@bitkyc08/opencodex 2.63.0-preview.20260923 → 2.64.0-preview.20260923

package/src/claude/agents-inject.ts

@@ -36,6 +36,7 @@ export interface ClaudeAgentDef {
 const OWNED_PREFIX = "ocx-";
 /** Ownership proof (audit 071 #2): a file without this marker is NEVER touched. */
 const GENERATED_MARKER = "generated-by: opencodex";
+const SAFE_AGENT_MODEL_ID = /^[a-z0-9][a-z0-9._:/@+\[\]~-]*$/i;
 
 function sanitizeName(value: string): string {
   const cleaned = value.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
@@ -156,7 +157,7 @@ export function buildClaudeAgentDefs(
   const roster = rosterOverride
     ?? (config.subagentModels === undefined ? DEFAULT_SUBAGENT_MODELS : config.subagentModels);
   for (const entry of roster.slice(0, 5)) {
-    if (typeof entry !== "string" || entry.trim() === "") continue;
+    if (typeof entry !== "string" || !SAFE_AGENT_MODEL_ID.test(entry.trim())) continue;
     const { alias, id, provider } = entryParts(entry.trim(), config);
     push(sanitizeName(id), alias, `Delegate work to ${id} (${provider}) via opencodex routing. General-purpose worker/explorer on that model. ${NO_MODEL_ARG}`);
   }

package/src/claude/desktop-applied-marker.ts

@@ -0,0 +1,44 @@
+import { mutatePersistedConfig, type PersistedConfigMutationOutcome } from "../config";
+import { emptyDesktopProfile, sameProfileContent, type DesktopProfile } from "./desktop-profile";
+
+export interface DesktopAppliedMarkerBaseline {
+  profile: DesktopProfile | undefined;
+  appliedFingerprint: string | undefined;
+  appliedAt: string | undefined;
+}
+
+export function captureDesktopAppliedMarker(
+  profile: DesktopProfile | undefined,
+): DesktopAppliedMarkerBaseline {
+  const snapshot = profile == null ? undefined : structuredClone(profile);
+  return {
+    profile: snapshot,
+    appliedFingerprint: snapshot?.appliedFingerprint,
+    appliedAt: snapshot?.appliedAt,
+  };
+}
+
+export function commitDesktopAppliedMarker(
+  baseline: DesktopAppliedMarkerBaseline,
+  fingerprint: string,
+): PersistedConfigMutationOutcome<boolean> {
+  const appliedAt = new Date().toISOString();
+  return mutatePersistedConfig<boolean>(persisted => {
+    const profile = persisted.claudeCode?.desktopProfile;
+    if ((profile == null) !== (baseline.profile === undefined)
+      || (profile && baseline.profile && !sameProfileContent(profile, baseline.profile))
+      || profile?.appliedFingerprint !== baseline.appliedFingerprint
+      || profile?.appliedAt !== baseline.appliedAt) {
+      return { changed: false, value: false };
+    }
+    persisted.claudeCode = {
+      ...(persisted.claudeCode ?? {}),
+      desktopProfile: {
+        ...(profile ?? emptyDesktopProfile()),
+        appliedFingerprint: fingerprint,
+        appliedAt,
+      },
+    };
+    return { changed: true, value: true };
+  });
+}

package/src/claude/desktop-profile.ts

@@ -77,15 +77,6 @@ function assertExactKeys(value: Record<string, unknown>, keys: readonly string[]
   }
 }
 
-/**
- * Applied-state markers survive every profile rebuild.
- *
- * `parseDesktopProfile`, `reconcileDesktopProfile` and `moveDesktopRoute` each construct a
- * fresh `{ version, assignments, defaults }`, and the management routes persist whatever they
- * return. Without this carry-through, saving an assignment — or merely dragging a model to
- * another family — would erase the fingerprint the apply route wrote, and the GUI would report
- * "not applied" for a config that is applied on disk.
- */
 function appliedMarkers(source: { appliedFingerprint?: unknown; appliedAt?: unknown }): {
   appliedFingerprint?: string;
   appliedAt?: string;
@@ -96,6 +87,19 @@ function appliedMarkers(source: { appliedFingerprint?: unknown; appliedAt?: unkn
   };
 }
 
