@bitkyc08/opencodex 2.81.0 → 2.82.0

package/src/update/index.ts

@@ -1,4 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
+import { createSupervisionLatch, inspectDesktopSupervision } from "../service/desktop-supervision.mjs";
 import { manualUpdateFailureGuidance } from "./update-failure-guidance.mjs";
 import { STOP_HISTORY_INCOMPLETE_EXIT_CODE } from "./stop-contract.mjs";
 import { proxyIdentityAt } from "../server/proxy-liveness";
@@ -484,14 +485,17 @@ export async function runUpdate(): Promise<void> {
   } catch { /* best-effort */ }
   // What this update may do to the runtime. A desktop takeover vetoes both the stop and the
   // service refresh below; see `planUpdateRuntimeHandling` for why each half is wrong.
+  const supervisionLatch = createSupervisionLatch();
+  const observeSupervision = () => supervisionLatch.observe(inspectDesktopSupervision());
   const initialOwnership = await resolvedRuntimeOwnership();
   const runtimePlan = planUpdateRuntimeHandling({
     ...initialOwnership,
     serviceInstalled: serviceWasInstalled,
+    supervision: observeSupervision(),
   });
   if (runtimePlan.notice) console.log(runtimePlan.notice);
   if (!runtimePlan.mayReplacePackage) {
-    console.error("⚠️  Update stopped before tray handoff, runtime stop, or package replacement because runtime ownership is unknown.");
+    console.error("⚠️  Update stopped before tray handoff, runtime stop, or package replacement because runtime authority does not permit it.");
     return 1;
   }
   let trayWasInstalled = false;
@@ -548,6 +552,15 @@ export async function runUpdate(): Promise<void> {
       && before?.consentGeneration === after?.consentGeneration;
   };
   const startProxyDirectly = async (): Promise<boolean> => {
+    const ownership = await resolvedRuntimeOwnership();
+    const supervision = observeSupervision();
+    const plan = planUpdateRuntimeHandling({ ...ownership, serviceInstalled: false, supervision });
+    if (!plan.mayStopRuntime) {
+      console.warn(supervision
+        ? "OpenCodex Desktop supervises the proxy; no CLI runtime was restored."
+        : plan.notice);
+      return false;
+    }
     if (!postUpdateLauncherUsable || !existsSync(postUpdateLauncher)) return false;
     // An ordinary owner: a stray sibling marker would otherwise mark it before any probe.
     const env = mutation.controlEnvironment(withoutSiblingMarker(process.env));
@@ -574,7 +587,7 @@ export async function runUpdate(): Promise<void> {
       const planRecovery = async () => {
         const current = await resolvedRuntimeOwnership();
         return planStoppedRuntimeRecovery({
-          stopAttempted, ...current, sameOwner: sameOwner(current),
+          stopAttempted, ...current, sameOwner: sameOwner(current), supervision: observeSupervision(),
           liveness: currentPackageRuntimeLiveness(), serviceInstalled: serviceWasInstalled,
           launcherUsable: postUpdateLauncherUsable && existsSync(postUpdateLauncher), hadRuntimeState,
         });
@@ -588,10 +601,17 @@ export async function runUpdate(): Promise<void> {
         mutation.release();
         recovery = await planRecovery();
       }
-      if (recovery.action === "manual") {
+      if (recovery.reason === "desktop-supervised") {
+        console.log("OpenCodex Desktop supervises the proxy; no CLI runtime was restored.");
+      } else if (recovery.action === "manual") {
         console.warn(`⚠️  ${reason}; runtime recovery requires manual review (${recovery.reason}).`);
       } else if (recovery.action === "service") {
         const { serviceReinstallArgs, isServiceViable } = await import("../service");
+        recovery = await planRecovery();
+        if (recovery.action !== "service") {
+          console.warn("Runtime authority changed before service recovery; no CLI runtime was restored.");
+          return;
+        }
         const service = spawnSync(process.execPath, [postUpdateLauncher, ...serviceReinstallArgs()], {
           stdio: updateChildStdio(), windowsHide: true,
           env: mutation.controlEnvironment({ ...process.env, OCX_BAKE_PORT: String(capturedListen.port) }),
@@ -602,7 +622,7 @@ export async function runUpdate(): Promise<void> {
           mutation.reacquire();
           const nowOwned = await resolvedRuntimeOwnership();
           const fallback = planStoppedRuntimeRecovery({
-            stopAttempted, ...nowOwned, sameOwner: sameOwner(nowOwned),
+            stopAttempted, ...nowOwned, sameOwner: sameOwner(nowOwned), supervision: observeSupervision(),
             liveness: currentPackageRuntimeLiveness(), serviceInstalled: false,
             launcherUsable: postUpdateLauncherUsable && existsSync(postUpdateLauncher), hadRuntimeState,
           });
@@ -632,6 +652,15 @@ export async function runUpdate(): Promise<void> {
   // Full `ocx stop` semantics (drain, service stop, restore).
 
