@bitkyc08/opencodex 2.10.1 → 2.10.2

package/src/cli/launcher-context.ts

@@ -0,0 +1,77 @@
+/**
+ * Trusted facts captured by the plain-Node npm launcher before Bun auto-loads
+ * project dotenv files. The random proof travels in argv while the context
+ * travels in the environment, so a project `.env` cannot forge the pair during
+ * an ordinary `ocx ...` invocation.
+ */
+export const NODE_LAUNCH_CONTEXT_ENV = "OCX_NODE_LAUNCH_CONTEXT";
+export const NODE_LAUNCH_PROOF_PREFIX = "--ocx-internal-launch-proof=";
+
+export const ANTHROPIC_PARENT_ENV_SLOTS = [
+  "ANTHROPIC_API_KEY",
+  "ANTHROPIC_AUTH_TOKEN",
+  "ANTHROPIC_BASE_URL",
+] as const;
+
+export type AnthropicParentEnvSlot = typeof ANTHROPIC_PARENT_ENV_SLOTS[number];
+
+export type TrustedNodeLaunchContext = {
+  anthropicEnvSlots: readonly AnthropicParentEnvSlot[];
+};
+
+let trustedContext: TrustedNodeLaunchContext | null = null;
+
+function isLaunchProof(value: string): boolean {
+  return /^[A-Za-z0-9_-]{43}$/.test(value);
+}
+
+/** Consume the internal proof before normal CLI argument parsing. */
+export function initializeNodeLauncherContext(
+  argv: string[] = process.argv,
+  env: NodeJS.ProcessEnv = process.env,
+): TrustedNodeLaunchContext | null {
+  const proofArgs: string[] = [];
+  for (let index = argv.length - 1; index >= 2; index -= 1) {
+    const value = argv[index];
+    if (!value?.startsWith(NODE_LAUNCH_PROOF_PREFIX)) continue;
+    proofArgs.push(value.slice(NODE_LAUNCH_PROOF_PREFIX.length));
+    argv.splice(index, 1);
+  }
+
+  const raw = env[NODE_LAUNCH_CONTEXT_ENV];
+  delete env[NODE_LAUNCH_CONTEXT_ENV];
+  // Older launchers used this unauthenticated marker. Never let a project
+  // dotenv resurrect it as a trusted provenance channel.
+  delete env.OCX_PRE_BUN_ANTHROPIC_ENV;
+  trustedContext = null;
+
+  if (proofArgs.length !== 1 || !raw || raw.length > 2048) return null;
+  const proof = proofArgs[0]!;
+  if (!isLaunchProof(proof)) return null;
+
+  try {
+    const parsed = JSON.parse(raw) as {
+      version?: unknown;
+      proof?: unknown;
+      anthropicEnvSlots?: unknown;
+    };
+    if (parsed.version !== 1 || parsed.proof !== proof || !Array.isArray(parsed.anthropicEnvSlots)) {
+      return null;
+    }
+    const allowed = new Set<string>(ANTHROPIC_PARENT_ENV_SLOTS);
+    const slots = parsed.anthropicEnvSlots.filter(
+      (slot): slot is AnthropicParentEnvSlot => typeof slot === "string" && allowed.has(slot),
+    );
+    if (slots.length !== parsed.anthropicEnvSlots.length || new Set(slots).size !== slots.length) {
+      return null;
+    }
+    trustedContext = { anthropicEnvSlots: slots };
+    return trustedContext;
+  } catch {
+    return null;
+  }
+}
+
+export function trustedNodeLauncherContext(): TrustedNodeLaunchContext | null {
+  return trustedContext;
+}

package/src/codex/admission.ts

@@ -16,7 +16,7 @@
  * READS ONLY. Nothing here creates a directory, a database, or a marker: an
  * admission that manufactures the state it is admitting cannot refuse.
  *
- * Design record: devlog/_plan/260804_codex_write_substrate/040_ownership_convergence.md.
+ * Design record: devlog/_fin/260804_codex_write_substrate/040_ownership_convergence.md.
  */
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";

package/src/codex/app-server-processes.ts

@@ -407,7 +407,9 @@ export function listCodexAppServerProcesses(io: CodexAppServerProcessIo = {}): C
   return matched;
 }
 