+export function sameProfileContent(left: DesktopProfile, right: DesktopProfile): boolean {
+  return DESKTOP_FAMILIES.every(family => left.defaults[family] === right.defaults[family])
+    && JSON.stringify(Object.entries(left.assignments).sort(([a], [b]) => a.localeCompare(b)))
+      === JSON.stringify(Object.entries(right.assignments).sort(([a], [b]) => a.localeCompare(b)));
+}
+
+/** Retain applied-state bookkeeping only when the desired Desktop config is unchanged. */
+export function preserveDesktopAppliedState(source: DesktopProfile, rebuilt: DesktopProfile): DesktopProfile {
+  return sameProfileContent(source, rebuilt)
+    ? { ...rebuilt, ...appliedMarkers(source) }
+    : rebuilt;
+}
+
 function isFamily(value: unknown): value is DesktopFamily {
   return typeof value === "string" && (DESKTOP_FAMILIES as readonly string[]).includes(value);
 }
@@ -244,7 +248,8 @@ export function reconcileDesktopProfile(
     const current = defaults[family];
     defaults[family] = current && assignments[current]?.family === family ? current : (members[0] ?? null);
   }
-  return parseDesktopProfile({ version: 1, assignments, defaults, ...appliedMarkers(profile) });
+  const rebuilt = parseDesktopProfile({ version: 1, assignments, defaults });
+  return preserveDesktopAppliedState(profile, rebuilt);
 }
 
 export function moveDesktopRoute(
@@ -268,7 +273,7 @@ export function moveDesktopRoute(
   const destinationMembers = Object.keys(assignments).filter(key => assignments[key]!.family === family).sort();
   if (makeDefault || !defaults[family] || assignments[defaults[family]!]?.family !== family) defaults[family] = route;
   if (!defaults[family] && destinationMembers.length > 0) defaults[family] = destinationMembers[0]!;
-  return parseDesktopProfile({ version: 1, assignments, defaults, ...appliedMarkers(parsed) });
+  return parseDesktopProfile({ version: 1, assignments, defaults });
 }
 
 export function setDesktopFamilyDefault(
@@ -280,7 +285,12 @@ export function setDesktopFamilyDefault(
   const members = Object.keys(parsed.assignments).filter(key => parsed.assignments[key]!.family === family);
   if (route === null && members.length > 0) throw new DesktopProfileError("cannot clear a non-empty family default", `profile.defaults.${family}`);
   if (route !== null && parsed.assignments[route]?.family !== family) throw new DesktopProfileError("route is not a member of this family", `profile.defaults.${family}`);
-  return parseDesktopProfile({ ...parsed, defaults: { ...parsed.defaults, [family]: route } });
+  const rebuilt = parseDesktopProfile({
+    version: 1,
+    assignments: parsed.assignments,
+    defaults: { ...parsed.defaults, [family]: route },
+  });
+  return preserveDesktopAppliedState(parsed, rebuilt);
 }
 
 export function renderDesktopProfile(

package/src/claude/inbound.ts

@@ -118,6 +118,7 @@ export function effectiveBlockedSkillNames(cc?: Pick<OcxClaudeCodeConfig, "block
 /** Injected-skill payloads below this size are never stubbed (not worth it). */
 const SKILL_ELISION_MIN_CHARS = 10_000;
 const SKILL_TEXT_MARKER = "Base directory for this skill: ";
+const SKILL_TEXT_PATH_MAX_CHARS = 4_096;
 
