@bitkyc08/opencodex 2.83.0 → 2.84.0

package/src/server/responses/request-transport.ts

@@ -1,4 +1,5 @@
 import { SendBudgetExhaustedError } from "../../lib/upstream-retry";
+import { anthropicBillingPhysicalFetch } from "../../providers/anthropic-billing-ownership";
 import { rebindPhysicalSend } from "../../lib/request-execution-budget";
 import { anthropicModelQuotaFor } from "../../oauth/anthropic-model-quota";
 import { anthropicRatePolicyFor } from "../../oauth/anthropic-rate-limit-policy";
@@ -87,7 +88,7 @@ import {
 import type { AttemptRecoveryKind } from "../../usage/log";
 import { bindAttemptDeliveryRecorder } from "../../usage/attempt-delivery";
 import { resolvePassiveRouteSubjectId } from "../passive-route-linker";
-import { clientCancelledResponse } from "./core-errors";
+import { anthropicPoolCooldownResponse, clientCancelledResponse } from "./core-errors";
 import { acquireAccountLease, KIRO_ACCOUNT_WAIT_MS } from "../../oauth/kiro-account-load";
 
 /** Return a renewed Chat wire to the native owner before sending inference. */
@@ -697,7 +698,7 @@ export async function prepareResponsesTransport(
             }
             commitKeyAttemptSend();
             response = await sendWithConnectionPolicy(
-              fetchImpl,
+              anthropicBillingPhysicalFetch(fetchImpl, route.providerName, route.provider),
               destination,
               { ...dispatchInit, redirect: "manual" },
               { providerName: route.providerName, provider: route.provider },
@@ -784,12 +785,9 @@ export async function prepareResponsesTransport(
           // Route names may resemble account IDs; log only the matched rule position.
           if (anthropicRouteDecision) console.warn(`[${anthropicInstance}-pool] route:#${anthropicRouteDecision.position} ${selection.reason}; answering locally`);
           if (selection.reason === "all-cooled") {
-            const retryAfterSec = anthropicRouting!.getAnthropicPoolRetryAfterSeconds(Date.now(), anthropicRouteDecision, route.modelId);
-            return formatErrorResponse(
-              429,
-              "rate_limit_error",
-              anthropicRouteDecision ? "Anthropic OAuth accounts for this model route are temporarily rate-limited" : "All Anthropic OAuth accounts are temporarily rate-limited",
-              retryAfterSec !== null ? { retryAfter: String(retryAfterSec) } : undefined,
+            return anthropicPoolCooldownResponse(
+              anthropicRouting!.anthropicPoolCooldownError(Date.now(), anthropicRouteDecision, route.modelId),
+              { comboAttempt: options.comboAttempt, logCtx },
             );
           }
           return formatErrorResponse(401, "authentication_error", anthropicRouteDecision ? "No eligible Anthropic OAuth account for this model route" : "No eligible Anthropic OAuth account available");

