@bitkyc08/opencodex 2.50.0 → 2.51.0

package/src/types/config.ts

@@ -259,6 +259,21 @@ export type OcxRuntimeRole = "standalone" | "hub" | "client";
 export interface OcxHubConfig {
   /** Canonical browser-reachable management origin advertised by a hub. */
   managementPublicOrigin?: string;
+  /**
+   * Canonical client-reachable DATA origin of this hub — what a remote machine passes as the
+   * positional URL to `ocx connect`, and what `ocx hub invite` prints.
+   *
+   * Separate from `managementPublicOrigin` because the two are genuinely different sockets on a
+   * real deployment: management is a loopback-only ingress published by an HTTPS frontend, while
+   * the data listener is bound to the hub's tailnet/LAN address and fronted on its own port
+   * (`https://hub.tailnet.ts.net:8443`). Deriving one from the other produced an origin that
+   * answered `/readyz` and nothing else.
+   *
+   * Advisory only: it is the origin the hub ADVERTISES, never a bind address. When omitted,
+   * `ocx hub invite` falls back to `http://<hostname>:<port>`, which is correct for a plain
+   * tailnet bind with no TLS frontend.
+   */
+  dataPublicOrigin?: string;
   /**
    * Optional management-only listener for a local HTTPS frontend such as Tailscale Serve.
    * The hostname is deliberately not configurable: when enabled the socket is always bound
@@ -661,13 +676,24 @@ export interface OcxConfig {
    * surface: every process on the machine can reach it, spend account quota, and consume paid
    * provider credentials. Off by default; not for multi-tenant hosts.
    *
-   * The port is required when enabled and must differ from the proxy port. An OS-assigned port
-   * would change across restarts, which would break already-running app-servers holding the
-   * previous `base_url` — the exact symptom #1102 reported and we disproved for token rotation.
+   * Two enabled forms:
+   *
+   *  - `{ enabled: true, port: N }` — a distinct port (the #1102 form). N must differ from the
+   *    proxy port.
+   *  - `{ enabled: true }` — the "companion" form: bind `127.0.0.1:<proxy port>`. Legal only
+   *    when `hostname` is a specific non-loopback, non-wildcard address (a tailnet or LAN IP),
+   *    because otherwise the public socket already owns that loopback address. This is the
+   *    one-port hub shape: remote clients dial `hostname:port`, local processes dial
+   *    `127.0.0.1:port`, and every integration that hardcodes `http://127.0.0.1:<proxy port>`
+   *    keeps working on a hub whose public bind they cannot reach (#4236).
+   *
+   * Neither form is OS-assigned. A changing port would break already-running app-servers
+   * holding the previous `base_url` — the exact symptom #1102 reported and we disproved for
+   * token rotation.
    */
   unauthenticatedLoopbackListener?:
     | { enabled: false }
-    | { enabled: true; port: number };
+    | { enabled: true; port?: number };
   /**
    * Outbound HTTP(S) proxy URL for provider requests (e.g. "http://user:pass@proxy:8080", or
    * "${HTTPS_PROXY}"-style env reference). Mirrored into HTTP_PROXY/HTTPS_PROXY at startup when
@@ -746,6 +772,14 @@ export interface OcxConfig {
   codexAccounts?: CodexAccount[];
   /** Account ids administratively excluded from future pool selection until resumed. */
   pausedCodexAccountIds?: string[];
+  /**
+   * Codex pool selection policy. Absent means no policy, so an existing install rotates exactly
+   * as before.
+   *
+   * Not in `getDefaultConfig()` on purpose — that function carries no optional-feature keys, so
+   * absence is the only default state this policy has.
+   */
+  codexPool?: OcxCodexPoolConfig;
   /** Opt-in per-account activation of newly reset Codex quota windows. */
   codexQuotaAutoRefresh?: Record<string, {
     fiveHour?: boolean;
@@ -1175,6 +1209,25 @@ export interface OcxWebSearchSidecarConfig {
   streamRoutedModelOutput?: boolean;
 }
 