   if (runtimePlan.mayStopRuntime && (serviceWasInstalled || readPid() || readRuntimePort() || pendingTeardownOutstanding())) {
+    const preStopPlan = planUpdateRuntimeHandling({
+      ...(await resolvedRuntimeOwnership()),
+      serviceInstalled: serviceWasInstalled,
+      supervision: supervisionLatch.observe(inspectDesktopSupervision({ targetPid: runtimeTrusted ? livePid : undefined })),
+    });
+    if (!preStopPlan.mayStopRuntime) {
+      console.error(preStopPlan.notice);
+      return 1;
+    }
     stopAttempted = true;
     console.log("⏹  Stopping the running proxy before updating...");
     const stopStdio = updateChildStdio();
@@ -701,13 +730,14 @@ export async function runUpdate(): Promise<void> {
     stderr?: string | Buffer | null;
   } | null = null;
   let replacementRefusal: string | null = null;
-  // Ownership can change while registry work is in flight. Unknown at this exact
-  // boundary blocks replacement; a confirmed desktop claim still permits updating the idle
-  // npm installation while leaving the bundled sidecar alone.
+  // Re-read durable ownership and live supervision before package replacement.
+  // Desktop supervision and foreign/unknown ownership veto replacement.
+  // Plain unknown supervision preserves the existing ownership/liveness decision.
   const replacementOwnership = await resolvedRuntimeOwnership();
   const replacementPlan = planUpdateRuntimeHandling({
     ...replacementOwnership,
     serviceInstalled: serviceWasInstalled,
+    supervision: observeSupervision(),
   });
   const replacementLiveness = currentPackageRuntimeLiveness();
   if (replacementOwnership.subjectToken !== initialOwnership.subjectToken
@@ -786,9 +816,11 @@ export async function runUpdate(): Promise<void> {
   const postInstallPlan = planUpdateRuntimeHandling({
     ...(await resolvedRuntimeOwnership()),
     serviceInstalled: serviceWasInstalled,
+    supervision: observeSupervision(),
   });
   if (r.status === 0) {
     console.log(`\n✅ Updated${latest ? ` to v${latest}` : ""}.`);
+    if (!postInstallPlan.mayStopRuntime) console.warn("Runtime authority does not permit CLI recovery; no service was refreshed or proxy started.");
     // Re-enter through the verified active package launcher. This keeps the Codex
     // shim, tray, service and proxy recovery paths on the same package/group that
     // pnpm selected, including when the update changed the global link target.
@@ -819,6 +851,16 @@ export async function runUpdate(): Promise<void> {
     // (spawn the fresh cli.ts so updated code writes the baked paths) so a
     // launchd/schtasks/systemd user isn't left with the background proxy down.
     if (postInstallPlan.mayRestoreService) {
+      const mayRefresh = async () => {
+        const ownership = await resolvedRuntimeOwnership();
+        const supervision = observeSupervision();
+        const plan = planUpdateRuntimeHandling({ ...ownership, serviceInstalled: true, supervision });
+        if (!plan.mayRestoreService) console.warn(supervision
+          ? "OpenCodex Desktop supervises the proxy; CLI recovery was skipped. Use the app's updater (tray → Check for Updates)."
+          : plan.notice);
+        return plan.mayRestoreService;
+      };
+      if (!await mayRefresh()) return;
       console.log("🔁 Refreshing the background service with the updated files...");
       const { serviceReinstallArgs } = await import("../service");
       const { reclaimListenPort } = await import("../server/port-reclaim");
@@ -840,6 +882,7 @@ export async function runUpdate(): Promise<void> {
       const prevBake = process.env.OCX_BAKE_PORT;
       process.env.OCX_BAKE_PORT = String(capturedListen.port);
       try {
+        if (!await mayRefresh()) return;
         const svcStdio = updateChildStdio();
         const svc = spawnSync(process.execPath, [postUpdateLauncher, ...serviceReinstallArgs()], {
           env: mutation.controlEnvironment(),
@@ -889,12 +932,17 @@ export async function runUpdate(): Promise<void> {
               console.warn(`   Run 'ocx service repair', then 'ocx start --port ${capturedListen.port}'.`);
               return 1;
             }
+            const fallbackOwnership = await resolvedRuntimeOwnership();
+            const supervision = observeSupervision();
             const nowOwned = planUpdateRuntimeHandling({
-              ...(await resolvedRuntimeOwnership()),
+              ...fallbackOwnership,
               serviceInstalled: true,
+              supervision,
             });
             if (!nowOwned.mayStopRuntime) {
-              console.warn(nowOwned.notice ?? "⚠️  The background runtime is owned elsewhere; not starting a second proxy.");
+              console.warn(supervision
+                ? "OpenCodex Desktop supervises the proxy; CLI recovery was skipped. Use the app's updater (tray → Check for Updates)."
+                : nowOwned.notice ?? "⚠️  The background runtime is owned elsewhere; not starting a second proxy.");
               return;
             }
             console.warn(

