@bitkyc08/opencodex 2.10.0 → 2.10.1

package/src/claude/agents-inject.ts

@@ -15,7 +15,7 @@ import { lstatSync, mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync
 import { join } from "node:path";
 import type { OcxConfig } from "../types";
 import { claudeCodeAlias, claudeCodeNativeAlias } from "./alias";
-import { resolveAutoContext, stripOneMillionMarker, withOneMillionMarker } from "./context-windows";
+import { AUTO_CONTEXT_OFF, shouldMarkOneMillion, stripOneMillionMarker, withOneMillionMarker } from "./context-windows";
 import { claudeConfigDir } from "./gateway-cache";
 import { DEFAULT_SUBAGENT_MODELS, hasOwnProvider } from "../config";
 import { effectiveBlockedSkillNames, resolveInboundModel } from "./inbound";
@@ -58,6 +58,27 @@ function pickerDefaultModel(configDir: string): string | null {
 /** Roster entry -> alias + display parts. Entries are bare native slugs or "provider/id".
  * Codex-facing encoded ids (`provider/vendor-model`) decode to the native slash id first
  * so the alias joins the raw-native context-window map (context-windows.ts). */
+
+/**
+ * Generated subagent defs cannot rely on the parent's auto-context compaction
+ * pairing, so their [1m] marker follows the AUTHORITATIVE window only: mark when
+ * the effective window (exact selector, then the canonical [1m] form, then bare)
+ * is genuinely >= 1M; strip an inherited unsafe marker back to the bare selector;
+ * with no window information, keep the selector as it was. Genuine routed [1m]
+ * ids are preserved through the canonical-exact lookup. (#854)
+ */
+function withSubagentContextMarker(selector: string, windows: Record<string, number>): string {
+  const bare = stripOneMillionMarker(selector);
+  const wasMarked = selector !== bare;
+  const canonicalExact = wasMarked ? `${bare}[1m]` : selector;
+  const authoritativeWindow = windows[selector] ?? windows[canonicalExact] ?? windows[bare];
+  if (typeof authoritativeWindow === "number" && authoritativeWindow > 0) {
+    return shouldMarkOneMillion(authoritativeWindow, AUTO_CONTEXT_OFF)
+      ? (withOneMillionMarker(selector, windows) ?? selector)
+      : bare;
+  }
+  return wasMarked ? selector : bare;
+}
 function entryParts(entry: string, config: OcxConfig): { alias: string; id: string; provider: string } {
   const slash = entry.indexOf("/");
   if (slash > 0) {
@@ -72,7 +93,6 @@ function entryParts(entry: string, config: OcxConfig): { alias: string; id: stri
 }
 
 export function buildClaudeAgentDefs(config: OcxConfig, windows: Record<string, number>, configDir = claudeConfigDir()): ClaudeAgentDef[] {
-  const auto = resolveAutoContext(config.claudeCode);
   const blockedSkills = effectiveBlockedSkillNames(config.claudeCode);
   const blockedSkillsFor = (model: string): readonly string[] => {
     const unmarked = stripOneMillionMarker(model);
@@ -87,8 +107,10 @@ export function buildClaudeAgentDefs(config: OcxConfig, windows: Record<string,
   const coveredModels = new Set<string>();
 
   const push = (name: string, alias: string, description: string) => {
-    // Effective model value: [1m] marking follows the same predicate as env slots.
-    const model = withOneMillionMarker(alias, windows, auto) ?? alias;
+    // Generated defs mark [1m] on the authoritative window only — never the
+    // main-session auto-context predicate (a 372K route marked [1m] would be
+    // accounted at 1M with no compaction safety net in the subagent).
+    const model = withSubagentContextMarker(alias, windows);
     const bare = alias.toLowerCase();
     if (coveredModels.has(bare)) return;
     coveredModels.add(bare);
@@ -120,7 +142,7 @@ export function buildClaudeAgentDefs(config: OcxConfig, windows: Record<string,
   // the next launch sync — documented limit. No resolvable default -> no self def.
   const selfModel = pickerDefaultModel(configDir) ?? (config.claudeCode?.model?.trim() || null);
   if (selfModel) {
-    const marked = withOneMillionMarker(selfModel, windows, auto) ?? selfModel;
+    const marked = withSubagentContextMarker(selfModel, windows);
     defs.push({
       file: `${OWNED_PREFIX}self.md`,
       name: `${OWNED_PREFIX}self`,

