@bitkyc08/opencodex 2.81.0 → 2.83.0

package/src/storage/policy-job.ts

@@ -65,6 +65,8 @@ export interface PolicyJobTestHooks {
    * policy load, so concurrent PUTs can race completion metadata writes.
    */
   blockMs?: number;
+  /** Test-only shared barrier after the Worker has loaded its initial policy. */
+  workerLoadGate?: Int32Array;
   /**
    * When true, run on the main thread via `queueMicrotask` + optional sleep.
    * Used only for unit tests that cannot spawn workers; responsiveness tests
@@ -304,7 +306,7 @@ function applyMutationBusy(): void {
   };
 }
 
-function runInWorker(opts: RequestPolicyRunOptions & { blockMs?: number }): Promise<PolicyRunResult> {
+function runInWorker(opts: RequestPolicyRunOptions & { blockMs?: number; workerLoadGate?: Int32Array }): Promise<PolicyRunResult> {
   const reservation = tryReserveStorageWorker();
   if (!reservation) return Promise.reject(new StorageWorkerAdmissionBusyError());
   return withStorageWorkerSpawnGate(() => new Promise<PolicyRunResult>((resolve, reject) => {
@@ -369,6 +371,7 @@ function runInWorker(opts: RequestPolicyRunOptions & { blockMs?: number }): Prom
       ...(opts.codexHome ? { codexHome: opts.codexHome } : {}),
       ...(opts.busyTimeoutMs !== undefined ? { busyTimeoutMs: opts.busyTimeoutMs } : {}),
       ...(opts.blockMs !== undefined ? { blockMs: opts.blockMs } : {}),
+      ...(opts.workerLoadGate ? { workerLoadGate: opts.workerLoadGate } : {}),
       env: {
         ...(process.env.CODEX_HOME ? { CODEX_HOME: process.env.CODEX_HOME } : {}),
         ...(process.env.OPENCODEX_HOME ? { OPENCODEX_HOME: process.env.OPENCODEX_HOME } : {}),
@@ -410,6 +413,7 @@ async function executeJob(opts: RequestPolicyRunOptions): Promise<void> {
         ...opts,
         codexHome,
         ...(typeof blockMs === "number" && blockMs > 0 ? { blockMs } : {}),
+        ...(testHooks?.workerLoadGate ? { workerLoadGate: testHooks.workerLoadGate } : {}),
       });
     }
 

package/src/storage/policy-worker.ts

@@ -13,6 +13,7 @@ interface RunMessage {
   busyTimeoutMs?: number;
   /** Test-only: block after loading the start-of-job policy (see holdAfterLoadMs). */
   blockMs?: number;
+  workerLoadGate?: Int32Array;
   /** Env snapshot — Workers may not see parent mutations on all platforms. */
   env?: { CODEX_HOME?: string; OPENCODEX_HOME?: string };
 }
@@ -29,7 +30,7 @@ declare const self: Worker;
 
 self.onmessage = (event: MessageEvent<unknown>) => {
   if (!isRunMessage(event.data)) return;
-  const { requestId, reason, force, codexHome, busyTimeoutMs, blockMs, env } = event.data;
+  const { requestId, reason, force, codexHome, busyTimeoutMs, blockMs, workerLoadGate, env } = event.data;
   try {
     if (env?.CODEX_HOME) process.env.CODEX_HOME = env.CODEX_HOME;
     if (env?.OPENCODEX_HOME) process.env.OPENCODEX_HOME = env.OPENCODEX_HOME;
@@ -38,6 +39,7 @@ self.onmessage = (event: MessageEvent<unknown>) => {
       force: force === true,
       ...(codexHome ? { codexHome } : {}),
       ...(busyTimeoutMs !== undefined ? { busyTimeoutMs } : {}),
+      ...(workerLoadGate ? { holdAfterLoadGate: workerLoadGate } : {}),
       ...(typeof blockMs === "number" && Number.isFinite(blockMs) && blockMs > 0
         ? { holdAfterLoadMs: Math.floor(blockMs) }
         : {}),

package/src/storage/policy.ts

@@ -74,6 +74,8 @@ export interface PolicyRunDeps {
    * land before completion merges run metadata.
    */
   holdAfterLoadMs?: number;
+  /** Test-only Worker barrier: 0=pending, 1=policy loaded, 2=released. */
+  holdAfterLoadGate?: Int32Array;
 }
 