+/**
+ * Codex account-pool selection policy.
+ *
+ * This is a selection policy, not a block. An excluded account keeps its credential, quota
+ * history, and thread affinity, stays visible on the account surface, and remains reachable by
+ * explicit account selection. Only automatic rotation skips it.
+ */
+export interface OcxCodexPoolConfig {
+  /**
+   * Plan keys ordinary rotation skips, matched case-insensitively against the plan stored on each
+   * account. Absent or empty means no policy.
+   *
+   * There is no `minimumPlan` counterpart: ranking ChatGPT plans against each other needs a total
+   * ordering this repository does not have, and inventing one would silently drain a tier the
+   * operator never meant to exclude.
+   */
+  excludedPlans?: string[];
+}
+
 /**
  * Quota-reset notification settings.
  *

package/src/update/badge.ts

@@ -1,13 +1,14 @@
 /**
  * Cached "is an update available?" answer for the GUI sidebar badge.
  *
- * `/api/update/check` spawns `npm view` on every call (~1s, network-bound), so a
+ * `/api/update/check` spawns the installing manager's `view` command on every call
+ * (~1s, network-bound), so a
  * sidebar that polls it would spawn a process per tick on every page of the GUI.
  * The badge instead READS the 20h version cache the CLI update prompt already
  * maintains (`~/.opencodex/version.json`).
  *
  * This is deliberately read-only: it must never trigger a registry refresh. The GUI
- * polls it, so a refresh-on-read would let repeated polls launch repeated `npm view`
+ * polls it, so a refresh-on-read would let repeated polls launch repeated manager `view`
  * helpers with no coalescing. Cache warming stays with `ocx start`
  * (`triggerBackgroundRefreshIfStale` in `src/update/notify.ts`) and with the explicit
  * `/api/update/check` the user reaches by clicking the sidebar update button.

package/src/update/index.ts

@@ -3,13 +3,23 @@ import { STOP_HISTORY_INCOMPLETE_EXIT_CODE } from "./stop-contract.mjs";
 import { proxyIdentityAt } from "../server/proxy-liveness";
 import { probeProxyLiveness } from "./proxy-liveness-probe.mjs";
 import { decidePostStopUpdate } from "./stop-decision.mjs";
-import { readFileSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { fileURLToPath } from "node:url";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { getConfigDir, loadConfig } from "../config";
 import { readPid, readRuntimePort } from "../config/process-state";
 import { pendingTeardownOutstanding } from "../config/pending-teardown";
 import { npmInvocation } from "./npm-invocation.mjs";
+import { pnpmInvocation, pnpmInvocationForPath, resolvePnpmCommands } from "./pnpm-invocation.mjs";
+import { detectInstallFromPath } from "./install-detection.mjs";
+import {
+  pnpmOwnerInvocation,
+  readPnpmGlobalPackage,
+  resolvePnpmGlobalOwner,
+  runPnpmGlobalUpdate,
+} from "./pnpm-global-install.mjs";
+import type { PnpmGlobalOwner, PnpmGlobalOwnerResult } from "./pnpm-global-install.mjs";
+import { checkRegistryPackageIntegrity } from "./registry-integrity.mjs";
 import {
   npmCachePreflightFailureMessage,
   runNpmCachePreflight,
@@ -35,13 +45,101 @@ export function historyRestoreIncomplete(configDir = getConfigDir()): boolean {
 export const PKG = "@bitkyc08/opencodex";
 const HERE = dirname(fileURLToPath(import.meta.url)); // .../opencodex/src/update
 
-export type Installer = "bun" | "npm" | "source";
+export type Installer = "bun" | "npm" | "pnpm" | "source";
 export type Channel = "latest" | "preview";
 