package/src/server/responses/sidecar-execution.ts

@@ -32,7 +32,7 @@ import { classifyKiroRefusal } from "../../adapters/kiro-refusal";
 import { isNonReplayableResponse } from "../../lib/upstream-retry";
 import { noteKiroMonthlyRefusal, noteKiroServedSuccess } from "../../providers/kiro-usage";
 import { persistKiroAccountState } from "../../providers/kiro-account-state-disk";
-import { readDisplaySafeErrorText } from "./core-errors";
+import { anthropicPoolCooldownResponse, readDisplaySafeErrorText } from "./core-errors";
 import {
   ANTHROPIC_POOL_MAX_FAILOVERS_PER_REQUEST,
   anthropicRoutingFor,
@@ -555,7 +555,7 @@ export async function executeResponsesSidecars(
         modelId: route.modelId,
         ...sidecarBudget.fetchOptions(transportState.adapter),
       })(input, init)) as typeof globalThis.fetch;
-    const wsResponse = await runWithWebSearch({
+    const loopResponse = await runWithWebSearch({
       parsed, adapter: transportState.adapter,
       onIterationEnd: sidecarBudget.releaseUnsentHop,
       fetchForRequest: (request, iterParsed, adapter) => providerFetch(route.provider, options.codexWsRuntimeIdentity, {
@@ -622,6 +622,15 @@ export async function executeResponsesSidecars(
         notifyResponseComplete(response);
       },
     });
+    // A routed Anthropic model whose last pool account refused on spent quota fails the loop's
+    // first iteration with a generic 429 before any search runs. Answer the usage limit instead,
+    // as the main path does (#6991), so Codex stops rather than retrying the whole turn.
+    const poolUsageLimit = loopResponse.status === 429 && anthropicInstance && route.provider.authMode === "oauth"
+      && !options.comboAttempt
+      ? anthropicRoutingFor(anthropicInstance).anthropicPoolUsageLimitAfterRefusal(Date.now(), transportState.anthropicRouteDecision, route.modelId)
+      : null;
+    if (poolUsageLimit) void loopResponse.body?.cancel().catch(() => {});
+    const wsResponse = poolUsageLimit ? anthropicPoolCooldownResponse(poolUsageLimit, { logCtx }) : loopResponse;
     // Register the sidecar stream as an active turn so drainAndShutdown waits for (or aborts)
     // in-flight web-search turns instead of skipping them during graceful shutdown.
     if (wsResponse.body) {

package/src/server/responses/ws-upstream.ts

@@ -23,8 +23,9 @@ import { CODEX_RESPONSES_HTTP_URL, CODEX_RESPONSES_WS_URL, CODEX_WS_FRAME_HEADER
 import { codexWsExchange } from "./codex-ws-exchange";
 import { CodexWsSession } from "./codex-ws-session";
 import { codexWsPool, codexWsReuseIdentity } from "./codex-ws-pool";
-import { codexWsCreateFrameExceedsLimit } from "./codex-ws-wire";
+import { codexWsCreateFrameExceedsLimit, type CodexWsPreOutputRefusalHold } from "./codex-ws-wire";
 import { isLoopbackUrl, rewriteWebSocketDial } from "../../plugins/upstream-hooks";
+import { outboundCredentials } from "../../lib/outbound-credential-registry";
 export { CODEX_WS_LIVENESS_PING_INTERVAL_MS, CODEX_WS_RESPONSE_PRELUDE_TIMEOUT_MS, MAX_CODEX_WS_FRAME_BYTES, MAX_CODEX_WS_QUEUE_BYTES,
   MAX_CODEX_WS_CREATE_FRAME_BYTES, CODEX_WS_CREATE_FRAME_LIMIT_BYTES, codexWsCreateFrameExceedsLimit,
   isCodexWsQuotaObservedResponse, isCodexWsUpstreamResponse, isCodexWsPreludeProjection } from "./codex-ws-wire";
@@ -162,6 +163,8 @@ export async function codexWsUpstreamFetch(
   nativeControl?: NativeResponseControl,
   beforeContinuation?: () => Promise<void>,
   onPhysicalDispatch?: () => void,
+  /** Opt-in pre-output refusal hold (#6969); see codexWsExchange. */
+  preOutputRefusalHold?: CodexWsPreOutputRefusalHold,
 ): Promise<Response> {
   const prepared = prepareCodexWsRequest(url, init);
   if (!prepared) return sseFallback(url, prepareCodexHttpInit(url, init));
@@ -221,6 +224,10 @@ export async function codexWsUpstreamFetch(
     // reused for a different destination or with stale plugin headers.
     const dial = planCodexWsDial(wsUrl, headers, proxy);
     if (!dial) return sseFallback(url, init);
+    // The final dial headers, after plugin rewrites, are what the WebSocket upstream receives; the
+    // per-turn headers planning drops from the upgrade still reach it inside the frame metadata.
+    outboundCredentials().remember(headers);
+    outboundCredentials().remember(dial.headers);
     const identity = control ? null : codexWsReuseIdentity(url, dial.headers, frameText, dial.proxy, dial.url);
     const reuseAcrossTurns = identity !== null && codexWsReuseAcrossTurnsEnabled();
     const pooled = identity
@@ -243,6 +250,7 @@ export async function codexWsUpstreamFetch(
     session, url, init, prepared, sseFallback, onQuota, beforeDispatch,
     nativeControl: control,
     beforeContinuation, onPhysicalDispatch,
+    preOutputRefusalHold,
     bunVersion: typeof runtime === "string" ? runtime : runtime.version,
   });
 }

