
 Cursor is tracked separately as an experimental adapter. `adapter: "cursor"` appears in `ocx init`
 and the dashboard Add Provider picker as an experimental local config entry with Cursor's static
 public model catalog metadata. When a Cursor access token is configured, opencodex uses Cursor's
-live HTTP/2 transport and handles native read/write/delete/ls/grep/shell/fetch requests locally.
-MCP, screen recording, and computer-use are available as executor hooks; without a configured local
-executor, opencodex returns typed no-executor results instead of policy-blocking the request. Cursor
-OAuth and live model discovery remain separate future phases; Cursor is still not shown in key-login
-or OAuth login lists.
+live HTTP/2 transport. Cursor server-driven native read/write/delete/ls/grep/shell/fetch execution
+is disabled by default because it bypasses Codex's approval and sandbox path; set
+`unsafeAllowNativeLocalExec: true` only for trusted local experiments. The older
+`allowNativeLocalExec` spelling is accepted as a deprecated transition alias. MCP, screen recording,
+and computer-use are available as executor hooks; without a configured local executor, opencodex
+returns typed no-executor results instead of policy-blocking the request. Cursor OAuth and live
+model discovery are enabled for this experimental adapter; Cursor is still not shown in key-login
+lists.
 :::
 
 ### Ollama Cloud

docs-site/src/content/docs/ko/guides/codex-integration.md

@@ -48,6 +48,11 @@ $CODEX_HOME/opencodex-catalog.json
 $CODEX_HOME/models_cache.json
 ```
 
+WSL에서는 `CODEX_HOME`이 없고 Linux 쪽 `~/.codex/config.toml`도 없을 때
+`/mnt/c/Users/*/.codex/config.toml` 아래의 Windows Codex Desktop home을 확인합니다. 후보가
+정확히 하나면 그 디렉터리를 사용하므로 WSL app-server mode와 Windows Codex Desktop이 같은 config와
+auth 파일을 공유합니다. 이 탐지를 덮어쓰려면 `CODEX_HOME`을 명시하세요.
+
 `requires_openai_auth = true`는 Codex App/TUI의 계정 게이트 UI가 네이티브 Codex와 같은 조건으로 동작하게 합니다.
 WebSocket 전송은 별도입니다. opencodex는 `/v1/responses` WebSocket 엔드포인트를 제공하지만,
 `~/.opencodex/config.json`에서 `"websockets": true`일 때만 `supports_websockets = true`를 광고합니다.

docs-site/src/content/docs/ko/guides/providers.md

@@ -97,10 +97,13 @@ Gateway**는 URL에 계정 + 게이트웨이 id를 채워야 합니다.
 Cursor는 별도의 실험적 어댑터로 추적합니다. `adapter: "cursor"`는 `ocx init`과 dashboard Add
 Provider picker에 실험적 local config 항목으로 표시되며, Cursor의 static public model catalog
 metadata를 저장합니다. Cursor access token이 설정되면 opencodex는 Cursor live HTTP/2 transport를
-사용하고 native read/write/delete/ls/grep/shell/fetch 요청을 로컬에서 처리합니다. MCP, 화면 녹화,
-computer-use는 executor hook으로 열려 있으며, 로컬 executor가 없으면 정책 차단이 아니라 typed
-no-executor 결과를 반환합니다. Cursor OAuth와 live model discovery는 별도 후속 단계이며, Cursor는
-여전히 key-login 또는 OAuth login 목록에는 표시되지 않습니다.
+사용합니다. Cursor 서버가 직접 보내는 native read/write/delete/ls/grep/shell/fetch 실행은 Codex
+승인 및 sandbox 경로를 우회하므로 기본적으로 비활성화되어 있습니다. 신뢰한 로컬 실험에서만
+`unsafeAllowNativeLocalExec: true`를 설정하세요. 기존 `allowNativeLocalExec` 표기는 deprecated
+전환 alias로만 허용됩니다. MCP, 화면 녹화, computer-use는 executor hook으로 열려 있으며, 로컬
+executor가 없으면 정책 차단이 아니라 typed no-executor 결과를 반환합니다. Cursor OAuth와 live
+model discovery는 이 실험적 어댑터에서 활성화되어 있으며, Cursor는 여전히 key-login 목록에는
+표시되지 않습니다.
 :::
 
 ### Ollama Cloud

docs-site/src/content/docs/ko/reference/cli.md

@@ -52,7 +52,8 @@ ocx start --port 8080
 ### `ocx login <provider>`
 
 프로바이더의 OAuth 로그인 플로우를 실행하고 자격 증명을 `~/.opencodex/auth.json`에 저장합니다
-(자동 갱신됨). 지원: `xai`, `anthropic`, `kimi`.
+(자동 갱신됨). 지원 예시: `xai`, `anthropic`, `kimi`, `cursor`, `kiro`, `google-antigravity`,
+`chatgpt`.
 
