@bitkyc08/opencodex 2.69.0 → 2.70.0

package/src/adapters/kiro/payload.ts

@@ -23,9 +23,8 @@ import {
 import { EMPTY_EXEC_OUTPUT_MESSAGE, annotateCodeModeHostFailure, normalizeEmptyExecToolResultText } from "../exec-tool-result-normalize";
 import { identifyRoutedModel } from "../identity";
 import {
-  countKiroUninlinableImages,
   extractKiroImages,
-  kiroUninlinableImageMarker,
+  kiroImageOmissionMarker,
   type KiroImage,
 } from "../kiro-images";
 import { convertKiroToolContext } from "../kiro-tools";
@@ -105,6 +104,7 @@ export function kiroCompletionTool(): Record<string, unknown> {
   };
 }
 
+/** Build the Kiro wire request, retaining markers for images that cannot be inlined. */
 export function buildKiroPayload(
   parsed: OcxParsedRequest,
   profileArn: string | undefined,
@@ -245,9 +245,9 @@ export function buildKiroPayload(
     if (msg.role === "user" || msg.role === "developer") {
       const content = (msg as { content: string | OcxContentPart[] }).content;
       const images = extractKiroImages(content);
-      // Kiro inlines base64 bytes only. A remote reference used to vanish with neither
-      // bytes nor a trace; attach a bounded, URL-free marker so the loss is visible.
-      const marker = kiroUninlinableImageMarker(countKiroUninlinableImages(content));
+      // Kiro inlines base64 bytes only. Neither remote references nor malformed
+      // inline data URLs can be forwarded; leave a bounded, URL-free marker.
+      const marker = kiroImageOmissionMarker(content);
       const text = userContentText(content);
       pushUser(marker ? (text ? text + "\n" + marker : marker) : text, images);
     } else if (msg.role === "assistant") {
@@ -295,14 +295,14 @@ export function buildKiroPayload(
       const annotatedExecText = normalizedExecText === undefined && codeModeExecName !== undefined
         ? annotateCodeModeHostFailure(text, execOptions)
         : undefined;
-      const uninlinableMarker = kiroUninlinableImageMarker(countKiroUninlinableImages(tr.content));
+      const omittedImageMarker = kiroImageOmissionMarker(tr.content);
       // Appended to the SELECTED result text, not to `text`: when an exec normalization
       // fires, resultText below takes normalizedExecText/annotatedExecText instead, and
       // a marker attached to `text` would be dropped — reinstating the silent loss this
       // exists to remove.
       const chosenText = normalizedExecText ?? annotatedExecText ?? (text.trim() ? text : KIRO_EMPTY_TOOL_RESULT_MESSAGE);
-      const resultText = uninlinableMarker
-        ? (chosenText ? chosenText + "\n" + uninlinableMarker : uninlinableMarker)
+      const resultText = omittedImageMarker
+        ? (chosenText ? chosenText + "\n" + omittedImageMarker : omittedImageMarker)
         : chosenText;
       const images = extractKiroImages(tr.content);
       const toolUseId = normalizeToolId(tr.toolCallId);
@@ -315,8 +315,8 @@ export function buildKiroPayload(
         ? (annotatedExecText ?? text) : undefined;
       // The grouping path rebuilds a collapsed turn's content from these texts, so the
       // marker has to ride along here too or an adjacent-result turn loses it.
-      const rawGroupText = uninlinableMarker
-        ? (rawGroupBase ? rawGroupBase + "\n" + uninlinableMarker : uninlinableMarker)
+      const rawGroupText = omittedImageMarker
+        ? (rawGroupBase ? rawGroupBase + "\n" + omittedImageMarker : omittedImageMarker)
         : rawGroupBase;
       const last = turns.at(-1);
       if (

package/src/adapters/kiro-images.ts

@@ -1,5 +1,7 @@
 import type { OcxContentPart } from "../types";
 import { normalizeImageTargets, type NormalizeOptions, type NormalizeTarget } from "./anthropic-image-normalize";
+import { MAX_INPUT_BASE64_LENGTH, MAX_INPUT_PIXELS } from "./anthropic-image-codec";
+import { sniffImageDimensions } from "./anthropic-image-guard";
 
 // CodeWhisperer native image part (matches Kiro IDE wire format): the base64 bytes live directly in
 // userInputMessage.images, NOT in userInputMessageContext. Verified against kiro-gateway.
@@ -8,8 +10,7 @@ export interface KiroImage {
   source: { bytes: string }; // pure base64, no "data:...;base64," prefix
 }
 
