@bitkyc08/opencodex 2.76.0 → 2.78.0-preview.20261005

package/src/cli/secret-args.ts

@@ -0,0 +1,149 @@
+/** Credential-option redaction for CLI argument errors. Kept dependency-free so the CLI head can use it. */
+/**
+ * Options whose VALUE is a credential (or can carry one), listed here so a parse
+ * error never prints one. `--headers` belongs on the list defensively: custom
+ * headers are documented as non-secret metadata and the validator rejects the
+ * standard credential names, but it cannot recognize an arbitrary one such as
+ * `X-My-Token`, so a parse error must not echo the value back either way.
+ *
+ * `takeOption` only understands `--flag value`. `--flag=value` therefore falls
+ * through to `rejectArgs`, which reports the offending argument verbatim — for
+ * `--code=https://…?code=SECRET` that writes the authorization code to stderr,
+ * which is the exact exposure the stdin path exists to avoid.
+ */
+const SECRET_OPTIONS = [
+  "--code",
+  "--headers",
+  "--api-key",
+  "--key",
+  "--secret",
+  "--password",
+  "--token",
+  "--admin-token",
+  "--pairing-code",
+  "--credential-env",
+  "--admin-token-env",
+  "--pairing-code-env",
+];
+
+function isSecretOptionToken(token: string): boolean {
+  return SECRET_OPTIONS.includes(token) || SECRET_OPTIONS.some(option => token.startsWith(`${option}=`));
+}
+
+let credentialArgvSeen = false;
+let credentialValues: string[] = [];
+let consoleScrubInstalled = false;
+
+/** Operands of credential options in argv, longest first; very short values are not scrubbed. */
+function credentialOperands(argv: readonly string[]): string[] {
+  const values = new Set<string>();
+  for (let index = 0; index < argv.length; index++) {
+    const token = argv[index] as string;
+    const inline = SECRET_OPTIONS.find(option => token.startsWith(`${option}=`));
+    let value: string | undefined;
+    if (inline) value = token.slice(inline.length + 1);
+    else if (SECRET_OPTIONS.includes(token)) {
+      value = argv[argv[index + 1] === "--" ? index + 2 : index + 1];
+      // A following bare credential option is not this option's operand; its own operand is
+      // collected on its turn. An inline value is always an operand, whatever it looks like.
+      if (value !== undefined && SECRET_OPTIONS.includes(value)) value = undefined;
+    }
+    if (value !== undefined && value.length >= 4) values.add(value);
+  }
+  return [...values].sort((a, b) => b.length - a.length);
+}
+
+/** Replace every argv credential operand in text printed by this process. */
+export function scrubCredentialOperands(text: string): string {
+  let out = text;
+  // Case-insensitive: some parsers lowercase an action before echoing it.
+  for (const value of credentialValues) out = out.replace(new RegExp(value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "gi"), "<redacted>");
+  return out;
+}
+
+/**
+ * Last-line guard for console diagnostics (stderr): parsers that echo a selector, an unknown
+ * subcommand or a leftover before any redaction would otherwise print an operand typed after
+ * a credential option. Installed once; it reads the operands recorded for the current argv.
+ */
+function installConsoleScrub(): void {
+  if (consoleScrubInstalled) return;
+  consoleScrubInstalled = true;
+  // Diagnostics only: stdout carries JSON documents whose primitives must not be rewritten.
+  for (const method of ["warn", "error"] as const) {
+    const original = console[method].bind(console);
+    console[method] = (...args: unknown[]) => {
+      if (credentialValues.length === 0) return original(...args);
+      return original(...args.map(arg => typeof arg === "string" ? scrubCredentialOperands(arg)
+        : arg instanceof Error ? scrubCredentialOperands(arg.stack ?? arg.message) : arg));
+    };
+  }
+}
+
+/**
+ * Record whether the process argv carried any credential option. Parsers that take
+ * positionals can consume the option token itself (`ocx account use openai --token X`
+ * makes `--token` the id), leaving only its operand as a "leftover"; once a credential
+ * option was present anywhere, every bare leftover is reported as `<redacted>`.
+ */
+export function noteCredentialArgv(argv: readonly string[]): void {
+  credentialArgvSeen = argv.some(isSecretOptionToken);
+  credentialValues = credentialOperands(argv);
+  if (credentialValues.length > 0) installConsoleScrub();
+}
+
+/**
+ * Replace credential values before they are reported back.
+ *
+ * Both spellings have to be covered, and the space-separated one spans two
+ * tokens: mistyping `ocx account cancel <p> --code <secret>` on a command that
+ * does not parse `--code` leaves the flag AND its value in the leftovers, and
+ * reporting them verbatim writes the credential to stderr. Repeating the
+ * option does the same with the second value, since the parser takes only the
+ * first occurrence.
+ *
+ * The token after the option is redacted whatever it looks like. Skipping
+ * `--`-prefixed tokens read as "that is a flag, not a value", but the shell
+ * hands over whatever was typed: `--code --SUPERSECRET` and
+ * `--code -- SUPERSECRET` both put the credential straight in the message. A
+ * mistaken `--code --json` now reads `--code <redacted>`, which is worse
+ * diagnostics for a case that already prints the usage text, and better than
+ * printing a credential.
+ *
+ * `redactValues` extends that to bare leftovers, for commands whose positional
+ * argument is itself a credential.
+ */
+export function redactSecretArgs(args: string[], redactValues = false): string[] {
+  redactValues ||= credentialArgvSeen;
+  const out: string[] = [];
+  for (let index = 0; index < args.length; index++) {
+    const arg = args[index] as string;
+    const inline = SECRET_OPTIONS.find(option => arg.startsWith(`${option}=`));
+    if (inline) {
+      out.push(`${inline}=<redacted>`);
+      continue;
+    }
+    if (SECRET_OPTIONS.includes(arg)) {
+      out.push(arg);
+      // Swallow the value that belongs to it. `--` is an end-of-options
+      // separator, so the value is the token after it.
+      let valueIndex = index + 1;
+      if (args[valueIndex] === "--") {
+        out.push("--");
+        valueIndex++;
+      }
+      const next = args[valueIndex];
+      // A following credential option is not this option's value: leave it for the
+      // next iteration so its own operand is redacted too (`--code --token SECRET`).
+      if (next !== undefined && !isSecretOptionToken(next)) {
+        out.push("<redacted>");
+        index = valueIndex;
+      } else if (next !== undefined) {
+        index = valueIndex - 1;
+      }
+      continue;
+    }
+    out.push(redactValues && !arg.startsWith("-") ? "<redacted>" : arg);
+  }
+  return out;
+}

