@bitkyc08/opencodex 2.11.1 → 2.12.0

package/src/cli/lab.ts

@@ -0,0 +1,367 @@
+/**
+ * `ocx lab` — read-only Compatibility Lab inspection (CL-04).
+ *
+ * Local SQLite projection reads; no daemon, network, probes, or rebuilds.
+ */
+import { getConfigDir } from "../config";
+import {
+  ARTIFACT_CLASSES,
+  EVIDENCE_LAYERS,
+  EVENT_KINDS,
+  EXECUTION_MODES,
+  OUTCOMES,
+  VERDICTS,
+  type ArtifactClass,
+  type CompatibilityVerdict,
+  type EvidenceLayer,
+  type ExecutionMode,
+  type LabEventKind,
+  type ObservationOutcome,
+} from "../lab/constants";
+import {
+  InvalidCursorError,
+  LabProjectionIncompatibleError,
+  LabProjectionUnavailableError,
+  queryLabArtifactByDigest,
+  queryLabArtifacts,
+  queryLabCatalogEntries,
+  queryLabEventById,
+  queryLabEvents,
+  queryLabObservations,
+  queryLabStatus,
+  queryLabSubjectById,
+  queryLabSubjects,
+  queryLabVerdicts,
+} from "../lab/query";
+import {
+  CliUsageError,
+  RuntimeApiError,
+  printData,
+  rejectArgs,
+  runCliAction,
+  takeFlag,
+  takeIntegerOption,
+  takeOption,
+} from "./runtime-api";
+
+const USAGE = `Usage:
+  ocx lab status [--json]
+  ocx lab verdicts [--subject <id>] [--layer <layer>] [--suite <id>] [--verdict <v>] [--from <ms>] [--to <ms>] [--limit <n>] [--cursor <c>] [--json]
+  ocx lab subjects [--kind <kind>] [--limit <n>] [--cursor <c>] [--json]
+  ocx lab subject <subjectId> [--json]
+  ocx lab observations [--subject <id>] [--layer <layer>] [--suite <id>] [--scenario <id>] [--outcome <o>] [--execution-mode <m>] [--from <ms>] [--to <ms>] [--limit <n>] [--cursor <c>] [--json]
+  ocx lab events [--event-kind <k>] [--subject <id>] [--from <ms>] [--to <ms>] [--excluded <true|false>] [--limit <n>] [--cursor <c>] [--json]
+  ocx lab event <eventId> [--json]
+  ocx lab artifacts [--status <s>] [--artifact-class <c>] [--limit <n>] [--cursor <c>] [--json]
+  ocx lab artifact <digest> [--json]
+  ocx lab catalog [--layer <layer>] [--suite <id>] [--json]`;
+
+const ARTIFACT_STATUSES = ["present", "corrupt", "purged_unavailable"] as const;
+type ArtifactStatus = (typeof ARTIFACT_STATUSES)[number];
+
+export interface LabCliDeps {
+  configDir?: string;
+}
+
+class LabStateError extends RuntimeApiError {
+  constructor(message: string) {
+    super(message, 503, null);
+    this.name = "LabStateError";
+  }
+}
+
+function labErrorMessage(err: unknown): string {
+  if (err instanceof LabProjectionUnavailableError) return "lab projection is not available";
+  if (err instanceof LabProjectionIncompatibleError) return "lab projection schema or spec version is incompatible";
+  if (err instanceof InvalidCursorError) return "invalid cursor";
+  return "lab read failed";
+}
+
+function takeEnumOption<T extends string>(
+  args: string[],
+  flag: string,
+  values: readonly T[],
+  message: string,
+): T | undefined {
+  const raw = takeOption(args, flag);
+  if (raw === undefined) return undefined;
+  if (!(values as readonly string[]).includes(raw)) {
+    throw new CliUsageError(message, USAGE);
+  }
+  return raw as T;
+}
+
+function assertRange(from: number | undefined, to: number | undefined): void {
+  if (from !== undefined && to !== undefined && from > to) {
+    throw new CliUsageError("--from must not be greater than --to", USAGE);
+  }
+}
+
+function appendPaginationHint(
+  lines: string[],
+  page: { hasMore: boolean; nextCursor?: string | null },
+): void {
+  if (page.hasMore) lines.push(`(more available; pass --cursor ${page.nextCursor ?? ""})`);
+}
+
