@bitkyc08/opencodex 2.36.0-preview.20260829 → 2.36.0

package/src/cli/doctor.ts

@@ -10,8 +10,9 @@
 import { accessSync, constants, existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { getConfigDir, getConfigPath, readConfigDiagnostics, resolveEnvValue } from "../config";
+import { getConfigDir, getConfigPath, readConfigDiagnostics } from "../config";
 import { readPid } from "../config/process-state";
+import { probeUncleanExitState } from "./status";
 import { findLiveProxy, type LiveProxy } from "../server/proxy-liveness";
 import { BUN_RUNTIME_SOURCES } from "../lib/bun-runtime";
 import type { BunRuntimeSource } from "../lib/bun-runtime";
@@ -26,7 +27,8 @@ import { probeNativeProfileRecoveryState, resolveNativeProfileContext } from "..
 import { NativeProfileError } from "../codex/native-profile-types";
 import { collectOrcaCodexHomeDiagnostic, resolveCodexHomeDir as resolveCodexHomeDirImpl, isWslRuntime, listWslWindowsCodexHomes, wslAutomountRoot, type CodexHomeDeps } from "../codex/home";
 import { scanCodexAgentRolesWithTomlModelFallback } from "../codex/subagent-model-fallback";
-import { findCodexOnPath, isWindowsInteropDir } from "../codex/shim";
+import { diagnoseCodexShim, findCodexOnPath, isWindowsInteropDir, type CodexShimDiagnostic } from "../codex/shim";
+import { providerTableString, rootTomlString } from "../codex/injected-marker";
 import { countPendingOpencodexHistory } from "../codex/history-provider";
 import {
   inspectCodexCoordinator,
@@ -403,6 +405,10 @@ export function collectWslDualInstall(deps: WslDualInstallDeps = {}): WslDualIns
 export type ProxyEnvRow = { key: string; present: boolean };
 export type EnvMap = Record<string, string | undefined>;
 
+function ownEnvValue(env: EnvMap, name: string): string | undefined {
+  return Object.hasOwn(env, name) ? env[name] : undefined;
+}
+
 /** Report only presence/absence of proxy env vars - never the value (it may
  * embed credentials). Checks both upper- and lower-case forms. */
 export function collectProxyEnv(env: EnvMap = process.env): ProxyEnvRow[] {
@@ -438,11 +444,6 @@ export function collectProviderApiKeyDiagnostics(
   providers: Record<string, { authMode?: string; apiKey?: string }> = readConfigDiagnostics().config.providers ?? {},
   env: EnvMap = process.env,
 ): ProviderApiKeyDiagnostic[] {
-  const resolveInEnv = (value: string): string | undefined => {
-    const name = envReferenceName(value);
-    if (!name) return value;
-    return env[name];
-  };
   const rows: ProviderApiKeyDiagnostic[] = [];
   for (const [provider, config] of Object.entries(providers)) {
     if (config.authMode !== "key") continue;
@@ -450,7 +451,7 @@ export function collectProviderApiKeyDiagnostics(
     if (!raw) continue;
     const envName = envReferenceName(raw);
     if (!envName) continue;
-    const resolved = resolveInEnv(raw);
+    const resolved = ownEnvValue(env, envName);
     if (resolved?.trim()) continue;
     rows.push({
       provider,
@@ -461,6 +462,33 @@ export function collectProviderApiKeyDiagnostics(
   return rows;
 }
 