package/src/cli/settings-result.ts

@@ -0,0 +1,30 @@
+import { printData } from "./runtime-api";
+import type { CodexDesktopSwitchApply, CodexDesktopSwitchApplyReason } from "../codex/desktop-switches";
+
+const APPLY_REASONS = {
+  not_requested: true, proxy_not_running: true, integration_disabled: true,
+  external_provider: true, ownership_undetermined: true, write_lock_busy: true, injection_refused: true,
+} satisfies Record<CodexDesktopSwitchApplyReason, true>;
+
+/** The shared native apply DTO, excluding exception/path detail. */
+export function projectSettingsApply(value: unknown): CodexDesktopSwitchApply | null {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const row = value as Record<string, unknown>;
+  if (row.applied === true) return { applied: true };
+  if (row.applied !== false || typeof row.reason !== "string" || !Object.hasOwn(APPLY_REASONS, row.reason)
+    || typeof row.retryable !== "boolean") return null;
+  return { applied: false, reason: row.reason as CodexDesktopSwitchApplyReason, retryable: row.retryable };
+}
+
+/** Caller rebuilds the relevant task DTO; settings pending is not a CatalogDisposition. */
+export function printSettingsResult(
+  data: Record<string, unknown>, pending: unknown, wantsJson: boolean, lines: readonly string[],
+): number {
+  const verified = typeof pending === "boolean";
+  const note = !verified ? "Settings were accepted; catalog status is unverified. Read back before retrying."
+    : pending ? "Settings saved; catalog refresh is pending."
+      : "Settings saved; this response reports no pending catalog refresh.";
+  printData({ ...data, catalogRefreshPending: verified ? pending : null,
+    ...(!verified ? { verification: "unverified" } : {}) }, wantsJson, [...lines, note]);
+  return verified && pending === false ? 0 : 1;
+}