 /** Infer how opencodex is installed from the running module's path. */
 export function detectInstall(): Installer {
-  if (!HERE.includes("node_modules")) return "source"; // a git checkout, not a global install
-  return HERE.includes(".bun") ? "bun" : "npm";
+  return detectInstallFromPath(HERE, { exists: existsSync });
+}
+
+function packageRoot(): string {
+  return resolve(HERE, "..", "..");
+}
+
+function runningPnpmShimPath(): string | undefined {
+  const invoked = process.argv[1];
+  if (!invoked) return undefined;
+  const name = invoked.replaceAll("\\", "/").split("/").at(-1)?.toLowerCase();
+  if (!new Set(["ocx", "opencodex", "ocx.cmd", "opencodex.cmd", "ocx.ps1", "opencodex.ps1"]).has(name ?? "")) {
+    return undefined;
+  }
+  return resolve(invoked);
+}
+
+function runPnpmCandidate(
+  commandPath: string,
+  args: readonly string[],
+  capture = false,
+): { status: number | null; stdout?: string | null; stderr?: string | null } {
+  const invocation = pnpmInvocationForPath(commandPath, args);
+  if (!invocation) return { status: 1 };
+  return spawnSync(invocation.file, invocation.args, {
+    stdio: capture ? "pipe" : "ignore",
+    encoding: "utf8",
+    timeout: 20_000,
+    windowsHide: true,
+    ...invocation.options,
+  });
+}
+
+/** Resolve the exact pnpm executable/group/bin that own this package. */
+export function resolveCurrentPnpmGlobalOwner(): PnpmGlobalOwnerResult {
+  return resolvePnpmGlobalOwner({
+    packageName: PKG,
+    packagePath: packageRoot(),
+    commandPaths: resolvePnpmCommands(),
+    runningShimPath: runningPnpmShimPath(),
+    runPnpm: runPnpmCandidate,
+  });
+}
+
+function ownerPnpmTarget(
+  owner: PnpmGlobalOwner,
+  args: readonly string[],
+): { bin: string; args: string[]; options: { windowsVerbatimArguments?: boolean }; env: Record<string, string | undefined> } | null {
+  const invocation = pnpmOwnerInvocation(owner, args);
+  if (!invocation) return null;
+  return {
+    bin: invocation.file,
+    args: invocation.args,
+    options: invocation.options,
+    env: invocation.env,
+  };
+}
+
+function runOwnedPnpm(
+  owner: PnpmGlobalOwner,
+  args: readonly string[],
+  capture: boolean,
+  stdio: "inherit" | "pipe" | "ignore" = capture ? "pipe" : "inherit",
+): { status: number | null; stdout?: string | null; stderr?: string | null } {
+  const target = ownerPnpmTarget(owner, args);
+  if (!target) return { status: 1 };
+  return spawnSync(target.bin, target.args, {
+    stdio,
+    encoding: "utf8",
+    timeout: 180_000,
+    windowsHide: true,
+    env: target.env,
+    ...target.options,
+  });
+}
+
+/** Re-read the owning group's active package and return its verified launcher. */
+export function resolvePnpmActiveLauncher(owner: PnpmGlobalOwner): string | null {
+  const active = readPnpmGlobalPackage(
+    PKG,
+    (args, capture = false) => runOwnedPnpm(owner, args, capture),
+    undefined,
+    {
+      owner,
+      expectedGlobalDir: owner.globalDir,
+      expectedGlobalRoot: owner.globalRoot,
+      globalBinDir: owner.globalBinDir,
+    },
+  );
+  return active.ok ? join(active.path, "bin", "ocx.mjs") : null;
 }
 
 export function currentVersion(): string {
@@ -63,14 +161,57 @@ export function updateTag(current: string): Channel {
   return defaultUpdateTag(current);
 }
 
-function npmSpawnTarget(args: readonly string[]): { bin: string; args: string[]; options: { windowsVerbatimArguments?: boolean } } | null {
+type SpawnTarget = {
+  bin: string;
+  args: string[];
+  options: { windowsVerbatimArguments?: boolean };
+  env?: Record<string, string | undefined>;
+};
+
+function npmSpawnTarget(args: readonly string[]): SpawnTarget | null {
   const invocation = npmInvocation(args);
   if (!invocation) return null;
   return { bin: invocation.file, args: invocation.args, options: invocation.options };
 }
 