+export type CodexEnvKeyReadinessDiagnostic = {
+  envName: string;
+  shimState: "missing" | "unhealthy";
+  detail: string;
+  action: string;
+};
+
+/** Warn when routed Codex cannot obtain its configured admission token at launch. */
+export function collectCodexEnvKeyReadiness(
+  configText: string | null,
+  env: EnvMap,
+  shim: CodexShimDiagnostic,
+  serviceTokenPresent: boolean,
+): CodexEnvKeyReadinessDiagnostic | null {
+  if (!configText || rootTomlString(configText, "model_provider") !== "opencodex") return null;
+  const envName = providerTableString(configText, "opencodex", "env_key")?.trim();
+  const envValue = envName ? ownEnvValue(env, envName) : undefined;
+  if (!envName || envValue?.trim() || shim.healthy || !serviceTokenPresent) return null;
+  const shimState = shim.installed ? "unhealthy" : "missing";
+  return {
+    envName,
+    shimState,
+    detail: `Codex uses env_key ${envName}, but that variable is unset and the OpenCodex shim is ${shimState}; the service token file exists but plain Codex does not load it`,
+    action: `Run 'ocx codex-shim install' to repair launch-time token injection, or export ${envName} in the process that starts Codex`,
+  };
+}
+
 export function collectConfiguredProxy(): ConfiguredProxyDiagnostic {
   const diagnostics = readConfigDiagnostics();
   const rawProxy = typeof diagnostics.config.proxy === "string" ? diagnostics.config.proxy.trim() : "";
@@ -484,7 +512,9 @@ export function collectConfiguredProxy(): ConfiguredProxyDiagnostic {
   }
 
   const envName = envReferenceName(rawProxy);
-  const resolved = resolveEnvValue(rawProxy);
+  const resolved = rawProxy.startsWith("$")
+    ? ownEnvValue(process.env, envName ?? rawProxy.slice(1))
+    : rawProxy;
   if (resolved?.trim()) {
     return {
       key: "config.proxy",
@@ -505,7 +535,7 @@ export function collectConfiguredProxy(): ConfiguredProxyDiagnostic {
 }
 
 export function parseProcessEnvBlock(content: string): EnvMap {
-  const env: EnvMap = {};
+  const env: EnvMap = Object.create(null);
   for (const entry of content.split("\0")) {
     if (!entry) continue;
     const separator = entry.indexOf("=");
@@ -943,6 +973,11 @@ export function proxyDownRestartHint(input: {
   /** Absent means "unknown"; the hint then keeps its pre-repair wording. */
   serviceInstalled?: boolean;
   serviceConflict?: boolean;
+  /**
+   * Persisted owner records outlived their process (#1419). Cause-neutral: what is on
+   * disk proves an unclean exit, not which signal caused it.
+   */
+  staleProcessState?: boolean;
 }): string | null {
   if (input.proxyRunning) return null;
   // `serviceViable` alone conflates "no service at all" with "registered but stale or
@@ -955,7 +990,10 @@ export function proxyDownRestartHint(input: {
     : installedButBroken
       ? "Restart it with 'ocx start', or refresh the installed service: 'ocx service repair'."
       : "Restart it with 'ocx start', or install the persistent service: 'ocx service install'.";
-  return `The ocx proxy is not running. Codex/Claude clients pinned to 127.0.0.1:${input.port} fail with errors like "error sending request for url (http://127.0.0.1:${input.port}/v1/responses)". ${restart}`;
+  const uncleanExit = input.staleProcessState === true
+    ? "Stale process records remain, so the previous run may have exited unexpectedly. "
+    : "";
+  return `The ocx proxy is not running. ${uncleanExit}Codex/Claude clients pinned to 127.0.0.1:${input.port} fail with errors like "error sending request for url (http://127.0.0.1:${input.port}/v1/responses)". ${restart}`;
 }
 
 export async function runDoctor(args: string[] = []): Promise<void> {
@@ -1059,6 +1097,17 @@ export async function runDoctor(args: string[] = []): Promise<void> {
   }
 