package/src/cli/storage.ts

@@ -17,6 +17,7 @@
  */
 import {
   CliUsageError,
+  RuntimeApiError,
   printData,
   rejectArgs,
   runCliAction,
@@ -27,6 +28,7 @@ import {
   takeOption,
   type RuntimeApiDeps,
 } from "./runtime-api";
+import type { StorageCleanupPolicy } from "../types/config";
 
 const USAGE = `Usage:
   ocx storage report [--json]
@@ -34,7 +36,8 @@ const USAGE = `Usage:
   ocx storage trash [list] [--json]
   ocx storage trash restore <entry-id> [--yes] [--json]
   ocx storage policy [show] [--json]
-  ocx storage policy set [--enabled <true|false>] [--percent <0-100>]
+  ocx storage policy set [--enabled <true|false>] [--archived-bytes-over <bytes>]
+      [--reduce-to-bytes <bytes> | --remove-oldest-percent <1-100> | --percent <1-100>]
       [--mode <quarantine|permanent>] [--schedule <startup|daily|weekly|manual>] [--json]
   ocx storage policy run [--yes] [--json]
 
@@ -146,6 +149,41 @@ async function trash(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   printData(result, wantsJson, summaryLines(result));
 }
 
+/** New policy controls expose only observed settings and job status, never arbitrary API fields. */
+type ObservedPolicy = Omit<StorageCleanupPolicy, "target"> & { target: { reduceToBytes: number } | { removeOldestPercent: number } };
+function policyWriteReceipt(value: unknown): { ok: true; policy: ObservedPolicy; job: { status: "idle" | "running" } } {
+  const record = (item: unknown): item is Record<string, unknown> => item !== null && typeof item === "object" && !Array.isArray(item);
+  const count = (item: unknown): item is number => typeof item === "number" && Number.isInteger(item) && item >= 0;
+  const invalid = (): never => { throw new Error("Invalid storage policy response; inspect the policy before retrying."); };
+  if (!record(value) || value.ok !== true || !record(value.policy) || !record(value.job)) return invalid();
+  const source = value.policy;
+  if (typeof source.enabled !== "boolean" || !record(source.trigger) || !count(source.trigger.archivedBytesOver)
+    || !record(source.target) || (source.mode !== "quarantine" && source.mode !== "permanent")
+    || (source.schedule !== "startup" && source.schedule !== "daily" && source.schedule !== "weekly" && source.schedule !== "manual")
+    || (value.job.status !== "idle" && value.job.status !== "running")) return invalid();
+  const { reduceToBytes, removeOldestPercent } = source.target;
+  let target: ObservedPolicy["target"];
+  if (count(reduceToBytes) && removeOldestPercent === undefined) target = { reduceToBytes };
+  else if (count(removeOldestPercent) && removeOldestPercent >= 1 && removeOldestPercent <= 100 && reduceToBytes === undefined) target = { removeOldestPercent };
+  else return invalid();
+  const policy: ObservedPolicy = {
+    enabled: source.enabled,
+    trigger: { archivedBytesOver: source.trigger.archivedBytesOver },
+    target,
+    mode: source.mode,
+    schedule: source.schedule,
+  };
+  if (source.lastRun !== undefined) {
+    if (!record(source.lastRun) || !count(source.lastRun.at) || !count(source.lastRun.freedBytes) || !count(source.lastRun.removed)) return invalid();
+    policy.lastRun = { at: source.lastRun.at, freedBytes: source.lastRun.freedBytes, removed: source.lastRun.removed };
+  }
+  if (source.nextRun !== undefined) {
+    if (!count(source.nextRun)) return invalid();
+    policy.nextRun = source.nextRun;
+  }
+  return { ok: true, policy, job: { status: value.job.status } };
+}
+
 async function policy(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const action = argv[0] && !argv[0].startsWith("-") ? argv[0] : "show";
   const rest = argv[0] && !argv[0].startsWith("-") ? argv.slice(1) : argv;
@@ -164,6 +202,9 @@ async function policy(argv: string[], deps: RuntimeApiDeps): Promise<void> {
     const wantsJson = takeFlag(args, "--json");
     const enabled = takeOption(args, "--enabled");
     const percent = takeIntegerOption(args, "--percent", { min: 0 });
+    const removeOldestPercent = takeIntegerOption(args, "--remove-oldest-percent", { min: 0 });
