@bitkyc08/opencodex 2.78.0 → 2.79.0

package/src/generated/compatibility-version.json

@@ -6,11 +6,11 @@
   "files": [
     {
       "path": "bun.lock",
-      "sha256": "2dc53f5af56ecbf269cb692769b4c9910f9d1aa1d7658ae4deb66444129fcdfd"
+      "sha256": "c065612db20131683fd657dce98b6c51745ed9fadfeb56ea0c3edd823da39cc4"
     },
     {
       "path": "package.json",
-      "sha256": "c429f802391480166ada348d017be8e45411aa92891dabc46bf332ea9ad6a999"
+      "sha256": "90cabe2689a17d5376a3d50526cbe2a6b4f5a441dd829476770e14aacda15281"
     },
     {
       "path": "scripts/model-metadata.source.json",
@@ -354,7 +354,7 @@
     },
     {
       "path": "src/adapters/devin.ts",
-      "sha256": "dfa109ecb5c4ad95c29a4713ff6245244ac731868d90436af4b3a13ad3b87a56"
+      "sha256": "13c4afa1f3789e63ef73563ab56503970e38dc40c697877e81be8d4cc1e7c734"
     },
     {
       "path": "src/adapters/devin/cloud-direct/auth.ts",
@@ -882,7 +882,7 @@
     },
     {
       "path": "src/claude/desktop-picker.ts",
-      "sha256": "d10d6826b572f12f8f6b27facaa80fac7c0d98812ebb4e658f8978d10f12a687"
+      "sha256": "84502b1936f7ecbac709ada0ab4abb1407bb4f45bcf72d91ed7388e58a82e070"
     },
     {
       "path": "src/claude/desktop-policy.ts",
@@ -934,7 +934,7 @@
     },
     {
       "path": "src/claude/inbound-content-options.ts",
-      "sha256": "47a9c490be54035a89d65bbbd936685d51f14fb2511c8429d20a961154be7f9e"
+      "sha256": "d8ee5df821f9d6a1b2836bb52a8390c54b69aa57bebbcd3fa7ac2ebb505fc7f6"
     },
     {
       "path": "src/claude/inbound-debug.ts",
@@ -976,9 +976,17 @@
       "path": "src/claude/intercept/listener.ts",
       "sha256": "20d0cb9b82824ed156a771498a423d8be04a972e6447dd935e0ebf66569eb062"
     },
+    {
+      "path": "src/claude/intercept/local-ca-files.ts",
+      "sha256": "a044ed31ce54ee5b77622973c77204c9426e96d3c8291075f12fb680a787bce5"
+    },
+    {
+      "path": "src/claude/intercept/local-ca-windows.ts",
+      "sha256": "d637cdf4d2a84b6071bc8710e4c7c05f292548138208569e69b8d600ae35e462"
+    },
     {
       "path": "src/claude/intercept/local-ca.ts",
-      "sha256": "5344c5e90053515dfd8f6efe04180f0f96f66fadd1d4d20e96568a0592070919"
+      "sha256": "b078505389400efd1e1b36a517becde644d9e9193492a9b17e5edd2ea6e691cf"
     },
     {
       "path": "src/claude/intercept/model-bindings.ts",
@@ -996,9 +1004,21 @@
       "path": "src/claude/intercept/picker-ca-cleanup.ts",
       "sha256": "11166443791f3b0578c3fdcea3d91c6b127ddf2ec4df36b678173b9fc2e410a1"
     },
+    {
+      "path": "src/claude/intercept/picker-ca-persistence.ts",
+      "sha256": "09d04582cb9d04a20e54f2c066345ed59df42671b233dc7c606061af9b1794e3"
+    },
+    {
+      "path": "src/claude/intercept/picker-ca-startup.ts",
+      "sha256": "301a018a6202c5f5a900e667b89427805ddf70a4c114b0b82425da2f37b63eeb"
+    },
+    {
+      "path": "src/claude/intercept/picker-ca-store.ts",
+      "sha256": "229a7d567e85679018443d91b6c8b1b4a9e365887dd324df31d6bfda58156d5d"
+    },
     {
       "path": "src/claude/intercept/picker-ca.ts",
-      "sha256": "4afa56ccad7adf07082dbf49ac0c46b8f75a678b50f28bcbb5e5237a812c6c93"
+      "sha256": "f01671b033809904a8024e2344d32f1e531792ee0ba43c1a337e538dcf9869a7"
     },
     {
       "path": "src/claude/intercept/picker-listener.ts",
@@ -1010,7 +1030,7 @@
     },
     {
       "path": "src/claude/intercept/picker-runtime.ts",
-      "sha256": "239680f4c0010c09fc7c3eedca791d4e5cc65d4b7e2a261d5107cbf7ce29ae96"
