adding headroom and codex-gema

.codex-gemma/config.toml

@@ -0,0 +1,62 @@
+model = "gemma4:26b-a4b-it-q4_K_M"
+oss_provider = "ollama"
+trust_level = "trusted"
+sandbox_mode = "workspace-write"
+personality = "pragmatic"
+
+[features]
+terminal_resize_reflow = true
+goals = true
+
+[sandbox_workspace_write]
+network_access = true
+writable_roots = ["/Users/jetpac/.codex-gemma/skills"]
+
+[mcp_servers.headroom]
+command = "/Users/jetpac/.conda/envs/headroom/bin/headroom"
+args = ["mcp", "serve"]
+
+[mcp_servers.serena]
+command = "uvx"
+args = ["--from", "git+https://github.com/oraios/serena", "serena", "start-mcp-server", "--project-from-cwd", "--context", "codex"]
+
+[projects."/Users/jetpac"]
+trust_level = "trusted"
+
+[projects."/private/tmp/test"]
+trust_level = "trusted"
+
+[projects."/private/tmp"]
+trust_level = "trusted"
+
+[projects."/private/etc/codex"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/gemma-tests/mine"]
+trust_level = "trusted"
+
+[tui.model_availability_nux]
+"gpt-5.5" = 4
+
+
+
+[mcp_servers.playwright]
+command = "/Users/jetpac/.codex/bin/playwright-mcp"
+args = ["--extension"]
+startup_timeout_sec = 30.0
+
+[mcp_servers.playwright.env]
+PLAYWRIGHT_MCP_EXTENSION_TOKEN = "-6NDHv8ampzL_lDb5uVCpvea_m_O4vht7ZeTq3n5baI"
+
+[mcp_servers.playwright.tools]
+browser_navigate        = { approval_mode = "approve" }
+browser_resize          = { approval_mode = "approve" }
+browser_fill_form       = { approval_mode = "approve" }
+browser_click           = { approval_mode = "approve" }
+browser_type            = { approval_mode = "approve" }
+browser_tabs            = { approval_mode = "approve" }
+browser_run_code        = { approval_mode = "approve" }
+browser_select_option   = { approval_mode = "approve" }
+browser_evaluate        = { approval_mode = "approve" }
+
+

.codex/config.toml

@@ -1,3 +1,5 @@
+model_provider = "headroom"
+
 # doc: https://developers.openai.com/codex/config-advanced
 #      https://developers.openai.com/codex/config-reference
 
@@ -25,13 +27,14 @@ trust_level = "trusted"
 
 sandbox_mode = "workspace-write"
 personality = "pragmatic"
-model_reasoning_effort = "low"
+model_reasoning_effort = "medium"
+plan_mode_reasoning_effort = "high"
+
 
 
 notify = ["/Users/jetpac/.codex/computer-use/Codex Computer Use.app/Contents/SharedSupport/SkyComputerUseClient.app/Contents/MacOS/SkyComputerUseClient", "turn-ended"]
 # approvals_reviewer = "guardian_subagent"
 approvals_reviewer  = "auto_review"
-plan_mode_reasoning_effort = "high"
 
 
 [features]
@@ -70,9 +73,6 @@ wire_api = "responses"
 stream_max_retries = 20
 request_max_retries = 20
 
-
-
-
 [profiles.gpt-5-5-pro]
 model = "gpt-5.5-pro"
 model_provider = "oca-responses"
@@ -1334,6 +1334,15 @@ approval_mode = "approve"
 [mcp_servers.mcp_gateway.tools.devops__get_property_defaults]
 approval_mode = "approve"
 
+[mcp_servers.headroom]
+command = "headroom"
+args = ["mcp", "serve"]
+enabled = false
+
+[mcp_servers.serena]
+command = "uvx"
+args = ["--from", "git+https://github.com/oraios/serena", "serena", "start-mcp-server", "--project-from-cwd", "--context", "codex"]
+
 [mcp_servers.node_repl]
 args = []
 command = "/Applications/Codex.app/Contents/Resources/node_repl"
@@ -1378,3 +1387,9 @@ CODEX_CLI_PATH = "/Applications/Codex.app/Contents/Resources/codex"
 