-function updateSpawnTarget(bin: string, args: readonly string[]): { bin: string; args: string[]; options: { windowsVerbatimArguments?: boolean } } | null {
+function pnpmSpawnTarget(args: readonly string[], owner?: PnpmGlobalOwner): SpawnTarget | null {
+  if (owner) {
+    const invocation = pnpmOwnerInvocation(owner, args);
+    if (!invocation) return null;
+    return {
+      bin: invocation.file,
+      args: invocation.args,
+      options: invocation.options,
+      env: invocation.env,
+    };
+  }
+  const invocation = pnpmInvocation(args);
+  if (!invocation) return null;
+  return { bin: invocation.file, args: invocation.args, options: invocation.options };
+}
+
+function registrySpawnTarget(
+  installer: Installer,
+  args: readonly string[],
+  owner?: PnpmGlobalOwner,
+): SpawnTarget | null {
+  // A pnpm command without an owner would silently fall back to the first PATH
+  // candidate. That is unsafe when multiple PNPM_HOME installations expose the
+  // same version, so registry queries use the same hard binding as mutation.
+  return installer === "pnpm"
+    ? owner ? pnpmSpawnTarget(args, owner) : null
+    : npmSpawnTarget(args);
+}
+
+function selectedPnpmOwner(owner?: PnpmGlobalOwner): PnpmGlobalOwner | undefined {
+  if (owner) return owner;
+  const result = resolveCurrentPnpmGlobalOwner();
+  return result.ok ? result.owner : undefined;
+}
+
+function updateSpawnTarget(bin: string, args: readonly string[]): SpawnTarget | null {
   if (bin === "npm") return npmSpawnTarget(args);
+  if (bin === "pnpm") return pnpmSpawnTarget(args);
   if (process.platform === "win32" && bin === "bun") {
     return { bin: process.execPath, args: [...args], options: {} };
   }
@@ -95,28 +236,46 @@ function logSpawnOutput(label: string, result: { stdout?: string | Buffer | null
   if (stderr) console.error(stderr.length > 4000 ? `${label}${stderr.slice(-4000)}` : stderr);
 }
 
-/** Latest published version from the registry (best-effort; null if npm isn't available). */
-export function latestVersion(tag: string): string | null {
-  const npm = npmSpawnTarget(["view", `${PKG}@${tag}`, "version"]);
-  if (!npm) return null;
-  const r = spawnSync(npm.bin, npm.args, {
+function shellQuote(value: string): string {
+  if (process.platform === "win32") return `"${value.replaceAll("\"", "\\\"")}"`;
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+
+function launcherStartHint(launcher: string, port: number): string {
+  return `${shellQuote(process.execPath)} ${shellQuote(launcher)} start --port ${Math.trunc(port)}`;
+}
+
+/** Latest published version from the registry (best-effort; null if the manager isn't available). */
+export function latestVersion(
+  tag: string,
+  installer: Installer = detectInstall(),
+  owner?: PnpmGlobalOwner,
+): string | null {
+  const resolvedOwner = installer === "pnpm" ? selectedPnpmOwner(owner) : undefined;
+  if (installer === "pnpm" && !resolvedOwner) return null;
+  const manager = registrySpawnTarget(installer, ["view", `${PKG}@${tag}`, "version"], resolvedOwner);
+  if (!manager) return null;
+  const r = spawnSync(manager.bin, manager.args, {
     encoding: "utf8",
     timeout: 12000,
     windowsHide: true,
-    ...npm.options,
+    ...(manager.env ? { env: manager.env } : {}),
+    ...manager.options,
   });
-  return r.status === 0 ? (r.stdout.trim() || null) : null;
+  return r.status === 0 && typeof r.stdout === "string" ? (r.stdout.trim() || null) : null;
 }
 
