august 2026

.codex-ollama/config.toml

@@ -0,0 +1,61 @@
+model = "gemma4:26b-a4b-it-q4_K_M"
+oss_provider = "ollama"
+trust_level = "trusted"
+sandbox_mode = "workspace-write"
+personality = "pragmatic"
+
+[features]
+terminal_resize_reflow = true
+goals = true
+
+[sandbox_workspace_write]
+network_access = true
+writable_roots = ["/Users/jetpac/.codex-ollama/skills"]
+
+[mcp_servers.headroom]
+command = "/Users/jetpac/.conda/envs/headroom/bin/headroom"
+args = ["mcp", "serve"]
+
+[mcp_servers.serena]
+command = "uvx"
+args = ["--from", "git+https://github.com/oraios/serena", "serena", "start-mcp-server", "--project-from-cwd", "--context", "codex"]
+
+[projects."/Users/jetpac"]
+trust_level = "trusted"
+
+[projects."/private/tmp/test"]
+trust_level = "trusted"
+
+[projects."/private/tmp"]
+trust_level = "trusted"
+
+[projects."/private/etc/codex"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/gemma-tests/mine"]
+trust_level = "trusted"
+
+[tui.model_availability_nux]
+"gpt-5.5" = 4
+
+
+
+[mcp_servers.playwright]
+command = "/Users/jetpac/.codex/bin/playwright-mcp"
+args = ["--extension"]
+startup_timeout_sec = 30.0
+
+[mcp_servers.playwright.env]
+PLAYWRIGHT_MCP_EXTENSION_TOKEN = "-6NDHv8ampzL_lDb5uVCpvea_m_O4vht7ZeTq3n5baI"
+
+[mcp_servers.playwright.tools]
+browser_navigate        = { approval_mode = "approve" }
+browser_resize          = { approval_mode = "approve" }
+browser_fill_form       = { approval_mode = "approve" }
+browser_click           = { approval_mode = "approve" }
+browser_type            = { approval_mode = "approve" }
+browser_tabs            = { approval_mode = "approve" }
+browser_run_code        = { approval_mode = "approve" }
+browser_select_option   = { approval_mode = "approve" }
+browser_evaluate        = { approval_mode = "approve" }
+

.codex/config.toml

@@ -1,3 +1,10 @@
+model_provider = "openai"
+model = "gpt-5.6-luna"
+openai_base_url = "http://127.0.0.1:8787/v1"
+
+# Work around Headroom 0.25.0 stripping Codex model metadata.
+model_catalog_json = "/Users/jetpac/.codex-test/models_cache.json"
+
 # doc: https://developers.openai.com/codex/config-advanced
 #      https://developers.openai.com/codex/config-reference
 
@@ -12,7 +19,7 @@
 
 
 
-model = "gpt-5.5"
+# model = "gpt-5.6-sol"
 
 
 # web_search is deprecated
@@ -23,15 +30,18 @@ allowed_web_search_modes = [ "live" ]
 
 trust_level = "trusted"
 
-sandbox_mode = "workspace-write"
+# sandbox_mode = "workspace-write"
 personality = "pragmatic"
 model_reasoning_effort = "low"
+plan_mode_reasoning_effort = "xhigh"
+
 
 
 notify = ["/Users/jetpac/.codex/computer-use/Codex Computer Use.app/Contents/SharedSupport/SkyComputerUseClient.app/Contents/MacOS/SkyComputerUseClient", "turn-ended"]
 # approvals_reviewer = "guardian_subagent"
+# approvals_reviewer  = "user"
 approvals_reviewer  = "auto_review"
-plan_mode_reasoning_effort = "high"
+service_tier = "default"
 
 
 [features]
@@ -39,6 +49,7 @@ multi_agent = true
 goals = true
 js_repl = false
 terminal_resize_reflow = true
+memories = true
 # remote_control = true
 
