@bitkyc08/opencodex 2.63.0 → 2.64.0-preview.20260923

package/src/service/guarded-manager-target.ts

@@ -0,0 +1,151 @@
+/** Read-only manager-to-proxy binding for consent-bound desktop stops. */
+import { execFileSync } from "node:child_process";
+import { resolve } from "node:path";
+import { verifyPidIdentity } from "../config/process-state";
+import { statusWinswRaw } from "../lib/winsw";
+import { systemdProperty } from "../service-manager-probe";
+import { expectedLaunchdCommand, launchdEvictionTargets, probeLaunchdLoadState, runLaunchctl } from "./launchd";
+import { probeSystemdUnitInactive, unitPath } from "./systemd";
+import { probeWindowsSchedulerTask } from "./windows-scheduler";
+import { TASK } from "./state";
+
+export type GuardedManagerTarget =
+  | { kind: "absent" }
+  | { kind: "bound"; pid: number; managerPid: number; backend: "launchd" | "systemd" }
+  | { kind: "unknown"; reason: string };
+
+export type GuardedManagerStopped = "inactive" | "active" | "unknown";
+
+export function managerOwnsApprovedPid(
+  managerPid: number,
+  approvedPid: number,
+  parentOf: (pid: number) => number | null,
+): boolean {
+  let current = approvedPid;
+  const seen = new Set<number>();
+  for (let depth = 0; depth < 16; depth += 1) {
+    if (current === managerPid) return true;
+    if (!Number.isSafeInteger(current) || current <= 0 || seen.has(current)) return false;
+    seen.add(current);
+    const parent = parentOf(current);
+    if (parent === null || !Number.isSafeInteger(parent) || parent <= 0) return false;
+    current = parent;
+  }
+  return false;
+}
+
+function parentPid(pid: number): number | null {
+  try {
+    const raw = execFileSync("ps", ["-o", "ppid=", "-p", String(pid)], {
+      encoding: "utf8", timeout: 2_000, stdio: ["ignore", "pipe", "pipe"],
+    }).trim();
+    const value = Number(raw);
+    return /^\d+$/.test(raw) && Number.isSafeInteger(value) && value > 0 ? value : null;
+  } catch { return null; }
+}
+
+function positivePid(raw: string | null | undefined): number | null {
+  if (!raw || !/^\d+$/.test(raw)) return null;
+  const pid = Number(raw);
+  return Number.isSafeInteger(pid) && pid > 0 ? pid : null;
+}
+
+export interface GuardedManagerDeps {
+  platform?: NodeJS.Platform;
+  launchctl?: typeof runLaunchctl;
+  expectedCommand?: (port: number) => string;
+  systemdShow?: () => string;
+  parentOf?: (pid: number) => number | null;
+  verifyPid?: (pid: number) => number | null;
+  scheduler?: typeof probeWindowsSchedulerTask;
+  winsw?: typeof statusWinswRaw;
+}
+
+/** Only one current manager with a verified parent chain may be stopped by name. */
+export function inspectGuardedManagerTarget(
+  approvedPid: number,
+  approvedPort: number,
+  deps: GuardedManagerDeps = {},
+): GuardedManagerTarget {
+  const platform = deps.platform ?? process.platform;
+  if ((deps.verifyPid ?? verifyPidIdentity)(approvedPid) !== approvedPid) {
+    return { kind: "unknown", reason: "approved process identity could not be verified" };
+  }
+  const parentOf = deps.parentOf ?? parentPid;
+  if (platform === "darwin") {
+    const run = deps.launchctl ?? runLaunchctl;
+    let managerPid: number | null = null;
+    try {
+      const expected = (deps.expectedCommand ?? expectedLaunchdCommand)(approvedPort);
+      for (const target of launchdEvictionTargets()) {
+        const result = run(["print", target]);
+        if (result.status === 112 || result.status === 113) continue;
+        if (result.status !== 0) return { kind: "unknown", reason: "launchd state is unreadable" };
+        if (managerPid !== null) return { kind: "unknown", reason: "multiple launchd jobs are loaded" };
+        const output = `${result.stdout}\n${result.stderr}`;
+        if (!output.includes(expected)) return { kind: "unknown", reason: "launchd command differs from registration" };