 /** The global-install command opencodex would run to update on this channel. */
 export function updateCommand(installer: Installer, tag: Channel, resolvedVersion?: string | null): { bin: string; args: string[] } {
-  const bin = installer === "bun" ? "bun" : "npm";
   // Immutable target: when the registry resolved a concrete version, install exactly
   // that version — the dist-tag can move between resolution and install (TOCTOU).
   const target = resolvedVersion || tag;
-  const args = installer === "bun"
-    ? ["add", "-g", `${PKG}@${target}`]
-    : ["install", "-g", `${PKG}@${target}`];
+  if (installer === "bun") return { bin: "bun", args: ["add", "-g", `${PKG}@${target}`] };
+  if (installer === "pnpm") {
+    return { bin: "pnpm", args: ["add", "-g", "--allow-build=bun", `${PKG}@${target}`] };
+  }
+  const bin = "npm";
+  const args = ["install", "-g", `${PKG}@${target}`];
   return { bin, args };
 }
 
@@ -138,26 +297,33 @@ export function updateCommandStr(installer: Installer, tag: Channel, resolvedVer
 export function checkUpdatePackageIntegrity(
   version: string | null,
   spawn: typeof spawnSync = spawnSync,
+  installer: Installer = detectInstall(),
+  owner?: PnpmGlobalOwner,
 ): { ok: true; integrity: string } | { ok: false; reason: string } | { ok: "skipped"; reason: string } {
-  if (!version) return { ok: "skipped", reason: "no resolved version (registry unavailable)" };
-  const npm = npmSpawnTarget(["view", `${PKG}@${version}`, "dist.integrity"]);
-  if (!npm) return { ok: "skipped", reason: "npm executable was not found on a trusted PATH entry" };
-  const r = spawn(
-    npm.bin,
-    npm.args,
-    { encoding: "utf8", timeout: 12000, windowsHide: true, ...npm.options },
-  );
-  // status !== 0 covers nonzero exits AND timeouts (status === null).
-  if (r.status !== 0) return { ok: "skipped", reason: `registry integrity query failed (status ${r.status ?? "timeout"})` };
-  const tokens = (r.stdout ?? "").replace(/["']/g, "").trim().split(/\s+/).filter(Boolean);
-  const match = tokens.find(token => /^sha512-[A-Za-z0-9+/=]+$/.test(token));
-  if (!match) return { ok: false, reason: `registry returned no sha512 integrity for ${PKG}@${version}` };
-  return { ok: true, integrity: match };
+  const resolvedOwner = installer === "pnpm" ? selectedPnpmOwner(owner) : undefined;
+  if (installer === "pnpm" && !resolvedOwner) {
+    return { ok: false, reason: "could not identify pnpm's owning global installation" };
+  }
+  const manager = registrySpawnTarget(installer, ["view", `${PKG}@${version}`, "dist.integrity"], resolvedOwner);
+  if (!manager) return { ok: "skipped", reason: `${installer} executable was not found on a trusted PATH entry` };
+  const result = checkRegistryPackageIntegrity(PKG, version, args => {
+    const target = registrySpawnTarget(installer, args, resolvedOwner);
+    if (!target) return { status: 1 };
+    return spawn(target.bin, target.args, {
+      encoding: "utf8",
+      timeout: 12000,
+      windowsHide: true,
+      ...(target.env ? { env: target.env } : {}),
+      ...target.options,
+    });
+  });
+  return result;
 }
 
 /**
- * `ocx update` fallback for source checkouts and Bun global installs. npm global installs are updated
- * in the Node bin launcher before Bun starts, so Windows does not replace the running Bun binary.
+ * `ocx update` fallback for source checkouts and Bun global installs. npm and pnpm global installs
+ * are updated in the Node bin launcher before Bun starts, so Windows does not replace the running
+ * Bun binary.
  */
 export async function runUpdate(): Promise<void> {
   const installer = detectInstall();
@@ -170,7 +336,13 @@ export async function runUpdate(): Promise<void> {
     return;
   }
 
