# Skip this step if CCS is installed and Codex accounts are already in the pool.
$npm install -g @kaitranntt/ccs

# Open CCS dashboard, then add accounts in CLIProxy -> Codex -> Accounts.
$ccs config

# Confirm CLIProxyAPI can see Codex account state.
$ccs cliproxy quota --provider codex

$security add-generic-password \
   -a "$USER" \
   -s CLIPROXY_API_KEY \
   -w "$CLIPROXY_API_KEY" \
   -U

$mkdir -p "$HOME/.codex/bin"
$touch "$HOME/.codex/bin/cliproxy-token"

#!/bin/zsh
set -euo pipefail

service="CLIPROXY_API_KEY"
account="${USER:-$(id -un)}"

token="$(security find-generic-password -a "$account" -s "$service" -w 2>/dev/null || true)"

if [[ -z "$token" ]]; then
  token="$(security find-generic-password -s "$service" -w 2>/dev/null || true)"
fi

if [[ -z "$token" ]]; then
  print -u2 "Missing Keychain item: service=$service account=$account"
  exit 1
fi

printf '%s\n' "$token"

$chmod 700 "$HOME/.codex/bin/cliproxy-token"

model = "gpt-5.5"
# Optional for custom providers/proxies when Codex cannot infer model metadata.
# Omit this when falling back to native OpenAI/OAuth; Codex auto-detects there.
model_context_window = 272000
model_provider = "cliproxy"

[model_providers.cliproxy]
name = "CLIProxy"
base_url = "http://127.0.0.1:8317/api/provider/codex"
wire_api = "responses"

[model_providers.cliproxy.auth]
# Created in step 3
# If your Codex build does not expand $HOME here, replace it with the output of: echo "$HOME"
command = "$HOME/.codex/bin/cliproxy-token"
timeout_ms = 5000
refresh_interval_ms = 300000

# Verify the helper can read a non-empty token from Keychain.
$test -n "$("$HOME/.codex/bin/cliproxy-token")" && echo "Keychain helper OK"

# Verify the Keychain item exists. This prints metadata, not the token.
$security find-generic-password -a "$USER" -s CLIPROXY_API_KEY

# Verify local CLIProxyAPI is listening on port 8317.
$lsof -nP -iTCP:8317 -sTCP:LISTEN

# Verify Codex config/auth/connectivity. The important part is "0 warn | 0 fail".
$codex doctor --summary --no-color --ascii