adding headroom and codex-gema

bin/codex-gemma

@@ -0,0 +1,47 @@
+#!/usr/bin/env zsh
+set -euo pipefail
+
+CODEX_BIN="${CODEX_BIN:-/opt/homebrew/bin/codex}"
+CODEX_GEMMA_HOME="${CODEX_GEMMA_HOME:-${HOME}/.codex-gemma}"
+CODEX_GEMMA_MODEL="${CODEX_GEMMA_MODEL:-gemma4:26b-a4b-it-q4_K_M}"
+
+export CODEX_HOME="${CODEX_GEMMA_HOME}"
+export PATH="${HOME}/bin:${PATH}"
+
+if [[ ! -x "${CODEX_BIN}" ]]; then
+  print -u2 -- "Codex binary not found or not executable: ${CODEX_BIN}"
+  exit 1
+fi
+
+if ! command -v ollama >/dev/null 2>&1; then
+  print -u2 -- "ollama is not available on PATH"
+  exit 1
+fi
+
+if ! ollama list | awk 'NR > 1 { print $1 }' | grep -Fxq -- "${CODEX_GEMMA_MODEL}"; then
+  print -u2 -- "Ollama model is not installed: ${CODEX_GEMMA_MODEL}"
+  print -u2 -- "Install it with: ollama pull ${CODEX_GEMMA_MODEL}"
+  exit 1
+fi
+
+args_include_cd() {
+  local arg
+  for arg in "$@"; do
+    case "${arg}" in
+      -C|--cd|-C=*|--cd=*)
+        return 0
+        ;;
+    esac
+  done
+  return 1
+}
+
+codex_args=(--oss --local-provider ollama -m "${CODEX_GEMMA_MODEL}")
+
+if [[ "${PWD}" == "${HOME}" ]] && ! args_include_cd "$@"; then
+  original_pwd="${PWD}"
+  builtin cd "${TMPDIR:-/private/tmp}"
+  codex_args+=(--cd "${original_pwd}")
+fi
+
+exec "${CODEX_BIN}" "${codex_args[@]}" "$@"

bin/codex-sso

@@ -5,6 +5,12 @@ set -euo pipefail
 export CODEX_HOME="${CODEX_HOME:-${HOME}/.codex}"
 CODEX_AUTH_COMMON_SCRIPT="${CODEX_AUTH_COMMON_SCRIPT:-${HOME}/bin/codex-auth-common.zsh}"
 CODEX_BIN="${CODEX_BIN:-/opt/homebrew/bin/codex}"
+HEADROOM_BIN="${HEADROOM_BIN:-headroom}"
+HEADROOM_HOST="${HEADROOM_HOST:-127.0.0.1}"
+HEADROOM_PORT="${HEADROOM_PORT:-8787}"
+HEADROOM_LOG_FILE="${HEADROOM_LOG_FILE:-${HOME}/.headroom/logs/proxy.log}"
+CODEX_SSO_DIRECT_MODEL_PROVIDER="${CODEX_SSO_DIRECT_MODEL_PROVIDER:-openai}"
+CODEX_SSO_HEADROOM_PROXY_PID=""
 
 if [[ ! -r "${CODEX_AUTH_COMMON_SCRIPT}" ]]; then
   print -u2 -- "Codex auth common helper not found or not readable: ${CODEX_AUTH_COMMON_SCRIPT}"
@@ -12,12 +18,80 @@ if [[ ! -r "${CODEX_AUTH_COMMON_SCRIPT}" ]]; then
 fi
 source "${CODEX_AUTH_COMMON_SCRIPT}"
 
-trap codex_auth_cleanup EXIT INT TERM
+codex_sso_cleanup() {
+  local rc=$?
+
+  if [[ -n "${CODEX_SSO_HEADROOM_PROXY_PID}" ]]; then
+    kill "${CODEX_SSO_HEADROOM_PROXY_PID}" >/dev/null 2>&1 || true
+    wait "${CODEX_SSO_HEADROOM_PROXY_PID}" >/dev/null 2>&1 || true
+  fi
+
+  codex_auth_cleanup
+  return "${rc}"
+}
+
+codex_sso_headroom_ready() {
+  if command -v nc >/dev/null 2>&1; then
+    nc -z "${HEADROOM_HOST}" "${HEADROOM_PORT}" >/dev/null 2>&1
+    return $?
+  fi
+
+  if command -v lsof >/dev/null 2>&1; then
+    lsof -nP -iTCP:"${HEADROOM_PORT}" -sTCP:LISTEN >/dev/null 2>&1
+    return $?
+  fi
+
+  return 1
+}
+
+codex_sso_start_headroom() {
+  local attempt log_dir
+
+  if codex_sso_headroom_ready; then
+    return 0
+  fi
+
+  log_dir="$(dirname -- "${HEADROOM_LOG_FILE}")"
+  mkdir -p "${log_dir}"
+
+  "${HEADROOM_BIN}" proxy --host "${HEADROOM_HOST}" --port "${HEADROOM_PORT}" >"${HEADROOM_LOG_FILE}" 2>&1 &
+  CODEX_SSO_HEADROOM_PROXY_PID=$!
+
+  for attempt in {1..120}; do
+    if codex_sso_headroom_ready; then
+      return 0
+    fi
+
+    if ! kill -0 "${CODEX_SSO_HEADROOM_PROXY_PID}" >/dev/null 2>&1; then
+      print -u2 -- "Headroom proxy exited before becoming ready. See ${HEADROOM_LOG_FILE}."
+      return 1
+    fi
+
+    sleep 0.25
+  done
+
+  print -u2 -- "Timed out waiting for Headroom proxy on ${HEADROOM_HOST}:${HEADROOM_PORT}. See ${HEADROOM_LOG_FILE}."
+  return 1
+}
+
+codex_sso_toml_string() {
+  local value="$1"
+  value="${value//\\/\\\\}"
+  value="${value//\"/\\\"}"
+  print -r -- "\"${value}\""
+}
+
+trap codex_sso_cleanup EXIT INT TERM
 
 codex_auth_preflight
 
 unset OPENAI_API_KEY
 unset CODEX_ACCESS_TOKEN
 
-"${CODEX_BIN}" --disable guardian_approval -a untrusted "$@"
+if [[ "${CODEX_SSO_NO_HEADROOM:-}" == "1" ]]; then
+  "${CODEX_BIN}" --config "model_provider=$(codex_sso_toml_string "${CODEX_SSO_DIRECT_MODEL_PROVIDER}")" --disable guardian_approval -a untrusted "$@"
+else
+  codex_sso_start_headroom
+  OPENAI_BASE_URL="http://${HEADROOM_HOST}:${HEADROOM_PORT}/v1" "${CODEX_BIN}" --disable guardian_approval -a untrusted "$@"
+fi
 # "${CODEX_BIN}" "$@"