@bitkyc08/opencodex 2.75.0 → 2.76.0

package/src/config/macos-system-proxy.ts

@@ -2,10 +2,14 @@ import { execFileSync } from "node:child_process";
 import { isIP } from "node:net";
 
 export type MacOSProxyReader = () => string | null;
+export type UnrepresentableCounts = { cidr: number; hostname: number; wildcard: number; other: number };
 export type MacOSSystemProxyResult =
   | { kind: "proxy"; httpUrl?: string; httpsUrl?: string; exceptions: string[]; droppedLinkLocal: boolean }
-  | { kind: "disabled" | "unreadable" | "unsafe-exceptions" };
+  | { kind: "unsafe-exceptions"; unrepresentable?: UnrepresentableCounts; setting?: string }
+  | { kind: "socks-only" }
+  | { kind: "disabled" | "unreadable" };
 
+/** Reads the global proxy dictionary from /usr/sbin/scutil with tight time and size limits. */
 function readScutilProxy(): string {
   return execFileSync("/usr/sbin/scutil", ["--proxy"], {
     encoding: "utf8",
@@ -15,6 +19,7 @@ function readScutilProxy(): string {
   });
 }
 
+/** Normalizes an enabled host/port pair into an origin URL, or undefined when unusable. */
 function proxyUrl(host: string | undefined, port: string | undefined): string | undefined {
   if (!host || !port || !/^\d+$/.test(port) || +port < 1 || +port > 65535) return undefined;
   const bareHost = host.startsWith("[") && host.endsWith("]") ? host.slice(1, -1) : host;
@@ -26,11 +31,17 @@ function proxyUrl(host: string | undefined, port: string | undefined): string |
   }
 }
 
-// Bun matches a leading-dot entry at DNS-label boundaries and also bypasses the
-// bare apex. Translating "*.local" to ".local" therefore widens only to "local";
-// other glob shapes are refused. Bun cannot represent the default link-local
-// CIDRs, so they are dropped with a diagnostic instead of blocking discovery.
-// null means one of those exact ranges was dropped; undefined refuses discovery.
+/**
+ * Bun matches a leading-dot entry at DNS-label boundaries and also bypasses the
+ * bare apex. Translating "*.local" to ".local" therefore widens only to "local";
+ * other glob shapes are refused. Bun cannot represent the default link-local
+ * CIDRs, so they are dropped with a diagnostic instead of blocking discovery.
+ * Returns the translated entry, null when one of those exact ranges was dropped,
+ * or undefined when the shape cannot be represented and refuses discovery.
+ * Non-canonical IPv4 literals (e.g. leading-zero octets) return undefined; the
+ * refusal counter then reports them in the "other" shape bucket (see
+ * unrepresentableCategory) so shape counts stay interpretable.
+ */
 function translateException(value: string): string | null | undefined {
   if (value === "*") return value;
   if (value === "169.254/16" || value === "169.254.0.0/16") return null;
@@ -52,6 +63,32 @@ function translateException(value: string): string | null | undefined {
   return isIP(bare) === 6 ? new URL(`http://[${bare}]`).hostname : undefined;
 }
 