+function statusSummary(status: ReturnType<typeof queryLabStatus>): string[] {
+  if (!status.projectionAvailable) {
+    if (status.projectionIncompatible) return ["Lab projection: incompatible"];
+    return ["Lab projection: unavailable"];
+  }
+  return [
+    "Lab projection: available",
+    `SQLite schema: ${status.sqliteSchemaVersion}`,
+    `Projection spec: ${status.projectionSpecVersion}`,
+    `Built at: ${status.builtAtMs}`,
+    `Events: ${status.eventCount} | Subjects: ${status.subjectCount} | Observations: ${status.observationCount}`,
+    `Claims: ${status.claimCount} | Verdicts: ${status.verdictCount} | Artifacts: ${status.artifactCount}`,
+    `Corruption rows: ${status.corruptionCount}`,
+  ];
+}
+
+function verdictLines(page: ReturnType<typeof queryLabVerdicts>): string[] {
+  const lines = page.items.map((v) =>
+    `${v.verdict} ${v.evidenceLayer} ${v.suiteId} subject=${v.subjectId} asOf=${v.asOf}`,
+  );
+  appendPaginationHint(lines, page);
+  return lines.length > 0 ? lines : ["No verdicts"];
+}
+
+function subjectListLines(page: ReturnType<typeof queryLabSubjects>): string[] {
+  const lines = page.items.map((s) => `${s.subjectId} (${s.subjectKind})`);
+  appendPaginationHint(lines, page);
+  return lines.length > 0 ? lines : ["No subjects"];
+}
+
+function observationLines(page: ReturnType<typeof queryLabObservations>): string[] {
+  const lines = page.items.map((o) =>
+    `${o.outcome} ${o.evidenceLayer} ${o.scenarioId} event=${o.eventId} completed=${o.completedAt}`,
+  );
+  appendPaginationHint(lines, page);
+  return lines.length > 0 ? lines : ["No observations"];
+}
+
+function eventListLines(page: ReturnType<typeof queryLabEvents>): string[] {
+  const lines = page.items.map((e) =>
+    `${e.eventKind} ${e.eventId} recorded=${e.recordedAt}${e.excluded ? " excluded" : ""}`,
+  );
+  appendPaginationHint(lines, page);
+  return lines.length > 0 ? lines : ["No events"];
+}
+
+function artifactLines(page: ReturnType<typeof queryLabArtifacts>): string[] {
+  const lines = page.items.map((a) => `${a.status} ${a.digest} class=${a.artifactClass ?? "unknown"}`);
+  appendPaginationHint(lines, page);
+  return lines.length > 0 ? lines : ["No artifacts"];
+}
+
+function catalogLines(scenarios: ReturnType<typeof queryLabCatalogEntries>): string[] {
+  const lines = scenarios.map((s) =>
+    `${s.evidenceLayer} ${s.suiteId} ${s.scenarioId} digest=${s.scenarioManifestDigest.slice(0, 12)}…`,
+  );
+  return lines.length > 0 ? lines : ["No catalog scenarios"];
+}
+
+export async function handleLabCommand(argv: string[], deps: LabCliDeps = {}): Promise<number> {
+  return runCliAction(async () => {
+    const configDir = deps.configDir ?? getConfigDir();
+    const argvCopy = [...argv];
+    const wantsJson = takeFlag(argvCopy, "--json");
+    const [sub = "status", ...rest] = argvCopy;
+
+    try {
+      switch (sub) {
+        case "status": {
+          rejectArgs(rest, USAGE);
+          const status = queryLabStatus(configDir);
+          printData(status, wantsJson, statusSummary(status));
+          return;
+        }
+        case "verdicts": {
+          const subjectId = takeOption(rest, "--subject");
+          const layer = takeEnumOption<EvidenceLayer>(
+            rest,
+            "--layer",
+            EVIDENCE_LAYERS,
+            "--layer must be a supported evidence layer",
+          );
+          const suiteId = takeOption(rest, "--suite");
+          const verdict = takeEnumOption<CompatibilityVerdict>(
+            rest,
+            "--verdict",
+            VERDICTS,
