@bitkyc08/opencodex 2.42.0 → 2.43.0

package/src/cli/provider-runtime.ts

@@ -19,15 +19,32 @@ interface ProviderQuotasDto {
   reports?: ProviderQuotaReportDto[];
 }
 
+interface QuotaResetEventDto {
+  kind?: string;
+  scope?: string;
+  window?: string;
+  percentBefore?: number;
+  percentAfter?: number;
+  resetAt?: number;
+  detectedAt?: number;
+}
+
+interface QuotaResetsDto {
+  enabled?: boolean;
+  events?: QuotaResetEventDto[];
+}
+
 const USAGE = `Usage:
   ocx provider edit <name> [--adapter <id>] [--base-url <url>] [--default-model <id|->]
       [--auth-mode <key|forward|oauth|local|->] [--note <text|->]
       [--api-key-transport <x-api-key|bearer|->]
       [--headers <json>] [--enabled <on|off>] [--live-models <on|off>]
       [--retain-models <id,id|->]
+      [--xai-chat <on|off>]
       [--allow-private-network <on|off>] [--json]
   ocx provider test <name> [--json]
   ocx provider quota [--refresh] [--json]
+  ocx provider resets [--limit <n>] [--json]
   ocx provider presets [--json]
   ocx provider account-mode <pool|direct> [--json]
   ocx provider selected <name> [--set <model,model...>] [--clear] [--json]
@@ -54,7 +71,12 @@ async function edit(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const enabled = takeBooleanOption(args, "--enabled");
   const liveModels = takeBooleanOption(args, "--live-models");
   const allowPrivateNetwork = takeBooleanOption(args, "--allow-private-network");
+  const xaiChat = takeBooleanOption(args, "--xai-chat");
   rejectArgs(args, USAGE);
+  if (xaiChat !== undefined) {
+    if (name !== "xai") throw new CliUsageError("--xai-chat is valid only for provider xai", USAGE);
+    patch.xaiResponsesOptIn = !xaiChat;
+  }
   if (adapter !== undefined) patch.adapter = adapter;
   if (baseUrl !== undefined) patch.baseUrl = baseUrl;
   if (defaultModel !== undefined) patch.defaultModel = defaultModel;
@@ -132,6 +154,48 @@ async function quota(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   printData(result, wantsJson, lines);
 }
 
+
+/**
+ * Recently detected quota resets, newest first.
+ *
+ * `accountTag` is deliberately NOT rendered: it is a salted hash that means nothing to a human
+ * reading a terminal, and printing it invites treating an opaque tag as an account identifier.
+ */
+function quotaResetLine(event: QuotaResetEventDto): string {
+  const when = typeof event.detectedAt === "number"
+    ? new Date(event.detectedAt).toISOString()
+    : "unknown time";
+  const movement = typeof event.percentBefore === "number" && typeof event.percentAfter === "number"
+    ? `${event.percentBefore}% -> ${event.percentAfter}%`
+    : "usage unknown";
+  const next = typeof event.resetAt === "number"
+    ? `, next ${new Date(event.resetAt).toISOString()}`
+    : "";
+  return `${when}  ${event.scope ?? "?"} ${event.window ?? "?"} ${event.kind ?? "?"}: ${movement}${next}`;
+}
+
+async function resets(argv: string[], deps: RuntimeApiDeps): Promise<void> {
+  const args = [...argv];
+  const wantsJson = takeFlag(args, "--json");
+  const limitRaw = takeOption(args, "--limit");
+  rejectArgs(args, USAGE);
+  if (limitRaw !== undefined && !/^\d+$/.test(limitRaw)) {
+    throw new CliUsageError("--limit must be a non-negative integer", USAGE);
+  }
+  const query = limitRaw === undefined ? "" : `?limit=${limitRaw}`;
+  const result = await runtimeRequest<QuotaResetsDto>(`/api/quota-resets${query}`, {}, deps);
+  const events = Array.isArray(result?.events) ? result.events : [];
+  // One line per event, NOT summaryLines: that helper is a depth-1 flattener and renders a
+  // non-scalar array as "N item(s)", which is what made `ocx provider quota` useless in #2565.
+  const lines = events.length > 0
+    ? events.map(quotaResetLine)
+    // An empty list is ambiguous, so say which kind of empty it is. Without this an operator
+    // cannot tell "nothing has reset yet" from "I never turned this on".
+    : [result?.enabled === true
+      ? "no resets detected yet"
+      : "quota-reset notifications are disabled (set quotaResetNotify.enabled)"];
+  printData(result, wantsJson, lines);
+}
 async function presets(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const args = [...argv];
   const wantsJson = takeFlag(args, "--json");
@@ -210,6 +274,7 @@ export async function handleProviderRuntimeCommand(sub: string, argv: string[],
     update: edit,
     test: testProvider,
     quota,
+    resets,
     presets,
     "account-mode": accountMode,
     selected,

