@bitkyc08/opencodex 2.67.0-preview.20260926 → 2.68.0-preview.20260927

package/src/storage/scanner.ts

@@ -1,4 +1,5 @@
 import { readdirSync, statSync } from "node:fs";
+import { readdir, stat as statAsync } from "node:fs/promises";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { Database, constants } from "bun:sqlite";
@@ -110,6 +111,81 @@ function walkFiles(dir: string, relPrefix: string, out: FileEntry[]): void {
   }
 }
 
+/** Upper bound on concurrent readdir/stat calls within one async scan. */
+const SCAN_FS_CONCURRENCY = 64;
+
+type FsLimit = <T>(op: () => Promise<T>) => Promise<T>;
+
+/**
+ * FIFO limiter for filesystem calls. A finishing call hands its slot straight to the next
+ * waiter, so the bound holds exactly. Only leaf fs calls take a slot: a directory walk
+ * never holds one while awaiting its children, so recursion cannot deadlock the pool.
+ */
+function createFsLimit(max: number): FsLimit {
+  let active = 0;
+  const waiting: Array<() => void> = [];
+  return async <T>(op: () => Promise<T>): Promise<T> => {
+    if (active < max) active += 1;
+    else await new Promise<void>(resolve => waiting.push(resolve));
+    try {
+      return await op();
+    } finally {
+      const next = waiting.shift();
+      if (next) next();
+      else active -= 1;
+    }
+  };
+}
+
+/** Entries started together at one directory level of an async scan. */
+const SCAN_BATCH_SIZE = 256;
+
+/**
+ * Map `items` through `fn` a batch at a time, keeping input order. A directory with tens of
+ * thousands of entries then has at most one batch of pending tasks at its level, instead of
+ * one promise per entry queued behind the fs limiter.
+ */
+async function mapInBatches<T, R>(items: readonly T[], fn: (item: T) => Promise<R>): Promise<R[]> {
+  const results: R[] = [];
+  for (let start = 0; start < items.length; start += SCAN_BATCH_SIZE) {
+    const batch = await Promise.all(items.slice(start, start + SCAN_BATCH_SIZE).map(fn));
+    for (const result of batch) results.push(result);
+  }
+  return results;
+}
+
+/**
+ * Async twin of {@link walkFiles}: same skip rules, and entries come back in readdir
+ * order so the report (including `largest` tie order) matches the synchronous scan.
+ */
+async function walkFilesAsync(dir: string, relPrefix: string, limit: FsLimit): Promise<FileEntry[]> {
+  let entries;
+  try {
+    entries = await limit(() => readdir(dir, { withFileTypes: true }));
+  } catch {
+    return [];
+  }
+  // Bun can settle small async fs calls on the microtask queue alone, so a walk of cached
+  // directories would otherwise finish without ever giving the event loop a turn. One timer
+  // turn per directory keeps request handling live during a large scan.
+  await new Promise<void>(resolve => setTimeout(resolve, 0));
+  const parts = await mapInBatches(entries, async (entry): Promise<FileEntry[]> => {
+    const full = join(dir, entry.name);
+    const relPath = relPrefix ? `${relPrefix}/${entry.name}` : entry.name;
+    try {
+      if (entry.isDirectory()) return await walkFilesAsync(full, relPath, limit);
+      if (entry.isFile()) {
+        const stat = await limit(() => statAsync(full));
+        return [{ relPath, bytes: stat.size, mtimeMs: stat.mtimeMs }];
+      }
+    } catch {
+      /* entry vanished mid-scan — diagnostics tolerate racy trees */
+    }
+    return [];
+  });
+  return parts.flat();
+}
+
 function buildBucket(key: StorageBucketKey, files: FileEntry[]): StorageBucket {
   const bucket: StorageBucket = {
     key,
@@ -169,8 +245,8 @@ function newestVersionedDb(names: string[], pattern: RegExp): string | null {
   return best;
 }
 
-export function scanStorage(codexHome: string = resolveCodexHomeDir()): StorageReport {
-  const files: Record<StorageBucketKey, FileEntry[]> = {
+function emptyFiles(): Record<StorageBucketKey, FileEntry[]> {
+  return {
     sessions: [],
     archived_sessions: [],
     logs_db: [],
@@ -179,36 +255,27 @@ export function scanStorage(codexHome: string = resolveCodexHomeDir()): StorageR
     deletion_manifests: [],
     other: [],
   };
+}
 
