@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/types/config.ts

@@ -1,12 +1,8 @@
 import type { OcxProviderConfig } from "./provider";
 import type { CodexAccount } from "./accounts";
-
-export interface AnthropicModelRoute {
-  name: string;
-  match: string;
-  accounts: string[];
-  fallback?: boolean;
-}
+import type { AnthropicAccountPoolConfig, OcxAccountPoolRotationStrategy } from "./anthropic-account-pool";
+import type { AnthropicInstanceId } from "../providers/anthropic-instance-id";
+export type { AnthropicAccountPoolConfig, AnthropicModelRoute, OcxAccountPoolRotationStrategy, OcxAccountPoolQuotaWindow } from "./anthropic-account-pool";
 
 /** Public inference API exposure. Responses and Chat Completions are always served. */
 export interface OcxApiSurfacesConfig {
@@ -178,6 +174,15 @@ export interface OcxClaudeCodeConfig {
   autoContext?: boolean;
   /** Compact-window tokens for auto-context. Default 829_800 (AUTO_COMPACT_WINDOW_DEFAULT). */
   autoCompactWindow?: number;
+  /**
+   * Context accounting on Claude surfaces (devlog/_plan/261009_claude_1m_default/030). Absent
+   * (the default) = "1m": long-window models are offered at 1M wherever opencodex picks the
+   * default (launch env slots, Desktop pickers, Desktop 3P prefer1m, generated subagents).
+   * "200k" is the opt-in: nothing is marked [1m] automatically and no compact window is injected;
+   * a selector the user marks [1m] keeps it, and discovery and Desktop 3P keep offering 1M as a
+   * choice. The only stored value; "1m" deletes the key.
+   */
+  contextAccounting?: "200k";
   /**
    * Local CONNECT proxy + TLS listener that intercepts Claude Code's own `api.anthropic.com`
    * traffic without any `ANTHROPIC_BASE_URL` rewrite (src/claude/intercept). Claude Code reaches
@@ -222,9 +227,9 @@ export interface OcxClaudeCodeConfig {
   /** Optional roster-style model forced on subagents at the next routed Claude Code launch. */
   subagentModelForce?: string;
   /** Claude-originated web-search override. Unset fields inherit the global sidecar settings. */
-  webSearchSidecar?: { backend?: "openai" | "anthropic" | "xai" | "gemini" | "exa"; model?: string };
+  webSearchSidecar?: { backend?: "openai" | "anthropic" | "xai" | "gemini" | "exa"; model?: string; anthropicInstance?: AnthropicInstanceId };
   /** Claude-originated vision override. Unset fields inherit the global sidecar settings. */
-  visionSidecar?: { backend?: "openai" | "anthropic" | "routed"; model?: string };
+  visionSidecar?: { backend?: "openai" | "anthropic" | "routed"; model?: string; anthropicInstance?: AnthropicInstanceId };
   /** Persisted Claude Desktop four-family routing profile. */
   desktopProfile?: OcxClaudeDesktopProfile;
   /**
@@ -1052,6 +1057,8 @@ export interface OcxConfig {
    * upgrade against a number nobody chose.
    */
   spend?: OcxSpendConfig;
+  /** Historical salted pool aliases; h(pool,P) cannot map to Q != P for any configured provider P. */
+  spendPoolAliases?: Record<string, string>;
   /** Opt-in per-account activation of newly reset Codex quota windows. */
   codexQuotaAutoRefresh?: Record<string, {
     fiveHour?: boolean;
@@ -1176,6 +1183,18 @@ export interface OcxConfig {
   accountPoolStickyLimit?: number;
   /** Consecutive non-2xx upstream responses before switching future new threads. Default 3. 0 = disabled. */
   upstreamFailoverThreshold?: number;
+  /**
+   * Sliding 60s transient-failure ratio for Codex pool placement. Default on.
+   * Set false to steer new threads from the consecutive counter only.
+   */
+  codexFailureWindow?: boolean;
+  /**
+   * What a manual pin does while its failure window is degraded.
+   * `hold` keeps using it and logs a warning. `detour-new-threads` places only new threads elsewhere.
+   */
+  codexPinnedTransientPolicy?: "hold" | "detour-new-threads";
+  /** Opt-in: retain one Codex WebSocket per account and thread across turns. Default off. */
+  codexWsReuseAcrossTurns?: boolean;
   /**
    * Opt-in provider-origin circuit threshold for proven pre-connection reachability failures.
    * Default 0 (disabled); range 0..20. The circuit never counts timeouts or HTTP responses.
@@ -1216,21 +1235,7 @@ export interface OcxConfig {
    * upstream has just rate-limited only ever runs after a refusal, so stranding it while a
    * second logged-in account sits idle is a defect rather than a configuration choice.
    */
-  anthropicAccountPool?: {
-    enabled?: boolean;
-    /** Preserve native Claude Messages while the pool is enabled. Default true; false selects legacy translation. */
-    nativeMessages?: boolean;
-    /** Usage % threshold for new-session auto-pick. Default 80. 0 = disabled (affinity/active only). */
-    autoSwitchThreshold?: number;
-    /** New-session rotation strategy. Default quota (today's behaviour). */
-    strategy?: OcxAccountPoolRotationStrategy;
-    /** Successful new-session binds retained on one round-robin selection. Default 1; range 1..100. */
-    stickyLimit?: number;
-    /** Usage window for quota-based scoring. Default "five-hour" (today's behaviour). */
-    quotaWindow?: OcxAccountPoolQuotaWindow;
-    /** Ordered model allowlists; inactive while the pool is disabled. Stored account IDs only. */
-    routes?: AnthropicModelRoute[];
-  };
+  anthropicAccountPool?: AnthropicAccountPoolConfig;
   /**
    * Generic OAuth multi-account PROACTIVE account preference (#2568, #695).
    *
@@ -1262,10 +1267,6 @@ export interface OcxConfig {
   corsAllowOrigins?: string[];
 }
 