+      "sha256": "53a9cca52259bbac84d8cdfa1962f042e7fe7537e11021ccd3e356bdc3e83216"
     },
     {
       "path": "src/claude/intercept/picker-trust.ts",
@@ -1022,7 +1042,7 @@
     },
     {
       "path": "src/claude/intercept/runtime.ts",
-      "sha256": "a6b12bc624a8add7556a57eafef5fb5d23955faa97200a440970f994ee398a76"
+      "sha256": "5e6c4f3c925b9bf9513b257d86db3a04b0bed2acadfbcddebda1c5cc015efc7c"
     },
     {
       "path": "src/claude/intercept/settings.ts",
@@ -1320,17 +1340,21 @@
       "path": "src/cli/ensure-desired-integrations.ts",
       "sha256": "dee843db093485031b339fd1528ed3c4ebc3d3fac5be53cdbff47482d374bc8a"
     },
+    {
+      "path": "src/cli/ensure-readiness.ts",
+      "sha256": "6cbd94430f73cc6ac5c2d038098e697da75e95ee21ea05537f73f59fb2b72591"
+    },
     {
       "path": "src/cli/export-command.ts",
       "sha256": "ae2732e794d511e7f74005e8328e6c288e41e1b7d532f1dced796d4e5283992b"
     },
     {
       "path": "src/cli/gui-pair-client.ts",
-      "sha256": "bb889bbffb9df45d4140c39ec99c4f0576ac5b9fb6bc081cc7c33729dcc8fadc"
+      "sha256": "e149579629cabf46463367cc2b9b42337baa4a796c3059b106824c3d56089e31"
     },
     {
       "path": "src/cli/gui.ts",
-      "sha256": "07718c3a593b4db052992b30546b91cf69df521bd3be5a4eb1fb796fd2775b0d"
+      "sha256": "dd27180892a3134be24dfbc525deacd20fca2c83d8f722cf41dc6cba74c3e9bf"
     },
     {
       "path": "src/cli/help-catalog.ts",
@@ -1354,11 +1378,11 @@
     },
     {
       "path": "src/cli/hub.ts",
-      "sha256": "9deda8595eff11f751510d662de9ed15327c31a142b9c03c21fae6fa1e7995ba"
+      "sha256": "664d1cb26e67dbba38753bf0ce105f0c45816723cbc63f489dc16b96a0fe398c"
     },
     {
       "path": "src/cli/index.ts",
-      "sha256": "ab158db7999cb12f2c74a5f101f0067d48cce13fb3a507a83f8083647eee06d4"
+      "sha256": "9bd93af4b7913ce722e0d51b2bb9241774335d289eddf7047a7c1ccc2346a19f"
     },
     {
       "path": "src/cli/init.ts",
@@ -1594,7 +1618,7 @@
     },
     {
       "path": "src/cli/status.ts",
-      "sha256": "422a1b231ab77cd73ba0001bc900db499a7c464b27c07a2032365f412258a146"
+      "sha256": "4ef524e96c37bab4708b1de62e8069c2dd40c75ca05946e9375cf34ce5c15912"
     },
     {
       "path": "src/cli/stop-approval.ts",
@@ -1646,7 +1670,7 @@
     },
     {
       "path": "src/cli/update-restart-child.ts",
-      "sha256": "169ef469662dbdbeebefff8b4c7ef3a6663763666abce1d693afdee732c93c25"
+      "sha256": "e034981d71828d0a4d743e768207742101813749998574fa0dfab9616110c820"
     },
     {
       "path": "src/cli/update-restart-home.ts",
@@ -1846,7 +1870,7 @@
     },
     {
       "path": "src/codex/account-credit-use.ts",
-      "sha256": "4bc92e2e006618fab75b460a937dda1fb34b7eb2e29f7a5687c87a80470cde3e"
+      "sha256": "5eea9770afa87ee4683e7111137fed2fdd37530c5c1cd4f5c3c9124df604475c"
     },
     {
       "path": "src/codex/account-id.ts",
@@ -1916,6 +1940,10 @@
       "path": "src/codex/auth-api/account-list.ts",
       "sha256": "9334a6e895d843ab53f669681821c4eaabb51dc8449ad9d7757da72aa6d91417"
     },
+    {
+      "path": "src/codex/auth-api/account-pause-group.ts",
+      "sha256": "8a4dc18bed84efeb6b35fc2da9822ca266f0635957e31917f2ed4404993983d5"
+    },
     {
       "path": "src/codex/auth-api/http.ts",
       "sha256": "82eeb171e8ca439619ad8a2e0104f250b7268f1e69e5a37ecbab908fe44b925f"
@@ -1946,7 +1974,7 @@
     },
     {
       "path": "src/codex/auth-api/routes.ts",
