@bitkyc08/opencodex 2.69.0 → 2.70.0

package/src/server/responses/request-transport.ts

@@ -13,9 +13,11 @@ import type { ProviderAdapter, AdapterRequest } from "../../adapters/base";
 import { releaseProviderRequestSlot, waitForProviderRequestSlot, type ProviderRequestSlot } from "../../providers/request-pacing";
 import type { AdapterEvent, OcxParsedRequest, OcxProviderConfig, OcxUsage } from "../../types";
 import type { AnthropicAccountSelectionReason } from "../../oauth/anthropic-routing";
+import { resolveAnthropicModelRoute, routeCandidates, type AnthropicRouteDecision } from "../../oauth/anthropic-model-routes";
 import {
   isAnthropicAccountPoolEnabled,
   getAnthropicPoolAccessSnapshot,
+  getEligibleAnthropicAccounts,
   commitAnthropicSelectionRouting,
   formatAnthropicProviderForLog,
   anthropicSessionKeyFromParts,
@@ -118,11 +120,14 @@ export async function prepareResponsesTransport(
     || route.providerName === "kiro"
     || route.providerName === "google-antigravity"
     || route.providerName === "orcarouter-oauth"
+    // runTurn transport: the replay runs on the first-event preflight in run-turn-execution.
+    || route.providerName === "devin"
   ) && route.provider.authMode === "oauth";
   let sentOAuthSnapshot: OAuthAccessSnapshot | undefined;
   let replayOAuthCredentialSnapshot: Pick<OAuthAccessSnapshot, "accountId" | "generation"> | undefined;
   let anthropicPoolAccountId: string | null = null;
   let anthropicPoolFailovers = 0;
+  let anthropicRouteDecision: AnthropicRouteDecision | null = null;
   // Generic OAuth rotation (#2568) for providers with no pool of their own. Bound to the account
   // the request actually used, so a concurrent rotation cannot cool an innocent replacement.
   let genericFailoverAccountId: string | null = null;
@@ -166,6 +171,7 @@ export async function prepareResponsesTransport(
           ? await getAnthropicPoolAccessSnapshot(oauthSelection.accountId)
           : await getValidAccessSnapshotForAccount(route.providerName, oauthSelection.accountId, { requireUsableAccount: true });
       }
+      if (anthropicRouteDecision && !routeCandidates(getEligibleAnthropicAccounts(), anthropicRouteDecision).includes(candidate.accountId)) return null;
       const committed = await commitOAuthAccountSelection(route.providerName, candidate.accountId, {
         expectedSelection: oauthSelection,
         expectedCredentialGeneration: candidate.generation,
@@ -174,7 +180,7 @@ export async function prepareResponsesTransport(
       if (committed) {
         if (route.providerName === "anthropic" && !commitAnthropicSelectionRouting(
           candidate.accountId, oauthSelection, committed,
-          { config, sessionKey: anthropicSessionKey, reason: anthropicReason, expectedCredentialGeneration: candidate.generation },
+          { config, sessionKey: anthropicSessionKey, reason: anthropicReason, expectedCredentialGeneration: candidate.generation, routeDecision: anthropicRouteDecision },
         )) return null;
         oauthSelection = committed;
         servingOAuthSnapshot = candidate;
@@ -185,8 +191,11 @@ export async function prepareResponsesTransport(
       // Resolve that choice, not the rejected candidate, before trying admission again.
       oauthSelection = captureOAuthAccountSelection(route.providerName);
       if (!oauthSelection) return null;
+      const revisedAnthropicId = route.providerName === "anthropic" && anthropicRouteDecision
+        ? resolveAnthropicAccountForSession(anthropicSessionKey, config, Date.now(), anthropicRouteDecision).accountId : null;
+      if (route.providerName === "anthropic" && anthropicRouteDecision && !revisedAnthropicId) return null;
       candidate = route.providerName === "anthropic"
-        ? await getAnthropicPoolAccessSnapshot(oauthSelection.accountId)
+        ? await getAnthropicPoolAccessSnapshot(revisedAnthropicId ?? oauthSelection.accountId)
         : await getValidAccessSnapshotForAccount(route.providerName, oauthSelection.accountId, { requireUsableAccount: true });
       if (route.provider.googleMode === "cloud-code-assist" && !candidate.projectId) return null;
     }
@@ -194,9 +203,10 @@ export async function prepareResponsesTransport(
   };
   const refreshResolvedOAuthSelection = async (sent: OAuthAccessSnapshot): Promise<OAuthAccessSnapshot> => {
     const current = captureOAuthAccountSelection(route.providerName);
-    const unchanged = current?.accountId === oauthSelection?.accountId
