@bitkyc08/opencodex 2.78.0 → 2.80.0

package/src/claude/intercept/picker-ca.ts

@@ -1,6 +1,8 @@
 import { createHash, randomUUID, X509Certificate } from "node:crypto";
 import { chmodSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { canonicalPickerConfigDir, ensurePersistentPickerCa } from "./picker-ca-persistence";
+import type { PickerCaStore } from "./picker-ca-store";
 import { withClientLifecycleSync } from "../../client/lifecycle-lock";
 import {
   ALL_IP_ADDRESS_BASES,
@@ -405,29 +407,58 @@ export function acknowledgePendingPickerCaUntrust(
  * unconditional so a later failed rotation can never leave that key behind.
  */
 export function discardPickerCaKey(configDir: string): void {
+  try {
+    const stat = lstatSync(pickerStateDir(configDir));
+    if (!stat.isDirectory() || (process.platform !== "win32" && stat.uid !== process.getuid!())) {
+      throw new Error("picker_ca_directory_unsafe");
+    }
+  } catch (error) {
+    if (error !== null && typeof error === "object" && (error as { code?: unknown }).code === "ENOENT") return;
+    throw error;
+  }
   rmSync(join(pickerStateDir(configDir), "ca.key"), { force: true });
 }
 
-export function ensurePickerCa(configDir: string, options: { rotation?: "startup" } = {}): PickerCa {
+export function ensurePickerCa(configDir: string, options: { rotation?: "startup"; persistent?: boolean; store?: PickerCaStore } = {}): PickerCa {
+  mkdirSync(configDir, { recursive: true, mode: 0o700 });
+  configDir = canonicalPickerConfigDir(configDir);
   const dir = pickerStateDir(configDir);
-  // The signing key must never survive this process: another process under the same user could
-  // otherwise steal it and later take over the predictable loopback proxy. Drop a key left (or
-  // restored) by an older release on every call, including cache hits.
+  // Persistent startup stores the signing key in the OS credential store; plain calls keep an
+  // in-process authority. Both paths remove legacy plaintext ca.key files, including cache hits.
   discardPickerCaKey(configDir);
   const cached = processAuthorities.get(dir);
-  const pickerCa = cached ?? (() => {
+  const create = () => cached ?? (() => {
     const ca = createCertificateAuthority({ commonName: PICKER_CA_COMMON_NAME, permittedDnsNames: [PICKER_HOST] });
     return { ...ca, fingerprint: pickerCaFingerprints(ca.certPem).sha256 };
   })();
   mkdirSync(dir, { recursive: true, mode: 0o700 });
-  lockedPickerCa(configDir, () => {
+  const pickerCa = lockedPickerCa(configDir, () => {
     if (readPendingPickerCaUntrust(configDir)) throw new Error("picker_ca_pending_untrust");
+    if (options.persistent) {
+      return ensurePersistentPickerCa({
+        configDir, stateDir: dir, store: options.store, acceptsAuthority: acceptsPickerAuthority, create,
+        predecessor: ca => {
+          const published = publishedPickerCa(configDir);
+          if (published === ca.certPem || published === null) return null;
+          if (livePublishedOwner(configDir, published)) throw new Error("picker_ca_live_owner");
+          const outgoing = publicCertificate(published);
+          if (outgoing && options.rotation !== "startup") throw new Error("picker_ca_rotation_requires_startup");
+          return outgoing?.certPem ?? null;
+        },
+        publishMetadata: publishPem,
+        publish: (ca, predecessor) => {
+          if (predecessor) writePendingPickerCaUntrust(configDir, publicCertificate(predecessor)!);
+          publishAuthority(configDir, ca);
+        },
+      });
+    }
+    const pickerCa = create();
     const published = publishedPickerCa(configDir);
     if (published === pickerCa.certPem) {
       // The signing key is still in this process. A missing/stale owner file must not let a
       // second process rotate this live authority after an otherwise harmless cached ensure.
       if (!currentProcessOwnsPublishedCa(configDir, pickerCa)) publishOwner(configDir, pickerCa);
-      return;
+      return pickerCa;
     }
     if (published !== null && livePublishedOwner(configDir, published)) {
       throw new Error("picker_ca_live_owner");
@@ -438,14 +469,17 @@ export function ensurePickerCa(configDir: string, options: { rotation?: "startup
       writePendingPickerCaUntrust(configDir, outgoing);
     }
     publishAuthority(configDir, pickerCa);
+    return pickerCa;
   });
-  if (!cached) processAuthorities.set(dir, pickerCa);
+  if (!cached || options.persistent) processAuthorities.set(dir, pickerCa);
   return pickerCa;
 }
 