 /** Canonical defaults — enabled is always false. */
@@ -500,6 +502,13 @@ export function runStorageCleanupPolicy(deps: PolicyRunDeps): PolicyRunResult {
       })
     : (patch: PolicyRunMetadataPatch) => commitPolicyRunMetadataToConfig(patch, policy);
 
+  if (deps.holdAfterLoadGate) {
+    Atomics.compareExchange(deps.holdAfterLoadGate, 0, 0, 1);
+    Atomics.notify(deps.holdAfterLoadGate, 0);
+    if (Atomics.wait(deps.holdAfterLoadGate, 0, 1, 10_000) === "timed-out") {
+      throw new Error("policy_test_load_gate_timeout");
+    }
+  }
   if (typeof deps.holdAfterLoadMs === "number" && Number.isFinite(deps.holdAfterLoadMs) && deps.holdAfterLoadMs > 0) {
     Bun.sleepSync(Math.floor(deps.holdAfterLoadMs));
   }

package/src/types/config.ts

@@ -174,6 +174,15 @@ export interface OcxClaudeCodeConfig {
   autoContext?: boolean;
   /** Compact-window tokens for auto-context. Default 829_800 (AUTO_COMPACT_WINDOW_DEFAULT). */
   autoCompactWindow?: number;
+  /**
+   * Context accounting on Claude surfaces (devlog/_plan/261009_claude_1m_default/030). Absent
+   * (the default) = "1m": long-window models are offered at 1M wherever opencodex picks the
+   * default (launch env slots, Desktop pickers, Desktop 3P prefer1m, generated subagents).
+   * "200k" is the opt-in: nothing is marked [1m] automatically and no compact window is injected;
+   * a selector the user marks [1m] keeps it, and discovery and Desktop 3P keep offering 1M as a
+   * choice. The only stored value; "1m" deletes the key.
+   */
+  contextAccounting?: "200k";
   /**
    * Local CONNECT proxy + TLS listener that intercepts Claude Code's own `api.anthropic.com`
    * traffic without any `ANTHROPIC_BASE_URL` rewrite (src/claude/intercept). Claude Code reaches
@@ -1174,6 +1183,18 @@ export interface OcxConfig {
   accountPoolStickyLimit?: number;
   /** Consecutive non-2xx upstream responses before switching future new threads. Default 3. 0 = disabled. */
   upstreamFailoverThreshold?: number;
+  /**
+   * Sliding 60s transient-failure ratio for Codex pool placement. Default on.
+   * Set false to steer new threads from the consecutive counter only.
+   */
+  codexFailureWindow?: boolean;
+  /**
+   * What a manual pin does while its failure window is degraded.
+   * `hold` keeps using it and logs a warning. `detour-new-threads` places only new threads elsewhere.
+   */
+  codexPinnedTransientPolicy?: "hold" | "detour-new-threads";
+  /** Opt-in: retain one Codex WebSocket per account and thread across turns. Default off. */
+  codexWsReuseAcrossTurns?: boolean;
   /**
    * Opt-in provider-origin circuit threshold for proven pre-connection reachability failures.
    * Default 0 (disabled); range 0..20. The circuit never counts timeouts or HTTP responses.

package/src/types/request.ts

@@ -1,4 +1,5 @@
 import type { KiroOAuthMetadata } from "../oauth/types";
+import type { NativeReasoningOwner } from "../responses/reasoning-replay-cache";
 import type { OcxTool, OcxToolChoice } from "./tools";
 import type { TierDecision, TierObservationContext } from "./provider";
 
@@ -57,6 +58,10 @@ export interface OcxParsedRequest {
   stream: boolean;
   options: OcxRequestOptions;
   _rawBody?: unknown;
+  /** Claude replay tags, retained only until each route binding verifies them. */
+  _nativeReasoningReplay?: ReadonlyMap<string, string>;
+  _nativeReasoningBoundOwner?: NativeReasoningOwner;
+  _nativeReasoningMint?: { owner?: NativeReasoningOwner };
   /**
    * Boundary between replayed history and this turn's newly appended input. Usually the
    * items the proxy restored from local previous_response_id state; also set when the
@@ -437,6 +442,11 @@ export type AdapterEvent =
       errorType?: string;
       code?: string;
       retryable?: boolean;
+      /**
+       * Proxy-internal, never serialized: the upstream failed the turn before producing text or a
+       * tool call, so the opt-in empty-completion guard may replay the identical request once.
+       */
+      replaySafeBeforeOutput?: boolean;
     };
 