-      "sha256": "e1cf949c54f9c63141b5a5316d7f5cc9e14a23df45d03ac5ac0898eead022466"
+      "sha256": "691f19febde4e5863537658cef2a03f614af62da5a18acf376bb0e6a4a1ffd22"
     },
     {
       "path": "src/codex/auth-api/runtime-config.ts",
@@ -1958,11 +1986,11 @@
     },
     {
       "path": "src/codex/auth-context.ts",
-      "sha256": "2c8242642dd6f23c6a36bf988dd473b96b5e10133028e32857d219bdf3bbc0b4"
+      "sha256": "769ee5cffce92933f200e923e14dac75b3a98fea0b1bf96f96c254344f6aa032"
     },
     {
       "path": "src/codex/autostart-health.ts",
-      "sha256": "c4ca8ca25b8087a2b6fd8e11c3a41c04a445a381c23b1f720f5ecf813d6c1287"
+      "sha256": "bbd30686f19e73d40e1b3fbdb7cd20d9439459d19b4697c8410dac58bcb1b239"
     },
     {
       "path": "src/codex/catalog-admission.ts",
@@ -2556,6 +2584,10 @@
       "path": "src/codex/plugins-doctor.ts",
       "sha256": "51344b58e99a143d2c7d397481e5b2a26c86ab0a1c61db5b153068793e4d3cab"
     },
+    {
+      "path": "src/codex/pool-credit-policy.ts",
+      "sha256": "7c0d970583cd789a25169867e6ffb30afa770639d9a3101e79eb80b99b8385e5"
+    },
     {
       "path": "src/codex/pool-refresh-backoff.ts",
       "sha256": "6f4e7a8658d8bf7bcb4076a0ebdfbca8b2fec69294fde9c83730615bb9cfb7b4"
@@ -3858,7 +3890,11 @@
     },
     {
       "path": "src/lib/gui-pair-capability.ts",
-      "sha256": "2567d5d0fc153d34c354f6e3bae6355f1bd1e5d272263999ebd6ed8f94d52e87"
+      "sha256": "b1beb3aa9ea5325a89b8a38d404eb6351b421a3af0d7a244ca39b73634c14677"
+    },
+    {
+      "path": "src/lib/gui-pair-intent.ts",
+      "sha256": "1f905ca823d68b14cec4aa3690cadf1eef0d270dd4b1674db414ba4ad652f5d7"
     },
     {
       "path": "src/lib/handled-signal-exit.ts",
@@ -4156,6 +4192,10 @@
       "path": "src/lib/windows-elevation.ts",
       "sha256": "9e82e443b441282b4d38fa7830882de5303a886926793db9813f804c36c99c03"
     },
+    {
+      "path": "src/lib/windows-owner-acl.ts",
+      "sha256": "c45f9756367161f43515e60879fdcc52f096dae4ce4a18657bed70c8ab2f7555"
+    },
     {
       "path": "src/lib/windows-secret-acl.ts",
       "sha256": "3100c8468917e0484c287bb1a6b05b1a74c5916207ddc2dfc63318f17ed0eecd"
@@ -4788,9 +4828,13 @@
       "path": "src/providers/ollama-show.ts",
       "sha256": "b08bfca5a2919ef4ddc8fe8999e663a3220634c21cffcd06bc07c59dae188d0a"
     },
+    {
+      "path": "src/providers/openai-sidecar-credit.ts",
+      "sha256": "52ecdd022dfe4115ea975f0ca39ba18b350ec70794a78c43dfbfde2891e893c6"
+    },
     {
       "path": "src/providers/openai-sidecar.ts",
-      "sha256": "ed078175c3a9f225c07d956bcbaa2a60fb076877ab17a38c64f2cb44a75a2eae"
+      "sha256": "782b962f5ef44ca55352a8a6e5b1ed079d4a5cbeab47ed52a813d811629e6934"
     },
     {
       "path": "src/providers/openai-tier-startup.ts",
@@ -5490,7 +5534,7 @@
     },
     {
       "path": "src/server/claude-messages.ts",
-      "sha256": "430e7cb89d22834ae71a2d06eec970842ed0f17fc2d1a72aa36adf47411a062e"
+      "sha256": "34a498b80ce5f669527662ede39dddae9df6a319e63d47849975ecaa961fe5ea"
     },
     {
       "path": "src/server/context-history.ts",
@@ -5536,6 +5580,10 @@
       "path": "src/server/gui-freshness.ts",
       "sha256": "e9ac2c6e6eb61384acac7626b77dc29439a899b0bac953b1152b5ba4d804d4da"
     },
+    {
+      "path": "src/server/gui-pair-delivery.ts",
+      "sha256": "3f5ca5fd233d69d675aae4cc6d39e8dbf65470b2306442e215c70ecb032540ab"
+    },
     {
       "path": "src/server/gui-session.ts",