 /** Fingerprint of this process's authority only — null until ensurePickerCa has run. */
 export function publishedPickerCaSha256(configDir: string): string | null {
-  const cached = processAuthorities.get(pickerStateDir(configDir));
+  let canonical: string;
+  try { canonical = canonicalPickerConfigDir(configDir); } catch { return null; }
+  const cached = processAuthorities.get(pickerStateDir(canonical));
   return cached ? pickerCaFingerprints(cached.certPem).sha256 : null;
 }
 

package/src/claude/intercept/picker-runtime.ts

@@ -19,6 +19,8 @@ import type { ClaudeDesktopMode } from "../desktop-first-party";
 import type { TunnelDecision } from "./connect-proxy";
 import type { PemKeyPair } from "./local-ca";
 import { PICKER_HOST, ensurePickerCa, issuePickerLeaf, pickerCaFingerprints, pickerLeafCertPath, pickerStateDir, type PickerCa } from "./picker-ca";
+import { preparePersistentPickerAuthority } from "./picker-ca-startup";
+import type { PickerCaStore } from "./picker-ca-store";
 import { startPickerListener, type PickerListenerHandle } from "./picker-listener";
 import { createPickerModelSnapshot, type PickerModelSnapshot, type PickerRouteInput } from "./picker-models";
 import { inspectPickerTrust, type PickerTrustState, type SecurityRunner } from "./picker-trust";
@@ -81,6 +83,8 @@ export interface CreatePickerRuntimeOptions {
   isBusy?: () => boolean;
   configDir: string;
   loadRoutes: () => Promise<PickerRouteInput>;
+  /** Production opt-in; pure/direct runtime callers remain ephemeral. */
+  persistentAuthority?: { store?: PickerCaStore };
   security?: SecurityRunner;
   platform?: NodeJS.Platform;
   now?: () => number;
@@ -161,9 +165,11 @@ export function createPickerRuntime(options: CreatePickerRuntimeOptions): Picker
     if (pending) void pending.then(handle => handle.close()).catch(() => {});
   }
 
-  function ensureMaterial(): { ca: PickerCa; leaf: PemKeyPair; sha1: string } {
+  async function ensureMaterial(): Promise<{ ca: PickerCa; leaf: PemKeyPair; sha1: string }> {
     if (!ca || !leaf || !caSha1) {
-      ca = ensurePickerCa(options.configDir);
+      ca = options.persistentAuthority
+        ? await preparePersistentPickerAuthority({ configDir: options.configDir, store: options.persistentAuthority.store, security: options.security, platform })
+        : ensurePickerCa(options.configDir);
       leaf = issuePickerLeaf(ca, options.configDir);
       caSha1 = pickerCaFingerprints(ca.certPem).sha1;
     }
@@ -176,7 +182,7 @@ export function createPickerRuntime(options: CreatePickerRuntimeOptions): Picker
   }
 
   async function inspectTrust(force: boolean): Promise<PickerTrustState> {
-    const { sha1 } = ensureMaterial();
+    const { sha1 } = await ensureMaterial();
     if (!force && trustFor === sha1 && now() - trustCheckedAt < trustTtlMs) return trust;
     trust = await inspectPickerTrust(pickerLeafCertPath(options.configDir), sha1, options.security, platform);
     trustFor = sha1;
@@ -186,7 +192,8 @@ export function createPickerRuntime(options: CreatePickerRuntimeOptions): Picker
 
   /** CA, leaf, snapshot and listener. Resolves false when a disarm overtook it. */
   async function startPieces(gen: number): Promise<boolean> {
-    const material = ensureMaterial();
+    const material = await ensureMaterial();
+    if (gen !== generation || latched || stopped) return false;
     ensureSnapshot().refreshIfStale(PICKER_MODELS_MAX_AGE_MS);
     if (!listenerPromise) {
       const current = startListener({
@@ -266,6 +273,9 @@ export function createPickerRuntime(options: CreatePickerRuntimeOptions): Picker
       });
     },
     async refreshTrust() {
+      // A dormant production picker has no authority to inspect. Status/off must not initialize
+      // credentials; an already initialized issuer still gets authoritative OS trust inspection.
+      if (options.persistentAuthority && ca === null) return trust;
       return inspectTrust(true);
     },
     async refresh() {