 /**

package/src/types/wire.ts

@@ -47,6 +47,7 @@ export const MODEL_ADAPTER_OVERRIDE_ALLOWED: ReadonlySet<string> = new Set([
  */
 const ANTHROPIC_WIRE_MODELS: Record<string, ReadonlySet<string>> = {
   "opencode-go": new Set([
+    "claude-haiku-5-5",
     "minimax-m2.5",
     "minimax-m2.7",
     "minimax-m3",

package/src/update/index.ts

@@ -1,4 +1,5 @@
 import { spawn, spawnSync } from "node:child_process";
+import { createSupervisionLatch, inspectDesktopSupervision } from "../service/desktop-supervision.mjs";
 import { manualUpdateFailureGuidance } from "./update-failure-guidance.mjs";
 import { STOP_HISTORY_INCOMPLETE_EXIT_CODE } from "./stop-contract.mjs";
 import { proxyIdentityAt } from "../server/proxy-liveness";
@@ -484,14 +485,17 @@ export async function runUpdate(): Promise<void> {
   } catch { /* best-effort */ }
   // What this update may do to the runtime. A desktop takeover vetoes both the stop and the
   // service refresh below; see `planUpdateRuntimeHandling` for why each half is wrong.
+  const supervisionLatch = createSupervisionLatch();
+  const observeSupervision = () => supervisionLatch.observe(inspectDesktopSupervision());
   const initialOwnership = await resolvedRuntimeOwnership();
   const runtimePlan = planUpdateRuntimeHandling({
     ...initialOwnership,
     serviceInstalled: serviceWasInstalled,
+    supervision: observeSupervision(),
   });
   if (runtimePlan.notice) console.log(runtimePlan.notice);
   if (!runtimePlan.mayReplacePackage) {
-    console.error("⚠️  Update stopped before tray handoff, runtime stop, or package replacement because runtime ownership is unknown.");
+    console.error("⚠️  Update stopped before tray handoff, runtime stop, or package replacement because runtime authority does not permit it.");
     return 1;
   }
   let trayWasInstalled = false;
@@ -548,6 +552,15 @@ export async function runUpdate(): Promise<void> {
       && before?.consentGeneration === after?.consentGeneration;
   };
   const startProxyDirectly = async (): Promise<boolean> => {
+    const ownership = await resolvedRuntimeOwnership();
+    const supervision = observeSupervision();
+    const plan = planUpdateRuntimeHandling({ ...ownership, serviceInstalled: false, supervision });
+    if (!plan.mayStopRuntime) {
+      console.warn(supervision
+        ? "OpenCodex Desktop supervises the proxy; no CLI runtime was restored."
+        : plan.notice);
+      return false;
+    }
     if (!postUpdateLauncherUsable || !existsSync(postUpdateLauncher)) return false;
     // An ordinary owner: a stray sibling marker would otherwise mark it before any probe.
     const env = mutation.controlEnvironment(withoutSiblingMarker(process.env));
@@ -574,7 +587,7 @@ export async function runUpdate(): Promise<void> {
       const planRecovery = async () => {
         const current = await resolvedRuntimeOwnership();
         return planStoppedRuntimeRecovery({
-          stopAttempted, ...current, sameOwner: sameOwner(current),
+          stopAttempted, ...current, sameOwner: sameOwner(current), supervision: observeSupervision(),
           liveness: currentPackageRuntimeLiveness(), serviceInstalled: serviceWasInstalled,
           launcherUsable: postUpdateLauncherUsable && existsSync(postUpdateLauncher), hadRuntimeState,
         });
@@ -588,10 +601,17 @@ export async function runUpdate(): Promise<void> {
         mutation.release();
         recovery = await planRecovery();
       }
-      if (recovery.action === "manual") {
+      if (recovery.reason === "desktop-supervised") {
+        console.log("OpenCodex Desktop supervises the proxy; no CLI runtime was restored.");
+      } else if (recovery.action === "manual") {
         console.warn(`⚠️  ${reason}; runtime recovery requires manual review (${recovery.reason}).`);
       } else if (recovery.action === "service") {
         const { serviceReinstallArgs, isServiceViable } = await import("../service");
+        recovery = await planRecovery();
+        if (recovery.action !== "service") {
+          console.warn("Runtime authority changed before service recovery; no CLI runtime was restored.");
+          return;
+        }
         const service = spawnSync(process.execPath, [postUpdateLauncher, ...serviceReinstallArgs()], {
           stdio: updateChildStdio(), windowsHide: true,
           env: mutation.controlEnvironment({ ...process.env, OCX_BAKE_PORT: String(capturedListen.port) }),
@@ -602,7 +622,7 @@ export async function runUpdate(): Promise<void> {
           mutation.reacquire();
           const nowOwned = await resolvedRuntimeOwnership();
           const fallback = planStoppedRuntimeRecovery({
-            stopAttempted, ...nowOwned, sameOwner: sameOwner(nowOwned),
+            stopAttempted, ...nowOwned, sameOwner: sameOwner(nowOwned), supervision: observeSupervision(),
             liveness: currentPackageRuntimeLiveness(), serviceInstalled: false,
             launcherUsable: postUpdateLauncherUsable && existsSync(postUpdateLauncher), hadRuntimeState,
           });
@@ -632,6 +652,15 @@ export async function runUpdate(): Promise<void> {
   // Full `ocx stop` semantics (drain, service stop, restore).
 