+            "--verdict must be a supported compatibility verdict",
+          );
+          const from = takeIntegerOption(rest, "--from", { min: 0 });
+          const to = takeIntegerOption(rest, "--to", { min: 0 });
+          assertRange(from, to);
+          const limit = takeIntegerOption(rest, "--limit", { min: 1 });
+          const cursor = takeOption(rest, "--cursor");
+          rejectArgs(rest, USAGE);
+          const page = queryLabVerdicts({
+            subjectId,
+            layer,
+            suiteId,
+            verdict,
+            from,
+            to,
+          }, cursor, limit, configDir);
+          printData(page, wantsJson, verdictLines(page));
+          return;
+        }
+        case "subjects": {
+          const kind = takeOption(rest, "--kind");
+          const limit = takeIntegerOption(rest, "--limit", { min: 1 });
+          const cursor = takeOption(rest, "--cursor");
+          rejectArgs(rest, USAGE);
+          const page = queryLabSubjects(kind, cursor, limit, configDir);
+          printData(page, wantsJson, subjectListLines(page));
+          return;
+        }
+        case "subject": {
+          const subjectId = rest[0];
+          if (!subjectId) throw new CliUsageError("subject id required", USAGE);
+          rest.splice(0, 1);
+          rejectArgs(rest, USAGE);
+          const subject = queryLabSubjectById(subjectId, configDir);
+          if (!subject) throw new CliUsageError("unknown subject", USAGE);
+          printData({ subject }, wantsJson, [`Subject ${subjectId}`]);
+          return;
+        }
+        case "observations": {
+          const subjectId = takeOption(rest, "--subject");
+          const layer = takeEnumOption<EvidenceLayer>(
+            rest,
+            "--layer",
+            EVIDENCE_LAYERS,
+            "--layer must be a supported evidence layer",
+          );
+          const suiteId = takeOption(rest, "--suite");
+          const scenarioId = takeOption(rest, "--scenario");
+          const outcome = takeEnumOption<ObservationOutcome>(
+            rest,
+            "--outcome",
+            OUTCOMES,
+            "--outcome must be a supported observation outcome",
+          );
+          const executionMode = takeEnumOption<ExecutionMode>(
+            rest,
+            "--execution-mode",
+            EXECUTION_MODES,
+            "--execution-mode must be a supported execution mode",
+          );
+          const from = takeIntegerOption(rest, "--from", { min: 0 });
+          const to = takeIntegerOption(rest, "--to", { min: 0 });
+          assertRange(from, to);
+          const limit = takeIntegerOption(rest, "--limit", { min: 1 });
+          const cursor = takeOption(rest, "--cursor");
+          rejectArgs(rest, USAGE);
+          const page = queryLabObservations({
+            subjectId,
+            layer,
+            suiteId,
+            scenarioId,
+            outcome,
+            executionMode,
+            from,
+            to,
+          }, cursor, limit, configDir);
+          printData(page, wantsJson, observationLines(page));
+          return;
+        }
+        case "events": {
+          const eventKind = takeEnumOption<LabEventKind>(
+            rest,
+            "--event-kind",
+            EVENT_KINDS,
+            "--event-kind must be a supported lab event kind",
+          );
+          const subjectId = takeOption(rest, "--subject");
+          const from = takeIntegerOption(rest, "--from", { min: 0 });