       "sha256": "c42ee4a9d0b9469685f98dfbb8fc8171d90c7065a4d4418c95ee04fcd7f20e01"
@@ -5598,7 +5646,7 @@
     },
     {
       "path": "src/server/index/serve-options.ts",
-      "sha256": "6c3d664df04aa39d5507fe02cc3adfd43c824cdbab420813b932ca234c074ef1"
+      "sha256": "8dcf2c84e39366e7eef476f2657e5226bc7300ab7ae2fd3450108b1c366c0a31"
     },
     {
       "path": "src/server/index/spend-ledger-lifecycle.ts",
@@ -5648,9 +5696,13 @@
       "path": "src/server/live-call-bindings.ts",
       "sha256": "1cf1bb07147df0154d347c352b85428a380fcab7f9f25e070cfe693736a3098c"
     },
+    {
+      "path": "src/server/live-native-calls.ts",
+      "sha256": "b8c7162277cd75fa54341386d70d6833c06ab19c988a18312cbceb8bdf967cff"
+    },
     {
       "path": "src/server/live.ts",
-      "sha256": "306158ee88e1a4fa521eee0a69c17548d893040a3c9514676d7a426b420af92c"
+      "sha256": "7f4fe2ed446a93cf7cdbfc5cd9a45730f62bc102d8fe3ceb1130c2db82b30354"
     },
     {
       "path": "src/server/local-account-switch-auth.ts",
@@ -5662,7 +5714,7 @@
     },
     {
       "path": "src/server/local-management-read-client.ts",
-      "sha256": "cfcd49d5abef41be9059f16f5a3180c5ca1685d1de0d7d7e0b8e2091e308a57f"
+      "sha256": "46fa7303021b9c785addf887ef5eab9e13f989cd94af193e961ed7c05ceb247d"
     },
     {
       "path": "src/server/local-provider-reload-client.ts",
@@ -5814,7 +5866,7 @@
     },
     {
       "path": "src/server/management/oauth-account-routes.ts",
-      "sha256": "55abc70c590468fe548d9b7e3ad6d5b8623e8b1f31c222561643320166be6829"
+      "sha256": "89365a43108c4fcd1120f2643d5a2bcca5fef322065bf194873861098fa36e71"
     },
     {
       "path": "src/server/management/protocol-routes.ts",
@@ -5854,7 +5906,7 @@
     },
     {
       "path": "src/server/management/route-registry.ts",
-      "sha256": "7b61f2305ab72fbbca48ea7bcb9cd1f6164daa51bf3ff6e3277b5a1c301c4b73"
+      "sha256": "f6cff873e844b11d5990aa0d771cddd3fedc860cf7d6b6fcfd692fb12f5c16b5"
     },
     {
       "path": "src/server/management/routing-analytics-routes.ts",
@@ -5874,7 +5926,7 @@
     },
     {
       "path": "src/server/management/shared.ts",
-      "sha256": "1f64751627779cdda6636ffb5442b9dbbcd73599740f9cc8c4c14d427a8fc0b3"
+      "sha256": "9290f81ce76412f14f4205698bd0bc4512346eaee9ef7132cd457b7af30f0b48"
     },
     {
       "path": "src/server/management/sibling-guard.ts",
@@ -5944,9 +5996,13 @@
       "path": "src/server/messages-native-oauth.ts",
       "sha256": "a594bf3b8a9f79ac77cd55acab4573b6acf949921cf96a1d12c6f1e48763d7fa"
     },
+    {
+      "path": "src/server/messages-native-scope.ts",
+      "sha256": "c529062519b72e9ee5763663b646138726c51380822864b87d6cfad88f7f0297"
+    },
     {
       "path": "src/server/messages-native.ts",
-      "sha256": "b4f1603117baa247b6bd54326e3ddd54d3c885b4904b2f054751c01ba51dfbbb"
+      "sha256": "f466ebef7399197ad038b2d56124d7c40ff9805e53bf0c2d02cef5b134ea7619"
     },
     {
       "path": "src/server/models-capabilities.ts",
@@ -6094,7 +6150,7 @@
     },
     {
       "path": "src/server/responses/adapter-dispatch.ts",
-      "sha256": "319c5a2da348cf1c0c6e0f31f11d992a3caccc147cc5d8af08f8f414bb72c9b3"
+      "sha256": "a0222c7c8a503f93c8122e064991bcb14252adccdf1ac65b01807c2d8b0a270a"
     },
     {
       "path": "src/server/responses/agent-task-recovery-cache.ts",
@@ -6158,7 +6214,7 @@
     },
     {
       "path": "src/server/responses/compact.ts",