package/src/update/restart-ownership.ts

@@ -6,6 +6,8 @@ import {
   OWNERSHIP_MUTATION_LEASE_TOKEN_ENV,
 } from "../service/ownership-mutation-lease.mjs";
 import { planUpdateRuntimeHandling } from "./runtime-ownership.mjs";
+import { createSupervisionLatch, inspectDesktopSupervision } from "../service/desktop-supervision.mjs";
+type SupervisionInspector = typeof inspectDesktopSupervision;
 
 export type { ServiceOwnershipResolution };
 
@@ -24,6 +26,8 @@ export type { ServiceOwnershipResolution };
  */
 export function updateRestartVeto(
   resolve: () => ServiceOwnershipResolution = resolveServiceOwnership,
+  inspect: SupervisionInspector = inspectDesktopSupervision,
+  latch = createSupervisionLatch(),
 ): string | null {
   const owner = resolve();
   const plan = planUpdateRuntimeHandling({
@@ -31,6 +35,7 @@ export function updateRestartVeto(
     ownershipUnknown: owner.kind === "unknown",
     // The restart decision does not refresh the service; only the stop veto is read here.
     serviceInstalled: false,
+    supervision: latch.observe(inspect()),
   });
   if (plan.mayStopRuntime) return null;
   return plan.notice ?? "The background runtime is owned elsewhere; it was left running.";
@@ -78,7 +83,9 @@ const REACQUIRE_WAIT_MS = 10_000;
 export async function runUpdateRestartWithOwnershipLease<T>(
   resolve: (() => ServiceOwnershipResolution) | undefined,
   restart: (lease: UpdateRestartLeaseControl) => Promise<T>,
+  inspect: SupervisionInspector = inspectDesktopSupervision,
 ): Promise<{ readonly kind: "veto"; readonly notice: string } | { readonly kind: "ran"; readonly value: T }> {
+  const latch = createSupervisionLatch();
   let lease = acquireOwnershipMutationLease(serviceStatePaths());
   const previous = process.env[OWNERSHIP_MUTATION_LEASE_TOKEN_ENV];
   process.env[OWNERSHIP_MUTATION_LEASE_TOKEN_ENV] = lease.token;
@@ -107,11 +114,11 @@ export async function runUpdateRestartWithOwnershipLease<T>(
       heldNow = true;
       process.env[OWNERSHIP_MUTATION_LEASE_TOKEN_ENV] = lease.token;
     }
-    const veto = updateRestartVeto(resolve);
+    const veto = updateRestartVeto(resolve, inspect, latch);
     return veto ? { notice: veto, failed: false } : null;
   };
   try {
-    const veto = updateRestartVeto(resolve);
+    const veto = updateRestartVeto(resolve, inspect, latch);
     return veto
       ? { kind: "veto", notice: veto }
       : {
@@ -119,7 +126,7 @@ export async function runUpdateRestartWithOwnershipLease<T>(
           value: await restart({
             releaseForServiceManager: release,
             reacquireForDirectStart,
-            vetoAgain: () => updateRestartVeto(resolve),
+            vetoAgain: () => updateRestartVeto(resolve, inspect, latch),
           }),
         };
   } finally {