+          const to = takeIntegerOption(rest, "--to", { min: 0 });
+          assertRange(from, to);
+          const excludedRaw = takeOption(rest, "--excluded");
+          if (excludedRaw !== undefined && excludedRaw !== "true" && excludedRaw !== "false") {
+            throw new CliUsageError("--excluded must be true or false", USAGE);
+          }
+          const limit = takeIntegerOption(rest, "--limit", { min: 1 });
+          const cursor = takeOption(rest, "--cursor");
+          rejectArgs(rest, USAGE);
+          const page = queryLabEvents({
+            eventKind,
+            subjectId,
+            from,
+            to,
+            excluded: excludedRaw === "true" ? true : excludedRaw === "false" ? false : undefined,
+          }, cursor, limit, configDir);
+          printData(page, wantsJson, eventListLines(page));
+          return;
+        }
+        case "event": {
+          const eventId = rest[0];
+          if (!eventId) throw new CliUsageError("event id required", USAGE);
+          rest.splice(0, 1);
+          rejectArgs(rest, USAGE);
+          const event = queryLabEventById(eventId, configDir);
+          if (!event) throw new CliUsageError("unknown event", USAGE);
+          printData({ event }, wantsJson, [`Event ${eventId}`]);
+          return;
+        }
+        case "artifacts": {
+          const status = takeEnumOption<ArtifactStatus>(
+            rest,
+            "--status",
+            ARTIFACT_STATUSES,
+            "--status must be present, corrupt, or purged_unavailable",
+          );
+          const artifactClass = takeEnumOption<ArtifactClass>(
+            rest,
+            "--artifact-class",
+            ARTIFACT_CLASSES,
+            "--artifact-class must be a supported artifact class",
+          );
+          const limit = takeIntegerOption(rest, "--limit", { min: 1 });
+          const cursor = takeOption(rest, "--cursor");
+          rejectArgs(rest, USAGE);
+          const page = queryLabArtifacts({ status, artifactClass }, cursor, limit, configDir);
+          printData(page, wantsJson, artifactLines(page));
+          return;
+        }
+        case "artifact": {
+          const digest = rest[0];
+          if (!digest) throw new CliUsageError("artifact digest required", USAGE);
+          rest.splice(0, 1);
+          rejectArgs(rest, USAGE);
+          const artifact = queryLabArtifactByDigest(digest, configDir);
+          if (!artifact) throw new CliUsageError("unknown artifact", USAGE);
+          printData({ artifact }, wantsJson, [`Artifact ${digest}`]);
+          return;
+        }
+        case "catalog": {
+          const layer = takeEnumOption<EvidenceLayer>(
+            rest,
+            "--layer",
+            EVIDENCE_LAYERS,
+            "--layer must be a supported evidence layer",
+          );
+          const suiteId = takeOption(rest, "--suite");
+          rejectArgs(rest, USAGE);
+          const scenarios = queryLabCatalogEntries({ layer, suiteId });
+          printData({ scenarios }, wantsJson, catalogLines(scenarios));
+          return;
+        }
+        default:
+          throw new CliUsageError(`unknown lab subcommand: ${sub}`, USAGE);
+      }
+    } catch (err) {
+      if (err instanceof CliUsageError) throw err;
+      if (err instanceof LabProjectionUnavailableError || err instanceof LabProjectionIncompatibleError) {
+        throw new LabStateError(labErrorMessage(err));
+      }
+      throw new CliUsageError(labErrorMessage(err), USAGE);
+    }
+  });
+}
+
+export const LAB_USAGE = USAGE;