package/src/server/startup-action-control.ts

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { join } from "node:path";
 import { durableBunPath } from "../lib/bun-runtime";
+import { selfLaunchArgv } from "../lib/self-launch-argv";
 import {
   WINDOWS_SCHTASKS_CREATE_ACCESS_DENIED_MARKER,
   isWindowsSchtasksCreateAccessDenied,
@@ -61,6 +62,18 @@ export function setStartupInstallFinalizeForTests(next: FinalizeFn | null): void
   finalizeImpl = next ?? finalizeWindowsSchedulerServiceRegistration;
 }
 
+interface StartupInstallLaunch {
+  execFile?: typeof execFile;
+  /** Overrides Bun's own standalone detection, which a source-mode test cannot flip. */
+  isStandaloneExecutable?: boolean;
+}
+let installLaunch: StartupInstallLaunch = {};
+
+/** Test-only seam: observe the installer child's argv and simulate a compiled `ocx`. */
+export function setStartupInstallLaunchForTests(next: StartupInstallLaunch | null): void {
+  installLaunch = next ?? {};
+}
+
 /** Snapshot of the install lock for diagnostics and tests. */
 export function getStartupInstallState(): StartupInstallState {
   return installState;
@@ -162,12 +175,19 @@ function runCliInstall(
 ): Promise<{ stdout: string; stderr: string }> {
   const bun = durableBunPath();
   const cli = join(import.meta.dir, "..", "cli", "index.ts");
-  const argv = [cli, ...startupInstallArgv(action, options)];
+  // The Desktop app and the Linux deb run a compiled `ocx`, where `process.execPath` is the CLI
+  // itself: prefixing the source entrypoint made it an unknown command and every dashboard
+  // Install/Repair failed (#6963). Same builder as the startup-health probe.
+  const argv = selfLaunchArgv(startupInstallArgv(action, options), {
+    sourceEntrypoint: cli,
+    isStandaloneExecutable: installLaunch.isStandaloneExecutable,
+  });
+  const run = installLaunch.execFile ?? execFile;
   return new Promise((resolve, reject) => {
     const timeout = process.platform === "win32" && action === "install-service"
       ? 0
       : 60_000;
-    execFile(bun, argv, {
+    run(bun, argv, {
       encoding: "utf8",
       env: process.env,
       // A fresh Windows scheduler install now owns its UAC prompt inside this CLI

package/src/server/startup-health-cache.ts

@@ -9,6 +9,7 @@ import { selfLaunchArgv } from "../lib/self-launch-argv";
 import { desktopStartupOwnership } from "../service/desktop-startup";
 import type { OcxConfig } from "../types";
 import { truncateRetainedUtf8 } from "../lib/admission";
+import { isPassiveRead } from "../lib/passive-read";
 
 const CACHE_TTL_MS = 30_000;
 const PROBE_TIMEOUT_MS = startupHealthProbeBudgetMs();
@@ -69,6 +70,8 @@ export function getStartupHealthSnapshot(
 ): StartupHealth {
   const now = deps.now ?? Date.now;
   if (cached && now() - cached.timestamp < CACHE_TTL_MS) return cached.value;
+  // A passive read (a Remote Link Child's, #6959) starts no diagnostic process on this machine.
+  if (isPassiveRead()) return staleOrFallback(config);
   refreshInBackground(config, deps);
   return staleOrFallback(config);
 }
@@ -189,6 +192,7 @@ export async function getCachedStartupHealth(
 ): Promise<StartupHealth> {
   const now = deps.now ?? Date.now;
   if (cached && now() - cached.timestamp < CACHE_TTL_MS) return cached.value;
+  if (isPassiveRead()) return staleOrFallback(config);
   refreshInBackground(config, deps);
   // An expired or empty read is an explicit protection check. Wait for the
   // isolated probe instead of presenting a synthetic failure while that probe