 # [mcp_servers.local_exec.tools.local_exec_run]
 # approval_mode = "approve"
+
+[model_providers.headroom]
+name = "OpenAI via Headroom proxy"
+base_url = "http://127.0.0.1:8787/v1"
+supports_websockets = true
+env_http_headers = { "X-Headroom-Project" = "HEADROOM_PROJECT" }

.config/mc/ini

@@ -89,7 +89,7 @@ filepos_max_saved_entries=1024
 
 [Layout]
 output_lines=0
-left_panel_size=86
+left_panel_size=87
 top_panel_size=0
 message_visible=true
 keybar_visible=true

bin/codex-gemma

@@ -0,0 +1,47 @@
+#!/usr/bin/env zsh
+set -euo pipefail
+
+CODEX_BIN="${CODEX_BIN:-/opt/homebrew/bin/codex}"
+CODEX_GEMMA_HOME="${CODEX_GEMMA_HOME:-${HOME}/.codex-gemma}"
+CODEX_GEMMA_MODEL="${CODEX_GEMMA_MODEL:-gemma4:26b-a4b-it-q4_K_M}"
+
+export CODEX_HOME="${CODEX_GEMMA_HOME}"
+export PATH="${HOME}/bin:${PATH}"
+
+if [[ ! -x "${CODEX_BIN}" ]]; then
+  print -u2 -- "Codex binary not found or not executable: ${CODEX_BIN}"
+  exit 1
+fi
+
+if ! command -v ollama >/dev/null 2>&1; then
+  print -u2 -- "ollama is not available on PATH"
+  exit 1
+fi
+
+if ! ollama list | awk 'NR > 1 { print $1 }' | grep -Fxq -- "${CODEX_GEMMA_MODEL}"; then
+  print -u2 -- "Ollama model is not installed: ${CODEX_GEMMA_MODEL}"
+  print -u2 -- "Install it with: ollama pull ${CODEX_GEMMA_MODEL}"
+  exit 1
+fi
+
+args_include_cd() {
+  local arg
+  for arg in "$@"; do
+    case "${arg}" in
+      -C|--cd|-C=*|--cd=*)
+        return 0
+        ;;
+    esac
+  done
+  return 1
+}
+
+codex_args=(--oss --local-provider ollama -m "${CODEX_GEMMA_MODEL}")
+
+if [[ "${PWD}" == "${HOME}" ]] && ! args_include_cd "$@"; then
+  original_pwd="${PWD}"
+  builtin cd "${TMPDIR:-/private/tmp}"
+  codex_args+=(--cd "${original_pwd}")
+fi
+
+exec "${CODEX_BIN}" "${codex_args[@]}" "$@"

bin/codex-sso

@@ -5,6 +5,12 @@ set -euo pipefail
 export CODEX_HOME="${CODEX_HOME:-${HOME}/.codex}"
 CODEX_AUTH_COMMON_SCRIPT="${CODEX_AUTH_COMMON_SCRIPT:-${HOME}/bin/codex-auth-common.zsh}"
 CODEX_BIN="${CODEX_BIN:-/opt/homebrew/bin/codex}"
+HEADROOM_BIN="${HEADROOM_BIN:-headroom}"
+HEADROOM_HOST="${HEADROOM_HOST:-127.0.0.1}"
+HEADROOM_PORT="${HEADROOM_PORT:-8787}"
+HEADROOM_LOG_FILE="${HEADROOM_LOG_FILE:-${HOME}/.headroom/logs/proxy.log}"
+CODEX_SSO_DIRECT_MODEL_PROVIDER="${CODEX_SSO_DIRECT_MODEL_PROVIDER:-openai}"
+CODEX_SSO_HEADROOM_PROXY_PID=""
 
 if [[ ! -r "${CODEX_AUTH_COMMON_SCRIPT}" ]]; then
   print -u2 -- "Codex auth common helper not found or not readable: ${CODEX_AUTH_COMMON_SCRIPT}"
@@ -12,12 +18,80 @@ if [[ ! -r "${CODEX_AUTH_COMMON_SCRIPT}" ]]; then
 fi
 source "${CODEX_AUTH_COMMON_SCRIPT}"
 