package/src/cli/provider.ts

@@ -18,6 +18,7 @@ import type { OcxProviderConfig } from "../types";
 import { findLiveProxy } from "../server/proxy-liveness";
 import { syncModelsToCodex } from "../codex/sync";
 import { codexAccountNamespaceProviderCollisionError } from "../codex/account-namespace-match";
+import { modelSelectionGuidance, modelSelectionNextSteps } from "./model-selection-guidance";
 
 // ---------------------------------------------------------------------------
 // Arg helpers
@@ -212,6 +213,8 @@ async function handleAdd(args: string[]): Promise<void> {
   }
 
   const existingProvider = config.providers[name];
+  const { initializeProviderModelSelection } = await import("../providers/initial-model-selection");
+  initializeProviderModelSelection(name, provConfig, existingProvider, config);
   config.providers[name] = provConfig;
   // A --force overwrite rotates the key/endpoint but must not drop a
   // user-configured price overlay (same rule as the /api/providers path and
@@ -227,6 +230,7 @@ async function handleAdd(args: string[]): Promise<void> {
   if (wantsJson) {
     console.log(JSON.stringify({
       action: "added",
+      modelSelection: modelSelectionNextSteps(name),
       provider: name,
       adapter: provConfig.adapter,
       baseUrl: provConfig.baseUrl,
@@ -255,6 +259,7 @@ async function handleAdd(args: string[]): Promise<void> {
 
   const registryLabel = registryEntry ? ` (${registryEntry.label})` : "";
   console.log(`✅ Provider "${name}"${registryLabel} added.`);
+  for (const line of modelSelectionGuidance(name)) console.log(line);
   if (setDefault) console.log(`   Set as default provider.`);
   if (registryEntry?.authKind === "oauth") {
     console.log(`   Authenticate with: ocx login ${name}`);
@@ -433,6 +438,7 @@ Subcommands:
   set-default <name>    Change the default provider
   selected <name>       Show or set the provider model allowlist
   quota                 Show provider quota reports
+  resets                Show recently detected quota resets
   presets               List GUI provider presets
   account-mode <mode>   Set OpenAI Codex pool/direct mode
 
@@ -442,6 +448,8 @@ Examples:
   ocx provider add my-ollama --adapter openai-chat --base-url http://localhost:11434/v1
   ocx provider show anthropic --json
   ocx provider set-default anthropic
+  ocx provider edit xai --xai-chat on   # opt Grok 4.5/4.6 into Chat Completions
+  ocx provider edit xai --xai-chat off  # use Responses again
   ocx provider remove my-ollama`;
 
