@bitkyc08/opencodex 2.7.35 → 2.7.36

package/src/cli/index.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env bun
 import { spawn } from "node:child_process";
 import { rmSync } from "node:fs";
-import { restoreNativeCodex, shouldInjectApiAuthHeader } from "../codex/inject";
+import { currentExternalCodexModelProvider, restoreNativeCodex, shouldInjectApiAuthHeader } from "../codex/inject";
 import { restoreLegacyOpenaiHistory } from "../codex/history-provider";
 import { writeJournal, reconcileJournal } from "../codex/journal";
 import {
@@ -20,13 +20,16 @@ import {
   writeRuntimePort,
 } from "../config";
 import { collectStatus } from "./status";
+import { dispatchInternalCliCommand, type InternalCliCommand } from "./internal-dispatch";
+import { runTrayProxyRestart, runTrayProxyStart } from "./tray-proxy";
 import { installCrashGuards } from "../lib/crash-guard";
 import { hasHelpFlag, printSubcommandUsage, printUsage, printVersion } from "./help";
 import { findAvailablePort, isAddrInUse, PortUnavailableError, shouldPersistSelectedPort, waitForPortAvailable } from "../server/ports";
 import { findLiveProxy, probeHostname, type LiveProxy } from "../server/proxy-liveness";
 import { stopProxy } from "../lib/process-control";
 import { loadServiceTokenFromFile } from "../lib/service-secrets";
-import { serviceCommand, serviceStatusSummary, stopServiceIfInstalled, uninstallServiceIfInstalled } from "../service";
+import { diagnoseService, serviceCommand, serviceStartableFromTray, serviceStatusSummary, stopServiceIfInstalled, uninstallServiceIfInstalled } from "../service";
+import { startupHealthSummary } from "../codex/autostart-health";
 import { drainAndShutdown, startServer } from "../server";
 import { injectSystemEnv, revertSystemEnv } from "../server/system-env";
 import { buildDesktop3pRegistry } from "../claude/desktop-3p";
@@ -131,7 +134,7 @@ async function handleStart(options: { block?: boolean } = {}) {
   const serviceToken = loadServiceTokenFromFile(process.env);
   if (serviceToken) process.env.OPENCODEX_API_AUTH_TOKEN = serviceToken;
   const requestedPort = parsePortOption();
-  reconcileJournal();
+  if (!currentExternalCodexModelProvider()) reconcileJournal();
   const existingPid = readPid();
   if (existingPid) {
     const live = await findLiveProxy();
@@ -179,7 +182,7 @@ async function handleStart(options: { block?: boolean } = {}) {
 
   const config = loadConfig();
   writeRuntimePort({ pid: process.pid, port, hostname: config.hostname });
-  writeJournal();
+  if (!currentExternalCodexModelProvider()) writeJournal();
 
   // Background proactive token refresh. No-op unless config.tokenGuardian.enabled; timer is unref'd
   // so it never keeps the process alive on its own. Stopped in syncCleanup so no refresh fires mid-drain.
@@ -187,9 +190,7 @@ async function handleStart(options: { block?: boolean } = {}) {
   // Design B upgrade path: keep retrying the one-time opencodex→openai history migration in the
   // background — the first `ocx start` after an update usually races the Codex app's DB lock.
   // Loopback-only (legacy mode still forward-tags) and respects syncResumeHistory opt-out.
-  const historyGuardian = !shouldInjectApiAuthHeader(config) && config.syncResumeHistory !== false
-    ? startHistoryMigrationGuardian()
-    : undefined;
+  let historyGuardian: ReturnType<typeof startHistoryMigrationGuardian> | undefined;
 
   let cleaned = false;
   const syncCleanup = () => {
@@ -200,7 +201,9 @@ async function handleStart(options: { block?: boolean } = {}) {
     try { revertSystemEnv(); } catch { /* best-effort */ }
     removePid(process.pid);
     removeRuntimePort(process.pid);
-    if (!process.env.OCX_SERVICE) { try { restoreNativeCodex(); } catch { /* best-effort restore */ } }
+    if (!process.env.OCX_SERVICE && !currentExternalCodexModelProvider()) {
+      try { restoreNativeCodex(); } catch { /* best-effort restore */ }
+    }
   };
 
   let shuttingDown = false;
@@ -246,6 +249,9 @@ async function handleStart(options: { block?: boolean } = {}) {
 