-  let rootNames: string[] = [];
-  try {
-    rootNames = readdirSync(codexHome);
-  } catch (error) {
-    // A missing home is a normal fresh-machine state — report zeros. Anything else
-    // (e.g. ENOTDIR: CODEX_HOME points at a file) is a broken setup the caller
-    // must surface as a scan failure, not silently render as an empty home.
-    const code = (error as NodeJS.ErrnoException).code;
-    if (code !== "ENOENT") throw error;
-  }
+/** A missing home is a normal fresh-machine state; any other readdir failure is rethrown. */
+function rootReadFailure(error: unknown): string[] {
+  // A missing home is a normal fresh-machine state — report zeros. Anything else
+  // (e.g. ENOTDIR: CODEX_HOME points at a file) is a broken setup the caller
+  // must surface as a scan failure, not silently render as an empty home.
+  const code = (error as NodeJS.ErrnoException).code;
+  if (code !== "ENOENT") throw error;
+  return [];
+}
 
-  for (const name of rootNames) {
-    const full = join(codexHome, name);
-    let stat;
-    try {
-      stat = statSync(full);
-    } catch {
-      continue;
-    }
-    if (stat.isDirectory()) {
-      // Quarantine trash (Phase 2) must not inflate "other" or totals.
-      if (name === TRASH_DIR) continue;
-      walkFiles(full, name, files[DIR_BUCKETS[name] ?? "other"]);
-    } else if (stat.isFile()) {
-      const key: StorageBucketKey = STATE_DB_FILE.test(name) ? "state_db" : LOGS_DB_FILE.test(name) ? "logs_db" : "other";
-      files[key].push({ relPath: name, bytes: stat.size, mtimeMs: stat.mtimeMs });
-    }
-  }
+function rootFileBucket(name: string): StorageBucketKey {
+  return STATE_DB_FILE.test(name) ? "state_db" : LOGS_DB_FILE.test(name) ? "logs_db" : "other";
+}
 
+function finishReport(
+  codexHome: string,
+  rootNames: string[],
+  files: Record<StorageBucketKey, FileEntry[]>,
+): StorageReport {
   const buckets = (Object.keys(files) as StorageBucketKey[]).map(key => buildBucket(key, files[key]));
 
   const stateDbName = newestVersionedDb(rootNames, STATE_DB_FILE);
@@ -236,3 +303,84 @@ export function scanStorage(codexHome: string = resolveCodexHomeDir()): StorageR
     buckets,
   };
 }
+
+export function scanStorage(codexHome: string = resolveCodexHomeDir()): StorageReport {
+  const files = emptyFiles();
+
+  let rootNames: string[] = [];
+  try {
+    rootNames = readdirSync(codexHome);
+  } catch (error) {
+    rootNames = rootReadFailure(error);
+  }
+
+  for (const name of rootNames) {
+    const full = join(codexHome, name);
+    let stat;
+    try {
+      stat = statSync(full);
+    } catch {
+      continue;
+    }
+    if (stat.isDirectory()) {
+      // Quarantine trash (Phase 2) must not inflate "other" or totals.
+      if (name === TRASH_DIR) continue;
+      walkFiles(full, name, files[DIR_BUCKETS[name] ?? "other"]);
+    } else if (stat.isFile()) {
+      files[rootFileBucket(name)].push({ relPath: name, bytes: stat.size, mtimeMs: stat.mtimeMs });
+    }
+  }
+
+  return finishReport(codexHome, rootNames, files);
+}
+
+/**
+ * Same report as {@link scanStorage}, but the tree walk uses async fs calls so the server's
+ * event loop keeps serving while it runs. The synchronous walk measured ~3.7s for a
+ * 40k-file / 7.5GB CODEX_HOME on Windows, during which every listener (proxy traffic
+ * included) stalled each time the Storage page loaded. The two sqlite row counts stay
+ * synchronous: immutable readonly opens measured ~0.1s on the same home.
+ */
+export async function scanStorageAsync(codexHome: string = resolveCodexHomeDir()): Promise<StorageReport> {
+  const files = emptyFiles();
+  const limit = createFsLimit(SCAN_FS_CONCURRENCY);
+
+  let rootNames: string[] = [];
+  try {
+    rootNames = await readdir(codexHome);
+  } catch (error) {
+    rootNames = rootReadFailure(error);
+  }
+
+  const roots = await mapInBatches(rootNames, async name => {
+    const full = join(codexHome, name);
+    try {
+      return { name, full, stat: await limit(() => statAsync(full)) };
+    } catch {
+      return null;
+    }
+  });
+  const walks = await mapInBatches(roots, async root => {
+    if (!root) return;
+    if (root.stat.isDirectory()) {
+      // Quarantine trash (Phase 2) must not inflate "other" or totals.
+      if (root.name === TRASH_DIR) return;
+      return { key: DIR_BUCKETS[root.name] ?? "other", entries: await walkFilesAsync(root.full, root.name, limit) };
+    }
+    if (root.stat.isFile()) {
+      return {
+        key: rootFileBucket(root.name),
+        entries: [{ relPath: root.name, bytes: root.stat.size, mtimeMs: root.stat.mtimeMs }],
+      };
+    }
+  });
+  // Appended in root order so bucket contents match the synchronous scan. One entry at a
+  // time: spreading a large bucket into push() can exceed the engine's argument limit.
+  for (const walk of walks) {
+    if (!walk) continue;
+    const bucket = files[walk.key];
+    for (const entry of walk.entries) bucket.push(entry);
+  }
+
+  return finishReport(codexHome, rootNames, files);
+}