-// Codex sends each image as a `data:` URL (base64) or a remote https URL. Only data URLs can be
-// inlined as bytes here; remote URLs are not fetchable at request-build time.
+/** Parse inline image bytes; remote URLs are not fetched at request-build time. */
 function parseDataUrlImage(imageUrl: string): KiroImage | undefined {
   if (!imageUrl.startsWith("data:")) return undefined;
   const comma = imageUrl.indexOf(",");
@@ -65,17 +66,36 @@ export function kiroUninlinableImageMarker(count: number): string {
   return "[" + String(count) + " images omitted: remote image references are not supported by this provider]";
 }
 
+/** Report malformed inline references separately from remote URLs. */
+export function kiroImageOmissionMarker(content: string | OcxContentPart[]): string {
+  if (typeof content === "string") return "";
+  const remote = kiroUninlinableImageMarker(countKiroUninlinableImages(content));
+  let malformed = 0;
+  for (const part of content) {
+    if (part.type === "image" && part.imageUrl.startsWith("data:") && !parseDataUrlImage(part.imageUrl)) malformed++;
+  }
+  const inline = malformed === 1
+    ? "[image omitted: malformed inline image data URL]"
+    : malformed > 1 ? `[${malformed} images omitted: malformed inline image data URLs]` : "";
+  return [remote, inline].filter(Boolean).join("\n");
+}
+
 /**
- * Conservative POLICY caps for the CodeWhisperer GenerateAssistantResponse payload,
- * whose limits are undocumented. Derived from adjacent AWS surfaces
+ * Conservative POLICY caps for the CodeWhisperer GenerateAssistantResponse payload.
+ * The 100-image request cap comes from Kiro's IMAGE_COUNT_EXCEEDED error
+ * ("101 exceeds limit 100"); the per-message and byte limits are undocumented
+ * and derived from adjacent AWS surfaces
  * (devlog/260714_image_normalization_pipeline/050): Bedrock `Message` allows 20 images
  * per message (Converse), and `InvokeModel` caps requests at 25,000,000 bytes — 18MiB
  * bounds the IMAGE share of the body with headroom for text/tools.
  */
 export const KIRO_IMAGE_BASE64_BUDGET = 18 * 1024 * 1024;
 export const KIRO_MAX_IMAGES_PER_MESSAGE = 20;
+export const KIRO_MAX_IMAGES_PER_REQUEST = 100;
 
 const COUNT_CAP_NOTE = "[image omitted: exceeded the 20-image per-message cap; oldest images in this message were dropped]";
+const REQUEST_CAP_NOTE = "[images omitted: exceeded the 100-image request cap; oldest images in this message were dropped]";
+const REQUEST_CAP_EMPTY_NOTE = "[images omitted: exceeded the 100-image request cap; no images remain in this message]";
 
 /** A kiro wire message that can carry images (history userInputMessage or currentMessage). */
 interface KiroImageCarrier {
@@ -105,11 +125,20 @@ function appendNote(carrier: KiroImageCarrier, note: string): void {
   carrier.content = carrier.content ? `${carrier.content}\n${note}` : note;
 }
 
+/** Cheap structural check (no decode or encode) for the request-wide count. */
+function countsTowardRequestCap(image: KiroImage): boolean {
+  const b64 = typeof image.source?.bytes === "string" ? image.source.bytes : "";
+  if (b64.length === 0 || b64.length > MAX_INPUT_BASE64_LENGTH) return false;
+  const dims = sniffImageDimensions(b64);
+  return dims !== null && dims.width * dims.height <= MAX_INPUT_PIXELS;
+}
+
 /**
  * Apply the generous image pipeline to a built CodeWhisperer payload (mutates in
- * place): per-message 20-image cap first (oldest dropped), then the shared tier
- * machinery with the kiro budget and terminal-overflow DROP (kiro has no downstream
- * guard). Test seams (encode/validate) forward into the core.
+ * place): per-message 20-image cap, then the 100-image request cap over
+ * structurally usable images (oldest dropped), then the shared tier machinery
+ * with the kiro budget and terminal-overflow DROP (kiro has no downstream guard).
+ * Test seams (encode/validate) forward into the core.
  */
 export async function normalizeKiroImages(
   payload: unknown,
@@ -126,6 +155,28 @@ export async function normalizeKiroImages(
     appendNote(carrier, COUNT_CAP_NOTE);
   }
 