package/src/server/system-env-shell.ts

@@ -1,7 +1,7 @@
 import { accessSync, constants, readFileSync, writeFileSync, unlinkSync, mkdirSync, statSync } from "node:fs";
 import { delimiter, join } from "node:path";
 import { getConfigDir } from "../config";
-import { claudeToolSearchEnv, resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
+import { claudeTierDisplayName, claudeToolSearchEnv, isClaudeTierLabelSlot, resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
 import { PROXY_MARKER, defaultAuthDetectDeps, detectClaudeAuth, ownAdmissionTokens, type AuthDetectDeps } from "../claude/auth-detect";
 import { resolveClaudeAuthMode } from "../claude/auth-mode";
 import { ANTHROPIC_PARENT_ENV_SLOTS, trustedNodeLauncherContext, type AnthropicParentEnvSlot } from "../cli/launcher-context";
@@ -115,7 +115,12 @@ export function writeShellEnvFile(
   }
   for (const [name, value] of Object.entries(modelEnv)) {
     if (name === "ANTHROPIC_MODEL") continue;
-    lines.push(conditional(name, value));
+    // An alias tier slot carries its picker label (#6926) in the same branch, so the label is
+    // exported only when this file writes the slot and the shell has no label of its own.
+    const label = isClaudeTierLabelSlot(name) ? claudeTierDisplayName(value) : undefined;
+    lines.push(label === undefined
+      ? conditional(name, value)
+      : `${conditional(name, value)} && [ -z "\${${name}_NAME+x}" ] && export ${name}_NAME=${shellValue(label)}`);
   }
   const maxCtx = config.claudeCode?.maxContextTokens;
   if (typeof maxCtx === "number" && Number.isFinite(maxCtx) && maxCtx > 0) {

package/src/server/system-env.ts

@@ -2,7 +2,7 @@ import { execFileSync } from "node:child_process";
 import { readFileSync, writeFileSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir } from "../config";
-import { claudeToolSearchEnv, resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
+import { CLAUDE_TIER_LABEL_SLOTS, claudeTierDisplayName, claudeToolSearchEnv, resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
 import { PROXY_MARKER } from "../claude/auth-detect";
 import { isProxyAdmissionSecret } from "./auth-cors";
 import type { OcxConfig } from "../types";
@@ -30,6 +30,8 @@ const MANAGED_SYSTEM_ENV_NAMES = new Set<string>([
   "ANTHROPIC_DEFAULT_FABLE_MODEL",
   "ANTHROPIC_DEFAULT_HAIKU_MODEL",
   "ANTHROPIC_SMALL_FAST_MODEL",
+  // Picker labels paired with an alias tier slot this instance injected (#6926).
+  ...CLAUDE_TIER_LABEL_SLOTS.map(slot => `${slot}_NAME`),
   "CLAUDE_CODE_MAX_CONTEXT_TOKENS",
   "DISABLE_COMPACT",
   "CLAUDE_CODE_AUTO_COMPACT_WINDOW",
@@ -315,6 +317,14 @@ export async function injectSystemEnv(
       if (name === "ANTHROPIC_MODEL") continue; // legacy slot handled by shell file only (back-compat)
       injectLever(name, value);
     }
+    // Picker labels (#6926) only for alias tier slots this instance owns after the loop above: a
+    // launchd slot the user set keeps whatever label it has, and a label nothing produces any
+    // more is unset by the produced-key sweep below like any other tracked lever.
+    for (const slot of CLAUDE_TIER_LABEL_SLOTS) {
+      const value = modelEnv[slot];
+      const label = value === undefined ? undefined : claudeTierDisplayName(value);
+      if (label !== undefined && injectedKeys.includes(slot)) injectLever(`${slot}_NAME`, label);
+    }
     const maxCtx = config.claudeCode?.maxContextTokens;
     if (typeof maxCtx === "number" && Number.isFinite(maxCtx) && maxCtx > 0) {
       injectLever("CLAUDE_CODE_MAX_CONTEXT_TOKENS", String(Math.floor(maxCtx)));

package/src/service/cli.ts

@@ -27,6 +27,8 @@ import { win32 } from "node:path";
 import { serviceDiagnosticsSummary } from "./diagnostics";
 import { runServiceClaim } from "./claim";
 import { createSupervisionLatch, desktopServiceCommandRefusal } from "./desktop-command-guard";
+import { linuxServiceBootHint } from "./linux-linger";
+import { diagnoseDesktopStartup, desktopLoginStatusSummary } from "./desktop-startup";
 