package/src/storage/storage-mutation-coordinator.ts

@@ -34,8 +34,24 @@ export const MAX_ACTIVE_STORAGE_HOME_SLOTS = 32;
 const slots = new Map<string, ActiveSlot>();
 const slotGate = createAdmissionGate("storage_home_slots", MAX_ACTIVE_STORAGE_HOME_SLOTS);
 let releaseMisses = 0;
+let mutationEpoch = 0;
 let testHooks: StorageMutationCoordinatorTestHooks | null = null;
 
+/**
+ * Advances whenever a CODEX_HOME storage mutation finishes (coordinated cleanup, restore
+ * and policy runs on lease release; Log Guard maintenance through
+ * {@link noteStorageMutationCompleted}). An in-flight storage scan that started under an
+ * older epoch describes the tree before that mutation and must not answer a later read.
+ */
+export function storageMutationEpoch(): number {
+  return mutationEpoch;
+}
+
+/** Record a CODEX_HOME mutation that does not go through a coordinator slot. */
+export function noteStorageMutationCompleted(): void {
+  mutationEpoch += 1;
+}
+
 function slotKey(codexHome?: string): string {
   return resolve(codexHome ?? resolveCodexHomeDir());
 }
@@ -79,6 +95,7 @@ export function tryBeginStorageMutation(
     release() {
       if (!active) return;
       active = false;
+      mutationEpoch += 1;
       const owner = slots.get(key);
       if (owner?.lease === ownerLease) slots.delete(key);
       lease.release();

package/src/tray/windows-tray.ps1

@@ -1,4 +1,4 @@
-param(
+param(
   [Parameter(Mandatory = $true)][string]$BunPath,
   [Parameter(Mandatory = $true)][string]$CliPath,
   [Parameter(Mandatory = $true)][string]$CodexHome,
@@ -15,6 +15,19 @@ Add-Type -AssemblyName System.Windows.Forms
 Add-Type -AssemblyName System.Drawing
 try { [System.Windows.Forms.Application]::EnableVisualStyles() } catch { $null = $_ }
 