-export type OcxAccountPoolRotationStrategy = "quota" | "round-robin" | "fill-first";
-
-export type OcxAccountPoolQuotaWindow = "five-hour" | "weekly" | "max-utilization";
-
 export type OcxComboStrategy = "failover" | "round-robin" | "random" | "least-used" | "reset-window" | "jev";
 export type OcxComboDefaultEffort = "low" | "medium" | "high" | "xhigh" | "max" | "ultra";
 export type OcxComboDefaultEffortMode = "fallback" | "force";
@@ -1526,6 +1527,8 @@ export interface OcxSearchConfig {
 }
 
 export interface OcxVisionSidecarConfig {
+  /** Explicit Anthropic account pool; unset inherits the request's instance. */
+  anthropicInstance?: AnthropicInstanceId;
   /** Master switch. Default: enabled when the selected backend has a usable credential. */
   enabled?: boolean;
   /**
@@ -1545,6 +1548,8 @@ export interface OcxVisionSidecarConfig {
 }
 
 export interface OcxWebSearchSidecarConfig {
+  /** Explicit Anthropic account pool; unset inherits the request's instance. */
+  anthropicInstance?: AnthropicInstanceId;
   /** Master switch. Default: enabled when a forward (ChatGPT) provider exists and the caller is logged in. */
   enabled?: boolean;
   /**

package/src/types/provider.ts

@@ -1,4 +1,5 @@
 import type { UpstreamHttpVersion, ReasoningSummaryDelivery, CodexAccountMode } from "./wire";
+import type { AnthropicAccountPoolConfig } from "./anthropic-account-pool";
 