 interface SkillElisionContext {
   /** Skill-tool call ids whose input names a blocked skill (result-body carrier). */
@@ -138,11 +139,15 @@ const NO_ELISION: SkillElisionContext = { callIds: new Set(), names: [] };
 function maybeElideSkillText(text: string, names: readonly string[]): string {
   if (names.length === 0 || text.length < SKILL_ELISION_MIN_CHARS) return text;
   if (!text.startsWith(SKILL_TEXT_MARKER)) return text;
-  const firstLineEnd = text.indexOf("\n");
-  const dir = text.slice(SKILL_TEXT_MARKER.length, firstLineEnd === -1 ? text.length : firstLineEnd).trim();
+  const pathStart = SKILL_TEXT_MARKER.length;
+  const pathPrefix = text.slice(pathStart, pathStart + SKILL_TEXT_PATH_MAX_CHARS + 1);
+  const firstLineEnd = pathPrefix.indexOf("\n");
+  if (firstLineEnd === -1 && pathPrefix.length > SKILL_TEXT_PATH_MAX_CHARS) return text;
+  const dir = pathPrefix.slice(0, firstLineEnd === -1 ? pathPrefix.length : firstLineEnd).trim();
   // Windows clients send `C:\Users\...\claude-api`; normalize separators before
   // basenaming (repo precedent: src/codex/inject.ts isOpencodexCatalogPath).
-  const base = dir.replace(/\\/g, "/").split("/").filter(Boolean).pop()?.toLowerCase() ?? "";
+  const normalizedDir = dir.replace(/\\/g, "/").replace(/\/+$/, "");
+  const base = normalizedDir.slice(normalizedDir.lastIndexOf("/") + 1).toLowerCase();
   if (!names.includes(base)) return text;
   return `[opencodex] '${base}' skill document bundle (${text.length} chars) elided for routed models `
     + "(claudeCode.blockedSkills). The skill is loaded; answer from general knowledge instead of citing the bundle.";

package/src/cli/access.ts

@@ -22,6 +22,19 @@ const USAGE = `Usage:
   ocx access models [--json]
   ocx access test <model> [--protocol <chat|responses|messages>] [--json]`;
 
+const UTC_ISO_INSTANT_RE = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?Z$/;
+
+/**
+ * The server emits `attributionSince` with `toISOString()`. `Date.parse` alone also accepts
+ * strings such as "0", so require the ISO-8601 UTC shape and an instant that round-trips to the
+ * same second, which also rejects impossible dates the parser would roll over.
+ */
+function isUtcIsoInstant(value: unknown): value is string {
+  if (typeof value !== "string" || !UTC_ISO_INSTANT_RE.test(value)) return false;
+  const parsed = Date.parse(value);
+  return Number.isFinite(parsed) && new Date(parsed).toISOString().slice(0, 19) === value.slice(0, 19);
+}
+
 /**
  * Render the key table with the usage fields the API already returns (#2705).
  *
@@ -38,6 +51,10 @@ const USAGE = `Usage:
  */
 function formatKeyRows(payload: Record<string, unknown>, keys: Array<Record<string, unknown>>): string[] {
   const cells: string[][] = [["ID", "NAME", "PREFIX", "REQ 7D", "TOTAL", "LAST USED"]];
+  // A string that is not an ISO-8601 UTC instant is not attribution data: treat it like an
+  // absent field so malformed payloads still render "unavailable" instead of usage values.
+  const attributionSince = isUtcIsoInstant(payload.attributionSince) ? payload.attributionSince : undefined;
+  const usageAvailable = attributionSince !== undefined;
   for (const entry of keys) {
     const usage = (entry.usage ?? {}) as Record<string, unknown>;
     const ambiguous = usage.ambiguous === true;
@@ -47,16 +64,16 @@ function formatKeyRows(payload: Record<string, unknown>, keys: Array<Record<stri
       String(entry.name ?? ""),
       String(entry.prefix ?? ""),
       // One marker spanning both numeric columns: the union guarantees neither exists.
-      ambiguous ? "ambiguous" : num(usage.requests7d),
-      ambiguous ? "" : num(usage.totalRequests),
-      ambiguous ? "" : (typeof usage.lastUsedAt === "string" ? usage.lastUsedAt : "never"),
+      !usageAvailable ? "unavailable" : ambiguous ? "ambiguous" : num(usage.requests7d),
+      !usageAvailable || ambiguous ? "" : num(usage.totalRequests),
+      !usageAvailable || ambiguous ? "" : (typeof usage.lastUsedAt === "string" ? usage.lastUsedAt : "never"),
     ]);
   }
   const widths = cells[0]!.map((_, column) => Math.max(...cells.map(row => (row[column] ?? "").length)));
   const lines = cells.map(row => row.map((cell, i) => (cell ?? "").padEnd(widths[i]!)).join("  ").trimEnd());
   const footer: string[] = [];
-  if (typeof payload.attributionSince === "string") {
-    footer.push(`attribution since ${payload.attributionSince}`);
+  if (attributionSince !== undefined) {
+    footer.push(`attribution since ${attributionSince}`);
   }
   if (payload.historyTruncated === true) {
     footer.push("older history truncated");