+# Chinese UI cultures get Chinese tray text; every other locale keeps the English strings. The
+# judgment is a named function so it can be exercised directly instead of only through a live
+# desktop, where a selector that always answered English would still look correct.
+function Test-TrayChineseCulture([string]$CultureName) {
+  return $CultureName -like "zh*"
+}
+$script:isZh = Test-TrayChineseCulture ([System.Globalization.CultureInfo]::CurrentUICulture.Name)
+function Get-TrayText {
+  param([string]$En, [string]$Zh)
+  if ($script:isZh) { return $Zh }
+  return $En
+}
+
 # Normalize aliases before deriving singleton/event names. Without this,
 # C:\path and C:\path\. create separate tray instances for the same home.
 function Normalize-HomePath([string]$Value) {
@@ -127,7 +140,7 @@ function Start-OcxCommand([string[]]$CommandArgs, [switch]$TrackExit) {
     return $true
   } catch {
     Write-ActionLog "launch failed: $($_.Exception.GetType().Name)"
-    $notify.ShowBalloonTip(5000, "opencodex action failed", "The action could not start. Open the logs folder or run ocx doctor.", [System.Windows.Forms.ToolTipIcon]::Error)
+    $notify.ShowBalloonTip(5000, (Get-TrayText "opencodex action failed" "opencodex 操作失败"), (Get-TrayText "The action could not start. Open the logs folder or run ocx doctor." "操作无法启动。打开日志文件夹或运行 ocx doctor。"), [System.Windows.Forms.ToolTipIcon]::Error)
     return $false
   }
 }
@@ -396,19 +409,19 @@ $statusItem = New-Object System.Windows.Forms.ToolStripMenuItem
 $statusItem.Enabled = $false
 $safetyItem = New-Object System.Windows.Forms.ToolStripMenuItem
 $safetyItem.Enabled = $false
-$openItem = $menu.Items.Add("Open Dashboard")
-$updateItem = $menu.Items.Add("Update available")
+$openItem = $menu.Items.Add((Get-TrayText "Open Dashboard" "打开面板"))
+$updateItem = $menu.Items.Add((Get-TrayText "Update available" "有可用更新"))
 $updateItem.Visible = $false
 $updateItem.Enabled = $false
-$startItem = $menu.Items.Add("Start Proxy")
-$stopItem = $menu.Items.Add("Stop Proxy and Restore Native Routing")
-$restartItem = $menu.Items.Add("Restart Proxy")
+$startItem = $menu.Items.Add((Get-TrayText "Start Proxy" "启动代理"))
+$stopItem = $menu.Items.Add((Get-TrayText "Stop Proxy and Restore Native Routing" "停止代理并还原原生路由"))
+$restartItem = $menu.Items.Add((Get-TrayText "Restart Proxy" "重启代理"))
 [void]$menu.Items.Add((New-Object System.Windows.Forms.ToolStripSeparator))
 [void]$menu.Items.Add($statusItem)
 [void]$menu.Items.Add($safetyItem)
-$logsItem = $menu.Items.Add("Open Logs Folder")
+$logsItem = $menu.Items.Add((Get-TrayText "Open Logs Folder" "打开日志文件夹"))
 [void]$menu.Items.Add((New-Object System.Windows.Forms.ToolStripSeparator))
-$exitItem = $menu.Items.Add("Exit Tray")
+$exitItem = $menu.Items.Add((Get-TrayText "Exit Tray" "退出托盘"))
 
 $script:online = $false
 $script:port = 10100
@@ -463,6 +476,14 @@ function Set-PendingAction([string]$Action, [int]$TimeoutSeconds) {
 function Complete-PendingAction([bool]$Success) {
   if ($null -eq $script:pendingAction) { return }
   $action = $script:pendingAction
+  # The pending value stays English because it is compared against the labels the click
+  # handlers set; only the text a user reads is localized.
+  $displayAction = switch ($action) {
+    "Start Proxy" { Get-TrayText "Start Proxy" "启动代理" }
+    "Stop Proxy" { Get-TrayText "Stop Proxy" "停止代理" }
+    "Restart Proxy" { Get-TrayText "Restart Proxy" "重启代理" }
+    default { $action }
+  }
   $script:pendingAction = $null
   if ($null -ne $script:pendingProcess) {
     try {
@@ -474,10 +495,10 @@ function Complete-PendingAction([bool]$Success) {
   }
   if ($Success) {
     Write-ActionLog "$action completed (port=$($script:port), pid=$($script:proxyPid))"
-    $notify.ShowBalloonTip(2500, "opencodex", "$action completed.", [System.Windows.Forms.ToolTipIcon]::Info)
+    $notify.ShowBalloonTip(2500, "opencodex", (Get-TrayText "$displayAction completed." "$displayAction 已完成。"), [System.Windows.Forms.ToolTipIcon]::Info)
   } else {
     Write-ActionLog "$action failed to reach the expected state"
-    $notify.ShowBalloonTip(5000, "opencodex action failed", "$action did not reach the expected state. Open the logs folder or run ocx doctor.", [System.Windows.Forms.ToolTipIcon]::Error)
+    $notify.ShowBalloonTip(5000, (Get-TrayText "opencodex action failed" "opencodex 操作失败"), (Get-TrayText "$displayAction did not reach the expected state. Open the logs folder or run ocx doctor." "$displayAction 未达到预期状态。打开日志文件夹或运行 ocx doctor。"), [System.Windows.Forms.ToolTipIcon]::Error)
   }
 }
 