 /**
  * `restart` is NO LONGER folded into `repair`.
@@ -336,7 +338,7 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       // and the baked one cannot have diverged yet — unlike `start`, which reads the
       // installed artifact instead.
       await reportServiceServing("installed", { port: resolveServiceListenPort() });
-      if (process.platform === "linux") console.log("   For auto-start on boot: loginctl enable-linger $USER");
+      if (process.platform === "linux") console.log(linuxServiceBootHint());
       // Service users never reach the `ocx start` prompt: the proxy they run is the
       // supervised child, which always carries OCX_SERVICE=1. This command, though, is
       // hand-typed in a real terminal, so it is the one interactive moment they get.
@@ -433,6 +435,8 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       const lease = ownershipMutationLeaseStatusLine(serviceStatePaths());
       if (lease) console.log(lease);
       console.log(`Diagnostics: ${serviceDiagnosticsSummary()}`);
+      const desktop = diagnoseDesktopStartup();
+      if (desktop) console.log(desktopLoginStatusSummary(desktop));
       break;
     }
     case "uninstall":

package/src/service/desktop-startup.ts

@@ -1,18 +1,24 @@
 import { execFileSync } from "node:child_process";
-import { accessSync, constants, readFileSync, realpathSync } from "node:fs";
+import { accessSync, constants, lstatSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve, win32 } from "node:path";
 import { readPid } from "../config/process-state";
 import { resolveServiceOwnership, sameServiceOwnershipSubject, type ServiceOwnershipResolution } from "./state";
-import { inspectDesktopSupervision, processIdentity, procfs, type ProcReader } from "./desktop-supervision.mjs";
+import { inspectDesktopSupervision, processIdentity, procfs, type DesktopSupervisionDeps, type ProcReader } from "./desktop-supervision.mjs";
 
 export interface DesktopStartupDiagnostic {
   /** Durable desktop claim; failed supervision does not release ownership. */
   owned: boolean;
   loginEnabled: boolean;
+  /** Verified enabled macOS registration; absence means registration is not credited. */
+  loginRegistration?: "loaded" | "registered-not-loaded";
   running: boolean;
   viable: boolean;
-  /** Live parentage when no durable claim exists; never converts supervision into ownership. */
+  /**
+   * Proven live parentage; never converts supervision into ownership. macOS and Linux report it
+   * only without a durable claim. Windows also reports it beside a durable Desktop claim, because
+   * older Windows runtimes never published a Desktop diagnostic that status could defer to.
+   */
   supervisor?: { supervisorPid: number; runtimePid: number; app: string };
 }
 
@@ -21,6 +27,14 @@ export function deriveDesktopStartup(facts: Omit<DesktopStartupDiagnostic, "viab
   return { ...facts, viable: (facts.owned || facts.supervisor !== undefined) && facts.loginEnabled && facts.running };
 }
 
+export function desktopLoginStatusSummary(desktop: DesktopStartupDiagnostic): string {
+  if (!desktop.loginEnabled) return "Desktop Start at Login: not registered, disabled, or could not be verified.";
+  if (desktop.loginRegistration === "registered-not-loaded") {
+    return "Desktop Start at Login: registered and enabled for next login; not loaded in this session.";
+  }
+  return `Desktop Start at Login: enabled${desktop.loginRegistration === "loaded" ? " and loaded in this session" : ""}.`;
+}
+
 function run(command: string, args: string[]): string {
   return execFileSync(command, args, { encoding: "utf8", timeout: 750, maxBuffer: 128 * 1024, stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
@@ -35,12 +49,16 @@ interface DesktopStartupDeps {
   run?: typeof run;
   env?: NodeJS.ProcessEnv;
   proc?: ProcReader;
+  windowsProcesses?: DesktopSupervisionDeps["windowsProcesses"];
+  now?: () => number;
+  /** The Desktop's own install id (Tauri app_config_dir); null when unreadable. */
+  readWindowsInstallId?: () => string | null;
 }
 