package/src/claude/intercept/runtime.ts

@@ -8,10 +8,11 @@ import { createCliCatalogProvider } from "./cli-picker";
 import { CLAUDE_INTERCEPT_HOSTS, isBrowserConnect, startConnectProxy, type ConnectProxyHandle } from "./connect-proxy";
 import { startClaudeInterceptListener } from "./listener";
 import { claudeInterceptCaCertPath, ensureLocalInterceptCaForStartup, issueLocalInterceptLeaf } from "./local-ca";
-import { discardPickerCaKey, ensurePickerCa } from "./picker-ca";
-import { drainPendingPickerCaUntrust } from "./picker-ca-cleanup";
+import { discardPickerCaKey } from "./picker-ca";
+import { preparePersistentPickerAuthority } from "./picker-ca-startup";
+import type { PickerCaStore } from "./picker-ca-store";
 import type { PickerRouteInput } from "./picker-models";
-import { createPickerRuntime, type CreatePickerRuntimeOptions, type PickerRuntime } from "./picker-runtime";
+import { createPickerRuntime, pickerDesired, type CreatePickerRuntimeOptions, type PickerRuntime } from "./picker-runtime";
 import type { SecurityRunner } from "./picker-trust";
 import { ensureClaudeInterceptProxyToken, readClaudeInterceptProxyToken } from "./proxy-auth";
 import { buildClaudeInterceptEnv, migrateClaudeInterceptSettings } from "./settings";
@@ -31,6 +32,15 @@ import { buildClaudeInterceptEnv, migrateClaudeInterceptSettings } from "./setti
  * tunnels may be terminated by the picker runtime (src/claude/intercept/picker-runtime.ts).
  */
 
+const PICKER_AUTHORITY_ERROR_CODES = new Set([
+  "picker_ca_store_unavailable", "picker_ca_store_missing", "picker_ca_store_invalid",
+  "picker_ca_store_readback_failed", "picker_ca_metadata_mismatch", "picker_ca_metadata_unsafe",
+  "picker_ca_metadata_invalid", "picker_ca_live_owner", "picker_ca_pending_untrust",
+  "picker_ca_pending_untrust_invalid", "picker_ca_pending_untrust_unsafe", "picker_ca_pending_untrust_changed",
+  "picker_ca_config_unsafe", "picker_ca_directory_unsafe", "picker_ca_rotation_requires_startup",
+  "picker_ca_unsupported_platform",
+]);
+
 export const CLAUDE_INTERCEPT_PORT_OFFSET = 100;
 