 [agents]
@@ -70,9 +81,6 @@ wire_api = "responses"
 stream_max_retries = 20
 request_max_retries = 20
 
-
-
-
 [profiles.gpt-5-5-pro]
 model = "gpt-5.5-pro"
 model_provider = "oca-responses"
@@ -146,7 +154,7 @@ SLACK_MCP_ENABLE_WRITES = "true"
 # C0A71SCTQRM for Codex Slack MCP setup instructions,
 # C05RJJ18EAF for corparch-core-srv replies,
 # and D03AY0JMFDZ for this approved setup thread.
-SLACK_MCP_WRITE_CHANNEL_ALLOWLIST = "D7PT0SXMK,D9CF41WHG,DFYAKGQFL,D08G5NZAN2C,D090RLVUCUV,DEPU4A2QM,D02CNJ53H8X,C0A71SCTQRM,C05RJJ18EAF,D03AY0JMFDZ"
+SLACK_MCP_WRITE_CHANNEL_ALLOWLIST = "D7PT0SXMK,D9CF41WHG,DFYAKGQFL,D08G5NZAN2C,D090RLVUCUV,DEPU4A2QM,D02CNJ53H8X,C0A71SCTQRM,C05RJJ18EAF,D03AY0JMFDZ,D05B7C5F6AY"
 
 [mcp_servers.slack.tools.conversations_add_message]
 approval_mode = "approve"
@@ -354,6 +362,21 @@ approval_mode = "approve"
 [mcp_servers.webrti.tools."webrti.list_by_date"]
 approval_mode = "approve"
 
+[mcp_servers.webrti.tools."webrti.dump_raw_xml"]
+approval_mode = "approve"
+
+[mcp_servers.webrti.tools."webrti.get_packages_by_arch"]
+approval_mode = "approve"
+
+[mcp_servers.webrti.tools."webrti.get_objects_by_arch"]
+approval_mode = "approve"
+
+[mcp_servers.webrti.tools."webrti.create_rti"]
+approval_mode = "prompt"
+
+[mcp_servers.webrti.env]
+WEBRTI_ENABLE_WRITES = "true"
+
 [mcp_servers.bugdb]
 command = "/Users/jetpac/.codex/bin/bugdb-mcp"
 startup_timeout_sec = 30.0
@@ -429,6 +452,15 @@ approval_mode = "approve"
 [mcp_servers.central_confluence.tools.confluence_search_user]
 approval_mode = "approve"
 
+[mcp_servers.central_confluence.tools.confluence_get_comments]
+approval_mode = "approve"
+
+[mcp_servers.central_confluence.tools.confluence_get_labels]
+approval_mode = "approve"
+
+[mcp_servers.central_confluence.tools.confluence_get_page_attachments]
+approval_mode = "approve"
+
 [mcp_servers.notmuch]
 command = "node"
 args = ["/Users/jetpac/Documents/codex-tools/MCPs/notmuch/dist/index.js"]
@@ -481,6 +513,8 @@ jenkins_get_job               = { approval_mode = "approve" }
 jenkins_get_job_config        = { approval_mode = "approve" }
 jenkins_get_log               = { approval_mode = "approve" }
 jenkins_get_node              = { approval_mode = "approve" }
+jenkins_runtime               = { approval_mode = "approve" }
+# jenkins_start_build           = { approval_mode = "approve" }
 jenkins_get_queue_item        = { approval_mode = "approve" }
 jenkins_get_stage_log         = { approval_mode = "approve" }
 jenkins_get_test_results      = { approval_mode = "approve" }
@@ -512,6 +546,9 @@ approval_mode = "approve"
 [mcp_servers.vm.tools.vm_get_resources]
 approval_mode = "approve"
 
+[mcp_servers.vm.tools.vm_list_templates]
+approval_mode = "approve"
+
 [mcp_servers.vcap]
 command = "node"
 args = ["/Users/jetpac/Documents/codex-tools/MCPs/vcap-mcp/dist/index.js"]
@@ -520,7 +557,7 @@ tool_timeout_sec = 60.0
 