   await maybeShowStarPrompt(); // once-only [Y/n] GitHub-star prompt on first interactive start
   await syncModelsToCodex(port).catch(() => {});
+  if (!currentExternalCodexModelProvider() && !shouldInjectApiAuthHeader(config) && config.syncResumeHistory !== false) {
+    historyGuardian = startHistoryMigrationGuardian();
+  }
   // Build Desktop 3P alias registry so inbound claude-opus-4-8-{code} aliases (and legacy claude-opus-4-{code}) decode correctly.
   try {
     const { fetchAllModels } = await import("../server/management-api");
@@ -263,7 +269,7 @@ async function handleStart(options: { block?: boolean } = {}) {
 }
 
 async function handleEnsure() {
-  reconcileJournal();
+  if (!currentExternalCodexModelProvider()) reconcileJournal();
   const config = loadConfig();
   if (!codexAutoStartEnabled(config)) {
     console.log("Codex autostart is disabled.");
@@ -302,6 +308,47 @@ async function handleEnsure() {
   console.log(`✅ Proxy running on port ${port}`);
 }
 
+/** Fixed tray action: start the proxy without depending on codexAutoStart. */
+async function handleTrayProxyStart(): Promise<void> {
+  const ok = await runTrayProxyStart({
+    findLive: findLiveProxy,
+    diagnoseService: () => {
+      const service = diagnoseService();
+      return { installed: service.installed, startable: serviceStartableFromTray(service), summary: service.summary };
+    },
+    startService: () => serviceCommand("start"),
+    startDirect: () => {
+      const config = loadConfig();
+      const port = (config.port ?? 10100) > 0 ? (config.port ?? 10100) : 10100;
+      const child = spawn(process.execPath, startArgv(port), {
+        detached: true,
+        stdio: "ignore",
+        windowsHide: true,
+        env: { ...process.env, OCX_SERVICE: "1" },
+      });
+      child.unref();
+    },
+    waitForProxy,
+    info: message => console.log(message),
+    error: message => console.error(message),
+  });
+  if (!ok) process.exitCode = 1;
+}
+
+async function handleTrayProxyRestart(): Promise<void> {
+  const ok = await runTrayProxyRestart({
+    stop: async () => {
+      await handleStop();
+      return !process.exitCode || process.exitCode === 0;
+    },
+    start: async () => {
+      await handleTrayProxyStart();
+      return !process.exitCode || process.exitCode === 0;
+    },
+  });
+  if (!ok) process.exitCode = 1;
+}
+
 async function handleStop() {
   const stoppedService = stopServiceIfInstalled();
   if (stoppedService) console.log("🛑 Service manager stopped (won't respawn).");
@@ -382,6 +429,15 @@ async function handleUninstall() {
 
   await runStep("service removed", () => uninstallServiceIfInstalled());
 
+  if (process.platform === "win32") {
+    await runStep("Windows tray removed", async () => {
+      const { getWindowsTrayStatus, uninstallWindowsTray } = await import("../tray/windows");
+      const tray = getWindowsTrayStatus();
+      if (!tray.installed && !tray.stale && !tray.running) return false;
+      uninstallWindowsTray();
+    });
+  }
+
   await runStep("native Codex restored", () => {
     const r = restoreNativeCodex();
     if (!r.success) throw new Error(r.message);
@@ -448,6 +504,7 @@ async function handleStatus() {
   console.log(`   Runtime source: ${status.json.runtime.source}${status.json.runtime.overrideEnv ? ` (${status.json.runtime.overrideEnv})` : ""}`);
   console.log(`   Default provider: ${status.json.defaultProvider}`);
   console.log(`   Codex autostart: ${status.json.codexAutostart ? "enabled" : "disabled"}`);
+  console.log(`   Restart safety: ${startupHealthSummary(status.json.startup)}`);
   console.log(`   Service: ${status.json.service.summary}`);
   console.log(`   ${status.json.codexShim.summary}`);
   if (status.json.codexPlugins.applicable) {
@@ -594,6 +651,11 @@ switch (command) {
   case "service":
     await serviceCommand(...args.slice(1));
     break;
+  case "tray": {
+    const { windowsTrayCommand } = await import("../tray/windows");
+    await windowsTrayCommand(args.slice(1));
+    break;
+  }
   case "codex-shim": {
     const { codexShimStatus, installCodexShim, uninstallCodexShim } = await import("../codex/shim");
     switch (args[1]) {
@@ -636,6 +698,23 @@ switch (command) {
     await refreshVersionCache(channel);
     break;
   }
+  case "__tray-start":
+  case "__tray-restart":
+  case "__startup-health":
+    await dispatchInternalCliCommand(command as InternalCliCommand, {
+      trayStart: handleTrayProxyStart,
+      trayRestart: handleTrayProxyRestart,
+      startupHealth: async () => {
+        const { collectStartupHealth } = await import("../codex/autostart-health");
+        console.log(JSON.stringify(collectStartupHealth(loadConfig())));
+      },
+    });
+    break;
+  case "__tray-host": {
+    const { runWindowsTrayHost } = await import("../tray/windows");
+    await runWindowsTrayHost();
+    break;
+  }
   case "__gui-update-worker": {
     const jobId = args[1];
     if (!jobId) process.exit(1);