package/src/claude/inbound.ts

@@ -106,6 +106,10 @@ function toolResultOutput(block: Rec): string | Rec[] {
       } else if (item.type === "image") {
         const img = imageBlockToInputImage(item);
         if (img) out.push(img);
+      } else if (item.type === "document") {
+        // Same marker as the user-message document case below: the model should see the
+        // attachment happened instead of an empty tool output.
+        out.push({ type: "input_text", text: `[document${typeof item.title === "string" ? `: ${item.title}` : ""}]` });
       }
     }
     if (isError) out.unshift({ type: "input_text", text: "[tool error]" });
@@ -494,7 +498,13 @@ export function anthropicToResponsesTranslation(raw: unknown, cc?: OcxClaudeCode
   const thinking = raw.thinking;
   const outputConfigEffort = effortFromOutputConfig(raw.output_config);
   const thinkingDisabled = isRec(thinking) && thinking.type === "disabled";
-  if (!thinkingDisabled && (isRec(thinking) || outputConfigEffort !== undefined)) {
+  if (thinkingDisabled) {
+    // An explicit "disabled" is an instruction, not an absence. Dropping it made this
+    // indistinguishable from a request that never mentioned thinking — and for models that
+    // think by default, omission means thinking is ON, sharing the caller's max_tokens (#545).
+    // "none" is the parser's disable sentinel (parser.ts REASONING_EFFORTS).
+    body.reasoning = { effort: "none", summary: "none" };
+  } else if (isRec(thinking) || outputConfigEffort !== undefined) {
     const reasoning: Rec = { summary: "auto" };
     if (outputConfigEffort !== undefined) {
       // Adaptive wire: /effort arrives as output_config.effort (devlog 080).

package/src/claude/model-info.ts

@@ -18,7 +18,7 @@
 import { catalogModelEfforts, nativeEffortClamp, nativeOpenAiContextWindow, type CatalogModel } from "../codex/catalog";
 import { claudeCodeAlias, claudeCodeNativeAlias } from "./alias";
 import { desktop3pAlias } from "./desktop-3p";
-import { AUTO_CONTEXT_OFF, shouldMarkOneMillion, type AutoContextMode } from "./context-windows";
+import { AUTO_CONTEXT_OFF, type AutoContextMode } from "./context-windows";
 
 const MODEL_INFO_CREATED_AT = "2026-01-01T00:00:00Z";
 const ANTHROPIC_EFFORT_RUNGS = new Set(["low", "medium", "high", "xhigh", "max"]);
@@ -113,19 +113,22 @@ export function buildAnthropicModelInfos(
   const seen = new Set<string>();
   // [1m] picker variant (devlog 260712 B1): Claude Code accounts exactly 1M for ids
   // carrying the marker (2.1.207 binary: /\[1m\]/i → 1e6, compaction preserved), so
-  // models with an authoritative >=1M window get a second selectable row. In
-  // auto-context mode (devlog 020) the predicate widens to windows > 200k that can
-  // host the compact window — display stays honest (real window, not "1M"). Guards
-  // (audit R1#11): same dedupe set, never double-suffix.
-  const push1mVariant = (base: AnthropicModelInfo, contextWindow: number | undefined, mode: AutoContextMode = auto) => {
-    if (!shouldMarkOneMillion(contextWindow, mode)) return;
+  // ONLY models with an authoritative >=1M window get a second selectable row —
+  // the auto-context widening that let a 372K route carry the marker (and be
+  // over-filled) is the #854 defect and does not come back. Guards (audit R1#11):
+  // same dedupe set, never double-suffix.
+  const push1mVariant = (base: AnthropicModelInfo, contextWindow: number | undefined) => {
+    // The [1m] marker makes Claude Code account 1e6 tokens for the row, so it
+    // may only name models whose AUTHORITATIVE effective window is >= 1M —
+    // never the auto-context widening, which would mark a 372K route and have
+    // Claude Code over-fill it (the #854 defect).
+    if (contextWindow === undefined || contextWindow < ONE_MILLION) return;
     if (base.id.includes("[1m]")) return;
     const id = `${base.id}[1m]`;
     if (seen.has(id)) return;
     seen.add(id);
     const window = contextWindow as number;
-    const label = window >= ONE_MILLION ? "1M" : `${Math.round(window / 1_000)}k`;
-    out.push({ ...base, id, display_name: `${base.display_name} · ${label}`, max_input_tokens: Math.min(window, ONE_MILLION) });
+    out.push({ ...base, id, display_name: `${base.display_name} · 1M`, max_input_tokens: ONE_MILLION });
   };
   for (const slug of nativeSlugs) {
     const id = idStyle === "readable" ? claudeCodeNativeAlias(slug) : aliasForRoute("native", slug);
@@ -145,7 +148,7 @@ export function buildAnthropicModelInfos(
     out.push(info);
     // Anthropic passthrough guard (audit 021 #3): never auto-widen canonical claude
     // routes — only a genuine >=1M window earns the variant row there.
-    push1mVariant(info, m.contextWindow, m.provider === "anthropic" ? AUTO_CONTEXT_OFF : auto);
+    push1mVariant(info, m.contextWindow);
   }
   return out;
 }