 export function claudeInterceptEnabled(config: Pick<OcxConfig, "claudeCode" | "runtimeRole">): boolean {
@@ -135,6 +145,7 @@ export interface StartClaudeInterceptOptions<T> {
   /** Test seam: bind real CONNECT handlers on kernel-assigned ports without probe-and-release races. */
   startProxy?: typeof startConnectProxy;
   /** Test seams: the macOS `security` runner and platform for the picker runtime and controller. */
+  pickerCaStore?: PickerCaStore;
   pickerSecurity?: SecurityRunner;
   pickerPlatform?: NodeJS.Platform;
 }
@@ -200,10 +211,8 @@ export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptio
   let pickerReason: ClaudeInterceptState["pickerReason"] = null;
   let pickerFailurePort: number | undefined;
   try {
-    if (options.loadPickerRoutes) {
-      // A picker authority is process-scoped, and older releases persisted an exportable ca.key
-      // next to the published certificate. Drop that key before anything else: a cleanup failure
-      // below must never leave a signing key on disk that outlives this process.
+    if (options.loadPickerRoutes && (options.pickerPlatform ?? process.platform) === "darwin") {
+      // Remove any legacy plaintext key before inspecting or activating picker state.
       discardPickerCaKey(configDir);
       const { inspectDesktopPickerProfile } = await import("../desktop-picker-profile");
       // The applied profile row is durable evidence of the user's picker selection. Rotation keeps
@@ -217,22 +226,23 @@ export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptio
       const pickerProfileApplied = pickerProfile.kind === "applied";
       let pickerBlocked = false;
       try {
-        // A prior process may have died after publishing the journal but before cleanup. Finish
-        // that entry before rotation can replace it, then drain the newly queued predecessor.
-        const drain = () => drainPendingPickerCaUntrust(configDir, options.pickerSecurity, options.pickerPlatform);
-        if (!await drain()) pickerBlocked = true;
-        if (!pickerBlocked) {
-          ensurePickerCa(configDir, { rotation: "startup" });
-          if (!await drain()) pickerBlocked = true;
+        const { observeClaudeDesktopMode, resolveClaudeDesktopMode } = await import("../desktop-first-party");
+        const fresh = options.config;
+        const platform = options.pickerPlatform ?? process.platform;
+        if (pickerProfileApplied || pickerDesired(fresh, resolveClaudeDesktopMode(fresh, observeClaudeDesktopMode(fresh)), platform)) {
+          await preparePersistentPickerAuthority({ configDir, store: options.pickerCaStore, security: options.pickerSecurity, platform });
         }
       } catch (error) {
         pickerBlocked = true;
         pickerReason = "failed";
-        console.warn(`⚠ Claude Desktop picker CA cleanup deferred: ${error instanceof Error ? error.message : String(error)}`);
+        // Native and filesystem errors may include private contents or paths. Emit only an exact
+        // application-owned code; arbitrary diagnostic text never crosses this boundary.
+        const code = error instanceof Error && PICKER_AUTHORITY_ERROR_CODES.has(error.message) ? error.message : null;
+        console.warn(code === "picker_ca_pending_untrust"
+          ? "⚠ Claude Desktop picker disabled: the previous certificate could not be untrusted"
+          : `⚠ Claude Desktop picker disabled: picker authority unavailable${code ? ` (${code})` : ""}`);
       }
       if (pickerBlocked) {
-        pickerReason = "failed";
-        console.warn("⚠ Claude Desktop picker disabled: the previous certificate could not be untrusted");
         if (pickerProfile.kind === "applied") {
           // Keep Desktop's actual pinned egress alive without ever constructing a TLS terminator.
           const port = Number(new URL(pickerProfile.proxyUrl).port);
@@ -253,6 +263,7 @@ export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptio
       picker = pickerBlocked ? null : (options.createPicker ?? createPickerRuntime)({
         config: options.config,
         configDir,
+        persistentAuthority: { store: options.pickerCaStore },
         loadRoutes: options.loadPickerRoutes,
         // The controller's lock: while it is held, periodic refreshes never arm.
         isBusy: () => controller?.busy() ?? false,
@@ -312,17 +323,15 @@ export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptio
           persistPreference,
           proxyPort: () => (pickerProxyLive && boundProxy ? boundProxy.port : null),
           configDir,
+          persistentAuthority: { store: options.pickerCaStore },
           ...(options.pickerSecurity ? { security: options.pickerSecurity } : {}),
           ...(options.pickerPlatform ? { platform: options.pickerPlatform } : {}),
         });
         await picker.start();
-        // The rotated authority still needs the user's consent in the login keychain — a decline
-        // reports trust_pending, and the picker stays a blind tunnel until trust is granted. When
-        // Desktop was pinned to the picker before the restart, the regular enable flow re-trusts
-        // the new authority and rewrites the profile row in place, so a restart does not silently
-        // turn the picker off.
+        // Restore inspects the retained identity without installing trust. Explicit enable/trust
+        // owns consent when trust was revoked or legacy migration introduced a new authority.
         if (pickerProfileApplied && controller) {
-          void controller.enable({ persist: false, context: "server" })
+          void controller.enable({ persist: false, context: "server", allowTrustPrompt: false })
             .catch(error => console.warn(`⚠ Claude Desktop picker restore failed: ${error instanceof Error ? error.message : String(error)}`));
         }
       }

package/src/cli/ensure-readiness.ts

@@ -0,0 +1,48 @@
+/**
+ * Readiness wait for a proxy this process just asked to start.
+ *
+ * ocx ensure spawns a detached ocx start and returns once this home's proxy answers.
+ * It used to give up after a flat 8 s. A cold start can take longer than that on a
+ * busy Windows host (Windows CI measured 10-45 s for the first proxy child of a
+ * batch), so ensure reported "did not become healthy" for a proxy that came up
+ * moments later, and the Codex shim or autostart that called it saw a failure.
+ *
+ * The wait is now as long as the service start's follow-up (40 s) while the
+ * spawned child is alive. A child that has exited keeps the old 8 s bound, so a
+ * start that failed outright is reported no later than before.
+ */
+
+export const ENSURE_READY_TIMEOUT_MS = 40_000;
+export const ENSURE_EXITED_CHILD_TIMEOUT_MS = 8_000;
+const POLL_MS = 150;
+
+export interface LiveProxyWaitOptions<T> {
+  find: () => Promise<T | null>;
+  timeoutMs: number;
+  /** Return false to stop polling early; one observation is always made first. */
+  keepWaiting?: () => boolean;
+  now?: () => number;
+  sleep?: (ms: number) => Promise<void>;
+}
+
+export async function waitForLiveProxy<T>(options: LiveProxyWaitOptions<T>): Promise<T | null> {
+  const now = options.now ?? Date.now;
+  const sleep = options.sleep ?? ((ms: number) => new Promise<void>(resolve => setTimeout(resolve, ms)));
+  const deadline = now() + options.timeoutMs;
+  while (now() < deadline) {
+    const live = await options.find();
+    if (live) return live;
+    if (options.keepWaiting && !options.keepWaiting()) return null;
+    await sleep(POLL_MS);
+  }
+  return null;
+}
+
+/** Keep waiting while the spawned child lives; once it exits, only inside the old 8 s bound. */
+export function ensureKeepWaiting(
+  spawnedAt: number,
+  childExited: () => boolean,
+  now: () => number = Date.now,
+): () => boolean {
+  return () => !childExited() || now() - spawnedAt < ENSURE_EXITED_CHILD_TIMEOUT_MS;
+}

