feat(cli): relay-like CLI closure — target manifest, Codex TOML, Gemini launcher, guards

- canonical executable manifest (bin/cli/cli-manifest.mjs): run/configure/completion
  derive targets, aliases and --model wiring from one table; drift test cross-checks
  manifest x cliRuntime x UI catalog (tests/unit/cli/cli-manifest-drift.test.ts)
- dashboard Codex generator converged to ~/.codex/config.toml (modern Codex v0.137+,
  verified against codex-cli 0.147.0): conservative merge, env_key auth (key never
  written), refuses invalid TOML, reports legacy config.yaml as migration note
- omniroute run gemini: launcher over OmniRoute's /v1beta surface via
  GOOGLE_GEMINI_BASE_URL + isolated GEMINI_CLI_HOME forcing gemini-api-key auth
  (contract proven against @google/gemini-cli 0.50.0); ACP registration kept distinct
- opt-in real smoke harness for upstream CLIs (RUN_CLI_SMOKE=1, credential by env
  NAME, redacted output): tests/integration/upstream-cli-smoke.int.test.ts
- container-guard homologation for POST /api/cli-tools/apply (422 in container,
  dry-run preview allowed, host write passes) + docs; guard untouched
- typecheck: omniglyphAdapter union narrowing, usageTracking typed signatures
  (UsageLike, no any), models.ts isValidModel params — typecheck:core and
  typecheck:noimplicit:core now clean
- relay core (prior session of this effort): omniroute run for 6 CLIs, configure
  picker with per-context favorites/recents, contexts with optional keychain +
  0600 fallback, provider CRUD with recursive redaction, completion updates, docs

src/app/api/cli-tools/apply/route.ts

@@ -3,9 +3,9 @@ import { z } from "zod";
 import { requireCliToolsAuth } from "@/lib/api/requireCliToolsAuth";
 import fs from "node:fs";
 import path from "node:path";
-import os from "node:os";
 import { generateConfig } from "@/lib/cli-helper/config-generator";
 import { guardCliConfigWrite } from "@/lib/api/cliConfigWriteGuard";
+import { getCliPrimaryConfigPath, normalizeCliToolId } from "@/shared/services/cliRuntime";
 
 const applySchema = z.object({
   toolId: z.string().min(1),
@@ -15,21 +15,13 @@ const applySchema = z.object({
   dryRun: z.boolean().optional(),
 });
 
-const TOOL_CONFIG_PATHS: Record<string, string> = {
-  claude: path.join(os.homedir(), ".claude", "settings.json"),
-  codex: path.join(os.homedir(), ".codex", "config.yaml"),
-  cline: path.join(os.homedir(), ".cline", "data", "globalState.json"),
-  kilocode: path.join(os.homedir(), ".config", "kilocode", "settings.json"),
-  continue: path.join(os.homedir(), ".continue", "config.yaml"),
-};
-
 /** The host-side command that does the same job when OmniRoute is containerised. */
 const HOST_SETUP_COMMANDS: Record<string, string> = {
   claude: "omniroute setup-claude",
   codex: "omniroute setup-codex",
   opencode: "omniroute setup-opencode",
   cline: "omniroute setup-cline",
-  kilocode: "omniroute setup-kilo",
+  kilo: "omniroute setup-kilo",
   continue: "omniroute setup-continue",
 };
 
@@ -56,8 +48,9 @@ export async function POST(request: Request) {
       );
     }
     const { toolId, baseUrl, apiKey, model, dryRun } = parsed.data;
+    const canonicalToolId = normalizeCliToolId(toolId);
 
-    const result = await generateConfig(toolId, {
+    const result = await generateConfig(canonicalToolId, {
       baseUrl: baseUrl || "http://localhost:20128/v1",
       apiKey,
       model,
@@ -72,10 +65,11 @@ export async function POST(request: Request) {
         dryRun: true,
         configPath: result.configPath,
         content: result.content,
+        ...(result.migration ? { migration: result.migration } : {}),
       });
     }
 
-    const configPath = toolId === "opencode" ? result.configPath : TOOL_CONFIG_PATHS[toolId];
+    const configPath = result.configPath || getCliPrimaryConfigPath(canonicalToolId);
     if (!configPath) {
       return NextResponse.json({ error: `Unknown tool: ${toolId}` }, { status: 400 });
     }
@@ -83,8 +77,8 @@ export async function POST(request: Request) {
     // A container write into an unmounted path looks successful and then
     // disappears with the container — refuse it and point at the host CLI.
     const refusal = guardCliConfigWrite(configPath, {
-      toolLabel: toolId,
-      hostCommand: HOST_SETUP_COMMANDS[toolId],
+      toolLabel: canonicalToolId,
+      hostCommand: HOST_SETUP_COMMANDS[canonicalToolId],
     });
     if (refusal) return refusal;
 
@@ -100,6 +94,7 @@ export async function POST(request: Request) {
       configPath,
       backupPath,
       content: result.content,
+      ...(result.migration ? { migration: result.migration } : {}),
     });
   } catch (error) {
     console.log("Error applying config:", error);