-      && current?.revision === oauthSelection?.revision;
-    const candidate = unchanged ? await forceRefreshOAuthAccessSnapshot(sent) : sent;
+    // Keyed on the account, not the selection revision: a selection that moved away and back
+    // (A -> B -> A) before the 401 landed still serves the rejected credential, and skipping
+    // the refresh would replay it and spend the one recovery attempt.
+    const candidate = current?.accountId === sent.accountId ? await forceRefreshOAuthAccessSnapshot(sent) : sent;
     const admitted = await commitResolvedOAuthSelection(candidate);
     if (!admitted) throw new Error("OAuth selection changed during credential recovery");
     if (kiroLoadEnabled && options.accountLoad?.lease?.accountId !== admitted.accountId) {
@@ -508,7 +518,7 @@ export async function prepareResponsesTransport(
         bindRouteReasoningReplayScope({ parsed: requestParsed, providerName: route.providerName, provider: route.provider,
           adapterName: nextAdapter.name, oauthCredentialSnapshot: replayOAuthCredentialSnapshot });
         const rebuilt = await nextAdapter.buildRequest(requestParsed, {
-          headers: requestState.selectedForwardHeaders, translatorBudget,
+          headers: requestState.selectedForwardHeaders, providerName: route.providerName, translatorBudget,
           ...(imageTierBias > 0 ? { imageTierBias } : {}),
         });
         const bodySize = checkOutboundBodySize(rebuilt.body, config.maxUpstreamBodyBytes);
@@ -546,22 +556,28 @@ export async function prepareResponsesTransport(
   if (route.provider.authMode === "oauth") {
     try {
       if (route.providerName === "anthropic" && isAnthropicAccountPoolEnabled(config)) {
-        const selection = resolveAnthropicAccountForSession(anthropicSessionKey, config);
+        const routeResult = resolveAnthropicModelRoute(config, route.modelId);
+        if (routeResult.error) return formatErrorResponse(400, "invalid_request_error", `Invalid Anthropic model routes: ${routeResult.error}`);
+        anthropicRouteDecision = routeResult.decision;
+        const selection = resolveAnthropicAccountForSession(anthropicSessionKey, config, Date.now(), anthropicRouteDecision);
         if (!selection.accountId) {
+          // Route names may resemble account IDs; log only the matched rule position.
+          if (anthropicRouteDecision) console.warn(`[anthropic-pool] route:#${anthropicRouteDecision.position} ${selection.reason}; answering locally`);
           if (selection.reason === "all-cooled") {
-            const retryAfterSec = getAnthropicPoolRetryAfterSeconds();
+            const retryAfterSec = getAnthropicPoolRetryAfterSeconds(Date.now(), anthropicRouteDecision);
             return formatErrorResponse(
               429,
               "rate_limit_error",
-              "All Anthropic OAuth accounts are temporarily rate-limited",
+              anthropicRouteDecision ? "Anthropic OAuth accounts for this model route are temporarily rate-limited" : "All Anthropic OAuth accounts are temporarily rate-limited",
               retryAfterSec !== null ? { retryAfter: String(retryAfterSec) } : undefined,
             );
           }
-          return formatErrorResponse(401, "authentication_error", "No eligible Anthropic OAuth account available");
+          return formatErrorResponse(401, "authentication_error", anthropicRouteDecision ? "No eligible Anthropic OAuth account for this model route" : "No eligible Anthropic OAuth account available");
         }
         const admitted = await commitResolvedOAuthSelection(await getAnthropicPoolAccessSnapshot(selection.accountId), true, selection.reason);
         if (!admitted) return formatErrorResponse(409, "conflict_error", "OAuth account selection changed; retry the request");
         anthropicPoolAccountId = admitted.accountId;
+        if (anthropicRouteDecision) console.info(`[anthropic-pool] route:#${anthropicRouteDecision.position} ${selection.reason}`);
         route.provider = { ...route.provider, apiKey: admitted.accessToken };
         logCtx.provider = formatAnthropicProviderForLog("anthropic", admitted.accountId, config);
       } else {
@@ -837,6 +853,7 @@ export async function prepareResponsesTransport(
     set replayOAuthCredentialSnapshot(value: Pick<OAuthAccessSnapshot, "accountId" | "generation"> | undefined) {
       replayOAuthCredentialSnapshot = value;
     },
+    anthropicRouteDecision,
     get anthropicPoolAccountId(): string | null {
       return anthropicPoolAccountId;
     },