package/src/cli/internal-dispatch.ts

@@ -0,0 +1,20 @@
+export type InternalCliCommand = "__tray-start" | "__tray-restart" | "__startup-health";
+
+export interface InternalCliHandlers {
+  trayStart: () => void | Promise<void>;
+  trayRestart: () => void | Promise<void>;
+  startupHealth: () => void | Promise<void>;
+}
+
+/** Dispatch fixed internal commands without accepting caller-selected process arguments. */
+export async function dispatchInternalCliCommand(
+  command: InternalCliCommand,
+  handlers: InternalCliHandlers,
+): Promise<void> {
+  switch (command) {
+    case "__tray-start": return void await handlers.trayStart();
+    case "__tray-restart": return void await handlers.trayRestart();
+    case "__startup-health": return void await handlers.startupHealth();
+    default: throw new Error(`Unsupported internal CLI command: ${String(command)}`);
+  }
+}

package/src/cli/status.ts

@@ -3,7 +3,10 @@ import { codexAutoStartEnabled, getConfigPath, getPidPath, readConfigDiagnostics
 import { diagnoseCodexBundledPlugins, type CodexPluginsDiagnostic } from "../codex/plugins-doctor";
 import { isOpencodexHealthz, probeHostname } from "../server/proxy-liveness";
 import type { OcxConfig } from "../types";
-import { serviceStatusSummary } from "../service";
+import { diagnoseService } from "../service";
+import { collectStartupHealth, type StartupHealth } from "../codex/autostart-health";
+import { getCodexRoutingKind } from "../codex/inject";
+import { diagnoseCodexShim } from "../codex/shim";
 
 type HealthCheck = {
   ok: boolean;
@@ -39,6 +42,7 @@ export type CliStatusJson = {
     overrideEnv?: string;
   };
   codexAutostart: boolean;
+  startup: StartupHealth;
   defaultProvider: string | null;
   config: {
     source: "default" | "file" | "fallback";
@@ -115,9 +119,15 @@ export async function collectStatus(): Promise<CliStatusView> {
   const listen = selectListenTarget(config, pid, pid ? readRuntimePort(pid) : null);
   const health = await checkProxyHealth(listen);
   const bunRuntime = durableBunRuntime();
-  const serviceSummary = serviceStatusSummary();
-  const { codexShimStatus } = await import("../codex/shim");
-  const codexShimSummary = codexShimStatus();
+  const service = diagnoseService();
+  const serviceSummary = service.summary;
+  const codexShim = diagnoseCodexShim();
+  const codexShimSummary = codexShim.summary;
+  const startup = collectStartupHealth(config, {
+    service,
+    shim: codexShim,
+    routingKind: getCodexRoutingKind(),
+  });
   const codexPlugins = diagnoseCodexBundledPlugins();
   const proxyLabel = pid && health.ok
     ? `running (PID ${pid})`
@@ -157,6 +167,7 @@ export async function collectStatus(): Promise<CliStatusView> {
         ...(bunRuntime.source === "override" ? { overrideEnv: bunRuntime.overrideEnv } : {}),
       },
       codexAutostart: codexAutoStartEnabled(config),
+      startup,
       defaultProvider: typeof config.defaultProvider === "string" ? config.defaultProvider : null,
       config: {
         source: configDiagnostics.source,