package/src/cli/account-api.ts

@@ -33,6 +33,8 @@ export interface AccountRow {
   validationPending?: boolean;
   /** Codex pool selection order, higher used earlier. Absent where ordering does not apply. */
   priority?: number;
+  /** Null means the account inherits the global usage-switch threshold. */
+  autoSwitchThresholdOverride?: number | null;
   quota?: CodexQuotaDto | null;
   quotaRefresh?: CodexQuotaRefreshOutcome;
   quotaUnavailable?: boolean;
@@ -252,6 +254,7 @@ interface CodexAccountDto {
   selectionExcludedPlan?: string;
   health?: { reason?: string };
   priority?: number;
+  autoSwitchThresholdOverride?: number | null;
   quota?: CodexQuotaDto | null;
   quotaRefresh?: unknown;
   paused?: boolean;
@@ -322,6 +325,9 @@ export async function fetchCodexRows(
     } : {}),
     ...(a.health?.reason === "validation_pending" ? { validationPending: true } : {}),
     priority: typeof a.priority === "number" ? a.priority : 0,
+    autoSwitchThresholdOverride: typeof a.autoSwitchThresholdOverride === "number"
+      ? a.autoSwitchThresholdOverride
+      : null,
     paused: a.paused === true,
     ...(includeQuota ? {
       quota: projectQuota(a.quota),

package/src/cli/account-auth.ts

@@ -36,7 +36,7 @@ function writeStdoutFully(text: string): void {
 const USAGE = `Usage:
   ocx account login <provider> [--id <account-id>] [--reauth] [--device] [--code -] [--no-wait] [--json]
   ocx account code <provider> [--flow <flow-id>] [--json]   (reads the code from stdin)
-  ocx account cancel <provider> [--flow <flow-id>] [--json]
+  ocx account cancel <provider> [--flow <flow-id>] [--json] (--flow required for codex)
   ocx account reset-credits <account-id|main> [--consume --yes [--operation-id <uuid>]] [--json]
   ocx account grok-reset-coupons [<account-id>] [--consume --yes [--token-id <token-id>] [--operation-id <uuid>]] [--json]
 
@@ -281,10 +281,13 @@ async function cancel(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const args = [...argv];
   const provider = args.shift()?.trim().toLowerCase();
   const wantsJson = takeFlag(args, "--json");
-  const flowId = takeOption(args, "--flow");
+  const flowId = takeOption(args, "--flow")?.trim();
   if (!provider) throw new CliUsageError("provider is required", USAGE);
   rejectArgs(args, USAGE);
   const codex = CODEX_NAMES.has(provider);
+  if (codex && !flowId) {
+    throw new CliUsageError("Codex login cancel requires --flow <flow-id> (printed by 'ocx account login').", USAGE);
+  }
   const result = await runtimeRequest(codex ? "/api/codex-auth/login/cancel" : "/api/oauth/login/cancel", {
     method: "POST",
     body: JSON.stringify(codex ? { flowId } : { provider }),