package/src/server/responses/response-effects.ts

@@ -100,7 +100,10 @@ export function createResponsesEffects(
     if (parsed._rawBody && typeof parsed._rawBody === "object") {
       delete (parsed._rawBody as Record<string, unknown>).text;
     }
-    parsed.context.messages.push({ role: "user", content: COMPACT_PROMPT, timestamp: Date.now() });
+    parsed.context.messages = [
+      ...parsed.context.messages,
+      { role: "user", content: COMPACT_PROMPT, timestamp: Date.now() },
+    ];
   }
 
   let routedNamespaceToolAliases: RoutedNamespaceToolAliases = new Map();

package/src/server/responses/run-turn-execution.ts

@@ -27,6 +27,8 @@ import {
   rotateGenericOAuthAccountOn429,
   failoverAccountSnapshot,
 } from "../../oauth/generic-account-failover";
+import { OAuthAccountPausedError, publicOAuthAuthenticationErrorMessage, type OAuthAccessSnapshot } from "../../oauth/index";
+import { tryAlternateAfterTerminalRefresh } from "../../oauth/kiro-terminal-failover";
 import { resolveWireProtocolOverride } from "../adapter-resolve";
 import { formatErrorResponse, bridgeToResponsesSSE, buildResponseJSON } from "../../bridge";
 import { redactSecretString } from "../../lib/redact";
@@ -93,6 +95,9 @@ export async function executeResponsesRunTurn(
     | "genericFailovers"
     | "genericFailoverLimit"
     | "applyFailoverSnapshot"
+    | "refreshResolvedOAuthSelection"
+    | "isOAuth401ReplayProvider"
+    | "sentOAuthSnapshot"
     | "resolveSelectionAdapter"
     | "adapter"
     | "noteRoutedAttemptSend"
@@ -122,6 +127,7 @@ export async function executeResponsesRunTurn(
     adapterBindings,
     refreshRunTurnAdapter,
     applyFailoverSnapshot,
+    refreshResolvedOAuthSelection,
     resolveSelectionAdapter,
   } = transportState;
   const {
@@ -348,6 +354,99 @@ export async function executeResponsesRunTurn(
         yield* await preflightRunTurnFailover(stream, iterParsed);
       })();
     };
+    // Rebind the turn to an admitted account. The failed attempt emitted no client-visible bytes,
+    // so replay is safe, but a Cursor conversation/checkpoint is credential-scoped: carrying its
+    // account identity into the next account would not be. The rotated adapter derives its own.
+    const adoptRunTurnAccount = (admittedSnapshot: Pick<OAuthAccessSnapshot, "accountId" | "generation">): boolean => {
+      parsed._cursorIdentityScope = undefined;
+      parsed._cursorConversationId = undefined;
+      if (parsed._providerContinuation?.cursor) {
+        const { cursor: _discardedCursor, ...otherProviderState } = parsed._providerContinuation;
+        parsed._providerContinuation = otherProviderState;
+      }
+      const rotatedProvider = resolveWireProtocolOverride(
+        route.providerName,
+        route.modelId,
+        route.provider,
+        inboundWire,
+        route.staticPolicy,
+      );
+      const rotatedAdapter = resolveSelectionAdapter(rotatedProvider, config.cacheRetention);
+      if (!rotatedAdapter.runTurn) return false;
+      transportState.runTurnAdapter = rotatedAdapter;
+      bindRouteReasoningReplayScope({
+        parsed,
+        providerName: route.providerName,
+        provider: rotatedProvider,
+        adapterName: rotatedAdapter.name,
+        oauthCredentialSnapshot: {
+          accountId: admittedSnapshot.accountId,
+          generation: admittedSnapshot.generation,
+        },
+        codexAuthContext: admissionState.authCtx,
+        forwardHeaders: requestState.selectedForwardHeaders,
+      });
+      sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, rotatedAdapter.name, logCtx.accountLogLabel);
+      recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, rotatedAdapter.name);
+      return true;
+    };
+    // The runTurn half of the upstream-401 replay adapter-dispatch runs for HTTP transports:
+    // force-refresh the credential that was sent, once per request. A refresh that cannot
+    // succeed marks the account needsReauth inside the OAuth owner, so the account stops being
+    // selected; the turn then moves to a surviving stored account, or, with none, the client
+    // gets the login instruction instead of an opaque upstream 401.
+    let oauth401ReplayAttempted = false;
+    let pausedAuthRecovery = false;
+    const recoverRunTurnAdapterOnPreflight401 = async (
+      error: Extract<AdapterEvent, { type: "error" }>,
+    ): Promise<boolean> => {
+      const sent = transportState.sentOAuthSnapshot;
+      if (error.status !== 401 || !transportState.isOAuth401ReplayProvider || !sent || oauth401ReplayAttempted) return false;
+      oauth401ReplayAttempted = true;