+  // Request count cap BEFORE the byte budget: a surplus image must not push survivors to
+  // lower tiers, which #4532 then pins across turns. Only structurally usable images count
+  // (bytes present, within the bomb limits, dimensions sniffable), so a corrupt image cannot
+  // evict valid history; the normalizer below still drops it with its own marker. This stays
+  // a cheap header check: truncated data that still sniffs as an image does count.
+  let excess = carriers.reduce((count, carrier) => count + (carrier.images ?? []).filter(countsTowardRequestCap).length, 0)
+    - KIRO_MAX_IMAGES_PER_REQUEST;
+  for (const carrier of carriers) {
+    if (excess <= 0) break;
+    const images = carrier.images;
+    if (!images?.length) continue;
+    const kept: KiroImage[] = [];
+    for (const image of images) {
+      if (excess > 0 && countsTowardRequestCap(image)) excess--;
+      else kept.push(image);
+    }
+    if (kept.length === images.length) continue;
+    if (kept.length === 0) delete carrier.images;
+    else carrier.images = kept;
+    appendNote(carrier, kept.length === 0 ? REQUEST_CAP_EMPTY_NOTE : REQUEST_CAP_NOTE);
+  }
+
   // Targets over the survivors, oldest→newest across carriers. Drops resolve the image
   // by OBJECT IDENTITY at execution time (indices go stale after earlier splices) and
   // delete an emptied images field per the builder's omission contract.

package/src/adapters/openai-chat/passthrough.ts

@@ -6,6 +6,7 @@ import { applyExplicitChatDeveloperRole } from "./developer-role";
 import { openRouterProviderPayload, resolveOpenRouterRouting } from "../../providers/openrouter-routing";
 import { resolveVercelGatewayRouting, vercelGatewayProviderPayload } from "../../providers/vercel-gateway-routing";
 import { fastPolicyForModel } from "../../providers/service-tier";
+import { applyGithubCopilotContextTier } from "../../providers/github-copilot-context";
 import { canonicalFastTierMarker, decideTier, type ResolvedFastPolicy } from "../../providers/fastwire";
 import { debugProviderDiagnostic } from "../../lib/debug";
 import { isDebugEnabled } from "../../lib/debug-settings";
@@ -53,6 +54,7 @@ export function buildOpenAIChatPassthroughRequest(
   stream: boolean,
   fastPolicy: ResolvedFastPolicy = fastPolicyForModel(provider, modelId, undefined, "chat"),
   fastMode?: boolean,
+  providerName?: string,
 ): AdapterRequest {
   const { url, headers, hasCredential } = openAIChatTransport(provider);
 
@@ -153,7 +155,7 @@ export function buildOpenAIChatPassthroughRequest(
     body.stream_options = rawBody.stream_options;
   }
 
-  const bodyJson = JSON.stringify(body);
+  const bodyJson = JSON.stringify(applyGithubCopilotContextTier(body, provider, modelId, providerName));
 
   if (isDebugEnabled()) {
     let host = "upstream";

package/src/adapters/openai-chat.ts

@@ -13,6 +13,7 @@ import { isDebugEnabled } from "../lib/debug-settings";
 import { openRouterProviderPayload, resolveOpenRouterRouting } from "../providers/openrouter-routing";
 import { resolveVercelGatewayRouting, vercelGatewayProviderPayload } from "../providers/vercel-gateway-routing";
 import { fastPolicyForModel } from "../providers/service-tier";
+import { applyGithubCopilotContextTier } from "../providers/github-copilot-context";
 import { createAdapterTierMetadata, decideTier, type AdapterTierMetadata } from "../providers/fastwire";
 import {
   isTranslatorBudgetExceededError,
@@ -229,7 +230,7 @@ export function createOpenAIChatAdapter(provider: OcxProviderConfig): ProviderAd
         }
         if (parsed.stream) body.stream_options = { include_usage: true };
 