-  const latest = latestVersion(tag);
+  const ownerResult = installer === "pnpm" ? resolveCurrentPnpmGlobalOwner() : undefined;
+  if (installer === "pnpm" && (!ownerResult || !ownerResult.ok)) {
+    console.error(`⚠️  ${ownerResult?.reason ?? "Could not identify pnpm's owning global installation"}. Aborting before stopping the proxy.`);
+    process.exit(1);
+  }
+  const owner = ownerResult?.ok ? ownerResult.owner : undefined;
+  const latest = latestVersion(tag, installer, owner);
   if (latest && latest === current) {
     console.log(`Already on the latest ${tag} version (v${latest}).`);
     return;
@@ -178,7 +350,7 @@ export async function runUpdate(): Promise<void> {
 
   // Pre-flight integrity metadata check — runs BEFORE the proxy is stopped so an
   // anomalous registry entry aborts without unloading the running service.
-  const integrity = checkUpdatePackageIntegrity(latest);
+  const integrity = checkUpdatePackageIntegrity(latest, spawnSync, installer, owner);
   if (integrity.ok === false) {
     console.error(`⚠️  ${integrity.reason} — aborting the update before stopping the proxy.`);
     process.exit(1);
@@ -198,9 +370,11 @@ export async function runUpdate(): Promise<void> {
   }
 
   const { bin, args: cmdArgs } = updateCommand(installer, tag, latest);
-  const target = updateSpawnTarget(bin, cmdArgs);
+  const target = installer === "pnpm" && owner
+    ? pnpmSpawnTarget(cmdArgs, owner)
+    : updateSpawnTarget(bin, cmdArgs);
   if (!target) {
-    console.error("⚠️  Could not resolve npm from a trusted absolute PATH entry; aborting before stopping the proxy.");
+    console.error(`⚠️  Could not resolve ${bin} from a trusted absolute PATH entry; aborting before stopping the proxy.`);
     process.exit(1);
   }
 
@@ -257,7 +431,9 @@ export async function runUpdate(): Promise<void> {
   // shared client config still points at a proxy that is gone; installing over that
   // silently skips the recovery the receipt was written to trigger (#3008).
   // Full `ocx stop` semantics (drain, service stop, restore).
+  let stopAttempted = false;
   if (serviceWasInstalled || readPid() || readRuntimePort() || pendingTeardownOutstanding()) {
+    stopAttempted = true;
     console.log("⏹  Stopping the running proxy before updating...");
     const stopStdio = updateChildStdio();
     const stop = spawnSync(process.execPath, selfLaunchArgv(["stop"]), {
@@ -266,7 +442,7 @@ export async function runUpdate(): Promise<void> {
       windowsHide: true,
     });
     if (stopStdio === "pipe") logSpawnOutput("", stop);
-    // One decision, shared with the npm launcher (#3008). The two lanes disagreeing about
+    // One decision, shared with the package launcher (#3008). The two lanes disagreeing about
     // the same situation is how this shipped fixed on one side only. Absent PID and runtime
     // files are weak evidence - a crashed-but-listening proxy leaves none - so the captured
     // endpoint is asked, and `null` from proxyIdentityAt covers refusal AND timeout alike.
@@ -310,35 +486,96 @@ export async function runUpdate(): Promise<void> {
   console.log(`Updating${latest ? ` to v${latest}` : ""}…\n$ ${bin} ${cmdArgs.join(" ")}`);
 