@@ -536,8 +557,8 @@ function Update-TrayState {
     Start-StartupHealthProbe
   }
   if ($script:online) {
-    $statusItem.Text = "Proxy: Online (port $($script:port))"
-    $notify.Text = "opencodex: Online"
+    $statusItem.Text = (Get-TrayText "Proxy: Online (port $($script:port))" "代理: 在线 (端口 $($script:port))")
+    $notify.Text = (Get-TrayText "opencodex: Online" "opencodex: 在线")
     $startItem.Enabled = $false
     $stopItem.Enabled = $true
     $restartItem.Enabled = $true
@@ -547,21 +568,27 @@ function Update-TrayState {
     # diagnostic is cleaned up outside the online-only UI branch.
     $startup = $script:startupHealth
     if ($null -ne $startup) {
-      $label = if ($startup.status -eq "at-risk") { "At risk" } elseif ($startup.status -eq "protected") { "Protected" } else { "Native routing" }
-      $safetyItem.Text = "Restart safety: $label"
+      $label = if ($startup.status -eq "at-risk") {
+        Get-TrayText "At risk" "有风险"
+      } elseif ($startup.status -eq "protected") {
+        Get-TrayText "Protected" "已保护"
+      } else {
+        Get-TrayText "Native routing" "原生路由"
+      }
+      $safetyItem.Text = (Get-TrayText "Restart safety: $label" "重启保护: $label")
       $notify.Icon = if ($startup.status -eq "at-risk") {
         if ($script:updateAvailable) { $warningUpdateIcon } else { $warningIcon }
       } else {
         if ($script:updateAvailable) { $onlineUpdateIcon } else { $onlineIcon }
       }
     } else {
-      $safetyItem.Text = "Restart safety: unavailable"
+      $safetyItem.Text = (Get-TrayText "Restart safety: unavailable" "重启保护: 不可用")
       $notify.Icon = if ($script:updateAvailable) { $warningUpdateIcon } else { $warningIcon }
     }
   } else {
-    $statusItem.Text = "Proxy: Offline"
-    $safetyItem.Text = "Restart safety: start the proxy to inspect"
-    $notify.Text = "opencodex: Offline"
+    $statusItem.Text = (Get-TrayText "Proxy: Offline" "代理: 离线")
+    $safetyItem.Text = (Get-TrayText "Restart safety: start the proxy to inspect" "重启保护: 启动代理后查看")
+    $notify.Text = (Get-TrayText "opencodex: Offline" "opencodex: 离线")
     $notify.Icon = if ($script:updateAvailable) { $offlineUpdateIcon } else { $offlineIcon }
     $startItem.Enabled = $true
     $stopItem.Enabled = $false
@@ -607,7 +634,7 @@ $openItem.add_Click({ Start-OcxCommand @("gui") })
 $updateItem.add_Click({ Start-OcxCommand @("gui") })
 $startItem.add_Click({
   if (-not (Set-PendingAction "Start Proxy" 75)) { return }
-  $statusItem.Text = "Proxy: Starting..."
+  $statusItem.Text = (Get-TrayText "Proxy: Starting..." "代理: 启动中...")
   # service start can spend 20s and the CLI then observes health for another 40s.
   $startProcess = Start-OcxCommand @("__tray-start") -TrackExit
   if ($startProcess -is [System.Diagnostics.Process]) {
@@ -618,7 +645,7 @@ $startItem.add_Click({
 })
 $stopItem.add_Click({
   if (-not (Set-PendingAction "Stop Proxy" 15)) { return }
-  $statusItem.Text = "Proxy: Stopping..."
+  $statusItem.Text = (Get-TrayText "Proxy: Stopping..." "代理: 停止中...")
   $stopProcess = Start-OcxCommand @("stop") -TrackExit
   if ($stopProcess -is [System.Diagnostics.Process]) {
     $script:pendingProcess = $stopProcess
@@ -628,7 +655,7 @@ $stopItem.add_Click({
 })
 $restartItem.add_Click({
   if (-not (Set-PendingAction "Restart Proxy" 160)) { return }
-  $statusItem.Text = "Proxy: Restarting..."
+  $statusItem.Text = (Get-TrayText "Proxy: Restarting..." "代理: 重启中...")
   # /api/system/restart may drain active work for 60s and then spend up to 70s
   # handing off to an identity-verified replacement. The tray observes health/PID
   # rather than the detached CLI exit, so keep a watchdog margin around that shared
@@ -665,7 +692,7 @@ $timer.add_Tick({
 $notify.ContextMenuStrip = $menu
 $notify.Icon = $offlineIcon
 $notify.Visible = $true
-$notify.Text = "opencodex: Checking..."
+$notify.Text = (Get-TrayText "opencodex: Checking..." "opencodex: 检查中...")
 