+        const pids = [...output.matchAll(/^\s*pid\s*=\s*(\d+)\s*$/gm)];
+        if (pids.length !== 1) return { kind: "unknown", reason: "launchd PID is ambiguous" };
+        managerPid = positivePid(pids[0]?.[1]);
+        if (managerPid === null) return { kind: "unknown", reason: "launchd PID is invalid" };
+      }
+    } catch { return { kind: "unknown", reason: "launchd state could not be verified" }; }
+    if (managerPid === null) return { kind: "absent" };
+    return managerOwnsApprovedPid(managerPid, approvedPid, parentOf)
+      ? { kind: "bound", pid: approvedPid, managerPid, backend: "launchd" }
+      : { kind: "unknown", reason: "launchd job does not own the approved process" };
+  }
+  if (platform === "linux") {
+    try {
+      const output = (deps.systemdShow ?? (() => execFileSync("systemctl", ["--user", "show", "-p", "LoadState", "-p", "ActiveState", "-p", "MainPID", "-p", "FragmentPath", "-p", "NeedDaemonReload", TASK], {
+        encoding: "utf8", timeout: 2_000, stdio: ["ignore", "pipe", "pipe"],
+      })))();
+      const loaded = systemdProperty(output, "LoadState");
+      const active = systemdProperty(output, "ActiveState");
+      const pid = positivePid(systemdProperty(output, "MainPID"));
+      if (loaded === "not-found" && active === "inactive") return { kind: "absent" };
+      if (loaded === "loaded" && active === "inactive" && systemdProperty(output, "MainPID") === "0") return { kind: "absent" };
+      if (loaded !== "loaded" || active !== "active" || pid === null
+        || systemdProperty(output, "NeedDaemonReload") !== "no"
+        || resolve(systemdProperty(output, "FragmentPath") ?? "") !== resolve(unitPath())) {
+        return { kind: "unknown", reason: "systemd unit state is not current and active" };
+      }
+      return managerOwnsApprovedPid(pid, approvedPid, parentOf)
+        ? { kind: "bound", pid: approvedPid, managerPid: pid, backend: "systemd" }
+        : { kind: "unknown", reason: "systemd unit does not own the approved process" };
+    } catch { return { kind: "unknown", reason: "systemd state could not be verified" }; }
+  }
+  if (platform === "win32") {
+    const scheduler = (deps.scheduler ?? probeWindowsSchedulerTask)();
+    const native = (deps.winsw ?? statusWinswRaw)();
+    return scheduler.status === "absent" && native === "nonexistent"
+      ? { kind: "absent" }
+      : { kind: "unknown", reason: "Windows manager child PID cannot be proven" };
+  }
+  return { kind: "unknown", reason: "unsupported service manager platform" };
+}
+
+/** A guarded success needs manager absence after settlement and once more at publication. */
+export async function observeGuardedManagerStopped(
+  manager: Exclude<GuardedManagerTarget, { kind: "unknown" }>,
+  deps: Pick<GuardedManagerDeps, "platform" | "scheduler" | "winsw"> & {
+    launchd?: typeof probeLaunchdLoadState;
+    systemd?: typeof probeSystemdUnitInactive;
+  } = {},
+): Promise<GuardedManagerStopped> {
+  try {
+    const platform = deps.platform ?? process.platform;
+    if (platform === "darwin") {
+      const state = (deps.launchd ?? probeLaunchdLoadState)().state;
+      return state === "not-loaded" ? "inactive" : state === "unknown" ? "unknown" : "active";
+    }
+    if (platform === "linux") return (deps.systemd ?? probeSystemdUnitInactive)();
+    if (platform === "win32" && manager.kind === "absent") {
+      const scheduler = (deps.scheduler ?? probeWindowsSchedulerTask)();
+      const native = (deps.winsw ?? statusWinswRaw)();
+      if (scheduler.status === "absent" && native === "nonexistent") return "inactive";
+      return scheduler.status === "unknown" || native === "unknown" ? "unknown" : "active";
+    }
+  } catch { return "unknown"; }
+  return "unknown";
+}