-export function formatStaleCodexAppServerWarning(processes: readonly CodexAppServerProcess[]): string {
+export function formatStaleCodexAppServerWarning(
+  processes: readonly { pid: number }[],
+): string {
   const pids = processes.map(process => process.pid).join(", ");
   return (
     `WARNING: ${processes.length} Codex app-server process(es) still running (PID${processes.length === 1 ? "" : "s"}: ${pids}). `
@@ -754,3 +756,44 @@ export function afterCatalogWriteHandleAppServers(
   }
   return { processes, warned: false, restart, hint };
 }
+
+/**
+ * Startup-safe counterpart to {@link afterCatalogWriteHandleAppServers} (#1046).
+ *
+ * Service startup rewrites the catalog and the models cache, but an app-server
+ * that booted earlier keeps an in-memory model list — Codex builds a static
+ * manager from the catalog once and never rereads the file — so the picker shows
+ * a roster that no longer exists on disk. Every check a user runs reads the file;
+ * the picker renders memory.
+ *
+ * Two things this deliberately does NOT do, both of which the `--restart-codex`
+ * path does:
+ *
+ * - It never signals anything. Killing an app-server on an unattended boot would
+ *   interrupt whatever turn the user has in flight. A human typing
+ *   `ocx sync --restart-codex` is consenting to that; a login is not.
+ * - It never warns about a merely-running app-server. It asks the mtime
+ *   classifier whether one is actually stale, so a boot with Codex open and a
+ *   current catalog stays quiet.
+ *
+ * Failure is swallowed: startup synchronization is best-effort and must not stop
+ * the proxy from coming up.
+ *
+ * The memoized state is dropped first. {@link collectCodexAppServerCatalogState}
+ * caches for 5s when every io field is defaulted, so a `fresh` reading taken
+ * before the write would otherwise be replayed after it and this would stay
+ * silent about the very staleness it exists to report.
+ */
+export function warnIfStaleCodexAppServersAfterStartupWrite(
+  options: { log?: Pick<Console, "error">; io?: CodexAppServerProcessIo } = {},
+): { warned: boolean } {
+  try {
+    resetCodexAppServerCatalogStateCache();
+    const status = collectCodexAppServerCatalogState(options.io ?? {});
+    if (status.state !== "stale") return { warned: false };
+    options.log?.error(formatStaleCodexAppServerWarning(status.processes));
+    return { warned: true };
+  } catch {
+    return { warned: false };
+  }
+}

package/src/codex/catalog/sync.ts

@@ -11,7 +11,6 @@ import { modelInList } from "../../types";
 import { CODEX_REASONING_LEVELS, codexEffortRank, configuredReasoningEfforts, modelRecordValue, sanitizeCodexReasoningEfforts } from "../../reasoning-effort";
 import { getJawcodeModelMetadata, getJawcodeModelMetadataCaseInsensitive, listJawcodeModelMetadata, resolveJawcodeProvider } from "../../generated/jawcode-model-metadata";
 import { enrichProviderFromRegistry, shouldCaseFoldMetadataModelId } from "../../providers/derive";
-import { getProviderRegistryEntry } from "../../providers/registry";
 import { applyProviderContextCap, providerContextCap } from "../../providers/context-cap";
 import { routedSlug, slugEquals, slugsEquivalent } from "../../providers/slug-codec";
 import { identifyRoutedModel } from "../../adapters/identity";
@@ -200,6 +199,26 @@ export function isExactComboCatalogModel(
   return model !== undefined && exactComboSlugs.has(catalogModelSlug(model));
 }
 