-trap codex_auth_cleanup EXIT INT TERM
+codex_sso_cleanup() {
+  local rc=$?
+
+  if [[ -n "${CODEX_SSO_HEADROOM_PROXY_PID}" ]]; then
+    kill "${CODEX_SSO_HEADROOM_PROXY_PID}" >/dev/null 2>&1 || true
+    wait "${CODEX_SSO_HEADROOM_PROXY_PID}" >/dev/null 2>&1 || true
+  fi
+
+  codex_auth_cleanup
+  return "${rc}"
+}
+
+codex_sso_headroom_ready() {
+  if command -v nc >/dev/null 2>&1; then
+    nc -z "${HEADROOM_HOST}" "${HEADROOM_PORT}" >/dev/null 2>&1
+    return $?
+  fi
+
+  if command -v lsof >/dev/null 2>&1; then
+    lsof -nP -iTCP:"${HEADROOM_PORT}" -sTCP:LISTEN >/dev/null 2>&1
+    return $?
+  fi
+
+  return 1
+}
+
+codex_sso_start_headroom() {
+  local attempt log_dir
+
+  if codex_sso_headroom_ready; then
+    return 0
+  fi
+
+  log_dir="$(dirname -- "${HEADROOM_LOG_FILE}")"
+  mkdir -p "${log_dir}"
+
+  "${HEADROOM_BIN}" proxy --host "${HEADROOM_HOST}" --port "${HEADROOM_PORT}" >"${HEADROOM_LOG_FILE}" 2>&1 &
+  CODEX_SSO_HEADROOM_PROXY_PID=$!
+
+  for attempt in {1..120}; do
+    if codex_sso_headroom_ready; then
+      return 0
+    fi
+
+    if ! kill -0 "${CODEX_SSO_HEADROOM_PROXY_PID}" >/dev/null 2>&1; then
+      print -u2 -- "Headroom proxy exited before becoming ready. See ${HEADROOM_LOG_FILE}."
+      return 1
+    fi
+
+    sleep 0.25
+  done
+
+  print -u2 -- "Timed out waiting for Headroom proxy on ${HEADROOM_HOST}:${HEADROOM_PORT}. See ${HEADROOM_LOG_FILE}."
+  return 1
+}
+
+codex_sso_toml_string() {
+  local value="$1"
+  value="${value//\\/\\\\}"
+  value="${value//\"/\\\"}"
+  print -r -- "\"${value}\""
+}
+
+trap codex_sso_cleanup EXIT INT TERM
 
 codex_auth_preflight
 
 unset OPENAI_API_KEY
 unset CODEX_ACCESS_TOKEN
 
-"${CODEX_BIN}" --disable guardian_approval -a untrusted "$@"
+if [[ "${CODEX_SSO_NO_HEADROOM:-}" == "1" ]]; then
+  "${CODEX_BIN}" --config "model_provider=$(codex_sso_toml_string "${CODEX_SSO_DIRECT_MODEL_PROVIDER}")" --disable guardian_approval -a untrusted "$@"
+else
+  codex_sso_start_headroom
+  OPENAI_BASE_URL="http://${HEADROOM_HOST}:${HEADROOM_PORT}/v1" "${CODEX_BIN}" --disable guardian_approval -a untrusted "$@"
+fi
 # "${CODEX_BIN}" "$@"