 [mcp_servers.vcap.env]
 VCAP_MCP_USERNAME = "petr.nyc"
-VCAP_MCP_API_KEY = "b6e395b4-7e4b-4ba0-bdcd-a803c5dedbbb"
+VCAP_MCP_API_KEY = "8ee9fc5c-d826-4cbd-a1e5-f9857c9ab05a"
 VCAP_MCP_BASE_URL = "https://vcap.us.oracle.com/vcap"
 VCAP_MCP_ALLOW_MUTATIONS = "false"
 
@@ -1047,13 +1084,103 @@ trust_level = "trusted"
 [projects."/Users/jetpac/Documents/OSD/calico-scm"]
 trust_level = "trusted"
 
+[projects."/Users/jetpac/tmp/codex-ollama-test"]
+trust_level = "trusted"
+
+[projects."/private/tmp/pr/release-tools"]
+trust_level = "trusted"
+
+[projects."/private/tmp/ee"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/Solaris/ips-sru"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/PycharmProjects/on-sru/solaris/on/production"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/obsidian"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/OSD-marketplace"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/Solaris/11.3-custom"]
+trust_level = "trusted"
+
+[projects."/private/tmp/empty/e"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/trainings"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-02/i-have-a-web-training-i-5"]
+trust_level = "trusted"
+
+[projects."/private/tmp/course"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-21/i-wa"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-21/use-chrome-go-to-https-eeho"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-21/computer-use-plugin-computer-use-openai"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-21/use-chrome-go-to-https-eeho-2"]
+trust_level = "trusted"
+
+[projects."/private/tmp/pr-review/oci-desktop-service-shepherd"]
+trust_level = "trusted"
+
+[projects."/private/tmp/pr-review/oci-desktop-service-console-plugin"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/PycharmProjects/userland-pipeline/solaris/akidr/scripts"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-23/codex-start-with-autoreview-from-command"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-23/codex-start-with-autoreview-from-command-2"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-23/are"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/codex/2026-07-23/are-2"]
+trust_level = "trusted"
+
+[projects."/Applications/ChatGPT.app/Contents/Resources"]
+trust_level = "trusted"
+
+[projects."/"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/OSD/marketplace_images"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/PycharmProjects/solaris-cluster/solaris/userland/sru"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Downloads"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/OSD/nginx-update-july-2026/oci-desktop-service-shepherd"]
+trust_level = "trusted"
+
+[projects."/Users/jetpac/Documents/OSD/nginx-update-july-2026"]
+trust_level = "trusted"
+
 [marketplaces.openai-bundled]
-last_updated = "2026-05-28T10:46:49Z"
+last_updated = "2026-08-03T08:15:24Z"
 source_type = "local"
 source = "/Users/jetpac/.codex/.tmp/bundled-marketplaces/openai-bundled"
 
 [marketplaces.openai-primary-runtime]
-last_updated = "2026-04-28T18:12:08Z"
+last_updated = "2026-08-03T08:16:52Z"
 source_type = "local"
 source = "/Users/jetpac/.cache/codex-runtimes/codex-primary-runtime/plugins/openai-primary-runtime"
 
@@ -1069,11 +1196,34 @@ enabled = true
 [plugins."browser@openai-bundled"]
 enabled = true
 
+[plugins."sites@openai-bundled"]
+enabled = true
+
+[plugins."chrome@openai-bundled"]
+enabled = true
+
+[plugins."pdf@openai-primary-runtime"]
+enabled = true
+
+[plugins."template-creator@openai-primary-runtime"]
+enabled = true
+
+[plugins."computer-use@openai-bundled"]
+enabled = true
+
+[plugins."visualize@openai-bundled"]
+enabled = true
+
 [desktop]
 appearanceTheme = "system"
 composerEnterBehavior = "cmdIfMultiline"
-preventSleepWhileRunning = false
+preventSleepWhileRunning = true
 keepRemoteControlAwakeWhilePluggedIn = false
+conversationDetailMode = "STEPS_COMMANDS"
+ambient-suggestions-enabled = false
+followUpQueueMode = "queue"
+dock-icon-preference = "codex-system"
+show-context-window-usage = true
 