   if (runtimePlan.mayStopRuntime && (serviceWasInstalled || readPid() || readRuntimePort() || pendingTeardownOutstanding())) {
+    const preStopPlan = planUpdateRuntimeHandling({
+      ...(await resolvedRuntimeOwnership()),
+      serviceInstalled: serviceWasInstalled,
+      supervision: supervisionLatch.observe(inspectDesktopSupervision({ targetPid: runtimeTrusted ? livePid : undefined })),
+    });
+    if (!preStopPlan.mayStopRuntime) {
+      console.error(preStopPlan.notice);
+      return 1;
+    }
     stopAttempted = true;
     console.log("⏹  Stopping the running proxy before updating...");
     const stopStdio = updateChildStdio();
@@ -701,13 +730,14 @@ export async function runUpdate(): Promise<void> {
     stderr?: string | Buffer | null;
   } | null = null;
   let replacementRefusal: string | null = null;
-  // Ownership can change while registry work is in flight. Unknown at this exact
-  // boundary blocks replacement; a confirmed desktop claim still permits updating the idle
-  // npm installation while leaving the bundled sidecar alone.
+  // Re-read durable ownership and live supervision before package replacement.
+  // Desktop supervision and foreign/unknown ownership veto replacement.
+  // Plain unknown supervision preserves the existing ownership/liveness decision.
   const replacementOwnership = await resolvedRuntimeOwnership();
   const replacementPlan = planUpdateRuntimeHandling({
     ...replacementOwnership,
     serviceInstalled: serviceWasInstalled,
+    supervision: observeSupervision(),
   });
   const replacementLiveness = currentPackageRuntimeLiveness();
   if (replacementOwnership.subjectToken !== initialOwnership.subjectToken
@@ -786,9 +816,11 @@ export async function runUpdate(): Promise<void> {
   const postInstallPlan = planUpdateRuntimeHandling({
     ...(await resolvedRuntimeOwnership()),
     serviceInstalled: serviceWasInstalled,
+    supervision: observeSupervision(),
   });
   if (r.status === 0) {
     console.log(`\n✅ Updated${latest ? ` to v${latest}` : ""}.`);
+    if (!postInstallPlan.mayStopRuntime) console.warn("Runtime authority does not permit CLI recovery; no service was refreshed or proxy started.");
     // Re-enter through the verified active package launcher. This keeps the Codex
     // shim, tray, service and proxy recovery paths on the same package/group that
     // pnpm selected, including when the update changed the global link target.
@@ -819,6 +851,16 @@ export async function runUpdate(): Promise<void> {
     // (spawn the fresh cli.ts so updated code writes the baked paths) so a
     // launchd/schtasks/systemd user isn't left with the background proxy down.
     if (postInstallPlan.mayRestoreService) {
+      const mayRefresh = async () => {
+        const ownership = await resolvedRuntimeOwnership();
+        const supervision = observeSupervision();
+        const plan = planUpdateRuntimeHandling({ ...ownership, serviceInstalled: true, supervision });
+        if (!plan.mayRestoreService) console.warn(supervision
+          ? "OpenCodex Desktop supervises the proxy; CLI recovery was skipped. Use the app's updater (tray → Check for Updates)."
+          : plan.notice);
+        return plan.mayRestoreService;
+      };
+      if (!await mayRefresh()) return;
       console.log("🔁 Refreshing the background service with the updated files...");
       const { serviceReinstallArgs } = await import("../service");
       const { reclaimListenPort } = await import("../server/port-reclaim");
@@ -840,6 +882,7 @@ export async function runUpdate(): Promise<void> {
       const prevBake = process.env.OCX_BAKE_PORT;
       process.env.OCX_BAKE_PORT = String(capturedListen.port);
       try {
+        if (!await mayRefresh()) return;
         const svcStdio = updateChildStdio();
         const svc = spawnSync(process.execPath, [postUpdateLauncher, ...serviceReinstallArgs()], {
           env: mutation.controlEnvironment(),
@@ -889,12 +932,17 @@ export async function runUpdate(): Promise<void> {
               console.warn(`   Run 'ocx service repair', then 'ocx start --port ${capturedListen.port}'.`);
               return 1;
             }
+            const fallbackOwnership = await resolvedRuntimeOwnership();
+            const supervision = observeSupervision();
             const nowOwned = planUpdateRuntimeHandling({
-              ...(await resolvedRuntimeOwnership()),
+              ...fallbackOwnership,
               serviceInstalled: true,
+              supervision,
             });
             if (!nowOwned.mayStopRuntime) {
-              console.warn(nowOwned.notice ?? "⚠️  The background runtime is owned elsewhere; not starting a second proxy.");
+              console.warn(supervision
+                ? "OpenCodex Desktop supervises the proxy; CLI recovery was skipped. Use the app's updater (tray → Check for Updates)."
+                : nowOwned.notice ?? "⚠️  The background runtime is owned elsewhere; not starting a second proxy.");
               return;
             }
             console.warn(