package/src/update/runtime-ownership.d.mts

@@ -1,6 +1,10 @@
+import type { SupervisionEvidence } from "../service/desktop-supervision.mjs";
+
 export declare function planUpdateRuntimeHandling(input: {
   ownership: { owner: string; installId: string; consentGeneration: number } | null;
   ownershipUnknown?: boolean;
+  /** Fresh evidence or the operation's supervision latch verdict. */
+  supervision?: SupervisionEvidence | boolean;
   serviceInstalled: boolean;
 }): {
   mayReplacePackage: boolean;
@@ -13,6 +17,8 @@ export declare function planStoppedRuntimeRecovery(input: {
   stopAttempted: boolean;
   ownership: { owner: string; installId: string; consentGeneration: number } | null;
   ownershipUnknown?: boolean;
+  /** Fresh evidence or the operation's supervision latch verdict. */
+  supervision?: SupervisionEvidence | boolean;
   sameOwner: boolean;
   liveness: "live" | "dead" | "unknown";
   serviceInstalled: boolean;

package/src/update/runtime-ownership.mjs

@@ -7,6 +7,11 @@
  * situation separately is how a fix ships on one side only.
  */
 
+function desktopSupervisionBlocked(supervision) {
+  return supervision === true || supervision?.kind === "desktop"
+    || (supervision?.kind === "unknown" && supervision.desktopSeen);
+}
+
 /**
  * Decide how an update treats a runtime it may not own.
  *
@@ -21,11 +26,11 @@
  * The service registration itself is untouched in every case. It is kept by decision, not by
  * accident, so a user who later runs `ocx service install` gets their npm service back.
  *
- * THE COST OF A STALE MARKER. This reads the recorded claim, not liveness. An app deleted
- * without releasing ownership leaves a marker behind, and an update then declines to stop or
- * refresh a runtime no app is managing any more. That is the orphan-recovery cost the
- * two-record ownership design accepted; `ocx service install` clears the marker and restores
- * the ordinary path.
+ * Durable ownership and live supervision are separate. Desktop supervision denies package
+ * replacement, stop and restoration even without a claim. A latch retains that veto through
+ * inconclusive probes until a positive none. Plain unknown supervision alone keeps existing
+ * behavior; unknown durable ownership still vetoes. Explicit service install recovers a stale
+ * durable claim after Desktop has quit.
  *
  * The three returned flags are separate authorities, not commands. In particular, leaving
  * a runtime running is not permission to replace the package it may be executing from.
@@ -34,10 +39,19 @@
  * carries installation identity, it therefore blocks package replacement as well as stop and
  * restoration; the notice tells a stale-marker user how to take ownership back explicitly.
  *
- * @param {{ ownership: { owner: string, installId: string, consentGeneration: number } | null, ownershipUnknown?: boolean, serviceInstalled: boolean }} input
+ * @param {{ ownership: { owner: string, installId: string, consentGeneration: number } | null, ownershipUnknown?: boolean, serviceInstalled: boolean, supervision?: boolean | ReturnType<typeof import('../service/desktop-supervision.mjs').inspectDesktopSupervision> }} input
  * @returns {{ mayReplacePackage: boolean, mayStopRuntime: boolean, mayRestoreService: boolean, notice: string | null }}
  */
-export function planUpdateRuntimeHandling({ ownership, ownershipUnknown = false, serviceInstalled }) {
+export function planUpdateRuntimeHandling({ ownership, ownershipUnknown = false, serviceInstalled, supervision }) {
+  if (desktopSupervisionBlocked(supervision)) {
+    return {
+      mayReplacePackage: false,
+      mayStopRuntime: false,
+      mayRestoreService: false,
+      notice: "OpenCodex Desktop runs this proxy from its own bundle; use the app's updater (tray → Check for Updates). "
+        + "This npm/Bun install was left unchanged; quit OpenCodex first to update it.",
+    };
+  }
   // Unreadable, malformed or contradictory is not "nobody owns it". Reading it that way is
   // how a permissions error reactivates the npm launcher over a consented takeover.
   if (ownershipUnknown) {
@@ -77,6 +91,7 @@ export function planUpdateRuntimeHandling({ ownership, ownershipUnknown = false,
 /** Decide recovery after this updater already stopped the prior CLI-owned runtime. */
 export function planStoppedRuntimeRecovery({
   stopAttempted,
+  supervision,
   ownership,
   ownershipUnknown = false,
   sameOwner,
@@ -86,6 +101,7 @@ export function planStoppedRuntimeRecovery({
   hadRuntimeState,
 }) {
   if (!stopAttempted) return { action: "none", reason: "not-stopped" };
+  if (desktopSupervisionBlocked(supervision)) return { action: "none", reason: "desktop-supervised" };
   if (ownershipUnknown) return { action: "manual", reason: "ownership-unknown" };
   if (!sameOwner || (ownership && ownership.owner !== "cli")) {
     return { action: "none", reason: "ownership-transferred" };