+/**
+ * Classifies an unrepresentable entry for refusal diagnostics. Refusals must not echo
+ * the offending entries (a system bypass list can name internal hosts), so discovery
+ * reports only how many entries fall into each shape: CIDR ranges, syntactically
+ * valid bare hostnames Bun would widen to subdomains (validated per DNS label, so
+ * malformed structures like "foo..bar" do not count), malformed wildcard shapes,
+ * and anything else. Non-canonical IPv4 literals (digit-dotted strings that fail
+ * canonicalization) are IP-shaped rather than hostnames and count as "other".
+ */
+function unrepresentableCategory(value: string): "cidr" | "hostname" | "wildcard" | "other" {
+  if (value.includes("/")) return "cidr";
+  if (value.includes("*")) return "wildcard";
+  if (isIP(value) || (value.startsWith("[") && value.endsWith("]"))) return "other";
+  if (/^\d+(\.\d+)+$/.test(value)) return "other";
+  const validLabels = value.split(".").every(label => label.length > 0 && label.length <= 63
+    && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/i.test(label));
+  return validLabels ? "hostname" : "other";
+}
+
+/** Counts unrepresentable entries by shape for the refusal diagnostic. */
+function countUnrepresentable(values: string[]): UnrepresentableCounts {
+  const counts: UnrepresentableCounts = { cidr: 0, hostname: 0, wildcard: 0, other: 0 };
+  for (const value of values) counts[unrepresentableCategory(value)]++;
+  return counts;
+}
+
 /** Read only the global dictionary; scoped service dictionaries do not apply globally. */
 export function readMacOSSystemProxy(reader: MacOSProxyReader = readScutilProxy): MacOSSystemProxyResult {
   try {
@@ -90,24 +127,44 @@ export function readMacOSSystemProxy(reader: MacOSProxyReader = readScutilProxy)
       }
     }
     if (depth !== 0) return { kind: "unreadable" };
-    if (values.get("ExcludeSimpleHostnames") === "1" || values.get("ProxyAutoConfigEnable") === "1"
-      || values.get("ProxyAutoDiscoveryEnable") === "1") return { kind: "unsafe-exceptions" };
     for (const key of ["HTTPEnable", "HTTPSEnable", "ExcludeSimpleHostnames", "ProxyAutoConfigEnable", "ProxyAutoDiscoveryEnable"]) {
       const value = values.get(key);
       if (value !== undefined && value !== "0" && value !== "1") return { kind: "unreadable" };
     }
-    const translated = exceptions.map(translateException);
-    if (translated.some(value => value === undefined)) return { kind: "unsafe-exceptions" };
     const httpEnabled = values.get("HTTPEnable") === "1";
     const httpsEnabled = values.get("HTTPSEnable") === "1";
     const httpUrl = httpEnabled ? proxyUrl(values.get("HTTPProxy"), values.get("HTTPPort")) : undefined;
     const httpsUrl = httpsEnabled ? proxyUrl(values.get("HTTPSProxy"), values.get("HTTPSPort")) : undefined;
     if ((httpEnabled && !httpUrl) || (httpsEnabled && !httpsUrl)) return { kind: "unreadable" };
-    return httpUrl || httpsUrl
-      ? { kind: "proxy", httpUrl, httpsUrl,
-          exceptions: translated.filter((value): value is string => typeof value === "string"),
-          droppedLinkLocal: translated.includes(null) }
-      : { kind: "disabled" };
+    // Transport precedence: with no HTTP(S) proxy configured, no bypass list or toggle
+    // can change the outcome — SOCKS-only is the primary blocker and is reported ahead
+    // of exception shapes, which would otherwise mask it (review round 1, P2).
+    if (!(httpUrl || httpsUrl)) {
+      // PAC and WPAD can route traffic without a static HTTP(S) proxy. Saying "disabled",
+      // or "SOCKS-only, using direct egress", would misdescribe that setup, so the
+      // automatic-configuration toggle is reported first.
+      const autoSetting = values.get("ProxyAutoConfigEnable") === "1" ? "ProxyAutoConfigEnable"
+        : values.get("ProxyAutoDiscoveryEnable") === "1" ? "ProxyAutoDiscoveryEnable"
+        : undefined;
+      if (autoSetting) return { kind: "unsafe-exceptions", setting: autoSetting };
+      return values.get("SOCKSEnable") === "1" ? { kind: "socks-only" } : { kind: "disabled" };
+    }
+    // With a usable HTTP(S) transport, toggles and untranslatable entries refuse
+    // discovery together: the user should fix both in one pass, not one per retry.
+    const flaggedSetting = values.get("ExcludeSimpleHostnames") === "1" ? "ExcludeSimpleHostnames"
+      : values.get("ProxyAutoConfigEnable") === "1" ? "ProxyAutoConfigEnable"
+      : values.get("ProxyAutoDiscoveryEnable") === "1" ? "ProxyAutoDiscoveryEnable"
+      : undefined;
+    const translated = exceptions.map(translateException);
+    const unrepresentable = translated.some(value => value === undefined)
+      ? countUnrepresentable(exceptions.filter((_, index) => translated[index] === undefined))
+      : undefined;
+    if (flaggedSetting || unrepresentable) {
+      return { kind: "unsafe-exceptions", setting: flaggedSetting, unrepresentable };
+    }
+    return { kind: "proxy", httpUrl, httpsUrl,
+      exceptions: translated.filter((value): value is string => typeof value === "string"),
+      droppedLinkLocal: translated.includes(null) };
   } catch {
     return { kind: "unreadable" };
   }

