[Bug]: ocx update --help performs the real npm self-update #168

Summary

On a global npm installation, ocx update --help performs the real self-update instead of printing help and exiting without side effects.

This is especially disruptive when Codex Desktop is currently routed through the local opencodex proxy: the update restarts the proxy and drops the in-flight Responses stream.

Reproduction

Environment:

• Windows 11
• PowerShell 7.6.3
• global npm installation
• starting version: @bitkyc08/opencodex@2.7.23
• target/latest version: 2.7.26
• proxy running as the Task Scheduler service on 127.0.0.1:10100

Steps:

1. Keep the opencodex service running.
2. Route an active Codex Desktop thread through the proxy.
3. Run:

ocx update --help

Expected behavior

Print the update subcommand help and exit successfully without checking, installing, stopping, or restarting anything.

Actual behavior

The npm self-update runs. In this reproduction it updated 2.7.23 -> 2.7.26, restarted the proxy, and the active Codex turn failed with:

stream disconnected before completion: error sending request for url (http://127.0.0.1:10100/v1/responses)

After reconnecting:

opencodex v2.7.26 (installed via npm, tag latest)
Already on the latest latest version (v2.7.26).

Root cause

The TypeScript CLI correctly handles subcommand help before dispatch:

https://github.com/lidge-jun/opencodex/blob/v2.7.26/src/cli/index.ts#L48-L55

However, the npm launcher intercepts every npm-installed update command before the Bun CLI receives --help:

https://github.com/lidge-jun/opencodex/blob/v2.7.26/bin/ocx.mjs#L225-L227

if (process.argv[2] === "update" && isNodeModulesInstall() && !isBunGlobalInstall()) {
  runNpmSelfUpdate();
}

That condition does not exclude --help, -h, or help.

Suggested fix

Before calling runNpmSelfUpdate(), detect help arguments and forward the command to the normal CLI help path. A regression test should verify that all of these are side-effect free:

ocx update --help
ocx update -h
ocx update help

This is related in spirit to the earlier subcommand-help safety work mentioned in #11/#14, but it is a separate npm-launcher bypass that remains present in v2.7.26.