package/src/cli/gui-pair-client.ts

@@ -1,5 +1,6 @@
 import { readRuntimePort, type RuntimePortState } from "../config/process-state";
 import { timingSafeEqual } from "node:crypto";
+import { createGuiPairIntent, GUI_PAIR_INTENT_HEADER, type GuiPairIntent } from "../lib/gui-pair-intent";
 import {
   LOCAL_ATTESTATION_CHALLENGE_HEADER,
   LOCAL_ATTESTATION_PROOF_HEADER,
@@ -30,7 +31,7 @@ import {
 
 export type GuiPairRequestResult =
   | { kind: "created"; grant: string; browserOrigin: string; serverOrigin: string; expiresAt: number }
-  | { kind: "unavailable"; reason: "unattested-target" | "runtime-mismatch" | "attestation" | "capability" | "transport" | "rejected" };
+  | { kind: "unavailable"; reason: "unattested-target" | "runtime-mismatch" | "attestation" | "capability" | "transport" | "rejected" | "local-intent" };
 
 export interface GuiPairClientDeps {
   fetchImpl?: typeof fetch;
@@ -38,6 +39,9 @@ export interface GuiPairClientDeps {
   createChallenge?: () => string;
   now?: () => number;
   timeoutMs?: number;
+  /** Hub invitation policy is unchanged; standalone commands require local write intent. */
+  requireLocalIntent?: boolean;
+  createIntent?: typeof createGuiPairIntent;
 }
 
 const GUI_PAIR_REQUEST_TIMEOUT_MS = 10_000;
@@ -136,9 +140,12 @@ export async function requestBoundGuiPairingGrant(
     expiresAt,
   );
   if (!capability) return { kind: "unavailable", reason: "capability" };
-  let response: Response;
+  let intent: GuiPairIntent | undefined;
   try {
-    response = await fetchImpl(`${baseUrl}${GUI_PAIR_PATH}`, {
+    if (deps.requireLocalIntent !== false) intent = (deps.createIntent ?? createGuiPairIntent)(capability);
+  } catch { return { kind: "unavailable", reason: "local-intent" }; }
+  try {
+    const response = await fetchImpl(`${baseUrl}${GUI_PAIR_PATH}`, {
       method: GUI_PAIR_METHOD,
       headers: {
         "Content-Length": "0",
@@ -147,13 +154,14 @@ export async function requestBoundGuiPairingGrant(
         [GUI_PAIR_EXPIRES_AT_HEADER]: String(expiresAt),
         [GUI_PAIR_BROWSER_ORIGIN_HEADER]: browserOrigin,
         [GUI_PAIR_CAPABILITY_HEADER]: capability,
+        ...(intent ? { [GUI_PAIR_INTENT_HEADER]: intent.proof } : {}),
       },
       signal: AbortSignal.timeout(timeoutMs),
     });
+    if (!response.ok) return { kind: "unavailable", reason: "rejected" };
+    const result = parseCreatedResult(await response.json().catch(() => null), browserOrigin);
+    return result ?? { kind: "unavailable", reason: "rejected" };
   } catch {
     return { kind: "unavailable", reason: "transport" };
-  }
-  if (!response.ok) return { kind: "unavailable", reason: "rejected" };
-  const result = parseCreatedResult(await response.json().catch(() => null), browserOrigin);
-  return result ?? { kind: "unavailable", reason: "rejected" };
+  } finally { intent?.dispose(); }
 }

package/src/cli/gui.ts

@@ -77,9 +77,12 @@ export async function runGuiCommand(args: string[], deps: GuiCommandDeps): Promi
   }
   const result = await (deps.requestPairingGrant ?? requestBoundGuiPairingGrant)(target, canonicalOrigin, {
     ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+    requireLocalIntent: config.runtimeRole !== "hub",
   });
   if (result.kind !== "created") {
-    console.error(`GUI pairing failed (${result.reason}).`);
+    console.error(result.reason === "local-intent"
+      ? "GUI pairing requires write access to the private OpenCodex home; no code was issued."
+      : `GUI pairing failed (${result.reason}).`);
     return 1;
   }
   if (parsed.json) {