+    const reduceToBytes = takeIntegerOption(args, "--reduce-to-bytes", { min: 0 });
+    const archivedBytesOver = takeIntegerOption(args, "--archived-bytes-over", { min: 0 });
     const mode = takeOption(args, "--mode");
     const schedule = takeOption(args, "--schedule");
     rejectArgs(args, USAGE);
@@ -171,8 +212,13 @@ async function policy(argv: string[], deps: RuntimeApiDeps): Promise<void> {
     if (enabled !== undefined && enabled !== "true" && enabled !== "false") {
       throw new CliUsageError("--enabled must be true or false", USAGE);
     }
+    if ([percent, removeOldestPercent, reduceToBytes].filter(value => value !== undefined).length > 1) {
+      throw new CliUsageError("choose one target: --percent, --remove-oldest-percent or --reduce-to-bytes", USAGE);
+    }
+    const extended = archivedBytesOver !== undefined || reduceToBytes !== undefined || removeOldestPercent !== undefined;
     const body: Record<string, unknown> = {};
     if (enabled !== undefined) body.enabled = enabled === "true";
+    if (archivedBytesOver !== undefined) body.trigger = { archivedBytesOver };
     // The policy target is nested. A top-level `percent` is not part of the PUT contract:
     // `normalizeStorageCleanupPolicy` reads only `target`, so the field was dropped and the
     // previously stored target survived. `--percent 10` on a policy still holding the
@@ -183,20 +229,44 @@ async function policy(argv: string[], deps: RuntimeApiDeps): Promise<void> {
     // vocabulary and answers with a named 400, which is a rejected write rather than the
     // silent wrong write this replaces.
     if (percent !== undefined) body.target = { removeOldestPercent: percent };
+    if (removeOldestPercent !== undefined) body.target = { removeOldestPercent };
+    if (reduceToBytes !== undefined) body.target = { reduceToBytes };
     if (mode !== undefined) body.mode = mode;
     if (schedule !== undefined) body.schedule = schedule;
     if (Object.keys(body).length === 0) {
-      throw new CliUsageError("policy set needs at least one of --enabled, --percent, --mode, --schedule", USAGE);
+      throw new CliUsageError("policy set needs at least one policy field", USAGE);
     }
     // Values are NOT re-validated here beyond --enabled's shape. The server owns the mode and
     // schedule vocabularies and returns a named 400; duplicating them is a second thing to
     // keep in sync. `enabled` is checked because "--enabled maybe" would otherwise be sent as
     // `false`, which is a wrong write rather than a rejected one.
-    const result = await runtimeRequest("/api/storage/cleanup-policy", {
-      method: "PUT",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify(body),
-    }, deps);
+    let result: unknown;
+    try {
+      result = await runtimeRequest("/api/storage/cleanup-policy", {
+        method: "PUT",
+        ...(extended ? { redirect: "error" as const } : {}),
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body),
+      }, deps);
+    } catch (error) {
+      if (!extended) throw error;
+      if (error instanceof RuntimeApiError) {
+        throw new RuntimeApiError(`Storage policy request failed (${error.status}); inspect the policy before retrying.`, error.status, null);
+      }
+      throw new Error("Storage policy request failed; inspect the policy before retrying.");
+    }
+    if (extended) {
+      const receipt = policyWriteReceipt(result);
+      const saved = receipt.policy;
+      printData(receipt, wantsJson, [
+        "Policy saved. This command did not start cleanup.",
+        `Enabled: ${saved.enabled}`,
+        `Trigger: archived bytes over ${saved.trigger.archivedBytesOver}`,
+        "reduceToBytes" in saved.target ? `Target: reduce archives to ${saved.target.reduceToBytes} bytes` : `Target: remove oldest ${saved.target.removeOldestPercent}%`,
+        `Mode: ${saved.mode}; schedule: ${saved.schedule}; job: ${receipt.job.status}`,
+      ]);
+      return;
+    }
     printData(result, wantsJson, summaryLines(result));
     return;
   }