package/src/cli/account.ts

@@ -60,7 +60,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account import-orca --source <orca-data-directory> --registry <orca-data.json> [--apply] [--json]
   ocx account login <provider> [--id <account-id>] [--reauth] [--code -] [--no-wait] [--json]
   ocx account code <provider> [--flow <flow-id>] [--json]   (reads the code from stdin)
-  ocx account cancel <provider> [--flow <flow-id>] [--json]
+  ocx account cancel <provider> [--flow <flow-id>] [--json] (--flow required for codex)
   ocx account reset-credits <account-id|main> [--consume --yes] [--json]
   ocx account grok-reset-coupons [<account-id>] [--consume --yes] [--token-id <token-id>] [--json]
   ocx account main <doctor|list|register|add|reauth|switch|recover> ...
@@ -340,10 +340,9 @@ async function cmdUse(rest: string[], deps: AccountDeps): Promise<number> {
   }
   if (c.type === "codex") {
     console.error("Takes effect immediately; running threads move on their next request, and in-flight requests keep the account they captured.");
-    const active = await apiJson(deps, baseUrl, "GET", "/api/codex-auth/active");
-    const threshold = active.status === 200 && typeof active.json.autoSwitchThreshold === "number"
-      ? active.json.autoSwitchThreshold
-      : undefined;
+    const state = await fetchRows(deps, baseUrl, name, "codex");
+    const selected = state.rows.find(row => row.id === activeId);
+    const threshold = selected?.autoSwitchThresholdOverride ?? state.autoSwitchThreshold;
     if (pinDrainReason !== undefined) {
       // "may override" is the right caveat for a pin that is currently fine and could be
       // overtaken later. It is the wrong sentence for one the next request will discard, and
@@ -352,7 +351,7 @@ async function cmdUse(rest: string[], deps: AccountDeps): Promise<number> {
         ? `is at or above the auto-switch threshold${threshold !== undefined ? ` (${threshold}%)` : ""}`
         : `cannot currently be selected (${pinDrainReason})`;
       console.error(`Note: ${displayId(activeId)} ${because}, so routing releases this pin on its next request.`);
-    } else if (threshold !== undefined && threshold > 0) {
+    } else if (state.status === 200 && typeof threshold === "number" && threshold > 0) {
       console.error(`Note: auto-switch (threshold ${threshold}%) may override this pin.`);
     }
   }

package/src/cli/aside-profiles.ts

@@ -1,10 +1,70 @@
 import type { OwnedIntegrationRefreshOutcome } from "../integrations/owned-refresh";
+import { readRuntimePort } from "../config/process-state";
+import { createLocalAttestationChallenge, LOCAL_ATTESTATION_CHALLENGE_HEADER, LOCAL_ATTESTATION_PROOF_HEADER, verifyLocalAttestationProof } from "../lib/local-management-attestation";
+import { createLocalAsideSyncCapability, LOCAL_ASIDE_SYNC_CAPABILITY_HEADER, LOCAL_ASIDE_SYNC_CAPABILITY_TTL_MS, LOCAL_ASIDE_SYNC_CAPABILITY_VERSION, LOCAL_ASIDE_SYNC_EXPECTED_PID_HEADER, LOCAL_ASIDE_SYNC_EXPIRES_AT_HEADER, LOCAL_ASIDE_SYNC_METHOD, LOCAL_ASIDE_SYNC_NONCE_HEADER, LOCAL_ASIDE_SYNC_PATH } from "../lib/local-aside-sync-contract";
+import { directLocalHttpFetch } from "../server/direct-local-http";
+import { findLiveProxy, isOpencodexHealthz, probeHostname } from "../server/proxy-liveness";
 import { runtimeRequest, RuntimeApiError, type RuntimeApiDeps } from "./runtime-api";
 