package/src/cli/hub.ts

@@ -328,6 +328,7 @@ async function runInvite(args: string[], deps: HubCommandDeps): Promise<number>
   const dataUrl = resolved.dataUrl;
   const result = await (deps.requestPairingGrant ?? requestBoundGuiPairingGrant)(target, browserOrigin, {
     ...(deps.fetchImpl ? { fetchImpl: deps.fetchImpl } : {}),
+    requireLocalIntent: false,
   });
   if (result.kind !== "created") {
     console.error(`Minting a pairing code failed (${result.reason}).`);

package/src/cli/index.ts

@@ -152,6 +152,7 @@ import {
   grokSyncFailureMessage,
   reconcileEnsureDesiredIntegrations,
 } from "./ensure-desired-integrations";
+import { ENSURE_READY_TIMEOUT_MS, ensureKeepWaiting, waitForLiveProxy } from "./ensure-readiness";
 import { refreshOwnedCatalogIntegrations } from "../integrations/catalog-refresh";
 import { loadExportModels } from "../server/management/model-rows";
 
@@ -235,16 +236,10 @@ function parseStartCliOptions(): ReturnType<typeof parseStartOptions> {
   }
 }
 
-async function waitForProxy(timeoutMs = 8_000): Promise<LiveProxy | null> {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    // Runtime-state-first with identity: finds the proxy even when it started on a
-    // fallback port, and never mistakes a foreign 200 for our proxy.
-    const live = await findLiveProxy();
-    if (live) return live;
-    await new Promise(resolve => setTimeout(resolve, 150));
-  }
-  return null;
+async function waitForProxy(timeoutMs = 8_000, keepWaiting?: () => boolean): Promise<LiveProxy | null> {
+  // Runtime-state-first with identity: finds the proxy even when it started on a
+  // fallback port, and never mistakes a foreign 200 for our proxy.
+  return waitForLiveProxy({ find: findLiveProxy, timeoutMs, keepWaiting });
 }
 
 class StartCommandExit extends Error {
@@ -846,9 +841,13 @@ async function handleEnsure(options: { existingIsSuccess?: boolean; forceStart?:
     env: detachedStartEnvironment(),
   });
   options.onSpawn?.(child);
+  const spawnedAt = Date.now();
+  let childExited = false;
+  child.once("exit", () => { childExited = true; });
   child.unref();
 
-  const port = (await waitForProxy())?.port;
+  // A cold start can outlast 8 s on a busy Windows host; see ensure-readiness.ts.
+  const port = (await waitForProxy(ENSURE_READY_TIMEOUT_MS, ensureKeepWaiting(spawnedAt, () => childExited)))?.port;
   if (!port) {
     console.error("❌ Proxy did not become healthy after starting.");
     process.exitCode = 1;

package/src/cli/status.ts

@@ -7,7 +7,7 @@ import { diagnoseCodexBundledPlugins, type CodexPluginsDiagnostic } from "../cod
 import { findLiveProxy, probeHostname } from "../server/proxy-liveness";
 import type { OcxConfig } from "../types";
 import { diagnoseService, serviceLogPath } from "../service";
-import { collectStartupHealth, type StartupHealth } from "../codex/autostart-health";
+import { collectStartupHealth, startupHealthReadBudgetMs, type StartupHealth } from "../codex/autostart-health";
 import { getCodexRoutingKind } from "../codex/inject";
 import { missingOwnedCatalogPath } from "../codex/inject/config-toml";
 import { CODEX_CONFIG_PATH } from "../codex/paths";
@@ -251,7 +251,7 @@ export async function fetchLiveStartupHealth(
   deps: Parameters<typeof fetchBoundLocalManagementRead>[2] = {},
 ): Promise<StartupHealth | null> {
   const result = await fetchBoundLocalManagementRead(
-    live, LOCAL_MANAGEMENT_READ_PATHS.startupHealth, { timeoutMs: 1_500, ...deps, requireResponseProof: true },
+    live, LOCAL_MANAGEMENT_READ_PATHS.startupHealth, { timeoutMs: startupHealthReadBudgetMs(), ...deps, requireResponseProof: true },
   );
   if (result.kind !== "response" || !result.response.ok) return null;
   let payload: unknown;