package/src/claude/outbound.ts

@@ -187,6 +187,8 @@ interface OpenBlock {
   argsBufBytes?: number;
   webSearchArgsEmitted?: boolean;
   callId?: string;
+  /** Last reasoning part identity (item + summary/content index) seen by this thinking block. */
+  reasoningPartKey?: string;
 }
 
 /** Streaming: Responses SSE bytes -> Anthropic Messages SSE bytes. */
@@ -353,6 +355,21 @@ export function responsesSseToAnthropicSse(
           case "response.reasoning_text.delta": {
             if (typeof data.delta !== "string" || data.delta.length === 0) break;
             ensureBlock("thinking");
+            // The JSON path joins reasoning summary/content parts with "\n\n"
+            // (responsesJsonToAnthropicMessage); mirror that at part and item boundaries
+            // so multi-part summaries do not glue into one run-on paragraph. Frames
+            // without part indices produce a constant key and never get a separator.
+            const slot = eventName === "response.reasoning_summary_text.delta"
+              ? `s${String(data.summary_index)}`
+              : `c${String(data.content_index)}`;
+            const partKey = `${String(data.item_id)}:${slot}`;
+            if (open!.reasoningPartKey !== undefined && open!.reasoningPartKey !== partKey) {
+              emit("content_block_delta", {
+                type: "content_block_delta", index: open!.index,
+                delta: { type: "thinking_delta", thinking: "\n\n" },
+              });
+            }
+            open!.reasoningPartKey = partKey;
             emit("content_block_delta", {
               type: "content_block_delta", index: open!.index,
               delta: { type: "thinking_delta", thinking: data.delta },

package/src/cli/account-api.ts

@@ -28,6 +28,17 @@ export type ClassifyResult = { type: AccountType } | { error: string };
 
 export type AccountStdin = NodeJS.ReadableStream & { isTTY?: boolean };
 
+export interface NativeMainLoginChild {
+  exited: Promise<number>;
+  kill(signal?: number | NodeJS.Signals): void;
+}
+
+export interface StageLeaseClock {
+  now(): number;
+  setTimeout(callback: () => void, ms: number): ReturnType<typeof setTimeout>;
+  clearTimeout(timer: ReturnType<typeof setTimeout>): void;
+}
+
 export interface AccountDeps {
   /** Test injection: skip findLiveProxy and call the API at this base URL. */
   baseUrl?: string;
@@ -35,6 +46,14 @@ export interface AccountDeps {
   loadConfigImpl?: () => OcxConfig;
   stdinImpl?: AccountStdin;
   stdinTimeoutMs?: number;
+  /** Test/platform injection for the official Codex login in a restricted staging home. */
+  spawnCodexLoginImpl?: (codexHome: string) => NativeMainLoginChild;
+  /** Legacy test seam. Production always uses the spawned child handle above. */
+  runCodexLoginImpl?: (codexHome: string) => Promise<number>;
+  /** Test-only heartbeat cadence floor. Production keeps the five-second floor. */
+  stageHeartbeatIntervalMinMs?: number;
+  /** Test-only clock for deterministic native-profile lease deadline coverage. */
+  stageLeaseClock?: StageLeaseClock;
 }
 