 export async function handleProviderCommand(args: string[]): Promise<void> {

package/src/cli/registry.ts

@@ -228,6 +228,19 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
     usage: "ocx route combo <list|show|set|remove> ...",
     summary: "Manage routing features; combo is currently the supported routing resource.",
   },
+  {
+    name: "effort",
+    usage: "ocx effort [status|<level>|set|clear|model] [--main <level|->] [--subagent <level|->] [--injection <level|->] [--json]",
+    summary: "Inspect and configure reasoning effort caps and defaults.",
+    details: [
+      "With no arguments or `status`, displays effective effort caps, injection effort, and supported rungs.",
+      "`ocx effort <level>` (or `set --main <level>`) sets the global/main-agent reasoning ceiling.",
+      "`--subagent <level>` sets the hard ceiling for delegated sub-agent turns.",
+      "`ocx effort clear` (or `set --main - --subagent -`) removes main and subagent caps but preserves injection effort; use `ocx effort set --injection -` to clear it.",
+      "`ocx effort model <provider/model|model>` inspects a model's configured ladder, disabled status, and wire mappings.",
+      "Works both online (via live proxy API) and offline (modifies persisted config safely with atomic writes).",
+    ],
+  },
   {
     name: "agent",
     usage: "ocx agent <status|injection|effort|subagents|fallback|sidecar> ...",
@@ -315,13 +328,14 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
   {
     name: "claude",
     usage: "ocx claude [claude args...]",
-    summary: "Launch Claude Code wired to the proxy (env injection + gateway model discovery).",
+    summary: "Launch Claude Code through the proxy, with native fallback when Claude routing is disabled.",
     details: [
       "Ensures the proxy is running, then execs `claude` with ANTHROPIC_BASE_URL/ANTHROPIC_AUTH_TOKEN,",
       "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY=1 and model slots from config.claudeCode.",
+      "When Claude routing is explicitly disabled, it launches natively after removing proven OpenCodex-owned proxy state.",
       "Routed models appear in the native /model picker with stable claude-opus-4-8-2026MMDD slot aliases (Claude Code >= 2.1.129).",
       "Older versions: pick models via ANTHROPIC_MODEL or /model <id> directly (any string passes through).",
-      "User-exported ANTHROPIC_* variables always take precedence.",
+      "User-exported ANTHROPIC_* variables take precedence for routed launches; native fallback removes only proven OpenCodex-owned proxy values.",
       "",
       "Claude Desktop profile:",
       "  ocx claude desktop [apply]                         Save and apply the four-family profile",

package/src/cli/runtime-api.ts

@@ -9,7 +9,7 @@
  * - 다른 대안 대신 이 방식을 선택한 이유: GUI/CLI의 검증 규칙이 갈라지지 않고 fallback port도 안전하게 찾는다.
  * - 장점, 단점 및 영향: 동작 일관성이 높아지는 대신 live 관리 명령은 실행 중인 proxy가 필요하다.
  */
-import { findLiveProxy, probeHostname } from "../server/proxy-liveness";
+import { findLiveProxy, probeHostname, type LivenessIo, type LiveProxy } from "../server/proxy-liveness";
 import { runningProxyUpdateHeaders } from "../oauth/login-cli";
 
 export type CliStdin = NodeJS.ReadableStream & { isTTY?: boolean; readableEnded?: boolean };
@@ -20,6 +20,8 @@ export interface RuntimeApiDeps {
   /** Test injection for commands that read a secret from stdin instead of argv. */
   stdinImpl?: CliStdin;
   stdinTimeoutMs?: number;
+  /** Optional proxy liveness probe injection for commands that check or fall back around live runtime state. */
+  findLiveProxy?: (io?: LivenessIo) => Promise<LiveProxy | null>;
 }
 
 export class CliUsageError extends Error {

package/src/cli/star-prompt.ts

@@ -1,5 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { isatty } from "node:tty";
 import { spawnSync } from "node:child_process";
 import { getConfigDir } from "../config";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
@@ -86,11 +87,20 @@ function ghAvailable(): boolean {
 }
 