package/src/cli/update-restart-child.ts

@@ -18,8 +18,11 @@ function parseMarker(raw: string): UpdateRestartChildMarker {
     || value.version === "0.0.0" || !parseStrictSemver(value.version) || !value.home
     || !Number.isSafeInteger(value.home.revision)) throw new Error("update_restart_child_marker_invalid");
   for (const directory of [value.home.config, value.home.codex]) {
+    // Windows reports 64-bit NTFS file ids (MFT sequence in the high 16 bits) as doubles above
+    // 2^53. Parent and child read them through the same stat API, so any finite integer is a
+    // faithful identity token; assertUpdateRestartHome still compares path, dev and ino exactly.
     if (!directory || typeof directory.path !== "string" || !directory.path
-      || !Number.isSafeInteger(directory.dev) || !Number.isSafeInteger(directory.ino)) {
+      || !Number.isInteger(directory.dev) || !Number.isInteger(directory.ino)) {
       throw new Error("update_restart_child_marker_invalid");
     }
   }

package/src/codex/account-credit-use.ts

@@ -3,6 +3,7 @@ import { deleteConfigTopLevelKey } from "../config/rebase-provenance";
 import { isThirtyDayOnlyCodexPlan } from "./plan";
 import {
   CODEX_EXHAUSTED_USAGE_PERCENT,
+  TERMINAL_SHORT_WINDOW_FRESHNESS_MS,
   isTerminalShortWindow,
   hasSpendableCodexCredits,
   resetAtToMs,
@@ -73,8 +74,13 @@ export function codexUsageLimitResetAt(quota: StoredAccountQuota | null, plan: u
   if (!quota) return undefined;
   const full: number[] = [];
   if (isTerminalShortWindow(quota, now)) {
-    // A reset-less burst reading counts while it is fresh, so there is no instant to report.
-    full.push(typeof quota.shortResetAt === "number" && quota.shortResetAt > 0 ? resetAtToMs(quota.shortResetAt) : now);
+    // A reset-less burst reading holds until its observation goes stale: the freshness horizon
+    // is the deadline a retried request still meets, so report it rather than `now` (which
+    // collapsed the refusal's Retry-After to 1s against an account blocked for minutes).
+    // `isTerminalShortWindow` guarantees `shortObservedAt` is finite on this branch.
+    full.push(typeof quota.shortResetAt === "number" && quota.shortResetAt > 0
+      ? resetAtToMs(quota.shortResetAt)
+      : (quota.shortObservedAt ?? now) + TERMINAL_SHORT_WINDOW_FRESHNESS_MS);
   }
   const longWindows: Array<[number | undefined, number | undefined]> = isThirtyDayOnlyCodexPlan(plan)
     ? [[quota.monthlyPercent, quota.monthlyResetAt]]