package/src/cli/system-command.ts

@@ -1,3 +1,4 @@
+import { runCatalogAction } from "./catalog-command-result";
 import {
   CliUsageError,
   desktopSwitchApplyReason,
@@ -14,8 +15,11 @@ import {
 
 const USAGE = `Usage:
   ocx system [status] [--json]
+  ocx system health [--json]
   ocx system settings [--auto-start <on|off>] [--stream-mode <auto|legacy-tee|eager-relay>]
-      [--desktop-authless <on|off>] [--client-compaction <on|off>] [--json]
+      [--desktop-authless <on|off>] [--client-compaction <on|off>]
+      [--show-codex-credits <on|off>] [--account-picker <on|off>] [--main-account-hard-lock <on|off>]
+      [--ultra-fast-tier <on|off>] [--fast-rows <on|off>] [--json]
   ocx system startup <health|install-service|install-shim> [--json]
   ocx system diagnostics [--json]
   ocx system sync [--json]
@@ -45,6 +49,46 @@ async function status(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   printData(result, wantsJson, summaryLines(result));
 }
 
+/** The management health observation is distinct from root liveness and aggregate status. */
+async function health(argv: string[], deps: RuntimeApiDeps): Promise<number> {
+  return runCatalogAction(async () => {
+    const args = [...argv], wantsJson = takeFlag(args, "--json");
+    if (args.length) throw new CliUsageError("system health accepts only --json", USAGE);
+    const raw = await runtimeRequest("/api/system/health", { method: "GET", redirect: "error" }, deps);
+    const value = recordValue(raw), ledger = recordValue(value?.spendLedger);
+    const counter = (number: unknown): number => {
+      if (typeof number !== "number" || !Number.isSafeInteger(number) || number < 0 || number > 1_000_000) {
+        throw new Error("Invalid health counter");
+      }
+      return number;
+    };
+    if (!value || Array.isArray(raw) || !ledger || Array.isArray(value.spendLedger)
+      || value.status !== "ok" || value.service !== "opencodex"
+      || typeof value.version !== "string" || !value.version.trim()
+      || typeof value.uptime !== "number" || !Number.isFinite(value.uptime) || value.uptime < 0
+      || typeof value.pid !== "number" || !Number.isSafeInteger(value.pid) || value.pid <= 0
+      || (ledger.ownership !== "held" && ledger.ownership !== "unheld")
+      || typeof ledger.initialized !== "boolean" || typeof ledger.configured !== "boolean"
+      || typeof ledger.degraded !== "boolean") throw new Error("Invalid system health response");
+    const result = {
+      status: "ok", service: "opencodex", version: value.version, uptime: value.uptime, pid: value.pid,
+      spendLedger: {
+        ownership: ledger.ownership, initialized: ledger.initialized, configured: ledger.configured,
+        degraded: ledger.degraded, persistFailures: counter(ledger.persistFailures), corruptRecords: counter(ledger.corruptRecords),
+      },
+    };
+    printData(result, wantsJson, [
+      `Management endpoint: ${result.status} (${result.service} ${result.version}, PID ${result.pid})`,
+      `Uptime: ${result.uptime} seconds`,
+      `Spend ledger: ${ledger.degraded ? "degraded" : "no degradation reported"}; ownership ${ledger.ownership}`,
+      `Ledger initialized: ${ledger.initialized}; configured: ${ledger.configured}`,
+      `Ledger persistence failures: ${result.spendLedger.persistFailures}; corrupt records: ${result.spendLedger.corruptRecords}`,
+      "This observation does not certify every subsystem healthy.",
+      ...(ledger.degraded ? ["Next: inspect the proxy diagnostics and spend-ledger configuration before relying on spend limits."] : []),
+    ]);
+  });
+}
+
 function recordValue(value: unknown): Record<string, unknown> | undefined {
   return value !== null && typeof value === "object" ? value as Record<string, unknown> : undefined;
 }
@@ -187,11 +231,25 @@ async function update(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   if (!yes) throw new CliUsageError("update run requires --yes", USAGE);
   rejectArgs(args, USAGE);
   const result = await runtimeRequest("/api/update/run", { method: "POST", body: JSON.stringify({ tag: channel, restart }) }, deps);
-  printData(result, wantsJson, [`Update started (${channel}).`]);
+  const job = recordValue(recordValue(result)?.job);
+  const jobId = typeof job?.id === "string" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/.test(job.id) ? job.id : undefined;
+  const jobStatus = ["running", "restarting", "succeeded", "failed"].find(state => state === job?.status);
+  const lines = jobId ? [
+    `Update job ${jobId}: ${jobStatus ?? "status unconfirmed"} (${channel}).`,
+    `Check progress: ocx system update status ${jobId}`,
+  ] : ["Update request returned no usable job ID. Check: ocx system update check."];
+  printData(result, wantsJson, lines);
 }
 