 /** Test seam: replace gh/interactiveConfirm so the full prompt flow is
- * drivable without a real gh login or a TTY conversation. */
-let depsForTests: { ghAvailable?: () => boolean; interactiveConfirm?: typeof interactiveConfirm } | null = null;
-export function setStarPromptDepsForTests(
-  deps: { ghAvailable?: () => boolean; interactiveConfirm?: typeof interactiveConfirm } | null,
-): void {
+ * drivable without a real gh login or a TTY conversation.
+ *
+ * `isTty` is part of the seam because the guard reads the file descriptors directly through
+ * `isatty` rather than `process.stdin.isTTY`: touching the stream properties would make Bun
+ * construct the stream, which dereferences the working directory and throws when that directory
+ * has been unlinked (#3400). A test therefore cannot fake a TTY by redefining those properties,
+ * so it overrides the decision here instead. */
+type StarPromptTestDeps = {
+  ghAvailable?: () => boolean;
+  interactiveConfirm?: typeof interactiveConfirm;
+  isTty?: () => boolean;
+};
+let depsForTests: StarPromptTestDeps | null = null;
+export function setStarPromptDepsForTests(deps: StarPromptTestDeps | null): void {
   depsForTests = deps;
 }
 
@@ -167,7 +177,13 @@ function printAgentDeferral(): void {
  */
 export async function maybeShowStarPrompt(): Promise<void> {
   try {
-    if (process.env.OCX_SERVICE || !process.stdin.isTTY || !process.stdout.isTTY) return;
+    let isTty = false;
+    try {
+      isTty = depsForTests?.isTty ? depsForTests.isTty() : isatty(0) && isatty(1);
+    } catch {
+      /* best-effort */
+    }
+    if (process.env.OCX_SERVICE || !isTty) return;
     const dir = getConfigDir();
     const marker = join(dir, MARKER);
     if (existsSync(marker)) return;