 /**
  * Per-provider proactive-refresh policy. The guardian only ever touches a provider whose EFFECTIVE
@@ -274,6 +275,10 @@ export interface ModelCapabilities {
 }
 
 export interface OcxProviderConfig {
+  /** Explicit builtin Pool 2 provenance; endpoints never imply ownership. */
+  anthropicOAuthInstance?: "anthropic2";
+  /** Independent Anthropic pool settings; valid only on providers.anthropic2. */
+  anthropicAccountPool?: AnthropicAccountPoolConfig;
   /** Optional browser-compatible outbound TLS profile; disabled by default. */
   tlsProfile?: "antigravity-browser";
   /** Optional short provider namespace used only at request/catalog presentation time. */

package/src/types/request.ts

@@ -1,4 +1,5 @@
 import type { KiroOAuthMetadata } from "../oauth/types";
+import type { NativeReasoningOwner } from "../responses/reasoning-replay-cache";
 import type { OcxTool, OcxToolChoice } from "./tools";
 import type { TierDecision, TierObservationContext } from "./provider";
 
@@ -57,6 +58,10 @@ export interface OcxParsedRequest {
   stream: boolean;
   options: OcxRequestOptions;
   _rawBody?: unknown;
+  /** Claude replay tags, retained only until each route binding verifies them. */
+  _nativeReasoningReplay?: ReadonlyMap<string, string>;
+  _nativeReasoningBoundOwner?: NativeReasoningOwner;
+  _nativeReasoningMint?: { owner?: NativeReasoningOwner };
   /**
    * Boundary between replayed history and this turn's newly appended input. Usually the
    * items the proxy restored from local previous_response_id state; also set when the

package/src/types/tools.ts

@@ -399,6 +399,13 @@ export function isAllowedToolChoice(value: OcxToolChoice | undefined): value is
   return typeof value === "object" && value !== null && "allowedTools" in value;
 }
 
+export function requiresToolCall(choice: OcxToolChoice | undefined): boolean {
+  return choice === "required"
+    || (typeof choice === "object" && choice !== null && (
+      "name" in choice || ("mode" in choice && choice.mode === "required")
+    ));
+}
+
 /** Compile the request's tool-choice policy into a reusable advertisement/restoration predicate. */
 export function toolChoiceToolPredicate(
   choice: OcxToolChoice | undefined,

package/src/types/wire.ts

@@ -47,6 +47,7 @@ export const MODEL_ADAPTER_OVERRIDE_ALLOWED: ReadonlySet<string> = new Set([
  */
 const ANTHROPIC_WIRE_MODELS: Record<string, ReadonlySet<string>> = {
   "opencode-go": new Set([
+    "claude-haiku-5-5",
     "minimax-m2.5",
     "minimax-m2.7",
     "minimax-m3",

package/src/types.ts

@@ -16,6 +16,7 @@ export {
   resolveToolChoiceWireName,
   modelInList,
   isAllowedToolChoice,
+  requiresToolCall,
   toolChoiceToolPredicate,
   declaresCodeModeExec,
   toolRestrictsCallers,
@@ -23,6 +24,9 @@ export {
 } from "./types/tools";
 
 export type { UpstreamHttpVersion, ReasoningSummaryDelivery, CodexAccountMode } from "./types/wire";
+export type { AnthropicInstanceId } from "./providers/anthropic-instance-id";
+export { ANTHROPIC_INSTANCE_IDS, ANTHROPIC_PRIMARY_INSTANCE, ANTHROPIC_POOL2_INSTANCE, isAnthropicInstanceId } from "./providers/anthropic-instance-id";
+export type { AnthropicAccountPoolConfig, AnthropicModelRoute } from "./types/anthropic-account-pool";
 export {
   UPSTREAM_HTTP_VERSION_VALUES,
   REASONING_SUMMARY_DELIVERY_VALUES,