-      "sha256": "2a4c065ce18b3dfe24ee085df8abab976a8f1fb5e26cd01267d98fb18d60c9ca"
+      "sha256": "c369659cd76e724abaf47198a4bd19109cecdd23bef1eb77e4c11a375f3da0d4"
     },
     {
       "path": "src/server/responses/compaction-recovery-policy.ts",
@@ -6182,11 +6238,11 @@
     },
     {
       "path": "src/server/responses/core-auth.ts",
-      "sha256": "fcae80bb4024bad1824624e9d16a8f6455b94dee269ad718f37e0e9741707bd8"
+      "sha256": "f0efe9541c66eb6282f8427432578dca11be7051b7c34867c6522d9039bf008c"
     },
     {
       "path": "src/server/responses/core-codex-account.ts",
-      "sha256": "53602a707e6d7bf7ad5e10f8965266b39e06d56177d3937deb95f40c15f196ec"
+      "sha256": "ee0557aac9735359ab45cafd64f7d26e86c6d94ac76ed112252ed9736b6af226"
     },
     {
       "path": "src/server/responses/core-combo-failure.ts",
@@ -6300,6 +6356,10 @@
       "path": "src/server/responses/native-tool-results.ts",
       "sha256": "16e4f9f68bd2a60fcff0cb1d19049dce7c03dab8d7cc03380c69c5974a641a0d"
     },
+    {
+      "path": "src/server/responses/non-replayable-error.ts",
+      "sha256": "4b22357dd182a51aa348a55865ffbf0bb48b4d6cb8ec3907e7751919aadc0998"
+    },
     {
       "path": "src/server/responses/outbound-body-guard.ts",
       "sha256": "d6073c677abe1a00ea85991b6a58335e28a6386ec88baceeecc84642ea437cdb"
@@ -6310,11 +6370,11 @@
     },
     {
       "path": "src/server/responses/passthrough-delivery.ts",
-      "sha256": "20b9a194046bedd1996d6e3a48eafc15ab029852930a9e94c11df24abf647ceb"
+      "sha256": "87a0541e8ce51da17ac536f14331fa3193d99a6b72dd70ada0875553c67cc58b"
     },
     {
       "path": "src/server/responses/passthrough-dispatch.ts",
-      "sha256": "c2e7c16619bb6c26304edabde63a95f5e9fd0511237db8b48314dd80e5317681"
+      "sha256": "e94a8720e080c0ca7c734e862cd2e617dd55022c75e9cbd2629058d7313d88a5"
     },
     {
       "path": "src/server/responses/passthrough-error.ts",
@@ -6338,7 +6398,7 @@
     },
     {
       "path": "src/server/responses/request-prepare.ts",
-      "sha256": "b28d13eb747da7cc61d09617742082e83d1046133e9c52da950687a890665f06"
+      "sha256": "2ea9db1882f2a63a47e6ee2bae40a21a650536edde0f4e37233f0a99dab6e1f6"
     },
     {
       "path": "src/server/responses/request-send-budget.ts",
@@ -6378,7 +6438,7 @@
     },
     {
       "path": "src/server/responses/sidecar-execution.ts",
-      "sha256": "b2b343a546c7cbcdd372ffcdac4cbb90c643daf80946aa564a63466a43c8368d"
+      "sha256": "eca29aa48b1e63da62f54064ea4aa4e7ceae059124c9837bf5fb2029bff3daa6"
     },
     {
       "path": "src/server/responses/skills-snapshot.ts",
@@ -6410,7 +6470,7 @@
     },
     {
       "path": "src/server/search.ts",
-      "sha256": "a7fdcf33833d28aae54e40cecc789a6d7c44906f10eb457f071b50d2878a9800"
+      "sha256": "318a820d06e482a60cf600b76987519f3de0b634a3228fe58be668fd9daf442e"
     },
     {
       "path": "src/server/sse-frame-buffer.ts",
@@ -6426,7 +6486,7 @@
     },
     {
       "path": "src/server/startup-health-cache.ts",
-      "sha256": "d811b597d5fe44de11f80a526dc1e1437a154d7461fe1bad2b04bdc5c274613f"
+      "sha256": "0f79c004ae81f5e8c4d4c908f1bd50c5a5c2441b924b12d4fa7c05c75d432597"
     },
     {
       "path": "src/server/stop-teardown.ts",
@@ -7026,7 +7086,7 @@
     },
     {
       "path": "src/vision/describe.ts",
-      "sha256": "0b175ccccdd999ea41440be350a264639f755357737608de057124dd6a7b11ac"
+      "sha256": "37c24beb525d38c9f82dd1a67eacee00375abbd803d9da3fc744f357aa899fdb"