   const doctorConfig = readConfigDiagnostics().config;
+  const codexConfigPath = join(resolveCodexHomeDirImpl(), "config.toml");
+  const codexConfigText = (() => {
+    try { return readFileSync(codexConfigPath, "utf8"); } catch { return null; }
+  })();
+  const serviceTokenPresent = Boolean(readInstalledServiceToken()?.trim());
+  const codexEnvKeyReadiness = collectCodexEnvKeyReadiness(
+    codexConfigText,
+    process.env,
+    diagnoseCodexShim(),
+    serviceTokenPresent,
+  );
   const startup = collectStartupHealth(doctorConfig);
   console.log("\nCodex restart safety");
   console.log(`  ${startup.rebootSafe ? "ok " : "!! "} ${startupHealthSummary(startup)}`);
@@ -1137,6 +1186,14 @@ export async function runDoctor(args: string[] = []): Promise<void> {
     }
   }
 
+  console.log("\nCodex env_key launch readiness");
+  if (codexEnvKeyReadiness) {
+    console.log(`  !!     ${codexEnvKeyReadiness.detail}`);
+    console.log(`         Action: ${codexEnvKeyReadiness.action}`);
+  } else {
+    console.log("  ok     no broken OpenCodex env_key launch path detected");
+  }
+
   console.log("\nRunning proxy process proxy env (presence only)");
   if (runningProxyEnv.status === "not_running") {
     console.log("  --     no running ocx proxy process found");
@@ -1269,11 +1326,20 @@ export async function runDoctor(args: string[] = []): Promise<void> {
     serviceViable: startup.serviceViable,
     serviceInstalled: startup.serviceInstalled,
     serviceConflict: startup.serviceConflict,
+    // Threaded through the same decision helper `ocx status` uses, so the two
+    // diagnostics cannot drift. A helper-only change would satisfy a unit test while
+    // real `ocx doctor` output never mentioned the crash (#1419).
+    staleProcessState: await probeUncleanExitState({
+      live: Boolean(live),
+      port: doctorConfig.port,
+      hostname: doctorConfig.hostname,
+    }),
   });
   if (proxyDown) hints.push(proxyDown);
   for (const row of providerApiKeys) {
     hints.push(`${row.detail}. Set ${row.envName} in the shell that starts the proxy, or store a literal key in config (value hidden here).`);
   }
+  if (codexEnvKeyReadiness) hints.push(`${codexEnvKeyReadiness.detail}. ${codexEnvKeyReadiness.action}.`);
   const anyDrvfs = paths.some(p => detectFsType(p.path, mounts).isDrvfs || detectFsType(p.path, mounts).isMntDrive);
   const noProxy = currentProxyEnv.every(p => !p.present) && !configuredProxy.present;
   if (!startup.rebootSafe) {

package/src/cli/help.ts

@@ -61,7 +61,7 @@ Usage:
   ocx account <sub>           Accounts, login/reauth, key pools, and quota controls
   ocx models <sub>            Live/custom models, visibility, context, and shadow calls
   ocx alias <sub>             Short names for providers and models (list, set, rm, defaults)
-  ocx combo <sub>             Combo failover/round-robin routing
+  ocx combo <sub>             Combo routing strategies and failover
   ocx agent <sub>             Subagents, injection, effort caps, and sidecars
   ocx observe <sub>           Logs, usage, storage, memory, and debug data
   ocx inspect <sub>           Effective config, catalog, analytics, pacing, client-config