 [desktop.open-in-target-preferences]
 global = "iterm2"
@@ -1085,6 +1235,19 @@ global = "iterm2"
 [apps.connector_4aaab2856305417b993eca9a216aaf6e.tools."microsoft outlook email_send_email"]
 approval_mode = "approve"
 
+[shell_environment_policy.set]
+BROWSER_USE_AVAILABLE_BACKENDS = "chrome,iab"
+NODE_REPL_TRUSTED_BROWSER_CLIENT_SHA256S = "028a14b6eaa6d98dac2aae00764345ab9f244801ed8493d42b9af3be5575006e,f204d340535055781952b10ed396de20b842f00a19e430852f7e121ad1ce91f6"
+NODE_REPL_TRUSTED_CODE_PATHS = "/Users/jetpac/.codex"
+
+[hooks.state]
+
+[hooks.state."/Users/jetpac/.codex/hooks.json:post_tool_use:0:0"]
+trusted_hash = "sha256:ac371f260e4b23ba1d1b7a4ad68a44a323a8470b61f38471a47aceac1b7a5a7c"
+
+[hooks.state."/Users/jetpac/.codex/hooks.json:pre_tool_use:0:0"]
+trusted_hash = "sha256:fc87dbee1cb8a9be4f78ba094c4fa8d5e2fd38cb800854e3717f9b6a52fe2a47"
+
 # [projects."/Users/jetpac/Documents/codex-tools/MCPs/ident-scm-mcp"]
 # trust_level = "trusted"
 
@@ -1334,23 +1497,66 @@ approval_mode = "approve"
 [mcp_servers.mcp_gateway.tools.devops__get_property_defaults]
 approval_mode = "approve"
 
+[mcp_servers.mcp_gateway.tools.scm__oci_devops_pr_activities]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.devops__get_tenancy_by_id]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.devops__get_shepherd_compartments_by_phonebook]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.devops__list_shepherd_compartments]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.bitbucket__search]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.jira__jira_get_user_profile]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.bitbucket__get_comments]
+approval_mode = "approve"
+
+[mcp_servers.mcp_gateway.tools.devops__get_shepherd_region_details]
+approval_mode = "approve"
+
+[mcp_servers.headroom]
+command = "headroom"
+args = ["mcp", "serve"]
+enabled = false
+
+[mcp_servers.serena]
+command = "uvx"
+args = ["--from", "git+https://github.com/oraios/serena", "serena", "start-mcp-server", "--project-from-cwd", "--context", "codex"]
+
 [mcp_servers.node_repl]
 args = []
-command = "/Applications/Codex.app/Contents/Resources/node_repl"
+command = "/Applications/Codex.app/Contents/Resources/cua_node/bin/node_repl"
 startup_timeout_sec = 120
 