   const installStdio = updateChildStdio();
-  const r = spawnSync(target.bin, target.args, {
-    stdio: installStdio,
-    encoding: installStdio === "pipe" ? "utf8" : undefined,
-    timeout: 180000,
-    windowsHide: true,
-    ...target.options,
-  });
+  // Every post-update action below receives this path. For pnpm it is replaced only
+  // by a path returned after tree+shim verification; on rollback, activePath is
+  // likewise returned only after the old group has been verified again.
+  let postUpdateLauncher = join(packageRoot(), "bin", "ocx.mjs");
+  // The pnpm owner preflight has verified this package tree and global group. Keep that exact
+  // package path as the recovery starting point; the path returned by the update transaction
+  // replaces it only after post-update tree+shim verification succeeds.
+  if (installer === "pnpm" && owner) {
+    postUpdateLauncher = join(owner.packagePath, "bin", "ocx.mjs");
+  }
+  let postUpdateLauncherUsable = true;
+  let r: {
+    status: number | null;
+    signal?: NodeJS.Signals | null;
+    stdout?: string | Buffer | null;
+    stderr?: string | Buffer | null;
+  };
+  if (installer === "pnpm") {
+    let update: ReturnType<typeof runPnpmGlobalUpdate>;
+    try {
+      update = runPnpmGlobalUpdate({
+        packageName: PKG,
+        currentVersion: current,
+        targetVersion: latest || undefined,
+        tag,
+        owner: owner!,
+        runningPackagePath: packageRoot(),
+        runPnpm: (args, capture = false) => runOwnedPnpm(
+          owner!,
+          args,
+          capture,
+          capture ? "pipe" : installStdio,
+        ),
+        log: line => console.log(line),
+      });
+    } catch {
+      // A thrown verifier/runner error means the active group is unknown. Mark the
+      // launcher unusable and let the failure lane report a manual recovery path.
+      update = {
+        ok: false,
+        phase: "rollback",
+        rolledBack: false,
+        error: "pnpm update failed unexpectedly; active package could not be verified",
+      };
+    }
+    if (update.ok) {
+      postUpdateLauncher = join(update.path, "bin", "ocx.mjs");
+      postUpdateLauncherUsable = true;
+      r = { status: 0, signal: null, stdout: "", stderr: "" };
+    } else {
+      postUpdateLauncherUsable = Boolean(update.activePath);
+      if (update.activePath) postUpdateLauncher = join(update.activePath, "bin", "ocx.mjs");
+      console.error(`⚠️  ${update.error}${update.rolledBack ? "." : " Manual recovery may be required."}`);
+      r = { status: 1, signal: null, stdout: "", stderr: "" };
+    }
+  } else {
+    r = spawnSync(target.bin, target.args, {
+      stdio: installStdio,
+      encoding: installStdio === "pipe" ? "utf8" : undefined,
+      timeout: 180000,
+      windowsHide: true,
+      ...target.options,
+    });
+  }
   if (installStdio === "pipe") logSpawnOutput("", r);
   if (r.status === 0) {
     console.log(`\n✅ Updated${latest ? ` to v${latest}` : ""}.`);
-    // Re-bake the bundled Bun path into the Codex autostart shim on every
-    // platform when one is installed (refresh-only; never installs fresh).
+    // Re-enter through the verified active package launcher. This keeps the Codex
+    // shim, tray, service and proxy recovery paths on the same package/group that
+    // pnpm selected, including when the update changed the global link target.
     try {
-      const { isCodexShimInstalled, installCodexShim } = await import("../codex/shim");
+      const { isCodexShimInstalled } = await import("../codex/shim");
       if (isCodexShimInstalled()) {
-        const result = installCodexShim();
-        if (result.installed) console.log(`🔧 ${result.message}`);
+        const shim = spawnSync(process.execPath, [postUpdateLauncher, "codex-shim", "install"], {
+          stdio: "inherit",
+          windowsHide: true,
+        });
+        if (shim.status !== 0) console.warn("⚠️  Shim repair skipped: run 'ocx codex-shim install'.");
       }
-    } catch (e) {
-      console.warn(`⚠️  Shim repair skipped: ${e instanceof Error ? e.message : e}`);
+    } catch {
+      console.warn("⚠️  Shim repair skipped; run 'ocx codex-shim install'.");
     }
     if (trayWasInstalled) {