 export async function handleSystemCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
   const [sub = "status", ...rest] = argv;
+  if (sub === "health") return health(rest, deps);
+  if (sub === "settings") {
+    const { SYSTEM_PARITY_OPTIONS, handleSystemSettingsParity } = await import("./system-settings-parity");
+    if (rest.some(arg => SYSTEM_PARITY_OPTIONS.some(flag => arg === flag || arg.startsWith(`${flag}=`)))) {
+      return handleSystemSettingsParity(rest, deps);
+    }
+  }
   if (sub === "codex-cli-update") {
     const { handleCodexCliUpdateCommand } = await import("./codex-cli-update");
     return await handleCodexCliUpdateCommand(rest);

package/src/cli/system-restart-client.ts

@@ -26,6 +26,8 @@ import {
 import type { ProxyRestartRequestOutcome } from "./tray-proxy";
 import { packageVersion } from "./help";
 import { computeVersionSkew } from "./version-skew";
+import { readUpdateRestartHome } from "./update-restart-home";
+import { UpdateRestartRequired } from "./update-restart-candidate";
 
 export const SYSTEM_RESTART_REQUEST_TIMEOUT_MS = 5_000;
 export const SYSTEM_RESTART_ATTESTATION_TIMEOUT_MS = 4_000;
@@ -38,6 +40,7 @@ export interface BoundSystemRestartDeps {
   now?: () => number;
   /** Invoking CLI version for the skew guard; defaults to this bundle's package version. */
   cliVersion?: string;
+  readUpdateHome?: typeof readUpdateRestartHome;
 }
 
 function rejected(code: string): ProxyRestartRequestOutcome {
@@ -90,6 +93,8 @@ export async function requestBoundSystemRestart(
     return rejected("restart_target_runtime_mismatch");
   }
 
+  let updateHome: ReturnType<typeof readUpdateRestartHome> | undefined;
+  try { updateHome = (deps.readUpdateHome ?? readUpdateRestartHome)(); } catch { /* normal in-place restart remains available */ }
   const attestationBudget = remaining(deadlineAt, now, SYSTEM_RESTART_ATTESTATION_TIMEOUT_MS);
   if (attestationBudget <= 0) return rejected("restart_deadline_expired");
 
@@ -143,9 +148,9 @@ export async function requestBoundSystemRestart(
   const proxyVersion = fenced
     ? body.installedVersion as string
     : typeof body.version === "string" ? body.version : undefined;
-  if (computeVersionSkew(deps.cliVersion ?? ownCliVersion(), proxyVersion).skewed) {
-    return rejected("restart_version_skew");
-  }
+  const cliVersion = deps.cliVersion ?? ownCliVersion();
+  const skew = computeVersionSkew(cliVersion, proxyVersion);
+  if (skew.skewed && skew.relation !== "cli-newer") return rejected("restart_version_skew");
 