+      const hop = reserveCredentialHop("auth-recovery", `${route.providerName}|${route.modelId}|runturn-oauth-401`);
+      if (!hop.allowed) return false;
+      try {
+        let admitted: OAuthAccessSnapshot | null;
+        try {
+          admitted = await applyFailoverSnapshot(await refreshResolvedOAuthSelection(sent));
+        } catch (err) {
+          if (err instanceof OAuthAccountPausedError) {
+            pausedAuthRecovery = true;
+            Object.assign(error, { status: 403, errorType: "permission_error", message: publicOAuthAuthenticationErrorMessage(err) });
+            hop.permit?.release();
+            return false;
+          }
+          // Not only OAuthLoginRequiredError: a concurrent request that already flagged this
+          // account and moved the selection makes this refresh fail as "selection changed". The
+          // helper still requires the sent generation to be flagged needsReauth, so it is safe.
+          const alternate = transportState.genericFailovers < transportState.genericFailoverLimit
+            ? await tryAlternateAfterTerminalRefresh(config, route.providerName, sent.accountId, sent.generation)
+            : null;
+          admitted = alternate ? await applyFailoverSnapshot(alternate) : null;
+          if (admitted) transportState.genericFailovers += 1;
+          else Object.assign(error, { errorType: "authentication_error", message: publicOAuthAuthenticationErrorMessage(err) });
+        }
+        if (!admitted || !adoptRunTurnAccount(admitted)) {
+          hop.permit?.release();
+          return false;
+        }
+        sendBudgetState.pendingHopPermit = hop.permit;
+        return true;
+      } catch (err) {
+        // Applying the alternate can still fail, e.g. when a newer manual selection points back
+        // at the flagged account; the client then needs the login instruction, not the raw 401.
+        Object.assign(error, { errorType: "authentication_error", message: publicOAuthAuthenticationErrorMessage(err) });
+        hop.permit?.release();
+        return false;
+      }
+    };
+    const recoverRunTurnAdapterOnPreflightError = async (
+      error: Extract<AdapterEvent, { type: "error" }>,
+    ): Promise<AttemptRecoveryKind | undefined> => {
+      if (await recoverRunTurnAdapterOnPreflight401(error)) return "oauth-401";
+      if (await rotateRunTurnAdapterOnPreflight429(error)) return "oauth-account-429";
+      return undefined;
+    };
     const rotateRunTurnAdapterOnPreflight429 = async (
       error: Extract<AdapterEvent, { type: "error" }>,
     ): Promise<boolean> => {
@@ -400,42 +499,10 @@ export async function executeResponsesRunTurn(
           hop.permit?.release();
           return false;
         }
-        // A Cursor conversation/checkpoint is credential-scoped. The failed attempt emitted no
-        // client-visible bytes, so replay is safe, but carrying its account identity into the next
-        // account would not be. Let the rotated adapter derive a fresh identity and conversation.
-        parsed._cursorIdentityScope = undefined;
-        parsed._cursorConversationId = undefined;
-        if (parsed._providerContinuation?.cursor) {
-          const { cursor: _discardedCursor, ...otherProviderState } = parsed._providerContinuation;
-          parsed._providerContinuation = otherProviderState;
-        }
-        const rotatedProvider = resolveWireProtocolOverride(
-          route.providerName,
-          route.modelId,
-          route.provider,
-          inboundWire,
-          route.staticPolicy,
-        );
-        const rotatedAdapter = resolveSelectionAdapter(rotatedProvider, config.cacheRetention);
-        if (!rotatedAdapter.runTurn) {
+        if (!adoptRunTurnAccount(admittedSnapshot)) {
           hop.permit?.release();
           return false;
         }
-        transportState.runTurnAdapter = rotatedAdapter;
-        bindRouteReasoningReplayScope({
-          parsed,
-          providerName: route.providerName,
-          provider: rotatedProvider,
-          adapterName: rotatedAdapter.name,
-          oauthCredentialSnapshot: {
-            accountId: admittedSnapshot.accountId,
-            generation: admittedSnapshot.generation,
-          },
-          codexAuthContext: admissionState.authCtx,
-          forwardHeaders: requestState.selectedForwardHeaders,
-        });
-        sealRequestAttemptIdentity(logCtx.activeAttempt, logCtx.provider, rotatedAdapter.name, logCtx.accountLogLabel);
-        recordAttemptCredentialSource(logCtx.activeAttempt, route.providerName, route.provider, rotatedAdapter.name);