-        const bodyJson = JSON.stringify(body);
+        const bodyJson = JSON.stringify(applyGithubCopilotContextTier(body, provider, parsed.modelId, incoming?.providerName));
         const actualServiceTier = typeof body.service_tier === "string" ? body.service_tier : null;
         const tierLog = createAdapterTierMetadata(
           parsed.options.tierObservation,

package/src/adapters/openai-responses/passthrough.ts

@@ -3,6 +3,7 @@ import { nameRoutedIdentity, repairIdentityInResponsesBody, stripRoutedIdentity
 import { stripBracketedModelSuffix } from "../openai-chat";
 import { normalizeOpenCodeGoAdditionalTools } from "../opencode-go-additional-tools";
 import { isXaiResponsesDestination } from "../../providers/xai-transport";
+import { applyGithubCopilotContextTier } from "../../providers/github-copilot-context";
 import { Buffer } from "node:buffer";
 import type { IncomingMeta, ProviderAdapter } from "../base";
 import { namespacedToolName, type AdapterEvent, type OcxParsedRequest, type OcxProviderConfig, type OcxUsage, type TierDecision } from "../../types";
@@ -538,7 +539,7 @@ export function createResponsesPassthroughAdapter(provider: OcxProviderConfig):
       if (!isCanonicalOpenAiForwardProvider(provider)) {
         validateFinalCustomToolCompatibility(finalBody, provider.supportsResponsesCustomTools);
       }
-      const body = JSON.stringify(finalBody);
+      const body = JSON.stringify(applyGithubCopilotContextTier(finalBody, provider, parsed.modelId, incoming.providerName));
       const releaseBodyObservation = translatorBudget.observeExternallyCapped(
         "passthrough_serialization",
         Buffer.byteLength(body, "utf8"),

package/src/bridge/response-json.ts

@@ -83,6 +83,8 @@ function buildResponseJSONWithBudget(
   modelId: string,
   options?: {
     hideThinkingSummary?: boolean;
+    /** Provider policy: suppress raw content-channel reasoning, keep provider-authored summaries. */
+    hideRawReasoning?: boolean;
     toolNsMap?: Map<string, { namespace: string; name: string; freeform?: true }>;
     /** Request-visible tool names. Required for client calls when enforcement is explicitly enabled. */
     declaredToolNames?: ReadonlySet<string>;
@@ -102,6 +104,13 @@ function buildResponseJSONWithBudget(
     translatorBudget?: TranslatorBudget;
     /** Conversation identity for the reasoning replay cache (issue #950). */
     replayCacheScope?: OcxReasoningReplayScopeRef;
+    /**
+     * Fold-only callers whose body never reaches the client (direct client encoders): hidden raw
+     * reasoning is still handed to the replay cache, but no client-bound `ocxr1` envelope is
+     * materialized. Encoding reserves roughly ten times the text against the translator budget,
+     * so a block that fit live delivery could otherwise overflow here and lose the cache write.
+     */
+    omitHiddenReasoningEnvelope?: boolean;
   },
 ): Record<string, unknown> {
   const responseId = `resp_${uuid()}`;
@@ -284,7 +293,12 @@ function buildResponseJSONWithBudget(
     const rawText = joinChunks(currentRawReasoning);
     if (!rawText) return;
     rawReasoningForNextToolCall = rawText;
-    if (options?.hideThinkingSummary === true) {
+    if (options?.hideThinkingSummary === true || options?.hideRawReasoning === true) {
+      if (options?.omitHiddenReasoningEnvelope === true) {
+        budget?.releaseRetained(currentRawReasoning.bytes, { kind: "reasoning" });
+        currentRawReasoning = emptyChunks();
+        return;
+      }
       // Same contract as the streaming path: no visible reasoning, txt-only envelope round-trip.
       pushOutput({
         type: "reasoning", id: `rs_${uuid()}`, summary: [],

package/src/bridge/sse.ts

@@ -80,6 +80,8 @@ export function bridgeToResponsesSSE(
      */
     localUpstream?: boolean;
     hideThinkingSummary?: boolean;
+    /** Provider policy: suppress raw content-channel reasoning, keep provider-authored summaries. */
+    hideRawReasoning?: boolean;
     /**
      * Remote compaction v2 turn: accumulate all assistant text and, on done, emit ONE synthetic
      * `{type:"compaction", encrypted_content:"ocx1:"+base64(text)}` output item before
@@ -975,7 +977,7 @@ export function bridgeToResponsesSSE(
               break;
             }
             case "reasoning_raw_delta": {
-              if (options?.hideThinkingSummary) {
+              if (options?.hideThinkingSummary || options?.hideRawReasoning) {
                 hiddenRawReasoning = appendString(
                   hiddenRawReasoning,
                   event.text,