+/**
+ * Friendly Codex-picker label for a routed `provider/model` slug. Command Code's two config
+ * ids differ by a single dash (`command-code` vs `commandcode`), so relabel them to the
+ * lowercase-dash style the opencode presets use: `commandcode-auth/x` and `commandcode-api/x`.
+ * The model-id portion also carries a redundant `<vendor>-` prefix (`deepseek-deepseek-v4-flash`)
+ * that is dropped for display. All other providers keep the raw slug exactly as before.
+ */
+function routedDisplayName(slug: string): string {
+  const slash = slug.indexOf("/");
+  if (slash <= 0) return slug;
+  const provider = slug.slice(0, slash);
+  let model = slug.slice(slash + 1);
+  if (provider === "command-code" || provider === "commandcode") {
+    const m = model.match(/^([a-z0-9]+)-([a-z0-9]+(?:-[a-z0-9]+)+)$/i);
+    if (m && model.startsWith(`${m[1]}-${m[1]}-`)) model = model.slice(m[1]!.length + 1);
+    return `${provider === "command-code" ? "commandcode-auth" : "commandcode-api"}/${model}`;
+  }
+  return slug;
+}
+
 export function deriveEntry(
   template: RawEntry | null,
   slug: string,
@@ -220,7 +239,7 @@ export function deriveEntry(
   if (template) {
     const e = JSON.parse(JSON.stringify(template)) as RawEntry;
     e.slug = slug;
-    e.display_name = slug;
+    e.display_name = routedDisplayName(slug);
     e.description = desc;
     e.priority = priority;
     e.visibility = "list";
@@ -271,7 +290,7 @@ export function deriveEntry(
   }
   // Fallback when no template is available (best-effort; strict parser may need more).
   const entry: RawEntry = {
-    slug, display_name: slug, description: desc,
+    slug, display_name: routedDisplayName(slug), description: desc,
     shell_type: "shell_command", visibility: "list", supported_in_api: true,
     priority, base_instructions: "You are a helpful coding assistant.",
     ...(isRouted ? { web_search_tool_type: "text_and_image", supports_search_tool: true } : {}),

package/src/codex/catalog-write-serialization.ts

@@ -22,7 +22,7 @@
  * advances the native pair. Order is `N -> K -> C`; there is no `C -> K` and no
  * `K -> N` (`005_contract.md:660-762`).
  *
- * Design record: devlog/_plan/260804_codex_write_substrate/005_contract.md §3.
+ * Design record: devlog/_fin/260804_codex_write_substrate/005_contract.md §3.
  */
 import { chmodSync, lstatSync, realpathSync } from "node:fs";
 

package/src/codex/codex-write-lock.ts

@@ -26,7 +26,7 @@
  * Lock order is `N -> C`. C is `withConfigMutationLockSync`, entered while N is
  * held and released before N commits. There is no `C -> N`.
  *
- * Design record: devlog/_plan/260804_codex_write_substrate/030_lock_protocol.md.
+ * Design record: devlog/_fin/260804_codex_write_substrate/030_lock_protocol.md.
  */
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash } from "node:crypto";

package/src/codex/convergence-types.ts

@@ -6,7 +6,7 @@
  * of the record schema, the /api/sync contract, and the convergence entry
  * point; the contract is centralized here so a consumer can only import.
  *
- * Design record: devlog/_plan/260804_codex_write_substrate/005_contract.md
+ * Design record: devlog/_fin/260804_codex_write_substrate/005_contract.md
  * Audit trail: 006, 007, 008, 009, 010 audit syntheses in the same unit.
  *
  * TYPES ONLY. WP8b deliberately rewires nothing: WP9 supplies the first

package/src/codex/desired-state.ts

@@ -27,7 +27,17 @@ import type { OcxClientIntegrationsConfig, OcxConfig } from "../types";
 export type DurableIntentClientId = keyof OcxClientIntegrationsConfig;
 