package/src/web-search/loop.ts

@@ -323,7 +323,7 @@ export interface WebSearchLoopDeps {
   /** Observe the exact adapter request selected for each routed-model iteration. */
   onRequestBuilt?: (request: AdapterRequest) => void;
   /** Request-scoped executor retains the core's selection binding across loop retries. */
-  fetchForRequest?: (request: AdapterRequest, parsed: OcxParsedRequest) => typeof globalThis.fetch;
+  fetchForRequest?: (request: AdapterRequest, parsed: OcxParsedRequest, adapter: ProviderAdapter) => typeof globalThis.fetch;
   /** Called before each routed-model dispatch in the loop, for attempt telemetry. Same-target 429 replays pass the `rate-limit-429` recovery kind. */
   onAttemptSend?: (recovery?: AttemptRecoveryKind) => void;
   /**
@@ -494,7 +494,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
           cachedRequest = request;
           cachedAdapter = requestAdapter;
         }
-        const requestFetch = headerDeadline.pacedFetch(deps.fetchForRequest?.(request, iterParsed) ?? routedProviderFetch);
+        const requestFetch = headerDeadline.pacedFetch(deps.fetchForRequest?.(request, iterParsed, requestAdapter) ?? routedProviderFetch);
         let response: Response;
         try {
           if (requestAdapter.fetchResponse) {
@@ -507,6 +507,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
               sendBudget: deps.incomingMeta.sendBudget,
               onPhysicalSend: deps.incomingMeta.onPhysicalSend,
               executor: requestFetch,
+              onRecoveryWithheld: deps.incomingMeta.onRecoveryWithheld,
             });
           } else {
             response = await fetchWithResetRetry(
@@ -576,6 +577,8 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       // 429 key-failover parity with the normal routed path: rotate pool keys until one responds
       // or the pool is exhausted (deps.on429 returns null — cooldown map guarantees termination).
       while ((prepared.response.status === 429
+        || (prepared.response.status === 401 && isAnthropicInstanceId(deps.incomingMeta?.providerName)
+          && !accountRefusalOutputStarted)
         || (prepared.response.status === 403
           && (isAnthropicInstanceId(deps.incomingMeta?.providerName) || deps.incomingMeta?.providerName === "google-antigravity")
           && !accountRefusalOutputStarted)