package/src/cli/tray-proxy.ts

@@ -0,0 +1,52 @@
+export interface TrayProxyLive { port: number }
+
+export interface TrayProxyServiceState {
+  installed: boolean;
+  startable: boolean;
+  summary: string;
+}
+
+export interface TrayProxyStartIo {
+  findLive: () => Promise<TrayProxyLive | null>;
+  diagnoseService: () => TrayProxyServiceState;
+  startService: () => void | Promise<void>;
+  startDirect: () => void | Promise<void>;
+  waitForProxy: () => Promise<TrayProxyLive | null>;
+  info: (message: string) => void;
+  error: (message: string) => void;
+}
+
+/** Side-effect coordinator for the tray's fixed proxy-start action. */
+export async function runTrayProxyStart(io: TrayProxyStartIo): Promise<boolean> {
+  const live = await io.findLive();
+  if (live) {
+    io.info(`Proxy already running on port ${live.port}.`);
+    return true;
+  }
+
+  const service = io.diagnoseService();
+  if (service.installed && !service.startable) {
+    io.error(`Cannot start from the tray because the installed service is not viable: ${service.summary}`);
+    io.error("Repair or remove the service before starting a direct proxy.");
+    return false;
+  }
+
+  if (service.startable) await io.startService();
+  else await io.startDirect();
+
+  const started = await io.waitForProxy();
+  if (!started) {
+    io.error("Proxy did not become healthy after the tray start action.");
+    return false;
+  }
+  io.info(`Proxy running on port ${started.port}.`);
+  return true;
+}
+
+export async function runTrayProxyRestart(io: {
+  stop: () => boolean | Promise<boolean>;
+  start: () => boolean | Promise<boolean>;
+}): Promise<boolean> {
+  if (!await io.stop()) return false;
+  return io.start();
+}

package/src/codex/auth-api.ts

@@ -13,7 +13,7 @@ import { deleteCodexAccount } from "./account-lifecycle";
 import { checkAccountIdCollision, readCodexTokens } from "./auth-collision";
 export { checkAccountIdCollision, getMainChatgptAccountId } from "./auth-collision";
 export { clearAccountNeedsReauth, isAccountNeedsReauth, markAccountNeedsReauth } from "./account-runtime-state";
-import { clearAccountNeedsReauth, isAccountNeedsReauth } from "./account-runtime-state";
+import { clearAccountNeedsReauth, isAccountNeedsReauth, markAccountNeedsReauth } from "./account-runtime-state";
 import {
   clearAccountQuota,
   getAccountQuota,
@@ -32,6 +32,7 @@ export { maskEmail } from "../lib/privacy";
 import type { CodexAccount, OcxConfig } from "../types";
 import { isCanonicalOpenAiForwardProvider, OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
 import { providerCodexAccountMode } from "../providers/registry";
+import { readBoundedResponseBody } from "../lib/bounded-body";
 
 function jsonResponse(data: unknown, status = 200): Response {
   return new Response(JSON.stringify(data), {
@@ -217,18 +218,55 @@ async function mapWithConcurrency<T, R>(
   return results;
 }
 