 export function classifyAccount(config: OcxConfig, name: string): ClassifyResult {
@@ -68,6 +87,7 @@ export async function apiJson(
   method: "GET" | "PUT" | "POST" | "DELETE",
   path: string,
   body?: unknown,
+  options: { signal?: AbortSignal } = {},
 ): Promise<ApiResult> {
   const fetchImpl = deps.fetchImpl ?? fetch;
   try {
@@ -75,6 +95,7 @@ export async function apiJson(
       method,
       headers: runningProxyUpdateHeaders(),
       body: body === undefined ? undefined : JSON.stringify(body),
+      signal: options.signal,
     });
     const json = (await res.json().catch(() => ({}))) as Record<string, unknown>;
     return { status: res.status, json };
@@ -98,6 +119,9 @@ export function proxyUnreachable(): number {
 export function apiError(json: Record<string, unknown>, fallback: string): number {
   const message = typeof json.error === "string" ? json.error : fallback;
   console.error(`Error: ${message}`);
+  if (json.cleanupRequired === true) {
+    console.error("Warning: native-login staging cleanup is still required; run 'ocx account main doctor'.");
+  }
   return 1;
 }
 

package/src/cli/account-auth.ts

@@ -11,6 +11,23 @@ import {
   type CliStdin,
   type RuntimeApiDeps,
 } from "./runtime-api";
+import { writeSync } from "node:fs";
+
+/**
+ * Write the whole block to fd 1 synchronously (#1007). `console.log` can
+ * buffer behind a pipe, which hid the authorization URL for the entire
+ * polling window under non-TTY stdout. A partial write loops; a zero-byte
+ * write is a hard failure, never silent progress.
+ */
+function writeStdoutFully(text: string): void {
+  const bytes = Buffer.from(text, "utf8");
+  let offset = 0;
+  while (offset < bytes.length) {
+    const written = writeSync(1, bytes, offset, bytes.length - offset);
+    if (written <= 0) throw new CliUsageError("failed to write login instructions to stdout");
+    offset += written;
+  }
+}
 
 const USAGE = `Usage:
   ocx account login <provider> [--id <account-id>] [--reauth] [--code -] [--no-wait] [--json]
@@ -82,9 +99,14 @@ async function login(argv: string[], deps: RuntimeApiDeps): Promise<void> {
       body: JSON.stringify({ ...(id ? { id } : {}), ...(reauth ? { reauth: true } : {}) }),
     }, deps);
     if (!wantsJson) {
-      if (start.url) console.log(`Open this URL to sign in:\n${start.url}`);
-      if (start.instructions) console.log(start.instructions);
-      if (start.flowId) console.log(`Flow: ${start.flowId}`);
+      // One atomic pre-poll block, flushed synchronously so a piped parent
+      // reads the URL before the polling window starts (#1007).
+      const block = [
+        start.url ? `Open this URL to sign in:\n${start.url}` : "",
+        start.instructions ?? "",
+        start.flowId ? `Flow: ${start.flowId}` : "",
+      ].filter(line => line !== "").join("\n");
+      if (block) writeStdoutFully(`${block}\n`);
     }
     if (code && start.flowId) {
       await runtimeRequest("/api/codex-auth/login/code", {
@@ -120,9 +142,12 @@ async function login(argv: string[], deps: RuntimeApiDeps): Promise<void> {
     body: JSON.stringify({ provider, addAccount: !reauth, ...(reauth && id ? { accountId: id, reauth: true } : {}) }),
   }, deps);
   if (!wantsJson) {
-    if (start.url) console.log(`Open this URL to sign in:\n${start.url}`);
-    if (start.instructions) console.log(start.instructions);
-    if (start.deviceCode) console.log(`Device code: ${start.deviceCode}`);
+    const block = [
+      start.url ? `Open this URL to sign in:\n${start.url}` : "",
+      start.instructions ?? "",
+      start.deviceCode ? `Device code: ${start.deviceCode}` : "",
+    ].filter(line => line !== "").join("\n");
+    if (block) writeStdoutFully(`${block}\n`);
   }
   if (code) {
     await runtimeRequest("/api/oauth/login/code", {