package/src/cli/provider.ts

@@ -8,7 +8,7 @@
  *   show <name>   Show provider config details (secrets masked)
  *   set-default <name>  Change the default provider
  */
-import { apiKeyTransportConfigError, hasOwnProvider, isValidProviderName, loadConfig, saveConfig } from "../config";
+import { apiKeyTransportConfigError, hasOwnProvider, isValidProviderName, loadConfig, sanitizeModelCostsForDisplay, saveConfig } from "../config";
 import { hasHelpFlag } from "./help";
 import { getProviderRegistryEntry, PROVIDER_REGISTRY } from "../providers/registry";
 import { providerConfigSeed } from "../providers/derive";
@@ -210,7 +210,14 @@ async function handleAdd(args: string[]): Promise<void> {
     provConfig.apiKeyTransport = apiKeyTransport;
   }
 
+  const existingProvider = config.providers[name];
   config.providers[name] = provConfig;
+  // A --force overwrite rotates the key/endpoint but must not drop a
+  // user-configured price overlay (same rule as the /api/providers path and
+  // the login paths); there is no explicit clear/replace flag yet.
+  if (existingProvider?.modelCosts !== undefined && provConfig.modelCosts === undefined) {
+    provConfig.modelCosts = existingProvider.modelCosts;
+  }
   if (allowPrivateNetwork) provConfig.allowPrivateNetwork = true;
   if (setDefault) config.defaultProvider = name;
 
@@ -349,6 +356,7 @@ function handleShow(args: string[]): void {
   const prov = config.providers[name];
   const display = {
     ...prov,
+    ...(prov.modelCosts !== undefined ? { modelCosts: sanitizeModelCostsForDisplay(prov.modelCosts) } : {}),
     ...(prov.apiKey ? { apiKey: maskSecret(prov.apiKey) } : {}),
     ...(prov.apiKeyPool ? { apiKeyPool: prov.apiKeyPool.map(e => ({ ...e, key: maskSecret(e.key) })) } : {}),
   };

package/src/clients/config-export.ts

@@ -391,6 +391,9 @@ export interface ExportModel {
   displayName?: string;
   contextWindow?: number;
   inputModalities?: string[];
+  /** Optional effort ladder exported only to clients that support it. */
+  reasoningEfforts?: string[];
+  defaultReasoningEffort?: string;
 }
 
 export interface ExportContext {
@@ -637,6 +640,50 @@ export interface PiGeneratedConfig {
   providers: Record<string, PiProviderBlock>;
 }
 
+/**
+ * omp accepts a model-level API override. Keep the provider on Chat
+ * Completions so routed providers retain their established wire format, while
+ * native OpenAI models can use the lossless Responses surface.
+ */
+export interface OmpModelEntry extends PiModelEntry {
+  api?: "openai-responses";
+  /** omp requires this flag before it honors a thinking block. */
+  reasoning?: true;
+  thinking?: {
+    mode: "effort";
+    efforts: string[];
+    defaultLevel?: string;
+  };
+}
+
+export interface OmpProviderBlock {
+  baseUrl: string;
+  api: typeof PI_API_DIALECT;
+  apiKey: string;
+  models: OmpModelEntry[];
+}
+
+export interface OmpGeneratedConfig {
+  providers: Record<string, OmpProviderBlock>;
+}
+
+/**
+ * omp validates model entries strictly. These are its documented effort
+ * values; omit an unknown value rather than invalidating the whole provider.
+ */
+const OMP_EFFORT_VOCABULARY = new Set(["minimal", "low", "medium", "high", "xhigh", "max"]);
+
+function ompEfforts(model: ExportModel): string[] {
+  const efforts: string[] = [];
+  for (const effort of model.reasoningEfforts ?? []) {
+    const normalized = effort.trim().toLowerCase();
+    if (OMP_EFFORT_VOCABULARY.has(normalized) && !efforts.includes(normalized)) {
+      efforts.push(normalized);
+    }
+  }
+  return efforts;
+}
+
 /**
  * Hermes `~/.hermes/config.yaml`. We emit ONLY the provider entry — never
  * `model.default` — because hijacking the user's main model is not what a
@@ -772,6 +819,51 @@ function buildPiClientConfig(ctx: ExportContext): PiGeneratedConfig {
   };
 }
 