     },
     {
       "path": "src/vision/eligibility.ts",
@@ -7038,7 +7098,7 @@
     },
     {
       "path": "src/vision/index.ts",
-      "sha256": "dc2ef3c7b6898eb8938695c1941cecefce86f25836243ba6bc4db2cd91c5400a"
+      "sha256": "66fc9bdda6a590416ca082253e655de6963cb89023615ff489881a1fb236db20"
     },
     {
       "path": "src/vision/plan.ts",
@@ -7078,11 +7138,11 @@
     },
     {
       "path": "src/web-search/executor.ts",
-      "sha256": "fd7eed132b645efd472944cdc4eacf5e6546258cd805bafe3b828bc9ca0c35c9"
+      "sha256": "de37df4e5dd8d57a50271b708cc180cef94dc215c03766ed76cbb49cdd63a025"
     },
     {
       "path": "src/web-search/format-result.ts",
-      "sha256": "d0698e78c55bd5d861645f27af5f0cc7ce122f50a81c8fba57d9c4d3f4e8d010"
+      "sha256": "6fb56f39dfa2d6c8910edd0cb1d101f6121b9c53dc08903627900cfc055b95e6"
     },
     {
       "path": "src/web-search/gemini-executor.ts",
@@ -7094,7 +7154,7 @@
     },
     {
       "path": "src/web-search/loop.ts",
-      "sha256": "8f8007336e9645f317aeefeaf8ddc7321e892b186c7e4eb5cdc577040506a912"
+      "sha256": "88cb405912a912c2ccf4cea4261ab727aa4d01b1b49f57081f7cf5d926d6b94b"
     },
     {
       "path": "src/web-search/ollama-executor.ts",
@@ -7106,7 +7166,7 @@
     },
     {
       "path": "src/web-search/passthrough-bridge.ts",
-      "sha256": "12e1b0ed4252c02e09b92bc34481f6e2c5f0dca4fafb041c2b838c13013f88cb"
+      "sha256": "1cf30bdab0d60d57a0e57a710223238fb3af4e5f01eb761872f8d60583f99451"
     },
     {
       "path": "src/web-search/progress-stream.ts",
@@ -7114,7 +7174,7 @@
     },
     {
       "path": "src/web-search/run-turn-loop.ts",
-      "sha256": "417eefc2c6b2ff7974a9b65d2e256c5067f110bbb667a7df124d7b3ef0d961b1"
+      "sha256": "5566c3ad172e63fd507db0da79886acc9803af8a6c956df2033a8ce34461dbe4"
     },
     {
       "path": "src/web-search/sidecar-providers.ts",

package/src/lib/gui-pair-capability.ts

@@ -3,7 +3,7 @@ import { isLocalAttestationSecret } from "./local-management-attestation";
 
 export const GUI_PAIR_METHOD = "POST";
 export const GUI_PAIR_PATH = "/api/gui/pairing-grants";
-export const GUI_PAIR_CAPABILITY_VERSION = "v1";
+export const GUI_PAIR_CAPABILITY_VERSION = "v2";
 export const GUI_PAIR_EXPECTED_PID_HEADER = "x-opencodex-gui-pair-expected-pid";
 export const GUI_PAIR_NONCE_HEADER = "x-opencodex-gui-pair-nonce";
 export const GUI_PAIR_EXPIRES_AT_HEADER = "x-opencodex-gui-pair-expires-at";

package/src/lib/gui-pair-intent.ts

@@ -0,0 +1,170 @@
+import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { closeSync, constants, fstatSync, lstatSync, mkdirSync, openSync, readdirSync, readSync, rmdirSync, unlinkSync, writeFileSync, type BigIntStats } from "node:fs";
+import { join } from "node:path";
+import { getConfigDir } from "../config/paths";
+import { assertNotRealHomeUnderTest } from "./test-home-guard";
+import { forgetEphemeralSecretPath, hardenSecretDir, hardenSecretPath, windowsSecretAclApplies } from "./windows-secret-acl";
+
+import { verifyWindowsPrivateEntries, WINDOWS_OWNER_ACL_TIMEOUT_MS } from "./windows-owner-acl";
+
+export const GUI_PAIR_INTENT_HEADER = "x-opencodex-gui-pair-intent";
+const TOKEN = /^[A-Za-z0-9_-]{43}$/;
+const INTENT_NAME = /^[0-9a-f]{64}$/;
+// Records outlive their ~10s capability only when the publishing CLI died; a wide
+// margin keeps an active command's fresh record from ever looking stale.