 /** Injectable for tests; production passes the real sync. */
-export type CodexStartupSync = (port: number) => Promise<unknown>;
+/**
+ * The startup sync result the caller needs to decide whether anything was
+ * actually written (#1046). It used to be `unknown`, so "a write happened" was
+ * not observable at the startup boundary and no post-write action could be
+ * gated on it.
+ */
+export interface CodexStartupSyncOutcome {
+  catalogWritten: boolean;
+  cacheSynced: boolean;
+}
+export type CodexStartupSync = (port: number) => Promise<CodexStartupSyncOutcome | undefined>;
 
 export type CodexDesiredStateResult =
   | { readonly ok: true; readonly status: "committed" | "unchanged"; readonly enabled: boolean }
@@ -143,19 +153,29 @@ export function setGrokIntegrationEnabled(enabled: boolean): CodexDesiredStateRe
  * Swallowing the user's decision was not.
  *
  * Returns whether the sync ran, so a caller — or a test — can tell "skipped
- * because the user turned it off" from "ran and quietly failed".
+ * because the user turned it off" from "ran and quietly failed", plus what it
+ * wrote when it did run (#1046 — the caller warns about stale app-servers only
+ * after a real write).
  */
 export async function syncCodexOnStartIfEnabled(
   port: number,
   config: Pick<OcxConfig, "clientIntegrations">,
   sync: CodexStartupSync = defaultStartupSync,
-): Promise<boolean> {
-  if (!codexIntegrationEnabled(config)) return false;
-  await sync(port).catch(() => {});
-  return true;
+): Promise<{ ran: boolean; catalogWritten: boolean; cacheSynced: boolean }> {
+  if (!codexIntegrationEnabled(config)) {
+    return { ran: false, catalogWritten: false, cacheSynced: false };
+  }
+  // The `.catch` is deliberate and stays: a failure to APPLY must not stop the
+  // proxy from coming up. A failed sync simply reports no writes.
+  const outcome = await sync(port).catch(() => undefined);
+  return {
+    ran: true,
+    catalogWritten: outcome?.catalogWritten === true,
+    cacheSynced: outcome?.cacheSynced === true,
+  };
 }
 
-async function defaultStartupSync(port: number): Promise<unknown> {
+async function defaultStartupSync(port: number): Promise<CodexStartupSyncOutcome> {
   const { syncModelsToCodex } = await import("./sync");
   return syncModelsToCodex(port);
 }

package/src/codex/history-job.ts

@@ -14,7 +14,7 @@
  * exception crossing back into a route that already persisted its mutation — is
  * how a successful change gets reported as a 500.
  *
- * Design record: devlog/_plan/260804_codex_write_substrate/020_history_isolation.md.
+ * Design record: devlog/_fin/260804_codex_write_substrate/020_history_isolation.md.
  */
 import { randomUUID } from "node:crypto";
 import { join } from "node:path";

package/src/codex/history-lock.ts

@@ -27,7 +27,7 @@
  * So every history mutator asks this module at runtime whether the permit it was
  * handed is still live for the state database it is about to write.
  *
- * Design record: devlog/_plan/260804_codex_write_substrate/005_contract.md §6.
+ * Design record: devlog/_fin/260804_codex_write_substrate/005_contract.md §6.
  */
 import { chmodSync, lstatSync, realpathSync } from "node:fs";
 

package/src/codex/history-worker.ts

@@ -21,7 +21,7 @@
  * at import time, so a request that leaned on those constants would silently
  * address the wrong home.
  *
- * Design record: devlog/_plan/260804_codex_write_substrate/020_history_isolation.md.
+ * Design record: devlog/_fin/260804_codex_write_substrate/020_history_isolation.md.
  */
 import { withHistoryWriteSerialization } from "./history-lock";
 import {