+/**
+ * omp's models.yml is Pi-like, but it supports effort metadata and a per-model
+ * API dialect. Native OpenAI models use Responses; all routed models inherit
+ * the provider's existing Chat Completions dialect.
+ */
+function buildOmpClientConfig(ctx: ExportContext): OmpGeneratedConfig {
+  const models: OmpModelEntry[] = [];
+  for (const model of normalizeExportModels(ctx.models)) {
+    const input = inputModalitiesForClient("pi", model.inputModalities);
+    if (input === null) continue;
+    const entry: OmpModelEntry = {
+      id: model.namespaced,
+      name: exportModelLabel(model),
+      input,
+      ...(model.native && model.provider === "openai" ? { api: "openai-responses" } : {}),
+    };
+    const context = authoritativeContextWindow(model.contextWindow);
+    if (context !== undefined) {
+      entry.contextWindow = context;
+      entry.maxTokens = outputBudgetFor(context);
+    }
+    const efforts = ompEfforts(model);
+    if (efforts.length > 0) {
+      const defaultLevel = model.defaultReasoningEffort?.trim().toLowerCase();
+      entry.reasoning = true;
+      entry.thinking = {
+        mode: "effort",
+        efforts,
+        ...(defaultLevel && efforts.includes(defaultLevel) ? { defaultLevel } : {}),
+      };
+    }
+    models.push(entry);
+  }
+  return {
+    providers: {
+      [OPENCODE_PROVIDER_ID]: {
+        baseUrl: ctx.baseUrl,
+        api: PI_API_DIALECT,
+        apiKey: LOOPBACK_API_KEY_PLACEHOLDER,
+        models,
+      },
+    },
+  };
+}
+
 /** Extra headers a non-loopback bind needs, or nothing on loopback. */
 function proxyAdmissionHeaders(config: OcxConfig | undefined, envRef: string): Record<string, string> | undefined {
   return shouldInjectApiAuthHeader(config) ? { "x-opencodex-api-key": envRef } : undefined;
@@ -899,6 +991,11 @@ function summarizePi(document: unknown): { modelCount: number; modelsWithoutLimi
   return { modelCount: models.length, modelsWithoutLimits: models.filter(model => model.contextWindow === undefined).length };
 }
 
+function summarizeOmp(document: unknown): { modelCount: number; modelsWithoutLimits: number } {
+  const models = (document as OmpGeneratedConfig | undefined)?.providers?.[OPENCODE_PROVIDER_ID]?.models ?? [];
+  return { modelCount: models.length, modelsWithoutLimits: models.filter(model => model.contextWindow === undefined).length };
+}
+
 function summarizeHermes(document: unknown): { modelCount: number; modelsWithoutLimits: number } {
   const models = (document as HermesGeneratedConfig | undefined)?.providers?.[OPENCODE_PROVIDER_ID]?.models ?? [];
   // Hermes carries selectors only; it has no per-model limit to be missing.
@@ -938,7 +1035,7 @@ function buildPiContribution(ctx: ExportContext): ManagedContribution {
 }
 
 function buildOmpContribution(ctx: ExportContext): ManagedContribution {
-  const doc = buildPiClientConfig(ctx);
+  const doc = buildOmpClientConfig(ctx);
   return singleFragment("omp", ["providers", OPENCODE_PROVIDER_ID], doc.providers[OPENCODE_PROVIDER_ID]);
 }
 
@@ -1007,9 +1104,9 @@ export const EXPORT_CLIENTS: Record<ExportClientId, ExportClientSpec> = {
     destination: env => ompModelsConfigPath(env),
     apiKeyEnv: "",
     exportHint: "OMP reads a non-secret placeholder from models.yml; loopback needs no key.",
-    build: buildPiClientConfig,
+    build: buildOmpClientConfig,
     format: "yaml",
-    summarize: summarizePi,
+    summarize: summarizeOmp,
     buildContribution: buildOmpContribution,
     // OMP supports provider-level headers, but remote credential wiring is
     // intentionally deferred from this initial loopback-only integration.