package/src/codex/auth-api/account-pause-group.ts

@@ -0,0 +1,113 @@
+import { lstatSync } from "node:fs";
+import type { OcxConfig } from "../../types";
+import { inspectChatGptDomainClaim, extractEmail } from "../../oauth/chatgpt";
+import { MAIN_CODEX_ACCOUNT_ID, isSelectableCodexPoolAccount } from "../account-id";
+import { readCodexTokensResult } from "../auth-collision";
+import type { CodexTokenReadResult } from "../auth-collision";
+import { getCodexAccountCredential } from "../account-store";
+import { resolveCodexHomeDir } from "../home";
+import { tryAcquireNativeMainProfileClaim } from "../native-main-admission";
+import { withNativeMainSharedClaim } from "../native-main-claim";
+import { MAX_AUTH_BYTES, readBounded, resolveNativeProfileContext } from "../native-profile-store";
+import { NativeProfileError } from "../native-profile-types";
+import { isNativeMainClaimUnavailable, nativeMainProfileBusyResponse } from "./http";
+
+type AccountIdentity = { accountId: string; email: string };
+type MainAuth = CodexTokenReadResult | { status: "api-key-only" };
+
+/** A valid API-key login has no ChatGPT identity; anything else unreadable stays unknown. */
+function readMainAuth(authPath: string): MainAuth {
+  const main = readCodexTokensResult(authPath, { bounded: true });
+  if (main.status !== "invalid") return main;
+  try {
+    const j: unknown = JSON.parse(readBounded(authPath, MAX_AUTH_BYTES).toString("utf-8"));
+    if (j === null || typeof j !== "object" || Array.isArray(j)) return main;
+    const envelope = j as { auth_mode?: unknown; OPENAI_API_KEY?: unknown; tokens?: unknown };
+    const apiKeyOnly = envelope.tokens == null
+      && (envelope.auth_mode === undefined || envelope.auth_mode === "api_key")
+      && typeof envelope.OPENAI_API_KEY === "string" && envelope.OPENAI_API_KEY.trim() !== "";
+    return apiKeyOnly ? { status: "api-key-only" } : main;
+  } catch {
+    return main;
+  }
+}
+
+function identity(accountId: unknown, email: unknown): AccountIdentity | undefined {
+  const normalizedEmail = typeof email === "string" ? email.trim().toLowerCase() : undefined;
+  return typeof accountId === "string" && accountId.trim() && normalizedEmail
+    ? { accountId: accountId.trim(), email: normalizedEmail }
+    : undefined;
+}
+
+/** Resolve only existing entries, under native-main ownership, never on the request path. */
+function linkedAccountIds(config: OcxConfig, selectedId: string, main: MainAuth): string[] | undefined {
+  // Unknown main identity must not produce a successful but incomplete pause.
+  if (main.status === "unreadable" || main.status === "invalid") return undefined;
+  const identities = new Map<string, AccountIdentity | undefined>();
+  if (main.status === "ok") {
+    const tokens = main.tokens;
+    if (typeof tokens.access_token !== "string" || typeof tokens.account_id !== "string"
+      || (tokens.id_token !== undefined && typeof tokens.id_token !== "string")) return undefined;
+    const claims = [tokens.id_token, tokens.access_token]
+      .filter((token): token is string => typeof token === "string")
+      .map(inspectChatGptDomainClaim);
+    if (claims.some(claim => claim.kind === "invalid")) return undefined;
+    const claimIds = claims.flatMap(claim => claim.kind === "valid" ? [claim.accountId] : []);
+    // organizations[] describes memberships, not the selected workspace. Never use its first row.
+    const accountId = tokens.account_id.trim() || claimIds[0];
+    if (claimIds.some(claim => claim !== accountId)) return undefined;
+    // Both tokens must name the same member; otherwise the bearer's identity is unknown.
+    const emails = new Set([extractEmail(tokens.id_token), extractEmail(undefined, tokens.access_token)]
+      .flatMap(email => email?.trim() ? [email.trim().toLowerCase()] : []));
+    if (emails.size > 1) return undefined;
+    identities.set(MAIN_CODEX_ACCOUNT_ID, identity(accountId, [...emails][0]));
+  }
+  for (const account of config.codexAccounts ?? []) {
+    if (!isSelectableCodexPoolAccount(account)) continue;
+    const credential = getCodexAccountCredential(account.id);
+    identities.set(account.id, identity(credential?.chatgptAccountId, account.email));
+  }
+  const selected = identities.get(selectedId);
+  // Missing identity evidence never links unrelated logins, including members of one workspace.
+  if (!selected) return [selectedId];
+  return [selectedId, ...[...identities].flatMap(([id, candidate]) => (
+    id !== selectedId && candidate?.accountId === selected.accountId && candidate.email === selected.email
+      ? [id] : []
+  ))];
+}
+
+/** Hold admission throughout; claim the physical main whenever its home exists. */
+export async function withCodexAccountPauseGroup(
+  config: OcxConfig,
+  selectedId: string,
+  publish: (accountIds: string[]) => Response,
+): Promise<Response> {
+  const lease = tryAcquireNativeMainProfileClaim();
+  if (!lease) return nativeMainProfileBusyResponse();
+  try {
+    const codexHome = resolveCodexHomeDir();
+    try {
+      lstatSync(codexHome);
+    } catch (error) {
+      // Only positive absence permits Pool-only publication. A dangling symlink or access
+      // failure is not absence; do not create a home just to coordinate an unused main login.
+      if ((error as NodeJS.ErrnoException)?.code !== "ENOENT") return nativeMainProfileBusyResponse();
+      const ids = linkedAccountIds(config, selectedId, { status: "missing" });
+      return ids ? publish(ids) : nativeMainProfileBusyResponse();
+    }
+    const context = resolveNativeProfileContext({ codexHome });
+    return await withNativeMainSharedClaim(context, async () => {
+      const main = readMainAuth(context.authPath);
+      const ids = linkedAccountIds(config, selectedId, main);
+      return ids ? publish(ids) : nativeMainProfileBusyResponse();
+    });
+  } catch (error) {
+    if (isNativeMainClaimUnavailable(error)
+      || (error instanceof NativeProfileError && error.code === "CODEX_HOME_UNAVAILABLE")) {
+      return nativeMainProfileBusyResponse();
+    }
+    throw error;
+  } finally {
+    lease.release();
+  }
+}