package/src/config/owner-registry.ts

@@ -24,12 +24,13 @@
  */
 
 import { createHash } from "node:crypto";
-import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { atomicWriteFile } from "./atomic-write";
+import { atomicWriteFileNoFollow } from "./atomic-write";
 import { getConfigDir } from "./paths";
 import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
+import { hardenSecretDir } from "../lib/windows-secret-acl";
 
 const REGISTRY_DIR_NAME = "ocx-homes";
 /**
@@ -83,8 +84,16 @@ export function registerOwnerRegistryHome(home: string): void {
       if (parent === ancestor) break;
       ancestor = parent;
     }
-    mkdirSync(dir, { recursive: true });
-    atomicWriteFile(
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // This locator contains no secret, but its deterministic entry names must not
+    // give another local user a place to plant a destination symlink. Refuse a
+    // directory symlink and fail closed if an existing directory cannot be made
+    // owner-only (for example because another user created it first).
+    const registryStat = lstatSync(dir);
+    if (!registryStat.isDirectory() || registryStat.isSymbolicLink()) return;
+    chmodSync(dir, 0o700);
+    hardenSecretDir(dir, { required: true });
+    atomicWriteFileNoFollow(
       registryEntryPath(dir, home),
       JSON.stringify({ home: resolve(home), v: 1 }) + "\n",
     );

package/src/config/process-state.ts

@@ -328,14 +328,23 @@ export function readProcessCommandLine(pid: number): string | undefined {
       } catch {
         /* WMIC missing or failed — fall through */
       }
-      const output = processCommandLineExec(resolveTrustedWindowsPowerShellExe(), [
-        "-NoProfile",
-        "-NoLogo",
-        "-NonInteractive",
-        "-Command",
-        `(Get-CimInstance Win32_Process -Filter "ProcessId = ${pid}").CommandLine`,
-      ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 3000, windowsHide: true });
-      return output.trim() || undefined;
+      // One bounded retry: a transient CIM timeout answers "unreadable" for an
+      // unchanged process and turns a guarded stop into a false approval-changed.
+      for (let attempt = 0; attempt < 2; attempt += 1) {
+        try {
+          const output = processCommandLineExec(resolveTrustedWindowsPowerShellExe(), [
+            "-NoProfile",
+            "-NoLogo",
+            "-NonInteractive",
+            "-Command",
+            `(Get-CimInstance Win32_Process -Filter "ProcessId = ${pid}").CommandLine`,
+          ], { encoding: "utf-8", stdio: ["ignore", "pipe", "ignore"], timeout: 3000, windowsHide: true });
+          return output.trim() || undefined;
+        } catch {
+          /* timed out or CIM unavailable — try once more, then unreadable */
+        }
+      }
+      return undefined;
     }
     for (const ps of ["/bin/ps", "/usr/bin/ps"]) {
       try {

package/src/config/proxy-env.ts

@@ -5,7 +5,7 @@ import { DEFAULT_SUBAGENT_MODELS, SUBAGENT_MODELS_VERSION } from "./subagent-mod
 import { MULTI_AGENT_SURFACE_ADVISORY_VERSION } from "./multi-agent-surface";
 import { DEFAULT_APP_OWNED_MEMORY_BUDGET_BYTES } from "../lib/app-owned-memory";
 import { describeProxyForLog, readWindowsSystemProxy, type WindowsProxyRegistryReader } from "../lib/windows-system-proxy";
-import { readMacOSSystemProxy, type MacOSProxyReader } from "./macos-system-proxy";
+import { readMacOSSystemProxy, type MacOSProxyReader, type MacOSSystemProxyResult } from "./macos-system-proxy";
 import { OPENAI_PROVIDER_TIER_VERSION, type OcxConfig } from "../types";
 import type { OcxRuntimeRole } from "../types/config";
 