package/src/cli/status-probes.ts

@@ -0,0 +1,168 @@
+import { readPidFileValue, readRuntimePort } from "../config/process-state";
+import { isOpencodexHealthz, probeHostname } from "../server/proxy-liveness";
+import { directLocalHttpFetch } from "../server/direct-local-http";
+import { isProcessAlive } from "../lib/process-control";
+
+type HealthCheck = {
+  ok: boolean;
+  url: string;
+  message: string;
+  label: string;
+  /** True only for a connect-phase refusal: proof that nothing holds the port. */
+  refused?: boolean;
+};
+
+export type ListenTarget = {
+  port: number;
+  hostname?: string;
+  source: "runtime" | "config";
+  healthUrl: string;
+  dashboardUrl: string;
+};
+
+export function proxyHealthFailureReason(error: unknown, signal: AbortSignal): "timed out" | "unreachable" {
+  return signal.aborted || (error instanceof Error && error.name === "AbortError")
+    ? "timed out"
+    : "unreachable";
+}
+
+/**
+ * "Nothing is listening" is narrower than "the probe failed". `unreachable` covers every
+ * non-abort failure, including a socket that was ACCEPTED and then reset — which is what
+ * an in-flight start looks like mid-bind. Only a connect-phase refusal proves the port is
+ * free, so this reads the underlying errno instead of the display string.
+ */
+export function isConnectionRefused(error: unknown): boolean {
+  for (let current: unknown = error, depth = 0; current instanceof Error && depth < 4; depth++) {
+    const code = (current as { code?: unknown }).code;
+    if (code === "ECONNREFUSED" || code === "ConnectionRefused") return true;
+    // Bun surfaces the refusal as a plain message on some platforms; the errno name is
+    // still the discriminator, not a substring of arbitrary prose.
+    if (typeof code === "string" && code.endsWith("ECONNREFUSED")) return true;
+    current = (current as { cause?: unknown }).cause;
+  }
+  return false;
+}
+
+/**
+ * A proxy killed by a native trap or SIGKILL never runs the exit cleanup that removes
+ * `ocx.pid` and `runtime-port.json` (only SIGINT/SIGTERM/SIGHUP and normal exit are
+ * wired to it), so both records outlive it. That makes "crashed" and "never started"
+ * distinguishable — and #1419 is what it costs when we discard the distinction: the
+ * reporter's unsupervised `ocx gui` proxy died and every later command said only
+ * "not running", never that a previous process had exited or that a service would
+ * have restarted it.
+ *
+ * Two races have to stay closed, because a false "it crashed" is worse than a missing
+ * hint. `handleStart` binds the port BEFORE it publishes either record, so:
+ *
+ * - a start that publishes between two reads is caught by comparing the raw records
+ *   observed before and after the probes (the same snapshot discipline
+ *   `removePidIfValueIs` uses for deletion);
+ * - a start that has bound but not yet published leaves both snapshots identical, so
+ *   records alone cannot see it. That one is excluded on the port instead: the probe
+ *   must have been REFUSED at connect, which is the only outcome proving nothing holds
+ *   the port. A socket that is accepted and then reset — an in-flight bind — is not a
+ *   refusal, so review caught `unreachable` being too broad for this job.
+ *
+ * What this can and cannot prove: the records outliving their process establish that the
+ * previous run did not complete its cleanup. It does not establish a cause, and it cannot
+ * fully exclude a clean exit whose `unlinkSync` failed, because cleanup ignores that
+ * error (`src/cli/index.ts:324-325`) and the records carry no session provenance. The
+ * wording therefore says the records remain and the run MAY have exited unexpectedly.
+ */
+export function isUncleanExitEvidence(input: {
+  live: boolean;
+  healthOk: boolean;
+  healthRefused: boolean;
+  ownerPidAlive: boolean;
+  pidRecordBefore: number | null;
+  pidRecordAfter: number | null;
+  runtimePidBefore: number | null;
+  runtimePidAfter: number | null;
+}): boolean {
+  if (input.live || input.healthOk) return false;
+  if (!input.healthRefused) return false;
+  if (input.ownerPidAlive) return false;
+  if (input.pidRecordBefore !== input.pidRecordAfter) return false;
+  if (input.runtimePidBefore !== input.runtimePidAfter) return false;
+  return input.pidRecordAfter !== null || input.runtimePidAfter !== null;
+}
+
+export async function checkProxyHealth(target: ListenTarget): Promise<HealthCheck> {
+  const url = target.healthUrl;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), 800);
+  try {
+    const response = await directLocalHttpFetch(url, { signal: controller.signal });
+    if (!response.ok) {
+      const message = `returned HTTP ${response.status}`;
+      return { ok: false, url, message, label: `${url} ${message}` };
+    }
+    const body = await response.json().catch(() => null) as { service?: unknown; status?: unknown; version?: unknown; uptime?: unknown } | null;
+    if (!isOpencodexHealthz(body)) {
+      const message = "responded, but not an opencodex proxy";
+      return { ok: false, url, message, label: `${url} ${message}` };
+    }
+    const version = typeof body?.version === "string" ? ` v${body.version}` : "";
+    const uptime = typeof body?.uptime === "number" ? `, uptime ${Math.round(body.uptime)}s` : "";
+    const message = `ok${version}${uptime}`;
+    return { ok: true, url, message, label: `${url} ${message}` };
+  } catch (error) {
+    const reason = proxyHealthFailureReason(error, controller.signal);
+    return { ok: false, url, message: reason, label: `${url} ${reason}`, refused: isConnectionRefused(error) };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * The ONE evidence gatherer for stale-process state, shared by `ocx status` and
+ * `ocx doctor`.
+ *
+ * It deliberately probes the port named by the STALE RECORD, not the configured display
+ * port. Review found the two commands disagreeing precisely here: a proxy that hopped to
+ * a fallback port, or a config whose port changed after the crash, left status probing
+ * the configured port while doctor probed the recorded one, so one reported a crash and
+ * the other did not. The question being asked is "is the process that wrote this record
+ * gone?", and only that record's own port can answer it.
+ *
+ * `live` short-circuits before the probe so a healthy install pays nothing.
+ */
+export async function probeUncleanExitState(input: {
+  live: boolean;
+  port?: number;
+  hostname?: string | null;
+}): Promise<boolean> {
+  if (input.live) return false;
+  const pidRecordBefore = readPidFileValue();
+  const runtimeBefore = readRuntimePort();
+  const runtimePidBefore = runtimeBefore?.pid ?? null;
+  if (pidRecordBefore === null && runtimePidBefore === null) return false;
+  const ownerPid = pidRecordBefore ?? runtimePidBefore;
+  if (ownerPid !== null && isProcessAlive(ownerPid)) return false;
+  // The recorded port is the evidence target. Fall back to the configured port only when
+  // no runtime record exists, which is the pid-file-only case.
+  const port = runtimeBefore?.port ?? input.port ?? 10100;
+  const hostname = runtimeBefore?.hostname ?? input.hostname ?? undefined;
+  const health = await checkProxyHealth({
+    port,
+    hostname,
+    source: runtimeBefore ? "runtime" : "config",
+    healthUrl: `http://${probeHostname(hostname)}:${port}/healthz`,
+    dashboardUrl: `http://localhost:${port}/`,
+  });
+  const pidRecordAfter = readPidFileValue();
+  const runtimePidAfter = readRuntimePort()?.pid ?? null;
+  const ownerPidAfter = pidRecordAfter ?? runtimePidAfter;
+  return isUncleanExitEvidence({
+    live: false,
+    healthOk: health.ok,
+    healthRefused: health.refused === true,
+    ownerPidAlive: ownerPidAfter !== null && isProcessAlive(ownerPidAfter),
+    pidRecordBefore,
+    pidRecordAfter,
+    runtimePidBefore,
+    runtimePidAfter,
+  });
+}