package/src/cli/index.ts

@@ -858,6 +858,11 @@ async function handleStatus() {
     console.log(`❌ Proxy: ${status.proxyLabel}`);
   }
   console.log(`   Health: ${status.healthLabel}`);
+  if (status.json.claudeDesktop.desiredEnabled && !status.json.claudeDesktop.policy.ok) {
+    console.log(`   ⚠️  Claude Desktop 3P health: ${status.json.claudeDesktop.policy.status}`);
+    console.log(`      ${status.json.claudeDesktop.policy.message}`);
+    console.log(`      Action: ${status.json.claudeDesktop.policy.action}`);
+  }
   // Printed here, not only in --json: a stale ocx on PATH is exactly the situation where
   // the operator is reading human output and wondering why the CLI disagrees with the
   // dashboard. Adding the JSON field alone would satisfy a test and help nobody (#2701).
@@ -877,6 +882,17 @@ async function handleStatus() {
     // contradicted it in the same report, and install re-registers: UAC on Windows and a
     // possible WinSW-to-scheduler switch for someone who already has a service.
     const installed = status.json.startup.serviceInstalled && !status.json.startup.serviceConflict;
+    // #1419: the records outliving the process is the only evidence the user gets that a
+    // previous run ended without cleanup. Deliberately hedged and cause-neutral — cleanup
+    // ignores unlink failures and the records carry no session provenance, so this cannot
+    // prove a crash, only that the last run left state behind. The restart advice below is
+    // not repeated here; one recommendation per report.
+    if (status.json.proxy.staleProcessState) {
+      console.log("     Stale process records remain, so the previous run may have exited unexpectedly.");
+      if (!installed) {
+        console.log("     No background service was available to restart it.");
+      }
+    }
     console.log(installed
       ? "     Restart with 'ocx start', or refresh the installed service: 'ocx service repair'."
       : "     Restart with 'ocx start', or install the persistent service: 'ocx service install'.");

package/src/cli/models.ts

@@ -283,10 +283,27 @@ async function handleCustomRemove(args: string[]): Promise<void> {
   // that row while the dash form matched both — the two relations disagreed on the same
   // config. Removal stays exact-or-refuse: an ambiguous selector still aborts below, which is
   // the right default for a destructive command.
+  const separator = target.indexOf("/");
+  const selectedProvider = separator >= 0 ? target.slice(0, separator) : undefined;
+  // Resolve ONCE against the provider's whole roster, then map the decision back onto rows.
+  // Calling the resolver per row with a singleton roster hid every cross-row fact it needs:
+  // a self-namespaced `acme/turbo` and a sibling `turbo` each matched their own singleton,
+  // so the command saw two matches and aborted as ambiguous even though the selector names
+  // one row exactly.
+  const rosterMatched = selectedProvider === undefined
+    ? undefined
+    : resolveSlugSelection(
+      selectedProvider,
+      target,
+      existing.filter(model => model.provider === selectedProvider).map(model => model.modelId),
+    );
+  // Deliberately admit the whole matched set rather than narrowing to `exact`: an encoded
+  // selector that spans a real collision must still abort below. Removal stays exact-or-refuse.
+  const admitted = new Set(rosterMatched?.matched ?? []);
   const matchingIndexes = existing.flatMap((model, index) => {
-    if (!target.includes("/")) return model.id === target ? [index] : [];
-    const resolved = resolveSlugSelection(model.provider, target, [model.modelId]);
-    return resolved.matched.length > 0 ? [index] : [];
+    if (selectedProvider === undefined) return model.id === target ? [index] : [];
+    if (model.provider !== selectedProvider) return [];
+    return admitted.has(model.modelId) ? [index] : [];
   });
   if (matchingIndexes.length === 0) fail(`custom model "${target}" not found`);
   if (matchingIndexes.length > 1) {

package/src/cli/registry.ts

@@ -194,7 +194,7 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
   {
     name: "combo",
     usage: "ocx combo <list|show|set|remove> ...",
-    summary: "Manage combo failover and round-robin virtual models.",
+    summary: "Manage combo virtual models and routing strategies.",
     details: ["Alias hierarchy: ocx route combo ...", "Use --targets provider/model[:weight],provider/model[:weight]."],
   },
   {
@@ -291,6 +291,7 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
       "Claude Desktop profile:",
       "  ocx claude desktop [apply]                         Save and apply the four-family profile",
       "  ocx claude desktop show [--json]                   Show routes, families, and defaults",
+      "  ocx claude desktop status [--json]                 Show applied state, drift, and health",
       "  ocx claude desktop move <route> <family> [--default]",
       "  ocx claude desktop default <family> <route|none>",
       "  ocx claude desktop export <path|->                 Export versioned JSON (`-` = stdout)",