package/src/codex/internal/history-writer.ts

@@ -21,7 +21,7 @@
  * root. Readers and probes stay in `history-provider.ts`; nothing in the CLI, the
  * server, the guardian, `inject.ts` or `sync.ts` may reach these symbols.
  *
- * Design record: devlog/_plan/260804_codex_write_substrate/020_history_isolation.md.
+ * Design record: devlog/_fin/260804_codex_write_substrate/020_history_isolation.md.
  */
 import { assertHistoryWritePermit, type HistoryWritePermit } from "../history-lock";
 import {

package/src/codex/transition-state.ts

@@ -7,7 +7,7 @@
  * UPDATE, and the opaque one-shot capability backed by an already-open
  * `BEGIN IMMEDIATE` transaction.
  *
- * Design record: devlog/_plan/260804_codex_write_substrate/005_contract.md §1.
+ * Design record: devlog/_fin/260804_codex_write_substrate/005_contract.md §1.
  */
 import { randomUUID } from "node:crypto";
 import { chmodSync, lstatSync, realpathSync } from "node:fs";

package/src/codex/user-identity.ts

@@ -6,7 +6,7 @@
  * could therefore coordinate through different databases. The namespace is
  * keyed only by the effective uid/SID and the canonical CODEX_HOME.
  *
- * Design record: devlog/_plan/260804_codex_write_substrate/005_contract.md §7.
+ * Design record: devlog/_fin/260804_codex_write_substrate/005_contract.md §7.
  */
 import { createHash } from "node:crypto";
 import {

package/src/config.ts

@@ -38,6 +38,7 @@ import {
 } from "./lib/windows-secret-acl";
 import { recordOwnedConfigPath } from "./lib/config-ownership";
 import { assertNotRealHomeUnderTest } from "./lib/test-home-guard";
+import { isLocalAttestationSecret } from "./lib/local-management-attestation";
 import { providerDestinationConfigError } from "./lib/destination-policy";
 import { redactSecretString } from "./lib/redact";
 import { openRouterRoutingConfigError } from "./providers/openrouter-routing";
@@ -2608,18 +2609,22 @@ export type RuntimePortState = {
   pid: number;
   port: number;
   hostname?: string;
+  /** Per-process proof key; protected by the config directory and never served. */
+  attestationSecret?: string;
 };
 
 function isValidRuntimePortState(value: unknown): value is RuntimePortState {
   if (!value || typeof value !== "object") return false;
   const state = value as Record<string, unknown>;
   const hostnameOk = state.hostname === undefined || typeof state.hostname === "string";
+  const attestationOk = state.attestationSecret === undefined || isLocalAttestationSecret(state.attestationSecret);
   return Number.isSafeInteger(state.pid)
     && Number(state.pid) > 0
     && Number.isInteger(state.port)
     && Number(state.port) > 0
     && Number(state.port) <= 65535
-    && hostnameOk;
+    && hostnameOk
+    && attestationOk;
 }
 
 export function writeRuntimePort(state: RuntimePortState): void {

package/src/integrations/config-io.ts

@@ -5,7 +5,7 @@
  * needs it too, and a reader that disagreed with the writer about what counts
  * as an absent file is exactly how an unreadable config gets overwritten.
  *
- * Design of record: devlog/_plan/260802_client_toggle_api/021 §5-6.
+ * Design of record: devlog/_fin/260802_client_toggle_api/021 §5-6.
  */
 import { mkdirSync, readFileSync, rmSync, statSync } from "node:fs";
 import type { ConfigFormat } from "../clients/config-export";

package/src/integrations/journal.ts

@@ -10,7 +10,7 @@
  *    verbatim — so they go through `atomicWriteFile`, which applies 0600 plus
  *    Windows ACL hardening.
  *
- * Design of record: devlog/_plan/260802_client_toggle_api/021 §4.
+ * Design of record: devlog/_fin/260802_client_toggle_api/021 §4.
  */
 import { randomUUID } from "node:crypto";
 import { appendFileSync, existsSync, readFileSync, readdirSync, rmSync } from "node:fs";