package/src/cli/account-main.ts

@@ -0,0 +1,317 @@
+import { isAbsolute } from "node:path";
+import { codexExecInvocation } from "../codex/exec-invocation";
+import { resolveAndPersistCodexRuntime, type ResolveCodexRuntimeDeps } from "../codex/runtime";
+import type { ResolveDeps, SpawnInvocation } from "../lib/win-exec";
+import {
+  apiError,
+  apiJson,
+  proxyUnreachable,
+  resolveBaseUrl,
+  type AccountDeps,
+  type NativeMainLoginChild,
+  type StageLeaseClock,
+} from "./account-api";
+
+const USAGE = `Usage:
+  ocx account main doctor [--json]
+  ocx account main list [--json]
+  ocx account main register <label> [--json]
+  ocx account main add <label>
+  ocx account main switch <profile-id-or-label> --yes [--json]
+  ocx account main recover [--rollback --yes] [--json]
+
+Native main login profiles change the physical Codex App/CLI login in the effective CODEX_HOME.
+They are independent from the OpenCodex Pool selected by 'ocx account use openai'.`;
+
+const STAGE_LEASE_SAFETY_MARGIN_MS = 30_000;
+
+const systemStageLeaseClock: StageLeaseClock = {
+  now: Date.now,
+  setTimeout: (callback, ms) => setTimeout(callback, ms),
+  clearTimeout: timer => clearTimeout(timer),
+};
+
+interface PublicProfile {
+  id: string;
+  label: string;
+  identityHint: string;
+  state: "active" | "inactive";
+}
+
+export type NativeMainCodexLoginInvocationDeps =
+  & ResolveDeps
+  & Pick<ResolveCodexRuntimeDeps, "existsSync" | "execFileSync" | "configDir" | "readFileSync">;
+
+function flag(args: string[], name: string): boolean {
+  const index = args.indexOf(name);
+  if (index < 0) return false;
+  args.splice(index, 1);
+  return true;
+}
+
+function reject(args: string[]): number {
+  if (args.length > 0) console.error(`Unexpected argument(s): ${args.join(", ")}`);
+  console.error(USAGE);
+  return 1;
+}
+
+function effectiveCodexHome(result: Record<string, unknown>): string {
+  return typeof result.effectiveCodexHome === "string" && result.effectiveCodexHome.length > 0
+    ? result.effectiveCodexHome
+    : "the effective CODEX_HOME";
+}
+
+function printProfiles(profiles: PublicProfile[]): void {
+  if (profiles.length === 0) { console.log("No native main login profiles registered."); return; }
+  const rows = profiles.map(profile => [profile.state === "active" ? "*" : " ", profile.label, profile.id, profile.identityHint]);
+  const header = ["", "LABEL", "PROFILE ID", "IDENTITY"];
+  const widths = header.map((value, index) => Math.max(value.length, ...rows.map(row => row[index]!.length)));
+  const line = (columns: string[]) => columns.map((value, index) => value.padEnd(widths[index]!)).join("  ").trimEnd();
+  console.log([line(header), ...rows.map(line)].join("\n"));
+}
+
+export function nativeMainCodexLoginInvocation(
+  platform: NodeJS.Platform = process.platform,
+  deps: NativeMainCodexLoginInvocationDeps = {},
+): SpawnInvocation {
+  const command = resolveAndPersistCodexRuntime({
+    env: deps.env ?? process.env,
+    platform,
+    existsSync: deps.existsSync,
+    execFileSync: deps.execFileSync,
+    configDir: deps.configDir,
+    readFileSync: deps.readFileSync,
+    discoverAlternatives: false,
+  }).runtime.command || "codex";
+  return codexExecInvocation(command, ["login"], platform, deps);
+}
+
+function spawnOfficialCodexLogin(codexHome: string): NativeMainLoginChild {
+  const invocation = nativeMainCodexLoginInvocation();
+  const child = Bun.spawn([invocation.file, ...invocation.args], {
+    env: { ...process.env, CODEX_HOME: codexHome },
+    stdin: "inherit",
+    stdout: "inherit",
+    stderr: "inherit",
+    ...(invocation.options.windowsVerbatimArguments ? { windowsVerbatimArguments: true } : {}),
+  });
+  return child;
+}
+
+function abortableDelay(ms: number, signal: AbortSignal, clock: StageLeaseClock): Promise<void> {
+  if (signal.aborted) return Promise.resolve();
+  return new Promise(resolve => {
+    const timer = clock.setTimeout(done, ms);
+    signal.addEventListener("abort", done, { once: true });
+    function done(): void {
+      clock.clearTimeout(timer);
+      signal.removeEventListener("abort", done);
+      resolve();
+    }
+  });
+}
+
+async function maintainStageLease(
+  deps: AccountDeps,
+  baseUrl: string,
+  stageId: string,
+  writerToken: string,
+  initialLeaseExpiresAt: number,
+  heartbeatIntervalMs: number,
+  child: NativeMainLoginChild,
+  signal: AbortSignal,
+  clock: StageLeaseClock,
+): Promise<{ lost: boolean }> {
+  let leaseExpiresAt = initialLeaseExpiresAt;
+  for (;;) {
+    if (signal.aborted) return { lost: false };
+    const deadlineAt = leaseExpiresAt - STAGE_LEASE_SAFETY_MARGIN_MS;