package/src/service/guards.ts

@@ -1,7 +1,8 @@
 import { execSync } from "node:child_process";
 import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { getConfigDir, loadConfig } from "../config";
-import { readServiceApiTokenState, serviceApiTokenFilePath } from "../lib/service-secrets";
+import { withConfigMutationLockSync } from "../config/mutation-lock";
+import { hardenReusedServiceApiToken, readServiceApiTokenState, serviceApiTokenFilePath } from "../lib/service-secrets";
 import { tokenCollidesWithAdmin } from "../lib/admin-secrets";
 import { randomBytes } from "node:crypto";
 import { hardenSecretDir, hardenSecretPath } from "../lib/windows-secret-acl";
@@ -9,8 +10,10 @@ import { recordOwnedConfigPath } from "../lib/config-ownership";
 import { isTestHomeGuardArmed } from "../lib/test-home-guard";
 import { diagnoseService } from "./diagnostics";
 import type { ServiceDiagnostic } from "./diagnostics";
-import { currentCodexHome, currentOpenCodexHome, normalizePathForCompare, readServiceInstallState } from "./state";
+import { currentCodexHome, currentOpenCodexHome, normalizePathForCompare, resolveServiceState, serviceCodexHomeMatchesInstall } from "./state";
 import { resolveCodexSqliteHome } from "../codex/paths";
+import type { CodexHomeDeps } from "../codex/home";
+import { isLoopbackHostname } from "../codex/loopback-target";
 import { win32 } from "node:path";
 
 /**
@@ -42,16 +45,17 @@ export function serviceEnvironmentOwnedHere(): boolean {
   }
 }
 
-export function assertServiceEnvironmentMatchesInstall(): void {
-  const state = readServiceInstallState();
-  if (!state) return;
-  const actualCodexHome = currentCodexHome();
-  const expected = normalizePathForCompare(state.codexHome);
-  const actual = normalizePathForCompare(actualCodexHome);
-  if (expected !== actual) {
+export function assertServiceEnvironmentMatchesInstall(deps: CodexHomeDeps = {}): void {
+  const resolution = resolveServiceState();
+  // Unreadable state keeps its existing interactive semantics (see assertNativeTeardownOwned);
+  // unattended writes use the tri-state inspector, which reports it as unknown.
+  if (resolution.kind !== "state") return;
+  const state = resolution.state;
+  const actualCodexHome = currentCodexHome(deps);
+  if (!serviceCodexHomeMatchesInstall(state.codexHome, deps)) {
     throw new ServiceOwnershipError(
       `Service was installed with CODEX_HOME=${state.codexHome}, but current CODEX_HOME=${actualCodexHome}. ` +
-        "Run the service command from the same Codex home so native Codex restore updates the correct config.",
+        `Rerun with CODEX_HOME=${state.codexHome} so native Codex restore updates the recorded home.`,
     );
   }
   const expectedOpenCodexHome = normalizePathForCompare(state.opencodexHome);
@@ -73,11 +77,6 @@ export function assertServiceEnvironmentMatchesInstall(): void {
   }
 }
 