package/src/update/index.ts

@@ -1,4 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
+import { createSupervisionLatch, inspectDesktopSupervision } from "../service/desktop-supervision.mjs";
 import { manualUpdateFailureGuidance } from "./update-failure-guidance.mjs";
 import { STOP_HISTORY_INCOMPLETE_EXIT_CODE } from "./stop-contract.mjs";
 import { proxyIdentityAt } from "../server/proxy-liveness";
@@ -484,14 +485,17 @@ export async function runUpdate(): Promise<void> {
   } catch { /* best-effort */ }
   // What this update may do to the runtime. A desktop takeover vetoes both the stop and the
   // service refresh below; see `planUpdateRuntimeHandling` for why each half is wrong.
+  const supervisionLatch = createSupervisionLatch();
+  const observeSupervision = () => supervisionLatch.observe(inspectDesktopSupervision());
   const initialOwnership = await resolvedRuntimeOwnership();
   const runtimePlan = planUpdateRuntimeHandling({
     ...initialOwnership,
     serviceInstalled: serviceWasInstalled,
+    supervision: observeSupervision(),
   });
   if (runtimePlan.notice) console.log(runtimePlan.notice);
   if (!runtimePlan.mayReplacePackage) {
-    console.error("⚠️  Update stopped before tray handoff, runtime stop, or package replacement because runtime ownership is unknown.");
+    console.error("⚠️  Update stopped before tray handoff, runtime stop, or package replacement because runtime authority does not permit it.");
     return 1;
   }
   let trayWasInstalled = false;
@@ -548,6 +552,15 @@ export async function runUpdate(): Promise<void> {
       && before?.consentGeneration === after?.consentGeneration;
   };
   const startProxyDirectly = async (): Promise<boolean> => {
+    const ownership = await resolvedRuntimeOwnership();
+    const supervision = observeSupervision();
+    const plan = planUpdateRuntimeHandling({ ...ownership, serviceInstalled: false, supervision });
+    if (!plan.mayStopRuntime) {
+      console.warn(supervision
+        ? "OpenCodex Desktop supervises the proxy; no CLI runtime was restored."
+        : plan.notice);
+      return false;
+    }
     if (!postUpdateLauncherUsable || !existsSync(postUpdateLauncher)) return false;
     // An ordinary owner: a stray sibling marker would otherwise mark it before any probe.
     const env = mutation.controlEnvironment(withoutSiblingMarker(process.env));
@@ -574,7 +587,7 @@ export async function runUpdate(): Promise<void> {
       const planRecovery = async () => {
         const current = await resolvedRuntimeOwnership();
         return planStoppedRuntimeRecovery({
-          stopAttempted, ...current, sameOwner: sameOwner(current),
+          stopAttempted, ...current, sameOwner: sameOwner(current), supervision: observeSupervision(),
           liveness: currentPackageRuntimeLiveness(), serviceInstalled: serviceWasInstalled,
           launcherUsable: postUpdateLauncherUsable && existsSync(postUpdateLauncher), hadRuntimeState,
         });
@@ -588,10 +601,17 @@ export async function runUpdate(): Promise<void> {
         mutation.release();
         recovery = await planRecovery();
       }
-      if (recovery.action === "manual") {
+      if (recovery.reason === "desktop-supervised") {
+        console.log("OpenCodex Desktop supervises the proxy; no CLI runtime was restored.");
+      } else if (recovery.action === "manual") {
         console.warn(`⚠️  ${reason}; runtime recovery requires manual review (${recovery.reason}).`);
       } else if (recovery.action === "service") {
         const { serviceReinstallArgs, isServiceViable } = await import("../service");
+        recovery = await planRecovery();
+        if (recovery.action !== "service") {
+          console.warn("Runtime authority changed before service recovery; no CLI runtime was restored.");
+          return;
+        }
         const service = spawnSync(process.execPath, [postUpdateLauncher, ...serviceReinstallArgs()], {
           stdio: updateChildStdio(), windowsHide: true,
           env: mutation.controlEnvironment({ ...process.env, OCX_BAKE_PORT: String(capturedListen.port) }),
@@ -602,7 +622,7 @@ export async function runUpdate(): Promise<void> {
           mutation.reacquire();
           const nowOwned = await resolvedRuntimeOwnership();
           const fallback = planStoppedRuntimeRecovery({
-            stopAttempted, ...nowOwned, sameOwner: sameOwner(nowOwned),
+            stopAttempted, ...nowOwned, sameOwner: sameOwner(nowOwned), supervision: observeSupervision(),
             liveness: currentPackageRuntimeLiveness(), serviceInstalled: false,
             launcherUsable: postUpdateLauncherUsable && existsSync(postUpdateLauncher), hadRuntimeState,
           });
@@ -632,6 +652,15 @@ export async function runUpdate(): Promise<void> {
   // Full `ocx stop` semantics (drain, service stop, restore).
 