 [mcp_servers.node_repl.env]
 NODE_REPL_NATIVE_PIPE_CONNECT_TIMEOUT_MS = "1000"
-NODE_REPL_NODE_MODULE_DIRS = ""
+NODE_REPL_NODE_MODULE_DIRS = "/Applications/Codex.app/Contents/Resources/cua_node/lib/node_modules"
-NODE_REPL_NODE_PATH = "/Applications/Codex.app/Contents/Resources/node"
+NODE_REPL_NODE_PATH = "/Applications/Codex.app/Contents/Resources/cua_node/bin/node"
 NODE_REPL_TRUSTED_CODE_PATHS = "/Users/jetpac/.codex"
 CODEX_HOME = "/Users/jetpac/.codex"
-NODE_REPL_TRUSTED_BROWSER_CLIENT_SHA256S = "496c7b3cb95b4bc20cff49b513150606e0da0000c92bf752206bee5a6c248423"
+NODE_REPL_TRUSTED_BROWSER_CLIENT_SHA256S = "028a14b6eaa6d98dac2aae00764345ab9f244801ed8493d42b9af3be5575006e,f204d340535055781952b10ed396de20b842f00a19e430852f7e121ad1ce91f6"
-BROWSER_USE_AVAILABLE_BACKENDS = "iab"
+BROWSER_USE_AVAILABLE_BACKENDS = "chrome,iab"
-BROWSER_USE_MARKETPLACE_NAME = "openai-bundled"
+NODE_REPL_INSTRUCTIONS_USE_CASE_BROWSER = "Control the in-app browser in conjunction with the Browser Plugin."
-NODE_REPL_UNTRUSTED_ENV_ALLOWLIST = "BROWSER_USE_MARKETPLACE_NAME"
+NODE_REPL_INSTRUCTIONS_USE_CASE_CHROME = "Control the Chrome browser in conjunction with the Chrome Plugin. Prefer this method of controlling Chrome over alternatives (such as Computer Use) unless the user explicitly mentions an alternative."
+NODE_REPL_INSTRUCTIONS_USE_CASE_COMPUTER_USE = "Control desktop apps on macOS through Computer Use."
+BROWSER_USE_CODEX_APP_BUILD_FLAVOR = "prod"
+BROWSER_USE_CODEX_APP_VERSION = "26.727.51351"
+SKY_CUA_SERVICE_PATH = "/Users/jetpac/.codex/computer-use/Codex Computer Use.app"
 CODEX_CLI_PATH = "/Applications/Codex.app/Contents/Resources/codex"
 
+[mcp_servers.computer-use]
+command = "./Codex Computer Use.app/Contents/SharedSupport/SkyComputerUseClient.app/Contents/MacOS/SkyComputerUseClient"
+args = ["mcp"]
+cwd = "."
+enabled = false
+
 # [mcp_servers.remote_ssh]
 # command = "/Users/jetpac/.codex/remote-ssh-mcp/node_modules/.bin/tsx"
 # args = ["/Users/jetpac/.codex/remote-ssh-mcp/src/index.ts"]
@@ -1378,3 +1584,9 @@ CODEX_CLI_PATH = "/Applications/Codex.app/Contents/Resources/codex"
 
 # [mcp_servers.local_exec.tools.local_exec_run]
 # approval_mode = "approve"
+
+# [model_providers.headroom]
+# name = "OpenAI via Headroom proxy"
+# base_url = "http://127.0.0.1:8787/v1"
+# supports_websockets = true
+# env_http_headers = { "X-Headroom-Project" = "HEADROOM_PROJECT" }

.config/mc/ini

@@ -89,7 +89,7 @@ filepos_max_saved_entries=1024
 
 [Layout]
 output_lines=0
-left_panel_size=86
+left_panel_size=87
 top_panel_size=0
 message_visible=true
 keybar_visible=true

.ssh/config.oci

@@ -3,17 +3,35 @@ Include ssh_configs/config
 Include osd_configs/config
 Include user
 
+Host *
+  WarnWeakCrypto no
+
+# Host bitbucket.oci.oraclecorp.com
+# 	IdentityFile ~/.ssh/orabucket
+# 	HostkeyAlgorithms +ssh-rsa
+#	PubkeyAcceptedAlgorithms +ssh-rsa
+
+Include config.solaris-domain
+
 Host bitbucket.oci.oraclecorp.com
-	IdentityFile ~/.ssh/orabucket
+    HostName bitbucket.oci.oraclecorp.com
-	HostkeyAlgorithms +ssh-rsa
+    Port 7999
-	PubkeyAcceptedAlgorithms +ssh-rsa
+    IdentityFile ~/.ssh/orabucket
+    IdentitiesOnly yes
+    AddKeysToAgent yes
+    UseKeychain yes
+
+Host s11sru-x01 s11sru-x01.us.oracle.com
+     KexAlgorithms +diffie-hellman-group1-sha1
+
 