package/src/cli/status.ts

@@ -1,13 +1,11 @@
 import { durableBunRuntime } from "../lib/bun-runtime";
 import { codexAutoStartEnabled, getConfigPath, readConfigDiagnostics } from "../config";
-import { getPidPath, readPid, readPidFileValue, readRuntimePort, type RuntimePortState } from "../config/process-state";
+import { getPidPath, readPid, readRuntimePort, type RuntimePortState } from "../config/process-state";
 import { diagnoseCodexBundledPlugins, type CodexPluginsDiagnostic } from "../codex/plugins-doctor";
-import { findLiveProxy, isOpencodexHealthz, probeHostname } from "../server/proxy-liveness";
-import { directLocalHttpFetch } from "../server/direct-local-http";
+import { findLiveProxy, probeHostname } from "../server/proxy-liveness";
 import type { OcxConfig } from "../types";
 import { diagnoseService, serviceLogPath } from "../service";
 import { collectStartupHealth, type StartupHealth } from "../codex/autostart-health";
-import { isProcessAlive } from "../lib/process-control";
 import { getCodexRoutingKind } from "../codex/inject";
 import { diagnoseCodexShim } from "../codex/shim";
 import { displayCodexRuntimePath, effortClampAppliesToRuntime, loadLastEffortClamp, resolveCodexRuntime } from "../codex/runtime";
@@ -19,15 +17,9 @@ import { grokFenceEndpointDrift, readGrokStatus } from "../grok/status";
 import { claudeDesktopIntegrationEnabled } from "../codex/desired-state";
 import { claudeDesktopPolicyHealth, probeClaudeDesktopPolicy, type ClaudeDesktopPolicyHealth } from "../claude/desktop-policy";
 import { collectClientConnectionStatus } from "./connect";
-
-type HealthCheck = {
-  ok: boolean;
-  url: string;
-  message: string;
-  label: string;
-  /** True only for a connect-phase refusal: proof that nothing holds the port. */
-  refused?: boolean;
-};
+export { proxyHealthFailureReason, isConnectionRefused, isUncleanExitEvidence, probeUncleanExitState } from "./status-probes";
+export type { ListenTarget } from "./status-probes";
+import { checkProxyHealth, probeUncleanExitState, type ListenTarget } from "./status-probes";
 
 export type CliStatusJson = {
   schemaVersion: 1;
@@ -112,14 +104,6 @@ export type CliStatusView = {
 };
 