   if (runtimePlan.mayStopRuntime && (serviceWasInstalled || readPid() || readRuntimePort() || pendingTeardownOutstanding())) {
+    const preStopPlan = planUpdateRuntimeHandling({
+      ...(await resolvedRuntimeOwnership()),
+      serviceInstalled: serviceWasInstalled,
+      supervision: supervisionLatch.observe(inspectDesktopSupervision({ targetPid: runtimeTrusted ? livePid : undefined })),
+    });
+    if (!preStopPlan.mayStopRuntime) {
+      console.error(preStopPlan.notice);
+      return 1;
+    }
     stopAttempted = true;
     console.log("⏹  Stopping the running proxy before updating...");
     const stopStdio = updateChildStdio();
@@ -701,13 +730,14 @@ export async function runUpdate(): Promise<void> {
     stderr?: string | Buffer | null;
   } | null = null;
   let replacementRefusal: string | null = null;
-  // Ownership can change while registry work is in flight. Unknown at this exact
-  // boundary blocks replacement; a confirmed desktop claim still permits updating the idle
-  // npm installation while leaving the bundled sidecar alone.
+  // Re-read durable ownership and live supervision before package replacement.
+  // Desktop supervision and foreign/unknown ownership veto replacement.
+  // Plain unknown supervision preserves the existing ownership/liveness decision.
   const replacementOwnership = await resolvedRuntimeOwnership();
   const replacementPlan = planUpdateRuntimeHandling({
     ...replacementOwnership,
     serviceInstalled: serviceWasInstalled,
+    supervision: observeSupervision(),
   });
   const replacementLiveness = currentPackageRuntimeLiveness();
   if (replacementOwnership.subjectToken !== initialOwnership.subjectToken
@@ -786,9 +816,11 @@ export async function runUpdate(): Promise<void> {
   const postInstallPlan = planUpdateRuntimeHandling({
     ...(await resolvedRuntimeOwnership()),
     serviceInstalled: serviceWasInstalled,
+    supervision: observeSupervision(),
   });
   if (r.status === 0) {
     console.log(`\n✅ Updated${latest ? ` to v${latest}` : ""}.`);
+    if (!postInstallPlan.mayStopRuntime) console.warn("Runtime authority does not permit CLI recovery; no service was refreshed or proxy started.");
     // Re-enter through the verified active package launcher. This keeps the Codex
     // shim, tray, service and proxy recovery paths on the same package/group that
     // pnpm selected, including when the update changed the global link target.
@@ -819,6 +851,16 @@ export async function runUpdate(): Promise<void> {
     // (spawn the fresh cli.ts so updated code writes the baked paths) so a
     // launchd/schtasks/systemd user isn't left with the background proxy down.
     if (postInstallPlan.mayRestoreService) {
+      const mayRefresh = async () => {
+        const ownership = await resolvedRuntimeOwnership();
+        const supervision = observeSupervision();
+        const plan = planUpdateRuntimeHandling({ ...ownership, serviceInstalled: true, supervision });
+        if (!plan.mayRestoreService) console.warn(supervision
+          ? "OpenCodex Desktop supervises the proxy; CLI recovery was skipped. Use the app's updater (tray → Check for Updates)."
+          : plan.notice);
+        return plan.mayRestoreService;
+      };
+      if (!await mayRefresh()) return;
       console.log("🔁 Refreshing the background service with the updated files...");
       const { serviceReinstallArgs } = await import("../service");
       const { reclaimListenPort } = await import("../server/port-reclaim");
@@ -840,6 +882,7 @@ export async function runUpdate(): Promise<void> {
       const prevBake = process.env.OCX_BAKE_PORT;
       process.env.OCX_BAKE_PORT = String(capturedListen.port);
       try {
+        if (!await mayRefresh()) return;
         const svcStdio = updateChildStdio();
         const svc = spawnSync(process.execPath, [postUpdateLauncher, ...serviceReinstallArgs()], {
           env: mutation.controlEnvironment(),
@@ -889,12 +932,17 @@ export async function runUpdate(): Promise<void> {
               console.warn(`   Run 'ocx service repair', then 'ocx start --port ${capturedListen.port}'.`);
               return 1;
             }
+            const fallbackOwnership = await resolvedRuntimeOwnership();
+            const supervision = observeSupervision();
             const nowOwned = planUpdateRuntimeHandling({
-              ...(await resolvedRuntimeOwnership()),
+              ...fallbackOwnership,
               serviceInstalled: true,
+              supervision,
             });
             if (!nowOwned.mayStopRuntime) {
-              console.warn(nowOwned.notice ?? "⚠️  The background runtime is owned elsewhere; not starting a second proxy.");
+              console.warn(supervision
+                ? "OpenCodex Desktop supervises the proxy; CLI recovery was skipped. Use the app's updater (tray → Check for Updates)."
+                : nowOwned.notice ?? "⚠️  The background runtime is owned elsewhere; not starting a second proxy.");
               return;
             }
             console.warn(