package/src/update/restart-ownership.ts

@@ -6,6 +6,8 @@ import {
   OWNERSHIP_MUTATION_LEASE_TOKEN_ENV,
 } from "../service/ownership-mutation-lease.mjs";
 import { planUpdateRuntimeHandling } from "./runtime-ownership.mjs";
+import { createSupervisionLatch, inspectDesktopSupervision } from "../service/desktop-supervision.mjs";
+type SupervisionInspector = typeof inspectDesktopSupervision;
 
 export type { ServiceOwnershipResolution };
 
@@ -24,6 +26,8 @@ export type { ServiceOwnershipResolution };
  */
 export function updateRestartVeto(
   resolve: () => ServiceOwnershipResolution = resolveServiceOwnership,
+  inspect: SupervisionInspector = inspectDesktopSupervision,
+  latch = createSupervisionLatch(),
 ): string | null {
   const owner = resolve();
   const plan = planUpdateRuntimeHandling({
@@ -31,6 +35,7 @@ export function updateRestartVeto(
     ownershipUnknown: owner.kind === "unknown",
     // The restart decision does not refresh the service; only the stop veto is read here.
     serviceInstalled: false,
+    supervision: latch.observe(inspect()),
   });
   if (plan.mayStopRuntime) return null;
   return plan.notice ?? "The background runtime is owned elsewhere; it was left running.";
@@ -78,7 +83,9 @@ const REACQUIRE_WAIT_MS = 10_000;
 export async function runUpdateRestartWithOwnershipLease<T>(
   resolve: (() => ServiceOwnershipResolution) | undefined,
   restart: (lease: UpdateRestartLeaseControl) => Promise<T>,
+  inspect: SupervisionInspector = inspectDesktopSupervision,
 ): Promise<{ readonly kind: "veto"; readonly notice: string } | { readonly kind: "ran"; readonly value: T }> {
+  const latch = createSupervisionLatch();
   let lease = acquireOwnershipMutationLease(serviceStatePaths());
   const previous = process.env[OWNERSHIP_MUTATION_LEASE_TOKEN_ENV];
   process.env[OWNERSHIP_MUTATION_LEASE_TOKEN_ENV] = lease.token;
@@ -107,11 +114,11 @@ export async function runUpdateRestartWithOwnershipLease<T>(
       heldNow = true;
       process.env[OWNERSHIP_MUTATION_LEASE_TOKEN_ENV] = lease.token;
     }
-    const veto = updateRestartVeto(resolve);
+    const veto = updateRestartVeto(resolve, inspect, latch);
     return veto ? { notice: veto, failed: false } : null;
   };
   try {
-    const veto = updateRestartVeto(resolve);
+    const veto = updateRestartVeto(resolve, inspect, latch);
     return veto
       ? { kind: "veto", notice: veto }
       : {
@@ -119,7 +126,7 @@ export async function runUpdateRestartWithOwnershipLease<T>(
           value: await restart({
             releaseForServiceManager: release,
             reacquireForDirectStart,
-            vetoAgain: () => updateRestartVeto(resolve),
+            vetoAgain: () => updateRestartVeto(resolve, inspect, latch),
           }),
         };
   } finally {