@@ -187,6 +187,34 @@ export function applyProxyEnv(config: OcxConfig, announce = false): void {
   if (outbound) console.log(`   outbound proxy: ${redactUrlForLog(outbound)}`);
 }
 
+/**
+ * Builds the refusal reason for an unsafe macOS discovery outcome. Toggle refusals
+ * name the toggle only — they are not an exception-translation problem, so the
+ * "exceptions" framing is reserved for entries. Entry refusals report shape counts
+ * and setting names, never the entries themselves: naming them would leak
+ * bypass-list hostnames (internal servers, banked domains) into shared logs.
+ */
+function describeDiscoveryRefusal(
+  found: Extract<MacOSSystemProxyResult, { kind: "unsafe-exceptions" }>,
+): string {
+  const counts = found.unrepresentable;
+  if (counts) {
+    const parts = [
+      counts.cidr > 0 && `${counts.cidr} CIDR`,
+      counts.hostname > 0 && `${counts.hostname} bare-hostname`,
+      counts.wildcard > 0 && `${counts.wildcard} wildcard-shaped`,
+      counts.other > 0 && `${counts.other} other`,
+    ].filter(Boolean).join(", ");
+    const entries = counts.cidr + counts.hostname + counts.wildcard + counts.other;
+    const entriesPhrase = `${entries} ${entries === 1 ? "exception entry" : "exception entries"} cannot be safely translated (${parts})`;
+    return found.setting
+      ? `${found.setting} is enabled; ${entriesPhrase}; discovery refused`
+      : `macOS exceptions cannot be safely translated (${parts}); discovery refused`;
+  }
+  if (found.setting) return `${found.setting} is enabled; discovery refused`;
+  return "macOS exceptions cannot be safely translated; discovery refused";
+}
+
 /** Test seam for `proxy: "auto"`: the registry reader and platform are injectable. */
 export function applyProxyEnvWith(
   config: OcxConfig,
@@ -224,10 +252,12 @@ export function applyProxyEnvWith(
       const found = readMacOSSystemProxy(auto.macOSReader);
       if (found.kind !== "proxy") {
         const reason = found.kind === "unsafe-exceptions"
-          ? "macOS exceptions cannot be safely translated; discovery refused"
-          : found.kind === "disabled"
-            ? "macOS system proxy is disabled"
-            : "macOS proxy settings could not be read";
+          ? describeDiscoveryRefusal(found)
+          : found.kind === "socks-only"
+            ? "macOS system proxy is SOCKS-only, which HTTP_PROXY cannot express; using direct egress"
+            : found.kind === "disabled"
+              ? "macOS system proxy is disabled"
+              : "macOS proxy settings could not be read";
         console.log(`[opencodex] proxy "auto": ${reason}; proxy environment unchanged`);
         return;
       }

package/src/config/schema/config-schema.ts

@@ -1,3 +1,4 @@
+import { MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT } from "../../codex/quota-types";
 import * as z from "zod/v4";
 import { compactionRecoverySchema } from "./compaction-recovery";
 import { blockedModelRedirectsSchema } from "./blocked-model-redirects";
@@ -17,6 +18,7 @@ import {
   remoteGuiConfigSchema,
   runtimeRoleSchema,
   spendSchema,
+  chatgptDesktopSchema,
   skillsConfigSchema,
   configuredCodexPoolAccountIds,
   apiKeyEntrySchema,
@@ -53,10 +55,13 @@ import {
 } from "../../codex/account-namespace-match";
 import { UPSTREAM_HOST_CIRCUIT_MAX_THRESHOLD } from "../../codex/upstream-host-health";
 import { MIN_USAGE_LEDGER_MAX_BYTES } from "../../usage/retention-contract";
-import { COMBO_NAMESPACE, comboConfigIssues } from "../../combos/types";
+// The schema boundary uses a string-only stand-in for the ingress grammar: importing the server
+// parser here would cycle back through config loading and run Cursor detection during validation.
+import { COMBO_NAMESPACE, comboConfigIssues, lexicalDecisionModelBase } from "../../combos/types";
 import { routingProfileIssues } from "../../routing/profile";
 import { POLICY_NAMESPACE } from "../../routing/profile-namespace";
 import { providerDestinationConfigError } from "../../lib/destination-policy";
+import { providerTlsProfileConfigError } from "../../lib/provider-tls-profile";
 import { redactSecretString } from "../../lib/redact";
 import { openRouterRoutingConfigError } from "../../providers/openrouter-routing";
 import { vercelGatewayRoutingConfigError } from "../../providers/vercel-gateway-routing";
@@ -69,6 +74,7 @@ import { isInterceptBindingId, isInterceptBindingRoute } from "../../claude/inte
 import { DEFAULT_APP_OWNED_MEMORY_BUDGET_BYTES, MAX_APP_OWNED_MEMORY_BUDGET_MB, MIN_APP_OWNED_MEMORY_BUDGET_MB } from "../../lib/app-owned-memory";
 