 Host github.com
   IdentityFile ~/.ssh/github.com
 
 Host dabel dabel.us.oracle.com andel andel.us.oracle.com gates gates.us.oracle.com on10-patch.us.oracle.com scapen*
-	User pnyc
+  User pnyc
-	IdentityFile ~/.ssh/dabel.key
+  IdentityFile ~/.ssh/dabel.key
+  ForwardAgent yes
   RequestTTY yes
 
 Host codex.webad1phx.solarisx86phx.oraclevcn.com
@@ -51,4 +69,4 @@ Host pnyc-ws
   IdentityFile ~/.ssh/id_pnyc-ws
   IdentitiesOnly yes
   WarnWeakCrypto no
-  ForwardAgent yes
+  ForwardAgent yes

.ssh/config.solaris

@@ -1,5 +1,6 @@
 # Include config-scm
 
+Include config.solaris-domain
 
 Host *
 # 	UseKeychain yes
@@ -18,6 +19,8 @@ Host *
 Host 192.168.2.*
 	IdentitiesOnly yes
 
+
+
 Host osd-fra
   User desktopuser
   HostName 100.109.60.126
@@ -89,7 +92,7 @@ Host 192.168.2.1 gw gw.doma.jetpac.org
 Host github.com
 	IdentityFile ~/.ssh/github.com
 
-Host bitbucket.oci.oraclecorp.com
+Host bitbucket.oci.oraclecorp.com sig-ul-sru11-3-x01.us.oracle.com sig-ul-sru11-3-s01.us.oracle.com
 	IdentityFile ~/.ssh/orabucket
 	HostkeyAlgorithms +ssh-rsa
 	PubkeyAcceptedAlgorithms +ssh-rsa
@@ -182,4 +185,3 @@ Host nori sfzfs-nori.commonsub.zsphx.oraclevcn.com
 Include ossh_configs/*.ossh
 Include ssh_configs/config
 Include osd_configs/config
-

.ssh/config.solaris-domain

@@ -0,0 +1,16 @@
+# config for Solaris domains
+Host andel dabel on-11u4-bld-* re-userland-build-*01 gates s11sru-gate sig-kz-*-sc hubbins scapen-* bea100 bei100 sig-*-sru11-3-*01 s11sru-x0* s11sru-x02-sc s11sru-x01-sc
+  CanonicalizeHostname yes
+  CanonicalDomains us.oracle.com
+  PKCS11Provider none
+
+# config for service processors - requires password
+# password stored in OCI wallet - 'ops' command
+Host s11sru-x02-sc sig-kz-*-sc on-11u4-bld-*-sc s11sru-x02-sc s11sru-x01-sc
+  User root
+  HostKeyAlgorithms +ssh-rsa
+  PubkeyAuthentication no
+  PreferredAuthentications keyboard-interactive,password
+  KbdInteractiveAuthentication yes
+  # NumberOfPasswordPrompts 1
+

.zshrc

@@ -283,3 +283,7 @@ unset -f _profile_add_plugin _profile_add_plugin_if_command_exists 2>/dev/null |
 ### MANAGED BY RANCHER DESKTOP START (DO NOT EDIT)
 export PATH="/Users/jetpac/.rd/bin:$PATH"
 ### MANAGED BY RANCHER DESKTOP END (DO NOT EDIT)
+
+. "$HOME/.atuin/bin/env"
+
+eval "$(atuin init zsh --disable-up-arrow)"