package/src/cli/status.ts

@@ -1,12 +1,13 @@
 import { durableBunRuntime } from "../lib/bun-runtime";
 import { codexAutoStartEnabled, getConfigPath, readConfigDiagnostics } from "../config";
-import { getPidPath, readPid, readRuntimePort, type RuntimePortState } from "../config/process-state";
+import { getPidPath, readPid, readPidFileValue, readRuntimePort, type RuntimePortState } from "../config/process-state";
 import { diagnoseCodexBundledPlugins, type CodexPluginsDiagnostic } from "../codex/plugins-doctor";
 import { findLiveProxy, isOpencodexHealthz, probeHostname } from "../server/proxy-liveness";
 import { directLocalHttpFetch } from "../server/direct-local-http";
 import type { OcxConfig } from "../types";
 import { diagnoseService, serviceLogPath } from "../service";
 import { collectStartupHealth, type StartupHealth } from "../codex/autostart-health";
+import { isProcessAlive } from "../lib/process-control";
 import { getCodexRoutingKind } from "../codex/inject";
 import { diagnoseCodexShim } from "../codex/shim";
 import { displayCodexRuntimePath, effortClampAppliesToRuntime, loadLastEffortClamp, resolveCodexRuntime } from "../codex/runtime";
@@ -15,12 +16,16 @@ import { computeVersionSkew, type VersionSkew } from "./version-skew";
 import { redactSecretString, redactUserPath } from "../lib/redact";
 import { collectOrcaCodexHomeDiagnostic, type OrcaCodexHomeDiagnostic } from "../codex/home";
 import { grokFenceEndpointDrift, readGrokStatus } from "../grok/status";
+import { claudeDesktopIntegrationEnabled } from "../codex/desired-state";
+import { claudeDesktopPolicyHealth, probeClaudeDesktopPolicy, type ClaudeDesktopPolicyHealth } from "../claude/desktop-policy";
 
 type HealthCheck = {
   ok: boolean;
   url: string;
   message: string;
   label: string;
+  /** True only for a connect-phase refusal: proof that nothing holds the port. */
+  refused?: boolean;
 };
 
 export type CliStatusJson = {
@@ -28,6 +33,8 @@ export type CliStatusJson = {
   proxy: {
     running: boolean;
     pid: number | null;
+    /** Persisted owner records outlived their process: the last proxy did not exit cleanly. */
+    staleProcessState: boolean;
     health: {
       ok: boolean;
       url: string;
@@ -72,6 +79,10 @@ export type CliStatusJson = {
     };
   };
   codexHome: OrcaCodexHomeDiagnostic;
+  claudeDesktop: {
+    desiredEnabled: boolean;
+    policy: ClaudeDesktopPolicyHealth;
+  };
   /**
    * This CLI's version against the running proxy's (#2701).
    *
@@ -127,6 +138,69 @@ export function proxyHealthFailureReason(error: unknown, signal: AbortSignal): "
     : "unreachable";
 }
 