 export const configSchema = z.object({
+  chatgptDesktop: chatgptDesktopSchema.optional().catch(undefined),
   codexNativeSteering: z.boolean().optional().catch(false),
   codexNativeInjection: z.boolean().optional().catch(false),
   port: z.number().int().min(0).max(65535).default(10100),
@@ -186,6 +192,10 @@ export const configSchema = z.object({
   // Default-on policy (#5694): absence and malformed hand edits both mean "on", and only an
   // explicit `false` written by the settings PUT opts out.
   codexMainAccountHardLock: z.boolean().optional().catch(undefined),
+  codexMainAccountHardLockThresholds: z.object({
+    short: z.number().int().min(MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT).max(100).optional().catch(undefined),
+    long: z.number().int().min(MAIN_ACCOUNT_HARD_LOCK_MIN_PERCENT).max(100).optional().catch(undefined),
+  }).optional().catch(undefined),
   // Future versions remain opaque through passthrough-compatible whole-config saves.
   // Only version 1 grants deletion authority in the rebase path.
   configRebaseProvenance: z.unknown().optional(),
@@ -237,6 +247,12 @@ export const configSchema = z.object({
     z.string(),
     z.array(z.string().trim().min(1)).min(1),
   ).optional().catch(undefined),
+  // Advisory input to role auto-assign only; a malformed block falls back to price ranking.
+  codexRoleTiers: z.object({
+    fast: z.array(z.string().trim().min(1)).optional(),
+    standard: z.array(z.string().trim().min(1)).optional(),
+    frontier: z.array(z.string().trim().min(1)).optional(),
+  }).strict().optional().catch(undefined),
   codexShimAutoRestore: z.boolean().optional(),
   codexDesktopAuthless: z.boolean().optional().catch(undefined),
   codexClientCompaction: z.boolean().optional().catch(undefined),
@@ -245,6 +261,10 @@ export const configSchema = z.object({
   // would refuse to load — the provider id routing depends on is never derived from it.
   codexProviderDisplayName: z.string().trim().min(1).max(128).optional().catch(undefined),
   pausedCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional(),
+  // A malformed allow-list degrades to "no account spends credits" rather than failing the parse,
+  // so a hand-edited typo cannot trip the backup-and-defaults repair path; the write path rejects
+  // it (creditCodexAccountIdsError in diagnostics).
+  creditCodexAccountIds: z.array(z.string().regex(/^[a-zA-Z0-9._-]{1,64}$/)).optional().catch(undefined),
   // A malformed policy degrades to "no policy" rather than failing the parse, so a hand-edited
   // typo cannot trip the backup-and-defaults repair path and wipe providers or pool accounts.
   // Silently ignoring it would be its own trap, so the write path rejects it and loadConfig warns.
@@ -470,6 +490,14 @@ export const configSchema = z.object({
         });
       }
     }
+    const tlsProfileError = providerTlsProfileConfigError(name, provider);
+    if (tlsProfileError) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["providers", redactSecretString(name), "tlsProfile"],
+        message: tlsProfileError,
+      });
+    }
     const headersError = providerHeadersConfigError((provider as { headers?: unknown }).headers);
     if (headersError) {
       ctx.addIssue({
@@ -720,6 +748,7 @@ export const configSchema = z.object({
         for (const issue of comboConfigIssues(id, raw, config.providers, {
           combos: combos as Record<string, import("../../types").OcxComboConfig>,
           excludeComboId: id,
+          normalizeDecisionModel: model => lexicalDecisionModelBase(model, config.cursorEffortRows === true),
         })) {
           ctx.addIssue({
             code: "custom",

package/src/config/schema/leaf-validators.ts

@@ -43,6 +43,9 @@ import {
 import { getConfigDir } from "../paths";
 import { COMPACTION_TRIGGERS } from "./compaction-triggers";
 