 /** Cheap ownership-only snapshot: no launchd/process probes on the server request path. */
 export function desktopStartupOwnership(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
   const platform = deps.platform ?? process.platform;
-  if (platform !== "darwin" && platform !== "linux") return undefined;
+  if (platform !== "darwin" && platform !== "linux" && platform !== "win32") return undefined;
   const owner = (deps.ownership ?? resolveServiceOwnership)();
   return owner.kind === "owned" && owner.ownership.owner === "desktop"
     ? deriveDesktopStartup({ owned: true, loginEnabled: false, running: false }) : undefined;
@@ -49,33 +67,85 @@ export function desktopStartupOwnership(deps: DesktopStartupDeps = {}): DesktopS
 function macLoginRegistration(deps: DesktopStartupDeps) {
   const execute = deps.run ?? run;
   const path = join(deps.home ?? homedir(), "Library", "LaunchAgents", "OpenCodex.plist");
-  const plist = JSON.parse(execute("/usr/bin/plutil", ["-convert", "json", "-o", "-", path]));
-  const args = plist.ProgramArguments;
-  if (plist.Label !== "OpenCodex" || plist.RunAtLoad !== true || !Array.isArray(args)
-    || args.length !== 2 || args[1] !== "--autostart" || typeof args[0] !== "string"
-    || !args[0].endsWith("/Contents/MacOS/opencodex-desktop")
-    || (plist.Program !== undefined && plist.Program !== args[0])) return null;
-  const app = realpathSync(args[0]);
-  const proxy = realpathSync(join(dirname(app), "ocx"));
-  accessSync(app, constants.X_OK);
-  accessSync(proxy, constants.X_OK);
   const domain = `gui/${deps.uid ?? process.getuid!()}`;
-  const disabled = execute("/bin/launchctl", ["print-disabled", domain]);
-  const loaded = execute("/bin/launchctl", ["print", `${domain}/OpenCodex`]);
+  const identity = (file: string) => {
+    const stat = lstatSync(file, { bigint: true });
+    return [stat.dev, stat.ino, stat.size, stat.mode, stat.mtimeNs, stat.ctimeNs].map(String).join(":");
+  };
+  const capture = () => {
+    const registrationPath = realpathSync(path);
+    const plistIdentity = identity(path), targetIdentity = identity(registrationPath);
+    const definition = execute("/usr/bin/plutil", ["-convert", "json", "-o", "-", path]);
+    const plist = JSON.parse(definition);
+    const args = plist.ProgramArguments;
+    if (plist.Label !== "OpenCodex" || plist.RunAtLoad !== true || !Array.isArray(args)
+      || args.length !== 2 || args[1] !== "--autostart" || typeof args[0] !== "string"
+      || !args[0].endsWith("/Contents/MacOS/opencodex-desktop")
+      || (plist.Program !== undefined && plist.Program !== args[0])
+      || (plist.Disabled !== undefined && typeof plist.Disabled !== "boolean")) return null;
+    const app = realpathSync(args[0]);
+    const proxy = realpathSync(join(dirname(app), "ocx"));
+    accessSync(app, constants.X_OK);
+    accessSync(proxy, constants.X_OK);
+    const appIdentity = identity(app), proxyIdentity = identity(proxy);
+    const disabled = execute("/bin/launchctl", ["print-disabled", domain]);
+    const mentions = disabled.match(/"OpenCodex"/g)?.length ?? 0;
+    const override = /"OpenCodex"\s*=>\s*(enabled|false|disabled|true)(?=\s*(?:\r?\n|[,;}]|$))/.exec(disabled)?.[1];
+    const loginEnabled = /^\s*disabled services = \{[\s\S]*\}\s*$/.test(disabled)
+      && (mentions === 0 ? plist.Disabled !== true : mentions === 1 && (override === "enabled" || override === "false"));
+    if (registrationPath !== realpathSync(path) || plistIdentity !== identity(path) || targetIdentity !== identity(registrationPath)
+      || app !== realpathSync(args[0]) || proxy !== realpathSync(join(dirname(app), "ocx"))
+      || appIdentity !== identity(app) || proxyIdentity !== identity(proxy)) return null;
+    return { app, proxy, loginEnabled, registrationPath, plistIdentity, targetIdentity, definition, appIdentity, proxyIdentity, disabled };
+  };
+  const first = capture();
+  if (!first) return null;
+  const { app, proxy } = first;
+  if (!first.loginEnabled) return { app, proxy, loginEnabled: false };
+  let loaded: string;
+  try { loaded = execute("/bin/launchctl", ["print", `${domain}/OpenCodex`]); }
+  catch (error) {
+    // execFileSync's specific service-not-found result is absence, not a failed probe.
+    // Timeout, permission denial, missing tools and another domain remain unverified.
+    const failure = error as { status?: number; stderr?: unknown; signal?: unknown; code?: unknown } | null;
+    const stderr = typeof failure?.stderr === "string" ? failure.stderr
+      : Buffer.isBuffer(failure?.stderr) ? failure.stderr.toString("utf8") : "";
+    const message = `Could not find service "OpenCodex" in domain for user gui: ${domain.slice(4)}`;
+    const missing = failure?.status === 113 && !failure.signal && !failure.code
+      && [message, `Bad request.\n${message}`].includes(stderr.trim());
+    if (!missing) throw error;
+    // The absent job supplies no durable registration evidence. Re-read the entire
+    // registration and enabled state; replacement or ambiguity revokes login credit.
+    const final = capture();
+    if (!final || JSON.stringify(first) !== JSON.stringify(final)) return { app, proxy, loginEnabled: false };
+    return { app, proxy, loginEnabled: true, loginRegistration: "registered-not-loaded" as const };
+  }
   const program = /^\s*program = (.+)$/m.exec(loaded)?.[1];
   const loadedPath = /^\s*path = (.+)$/m.exec(loaded)?.[1];
-  const loginEnabled = /^\s*disabled services = \{[\s\S]*\}\s*$/.test(disabled)
-    && !/"OpenCodex"\s*=>\s*(?:disabled|true)/.test(disabled)
-    && program !== undefined && realpathSync(program) === app
-    && loadedPath !== undefined && realpathSync(loadedPath) === realpathSync(path);
-  return { app, proxy, loginEnabled };
+  const loginEnabled = program !== undefined && realpathSync(program) === app
+    && loadedPath !== undefined && realpathSync(loadedPath) === first.registrationPath;
+  return { app, proxy, loginEnabled, ...(loginEnabled ? { loginRegistration: "loaded" as const } : {}) };
+}
+
+type DesktopLoginFacts = Pick<DesktopStartupDiagnostic, "loginEnabled" | "loginRegistration">;
+
+/**
+ * Start at Login credit for one Desktop app copy. The tray's Start at Login item ports this
+ * judgment (desktop/src-tauri/src/login_registration.rs); both run the cases in
+ * tests/fixtures/desktop-login-registration-cases.json. Throws when evidence is unreadable.
+ */
+export function macLoginFactsFor(app: string, deps: DesktopStartupDeps): DesktopLoginFacts {
+  const login = macLoginRegistration(deps);
+  return login !== null && login.app === app
+    ? { loginEnabled: login.loginEnabled, ...(login.loginRegistration ? { loginRegistration: login.loginRegistration } : {}) }
+    : { loginEnabled: false };
 }
 