         // The caller replays the turn on this rotation, and a runTurn adapter dispatches through
         // its own reservation ladder -- Cursor reserves once per physical send. Confirming here
         // would leave that ladder to charge the same replay a second time (#4709), so hand the
@@ -463,13 +530,14 @@ export async function executeResponsesRunTurn(
             yield event;
             continue;
           }
-          if (!firstMeaningfulSeen && !replayUnsafe && event.type === "error"
-            && await rotateRunTurnAdapterOnPreflight429(event)) {
+          const recovery = !firstMeaningfulSeen && !replayUnsafe && event.type === "error"
+            ? await recoverRunTurnAdapterOnPreflightError(event) : undefined;
+          if (recovery) {
             const retryQueue = createAdapterEventQueue({
               onBacklogExceeded: () => runTurnAbort.abort(),
             });
             const pendingPermit = sendBudgetState.pendingHopPermit;
-            const retryAttempt = runTurnAttempt(retryQueue, "oauth-account-429", false, replayParsed);
+            const retryAttempt = runTurnAttempt(retryQueue, recovery, false, replayParsed);
             if (pendingPermit) {
               const releaseIfUnclaimed = () => {
                 if (sendBudgetState.pendingHopPermit !== pendingPermit) return;
@@ -522,15 +590,13 @@ export async function executeResponsesRunTurn(
             return streamAfterPreflight(preflight.stream, replayParsed, preflight.replayUnsafe);
           }
           if (preflight.ready) return streamAfterPreflight(preflight.stream, replayParsed, preflight.replayUnsafe);
-          if (preflight.replayUnsafe
-            || !preflight.error
-            || !(await rotateRunTurnAdapterOnPreflight429(preflight.error))) {
-            return preflight.stream;
-          }
+          const recovery = preflight.replayUnsafe || !preflight.error
+            ? undefined : await recoverRunTurnAdapterOnPreflightError(preflight.error);
+          if (!recovery) return preflight.stream;
           const retryQueue = createAdapterEventQueue({
             onBacklogExceeded: () => runTurnAbort.abort(),
           });
-          latestRetryAttempt = runTurnAttempt(retryQueue, "oauth-account-429", false, replayParsed);
+          latestRetryAttempt = runTurnAttempt(retryQueue, recovery, false, replayParsed);
           void latestRetryAttempt;
           source = retryQueue.stream();
         }
@@ -599,6 +665,14 @@ export async function executeResponsesRunTurn(
         // Preflight holds only heartbeats and the first meaningful event. A first-event 429 can be
         // replayed transparently; after any output reaches the bridge, a later error stays terminal.
         eventSource = await preflightRunTurnFailover(eventSource, wsFirstParsed, preflightDeadlineAt);
+        if (pausedAuthRecovery) {
+          cancelResponseCompletion();
+          runTurnAbort.abort();
+          queue.close();
+          cleanupRunTurnAbort();
+          releaseSearchProbeLease();
+          return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(new OAuthAccountPausedError()));
+        }
       }
       if (grokDevinPreflight) {
         const preflight = await preflightAdapterEvents(eventSource, undefined, {
@@ -672,6 +746,7 @@ export async function executeResponsesRunTurn(
           ...(options.forceEmptyResponseId ? { responseId: "" } : {}),
           stallTimeoutSec,
           hideThinkingSummary: parsed.options.hideThinkingSummary,
+          hideRawReasoning: parsed.options.hideRawReasoning,
           declaredToolNames,
           bareCustomToolNames,
           enforceDeclaredToolNames,
@@ -729,6 +804,14 @@ export async function executeResponsesRunTurn(
       for await (const event of await preflightRunTurnFailover(
         (async function* () { yield* firstAttemptEvents; })(),
       )) runTurnEvents.push(event);
+      if (pausedAuthRecovery) {
+        cancelResponseCompletion();
+        runTurnAbort.abort();
+        queue.close();
+        cleanupRunTurnAbort();
+        releaseSearchProbeLease();
+        return formatErrorResponse(403, "permission_error", publicOAuthAuthenticationErrorMessage(new OAuthAccountPausedError()));
+      }
     }
     if (grokDevinPreflight) {
       const preflight = await preflightAdapterEvents(
@@ -811,6 +894,7 @@ export async function executeResponsesRunTurn(
         translatorBudget,
         replayCacheScope: parsed._reasoningReplayScope,
         hideThinkingSummary: parsed.options.hideThinkingSummary,
+        hideRawReasoning: parsed.options.hideRawReasoning,
         toolNsMap,
         declaredToolNames,
         enforceDeclaredToolNames,