bin/codex-ollama

@@ -0,0 +1,67 @@
+#!/usr/bin/env zsh
+set -euo pipefail
+
+CODEX_BIN="${CODEX_BIN:-/opt/homebrew/bin/codex}"
+CODEX_OLLAMA_HOME="${CODEX_OLLAMA_HOME:-${HOME}/.codex-ollama}"
+CODEX_OLLAMA_MODEL="${CODEX_OLLAMA_MODEL:-gemma4:26b-a4b-it-q4_K_M}"
+
+export CODEX_HOME="${CODEX_OLLAMA_HOME}"
+export PATH="${HOME}/bin:${PATH}"
+
+if [[ ! -x "${CODEX_BIN}" ]]; then
+  print -u2 -- "Codex binary not found or not executable: ${CODEX_BIN}"
+  exit 1
+fi
+
+if ! command -v ollama >/dev/null 2>&1; then
+  print -u2 -- "ollama not available on PATH"
+  exit 1
+fi
+
+args_include_cd() {
+  local arg
+
+  for arg in "$@"; do
+    case "${arg}" in
+      -C|--cd|-C=*|--cd=*)
+        return 0
+        ;;
+    esac
+  done
+
+  return 1
+}
+
+args_include_model() {
+  local arg
+
+  for arg in "$@"; do
+    case "${arg}" in
+      -m|--model|-m=*|--model=*)
+        return 0
+        ;;
+    esac
+  done
+
+  return 1
+}
+
+codex_args=(--oss --local-provider ollama)
+
+if ! args_include_model "$@"; then
+  if ! ollama list | awk 'NR > 1 { print $1 }' | grep -Fxq -- "${CODEX_OLLAMA_MODEL}"; then
+    print -u2 -- "Ollama model not installed: ${CODEX_OLLAMA_MODEL}"
+    print -u2 -- "Install it with: ollama pull ${CODEX_OLLAMA_MODEL}"
+    exit 1
+  fi
+
+  codex_args+=(-m "${CODEX_OLLAMA_MODEL}")
+fi
+
+if [[ "${PWD}" == "${HOME}" ]] && ! args_include_cd "$@"; then
+  original_pwd="${PWD}"
+  builtin cd "${TMPDIR:-/private/tmp}"
+  codex_args+=(--cd "${original_pwd}")
+fi
+
+exec "${CODEX_BIN}" "${codex_args[@]}" "$@"

bin/codex-sso

@@ -5,6 +5,13 @@ set -euo pipefail
 export CODEX_HOME="${CODEX_HOME:-${HOME}/.codex}"
 CODEX_AUTH_COMMON_SCRIPT="${CODEX_AUTH_COMMON_SCRIPT:-${HOME}/bin/codex-auth-common.zsh}"
 CODEX_BIN="${CODEX_BIN:-/opt/homebrew/bin/codex}"
+HEADROOM_BIN="${HEADROOM_BIN:-headroom}"
+HEADROOM_HOST="${HEADROOM_HOST:-127.0.0.1}"
+HEADROOM_PORT="${HEADROOM_PORT:-8787}"
+HEADROOM_LOG_FILE="${HEADROOM_LOG_FILE:-${HOME}/.headroom/logs/proxy.log}"
+CODEX_SSO_DIRECT_MODEL_PROVIDER="${CODEX_SSO_DIRECT_MODEL_PROVIDER:-openai}"
+CODEX_SSO_APPROVAL_MODE="${CODEX_SSO_APPROVAL_MODE:-config}"
+CODEX_SSO_HEADROOM_PROXY_PID=""
 
 if [[ ! -r "${CODEX_AUTH_COMMON_SCRIPT}" ]]; then
   print -u2 -- "Codex auth common helper not found or not readable: ${CODEX_AUTH_COMMON_SCRIPT}"
@@ -12,12 +19,95 @@ if [[ ! -r "${CODEX_AUTH_COMMON_SCRIPT}" ]]; then
 fi
 source "${CODEX_AUTH_COMMON_SCRIPT}"
 