+/**
+ * "Nothing is listening" is narrower than "the probe failed". `unreachable` covers every
+ * non-abort failure, including a socket that was ACCEPTED and then reset — which is what
+ * an in-flight start looks like mid-bind. Only a connect-phase refusal proves the port is
+ * free, so this reads the underlying errno instead of the display string.
+ */
+export function isConnectionRefused(error: unknown): boolean {
+  for (let current: unknown = error, depth = 0; current instanceof Error && depth < 4; depth++) {
+    const code = (current as { code?: unknown }).code;
+    if (code === "ECONNREFUSED" || code === "ConnectionRefused") return true;
+    // Bun surfaces the refusal as a plain message on some platforms; the errno name is
+    // still the discriminator, not a substring of arbitrary prose.
+    if (typeof code === "string" && code.endsWith("ECONNREFUSED")) return true;
+    current = (current as { cause?: unknown }).cause;
+  }
+  return false;
+}
+
+/**
+ * A proxy killed by a native trap or SIGKILL never runs the exit cleanup that removes
+ * `ocx.pid` and `runtime-port.json` (only SIGINT/SIGTERM/SIGHUP and normal exit are
+ * wired to it), so both records outlive it. That makes "crashed" and "never started"
+ * distinguishable — and #1419 is what it costs when we discard the distinction: the
+ * reporter's unsupervised `ocx gui` proxy died and every later command said only
+ * "not running", never that a previous process had exited or that a service would
+ * have restarted it.
+ *
+ * Two races have to stay closed, because a false "it crashed" is worse than a missing
+ * hint. `handleStart` binds the port BEFORE it publishes either record, so:
+ *
+ * - a start that publishes between two reads is caught by comparing the raw records
+ *   observed before and after the probes (the same snapshot discipline
+ *   `removePidIfValueIs` uses for deletion);
+ * - a start that has bound but not yet published leaves both snapshots identical, so
+ *   records alone cannot see it. That one is excluded on the port instead: the probe
+ *   must have been REFUSED at connect, which is the only outcome proving nothing holds
+ *   the port. A socket that is accepted and then reset — an in-flight bind — is not a
+ *   refusal, so review caught `unreachable` being too broad for this job.
+ *
+ * What this can and cannot prove: the records outliving their process establish that the
+ * previous run did not complete its cleanup. It does not establish a cause, and it cannot
+ * fully exclude a clean exit whose `unlinkSync` failed, because cleanup ignores that
+ * error (`src/cli/index.ts:324-325`) and the records carry no session provenance. The
+ * wording therefore says the records remain and the run MAY have exited unexpectedly.
+ */
+export function isUncleanExitEvidence(input: {
+  live: boolean;
+  healthOk: boolean;
+  healthRefused: boolean;
+  ownerPidAlive: boolean;
+  pidRecordBefore: number | null;
+  pidRecordAfter: number | null;
+  runtimePidBefore: number | null;
+  runtimePidAfter: number | null;
+}): boolean {
+  if (input.live || input.healthOk) return false;
+  if (!input.healthRefused) return false;
+  if (input.ownerPidAlive) return false;
+  if (input.pidRecordBefore !== input.pidRecordAfter) return false;
+  if (input.runtimePidBefore !== input.runtimePidAfter) return false;
+  return input.pidRecordAfter !== null || input.runtimePidAfter !== null;
+}
+
 /**
  * `ocx status` greens on process liveness alone, so a proxy that answers
  * /healthz reads healthy even when Codex is not pointed at it and every routed
@@ -171,15 +245,70 @@ async function checkProxyHealth(target: ListenTarget): Promise<HealthCheck> {
     return { ok: true, url, message, label: `${url} ${message}` };
   } catch (error) {
     const reason = proxyHealthFailureReason(error, controller.signal);
-    return { ok: false, url, message: reason, label: `${url} ${reason}` };
+    return { ok: false, url, message: reason, label: `${url} ${reason}`, refused: isConnectionRefused(error) };
   } finally {
     clearTimeout(timer);
   }
 }
 