package/src/server/responses/sidecar-execution.ts

@@ -67,6 +67,7 @@ export async function executeResponsesSidecars(
     | "genericFailoverLimit"
     | "replayOAuthCredentialSnapshot"
     | "applyFailoverSnapshot"
+    | "anthropicRouteDecision"
     | "anthropicPoolAccountId"
     | "anthropicPoolFailovers"
     | "anthropicSessionKey"
@@ -275,6 +276,7 @@ export async function executeResponsesSidecars(
         anthropicSessionKey,
         Date.now(),
         responseHeaders,
+        transportState.anthropicRouteDecision,
       );
       if (!nextAccountId) {
         hop.permit?.release();
@@ -385,7 +387,7 @@ export async function executeResponsesSidecars(
     );
     const imgResponse = await runWithImageBridge({
       parsed, adapter: transportState.adapter,
-      incomingMeta: { headers: requestState.selectedForwardHeaders, abortSignal: options.abortSignal, translatorBudget },
+      incomingMeta: { headers: requestState.selectedForwardHeaders, providerName: route.providerName, abortSignal: options.abortSignal, translatorBudget },
       ...(imgPlan ? { plan: imgPlan } : {}),
       ...(vidPlan ? { videoPlan: vidPlan } : {}),
       forwardHeaders: requestState.selectedForwardHeaders,
@@ -477,6 +479,7 @@ export async function executeResponsesSidecars(
       }),
       incomingMeta: {
         headers: requestState.selectedForwardHeaders,
+        providerName: route.providerName,
         abortSignal: options.abortSignal,
         translatorBudget,
         providerFetch: routedProviderFetch,

package/src/service/diagnostics.ts

@@ -5,7 +5,7 @@ import { sh } from "./guards";
 import { installedServiceListenPort, confirmServiceServing } from "./health";
 import { expectedLaunchdCommand, launchdJobMatchesPlist, probeLaunchdLoadState } from "./launchd";
 import type { LaunchdLoadProbe } from "./launchd";
-import { plistPath, windowsServiceScriptPath, windowsLauncherVbsPath, windowsTaskXmlPath, readServiceInstallState } from "./state";
+import { plistPath, windowsServiceScriptPath, windowsLauncherVbsPath, windowsTaskXmlPath, readServiceInstallState, serviceLauncherPathDiagnostic } from "./state";
 import type { ServiceBackend } from "./state";
 import { unitPath, isSystemd } from "./systemd";
 import { statusWindowsXml } from "./windows-ops";
@@ -23,6 +23,8 @@ import { LABEL, TASK, serviceLogPath } from "./state";
  */
 export function bakedServicePathsDiagnostic(platform: NodeJS.Platform = process.platform): string | null {
   const state = readServiceInstallState();
+  const temporaryLauncher = serviceLauncherPathDiagnostic(state, platform);
+  if (temporaryLauncher) return temporaryLauncher;
   // A launcher install runs the launcher, not the baked pair, so the pair's existence says
   // nothing about whether the service can start. Judging the recorded launcher is both
   // necessary (a deleted launcher IS stale) and sufficient (a replaced version directory

package/src/service/guarded-manager-target.ts

@@ -6,12 +6,30 @@ import { statusWinswRaw } from "../lib/winsw";
 import { systemdProperty } from "../service-manager-probe";
 import { expectedLaunchdCommand, launchdEvictionTargets, probeLaunchdLoadState, runLaunchctl } from "./launchd";
 import { probeSystemdUnitInactive, unitPath } from "./systemd";
+import {
+  inspectWindowsGuardedManager,
+  observeWindowsGuardedManagerStopped,
+  type WindowsGuardedManagerDeps,
+} from "./windows-guarded-manager";
 import { probeWindowsSchedulerTask } from "./windows-scheduler";
 import { TASK } from "./state";
 
 export type GuardedManagerTarget =
   | { kind: "absent" }
-  | { kind: "bound"; pid: number; managerPid: number; backend: "launchd" | "systemd" }
+  | {
+      kind: "bound";
+      pid: number;
+      managerPid: number;
+      backend: "launchd" | "systemd" | "scheduler" | "winsw";
+      /**
+       * Whether stopping this manager can leave the approved process alive.
+       * launchd/systemd end their job's whole process tree; Windows Task
+       * Scheduler's /end does not reliably cascade to the wrapper's child (#764),
+       * so a bound scheduler or WinSW manager still needs the approved PID
+       * signalled separately after the manager is stopped.
+       */
+      childNeedsSeparateStop: boolean;
+    }
   | { kind: "unknown"; reason: string };
 
 export type GuardedManagerStopped = "inactive" | "active" | "unknown";
@@ -59,6 +77,7 @@ export interface GuardedManagerDeps {
   verifyPid?: (pid: number) => number | null;
   scheduler?: typeof probeWindowsSchedulerTask;
   winsw?: typeof statusWinswRaw;
+  win?: WindowsGuardedManagerDeps;
 }
 