+    if (clock.now() >= deadlineAt) {
+      try { child.kill(); } catch { /* child exit below is authoritative */ }
+      return { lost: true };
+    }
+
+    const heartbeatAbort = new AbortController();
+    const deadlineReached = Symbol("heartbeat-deadline");
+    const parentCancelled = Symbol("heartbeat-parent-cancelled");
+    let resolveInterruption!: (result: typeof deadlineReached | typeof parentCancelled) => void;
+    const interruption = new Promise<typeof deadlineReached | typeof parentCancelled>(resolve => {
+      resolveInterruption = resolve;
+    });
+    const cancelHeartbeat = () => {
+      heartbeatAbort.abort();
+      resolveInterruption(parentCancelled);
+    };
+    signal.addEventListener("abort", cancelHeartbeat, { once: true });
+    const deadlineTimer = clock.setTimeout(() => {
+      heartbeatAbort.abort();
+      resolveInterruption(deadlineReached);
+    }, Math.max(0, deadlineAt - clock.now()));
+    const heartbeatRequest = apiJson(
+      deps,
+      baseUrl,
+      "POST",
+      "/api/native-main-profiles/stage/heartbeat",
+      { stageId, writerToken },
+      { signal: heartbeatAbort.signal },
+    );
+    const heartbeat = await Promise.race([heartbeatRequest, interruption]);
+    clock.clearTimeout(deadlineTimer);
+    signal.removeEventListener("abort", cancelHeartbeat);
+    if (signal.aborted) return { lost: false };
+    if (heartbeat === parentCancelled) return { lost: false };
+    if (heartbeat === deadlineReached) {
+      try { child.kill(); } catch { /* child exit below is authoritative */ }
+      return { lost: true };
+    }
+    if (heartbeat.status === 200 && typeof heartbeat.json.leaseExpiresAt === "number") {
+      leaseExpiresAt = heartbeat.json.leaseExpiresAt;
+      await abortableDelay(Math.min(heartbeatIntervalMs, Math.max(0, leaseExpiresAt - STAGE_LEASE_SAFETY_MARGIN_MS - clock.now())), signal, clock);
+      continue;
+    }
+    if (heartbeat.status === 0 && clock.now() < leaseExpiresAt - STAGE_LEASE_SAFETY_MARGIN_MS) {
+      await abortableDelay(Math.min(5_000, heartbeatIntervalMs, leaseExpiresAt - STAGE_LEASE_SAFETY_MARGIN_MS - clock.now()), signal, clock);
+      continue;
+    }
+    try { child.kill(); } catch { /* child exit below is authoritative */ }
+    return { lost: true };
+  }
+}
+
+export async function cmdNativeMainAccount(args: string[], deps: AccountDeps): Promise<number> {
+  const sub = args.shift();
+  const wantsJson = flag(args, "--json");
+  const confirmed = flag(args, "--yes");
+  const rollback = flag(args, "--rollback");
+  const baseUrl = await resolveBaseUrl(deps);
+  if (!baseUrl) return proxyUnreachable();
+
+  if (sub === "doctor" || sub === "list") {
+    if (args.length > 0 || confirmed || rollback) return reject(args);
+    const path = sub === "doctor" ? "/api/native-main-profiles/doctor" : "/api/native-main-profiles";
+    const result = await apiJson(deps, baseUrl, "GET", path);
+    if (result.status === 0) return proxyUnreachable();
+    if (result.status !== 200) return apiError(result.json, `failed to ${sub} native profiles`);
+    if (wantsJson || sub === "doctor") console.log(JSON.stringify(result.json, null, 2));
+    else printProfiles(Array.isArray(result.json.profiles) ? result.json.profiles as PublicProfile[] : []);
+    return 0;
+  }
+
+  if (sub === "register") {
+    const label = args.shift();
+    if (!label || args.length > 0 || confirmed || rollback) return reject(args);
+    const result = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/register", { label });
+    if (result.status === 0) return proxyUnreachable();
+    if (result.status !== 200) return apiError(result.json, "failed to register the current native login");
+    if (wantsJson) console.log(JSON.stringify(result.json, null, 2));
+    else console.log(`Registered '${label}' for ${effectiveCodexHome(result.json)}.`);
+    return 0;
+  }
+
+  if (sub === "add") {
+    const label = args.shift();
+    if (!label || args.length > 0 || wantsJson || confirmed || rollback) return reject(args);
+    const stage = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/stage", {});
+    if (stage.status === 0) return proxyUnreachable();
+    if (stage.status !== 200) return apiError(stage.json, "failed to prepare native login staging");
+    const stageId = typeof stage.json.stageId === "string" ? stage.json.stageId : "";
+    const writerToken = typeof stage.json.writerToken === "string" ? stage.json.writerToken : "";
+    const stagingHome = typeof stage.json.stagingCodexHome === "string" ? stage.json.stagingCodexHome : "";
+    const leaseExpiresAt = typeof stage.json.leaseExpiresAt === "number" ? stage.json.leaseExpiresAt : 0;