package/src/update/restart-ownership.ts

@@ -6,6 +6,8 @@ import {
   OWNERSHIP_MUTATION_LEASE_TOKEN_ENV,
 } from "../service/ownership-mutation-lease.mjs";
 import { planUpdateRuntimeHandling } from "./runtime-ownership.mjs";
+import { createSupervisionLatch, inspectDesktopSupervision } from "../service/desktop-supervision.mjs";
+type SupervisionInspector = typeof inspectDesktopSupervision;
 
 export type { ServiceOwnershipResolution };
 
@@ -24,6 +26,8 @@ export type { ServiceOwnershipResolution };
  */
 export function updateRestartVeto(
   resolve: () => ServiceOwnershipResolution = resolveServiceOwnership,
+  inspect: SupervisionInspector = inspectDesktopSupervision,
+  latch = createSupervisionLatch(),
 ): string | null {
   const owner = resolve();
   const plan = planUpdateRuntimeHandling({
@@ -31,6 +35,7 @@ export function updateRestartVeto(
     ownershipUnknown: owner.kind === "unknown",
     // The restart decision does not refresh the service; only the stop veto is read here.
     serviceInstalled: false,
+    supervision: latch.observe(inspect()),
   });
   if (plan.mayStopRuntime) return null;
   return plan.notice ?? "The background runtime is owned elsewhere; it was left running.";
@@ -78,7 +83,9 @@ const REACQUIRE_WAIT_MS = 10_000;
 export async function runUpdateRestartWithOwnershipLease<T>(
   resolve: (() => ServiceOwnershipResolution) | undefined,
   restart: (lease: UpdateRestartLeaseControl) => Promise<T>,
+  inspect: SupervisionInspector = inspectDesktopSupervision,
 ): Promise<{ readonly kind: "veto"; readonly notice: string } | { readonly kind: "ran"; readonly value: T }> {
+  const latch = createSupervisionLatch();
   let lease = acquireOwnershipMutationLease(serviceStatePaths());
   const previous = process.env[OWNERSHIP_MUTATION_LEASE_TOKEN_ENV];
   process.env[OWNERSHIP_MUTATION_LEASE_TOKEN_ENV] = lease.token;
@@ -107,11 +114,11 @@ export async function runUpdateRestartWithOwnershipLease<T>(
       heldNow = true;
       process.env[OWNERSHIP_MUTATION_LEASE_TOKEN_ENV] = lease.token;
     }
-    const veto = updateRestartVeto(resolve);
+    const veto = updateRestartVeto(resolve, inspect, latch);
     return veto ? { notice: veto, failed: false } : null;
   };
   try {
-    const veto = updateRestartVeto(resolve);
+    const veto = updateRestartVeto(resolve, inspect, latch);
     return veto
       ? { kind: "veto", notice: veto }
       : {
@@ -119,7 +126,7 @@ export async function runUpdateRestartWithOwnershipLease<T>(
           value: await restart({
             releaseForServiceManager: release,
             reacquireForDirectStart,
-            vetoAgain: () => updateRestartVeto(resolve),
+            vetoAgain: () => updateRestartVeto(resolve, inspect, latch),
           }),
         };
   } finally {