package/src/claude/intercept/model-bindings.ts

@@ -32,6 +32,7 @@ const NATIVE_ROUTE_PREFIX = "native/";
  */
 export const DESKTOP_PICKER_ID_SUGGESTIONS: readonly string[] = [
   "claude-opus-5-5",
+  "claude-sonnet-5-5",
   "claude-sonnet-5",
   "claude-fable-5-1",
   "claude-haiku-4-5",

package/src/cli/account-extended.ts

@@ -1,7 +1,7 @@
 import { loadConfig } from "../config";
 import { isReservedCodexAccountWord, reportCodexAccountTargetError, resolveCodexAccountTarget } from "./account-target";
 import { hasPassiveAccountQuota } from "../providers/quota";
-import { closeSync, openSync, readSync } from "node:fs";
+import { closeSync, openSync, readSync, readFileSync, statSync } from "node:fs";
 import {
   MAX_ACCOUNT_PRIORITY,
   MIN_ACCOUNT_PRIORITY,
@@ -47,6 +47,7 @@ const EXTENDED_USAGE = `Usage:
   ocx account pause-exhausted <provider> [--json]
   ocx account strategy <provider> [<quota|round-robin|fill-first|least-loaded|reset-first>] [--json]
   ocx account sticky <provider> [<1-100>] [--json]
+  ocx account routes anthropic [--file <json-file>|--clear] [--json]
   ocx account remove <provider> <id|alias|main> --yes [--json]
   ocx account clear-cooldown <provider> <id|alias|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]
@@ -1090,3 +1091,32 @@ export async function cmdAlias(args: string[], deps: AccountDeps): Promise<numbe
   else console.log(alias ? `${name}: ${requestedId} is now “${alias}”` : `${name}: cleared alias for ${requestedId}`);
   return 0;
 }
+
+/** Read or replace the ordered Anthropic model routes through the unified settings API. */
+export async function cmdRoutes(args: string[], deps: AccountDeps): Promise<number> {
+  const wantsJson = flag(args, "--json");
+  const file = flagValue(args, "--file");
+  const clear = flag(args, "--clear");
+  if (args.shift() !== "anthropic" || args.length || (file.found && (!file.value || clear))) return usage();
+  const baseUrl = await resolveBaseUrl(deps);
+  if (!baseUrl) return proxyUnreachable();
+  let routes: unknown;
+  if (file.found) {
+    try {
+      const info = statSync(file.value!);
+      if (!info.isFile() || info.size > 64 * 1024) return usage("Error: route file must be a regular JSON file of at most 64 KiB");
+      routes = JSON.parse(readFileSync(file.value!, "utf8"));
+    } catch {
+      return usage("Error: could not read a valid JSON route file");
+    }
+  }
+  const writing = file.found || clear;
+  const response = await apiJson(deps, baseUrl, writing ? "PUT" : "GET",
+    writing ? "/api/pool/settings" : "/api/pool/settings?provider=anthropic",
+    writing ? { provider: "anthropic", routes: clear ? null : routes } : undefined);
+  if (response.status === 0) return proxyUnreachable(response.transportError);
+  if (response.status !== 200) return apiError(response.json, "failed to manage Anthropic routes", response.status);
+  if (wantsJson) console.log(JSON.stringify(response.json, null, 2));
+  else console.log(JSON.stringify(response.json.routes ?? [], null, 2));
+  return 0;
+}

package/src/cli/account.ts

@@ -15,6 +15,7 @@ import {
   cmdRefresh,
   cmdRemove,
   cmdSticky,
+  cmdRoutes,
   cmdStrategy,
 } from "./account-extended";
 import { apiError, apiJson, classifyAccount, fetchRows, proxyUnreachable, resolveBaseUrl, type AccountDeps, type AccountRow, type AccountType, type ApiResult }
@@ -55,6 +56,7 @@ const ACCOUNT_USAGE = `Usage:
   ocx account pause-exhausted <provider> [--json]
   ocx account strategy <provider> [<quota|round-robin|fill-first|least-loaded|reset-first>] [--json]
   ocx account sticky <provider> [<1-100>] [--json]
+  ocx account routes anthropic [--file <json-file>|--clear] [--json]
   ocx account remove <provider> <account-or-key-id|alias|main> --yes [--json]
   ocx account clear-cooldown <provider> <account-id|alias|main> [--json]
   ocx account add-key <provider> [--label <label>] [--json]
@@ -417,6 +419,7 @@ export async function cmdAccount(args: string[], deps: AccountDeps = {}): Promis
     if (sub === "pause-exhausted") return await cmdPauseExhausted(rest, deps);
     if (sub === "strategy") return await cmdStrategy(rest, deps);
     if (sub === "sticky") return await cmdSticky(rest, deps);
+    if (sub === "routes") return await cmdRoutes(rest, deps);
     if (sub === "remove") return await cmdRemove(rest, deps);
     if (sub === "clear-cooldown") return await cmdClearCooldown(rest, deps);
     if (sub === "add-key") return await cmdAddKey(rest, deps);