-function diagnoseSupervisedStartup(deps: DesktopStartupDeps, ownerRevision: number, loginFor: (app: string) => boolean): DesktopStartupDiagnostic | undefined {
+function diagnoseSupervisedStartup(deps: DesktopStartupDeps, ownerRevision: number, loginFor: (app: string) => DesktopLoginFacts): DesktopStartupDiagnostic | undefined {
   const evidence = inspectDesktopSupervision(deps);
   if (evidence.kind !== "desktop") return undefined;
-  let loginEnabled = false;
-  try { loginEnabled = loginFor(evidence.app); }
+  let login: DesktopLoginFacts = { loginEnabled: false };
+  try { login = loginFor(evidence.app); }
   catch { /* Login failure revokes restart viability, not the observed live supervisor. */ }
   if ((deps.ownership ?? resolveServiceOwnership)().kind !== "none") return undefined;
   // Login probes can outlive the runtime or its parent; only the same live chain gets credit.
@@ -86,7 +156,7 @@ function diagnoseSupervisedStartup(deps: DesktopStartupDeps, ownerRevision: numb
   const finalOwner = (deps.ownership ?? resolveServiceOwnership)();
   if (finalOwner.kind !== "none" || finalOwner.revision !== ownerRevision) return undefined;
   const { supervisorPid, runtimePid, app } = evidence;
-  return deriveDesktopStartup({ owned: false, loginEnabled, running: true, supervisor: { supervisorPid, runtimePid, app } });
+  return deriveDesktopStartup({ owned: false, ...login, running: true, supervisor: { supervisorPid, runtimePid, app } });
 }
 