package/src/update/runtime-ownership.d.mts

@@ -1,6 +1,10 @@
+import type { SupervisionEvidence } from "../service/desktop-supervision.mjs";
+
 export declare function planUpdateRuntimeHandling(input: {
   ownership: { owner: string; installId: string; consentGeneration: number } | null;
   ownershipUnknown?: boolean;
+  /** Fresh evidence or the operation's supervision latch verdict. */
+  supervision?: SupervisionEvidence | boolean;
   serviceInstalled: boolean;
 }): {
   mayReplacePackage: boolean;
@@ -13,6 +17,8 @@ export declare function planStoppedRuntimeRecovery(input: {
   stopAttempted: boolean;
   ownership: { owner: string; installId: string; consentGeneration: number } | null;
   ownershipUnknown?: boolean;
+  /** Fresh evidence or the operation's supervision latch verdict. */
+  supervision?: SupervisionEvidence | boolean;
   sameOwner: boolean;
   liveness: "live" | "dead" | "unknown";
   serviceInstalled: boolean;

package/src/update/runtime-ownership.mjs

@@ -7,6 +7,11 @@
  * situation separately is how a fix ships on one side only.
  */
 
+function desktopSupervisionBlocked(supervision) {
+  return supervision === true || supervision?.kind === "desktop"
+    || (supervision?.kind === "unknown" && supervision.desktopSeen);
+}
+
 /**
  * Decide how an update treats a runtime it may not own.
  *
@@ -21,11 +26,11 @@
  * The service registration itself is untouched in every case. It is kept by decision, not by
  * accident, so a user who later runs `ocx service install` gets their npm service back.
  *
- * THE COST OF A STALE MARKER. This reads the recorded claim, not liveness. An app deleted
- * without releasing ownership leaves a marker behind, and an update then declines to stop or
- * refresh a runtime no app is managing any more. That is the orphan-recovery cost the
- * two-record ownership design accepted; `ocx service install` clears the marker and restores
- * the ordinary path.
+ * Durable ownership and live supervision are separate. Desktop supervision denies package
+ * replacement, stop and restoration even without a claim. A latch retains that veto through
+ * inconclusive probes until a positive none. Plain unknown supervision alone keeps existing
+ * behavior; unknown durable ownership still vetoes. Explicit service install recovers a stale
+ * durable claim after Desktop has quit.
  *
  * The three returned flags are separate authorities, not commands. In particular, leaving
  * a runtime running is not permission to replace the package it may be executing from.
@@ -34,10 +39,19 @@
  * carries installation identity, it therefore blocks package replacement as well as stop and
  * restoration; the notice tells a stale-marker user how to take ownership back explicitly.
  *
- * @param {{ ownership: { owner: string, installId: string, consentGeneration: number } | null, ownershipUnknown?: boolean, serviceInstalled: boolean }} input
+ * @param {{ ownership: { owner: string, installId: string, consentGeneration: number } | null, ownershipUnknown?: boolean, serviceInstalled: boolean, supervision?: boolean | ReturnType<typeof import('../service/desktop-supervision.mjs').inspectDesktopSupervision> }} input