 /** Only one current manager with a verified parent chain may be stopped by name. */
@@ -92,7 +111,7 @@ export function inspectGuardedManagerTarget(
     } catch { return { kind: "unknown", reason: "launchd state could not be verified" }; }
     if (managerPid === null) return { kind: "absent" };
     return managerOwnsApprovedPid(managerPid, approvedPid, parentOf)
-      ? { kind: "bound", pid: approvedPid, managerPid, backend: "launchd" }
+      ? { kind: "bound", pid: approvedPid, managerPid, backend: "launchd", childNeedsSeparateStop: false }
       : { kind: "unknown", reason: "launchd job does not own the approved process" };
   }
   if (platform === "linux") {
@@ -111,16 +130,19 @@ export function inspectGuardedManagerTarget(
         return { kind: "unknown", reason: "systemd unit state is not current and active" };
       }
       return managerOwnsApprovedPid(pid, approvedPid, parentOf)
-        ? { kind: "bound", pid: approvedPid, managerPid: pid, backend: "systemd" }
+        ? { kind: "bound", pid: approvedPid, managerPid: pid, backend: "systemd", childNeedsSeparateStop: false }
         : { kind: "unknown", reason: "systemd unit does not own the approved process" };
     } catch { return { kind: "unknown", reason: "systemd state could not be verified" }; }
   }
   if (platform === "win32") {
     const scheduler = (deps.scheduler ?? probeWindowsSchedulerTask)();
     const native = (deps.winsw ?? statusWinswRaw)();
-    return scheduler.status === "absent" && native === "nonexistent"
-      ? { kind: "absent" }
-      : { kind: "unknown", reason: "Windows manager child PID cannot be proven" };
+    // A simulated win32 (deps.platform injected) must not run real schtasks or
+    // process-list queries at the host; the module degrades every unset probe to
+    // its least-proving answer then, which is exactly the old fail-closed shape.
+    return inspectWindowsGuardedManager(
+      approvedPid, scheduler, native, deps.win ?? {}, deps.platform === undefined,
+    );
   }
   return { kind: "unknown", reason: "unsupported service manager platform" };
 }
@@ -128,7 +150,7 @@ export function inspectGuardedManagerTarget(
 /** A guarded success needs manager absence after settlement and once more at publication. */
 export async function observeGuardedManagerStopped(
   manager: Exclude<GuardedManagerTarget, { kind: "unknown" }>,
-  deps: Pick<GuardedManagerDeps, "platform" | "scheduler" | "winsw"> & {
+  deps: Pick<GuardedManagerDeps, "platform" | "scheduler" | "winsw" | "win"> & {
     launchd?: typeof probeLaunchdLoadState;
     systemd?: typeof probeSystemdUnitInactive;
   } = {},
@@ -140,11 +162,16 @@ export async function observeGuardedManagerStopped(
       return state === "not-loaded" ? "inactive" : state === "unknown" ? "unknown" : "active";
     }
     if (platform === "linux") return (deps.systemd ?? probeSystemdUnitInactive)();
-    if (platform === "win32" && manager.kind === "absent") {
-      const scheduler = (deps.scheduler ?? probeWindowsSchedulerTask)();
-      const native = (deps.winsw ?? statusWinswRaw)();
-      if (scheduler.status === "absent" && native === "nonexistent") return "inactive";
-      return scheduler.status === "unknown" || native === "unknown" ? "unknown" : "active";
+    if (platform === "win32") {
+      // Registration presence is not the question: schtasks /end leaves the task
+      // registered forever, so the Windows check is RUNNING state + surviving
+      // wrapper processes + WinSW status, never mere presence.
+      return observeWindowsGuardedManagerStopped({
+        scheduler: deps.scheduler,
+        winsw: deps.winsw,
+        ...(deps.win ?? {}),
+        ...(manager.kind === "bound" ? { formerManagerPid: manager.managerPid } : {}),
+      }, deps.platform === undefined);
     }
   } catch { return "unknown"; }
   return "unknown";

package/src/service/launchd.ts

@@ -12,7 +12,7 @@ import { serviceApiTokenFilePath } from "../lib/service-secrets";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
 import { writeServiceApiTokenFile, assertLiveServiceManagerAllowed } from "./guards";
 import { resolveServiceListenPort, buildServiceShellCommand, buildServiceLauncherShellCommand, installedServiceListenPort, resolvedProxyEnv } from "./health";
-import { SERVICE_MANAGED_ENV, LABEL, cliEntry, logPath, serviceStatePath, currentCodexSqliteHomeAbsolute, type ServiceInstallState, writeServiceInstallState, readServiceInstallState } from "./state";
+import { SERVICE_MANAGED_ENV, LABEL, cliEntry, filterTransientServicePath, logPath, serviceStatePath, currentCodexSqliteHomeAbsolute, type ServiceInstallState, writeServiceInstallState, readServiceInstallState } from "./state";
 import { writeServiceDefinitionFile } from "./windows-ops";
 import { readTextOrNull } from "./windows-taskxml";
 