 
-export type ListenTarget = {
-  port: number;
-  hostname?: string;
-  source: "runtime" | "config";
-  healthUrl: string;
-  dashboardUrl: string;
-};
-
 type StatusListenConfig = Pick<OcxConfig, "port" | "hostname" | "runtimeRole" | "hub">;
 
 function statusDashboardUrl(config: StatusListenConfig, hostname: string | undefined, port: number): string {
@@ -160,75 +144,6 @@ export function resolveStatusPid(
   return live ? live.pid : pidFile;
 }
 
-export function proxyHealthFailureReason(error: unknown, signal: AbortSignal): "timed out" | "unreachable" {
-  return signal.aborted || (error instanceof Error && error.name === "AbortError")
-    ? "timed out"
-    : "unreachable";
-}
-
-/**
- * "Nothing is listening" is narrower than "the probe failed". `unreachable` covers every
- * non-abort failure, including a socket that was ACCEPTED and then reset — which is what
- * an in-flight start looks like mid-bind. Only a connect-phase refusal proves the port is
- * free, so this reads the underlying errno instead of the display string.
- */
-export function isConnectionRefused(error: unknown): boolean {
-  for (let current: unknown = error, depth = 0; current instanceof Error && depth < 4; depth++) {
-    const code = (current as { code?: unknown }).code;
-    if (code === "ECONNREFUSED" || code === "ConnectionRefused") return true;
-    // Bun surfaces the refusal as a plain message on some platforms; the errno name is
-    // still the discriminator, not a substring of arbitrary prose.
-    if (typeof code === "string" && code.endsWith("ECONNREFUSED")) return true;
-    current = (current as { cause?: unknown }).cause;
-  }
-  return false;
-}
-
-/**
- * A proxy killed by a native trap or SIGKILL never runs the exit cleanup that removes
- * `ocx.pid` and `runtime-port.json` (only SIGINT/SIGTERM/SIGHUP and normal exit are
- * wired to it), so both records outlive it. That makes "crashed" and "never started"
- * distinguishable — and #1419 is what it costs when we discard the distinction: the
- * reporter's unsupervised `ocx gui` proxy died and every later command said only
- * "not running", never that a previous process had exited or that a service would
- * have restarted it.
- *
- * Two races have to stay closed, because a false "it crashed" is worse than a missing
- * hint. `handleStart` binds the port BEFORE it publishes either record, so:
- *
- * - a start that publishes between two reads is caught by comparing the raw records
- *   observed before and after the probes (the same snapshot discipline
- *   `removePidIfValueIs` uses for deletion);
- * - a start that has bound but not yet published leaves both snapshots identical, so
- *   records alone cannot see it. That one is excluded on the port instead: the probe
- *   must have been REFUSED at connect, which is the only outcome proving nothing holds
- *   the port. A socket that is accepted and then reset — an in-flight bind — is not a
- *   refusal, so review caught `unreachable` being too broad for this job.
- *
- * What this can and cannot prove: the records outliving their process establish that the
- * previous run did not complete its cleanup. It does not establish a cause, and it cannot
- * fully exclude a clean exit whose `unlinkSync` failed, because cleanup ignores that
- * error (`src/cli/index.ts:324-325`) and the records carry no session provenance. The
- * wording therefore says the records remain and the run MAY have exited unexpectedly.
- */
-export function isUncleanExitEvidence(input: {
-  live: boolean;
-  healthOk: boolean;
-  healthRefused: boolean;
-  ownerPidAlive: boolean;
-  pidRecordBefore: number | null;
-  pidRecordAfter: number | null;
-  runtimePidBefore: number | null;
-  runtimePidAfter: number | null;
-}): boolean {
-  if (input.live || input.healthOk) return false;
-  if (!input.healthRefused) return false;
-  if (input.ownerPidAlive) return false;
-  if (input.pidRecordBefore !== input.pidRecordAfter) return false;
-  if (input.runtimePidBefore !== input.runtimePidAfter) return false;
-  return input.pidRecordAfter !== null || input.runtimePidAfter !== null;
-}
-
 /**
  * `ocx status` greens on process liveness alone, so a proxy that answers
  * /healthz reads healthy even when Codex is not pointed at it and every routed
@@ -252,84 +167,6 @@ export function unusedProxyWarningLines(input: {
   ];
 }
 