+const MAIN_TERMINAL_AUTH_CODES = new Set([
+  "invalid_workspace_selected",
+  "invalid_refresh_token",
+]);
+
+async function isTerminalMainAuthResponse(resp: Response): Promise<boolean> {
+  if (resp.status === 401) return true;
+  if (resp.status !== 403) return false;
+  try {
+    const body = await readBoundedResponseBody(resp, { totalTimeoutMs: 1_000, inactivityTimeoutMs: 1_000 });
+    if (!body.displaySafe) return false;
+    const parsed = JSON.parse(body.text) as {
+      detail?: { code?: unknown } | string;
+      error?: { code?: unknown } | string;
+      code?: unknown;
+    };
+    const code = typeof parsed.detail === "object" && parsed.detail !== null
+      ? parsed.detail.code
+      : typeof parsed.error === "object" && parsed.error !== null
+        ? parsed.error.code
+        : parsed.code;
+    return typeof code === "string" && MAIN_TERMINAL_AUTH_CODES.has(code);
+  } catch {
+    return false;
+  }
+}
+
 export async function fetchMainAccountInfo(forceRefresh = false): Promise<{ email: string | null; plan: string | null; quota: Omit<StoredAccountQuota, "updatedAt"> | null }> {
+  const tokens = readCodexTokens();
+  if (!tokens) {
+    mainAccountCache = null;
+    markAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+    return { email: null, plan: null, quota: null };
+  }
   if (!forceRefresh && mainAccountCache && Date.now() - mainAccountCache.ts < MAIN_CACHE_TTL) {
     return mainAccountCache;
   }
-  const tokens = readCodexTokens();
-  if (!tokens) return { email: null, plan: null, quota: null };
   try {
     const resp = await fetch("https://chatgpt.com/backend-api/wham/usage", {
       headers: { Authorization: `Bearer ${tokens.access_token}`, "ChatGPT-Account-Id": tokens.account_id },
       signal: AbortSignal.timeout(8000),
     });
-    if (!resp.ok) return { email: null, plan: null, quota: null };
+    if (!resp.ok) {
+      if (await isTerminalMainAuthResponse(resp)) {
+        mainAccountCache = null;
+        markAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+      }
+      return { email: null, plan: null, quota: null };
+    }
     const data = (await resp.json()) as WhamUsageResponse;
     const result = {
       email: data.email ?? null,
@@ -237,6 +275,7 @@ export async function fetchMainAccountInfo(forceRefresh = false): Promise<{ emai
       ts: Date.now(),
     };
     mainAccountCache = result;
+    clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
     // Mirror main quota + plan into the shared stores so the rotation engine can
     // score and auto-switch the main account exactly like a pool account (Option A).
     setMainAccountPlan(result.plan);
@@ -373,12 +412,14 @@ export async function listCodexAuthAccounts(config: OcxConfig, forceRefresh = fa
       : { quota: null, needsReauth: true };
     return poolAccountDto(a, quotaResult, !!cred);
   });
+  const hasMainCredential = readCodexTokens() !== null;
   const main: CodexAuthAccountDto = {
     id: MAIN_CODEX_ACCOUNT_ID,
     email: maskEmail(mainInfo.email) ?? "Codex App login",
     plan: mainInfo.plan,
     isMain: true,
-    hasCredential: true,
+    hasCredential: hasMainCredential,
+    needsReauth: !hasMainCredential || isAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID),
     quota: mainInfo.quota ? { ...quotaForPlan({ ...mainInfo.quota, updatedAt: Date.now() }, mainInfo.plan) } : null,
   };
   return [main, ...withQuota];