+/** Experimental macOS ChatGPT app-server shim; only a strict optional boolean is accepted. */
+export const chatgptDesktopSchema = z.object({ appServerShim: z.boolean().optional() }).strict();
+
 /** One definition of "usable secret", shared by the schema and the warnings. */
 export function isUsableApiKeySecret(value: unknown): value is string {
   return typeof value === "string" && value.length > 0 && value === value.trim();
@@ -294,6 +297,7 @@ export const providerConfigSchema = z.object({
   autoReviewModelOverrides: autoReviewModelOverridesSchema.optional(),
   adapter: z.string().min(1),
   baseUrl: z.string().min(1),
+  tlsProfile: z.literal("antigravity-browser").optional(),
   alias: z.string().optional(),
   modelAliases: z.record(z.string(), z.string()).optional(),
   modelDisplayNames: modelDisplayNamesSchema.optional(),

package/src/config/serving-runtimes.ts

@@ -33,7 +33,14 @@ import { assertNotRealHomeUnderTest } from "../lib/test-home-guard";
 import { atomicWriteFile } from "./atomic-write";
 import { getConfigDir } from "./paths";
 import { ConfigMutationLockError, withConfigMutationLockSync } from "./mutation-lock";
-import { SERVICE_MANAGED_ENV } from "../service/state";
+import {
+  inspectServiceManagerInstallation,
+  queryWinswBinaryPathName,
+  scBinaryPathNamesExecutable,
+  type ServiceManagerClaim,
+  type ServiceManagerInstallation,
+} from "../service-manager-probe";
+import { compareServicePathToInstall, currentServiceHomes, SERVICE_MANAGED_ENV } from "../service/state";
 import { WINDOWS_WRAPPER_PROTOCOL_ENV } from "../service/windows-wrapper-exit";
 
 export function servingRuntimesPath(dir: string = getConfigDir()): string {
@@ -253,11 +260,38 @@ export function selectNewerServingRuntime(
   return best === null ? null : { ...best.record, version: best.version };
 }
 
+/**
+ * Whether the census names a command different from self that records a newer
+ * version and still exists on disk. Cheap and spawn-free: use it to gate the
+ * expensive service-manager provenance probe instead of probing on every start.
+ */
+export function hasNewerRecordedServingRuntime(
+  selfVersion: string,
+  selfCommand: readonly string[],
+  deps: NewerServingRuntimeDeps = {},
+): boolean {
+  const self = parseStrictSemver(selfVersion);
+  if (self === null) return false;
+  const exists = deps.exists ?? existsSync;
+  const selfKey = servingRuntimeCommandKey(selfCommand);
+  return readServingRuntimes(deps.dir ?? getConfigDir())
+    .filter(record => servingRuntimeCommandKey(record.command) !== selfKey)
+    .filter(record => {
+      const recorded = parseStrictSemver(record.version);
+      return recorded !== null && compareStrictSemver(recorded, self) > 0;
+    })
+    .some(record => record.command.every(part => exists(part) && trustedRecordedPath(part)));
+}
+
 export interface DeferToNewerRuntimeDeps extends NewerServingRuntimeDeps {
   readonly runInherited?: (command: readonly string[], args: readonly string[]) => Promise<DelegatedExit>;
   readonly log?: (line: string) => void;
   /** Environment the service manager gave this child; decides its stay-out exit code. */
   readonly env?: NodeJS.ProcessEnv;
+  /** Test seam for the manager-definition provenance check at the pre-probe gate. */
+  readonly installedServiceOwnsCurrentHome?: () => boolean;
+  /** Test seam for the recorded-candidate gate that keeps the manager probe off empty censuses. */
+  readonly hasNewerRecordedRuntime?: () => boolean;
 }
 