   let observed: LiveProxy | null;
   try {
@@ -154,6 +159,18 @@ export async function requestBoundSystemRestart(
     return rejected("restart_target_recheck_failed");
   }
   if (!sameRestartTarget(target, observed)) return rejected("restart_target_changed");
+  if (skew.relation === "cli-newer") {
+    if (!updateHome) return rejected("update_restart_home_unverified");
+    const current = readRuntime(target.pid);
+    if (!current || current.pid !== runtime.pid || current.port !== runtime.port
+      || current.hostname !== runtime.hostname || current.attestationSecret !== runtime.attestationSecret) {
+      return rejected("restart_target_changed");
+    }
+    return { accepted: false, uncertain: false, error: new UpdateRestartRequired({
+      target: { ...target, pid: target.pid, version: proxyVersion },
+      runtime: { ...runtime, attestationSecret: runtime.attestationSecret }, cliVersion, home: updateHome,
+    }) };
+  }
 
   const capability = createSystemRestartCapability(
     runtime.attestationSecret,

package/src/cli/system-settings-parity.ts

@@ -0,0 +1,83 @@
+import { runCatalogAction } from "./catalog-command-result";
+import { serializeManagementJson } from "./json-input";
+import { printSettingsResult, projectSettingsApply } from "./settings-result";
+import { CliUsageError, runtimeBaseUrl, runtimeRequest, takeFlag, takeOptionWithSyntax, type RuntimeApiDeps } from "./runtime-api";
+
+export const SYSTEM_PARITY_OPTIONS = ["--show-codex-credits", "--account-picker", "--main-account-hard-lock", "--ultra-fast-tier", "--fast-rows"] as const;
+const BOOLEAN_FIELDS: Readonly<Record<string, string>> = {
+  "--show-codex-credits": "showCodexCredits", "--account-picker": "codexAccountPickerEnabled",
+  "--main-account-hard-lock": "codexMainAccountHardLock", "--ultra-fast-tier": "ultraFastTier", "--fast-rows": "fastRows",
+  "--auto-start": "codexAutoStart", "--desktop-authless": "codexDesktopAuthless", "--client-compaction": "codexClientCompaction",
+};
+function record(value: unknown): value is Record<string, unknown> {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function boolean(raw: string, option: string): boolean {
+  if (["on", "true", "yes", "1", "enabled"].includes(raw.toLowerCase())) return true;
+  if (["off", "false", "no", "0", "disabled"].includes(raw.toLowerCase())) return false;
+  throw new CliUsageError(`${option} must be on or off`);
+}
+function desktopState(value: unknown): Record<string, unknown> | null {
+  if (!record(value) || typeof value.stored !== "boolean" || (value.effective !== null && typeof value.effective !== "boolean")
+    || (value.inertReason !== undefined && value.inertReason !== "client_role" && value.inertReason !== "non_loopback_bind_requires_admission_token")) return null;
+  return { stored: value.stored, effective: value.effective, ...(value.inertReason ? { inertReason: value.inertReason } : {}) };
+}
+
+/** New-option writes; the original no-new-option settings output remains compatible. */
+export async function handleSystemSettingsParity(argsInput: string[], deps: RuntimeApiDeps = {}): Promise<number> {
+  return runCatalogAction(async () => {
+    const args = [...argsInput], wantsJson = takeFlag(args, "--json");
+    const body: Record<string, unknown> = {};
+    for (const [option, field] of Object.entries(BOOLEAN_FIELDS)) {
+      const value = takeOptionWithSyntax(args, option)?.value;
+      if (value !== undefined) body[field] = boolean(value, option);
+    }
+    const mode = takeOptionWithSyntax(args, "--stream-mode")?.value;
+    if (mode !== undefined) {
+      if (!["auto", "legacy-tee", "eager-relay"].includes(mode)) throw new CliUsageError("Invalid --stream-mode");
+      body.streamMode = mode;
+    }
+    if (args.length || !Object.keys(body).length) throw new CliUsageError("Provide supported system setting options and optional --json");
+    const pinned = { ...deps, baseUrl: await runtimeBaseUrl(deps) };
+    const response = await runtimeRequest("/api/settings", { method: "PUT", redirect: "error", body: serializeManagementJson(body) }, pinned);
+    if (!record(response) || response.ok !== true) throw new Error("Invalid settings receipt");
+    const observed: Record<string, unknown> = {};
+    const unverified: string[] = [];
+    for (const [key, requested] of Object.entries(body)) {
+      if (key === "ultraFastTier") continue;
+      const actual = response[key];
+      if (typeof actual === typeof requested && (key !== "streamMode" || ["auto", "legacy-tee", "eager-relay"].includes(actual as string))) observed[key] = actual;
+      if (actual !== requested) unverified.push(key);
+    }
+    if (Object.hasOwn(body, "ultraFastTier")) {
+      try {
+        const readBack = await runtimeRequest("/api/settings", { redirect: "error" }, pinned);
+        if (record(readBack) && typeof readBack.ultraFastTier === "boolean") observed.ultraFastTier = readBack.ultraFastTier;
+      } catch { /* Acceptance already happened; retain safe unknown verification, not raw error. */ }
+      if (observed.ultraFastTier !== body.ultraFastTier) unverified.push("ultraFastTier");
+    }
+    const data: Record<string, unknown> = { ok: true, settings: observed };
+    let nativePending = false;
+    if (Object.hasOwn(body, "codexDesktopAuthless") || Object.hasOwn(body, "codexClientCompaction")) {
+      const switches = record(response.codexDesktopSwitches) ? response.codexDesktopSwitches : {};
+      const report: Record<string, unknown> = {};
+      for (const key of ["codexDesktopAuthless", "codexClientCompaction"]) {
+        if (!Object.hasOwn(body, key)) continue;
+        const state = desktopState(switches[key]);
+        if (state) report[key] = state; else unverified.push(`${key}.effective`);
+      }
+      const apply = projectSettingsApply(switches.apply);
+      if (apply) {
+        report.apply = apply;
+        nativePending = !apply.applied && apply.reason !== "not_requested";
+      } else unverified.push("desktopApply");
+      data.desktop = report;
+    }
+    if (unverified.length) { data.verification = "unverified"; data.unverifiedFields = unverified; }
+    const lines = ["System settings accepted.", ...Object.entries(observed).map(([key, value]) => `${key}: ${value}`)];
+    if (unverified.length) lines.push(`Read-back is unverified for: ${unverified.join(", ")}.`);
+    if (nativePending) lines.push("Native client application is deferred or refused; the settings remain saved.");
+    const pendingCode = printSettingsResult(data, response.catalogRefreshPending, wantsJson, lines);
+    return unverified.length || nativePending ? 1 : pendingCode;
+  });
+}