  * @returns {{ mayReplacePackage: boolean, mayStopRuntime: boolean, mayRestoreService: boolean, notice: string | null }}
  */
-export function planUpdateRuntimeHandling({ ownership, ownershipUnknown = false, serviceInstalled }) {
+export function planUpdateRuntimeHandling({ ownership, ownershipUnknown = false, serviceInstalled, supervision }) {
+  if (desktopSupervisionBlocked(supervision)) {
+    return {
+      mayReplacePackage: false,
+      mayStopRuntime: false,
+      mayRestoreService: false,
+      notice: "OpenCodex Desktop runs this proxy from its own bundle; use the app's updater (tray → Check for Updates). "
+        + "This npm/Bun install was left unchanged; quit OpenCodex first to update it.",
+    };
+  }
   // Unreadable, malformed or contradictory is not "nobody owns it". Reading it that way is
   // how a permissions error reactivates the npm launcher over a consented takeover.
   if (ownershipUnknown) {
@@ -77,6 +91,7 @@ export function planUpdateRuntimeHandling({ ownership, ownershipUnknown = false,
 /** Decide recovery after this updater already stopped the prior CLI-owned runtime. */
 export function planStoppedRuntimeRecovery({
   stopAttempted,
+  supervision,
   ownership,
   ownershipUnknown = false,
   sameOwner,
@@ -86,6 +101,7 @@ export function planStoppedRuntimeRecovery({
   hadRuntimeState,
 }) {
   if (!stopAttempted) return { action: "none", reason: "not-stopped" };
+  if (desktopSupervisionBlocked(supervision)) return { action: "none", reason: "desktop-supervised" };
   if (ownershipUnknown) return { action: "manual", reason: "ownership-unknown" };
   if (!sameOwner || (ownership && ownership.owner !== "cli")) {
     return { action: "none", reason: "ownership-transferred" };

package/src/usage/cost.ts

@@ -30,6 +30,7 @@ import {
   cursorFastPriceSupported,
   findContextTier,
   isLongContext,
+  pricingFamilyProvider,
   type Cost4,
   type ExpectedPriceOverlay,
   type ExpectedPriceStatus,
@@ -262,7 +263,7 @@ function resolveMatchedPriceExact(
   if (userOverlay) return userOverlay;
   if (!cursorFastPriceSupported(provider, modelId)) return null;
   const verifiedOverride = overlays === EXPECTED_PRICE_OVERLAYS
-    ? findVerifiedPriceOverride(provider, modelId)
+    ? findVerifiedPriceOverride(pricingFamilyProvider(provider), modelId)
     : undefined;
   if (verifiedOverride && verifiedOverride.status !== "unverified" && validCost4(verifiedOverride.cost4) && hasNonZeroCost(verifiedOverride.cost4)) {
     return {
@@ -291,7 +292,7 @@ function resolveMatchedPriceExact(
       ...cursorFastPriceProvenance(provider, modelId),
     };
   }
-  const overlay = findExpectedPriceOverlay(provider, modelId, overlays);
+  const overlay = findExpectedPriceOverlay(overlays === EXPECTED_PRICE_OVERLAYS ? pricingFamilyProvider(provider) : provider, modelId, overlays);
   if (!overlay || !validCost4(overlay.cost4) || !hasNonZeroCost(overlay.cost4)) {
     if (options.allowModelLevelFallback === false) return null;
     const fallback = resolveModelLevelPrice(provider, modelId);