package/src/integrations/merge.ts

@@ -7,7 +7,7 @@
  * remove, and inferring ownership from a name is how a config editor destroys
  * work it did not create.
  *
- * Design of record: devlog/_plan/260802_client_toggle_api/031_wp3_writer_impl.md.
+ * Design of record: devlog/_fin/260802_client_toggle_api/031_wp3_writer_impl.md.
  */
 import type { ManagedContribution } from "../clients/config-export";
 

package/src/integrations/ownership.ts

@@ -7,7 +7,7 @@
  * conflating them is what lets a foreign edit read as ordinary drift — which
  * would then be silently overwritten.
  *
- * Design of record: devlog/_plan/260802_client_toggle_api/021 §2.
+ * Design of record: devlog/_fin/260802_client_toggle_api/021 §2.
  */
 import { createHash } from "node:crypto";
 import { mkdirSync, readFileSync } from "node:fs";

package/src/integrations/registry.ts

@@ -6,7 +6,7 @@
  * client's config. This one says where it lives, how to tell whether the client
  * is installed at all, and whether a remote bind is safe for it.
  *
- * Design of record: devlog/_plan/260802_client_toggle_api/021 §1.
+ * Design of record: devlog/_fin/260802_client_toggle_api/021 §1.
  */
 import { homedir } from "node:os";
 import { join } from "node:path";

package/src/integrations/serialize.ts

@@ -21,7 +21,7 @@
  * might misread — and the writer turns the failure into a structured refusal
  * rather than an exception.
  *
- * Design of record: devlog/_plan/260802_client_toggle_api/011_wp1_builders.md.
+ * Design of record: devlog/_fin/260802_client_toggle_api/011_wp1_builders.md.
  */
 
 export type ConfigFormat = "json" | "yaml" | "toml" | "json5";

package/src/integrations/state.ts

@@ -6,7 +6,7 @@
  * be reported as ordinary drift. Getting that wrong would let `disable` delete
  * a user's own edits.
  *
- * Design of record: devlog/_plan/260802_client_toggle_api/021 §3.
+ * Design of record: devlog/_fin/260802_client_toggle_api/021 §3.
  */
 import { ClientPathError, EXPORT_CLIENTS, opencodeProxyBaseUrl, type ExportModel, type ManagedContribution } from "../clients/config-export";
 import type { OcxConfig } from "../types";

package/src/integrations/store.ts

@@ -8,7 +8,7 @@
  * bookkeeping seams to that same store so the two can never point at different
  * roots.
  *
- * Design of record: devlog/_plan/260802_client_toggle_api/006 §Config-dir seam.
+ * Design of record: devlog/_fin/260802_client_toggle_api/006 §Config-dir seam.
  */
 import {
   appendOperation,

package/src/integrations/writer.ts

@@ -7,7 +7,7 @@
  * file is not in a state we can reason about. A disable that deletes work the
  * user did after us would be worse than never shipping the feature.
  *
- * Design of record: devlog/_plan/260802_client_toggle_api/030 and 031.
+ * Design of record: devlog/_fin/260802_client_toggle_api/030 and 031.
  */
 import { dirname } from "node:path";
 import { EXPORT_CLIENTS, type ExportModel } from "../clients/config-export";

package/src/lib/bounded-body.ts

@@ -23,6 +23,8 @@ export interface BoundedBodyOptions {
 	totalTimeoutMs?: number;
 	/** Deadline between non-empty raw chunks. Exposed for focused tests. */
 	inactivityTimeoutMs?: number;
+	/** Deadline for the first non-empty raw chunk. Defaults to inactivityTimeoutMs. */
+	firstByteTimeoutMs?: number;
 }
 