 try {
   Initialize-UpdateBadgeReader

package/src/types/config.ts

@@ -722,6 +722,8 @@ export interface OcxConfig {
     /** Compaction triggers this override covers; omission means `["manual"]`. */
     triggers?: ("manual" | "auto")[];
   };
+  /** Opt-in failure-only recovery; never replaces the initial compaction model. */
+  compactionRecovery?: { enabled: boolean; model: string; allowDevinInvalidArgument?: boolean };
   /**
    * Models hidden from Codex discovery without blocking direct proxy calls. Routed provider ids
    * are excluded from the catalog + /v1/models entirely. Account-qualified native ids hide only
@@ -1514,6 +1516,8 @@ export interface OcxWebSearchSidecarConfig {
  * explicit account selection. Only automatic rotation skips it.
  */
 export interface OcxCodexPoolConfig {
+  /** Start idle Codex windows when the pool is initialized. */
+  startIdleWindows?: boolean;
   /**
    * Plan keys ordinary rotation skips, matched case-insensitively against the plan stored on each
    * account. Absent or empty means no policy.

package/src/types/provider.ts

@@ -180,6 +180,8 @@ export interface RequestPacingRule {
   requestsPerMinute?: number;
   /** Minimum delay between request starts. The slower configured value wins. */
   minIntervalMs?: number;
+  /** Maximum number of requests concurrently in flight. */
+  maxConcurrentRequests?: number;
 }
 
 export interface ProviderRequestPacingConfig extends RequestPacingRule {
@@ -660,13 +662,15 @@ export interface OcxProviderConfig {
    * Reactive 429 rotation remains available even when proactive routing is disabled.
    */
   oauthAccountFailover?: {
+    /** Kiro OAuth only: active serving requests per account, 1..100. */
+    maxConcurrentPerAccount?: number;
     enabled?: boolean;
     /**
      * Generic OAuth pool selection strategy (#695). Persisted through the pool-settings
      * contract. Consumed by the selector only while `pool.kernel` is on; with the flag off
      * it is still merely persisted, so omitted and set behave the same.
      */
-    strategy?: "quota" | "round-robin" | "fill-first";
+    strategy?: "quota" | "round-robin" | "fill-first" | "least-loaded";
     /**
      * 0-100 usage percent at which fill-first advances off the active account (#695).
      * Read only under `pool.kernel` with `strategy: "fill-first"`; 80 when unset, matching

package/src/types/request.ts

@@ -221,8 +221,17 @@ export interface OcxImageContent {
 
 export interface OcxVideoContent {
   type: "video";
-  /** A base64 `data:` URL from an OpenAI-compatible `video_url` part. */
+  /**
+   * A base64 `data:` URL from an OpenAI-compatible `video_url` part, or a URI
+   * the upstream can fetch itself (a YouTube watch URL, a Files API uri).
+   */
   videoUrl: string;
+  /**
+   * Gemini's agentic video mode, carried verbatim from the caller's
+   * `video_url.processing` (#3271). Absent for every request that does not ask
+   * for it, so no existing traffic gains a field.
+   */
+  processing?: string;
 }
 