 /** Aside policy and file writes share the running server's mutation owner. Never fall back locally. */
 export async function refreshAsideProfilesThroughServer(
-  deps: RuntimeApiDeps = {},
+  // The optional transport seam observes the real direct-local exchange in listener tests.
+  deps: RuntimeApiDeps & {
+    directLocalFetch?: typeof directLocalHttpFetch;
+    exchangeDeadlineMs?: number;
+    scheduleExchangeDeadline?: (onTimeout: () => void, delayMs: number) => () => void;
+  } = {},
 ): Promise<OwnedIntegrationRefreshOutcome[]> {
+  // An explicit URL is an opt-in transport used by connected callers and tests.
+  if (!deps.baseUrl) {
+    const localFetch = deps.directLocalFetch ?? directLocalHttpFetch;
+    const controller = new AbortController();
+    const onTimeout = () => controller.abort(new DOMException("The Aside sync exchange timed out", "TimeoutError"));
+    const cancelDeadline = (deps.scheduleExchangeDeadline ?? ((callback, delayMs) => {
+      const timer = setTimeout(callback, delayMs);
+      return () => clearTimeout(timer);
+    }))(onTimeout, deps.exchangeDeadlineMs ?? LOCAL_ASIDE_SYNC_CAPABILITY_TTL_MS);
+    const deadline = controller.signal;
+    try {
+      const live = await (deps.findLiveProxy ?? findLiveProxy)();
+      if (!live) throw new RuntimeApiError("Proxy is not running. Start it with: ocx start", 503, null);
+      if (live.source !== "runtime" || live.pid === null) {
+        throw new RuntimeApiError("Aside profile synchronization requires an attested running proxy", 503, null);
+      }
+      const runtime = readRuntimePort(live.pid);
+      if (!runtime?.attestationSecret || runtime.pid !== live.pid || runtime.port !== live.port) {
+        throw new RuntimeApiError("Aside profile synchronization could not verify the running proxy", 503, null);
+      }
+      const nonce = createLocalAttestationChallenge();
+      const baseUrl = `http://${probeHostname(live.hostname)}:${live.port}`;
+      const proofResponse = await localFetch(`${baseUrl}/healthz`, { headers: { [LOCAL_ATTESTATION_CHALLENGE_HEADER]: nonce }, signal: deadline });
+      const health = await proofResponse.json().catch(() => null);
+      if (!proofResponse.ok || !isOpencodexHealthz(health) || health?.pid !== live.pid || health?.port !== live.port
+        || health?.asideSyncCapability !== LOCAL_ASIDE_SYNC_CAPABILITY_VERSION
+        || !verifyLocalAttestationProof(runtime.attestationSecret, nonce, live.pid, live.port, proofResponse.headers.get(LOCAL_ATTESTATION_PROOF_HEADER))) {
+        throw new RuntimeApiError("Aside profile synchronization could not attest the running proxy", 503, null);
+      }
+      const expiresAt = Date.now() + LOCAL_ASIDE_SYNC_CAPABILITY_TTL_MS;
+      const capability = createLocalAsideSyncCapability(runtime.attestationSecret, nonce, LOCAL_ASIDE_SYNC_METHOD, LOCAL_ASIDE_SYNC_PATH, live.pid, live.port, expiresAt);
+      if (!capability) throw new RuntimeApiError("Aside profile synchronization capability was unavailable", 503, null);
+      const response = await localFetch(`${baseUrl}${LOCAL_ASIDE_SYNC_PATH}`, {
+        method: LOCAL_ASIDE_SYNC_METHOD,
+        signal: deadline,
+        headers: {
+          [LOCAL_ASIDE_SYNC_EXPECTED_PID_HEADER]: String(live.pid),
+          [LOCAL_ASIDE_SYNC_NONCE_HEADER]: nonce,
+          [LOCAL_ASIDE_SYNC_EXPIRES_AT_HEADER]: String(expiresAt),
+          [LOCAL_ASIDE_SYNC_CAPABILITY_HEADER]: capability,
+        },
+      });
+      const body = await response.json().catch(() => null) as { results?: OwnedIntegrationRefreshOutcome[] } | null;
+      if (!response.ok) throw new RuntimeApiError("Aside profile synchronization was rejected", response.status, body);
+      if (!Array.isArray(body?.results)) throw new RuntimeApiError("The running proxy does not support Aside profile synchronization", 502, body);
+      return body.results;
+    } finally {
+      cancelDeadline();
+    }
+  }
   const result = await runtimeRequest<{ results?: OwnedIntegrationRefreshOutcome[] }>(
     "/api/client-integrations/aside/sync",
     { method: "POST", body: "{}" },