-function isLoopbackHostname(hostname: string | undefined): boolean {
-  const normalized = (hostname ?? "127.0.0.1").trim().toLowerCase();
-  return normalized === "" || normalized === "localhost" || normalized === "127.0.0.1" || normalized === "::1" || normalized === "[::1]";
-}
-
 /**
  * The `ocx` command a user should rerun for the service state they actually have.
  *
@@ -228,42 +227,42 @@ function persistServiceApiToken(token: string): string {
  * connected to a hub the same file holds that hub's issued client key, which must not be
  * overwritten by a local install.
  *
+ * Provisioning runs inside the cross-process config mutation lock: client-key rotation
+ * replaces `service-api-token` and records the new fingerprint under the same lock, so a
+ * reuse republish or a fresh write here can never interleave with a committed rotation and
+ * silently roll its bytes back.
+ *
  * The PATH is logged; the value never is, and never reaches argv, a unit file or a plist.
  */
 export function writeServiceApiTokenFile(): ProvisionedServiceApiToken | null {
-  const token = process.env.OPENCODEX_API_AUTH_TOKEN?.trim();
-  if (token) {
-    // Last line of defence: every install/repair path funnels through here, so a
-    // collision cannot reach disk regardless of which caller ran (#2696).
-    assertNotAdminToken(token);
-    const path = persistServiceApiToken(token);
-    console.log(`🔐 Data-plane token taken from OPENCODEX_API_AUTH_TOKEN and stored at ${path} (owner-only).`);
-    return { path, origin: "env" };
-  }
-  if (isLoopbackHostname(loadConfig().hostname)) return null;
-  const existing = readServiceApiTokenState();
-  if (existing.kind === "present") {
-    // The collision check is NOT only for the env branch. A file that already holds the admin
-    // token -- hand-pasted before #2696, or written by the very incident this unit closes --
-    // was silently accepted here, so `ocx status` reported `present (file)` and the hub
-    // crash-looped at boot with no command pointing at the cause.
-    const path = serviceApiTokenFilePath();
-    assertNotAdminToken(existing.token, process.env, "file");
-    // `readServiceApiTokenState` accepts any bounded regular file, so a reused token may well
-    // be group- or world-readable. Tighten it on the way through rather than claiming
-    // "owner-only" about a mode nobody checked; best-effort, since a non-owner cannot chmod
-    // and failing the install over it would be worse than the loose mode.
-    try { chmodSync(path, 0o600); } catch { /* best-effort */ }
-    if (process.platform === "win32") hardenSecretPath(path, { required: false });
-    // No log line: repair/restart hit this on every run and an unconditional notice about a
-    // credential file trains operators to ignore the one that matters.
-    return { path, origin: "file" };
-  }
-  if (existing.kind === "unsafe") throw new Error(`${existing.reason}: ${serviceApiTokenFilePath()}`);
-  const path = persistServiceApiToken(randomBytes(32).toString("hex"));
-  console.log(`🔐 Provisioned an owner-only data-plane token at ${path}; nothing needs to be exported by hand.`);
-  console.log("   Remote machines get their own per-client key — run 'ocx hub invite' instead of copying this file.");
-  return { path, origin: "generated" };
+  return withConfigMutationLockSync(() => {
+    const token = process.env.OPENCODEX_API_AUTH_TOKEN?.trim();
+    if (token) {
+      // Last line of defence: every install/repair path funnels through here, so a
+      // collision cannot reach disk regardless of which caller ran (#2696).
+      assertNotAdminToken(token);
+      const path = persistServiceApiToken(token);
+      console.log(`🔐 Data-plane token taken from OPENCODEX_API_AUTH_TOKEN and stored at ${path} (owner-only).`);
+      return { path, origin: "env" };
+    }
+    if (isLoopbackHostname(loadConfig().hostname)) return null;
+    const existing = hardenReusedServiceApiToken(token => assertNotAdminToken(token, process.env, "file"));
+    if (existing.kind === "present") {
+      // The collision check is NOT only for the env branch. A file that already holds the admin
+      // token -- hand-pasted before #2696, or written by the very incident this unit closes --
+      // was silently accepted here, so `ocx status` reported `present (file)` and the hub
+      // crash-looped at boot with no command pointing at the cause.
+      const path = serviceApiTokenFilePath();
+      // No log line: repair/restart hit this on every run and an unconditional notice about a
+      // credential file trains operators to ignore the one that matters.
+      return { path, origin: "file" };
+    }
+    if (existing.kind === "unsafe") throw new Error(`${existing.reason}: ${serviceApiTokenFilePath()}`);
+    const path = persistServiceApiToken(randomBytes(32).toString("hex"));
+    console.log(`🔐 Provisioned an owner-only data-plane token at ${path}; nothing needs to be exported by hand.`);
+    console.log("   Remote machines get their own per-client key — run 'ocx hub invite' instead of copying this file.");
+    return { path, origin: "generated" };
+  });
 }
 