package/src/update/runtime-ownership.d.mts

@@ -1,6 +1,10 @@
+import type { SupervisionEvidence } from "../service/desktop-supervision.mjs";
+
 export declare function planUpdateRuntimeHandling(input: {
   ownership: { owner: string; installId: string; consentGeneration: number } | null;
   ownershipUnknown?: boolean;
+  /** Fresh evidence or the operation's supervision latch verdict. */
+  supervision?: SupervisionEvidence | boolean;
   serviceInstalled: boolean;
 }): {
   mayReplacePackage: boolean;
@@ -13,6 +17,8 @@ export declare function planStoppedRuntimeRecovery(input: {
   stopAttempted: boolean;
   ownership: { owner: string; installId: string; consentGeneration: number } | null;
   ownershipUnknown?: boolean;
+  /** Fresh evidence or the operation's supervision latch verdict. */
+  supervision?: SupervisionEvidence | boolean;
   sameOwner: boolean;
   liveness: "live" | "dead" | "unknown";
   serviceInstalled: boolean;

package/src/update/runtime-ownership.mjs

@@ -7,6 +7,11 @@
  * situation separately is how a fix ships on one side only.
  */
 
+function desktopSupervisionBlocked(supervision) {
+  return supervision === true || supervision?.kind === "desktop"
+    || (supervision?.kind === "unknown" && supervision.desktopSeen);
+}
+
 /**
  * Decide how an update treats a runtime it may not own.
  *
@@ -21,11 +26,11 @@
  * The service registration itself is untouched in every case. It is kept by decision, not by
  * accident, so a user who later runs `ocx service install` gets their npm service back.
  *
- * THE COST OF A STALE MARKER. This reads the recorded claim, not liveness. An app deleted
- * without releasing ownership leaves a marker behind, and an update then declines to stop or
- * refresh a runtime no app is managing any more. That is the orphan-recovery cost the
- * two-record ownership design accepted; `ocx service install` clears the marker and restores
- * the ordinary path.
+ * Durable ownership and live supervision are separate. Desktop supervision denies package
+ * replacement, stop and restoration even without a claim. A latch retains that veto through
+ * inconclusive probes until a positive none. Plain unknown supervision alone keeps existing
+ * behavior; unknown durable ownership still vetoes. Explicit service install recovers a stale
+ * durable claim after Desktop has quit.
  *
  * The three returned flags are separate authorities, not commands. In particular, leaving
  * a runtime running is not permission to replace the package it may be executing from.
@@ -34,10 +39,19 @@
  * carries installation identity, it therefore blocks package replacement as well as stop and
  * restoration; the notice tells a stale-marker user how to take ownership back explicitly.
  *
- * @param {{ ownership: { owner: string, installId: string, consentGeneration: number } | null, ownershipUnknown?: boolean, serviceInstalled: boolean }} input
+ * @param {{ ownership: { owner: string, installId: string, consentGeneration: number } | null, ownershipUnknown?: boolean, serviceInstalled: boolean, supervision?: boolean | ReturnType<typeof import('../service/desktop-supervision.mjs').inspectDesktopSupervision> }} input
  * @returns {{ mayReplacePackage: boolean, mayStopRuntime: boolean, mayRestoreService: boolean, notice: string | null }}
  */
-export function planUpdateRuntimeHandling({ ownership, ownershipUnknown = false, serviceInstalled }) {
+export function planUpdateRuntimeHandling({ ownership, ownershipUnknown = false, serviceInstalled, supervision }) {
+  if (desktopSupervisionBlocked(supervision)) {
+    return {
+      mayReplacePackage: false,
+      mayStopRuntime: false,
+      mayRestoreService: false,
+      notice: "OpenCodex Desktop runs this proxy from its own bundle; use the app's updater (tray → Check for Updates). "
+        + "This npm/Bun install was left unchanged; quit OpenCodex first to update it.",
+    };
+  }
   // Unreadable, malformed or contradictory is not "nobody owns it". Reading it that way is
   // how a permissions error reactivates the npm launcher over a consented takeover.
   if (ownershipUnknown) {
@@ -77,6 +91,7 @@ export function planUpdateRuntimeHandling({ ownership, ownershipUnknown = false,
 /** Decide recovery after this updater already stopped the prior CLI-owned runtime. */
 export function planStoppedRuntimeRecovery({
   stopAttempted,
+  supervision,
   ownership,
   ownershipUnknown = false,
   sameOwner,
@@ -86,6 +101,7 @@ export function planStoppedRuntimeRecovery({
   hadRuntimeState,
 }) {
   if (!stopAttempted) return { action: "none", reason: "not-stopped" };
+  if (desktopSupervisionBlocked(supervision)) return { action: "none", reason: "desktop-supervised" };
   if (ownershipUnknown) return { action: "manual", reason: "ownership-unknown" };
   if (!sameOwner || (ownership && ownership.owner !== "cli")) {
     return { action: "none", reason: "ownership-transferred" };