 ```bash
 ocx login xai
@@ -71,21 +72,24 @@ ocx login xai
 
 ## 백그라운드 서비스
 
-### `ocx service <subcommand>`
+### `ocx service [subcommand]`
 
 opencodex를 로그인 시 관리되는 백그라운드 서비스(macOS **launchd**, Linux **systemd user unit**,
 Windows **Task Scheduler**)로 실행합니다. 로그인 시 자동으로 시작되고 크래시 시 자동으로 재시작됩니다. 서비스 실행은
 `OCX_SERVICE=1`을 설정하므로 재시작이 Codex 설정을 변경하지 않습니다.
 
 | Subcommand | Action |
 | --- | --- |
+| 없음 | 서비스를 생성/갱신하고 시작합니다. |
 | `install` | 서비스를 생성하고 시작합니다. |
 | `start` | 설치된 서비스를 시작합니다. |
 | `stop` | 서비스를 중지하고 네이티브 Codex를 복원합니다. |
 | `status` | 서비스 실행 여부를 보고합니다. |
-| `uninstall` | 서비스를 제거하고 네이티브 Codex를 복원합니다. (별칭: `remove`) |
+| `uninstall` | 서비스를 제거하고 네이티브 Codex를 복원합니다. |
+| `remove` | `uninstall`의 별칭입니다. |
 
 ```bash
+ocx service
 ocx service install
 ocx service status
 ocx service uninstall

docs-site/src/content/docs/reference/cli.md

@@ -100,7 +100,8 @@ Run it after adding a provider or to refresh available models.
 ### `ocx login <provider>`
 
 Run the OAuth login flow for a provider and store the credential in `~/.opencodex/auth.json`
-(auto-refreshed). Supported: `xai`, `anthropic`, `kimi`.
+(auto-refreshed). Supported examples: `xai`, `anthropic`, `kimi`, `cursor`, `kiro`,
+`google-antigravity`, `chatgpt`.
 
 ```bash
 ocx login xai
@@ -119,14 +120,15 @@ the proxy if it isn't running.
 
 ## Background service
 
-### `ocx service <subcommand>`
+### `ocx service [subcommand]`
 
 Run opencodex as a login-managed background service (macOS **launchd**, Linux **systemd user unit**,
 Windows **Task Scheduler**) that auto-starts on login and auto-restarts on crash. Service runs set
 `OCX_SERVICE=1` so a restart doesn't churn the Codex config.
 
 | Subcommand | Action |
 | --- | --- |
+| none | Create/update and start the service. |
 | `install` | Create and start the service. |
 | `start` | Start an installed service. |
 | `stop` | Stop the service and restore native Codex. |
@@ -135,6 +137,7 @@ Windows **Task Scheduler**) that auto-starts on login and auto-restarts on crash
 | `remove` | Alias of `uninstall`. |
 
 ```bash
+ocx service
 ocx service install
 ocx service status
 ocx service uninstall

docs-site/src/content/docs/zh-cn/guides/codex-integration.md

@@ -45,6 +45,11 @@ $CODEX_HOME/opencodex-catalog.json
 $CODEX_HOME/models_cache.json
 ```
 
+在 WSL 中，如果未设置 `CODEX_HOME`，且 Linux 侧 `~/.codex/config.toml` 不存在，opencodex 还会检查
+`/mnt/c/Users/*/.codex/config.toml` 下的 Windows Codex Desktop home。只有候选项恰好为一个时才会
+使用该目录，让 WSL app-server mode 和 Windows Codex Desktop 共享同一份 config 与 auth 文件。要覆盖
+此检测，请显式设置 `CODEX_HOME`。
+
 `requires_openai_auth = true` 让 Codex App/TUI 的账号门控界面与原生 Codex 保持一致。
 WebSocket 传输是单独的：opencodex 提供 `/v1/responses` WebSocket 端点，但只有在
 `~/.opencodex/config.json` 中设置 `"websockets": true` 时才会广告 `supports_websockets = true`。