package/src/codex/app-server-processes.ts

@@ -10,6 +10,7 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { isProcessAlive, waitForExit } from "../lib/process-control";
+import { resolveTrustedWindowsPowerShellExe } from "../lib/windows-elevation";
 import { readCodexCatalogPath } from "./catalog/parsing";
 
 export const STALE_CODEX_APP_SERVER_HINT =
@@ -271,12 +272,12 @@ function listDarwinSnapshots(uid: number | undefined): ProcessSnapshot[] {
   // Top-level exec failure propagates: callers decide their own safe default
   // (restart flow → treat as none; staleness check → unknown, never "fresh").
   const output = uid !== undefined
-    ? execFileSync("ps", ["-u", String(uid), "-o", "pid=,command="], {
+    ? execFileSync("/bin/ps", ["-u", String(uid), "-o", "pid=,command="], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 5_000,
     })
-    : execFileSync("ps", ["-axo", "pid=,uid=,command="], {
+    : execFileSync("/bin/ps", ["-axo", "pid=,uid=,command="], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 5_000,
@@ -345,8 +346,10 @@ export function listWindowsSnapshots(): ProcessSnapshot[] {
     "  } catch { \"__OCX_ENUM_INCOMPLETE__\" }",
     "}",
   ].join("\n");
-  // Top-level exec failure propagates (see listDarwinSnapshots note).
-  const output = execFileSync("powershell.exe", [
+  // Top-level exec failure propagates (see listDarwinSnapshots note). The
+  // executable resolves from the trusted System32 directory (never PATH), and
+  // windowsHide keeps the enumeration console-less on desktop sessions (#1278).
+  const output = execFileSync(resolveTrustedWindowsPowerShellExe(), [
     "-NoProfile", "-NoLogo", "-NonInteractive", "-WindowStyle", "Hidden",
     "-Command",
     psCommand,
@@ -441,7 +444,7 @@ function readLinuxProcStartMs(pid: number): number | null {
 /** `ps` lstart → epoch ms, or null (macOS). */
 function readDarwinProcStartMs(pid: number): number | null {
   try {
-    const out = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], {
+    const out = execFileSync("/bin/ps", ["-o", "lstart=", "-p", String(pid)], {
       encoding: "utf-8",
       stdio: ["ignore", "pipe", "ignore"],
       timeout: 4_000,
@@ -457,7 +460,7 @@ function readDarwinProcStartMs(pid: number): number | null {
 /** Win32_Process.CreationDate → epoch ms, or null (Windows). */
 function readWindowsProcStartMs(pid: number): number | null {
   try {
-    const out = execFileSync("powershell.exe", [
+    const out = execFileSync(resolveTrustedWindowsPowerShellExe(), [
       "-NoProfile", "-NoLogo", "-NonInteractive", "-WindowStyle", "Hidden",
       "-Command",
       `(Get-CimInstance Win32_Process -Filter "ProcessId=${pid}").CreationDate.ToUniversalTime().ToString("o")`,
@@ -490,7 +493,7 @@ export function readProcessStartMsBatch(
   if (pids.length === 0) return out;
   if (platform === "darwin") {
     try {
-      const stdout = execFileSync("ps", ["-o", "pid=,lstart=", "-p", pids.join(",")], {
+      const stdout = execFileSync("/bin/ps", ["-o", "pid=,lstart=", "-p", pids.join(",")], {
         encoding: "utf-8",
         stdio: ["ignore", "pipe", "ignore"],
         timeout: 3_000,
@@ -513,7 +516,7 @@ export function readProcessStartMsBatch(
   if (platform === "win32") {
     try {
       const filter = pids.map(pid => `ProcessId=${pid}`).join(" OR ");
-      const stdout = execFileSync("powershell.exe", [
+      const stdout = execFileSync(resolveTrustedWindowsPowerShellExe(), [
         "-NoProfile", "-NoLogo", "-NonInteractive", "-WindowStyle", "Hidden",
         "-Command",
         `Get-CimInstance Win32_Process -Filter "${filter}" | ForEach-Object { "$($_.ProcessId)\t$($_.CreationDate.ToUniversalTime().ToString("o"))" }`,