package/src/cli/claude-desktop.ts

@@ -398,7 +398,8 @@ export async function handleClaudeDesktopCommand(argv: string[], deps: ApplyProf
   const applyInvocation = argv.length === 0 || command === "apply" || applyFlags.length > 0;
   if (applyInvocation) {
     const rest = argv.filter(arg => arg !== "apply");
-    const parsedTarget = parseDesktopApplyArgs(rest, loadConfig());
+    const preApplyConfig = loadConfig();
+    const parsedTarget = parseDesktopApplyArgs(rest, preApplyConfig);
     if ("error" in parsedTarget) { console.error(parsedTarget.error); return 2; }
     const { target } = parsedTarget;
     try {
@@ -424,7 +425,7 @@ export async function handleClaudeDesktopCommand(argv: string[], deps: ApplyProf
         console.log(`Claude Desktop gateway 설정을 적용했습니다: ${result.path}`);
         for (const line of gatewayModeExplanation({
           requestedExplicitly: applyFlags.some(flag => flag !== "--first-party"),
-          config: loadConfig(),
+          config: preApplyConfig,
         })) {
           console.log(line);
         }

package/src/cli/claude.ts

@@ -572,7 +572,6 @@ export function claudeLaunchPreflight(
  */
 const NATIVE_STRIPPED_LEVERS = [
   "CLAUDE_CODE_ENABLE_GATEWAY_MODEL_DISCOVERY",
-  "CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST",
   "CLAUDE_CODE_MAX_CONTEXT_TOKENS",
   "CLAUDE_CODE_AUTO_COMPACT_WINDOW",
   "CLAUDE_CODE_ALWAYS_ENABLE_EFFORT",
@@ -632,6 +631,9 @@ export function buildNativeClaudeEnv(
   }
 
   for (const name of NATIVE_STRIPPED_LEVERS) delete env[name];
+  // An explicit caller-owned guard must follow a caller-owned gateway and credential;
+  // otherwise settings.env can replace the destination while retaining the credential.
+  if (hasOwnedAdmission) delete env.CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST;
   const providerNames = Object.keys(config.providers);
   for (const name of MODEL_ENV_SLOT_NAMES) {
     const value = env[name];

package/src/cli/codex-cli-update.ts

@@ -31,7 +31,7 @@ export interface CodexCliUpdateCommandDeps {
   readonly inspectIdentity?: (input: CodexCliInstallationIdentityInput) => Promise<CodexCliInstallationIdentityReport>;
   readonly deriveInstallationInput?: (
     snapshot: CodexCliInstallationSnapshot,
-  ) => CodexCliInstallationTargetDerivation;
+  ) => Promise<CodexCliInstallationTargetDerivation>;
 }
 
 function identitySummary(report: CodexCliInstallationIdentityReport): string[] {
@@ -148,7 +148,7 @@ export async function handleCodexCliUpdateCommand(
           const snapshot = trustedNodeLauncherContext()?.codexCliInspectionEnv;
           const derive = deps.deriveInstallationInput
             ?? (await import("../codex/cli-installation-targets")).deriveCodexCliInstallationInput;
-          const derived = derive({
+          const derived = await derive({
             codexCliPath: snapshot?.codexCliPath ?? null,
             path: snapshot?.path ?? null,
             pathExt: snapshot?.pathExt ?? null,