package/src/cli/capabilities.ts

@@ -611,6 +611,19 @@ export const CAPABILITIES: readonly Capability[] = [
     json: "envelope",
     details: ["Only meaningful under the sticky-capable strategies; the pool strategy is the other half of this setting."],
   },
+  {
+    command: ["account", "routes"],
+    summary: "Read, replace, or clear Anthropic OAuth model account routes.",
+    routes: [{ method: "GET", path: "/api/pool/settings" }, { method: "PUT", path: "/api/pool/settings" }],
+    flags: [
+      { name: "--file", value: "string", summary: "Read a bounded JSON route array from a local file." },
+      { name: "--clear", value: "boolean", summary: "Remove the stored routes." },
+      { name: "--json", value: "boolean", summary: "Emit the unified settings response as JSON." },
+    ],
+    mutates: true,
+    json: "envelope",
+    details: ["Only anthropic is supported. The server validates route names, patterns, and account IDs."],
+  },
   {
     command: ["account", "auto-switch"],
     summary: "Show or set the usage percentage at which a pool moves to another account.",

package/src/cli/client-start-fence.ts

@@ -0,0 +1,36 @@
+import type { ServiceChildOwnershipDecision } from "../service/service-child-ownership";
+
+/**
+ * Connected-client starts publish PID and runtime records too, so a supervised service child
+ * must not reach them past a foreign owner any more than the server path may. The server path
+ * rechecks inside `bindAndPublishStartOwnership`; this is the same fence for
+ * `startClientRuntime`, which binds, publishes and then blocks for the process lifetime.
+ *
+ * The lease is held from acquisition until the runtime reports its records published (or the
+ * start fails), and the ownership decision is re-read under it before anything binds. A refusal
+ * releases the lease and hands the refusal to `stayOut`, which exits.
+ */
+export async function startClientRuntimeUnderOwnershipLease(deps: {
+  acquireLease: () => { release(): void };
+  decide: () => ServiceChildOwnershipDecision;
+  stayOut: (refusal: string) => never;
+  start: (afterPublish: () => void) => Promise<void>;
+}): Promise<void> {
+  const lease = deps.acquireLease();
+  let released = false;
+  const release = () => {
+    if (released) return;
+    released = true;
+    lease.release();
+  };
+  try {
+    const decision = deps.decide();
+    if (decision.kind === "stay-out") {
+      release();
+      deps.stayOut(decision.refusal);
+    }
+    await deps.start(release);
+  } finally {
+    release();
+  }
+}

package/src/cli/dispatch.ts

@@ -1,3 +1,4 @@
+import type { ProxyRestartStartOutcome } from "./tray-proxy";
 /**
  * Registry-driven command dispatch (Phase 3 of the CLI deepening).
  *
@@ -54,8 +55,8 @@ export interface CliDispatchDeps {
   handleResolve: (args: ResolveArgs) => Promise<number>;
   handleTrayProxyStart: (existingIsSuccess?: boolean) => Promise<boolean>;
   handleTrayProxyRestart: () => Promise<void>;
-  handleRestartStartWhenStopped: () => Promise<boolean | "skipped">;
-  handleProxyRestart: (startWhenStopped: () => Promise<boolean | "skipped">) => Promise<boolean>;
+  handleRestartStartWhenStopped: (recoveringLiveRestart?: boolean) => Promise<ProxyRestartStartOutcome>;
+  handleProxyRestart: (startWhenStopped: (recoveringLiveRestart: boolean) => Promise<ProxyRestartStartOutcome>) => Promise<boolean>;
   handleUninstall: () => Promise<void>;
   handleStatus: () => Promise<void>;
   handleRecoverHistory: () => Promise<void>;