package/src/cli/tray-proxy.ts

@@ -128,11 +128,12 @@ export function reobserveRestartReplacement(
   deadlineAt: number,
   observe: (end: number) => Promise<ProxyRestartDiscovery>,
 ): Promise<ProxyRestartDiscovery> {
-  const windowMs = Math.min(5_000, deadlineAt - Date.now());
+  const now = Date.now();
+  const windowMs = Math.min(5_000, deadlineAt - now);
   if (windowMs < 1_500) return Promise.resolve({
     status: "uncertain", error: new Error("restart_reobserve_window_exhausted"),
   });
-  const end = Date.now() + windowMs;
+  const end = now + windowMs;
   return pollReplacementDeparture(() => observe(end), previous, () => Date.now() + 750 < end, () => Bun.sleep(250));
 }
 

package/src/cli/update-restart-candidate.ts

@@ -0,0 +1,21 @@
+import type { RuntimePortState } from "../config/process-state";
+import type { LiveProxy } from "../server/proxy-liveness";
+
+import type { UpdateRestartHome } from "./update-restart-home";
+
+export interface UpdateRestartCandidate {
+  home: UpdateRestartHome;
+  target: LiveProxy & { pid: number };
+  runtime: RuntimePortState & { attestationSecret: string };
+  cliVersion: string;
+}
+
+/** Private in-process evidence; diagnostics and JSON never expose the proof key. */
+export class UpdateRestartRequired extends Error {
+  #candidate: UpdateRestartCandidate;
+  constructor(candidate: UpdateRestartCandidate) {
+    super("restart_version_skew_cli_newer");
+    this.#candidate = candidate;
+  }
+  candidate(): UpdateRestartCandidate { return this.#candidate; }
+}