@@ -39,7 +39,7 @@ export function buildPlist(
   const runtime = deps.runtime ?? durableBunRuntime();
   const { bun, bunRuntimeSource, cli } = cliEntry(runtime);
   const log = logPath();
-  const path = process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin";
+  const path = filterTransientServicePath(process.env.PATH ?? "/usr/local/bin:/usr/bin:/bin", ":", "darwin");
   const codexHome = process.env.CODEX_HOME?.trim();
   const codexSqliteHome = currentCodexSqliteHomeAbsolute();
   const opencodexHome = process.env.OPENCODEX_HOME?.trim();
@@ -72,7 +72,7 @@ export function buildPlist(
     <string>${plistString(command)}</string>
   </array>
   <key>RunAtLoad</key><true/>
-  <key>KeepAlive</key><true/>
+  <key>KeepAlive</key><dict><key>SuccessfulExit</key><false/></dict>
   <key>EnvironmentVariables</key>
   <dict>
 ${envLines}
@@ -90,6 +90,11 @@ ${envLines}
  */
 const PLIST_PATH_ENTRY = /^(\s*<key>PATH<\/key><string>)([^\n]*)(<\/string>)$/m;
 
+function filterPlistPathVariable(plist: string): string {
+  return plist.replace(PLIST_PATH_ENTRY, (_match, open: string, value: string, close: string) =>
+    `${open}${filterTransientServicePath(value, ":", "darwin")}${close}`);
+}
+
 /**
  * The rendered plist with the PREVIOUS definition's `PATH` put back — or null when `PATH`
  * is not the only difference.
@@ -114,14 +119,17 @@ const PLIST_PATH_ENTRY = /^(\s*<key>PATH<\/key><string>)([^\n]*)(<\/string>)$/m;
  * re-install still updates it.
  */
 export function reusePreviousPlistPathVariable(previous: string, rendered: string): string | null {
+  if (previous === rendered) return null;
   const prev = PLIST_PATH_ENTRY.exec(previous);
   const next = PLIST_PATH_ENTRY.exec(rendered);
-  if (!prev || !next || prev[2] === next[2]) return null;
+  if (!prev || !next) return null;
+  const normalizedPrevious = filterPlistPathVariable(previous);
+  const previousPath = filterTransientServicePath(prev[2] ?? "", ":", "darwin");
   // A function replacer, not a `$1` template: a PATH entry containing `$&` or `$1` would
   // otherwise be re-expanded into the file.
   const adopted = rendered.replace(PLIST_PATH_ENTRY, (_match, open: string, _value: string, close: string) =>
-    `${open}${prev[2] ?? ""}${close}`);
-  return adopted === previous ? adopted : null;
+    `${open}${previousPath}${close}`);
+  return adopted === normalizedPrevious ? normalizedPrevious : null;
 }
 
 /**

package/src/service/repair.ts

@@ -5,7 +5,7 @@ import type { ServiceDiagnostic } from "./diagnostics";
 import { assertServiceEnvironmentMatchesInstall, assertServiceAuthEnvironment } from "./guards";
 import { installLaunchd, restartLaunchdJob } from "./launchd";
 import type { LaunchdInstallOutcome } from "./launchd";
-import { TASK, writeServiceInstallState, serviceSourceDir, resolveServiceOwnership } from "./state";
+import { TASK, writeServiceInstallState, serviceSourceDir, resolveServiceOwnership, serviceLauncherPathDiagnostic } from "./state";
 import type { ServiceOwnership, ServiceOwnershipResolution } from "./state";
 import { installSystemd } from "./systemd";
 import { writeWindowsSchedulerAssets, reregisterWindowsSchedulerTask, windowsSchedulerRegistrationMatchesSnapshot, restoreWindowsSchedulerTaskIfAbsent, startWindows, stopWindows, statusWindowsXml } from "./windows-ops";
@@ -62,6 +62,8 @@ export interface RepairServiceDeps {
   schedulerLauncher?: string;
   /** Test seam — defaults to process.platform so Linux CI cannot hit real installSystemd. */
   platform?: NodeJS.Platform;
+  /** Test seam for a recorded temporary launcher. */
+  launcherPathDiagnostic?: () => string | null;
 }
 
 /**
@@ -175,6 +177,9 @@ export async function repairService(deps: RepairServiceDeps = {}): Promise<void>
   (deps.assertEnv ?? assertServiceEnvironmentMatchesInstall)();
   (deps.assertAuth ?? assertServiceAuthEnvironment)();
 
+  const temporaryLauncher = (deps.launcherPathDiagnostic ?? (() => serviceLauncherPathDiagnostic(undefined, platform, true)))();
+  if (temporaryLauncher) console.warn(`⚠️ ${temporaryLauncher}`);
+
   if (platform === "win32") {
     if (diag.backend === "native") {
       await (deps.repairNative ?? (() => installWinswService(defaultWinswEntry(serviceSourceDir))))();