 export function sh(cmd: string): string {

package/src/service/managing-cli.ts

@@ -0,0 +1,170 @@
+/**
+ * Observe the two CLIs that can manage this runtime: the one baked into the preserved
+ * service registration, and the `ocx` the PATH resolves today.
+ *
+ * Both answers feed `assessServiceTakeoverCompatibility`, which refuses a takeover when
+ * either observation is unknown — a managing binary that cannot be named cannot be held to
+ * the ownership-aware floor. `absent` is a trustworthy answer; `unknown` is not.
+ *
+ * The PATH lookup is an in-module directory scan rather than `where`/`which`: spawning a
+ * shell builtin to find a binary makes the answer depend on the host's PATH handling, and
+ * this module exists so the resolve/claim path is deterministic and testable. And the one
+ * thing it must never do is spawn `process.execPath`: that binary is THIS CLI, and asking
+ * it for its version under `ocx --version` semantics is the recursion #5418 closed. When
+ * the located file IS this binary, its version is already known.
+ */
+import { existsSync, statSync } from "node:fs";
+import { spawnSync, type SpawnSyncReturns } from "node:child_process";
+import { delimiter, posix, win32 } from "node:path";
+import { parseStrictSemver } from "../lib/strict-semver";
+import { packageVersion } from "../lib/package-version";
+import {
+  registeredManagingCliInvocation,
+  type ManagingCliObservation,
+  type ManagingCliRole,
+} from "./ownership-compatibility";
+import type { ServiceInstallState } from "./state";
+
+const VERSION_PROBE_TIMEOUT_MS = 5000;
+
+export interface ManagingCliDeps {
+  /** Environment to scan PATH/PATHEXT in. Defaults to `process.env`. */
+  env?: Record<string, string | undefined>;
+  /** Spawn seam. Defaults to `spawnSync`. */
+  spawn?: typeof spawnSync;
+  /** The running binary, for the never-spawn-yourself rule. Defaults to `process.execPath`. */
+  execPath?: string;
+  /** This binary's own version, for the self-observation shortcut. */
+  ownVersion?: () => string;
+  /** Filesystem existence seam. */
+  exists?: (path: string) => boolean;
+  /** Validate the selected candidate as a regular file. */
+  isFile?: (path: string) => boolean;
+  /** Host platform override for tests. */
+  platform?: NodeJS.Platform;
+}
+
+/** The first strict-semver token in a `--version` line (`opencodex 2.61.0` → `2.61.0`). */
+function versionFromOutput(stdout: string): string | null {
+  for (const token of stdout.trim().split(/\s+/)) {
+    if (parseStrictSemver(token)) return token;
+  }
+  return null;
+}
+
+function probeVersion(
+  executable: string,
+  args: readonly string[],
+  deps: Required<Pick<ManagingCliDeps, "spawn" | "platform" | "env">>,
+): ManagingCliObservation {
+  const identity = [executable, ...args].join(" ");
+  let result: SpawnSyncReturns<string>;
+  try {
+    const windowsShim =
+      deps.platform === "win32" && /\.(cmd|bat)$/i.test(executable);
+    if (windowsShim && [executable, ...args].some(part => /[&|<>^%!"()]/.test(part))) {
+      return { status: "unknown", reason: "the selected Windows command shim invocation cannot be probed safely" };
+    }
+    result = deps.spawn(
+      windowsShim ? (deps.env?.ComSpec ?? "cmd.exe") : executable,
+      windowsShim ? ["/c", executable, ...args, "--version"] : [...args, "--version"],
+      { timeout: VERSION_PROBE_TIMEOUT_MS, encoding: "utf8", stdio: "pipe", windowsHide: true },
+    ) as SpawnSyncReturns<string>;
+  } catch (error) {
+    return {
+      status: "unknown",
+      reason: `${identity} --version could not run: ${error instanceof Error ? error.message : String(error)}`,
+    };
+  }
+  if (result.error) {
+    return {
+      status: "unknown",
+      reason: `${identity} --version did not finish: ${result.error.message}`,
+    };
+  }
+  if (result.status !== 0) {
+    return { status: "unknown", reason: `${identity} --version exited ${result.status ?? "without a code"}` };
+  }
+  const version = versionFromOutput(result.stdout ?? "");
+  return version === null
+    ? { status: "unknown", reason: `${identity} --version printed no semver` }
+    : { status: "observed", version, identity };
+}
+
+/**
+ * Where `ocx` resolves on PATH without spawning `where`/`which`.
+ *
+ * Returns the absolute candidate or null. On Windows every PATHEXT extension is tried (and
+ * the bare name, for extensionless shims); elsewhere the bare name only.
+ */
+function findOcxOnPath(
+  env: Record<string, string | undefined>,
+  exists: (path: string) => boolean,
+  platform: NodeJS.Platform,
+): string | null {
+  const pathValue = env.PATH ?? env.Path ?? env.path;
+  if (!pathValue) return null;
+  const pathApi = platform === "win32" ? win32 : posix;
+  const extensions = platform === "win32"
+    ? [...(env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").filter(ext => /^\.[A-Za-z0-9]+$/.test(ext)), ""]
+    : [""];
+  for (const directory of pathValue.split(platform === "win32" ? ";" : delimiter)) {
+    if (!directory) continue;
+    for (const extension of extensions) {
+      const candidate = pathApi.join(directory, `ocx${extension}`);
+      if (exists(candidate)) return pathApi.resolve(candidate);
+    }
+  }
+  return null;
+}
+
+function observeServiceRegistration(
+  state: ServiceInstallState | null,
+  deps: Required<Pick<ManagingCliDeps, "spawn" | "platform" | "env">>,
+): ManagingCliObservation {
+  const invocation = registeredManagingCliInvocation(state);
+  if (invocation.status !== "resolved") return invocation;
+  return probeVersion(invocation.executable, invocation.args, deps);
+}
+
+function observePathCli(
+  deps: Required<Pick<ManagingCliDeps, "spawn" | "platform" | "env" | "execPath" | "ownVersion" | "exists" | "isFile">>,
+): ManagingCliObservation {
+  const found = findOcxOnPath(deps.env, deps.exists, deps.platform);
+  if (!found) return { status: "absent" };
+  if (!deps.isFile(found)) {
+    return { status: "unknown", reason: "the selected managing CLI is not a readable file" };
+  }
+  const self = (deps.platform === "win32" ? win32 : posix).resolve(deps.execPath);
+  if (found === self || (deps.platform === "win32" && found.toLowerCase() === self.toLowerCase())) {
+    // Never spawn ourselves for our own version: the answer is already in hand, and the
+    // recursion that produced it is the #5418 regression.
+    return { status: "observed", version: deps.ownVersion(), identity: found };
+  }
+  return probeVersion(found, [], deps);
+}
+
+/**
+ * Both managing-CLI observations, for `assessServiceTakeoverCompatibility` and for the
+ * revalidation `recordServiceOwner` runs inside its lock.
+ */
+export function observeManagingClis(
+  state: ServiceInstallState | null,
+  deps: ManagingCliDeps = {},
+): Readonly<Record<ManagingCliRole, ManagingCliObservation>> {
+  const resolved = {
+    spawn: deps.spawn ?? spawnSync,
+    platform: deps.platform ?? process.platform,
+    env: deps.env ?? (process.env as Record<string, string | undefined>),
+    execPath: deps.execPath ?? process.execPath,
+    ownVersion: deps.ownVersion ?? packageVersion,
+    exists: deps.exists ?? existsSync,
+    isFile: deps.isFile ?? ((path: string) => {
+      try { return statSync(path).isFile(); } catch { return false; }
+    }),
+  };
+  return {
+    "service-registration": observeServiceRegistration(state, resolved),
+    path: observePathCli(resolved),
+  };
+}