 interface DelegatedExit { readonly exitCode: number; readonly ready: boolean }
@@ -397,9 +431,69 @@ export async function deferServiceChildToNewerRuntime(options: {
   readonly deps?: DeferToNewerRuntimeDeps;
 }): Promise<number | null> {
   if (options.sibling || !isManagedServiceEnvironment(options.env) || options.env[DELEGATED_ONCE_ENV] === "1") return null;
+  // Cheap gate first: with no recorded newer candidate there is nothing to delegate to, so
+  // the manager-definition probe (a potential full Task Scheduler listing) must not run.
+  const hasCandidate = options.deps?.hasNewerRecordedRuntime
+    ?? (() => hasNewerRecordedServingRuntime(options.selfVersion, options.selfCommand, options.deps));
+  if (!hasCandidate()) return null;
+  const installedServiceOwnsCurrentHome = options.deps?.installedServiceOwnsCurrentHome
+    ?? serviceManagerOwnsCurrentHome;
+  // Bun may populate the live environment from a project-controlled dotenv file. Markers
+  // therefore identify the service protocol but are not authority to execute census paths:
+  // require a live manager registration whose generated definition names this home first.
+  if (!installedServiceOwnsCurrentHome()) return null;
   return deferToNewerServiceRuntime(options.selfVersion, options.selfCommand, options.port, { env: options.env, ...options.deps });
 }
 
+/**
+ * A claim's null home key means the definition omitted it, which only happens for a
+ * default-home install. Such a claim authorizes nothing when the current process resolved
+ * a non-default home — otherwise a project .env setting the env var plus the service marker
+ * would borrow a default install's registration for a project-chosen census directory.
+ */
+export function serviceClaimMatchesCurrentHomes(
+  claim: ServiceManagerClaim,
+  current: { codexHome: string; opencodexHome: string },
+  env: NodeJS.ProcessEnv = process.env,
+): boolean {
+  return (claim.homes.codexHome === null
+      ? !env.CODEX_HOME?.trim()
+      : compareServicePathToInstall(claim.homes.codexHome, current.codexHome) === "same")
+    && (claim.homes.opencodexHome === null
+      ? !env.OPENCODEX_HOME?.trim()
+      : compareServicePathToInstall(claim.homes.opencodexHome, current.opencodexHome) === "same");
+}
+
+export interface ServiceOwnershipGateDeps {
+  readonly current?: { codexHome: string; opencodexHome: string };
+  readonly env?: NodeJS.ProcessEnv;
+  /** Test seam for the read-only manager inspection of the current config dir. */
+  readonly inspect?: (configDir: string) => ServiceManagerInstallation;
+  /** Test seam for the registered WinSW BINARY_PATH_NAME; production asks trusted `sc.exe qc`. */
+  readonly winswBinaryPathName?: () => string | null;
+}
+
+/**
+ * WinSW reports machine-wide SCM registration while its definition is read from the
+ * current config dir, so the delegation gate binds the registration to that definition:
+ * the registered service binary must be the claim's own executable. Any query failure,
+ * missing value, or mismatch refuses delegation. Other backends are unchanged.
+ */
+export function serviceManagerOwnsCurrentHome(deps: ServiceOwnershipGateDeps = {}): boolean {
+  const current = deps.current ?? currentServiceHomes();
+  const inspect = deps.inspect ?? (configDir => inspectServiceManagerInstallation({ configDir }));
+  const installation = inspect(current.opencodexHome);
+  if (installation.kind !== "present") return false;
+  return installation.claims.some(claim => claim.registration === "present"
+    && serviceClaimMatchesCurrentHomes(claim, current, deps.env)
+    && (claim.backend !== "winsw" || winswRegistrationRunsDefinition(claim, deps)));
+}
+
+function winswRegistrationRunsDefinition(claim: ServiceManagerClaim, deps: ServiceOwnershipGateDeps): boolean {
+  const binaryPathName = (deps.winswBinaryPathName ?? (() => queryWinswBinaryPathName()))();
+  return binaryPathName !== null && scBinaryPathNamesExecutable(binaryPathName, claim.definitionPath);
+}
+
 /**
  * A child a service manager started, as its environment proves it. launchd, systemd, and
  * current or repaired WinSW definitions write `OCX_SERVICE_MANAGED=1`; the Windows Task