+const STALE_INTENT_MS = 60_000;
+const STALE_INTENT_SWEEP_LIMIT = 256;
+const digest = (value: string) => createHash("sha256").update(value).digest("hex");
+
+function owned(stat: BigIntStats): boolean {
+  return process.platform === "win32" || (stat.uid === BigInt(process.getuid!()) && (stat.mode & 0o022n) === 0n);
+}
+function same(a: BigIntStats, b: BigIntStats): boolean {
+  return a.dev === b.dev && a.ino === b.ino && a.ctimeNs === b.ctimeNs;
+}
+function directory(path: string): BigIntStats {
+  const stat = lstatSync(path, { bigint: true });
+  if (!stat.isDirectory() || stat.isSymbolicLink() || !owned(stat)) throw new Error("Unsafe GUI pairing intent directory");
+  return stat;
+}
+function location(capability: string, configDir: string): { dir: string; path: string } {
+  if (!TOKEN.test(capability)) throw new Error("Invalid GUI pairing capability");
+  const dir = join(configDir, "gui-pair-intents");
+  return { dir, path: join(dir, digest(`opencodex-gui-pair-intent-v1\n${capability}`)) };
+}
+function releaseConsumeLock(path: string, identity: BigIntStats): boolean {
+  try {
+    if (!same(identity, lstatSync(path, { bigint: true }))) return false;
+    rmdirSync(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function removeOwned(path: string, identity: BigIntStats): void {
+  try {
+    if (same(identity, lstatSync(path, { bigint: true }))) unlinkSync(path);
+  } catch { /* expired or already consumed; never remove a replacement */ }
+  forgetEphemeralSecretPath(path);
+}
+
+/** Best-effort stale cleanup; bound per-entry work before creating the next expiring intent. */
+function sweepStaleIntents(dir: string): void {
+  let names: string[];
+  try { names = readdirSync(dir); } catch { return; }
+  const now = Date.now();
+  // Count every entry, including foreign and fresh ones, rather than only successful deletes.
+  // This caps metadata/deletion work, not readdirSync's array allocation or syscall duration.
+  // Bun 1.4.0 also snapshots names behind opendirSync, so an iterator alone is not a memory cap.
+  const limit = Math.min(names.length, STALE_INTENT_SWEEP_LIMIT);
+  for (let index = 0; index < limit; index++) {
+    const name = names[index]!;
+    if (!INTENT_NAME.test(name)) continue;
+    const path = join(dir, name);
+    try {
+      const stat = lstatSync(path, { bigint: true });
+      if (!stat.isFile() || stat.isSymbolicLink() || !owned(stat) || stat.nlink !== 1n) continue;
+      if (now - Number(stat.mtimeMs) < STALE_INTENT_MS) continue;
+      removeOwned(path, stat);
+    } catch { /* leave unreadable entries alone */ }
+  }
+}
+
+export interface GuiPairIntent {
+  proof: string;
+  dispose(): void;
+}
+
+/**
+ * Prove write access to the private configuration home, separately from runtime-state reads.
+ * Only a SHA-256 commitment goes to disk; the random verifier remains in the requesting CLI.
+ * This is an owner-write boundary, NOT proof of human presence or protection from a fully
+ * privileged same-user process. The existing HMAC binds PID, port, origin, nonce and expiry.