 /**
@@ -361,7 +370,7 @@ export interface OcxProviderContinuationState {
 }
 
 export type AdapterEvent =
-  | { type: "heartbeat"; replayUnsafe?: true }
+  | { type: "heartbeat"; replayUnsafe?: true; preflightReady?: true }
   | { type: "text_delta"; text: string; phase?: OcxMessagePhase }
   | { type: "thinking_delta"; thinking: string }
   // Anthropic extended-thinking round-trip: signature_delta for the current thinking block, and
@@ -438,6 +447,8 @@ export interface OcxUrlCitation {
  * - `totalTokens` = inputTokens + outputTokens. Never re-add cache detail on top.
  */
 export interface OcxUsage {
+  /** Provider-reported credit spend, independent of token estimates and USD pricing. */
+  providerCredits?: number;
   inputTokens: number;
   outputTokens: number;
   /**

package/src/update/index.ts

@@ -38,6 +38,7 @@ import {
 } from "./npm-cache-preflight.mjs";
 import { handoffWindowsTrayForUpdate, planWindowsTrayUpdate } from "./tray-update-plan.mjs";
 import { withProcessRuntimeProvenance } from "../lib/bun-runtime";
+import { withoutSiblingMarker } from "../codex/sibling-start";
 import { packageVersion } from "../lib/package-version";
 import { selfLaunchArgv } from "../lib/self-launch-argv";
 
@@ -529,7 +530,8 @@ export async function runUpdate(): Promise<void> {
   };
   const startProxyDirectly = async (): Promise<boolean> => {
     if (!postUpdateLauncherUsable || !existsSync(postUpdateLauncher)) return false;
-    const env = mutation.controlEnvironment();
+    // An ordinary owner: a stray sibling marker would otherwise mark it before any probe.
+    const env = mutation.controlEnvironment(withoutSiblingMarker(process.env));
     delete env.OCX_SERVICE;
     const child = spawn(process.execPath, [postUpdateLauncher, "start", "--port", String(capturedListen.port)], {
       detached: true, stdio: "ignore", windowsHide: true, env: withProcessRuntimeProvenance(env),

package/src/update/job.ts

@@ -60,6 +60,8 @@ import {
   runNpmCachePreflight,
   type NpmCachePreflightReason,
 } from "./npm-cache-preflight.mjs";
+import { guiUpdateWorkerCommand } from "./worker-launch";
+import { withoutSiblingMarker } from "../codex/sibling-start";
 
 const RELEASE_NOTES_URL = "https://github.com/lidge-jun/opencodex/releases/latest";
 const UPDATE_JOB_FILENAME = "update-job.json";
@@ -574,7 +576,8 @@ export function spawnGuiUpdateWorker(
     restart ? "restart" : "no-restart",
   ]);
   if (process.platform !== "win32") {
-    return spawn(process.execPath, args, {
+    const launch = guiUpdateWorkerCommand(process.execPath, args);
+    return spawn(launch.command, launch.argv, {
       detached: true,
       stdio: "ignore",
       windowsHide: true,
@@ -932,7 +935,8 @@ function spawnDetachedStart(
   launcher = packageLauncherPath(),
 ): ChildProcess {
   const cmd = restartCommand(false, installer, launcher, port);
-  const env = { ...process.env };
+  // An ordinary owner: a stray sibling marker would otherwise mark it before any probe.
+  const env: NodeJS.ProcessEnv = withoutSiblingMarker(process.env);
   delete env.OCX_SERVICE;
   updateJob(job, {}, `$ ${cmd.display}`);
   let stdio: "ignore" | [ "ignore", number, number ] = "ignore";