package/src/usage/expected-prices.ts

@@ -835,7 +835,7 @@ export const CONTEXT_TIERS: readonly ContextTier[] = [
   {
     // xAI documents the same whole-request >=200k band for grok-4.7;
     // priority stacking remains a lower bound. See
-    // devlog/_plan/260923_grok47_parity/010_probe-evidence.md.
+    // devlog/_fin/260923_grok47_parity/010_probe-evidence.md.
     provider: "xai",
     modelId: "grok-4.7",
     thresholdInputTokens: 200_000,

package/src/web-search/loop.ts

@@ -323,7 +323,7 @@ export interface WebSearchLoopDeps {
   /** Observe the exact adapter request selected for each routed-model iteration. */
   onRequestBuilt?: (request: AdapterRequest) => void;
   /** Request-scoped executor retains the core's selection binding across loop retries. */
-  fetchForRequest?: (request: AdapterRequest, parsed: OcxParsedRequest) => typeof globalThis.fetch;
+  fetchForRequest?: (request: AdapterRequest, parsed: OcxParsedRequest, adapter: ProviderAdapter) => typeof globalThis.fetch;
   /** Called before each routed-model dispatch in the loop, for attempt telemetry. Same-target 429 replays pass the `rate-limit-429` recovery kind. */
   onAttemptSend?: (recovery?: AttemptRecoveryKind) => void;
   /**
@@ -494,7 +494,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
           cachedRequest = request;
           cachedAdapter = requestAdapter;
         }
-        const requestFetch = headerDeadline.pacedFetch(deps.fetchForRequest?.(request, iterParsed) ?? routedProviderFetch);
+        const requestFetch = headerDeadline.pacedFetch(deps.fetchForRequest?.(request, iterParsed, requestAdapter) ?? routedProviderFetch);
         let response: Response;
         try {
           if (requestAdapter.fetchResponse) {
@@ -507,6 +507,7 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
               sendBudget: deps.incomingMeta.sendBudget,
               onPhysicalSend: deps.incomingMeta.onPhysicalSend,
               executor: requestFetch,
+              onRecoveryWithheld: deps.incomingMeta.onRecoveryWithheld,
             });
           } else {
             response = await fetchWithResetRetry(
@@ -576,6 +577,8 @@ export async function runWithWebSearch(deps: WebSearchLoopDeps): Promise<Respons
       // 429 key-failover parity with the normal routed path: rotate pool keys until one responds
       // or the pool is exhausted (deps.on429 returns null — cooldown map guarantees termination).
       while ((prepared.response.status === 429
+        || (prepared.response.status === 401 && isAnthropicInstanceId(deps.incomingMeta?.providerName)
+          && !accountRefusalOutputStarted)
         || (prepared.response.status === 403
           && (isAnthropicInstanceId(deps.incomingMeta?.providerName) || deps.incomingMeta?.providerName === "google-antigravity")
           && !accountRefusalOutputStarted)