-trap codex_auth_cleanup EXIT INT TERM
+codex_sso_cleanup() {
+  local rc=$?
+
+  if [[ -n "${CODEX_SSO_HEADROOM_PROXY_PID}" ]]; then
+    kill "${CODEX_SSO_HEADROOM_PROXY_PID}" >/dev/null 2>&1 || true
+    wait "${CODEX_SSO_HEADROOM_PROXY_PID}" >/dev/null 2>&1 || true
+  fi
+
+  codex_auth_cleanup
+  return "${rc}"
+}
+
+codex_sso_headroom_ready() {
+  if command -v nc >/dev/null 2>&1; then
+    nc -z "${HEADROOM_HOST}" "${HEADROOM_PORT}" >/dev/null 2>&1
+    return $?
+  fi
+
+  if command -v lsof >/dev/null 2>&1; then
+    lsof -nP -iTCP:"${HEADROOM_PORT}" -sTCP:LISTEN >/dev/null 2>&1
+    return $?
+  fi
+
+  return 1
+}
+
+codex_sso_start_headroom() {
+  local attempt log_dir
+
+  if codex_sso_headroom_ready; then
+    return 0
+  fi
+
+  log_dir="$(dirname -- "${HEADROOM_LOG_FILE}")"
+  mkdir -p "${log_dir}"
+
+  "${HEADROOM_BIN}" proxy --host "${HEADROOM_HOST}" --port "${HEADROOM_PORT}" >"${HEADROOM_LOG_FILE}" 2>&1 &
+  CODEX_SSO_HEADROOM_PROXY_PID=$!
+
+  for attempt in {1..120}; do
+    if codex_sso_headroom_ready; then
+      return 0
+    fi
+
+    if ! kill -0 "${CODEX_SSO_HEADROOM_PROXY_PID}" >/dev/null 2>&1; then
+      print -u2 -- "Headroom proxy exited before becoming ready. See ${HEADROOM_LOG_FILE}."
+      return 1
+    fi
+
+    sleep 0.25
+  done
+
+  print -u2 -- "Timed out waiting for Headroom proxy on ${HEADROOM_HOST}:${HEADROOM_PORT}. See ${HEADROOM_LOG_FILE}."
+  return 1
+}
+
+codex_sso_toml_string() {
+  local value="$1"
+  value="${value//\\/\\\\}"
+  value="${value//\"/\\\"}"
+  print -r -- "\"${value}\""
+}
+
+codex_sso_approval_args() {
+  case "${CODEX_SSO_APPROVAL_MODE}" in
+    config)
+      ;;
+    untrusted)
+      approval_args=(--disable guardian_approval -a untrusted)
+      ;;
+    *)
+      print -u2 -- "Invalid CODEX_SSO_APPROVAL_MODE: ${CODEX_SSO_APPROVAL_MODE} (expected config or untrusted)"
+      exit 2
+      ;;
+  esac
+}
+
+trap codex_sso_cleanup EXIT INT TERM
 
 codex_auth_preflight
 
 unset OPENAI_API_KEY
 unset CODEX_ACCESS_TOKEN
+approval_args=()
+codex_sso_approval_args
 
-"${CODEX_BIN}" --disable guardian_approval -a untrusted "$@"
+if [[ "${CODEX_SSO_NO_HEADROOM:-}" == "1" ]]; then
-# "${CODEX_BIN}" "$@"
+  "${CODEX_BIN}" --config "model_provider=$(codex_sso_toml_string "${CODEX_SSO_DIRECT_MODEL_PROVIDER}")" "${approval_args[@]}" "$@"
+else
+  codex_sso_start_headroom
+  OPENAI_BASE_URL="http://${HEADROOM_HOST}:${HEADROOM_PORT}/v1" "${CODEX_BIN}" "${approval_args[@]}" "$@"
+fi