package/src/cli/codex-shim-autorestore.ts

@@ -22,6 +22,9 @@ export function skipsCodexShimAutoRestore(command: string | undefined, args: str
   // `resolve` is read-only inspection for embedding shells: a lookup made to populate
   // a consent surface must not trigger a shim repair side effect first.
   if (command === "resolve") return true;
+  // The desktop's approval-bound stop must validate its snapshot before any unrelated
+  // CLI repair changes the installation it was approved against.
+  if (command === "stop" && args.some(arg => arg.startsWith("--expect-"))) return true;
   // The entire updater-inspection namespace is zero-effect, including malformed
   // or future actions. A later `apply` implementation must own its preflight.
   if (command === "system" && args[1] === "codex-cli-update") return true;

package/src/cli/dispatch.ts

@@ -30,6 +30,7 @@ import { handleRestartScopeAfterWrite, readRestartScope, type RestartScope } fro
 import { normalizeUpdateChannel, runGuiUpdateWorker } from "../update/job";
 import { isJsonOption, takeFlag, terminalSafeError } from "./runtime-api";
 import { printStopSummary, type StopOutcome } from "./stop-report";
+import { parseStopApproval, type StopApproval } from "./stop-approval";
 import type { ResolveArgs } from "./resolve";
 import type { ClientConnectionState } from "../client/state";
 import { OCX_NATIVE_REPLAY_RECOVERY_NOTE } from "../responses/compaction";
@@ -46,7 +47,7 @@ export interface CliDispatchDeps {
   /** Spawn a detached proxy child (stdio ignore, unref'd, provenance env). */
   spawnDetached: (argv: readonly string[]) => void;
   handleStart: () => Promise<void>;
-  handleStop: () => Promise<StopOutcome>;
+  handleStop: (approval?: StopApproval) => Promise<StopOutcome>;
   handleEnsure: (options?: { existingIsSuccess?: boolean }) => Promise<boolean>;
   handleResolve: (args: ResolveArgs) => Promise<number>;
   handleTrayProxyStart: (existingIsSuccess?: boolean) => Promise<boolean>;
@@ -99,10 +100,15 @@ const commandRunners: Record<string, CommandRunner> = {
     return Number(process.exitCode ?? 0);
   },
   stop: async deps => {
+    const parsed = parseStopApproval(deps.args.slice(1));
+    if (!parsed.ok) {
+      console.error("Usage: ocx stop [--json [--expect-pid <pid> --expect-port <port> --expect-hostname <host> --expect-config-home <home> --expect-cli-version <version> --expect-compatibility-token <hex>]]");
+      return 64;
+    }
     // Downtime warning lives HERE, not in handleStop: `restart`/tray-restart callers
     // re-start the proxy immediately, so warning there would contradict the next line.
     const warning = "⚠️  Codex/Claude requests through the proxy will fail until it is restarted ('ocx start' or 'ocx service start').";
-    if (!takeFlag(deps.args.slice(1), "--json")) {
+    if (!parsed.json) {
       // handleStop returns the structured outcome now; an object is always truthy, so
       // the warning must key on .ok — otherwise a failed stop would still claim downtime.
       if ((await deps.handleStop()).ok) console.log(warning);
@@ -117,7 +123,7 @@ const commandRunners: Record<string, CommandRunner> = {
     console.log = console.error;
     let outcome: StopOutcome | undefined;
     try {
-      outcome = await deps.handleStop();
+      outcome = await deps.handleStop(parsed.approval ?? undefined);
       if (outcome.ok) console.log(warning);
     } finally {
       console.log = humanLog;
@@ -125,7 +131,9 @@ const commandRunners: Record<string, CommandRunner> = {
     // A throw above propagates after the finally restores the console, so reaching here
     // with an undefined outcome cannot happen; the guard keeps the assignment provable.
     if (outcome) printStopSummary(outcome.summary);
-    return Number(process.exitCode ?? 0);
+    // A guarded refusal never reaches the code that records process.exitCode, so the
+    // approval-bound form answers with its summary's code; plain stop keeps its contract.
+    return parsed.approval ? (outcome?.summary.exitCode ?? 1) : Number(process.exitCode ?? 0);
   },
   resolve: async deps => {
     // Same fail-closed shape as `ready`: parseCliHead pre-parsed the verb before any