package/src/service/orchestration.ts

@@ -172,7 +172,8 @@ export async function proxyStillLiveAfterStop(deps: {
     const probeDeadline = canRespawn
       ? deadline
       : now() + (SERVICE_STOP_LIVENESS.timeoutMs! * SERVICE_STOP_LIVENESS.attempts! + 250);
-    return findLiveProxy({ ...SERVICE_STOP_LIVENESS, deadlineAt: probeDeadline, nowFn: now });
+    // A package-tree-fenced proxy (#5496) still holds the port; stop must not call it gone.
+    return findLiveProxy({ ...SERVICE_STOP_LIVENESS, deadlineAt: probeDeadline, nowFn: now, acceptPackageTreeFenced: true });
   });
   for (;;) {
     try {
@@ -205,6 +206,7 @@ async function stopTrackedProxyIfRunning(): Promise<TrackedProxyCleanupResult> {
   const live = await findLiveProxy({
     ...SERVICE_STOP_LIVENESS,
     deadlineAt: Date.now() + 7000,
+    acceptPackageTreeFenced: true,
   });
   const liveKillPid = verifiedKillTarget(live?.pid);
   if (liveKillPid !== null) {

package/src/service/state.ts

@@ -857,6 +857,10 @@ export function serviceHomeMatches(a: string, b: string): boolean {
   return normalizePathForCompare(a) === normalizePathForCompare(b);
 }
 
+export function serviceCodexHomeMatchesInstall(recordedHome: string, deps: CodexHomeDeps = {}): boolean {
+  return serviceHomeMatches(recordedHome, currentCodexHome(deps));
+}
+
 /** Single accessor for backend-sensitive service code — v1/legacy state maps to scheduler. */
 export function readServiceBackend(): ServiceBackend {
   return readServiceInstallState()?.backend === "native" ? "native" : "scheduler";

package/src/service/systemd.ts

@@ -1,5 +1,5 @@
 import { readFileSync } from "node:fs";
-import { execSync } from "node:child_process";
+import { execFileSync, execSync } from "node:child_process";
 import { existsSync, mkdirSync, unlinkSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
@@ -199,6 +199,21 @@ export function stopSystemd(): void { try { sh(`systemctl --user stop ${TASK}`);
 
 export function statusSystemd(): string { try { return sh(`systemctl --user status ${TASK}`); } catch { return ""; } }
 