+    const heartbeatIntervalMs = typeof stage.json.heartbeatIntervalMs === "number"
+      ? Math.min(5 * 60_000, Math.max(deps.stageHeartbeatIntervalMinMs ?? 5_000, stage.json.heartbeatIntervalMs))
+      : 60_000;
+    const stageLeaseClock = deps.stageLeaseClock ?? systemStageLeaseClock;
+    const stagedEffectiveHome = effectiveCodexHome(stage.json);
+    let exitCode = 1;
+    let finished = false;
+    let leaseLost = false;
+    try {
+      if (!stageId || !writerToken || !isAbsolute(stagingHome) || leaseExpiresAt <= stageLeaseClock.now()) {
+        throw new Error("The proxy returned an invalid staging session.");
+      }
+      console.error(`Effective CODEX_HOME: ${stagedEffectiveHome}`);
+      console.error(`Starting official Codex login in restricted staging home: ${stagingHome}`);
+      const child = deps.spawnCodexLoginImpl
+        ? deps.spawnCodexLoginImpl(stagingHome)
+        : deps.runCodexLoginImpl
+          ? { exited: deps.runCodexLoginImpl(stagingHome), kill: () => {} }
+          : spawnOfficialCodexLogin(stagingHome);
+      const heartbeatAbort = new AbortController();
+      const heartbeat = maintainStageLease(
+        deps,
+        baseUrl,
+        stageId,
+        writerToken,
+        leaseExpiresAt,
+        heartbeatIntervalMs,
+        child,
+        heartbeatAbort.signal,
+        stageLeaseClock,
+      );
+      try {
+        exitCode = await child.exited;
+      } finally {
+        heartbeatAbort.abort();
+        leaseLost = (await heartbeat).lost;
+      }
+      if (leaseLost) throw new Error("The native-login staging lease was lost before login completed.");
+      if (exitCode !== 0) throw new Error("Official Codex login did not complete successfully.");
+      const finish = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/stage/finish", { stageId, writerToken, label });
+      if (finish.status === 0) return proxyUnreachable();
+      if (finish.status !== 200) return apiError(finish.json, "failed to encrypt the staged native login");
+      finished = true;
+      console.log(`Added encrypted native profile '${label}' for ${effectiveCodexHome(finish.json)}.`);
+      return 0;
+    } catch (error) {
+      console.error(`Error: ${error instanceof Error ? error.message : "Official Codex login failed."}`);
+      return exitCode === 0 ? 1 : exitCode;
+    } finally {
+      if (stageId && !finished) {
+        const cleanup = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/stage/cancel", { stageId, writerToken });
+        if (cleanup.status !== 200 || cleanup.json.plaintextMayRemain === true) {
+          console.error("Error: the proxy could not confirm native-login staging cleanup; run account main doctor.");
+        }
+      }
+    }
+  }
+
+  if (sub === "switch") {
+    const target = args.shift();
+    if (!target || args.length > 0 || rollback || !confirmed) {
+      if (!confirmed) console.error("Close Codex App/CLI, then pass --yes to confirm it is stopped.");
+      return reject(args);
+    }
+    const result = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/switch", { target, confirmedStopped: true });
+    if (result.status === 0) return proxyUnreachable();
+    if (result.status !== 200) return apiError(result.json, "failed to switch the native login");
+    if (wantsJson) console.log(JSON.stringify(result.json, null, 2));
+    else {
+      const profile = result.json.activeProfile as PublicProfile | undefined;
+      console.log(`Native Codex login for ${effectiveCodexHome(result.json)} is now '${profile?.label ?? target}'. Restart Codex App/CLI before continuing.`);
+    }
+    return 0;
+  }
+
+  if (sub === "recover") {
+    if (args.length > 0 || (rollback && !confirmed)) {
+      if (rollback && !confirmed) console.error("--rollback changes the native login and requires --yes.");
+      return reject(args);
+    }
+    const result = await apiJson(deps, baseUrl, "POST", "/api/native-main-profiles/recover", rollback
+      ? { rollback: true, confirmedStopped: true }
+      : { rollback: false });
+    if (result.status === 0) return proxyUnreachable();
+    if (result.status !== 200) return apiError(result.json, "failed to recover the native-profile transaction");
+    if (wantsJson) console.log(JSON.stringify(result.json, null, 2));
+    else {
+      const home = effectiveCodexHome(result.json);
+      console.log(result.json.recovered === true
+        ? `Recovery completed for ${home}: ${String(result.json.action ?? "converged")}.`
+        : `No recovery journal is pending for ${home}.`);
+    }
+    return 0;
+  }
+
+  return reject(args);
+}