-async function checkProxyHealth(target: ListenTarget): Promise<HealthCheck> {
-  const url = target.healthUrl;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), 800);
-  try {
-    const response = await directLocalHttpFetch(url, { signal: controller.signal });
-    if (!response.ok) {
-      const message = `returned HTTP ${response.status}`;
-      return { ok: false, url, message, label: `${url} ${message}` };
-    }
-    const body = await response.json().catch(() => null) as { service?: unknown; status?: unknown; version?: unknown; uptime?: unknown } | null;
-    if (!isOpencodexHealthz(body)) {
-      const message = "responded, but not an opencodex proxy";
-      return { ok: false, url, message, label: `${url} ${message}` };
-    }
-    const version = typeof body?.version === "string" ? ` v${body.version}` : "";
-    const uptime = typeof body?.uptime === "number" ? `, uptime ${Math.round(body.uptime)}s` : "";
-    const message = `ok${version}${uptime}`;
-    return { ok: true, url, message, label: `${url} ${message}` };
-  } catch (error) {
-    const reason = proxyHealthFailureReason(error, controller.signal);
-    return { ok: false, url, message: reason, label: `${url} ${reason}`, refused: isConnectionRefused(error) };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-
-/**
- * The ONE evidence gatherer for stale-process state, shared by `ocx status` and
- * `ocx doctor`.
- *
- * It deliberately probes the port named by the STALE RECORD, not the configured display
- * port. Review found the two commands disagreeing precisely here: a proxy that hopped to
- * a fallback port, or a config whose port changed after the crash, left status probing
- * the configured port while doctor probed the recorded one, so one reported a crash and
- * the other did not. The question being asked is "is the process that wrote this record
- * gone?", and only that record's own port can answer it.
- *
- * `live` short-circuits before the probe so a healthy install pays nothing.
- */
-export async function probeUncleanExitState(input: {
-  live: boolean;
-  port?: number;
-  hostname?: string | null;
-}): Promise<boolean> {
-  if (input.live) return false;
-  const pidRecordBefore = readPidFileValue();
-  const runtimeBefore = readRuntimePort();
-  const runtimePidBefore = runtimeBefore?.pid ?? null;
-  if (pidRecordBefore === null && runtimePidBefore === null) return false;
-  const ownerPid = pidRecordBefore ?? runtimePidBefore;
-  if (ownerPid !== null && isProcessAlive(ownerPid)) return false;
-  // The recorded port is the evidence target. Fall back to the configured port only when
-  // no runtime record exists, which is the pid-file-only case.
-  const port = runtimeBefore?.port ?? input.port ?? 10100;
-  const hostname = runtimeBefore?.hostname ?? input.hostname ?? undefined;
-  const health = await checkProxyHealth({
-    port,
-    hostname,
-    source: runtimeBefore ? "runtime" : "config",
-    healthUrl: `http://${probeHostname(hostname)}:${port}/healthz`,
-    dashboardUrl: `http://localhost:${port}/`,
-  });
-  const pidRecordAfter = readPidFileValue();
-  const runtimePidAfter = readRuntimePort()?.pid ?? null;
-  const ownerPidAfter = pidRecordAfter ?? runtimePidAfter;
-  return isUncleanExitEvidence({
-    live: false,
-    healthOk: health.ok,
-    healthRefused: health.refused === true,
-    ownerPidAlive: ownerPidAfter !== null && isProcessAlive(ownerPidAfter),
-    pidRecordBefore,
-    pidRecordAfter,
-    runtimePidBefore,
-    runtimePidAfter,
-  });
-}
-
 export async function collectStatus(): Promise<CliStatusView> {
   const configDiagnostics = readConfigDiagnostics();
   const config = configDiagnostics.config;