+/** Strict user-unit inactivity proof for guarded desktop takeover. */
+export function probeSystemdUnitInactive(deps: { show?: () => string } = {}): "inactive" | "active" | "unknown" {
+  try {
+    const output = (deps.show ?? (() => execFileSync("systemctl", ["--user", "show", "-p", "ActiveState", "-p", "MainPID", TASK], {
+      encoding: "utf8", timeout: 2_000, stdio: ["ignore", "pipe", "pipe"],
+    })))();
+    const active = systemdProperty(output, "ActiveState")?.toLowerCase();
+    const pid = systemdProperty(output, "MainPID");
+    if (active === "inactive" && pid === "0") return "inactive";
+    if (["active", "activating", "deactivating", "reloading"].includes(active ?? "")
+      || (pid !== null && /^\d+$/.test(pid) && Number(pid) > 0)) return "active";
+    return "unknown";
+  } catch { return "unknown"; }
+}
+
 export function uninstallSystemd(deps: {
   run?: (command: string) => string;
   unitExists?: () => boolean;

package/src/service.ts

@@ -7,7 +7,7 @@
  */
 
 export type { ServiceBackend, ServiceInstallState, ServiceStateEvidence, ServiceStateResolution, ServiceOwner, ServiceOwnership, ServiceOwnershipSubject, ServiceOwnershipResolution, ServiceStateSwapDeps, RecordServiceOwnerRequest, RecordServiceOwnerDeps, ReleaseServiceOwnerDeps, RemoveServiceStateDeps } from "./service/state";
-export { SERVICE_MANAGED_ENV, SERVICE_OWNERSHIP_PROTOCOL_VERSION, SERVICE_OWNERSHIP_MINIMUM_CLI_VERSION, stableLauncherEntry, serviceLogPath, serviceStatePaths, serviceStatePathsForOpenCodexHome, parseServiceInstallState, parseServiceOwnership, inspectServiceStateEvidence, resolveServiceState, currentServiceHomes, serviceHomeMatches, readServiceBackend, serviceReinstallArgs, serviceInstallArgs, ServiceStateConflictError, ServiceOwnershipSubjectMismatchError, ServiceOwnershipSubjectUnknownError, ServiceTakeoverCompatibilityChangedError, swapServiceInstallState, removeServiceInstallStateRecords, serviceOwnership, resolveServiceOwnership, sameServiceOwnershipSubject, desktopOwnsService, ownershipGrantedTo, recordServiceOwner, releaseServiceOwner } from "./service/state";
+export { SERVICE_MANAGED_ENV, SERVICE_OWNERSHIP_PROTOCOL_VERSION, SERVICE_OWNERSHIP_MINIMUM_CLI_VERSION, stableLauncherEntry, serviceLogPath, serviceStatePaths, serviceStatePathsForOpenCodexHome, parseServiceInstallState, parseServiceOwnership, inspectServiceStateEvidence, resolveServiceState, currentServiceHomes, serviceHomeMatches, serviceCodexHomeMatchesInstall, readServiceBackend, serviceReinstallArgs, serviceInstallArgs, ServiceStateConflictError, ServiceOwnershipSubjectMismatchError, ServiceOwnershipSubjectUnknownError, ServiceTakeoverCompatibilityChangedError, swapServiceInstallState, removeServiceInstallStateRecords, serviceOwnership, resolveServiceOwnership, sameServiceOwnershipSubject, desktopOwnsService, ownershipGrantedTo, recordServiceOwner, releaseServiceOwner } from "./service/state";
 export type { OwnershipMutationLeaseOptions, OwnershipMutationLease } from "./service/ownership-mutation-lease.mjs";
 export { acquireOwnershipMutationLease, withOwnershipMutationLease } from "./service/ownership-mutation-lease.mjs";
 export type { ManagingCliRole, ManagingCliObservation, RegisteredManagingCliInvocation, ServiceTakeoverCompatibilityInput, ServiceTakeoverCompatibility } from "./service/ownership-compatibility";

package/src/types/config.ts

@@ -924,6 +924,12 @@ export interface OcxConfig {
    * which has no row, can be ordered too. Range -100..100.
    */
   codexAccountPriorities?: Record<string, number>;
+  /**
+   * Per-account proactive-switch threshold overrides. Missing account entry inherits
+   * `autoSwitchThreshold`; 0 disables usage-driven switching only for that account.
+   * Includes the synthetic `__main__` Desktop account. Range 0..100.
+   */
+  codexAccountAutoSwitchThresholds?: Record<string, number>;
   /**
    * Account id the operator last selected by hand. Suppresses upward priority
    * preemption until that account crosses the auto-switch threshold. Stores the
@@ -1017,6 +1023,8 @@ export interface OcxConfig {
   activeCodexAccountId?: string;
   /** Auto-switch threshold (0-100). Default 80. 0 = disabled. */
   autoSwitchThreshold?: number;
+  /** Opt-in: return bound quota-strategy tasks to recovered higher-priority accounts. */
+  codexAccountPriorityFailback?: boolean;
   /** New-session account rotation strategy for the Codex pool. Default quota (today's behaviour). */
   accountPoolStrategy?: OcxAccountPoolRotationStrategy | "reset-first";
   /** Successful new-session binds retained on one round-robin selection. Default 1; range 1..100. */