package/src/cli/account.ts

@@ -29,6 +29,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account code <provider> [--flow <flow-id>] [--json]   (reads the code from stdin)
   ocx account cancel <provider> [--flow <flow-id>] [--json]
   ocx account reset-credits <account-id|main> [--consume --yes] [--json]
+  ocx account main <doctor|list|register|add|switch|recover> ...
 
 List and switch provider accounts and API-key pools (masked output only).
 'main' selects the Codex App login for the openai account pool.`;
@@ -262,6 +263,10 @@ export async function cmdAccount(args: string[], deps: AccountDeps = {}): Promis
     if (sub === "remove") return await cmdRemove(rest, deps);
     if (sub === "clear-cooldown") return await cmdClearCooldown(rest, deps);
     if (sub === "add-key") return await cmdAddKey(rest, deps);
+    if (sub === "main") {
+      const { cmdNativeMainAccount } = await import("./account-main");
+      return await cmdNativeMainAccount(rest, deps);
+    }
     if (["login", "reauth", "code", "cancel", "reset-credits"].includes(sub ?? "")) {
       const { handleAccountAuthCommand } = await import("./account-auth");
       return await handleAccountAuthCommand(sub!, rest, deps) ?? 1;

package/src/cli/claude.ts

@@ -17,6 +17,7 @@ import type { OcxConfig } from "../types";
 import { configuredAdminToken } from "../lib/admin-secrets";
 import { PROXY_MARKER, ownAdmissionTokens, defaultAuthDetectDeps, detectClaudeAuth, type AuthDetectDeps } from "../claude/auth-detect";
 import { resolveClaudeAuthMode } from "../claude/auth-mode";
+import { withProcessRuntimeProvenance } from "../lib/bun-runtime";
 
 export interface ClaudeLaunchEnv {
   [key: string]: string | undefined;
@@ -205,7 +206,7 @@ async function ensureProxyForClaude(): Promise<number | null> {
     detached: true,
     stdio: "ignore",
     windowsHide: true,
-    env: { ...process.env, OCX_SERVICE: "1" },
+    env: withProcessRuntimeProvenance({ ...process.env, OCX_SERVICE: "1" }),
   });
   child.unref();
   const deadline = Date.now() + 8_000;