Integrate open backlog: doctor, CSRF, patch-app, image detail, docs

CHANGELOG.md

@@ -9,6 +9,13 @@ and this project does not yet follow semantic versioning (pre-1.0).
 
 ### Added
 
+- `codex-shim doctor`, a read-only local diagnostics command covering Python,
+  dependencies, Codex CLI availability, settings, runtime files, daemon health,
+  passthrough readiness, proxy loopback bypass, and Codex config wiring with
+  stable OK/WARN/FAIL/INFO output and summary exit-code handling.
+- `docs/subscription-integration.md`, covering ChatGPT/Codex and
+  Cursor/Composer subscription passthrough setup, troubleshooting, limitations,
+  and privacy notes.
 - Auto Router (`codex_shim/router.py`): an optional `Auto (smart routing)` picker
   entry (slug `codex-auto`) that routes each task to the cheapest configured
   model that can handle it. A cheap classifier model scores every candidate
@@ -79,6 +86,16 @@ and this project does not yet follow semantic versioning (pre-1.0).
 
 ### Fixed
 
+- Protected the state-changing picker `/api/switch` endpoint with a
+  per-process picker token so third-party pages cannot trigger model switches
+  or Desktop restarts through the loopback server.
+- Image detail normalization in `responses_to_chat`: Codex Desktop's
+  `detail: "original"` on `input_image` items is mapped to `"high"` for
+  OpenAI Chat Completions providers; unknown detail values fall back to `"auto"`.
+- `codex-shim patch-app` regex needles now match both legacy inline picker
+  filters in `model-queries-*.js` and newer extracted helpers in
+  `models-and-reasoning-efforts-*.js`, with APPLIED markers for idempotent
+  re-runs.
 - Anthropic route requests now send only `x-api-key` (plus `anthropic-version`)
   for authentication and no longer also attach `Authorization: Bearer <apiKey>`.
   Some Anthropic-compatible gateways reject requests that carry both headers.

README.md

@@ -887,6 +887,7 @@ codex-shim generate          regenerate catalog/config without starting daemon
 codex-shim start             regenerate catalog and start local shim daemon
 codex-shim enable            start daemon and write managed ~/.codex/config.toml block
 codex-shim status            health check + model count
+codex-shim doctor            read-only local diagnostics report
 codex-shim stop              stop daemon
 codex-shim disable           remove managed config block and stop daemon
 codex-shim restart           stop, regenerate, and start daemon
@@ -906,8 +907,8 @@ codex-model [list|<slug>]    shortcut for `codex-shim model …`
 
 Global flags:
 
-- `--settings <path>`: used by catalog/model/start/app/codex flows.
-- `--port <port>`: used by daemon/provider flows.
+- `--settings <path>`: used by catalog/model/start/app/codex/doctor flows.
+- `--port <port>`: used by daemon/provider/doctor flows.
 
 `patch-app` and `restore-app` always target `/Applications/Codex.app`, do not
 use `--settings`, and exit with a clear error on Windows/Linux.
@@ -927,10 +928,15 @@ restarting the CLI:
   `name = "..."` in `~/.codex/config.toml` so the Codex Desktop UI shows
   the selected model's display name (e.g. "Kimi K2.6") instead of the
   generic "Codex Shim" label, and optionally relaunches Codex Desktop
-  (`open -a Codex` on macOS, `taskkill` + `Codex.exe` on Windows).
+  (`open -a Codex` on macOS, `taskkill` + `Codex.exe` on Windows). This
+  state-changing picker endpoint requires the per-process
+  `X-Codex-Shim-Picker-Token` header embedded in `/picker`.
 
 All picker routes are behind the same `Host`-header allowlist as the rest of
-the shim, so a visited web page cannot drive them via DNS rebinding.
+the shim, so a visited web page cannot drive them via DNS rebinding. The
+state-changing `/api/switch` endpoint also requires a per-process picker token,
+so third-party pages cannot trigger model switches just because the loopback
+server is reachable.
 
 ---
 
@@ -944,6 +950,9 @@ the shim, so a visited web page cannot drive them via DNS rebinding.
   drives the shim with your credentials. If you deliberately bind to a
   non-loopback host, add the host(s) you reach it by to
   `CODEX_SHIM_ALLOWED_HOSTS` (comma-separated).
+- The model picker protects its state-changing `/api/switch` endpoint with a
+  per-process picker token, so cross-site pages cannot switch the active model
+  or request a Desktop restart without loading the picker page.
 - API keys stay in your settings file; the generated catalog does not contain
   them.
 - Request logs are summary-level by default and avoid full prompt/API-key dumps.
@@ -974,10 +983,18 @@ the shim, so a visited web page cannot drive them via DNS rebinding.
 ### Shim will not start
 
 ```bash
+codex-shim doctor
 codex-shim status
 tail -n 80 .codex-shim/shim.log
 ```
 
+`codex-shim doctor` prints a read-only diagnostics report grouped by section
+(Python, dependencies, Codex CLI, settings, runtime files, daemon health,
+passthrough availability, proxy bypass, and Codex config). It never writes
+configuration, starts/stops the daemon, calls model providers, or prints API
+keys/tokens. It exits 1 only when a hard `FAIL` is detected; warnings are meant
+as local setup hints.
+
 Common causes:
 
 - Python is older than 3.11.