+ */
+export function createGuiPairIntent(capability: string, configDir = getConfigDir()): GuiPairIntent {
+  assertNotRealHomeUnderTest(configDir);
+  directory(configDir);
+  const { dir, path } = location(capability, configDir);
+  try { mkdirSync(dir, { mode: 0o700 }); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error; }
+  directory(dir);
+  if (!hardenSecretDir(dir, { required: true, deadlineMs: 2_000 }).ok) throw new Error("GUI pairing intent ACL refused");
+  sweepStaleIntents(dir);
+  const parent = directory(dir);
+  const proof = randomBytes(32).toString("base64url");
+  const fd = openSync(path, "wx", 0o600);
+  let identity = fstatSync(fd, { bigint: true });
+  try {
+    writeFileSync(fd, `${digest(proof)}\n`, "utf8");
+    if (!hardenSecretPath(path, { required: true, deadlineMs: 2_000 }).ok) throw new Error("GUI pairing intent ACL refused");
+    identity = fstatSync(fd, { bigint: true });
+    if (!same(identity, lstatSync(path, { bigint: true })) || !owned(identity)
+      || identity.nlink !== 1n || parent.dev !== directory(dir).dev || parent.ino !== directory(dir).ino) {
+      throw new Error("GUI pairing intent changed during publication");
+    }
+  } catch (error) {
+    identity = fstatSync(fd, { bigint: true });
+    closeSync(fd);
+    removeOwned(path, identity);
+    throw error;
+  }
+  closeSync(fd);
+  // Disposal consumes the record: the same directory, identity and content checks as
+  // redemption, so a corrupted or replaced commitment is retained on every platform.
+  const dispose = (): void => { consumeGuiPairIntent(capability, proof, configDir); };
+  return { proof, dispose };
+}
+
+/** Called only after the existing process-bound, expiring capability passed authorization. */
+export function consumeGuiPairIntent(capability: string | null, proof: string | null, configDir = getConfigDir()): boolean {
+  if (!capability || !proof || !TOKEN.test(capability) || !TOKEN.test(proof)) return false;
+  let fd: number | undefined;
+  let consumeLock: string | undefined;
+  let consumeLockIdentity: BigIntStats | undefined;
+  try {
+    assertNotRealHomeUnderTest(configDir);
+    directory(configDir);
+    const { dir, path } = location(capability, configDir);
+    const parent = directory(dir);
+    consumeLock = `${path}.consuming`;
+    mkdirSync(consumeLock, { mode: 0o700 });
+    consumeLockIdentity = directory(consumeLock);
+    const lockedParent = directory(dir);
+    if (parent.dev !== lockedParent.dev || parent.ino !== lockedParent.ino) return false;
+    const before = lstatSync(path, { bigint: true });
+    if (!before.isFile() || before.isSymbolicLink() || !owned(before) || before.nlink !== 1n || before.size !== 65n) return false;
+    // Do not block on a substituted FIFO. Windows retains descriptor/path identity checks.
+    const flags = constants.O_RDONLY | (process.platform === "win32" ? 0 : constants.O_NOFOLLOW | constants.O_NONBLOCK);
+    fd = openSync(path, flags);
+    const opened = fstatSync(fd, { bigint: true });
+    if (!same(before, opened) || !opened.isFile()) return false;
+    const bytes = Buffer.alloc(66);
+    const size = readSync(fd, bytes, 0, bytes.length, 0);
+    if (size !== 65 || !timingSafeEqual(bytes.subarray(0, size), Buffer.from(`${digest(proof)}\n`))) return false;
+    const after = fstatSync(fd, { bigint: true });
+    if (!same(opened, after) || !same(after, lstatSync(path, { bigint: true }))
+      || parent.dev !== directory(dir).dev || parent.ino !== directory(dir).ino) return false;
+    closeSync(fd); fd = undefined;
+    // Verify only a matching commitment, with its descriptor closed and lock held.
+    // Redemption must never harden an untrusted record into acceptable authority.
+    if (windowsSecretAclApplies() && !verifyWindowsPrivateEntries([
+      { path: dir, directory: true }, { path, directory: false },
+    ], WINDOWS_OWNER_ACL_TIMEOUT_MS)) return false;
+    const verifiedParent = directory(dir);
+    if (parent.dev !== verifiedParent.dev || parent.ino !== verifiedParent.ino
+      || !same(after, lstatSync(path, { bigint: true }))) return false;
+    unlinkSync(path);
+    forgetEphemeralSecretPath(path);
+    return true;
+  } catch { return false; }
+  finally {
+    try {
+      if (fd !== undefined) closeSync(fd);
+    } finally {
+      if (consumeLock && consumeLockIdentity) {
+        releaseConsumeLock(consumeLock, consumeLockIdentity);
+      }
+    }
+  }
+}