+/**
+ * The ONE evidence gatherer for stale-process state, shared by `ocx status` and
+ * `ocx doctor`.
+ *
+ * It deliberately probes the port named by the STALE RECORD, not the configured display
+ * port. Review found the two commands disagreeing precisely here: a proxy that hopped to
+ * a fallback port, or a config whose port changed after the crash, left status probing
+ * the configured port while doctor probed the recorded one, so one reported a crash and
+ * the other did not. The question being asked is "is the process that wrote this record
+ * gone?", and only that record's own port can answer it.
+ *
+ * `live` short-circuits before the probe so a healthy install pays nothing.
+ */
+export async function probeUncleanExitState(input: {
+  live: boolean;
+  port?: number;
+  hostname?: string | null;
+}): Promise<boolean> {
+  if (input.live) return false;
+  const pidRecordBefore = readPidFileValue();
+  const runtimeBefore = readRuntimePort();
+  const runtimePidBefore = runtimeBefore?.pid ?? null;
+  if (pidRecordBefore === null && runtimePidBefore === null) return false;
+  const ownerPid = pidRecordBefore ?? runtimePidBefore;
+  if (ownerPid !== null && isProcessAlive(ownerPid)) return false;
+  // The recorded port is the evidence target. Fall back to the configured port only when
+  // no runtime record exists, which is the pid-file-only case.
+  const port = runtimeBefore?.port ?? input.port ?? 10100;
+  const hostname = runtimeBefore?.hostname ?? input.hostname ?? undefined;
+  const health = await checkProxyHealth({
+    port,
+    hostname,
+    source: runtimeBefore ? "runtime" : "config",
+    healthUrl: `http://${probeHostname(hostname)}:${port}/healthz`,
+    dashboardUrl: `http://localhost:${port}/`,
+  });
+  const pidRecordAfter = readPidFileValue();
+  const runtimePidAfter = readRuntimePort()?.pid ?? null;
+  const ownerPidAfter = pidRecordAfter ?? runtimePidAfter;
+  return isUncleanExitEvidence({
+    live: false,
+    healthOk: health.ok,
+    healthRefused: health.refused === true,
+    ownerPidAlive: ownerPidAfter !== null && isProcessAlive(ownerPidAfter),
+    pidRecordBefore,
+    pidRecordAfter,
+    runtimePidBefore,
+    runtimePidAfter,
+  });
+}
+
 export async function collectStatus(): Promise<CliStatusView> {
   const configDiagnostics = readConfigDiagnostics();
   const config = configDiagnostics.config;
+  const claudeDesktop = {
+    desiredEnabled: claudeDesktopIntegrationEnabled(config),
+    policy: claudeDesktopPolicyHealth(probeClaudeDesktopPolicy()),
+  };
   // Prefer identity-verified liveness (runtime-port + /healthz) over ocx.pid alone (#618).
   // Pass the already-resolved diagnostics config so findLiveProxy does not re-load and
   // warn on malformed config.json (status --json must stay stderr-clean).
@@ -210,6 +339,13 @@ export async function collectStatus(): Promise<CliStatusView> {
       label: `${listen.healthUrl} ok (live)`,
     }
     : await checkProxyHealth(listen);
+  // Same gatherer `ocx doctor` uses, so the two commands cannot reach different verdicts
+  // about the same on-disk state (review found them diverging on fallback ports).
+  const staleProcessState = await probeUncleanExitState({
+    live: Boolean(live),
+    port: config.port,
+    hostname: config.hostname,
+  });
   const bunRuntime = durableBunRuntime();
   const service = diagnoseService();
   // A service can be registered and still not serve: the manager reports the job
@@ -326,6 +462,7 @@ export async function collectStatus(): Promise<CliStatusView> {
       proxy: {
         running: Boolean(live) || Boolean(pid && health.ok),
         pid: live?.pid ?? pid,
+        staleProcessState,
         health: {
           ok: health.ok,
           url: health.url,
@@ -359,6 +496,7 @@ export async function collectStatus(): Promise<CliStatusView> {
       codexPlugins,
       codexRuntime,
       codexHome,
+      claudeDesktop,
       // Own field rather than a line in `codexRuntime.warning`: a stale ocx on PATH is a
       // fact about this install, not about the Codex runtime, and filing it there would
       // print it under the wrong heading (#2701).