 export interface BoundedBodyResult {
@@ -129,7 +131,7 @@ export async function readBoundedResponseBody(
 	let cancelReason: unknown;
 	const total = timeoutPromise(options.totalTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS, TOTAL_TIMEOUT);
 	let inactivity = timeoutPromise(
-		options.inactivityTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS,
+		options.firstByteTimeoutMs ?? options.inactivityTimeoutMs ?? BOUNDED_BODY_TIMEOUT_MS,
 		INACTIVITY_TIMEOUT,
 	);
 

package/src/lib/bun-runtime.ts

@@ -12,7 +12,7 @@
  */
 import { createRequire } from "node:module";
 import { realpathSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { dirname, join } from "node:path";
 import { isRealBunBinary } from "./bun-binary-validator.mjs";
 
 export { isRealBunBinary };
@@ -108,19 +108,23 @@ export function withProcessRuntimeProvenance(
  * exact executable, otherwise what this executable actually is.
  */
 function currentRuntimeProvenance(env: NodeJS.ProcessEnv): DurableBunRuntime {
-  const claimed = reportedBunRuntimeSource(env);
-  const claimedPath = env[BUN_RUNTIME_PATH_ENV]?.trim();
-  if (claimed && claimedPath && samePath(claimedPath, process.execPath)) {
-    return { path: process.execPath, source: claimed, overrideEnv: BUN_OVERRIDE_ENV };
-  }
+  const recorded = recordedCurrentRuntime(env);
+  if (recorded) return recorded;
   // No marker that describes this binary: report what is running. One resolution
   // supplies both halves so the pair can never disagree.
-  const runtime = durableBunRuntime();
+  const runtime = unmarkedDurableBunRuntime();
   return samePath(runtime.path, process.execPath)
     ? runtime
     : { path: process.execPath, source: "process", overrideEnv: BUN_OVERRIDE_ENV };
 }
 
+function recordedCurrentRuntime(env: NodeJS.ProcessEnv): DurableBunRuntime | null {
+  const source = reportedBunRuntimeSource(env);
+  const path = env[BUN_RUNTIME_PATH_ENV]?.trim();
+  if (!source || !path || !samePath(path, process.execPath)) return null;
+  return { path, source, overrideEnv: BUN_OVERRIDE_ENV };
+}
+
 /**
  * Same file, allowing for the aliases a path can pick up between launch and relaunch:
  * symlinks/junctions, mapped drives, and Windows case differences. Falls back to a
@@ -154,21 +158,21 @@ export function bundledBunPath(): string | null {
   }
 }
 
-export function overrideBunPath(): string | null {
-  const value = process.env[BUN_OVERRIDE_ENV]?.trim();
-  if (!value) return null;
-  const resolved = resolve(value);
-  return isRealBunBinary(resolved) ? resolved : null;
-}
-
-export function durableBunRuntime(): DurableBunRuntime {
-  const override = overrideBunPath();
-  if (override) return { path: override, source: "override", overrideEnv: BUN_OVERRIDE_ENV };
+function unmarkedDurableBunRuntime(): DurableBunRuntime {
   const bundled = bundledBunPath();
   if (bundled) return { path: bundled, source: "bundled", overrideEnv: BUN_OVERRIDE_ENV };
   return { path: process.execPath, source: "process", overrideEnv: BUN_OVERRIDE_ENV };
 }
 
+export function durableBunRuntime(): DurableBunRuntime {
+  // A durable artifact must use the runtime selected BEFORE Bun auto-loaded a
+  // project dotenv. The Node launcher and owned service/shim launchers stamp the
+  // selected source/path pair; it is accepted only when it names this exact
+  // running executable. Re-reading OPENCODEX_BUN_PATH here would let a project
+  // `.env` persist an arbitrary executable into a shim or service.
+  return recordedCurrentRuntime(process.env) ?? unmarkedDurableBunRuntime();
+}
+
 /**
  * Bun path to bake into durable artifacts (launchd/systemd/Task Scheduler and
  * the Codex auto-start shim). Prefer the bundled binary — it lives under the