package/src/update/mise-launcher-target.ts

@@ -0,0 +1,100 @@
+import { realpathSync } from "node:fs";
+import { dirname, isAbsolute, join } from "node:path";
+import {
+  observePackageManifestAt,
+  packageManifestPathIn,
+  runningPackageRoot,
+} from "../lib/package-tree-integrity";
+import type { LauncherTarget, ResolveLauncherTarget } from "../lib/package-tree-retarget";
+import { readServiceInstallState, SERVICE_MANAGED_ENV } from "../service/state";
+import { detectInstallOwnershipFromPath, type InstallOwnership } from "./install-detection.mjs";
+
+const PACKAGE_DIR = join("@bitkyc08", "opencodex");
+
+/**
+ * The package launcher mise's npm backend creates in `<toolRoot>/<selector>/node_modules/.bin`,
+ * beside the package it starts. This is the layout `detectInstallOwnershipFromPath` verifies as
+ * mise-owned; a launcher in any other layout is not followed.
+ */
+const LAUNCHER_BIN = join("node_modules", ".bin");
+const LAUNCHER_PACKAGE_DIR = join("node_modules", PACKAGE_DIR);
+
+export interface MiseLauncherTargetDeps {
+  platform?: NodeJS.Platform;
+  env?: NodeJS.ProcessEnv;
+  ownership?: () => InstallOwnership;
+  launcherPath?: () => string | undefined;
+  runningRoot?: () => string;
+  realpath?: (path: string) => string;
+}
+
+export interface MiseLauncherTargetWatchPlan {
+  runningRoot: string;
+  resolveTarget: ResolveLauncherTarget;
+}
+
+function canonical(path: string, realpath: (path: string) => string): string | null {
+  try {
+    return realpath(path);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Map a recorded service launcher to the package directory it starts, when it is one of mise's
+ * own package launchers for this tool. A mise shim (`<data>/shims/ocx`) resolves to the mise
+ * binary and names no package, and anything outside `<toolRoot>/<selector>/` is not a launcher
+ * this install owns, so both are unsupported and return null.
+ */
+function launcherPackageEntry(launcherPath: string, toolRoot: string, realpath: (path: string) => string): string | null {
+  if (!isAbsolute(launcherPath)) return null;
+  const binDir = dirname(launcherPath);
+  const canonicalToolRoot = canonical(toolRoot, realpath);
+  if (canonicalToolRoot === null) return null;
+  if (!binDir.endsWith(`/${LAUNCHER_BIN}`)) return null;
+  const selectorDir = binDir.slice(0, binDir.length - LAUNCHER_BIN.length - 1);
+  if (canonical(dirname(selectorDir), realpath) !== canonicalToolRoot) return null;
+  return join(selectorDir, LAUNCHER_PACKAGE_DIR);
+}
+
+/**
+ * Decide whether this process should watch its service launcher for a mise upgrade, and build the
+ * resolver when it should.
+ *
+ * Eligible only when every one of these holds:
+ * - Linux. launchd services always run pinned package paths (see the stable-launcher contract),
+ *   and Windows services have no launcher, so neither can follow a moved `latest` link.
+ * - The process is the managed service job itself (`OCX_SERVICE_MANAGED=1`). `OCX_SERVICE=1`
+ *   alone is also set on proxies `ocx claude`/`ocx opencode` spawn, and a foreground proxy must
+ *   never restart itself because a service record exists.
+ * - The running package has a verified mise owner, and the recorded launcher is one of that
+ *   tool's package launchers.
+ * - At boot, the launcher resolves to exactly the running package. That proves the supervisor
+ *   started this process through it, so a restart through it converges instead of looping.
+ */
+export function planMiseLauncherTargetWatch(deps: MiseLauncherTargetDeps = {}): MiseLauncherTargetWatchPlan | null {
+  if ((deps.platform ?? process.platform) !== "linux") return null;
+  if ((deps.env ?? process.env)[SERVICE_MANAGED_ENV] !== "1") return null;
+  const realpath = deps.realpath ?? realpathSync;
+  const runningRoot = canonical((deps.runningRoot ?? runningPackageRoot)(), realpath);
+  if (runningRoot === null) return null;
+  const ownership = (deps.ownership ?? (() => detectInstallOwnershipFromPath(runningRoot)))();
+  if (ownership.installer !== "mise" || !ownership.owner) return null;
+  const owner = ownership.owner;
+  const launcherPath = (deps.launcherPath ?? (() => readServiceInstallState()?.launcherPath))();
+  if (!launcherPath) return null;
+  const entry = launcherPackageEntry(launcherPath, owner.toolRoot, realpath);
+  const toolRoot = canonical(owner.toolRoot, realpath);
+  if (entry === null || toolRoot === null) return null;
+
+  const resolveTarget = (): LauncherTarget | null => {
+    const root = canonical(entry, realpath);
+    // A floating link repointed outside this tool's installs is not a mise upgrade of it.
+    if (root === null || !root.startsWith(`${toolRoot}/`)) return null;
+    const manifest = observePackageManifestAt(packageManifestPathIn(root));
+    return manifest === null ? null : { root, manifest };
+  };
+  if (resolveTarget()?.root !== runningRoot) return null;
+  return { runningRoot, resolveTarget };
+}