-      const trayArgs = selfLaunchArgv(planWindowsTrayUpdate({ installed: trayWasInstalled, running: trayWasRunning }).installArgs);
-      const tray = spawnSync(process.execPath, trayArgs, { stdio: "inherit", windowsHide: true });
+      const trayArgs = planWindowsTrayUpdate({ installed: trayWasInstalled, running: trayWasRunning }).installArgs;
+      const tray = spawnSync(process.execPath, [postUpdateLauncher, ...trayArgs], { stdio: "inherit", windowsHide: true });
       if (tray.status === 0) {
         console.log("🔧 Refreshed Windows tray startup paths.");
       } else {
         console.warn("⚠️  Windows tray refresh failed. Run 'ocx tray install'.");
-        if (trayWasRunning) spawnSync(process.execPath, selfLaunchArgv(["tray", "start"]), { stdio: "ignore", windowsHide: true });
+        if (trayWasRunning) spawnSync(process.execPath, [postUpdateLauncher, "tray", "start"], { stdio: "ignore", windowsHide: true });
       }
     }
     // The stop above unloaded any managed service; repair it with the NEW files
@@ -362,7 +599,7 @@ export async function runUpdate(): Promise<void> {
       process.env.OCX_BAKE_PORT = String(capturedListen.port);
       try {
         const svcStdio = updateChildStdio();
-        const svc = spawnSync(process.execPath, selfLaunchArgv(serviceReinstallArgs()), {
+        const svc = spawnSync(process.execPath, [postUpdateLauncher, ...serviceReinstallArgs()], {
           stdio: svcStdio,
           encoding: svcStdio === "pipe" ? "utf8" : undefined,
           windowsHide: true,
@@ -407,7 +644,7 @@ export async function runUpdate(): Promise<void> {
               : "   Run 'ocx service repair' to refresh the background service and see why it failed.");
             const env = { ...process.env };
             delete env.OCX_SERVICE;
-            const child = spawn(process.execPath, selfLaunchArgv(["start", "--port", String(capturedListen.port)]), {
+            const child = spawn(process.execPath, [postUpdateLauncher, "start", "--port", String(capturedListen.port)], {
               detached: true,
               stdio: "ignore",
               windowsHide: true,
@@ -422,14 +659,30 @@ export async function runUpdate(): Promise<void> {
         else process.env.OCX_BAKE_PORT = prevBake;
       }
     } else {
-      console.log(`Restart the proxy:  ocx start --port ${capturedListen.port}`);
+      console.log(`Restart the proxy:  ${launcherStartHint(postUpdateLauncher, capturedListen.port)}`);
     }
   } else {
-    if (trayWasRunning) {
-      try {
-        const { startWindowsTray } = await import("../tray/windows");
-        startWindowsTray();
-      } catch { /* keep the primary update failure */ }
+    if (stopAttempted && trayWasRunning && postUpdateLauncherUsable) {
+      spawnSync(process.execPath, [postUpdateLauncher, "tray", "start"], { stdio: "ignore", windowsHide: true });
+    }
+    if (stopAttempted && serviceWasInstalled && postUpdateLauncherUsable) {
+      const service = spawnSync(process.execPath, [postUpdateLauncher, "service", "repair"], {
+        stdio: "inherit",
+        windowsHide: true,
+      });
+      if (service.status !== 0) console.warn("⚠️  Previous background service could not be restored; run 'ocx service repair'.");
+    } else if (stopAttempted && postUpdateLauncherUsable) {
+      const env = { ...process.env };
+      delete env.OCX_SERVICE;
+      const child = spawn(process.execPath, [postUpdateLauncher, "start", "--port", String(capturedListen.port)], {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+        env: withProcessRuntimeProvenance(env),
+      });
+      child.unref();
+    } else if (stopAttempted) {
+      console.error("opencodex: no verified active launcher remains for automatic recovery; reinstall opencodex manually.");
     }
     console.error(`\n⚠️  Update failed (${bin} exit ${r.status ?? "?"}). Try manually:  ${bin} ${cmdArgs.join(" ")}`);
     process.exit(1);

package/src/update/install-detection.d.mts

@@ -0,0 +1,6 @@
+export type DetectedInstall = "bun" | "npm" | "pnpm" | "source";
+
+export declare function detectInstallFromPath(
+  packagePath: string,
+  deps?: { exists?: (path: string) => boolean; realpath?: (path: string) => string },
+): DetectedInstall;