package/src/lib/bun-stream-caps.ts

@@ -10,7 +10,7 @@
  * safety pin. Darwin no-rewrite traffic stays on tee
  * for `auto` regardless of runtime capability and reaches eager relay only via
  * explicit `streamMode: "eager-relay"` opt-in (see
- * devlog/_plan/260731_macos_rss_retention/100_darwin_eager_optin.md).
+ * devlog/_fin/260731_macos_rss_retention/100_darwin_eager_optin.md).
  *
  * Prerelease conservatism: a version carrying a prerelease suffix (e.g.
  * `1.4.0-canary.3`) is NEVER treated as fixed even when its numeric triple

package/src/lib/local-management-attestation.ts

@@ -0,0 +1,51 @@
+import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
+
+export const LOCAL_ATTESTATION_CHALLENGE_HEADER = "x-opencodex-attestation-challenge";
+export const LOCAL_ATTESTATION_PROOF_HEADER = "x-opencodex-attestation-proof";
+
+const BASE64URL_256 = /^[A-Za-z0-9_-]{43}$/;
+
+export function isLocalAttestationSecret(value: unknown): value is string {
+  return typeof value === "string" && BASE64URL_256.test(value);
+}
+
+export function createLocalAttestationSecret(): string {
+  return randomBytes(32).toString("base64url");
+}
+
+export function createLocalAttestationChallenge(): string {
+  return randomBytes(32).toString("base64url");
+}
+
+function attestationPayload(challenge: string, pid: number, port: number): string | null {
+  if (!BASE64URL_256.test(challenge)) return null;
+  if (!Number.isSafeInteger(pid) || pid <= 0) return null;
+  if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;
+  return `opencodex-local-management-v1\n${challenge}\n${pid}\n${port}`;
+}
+
+export function createLocalAttestationProof(
+  secret: string,
+  challenge: string,
+  pid: number,
+  port: number,
+): string | null {
+  if (!isLocalAttestationSecret(secret)) return null;
+  const payload = attestationPayload(challenge, pid, port);
+  if (!payload) return null;
+  return createHmac("sha256", secret).update(payload).digest("base64url");
+}
+
+export function verifyLocalAttestationProof(
+  secret: string,
+  challenge: string,
+  pid: number,
+  port: number,
+  proof: string | null,
+): boolean {
+  const expected = createLocalAttestationProof(secret, challenge, pid, port);
+  if (!expected || !proof || !BASE64URL_256.test(proof)) return false;
+  const expectedBytes = Buffer.from(expected);
+  const actualBytes = Buffer.from(proof);
+  return expectedBytes.length === actualBytes.length && timingSafeEqual(expectedBytes, actualBytes);
+}

package/src/lib/shadow-call.ts

@@ -1,13 +1,13 @@
 /**
  * Shadow-call intercept source models.
  *
- * Codex's hard-coded helper model is not stable across client versions: it was
- * `gpt-5.4-mini` up to 0.144.x and became `gpt-5.6-luna` in 0.145.0. The
- * intercept therefore matches a prefix SET, and every surface that names the
+ * Codex 0.145.0+ uses `gpt-5.6-luna` for helper calls. Older clients through
+ * 0.144.x used `gpt-5.4-mini`; operators supporting them can restore that
+ * prefix with the `sourceModels` override. Every surface that names the
  * intercepted model (management API, GUI badges/tooltips, CLI) reads it from
  * here instead of hard-coding a slug that goes stale on the next client bump.
  */
-export const DEFAULT_SHADOW_SOURCE_MODELS = ["gpt-5.4-mini", "gpt-5.6-luna"] as const;
+export const DEFAULT_SHADOW_SOURCE_MODELS = ["gpt-5.6-luna"] as const;
 
 /** Normalize a persisted `sourceModels` override; falls back to the defaults. */
 export function shadowSourceModels(configured?: unknown): string[] {