package/src/types/provider.ts

@@ -242,6 +242,12 @@ export interface TierObservationContext {
    * preserving the behaviour for the public API where the echo does mean what it says.
    */
   responseTierAuthoritative?: boolean;
+  /**
+   * Set when the upstream refused the fast wire earlier in this request and the proxy resent at
+   * standard speed (Anthropic `speed: "fast"` without entitlement). The resend's outcome is then
+   * a `response-declined` downgrade rather than an unavailable wire.
+   */
+  upstreamDeclinedFast?: boolean;
 }
 
 export type TierDecision =
@@ -950,6 +956,16 @@ export interface OcxProviderConfig {
    * thinking separately in `reasoning_content` / `reasoning_details` instead of visible content.
    */
   reasoningSplitModels?: string[];
+  /**
+   * Model ids served by a gateway that runs no server-side reasoning parser, so a thinking model
+   * leaves its chain of thought inline in `content` as `<think>` / `<thinking>` / `<reasoning>`
+   * blocks and never sends `reasoning_content` or `reasoning_details`. Without this the whole
+   * chain of thought renders as the answer. The openai-chat adapter then splits those blocks back
+   * into reasoning. Off by default and narrow on purpose: 66 registry providers share this
+   * adapter, and a gateway that does parse reasoning must not have its visible content rewritten.
+   * Prefer a provider-side parser or `reasoningSplitModels` when the upstream supports either.
+   */
+  inlineThinkTagModels?: string[];
   /**
    * Model ids whose chat endpoint carries thinking as a structured `reasoning_details` array
    * (MiniMax M-series with `reasoning_split`): stream deltas repeat each detail's `text` as a

package/src/types/request.ts

@@ -90,6 +90,16 @@ export interface OcxParsedRequest {
    * prepareOpaqueBlobRecovery after an authoritative rejection; consumers strip replayed blobs.
    */
   _stripReasoningEncryptedContent?: boolean;
+  /**
+   * Set when replayed reasoning item ids name items in a store this destination cannot read: by
+   * prepareOpaqueBlobRecovery before the one recovery rebuild, and by bindRouteReasoningReplayScope
+   * while the rejection memo is live or after a proven switch to a different destination or
+   * credential. The Responses passthrough then removes the `id` of every replayed reasoning item,
+   * whether or not it carries a blob. A stateful destination resolves a replayed id against its own
+   * store, so keeping it turns the send into `Item with id 'rs_…' not found` (#5583). A model
+   * change on the same destination and credential does not set this.
+   */
+  _dropForeignReasoningItemIds?: boolean;
   /** Final-route opt-in: emit v2 collaboration message arguments as plaintext on ChatGPT. */
   _plaintextV2AgentMessages?: boolean;
   /**

package/src/types/tools.ts

@@ -129,6 +129,8 @@ export const NAMESPACED_BARE_ALIAS_EXCLUDED_NAMES: ReadonlySet<string> = new Set
  *
  * Rewrites invented `default.<name>` prefixes back to a declared bare tool when that bare tool
  * is declared and neither `default.<name>` nor `default__<name>` was explicitly declared (#4176).
+ * The same wrapper may surround an already-flattened namespace identity; accept that exact
+ * declared suffix without treating its child name as a bare declaration.
  * Also normalizes legacy helper names (`exec_command`, `shell_command`, `apply_patch`, `view_image`) to
  * `exec` when code-mode `exec` is declared in the request catalog.
  *
@@ -151,7 +153,13 @@ export function normalizeDeclaredToolName(
     const bareDeclared = declaredBare ?? declared;
     if (
       bare.length > 0
-      && bareDeclared.has(bare)
+      && (
+        bareDeclared.has(bare)
+        // Muse can wrap the complete `namespace__tool` identity in `default.`. Requiring the
+        // exact flattened identity to be declared preserves the #4176 provenance boundary:
+        // `default.tool` still cannot borrow a namespaced tool's manufactured bare alias.
+        || (bare.includes("__") && declared.has(bare))
+      )
       && !declared.has("default." + bare)
       && !declared.has("default__" + bare)
     ) {