package/src/cli/storage.ts

@@ -173,7 +173,16 @@ async function policy(argv: string[], deps: RuntimeApiDeps): Promise<void> {
     }
     const body: Record<string, unknown> = {};
     if (enabled !== undefined) body.enabled = enabled === "true";
-    if (percent !== undefined) body.percent = percent;
+    // The policy target is nested. A top-level `percent` is not part of the PUT contract:
+    // `normalizeStorageCleanupPolicy` reads only `target`, so the field was dropped and the
+    // previously stored target survived. `--percent 10` on a policy still holding the
+    // default 25% therefore reported success while leaving cleanup authorized to delete
+    // more than the operator asked for.
+    //
+    // An out-of-range value is deliberately still sent: the server owns the 1-100
+    // vocabulary and answers with a named 400, which is a rejected write rather than the
+    // silent wrong write this replaces.
+    if (percent !== undefined) body.target = { removeOldestPercent: percent };
     if (mode !== undefined) body.mode = mode;
     if (schedule !== undefined) body.schedule = schedule;
     if (Object.keys(body).length === 0) {

package/src/codex/account-runtime-state.ts

@@ -1,18 +1,43 @@
 import { captureConfigGeneration, type GenerationContext } from "../lib/state-store-sweeper";
+import { isCodexAccountGenerationLive } from "./account-store";
 
-const reauthAccounts = new Set<string>();
+/**
+ * Accounts quarantined for reauthentication, each remembering WHICH credential produced the
+ * evidence (#2892 gap 4).
+ *
+ * A 401 describes one credential, not an account. Recording only the id let a 401 raced by a
+ * cross-process credential replacement quarantine the replacement: the flag outlived the credential
+ * it was evidence about, and routing then refused a perfectly good credential until a restart. A
+ * post-write re-read cannot fix that — the replacement may land at any point after the write — so
+ * the generation travels WITH the flag and is checked when the flag is read.
+ *
+ * `undefined` means "no credential generation was supplied", which stays account-wide: callers such
+ * as a login flow have no specific credential in hand, and their quarantine must not silently expire.
+ */
+const reauthAccounts = new Map<string, number | undefined>();
 let lastReconciledGeneration = 0;
 let liveAccountIds = new Set<string>();
 
-export function markAccountNeedsReauth(id: string, writerGeneration = captureConfigGeneration()): void {
+export function markAccountNeedsReauth(
+  id: string,
+  writerGeneration = captureConfigGeneration(),
+  credentialGeneration?: number,
+): void {
   if (writerGeneration < lastReconciledGeneration && !liveAccountIds.has(id)) return;
-  reauthAccounts.add(id);
+  // An account-wide mark supersedes a generation-scoped one: it is the stronger claim.
+  if (credentialGeneration === undefined || !reauthAccounts.has(id)) {
+    reauthAccounts.set(id, credentialGeneration);
+    return;
+  }
+  const existing = reauthAccounts.get(id);
+  if (existing === undefined) return;
+  reauthAccounts.set(id, Math.max(existing, credentialGeneration));
 }
 
 export function reconcileCodexReauthState(context: GenerationContext): number {
   if (context.generation <= lastReconciledGeneration) return 0;
   let removed = 0;
-  for (const id of reauthAccounts) {
+  for (const id of [...reauthAccounts.keys()]) {
     if (context.codexAccountIds.has(id)) continue;
     reauthAccounts.delete(id);
     removed += 1;
@@ -23,7 +48,16 @@ export function reconcileCodexReauthState(context: GenerationContext): number {
 }
 
 export function isAccountNeedsReauth(id: string): boolean {
-  return reauthAccounts.has(id);
+  if (!reauthAccounts.has(id)) return false;
+  const credentialGeneration = reauthAccounts.get(id);
+  if (credentialGeneration === undefined) return true;
+  // The credential this evidence describes is gone, so the evidence is spent. Drop it rather than
+  // re-deriving the same answer on every read.
+  if (!isCodexAccountGenerationLive(id, credentialGeneration)) {
+    reauthAccounts.delete(id);
+    return false;
+  }
+  return true;
 }
 
 export function clearAccountNeedsReauth(id: string): void {