package/src/codex/autostart-health.ts

@@ -0,0 +1,149 @@
+import { codexAutoStartEnabled } from "../config";
+import { diagnoseService, type ServiceDiagnostic } from "../service";
+import type { OcxConfig } from "../types";
+import { getCodexRoutingKind, type CodexRoutingKind } from "./inject";
+import { diagnoseCodexShim, type CodexShimDiagnostic } from "./shim";
+
+export type StartupProtection = "service" | "shim" | "none";
+export type StartupHealthStatus = "native" | "protected" | "at-risk";
+export type ShimCoverage = "full" | "cli-only" | "none";
+
+export interface StartupHealthInputs {
+  routingKind: CodexRoutingKind;
+  autostartEnabled: boolean;
+  serviceInstalled: boolean;
+  serviceViable: boolean;
+  serviceEnabled: boolean;
+  serviceRunning: boolean;
+  serviceStale: boolean;
+  serviceConflict: boolean;
+  serviceSupported: boolean;
+  shimInstalled: boolean;
+  shimHealthy: boolean;
+  platform: NodeJS.Platform;
+  diagnosticStale?: boolean;
+}
+
+export interface StartupHealth {
+  status: StartupHealthStatus;
+  routingKind: CodexRoutingKind;
+  routingInjected: boolean;
+  localRoutingDependency: boolean;
+  autostartEnabled: boolean;
+  rebootSafe: boolean;
+  protection: StartupProtection;
+  serviceInstalled: boolean;
+  serviceViable: boolean;
+  serviceEnabled: boolean;
+  serviceRunning: boolean;
+  serviceStale: boolean;
+  serviceConflict: boolean;
+  shimInstalled: boolean;
+  shimHealthy: boolean;
+  shimCoverage: ShimCoverage;
+  serviceSupported: boolean;
+  platform: NodeJS.Platform;
+  diagnosticStale: boolean;
+  recommendedCommand: string | null;
+  commands: {
+    installService: string;
+    installShim: string;
+    restoreNative: string;
+  };
+}
+
+const COMMANDS = {
+  installService: "ocx service install",
+  installShim: "ocx codex-shim install",
+  restoreNative: "ocx restore",
+} as const;
+
+export function deriveStartupHealth(inputs: StartupHealthInputs): StartupHealth {
+  const shimEffective = inputs.autostartEnabled && inputs.shimHealthy;
+  const routingInjected = inputs.routingKind === "opencodex-local";
+  const localRoutingDependency = inputs.routingKind === "opencodex-local"
+    || inputs.routingKind === "custom-local"
+    || inputs.routingKind === "unknown";
+  // Script launchers never cover Codex Desktop/app-server surfaces. This is
+  // intentionally conservative on every OS and for WSL-shared Codex homes.
+  const shimCoverage: ShimCoverage = !shimEffective
+    ? "none"
+    : "cli-only";
+  // We can only credit an opencodex service/shim for routing that opencodex owns.
+  // An arbitrary localhost gateway has an independent lifecycle that OCX cannot repair.
+  const ownsLocalRouting = inputs.routingKind === "opencodex-local";
+  const protection: StartupProtection = ownsLocalRouting && inputs.serviceViable
+    ? "service"
+    : ownsLocalRouting && shimEffective
+      ? "shim"
+      : "none";
+  const rebootSafe = !localRoutingDependency || (ownsLocalRouting && inputs.serviceViable);
+  const status: StartupHealthStatus = !localRoutingDependency
+    ? "native"
+    : rebootSafe
+      ? "protected"
+      : "at-risk";
+  const recommendedCommand = status !== "at-risk"
+    ? null
+    : inputs.routingKind === "custom-local" || inputs.routingKind === "unknown"
+      ? COMMANDS.restoreNative
+    : inputs.serviceSupported
+      ? COMMANDS.installService
+      : COMMANDS.restoreNative;
+  return {
+    ...inputs,
+    diagnosticStale: inputs.diagnosticStale ?? false,
+    routingInjected,
+    localRoutingDependency,
+    status,
+    rebootSafe,
+    protection,
+    shimCoverage,
+    recommendedCommand,
+    commands: { ...COMMANDS },
+  };
+}
+
+export interface StartupHealthDiagnostics {
+  routingKind?: CodexRoutingKind;
+  service?: ServiceDiagnostic;
+  shim?: CodexShimDiagnostic;
+}
+
+/** Collect current machine state without mutating config, services, or shims. */
+export function collectStartupHealth(
+  config: Pick<OcxConfig, "codexAutoStart">,
+  diagnostics: StartupHealthDiagnostics = {},
+): StartupHealth {
+  const shim = diagnostics.shim ?? diagnoseCodexShim();
+  const service = diagnostics.service ?? diagnoseService();
+  return deriveStartupHealth({
+    routingKind: diagnostics.routingKind ?? getCodexRoutingKind(),
+    autostartEnabled: codexAutoStartEnabled(config),
+    serviceInstalled: service.installed,
+    serviceViable: service.viable,
+    serviceEnabled: service.enabled,
+    serviceRunning: service.running,
+    serviceStale: service.stale,
+    serviceConflict: service.conflict,
+    serviceSupported: service.supported,
+    shimInstalled: shim.installed,
+    shimHealthy: shim.healthy,
+    platform: process.platform,
+  });
+}
+
+export function startupHealthSummary(health: StartupHealth): string {
+  if (health.status === "native") return health.routingKind === "custom-remote"
+    ? "custom remote Codex routing (no local restart dependency)"
+    : "native Codex routing (no opencodex restart dependency)";
+  if (health.protection === "service") return "protected by background service";
+  const command = health.recommendedCommand ?? health.commands.restoreNative;
+  if (health.routingKind === "unknown") return `AT RISK after restart (Codex routing could not be verified; run '${command}')`;
+  if (health.routingKind === "custom-local") return `AT RISK after restart (custom local gateway lifecycle is not managed by opencodex; run '${command}')`;
+  if (health.shimCoverage === "cli-only") return `AT RISK for Codex Desktop after restart (launcher shim covers CLI scripts only; run '${command}')`;
+  if (health.serviceConflict) return `AT RISK after restart (background service managers conflict; run '${command}')`;
+  if (health.serviceStale) return `AT RISK after restart (background service files are stale; run '${command}')`;
+  if (health.serviceInstalled && !health.serviceViable) return `AT RISK after restart (installed service is disabled, stopped, or unhealthy; run '${command}')`;
+  return `AT RISK after restart (no viable background service; run '${command}')`;
+}