 /** Read-only macOS desktop ownership, login registration and live parent/child checks. */
@@ -94,12 +164,9 @@ export function diagnoseMacDesktopStartup(deps: DesktopStartupDeps = {}): Deskto
   if ((deps.platform ?? process.platform) !== "darwin") return undefined;
   const ownership = deps.ownership ?? resolveServiceOwnership;
   const owner = ownership();
-  if (owner.kind === "none") return diagnoseSupervisedStartup(deps, owner.revision, app => {
-    const login = macLoginRegistration(deps);
-    return login !== null && login.app === app && login.loginEnabled;
-  });
+  if (owner.kind === "none") return diagnoseSupervisedStartup(deps, owner.revision, app => macLoginFactsFor(app, deps));
   if (owner.kind !== "owned" || owner.ownership.owner !== "desktop") return undefined;
-  const facts = { owned: true, loginEnabled: false, running: false };
+  const facts: Omit<DesktopStartupDiagnostic, "viable"> = { owned: true, loginEnabled: false, running: false };
   const execute = deps.run ?? run;
   const pidReader = deps.readPid ?? readPid;
   try {
@@ -110,6 +177,7 @@ export function diagnoseMacDesktopStartup(deps: DesktopStartupDeps = {}): Deskto
     if (!login) return deriveDesktopStartup(facts);
     const { app, proxy } = login;
     facts.loginEnabled = login.loginEnabled;
+    if (login.loginRegistration) facts.loginRegistration = login.loginRegistration;
     const pid = pidReader();
     if (pid !== null) {
       const child = processIdentity(pid, execute);
@@ -156,10 +224,10 @@ export function diagnoseLinuxDesktopStartup(deps: DesktopStartupDeps = {}): Desk
     const configured = (deps.env ?? process.env).XDG_CONFIG_HOME;
     const config = configured && isAbsolute(configured) ? configured : join(home, ".config");
     // auto-launch's HOME entry must remain inside the session's XDG autostart search path.
-    if (resolve(config) !== resolve(home, ".config")) return false;
+    if (resolve(config) !== resolve(home, ".config")) return { loginEnabled: false };
     const entry = readFileSync(join(home, ".config", "autostart", "OpenCodex.desktop"), "utf8");
     const login = linuxLoginApp(entry);
-    return login !== null && realpathSync(login) === app;
+    return { loginEnabled: login !== null && realpathSync(login) === app };
   });
   if (owner.kind !== "owned" || owner.ownership.owner !== "desktop") return undefined;
   const facts = { owned: true, loginEnabled: false, running: false };
@@ -212,5 +280,50 @@ export function diagnoseLinuxDesktopStartup(deps: DesktopStartupDeps = {}): Desk
 
 /** Platform dispatch for the full (probing) desktop startup diagnostic. */
 export function diagnoseDesktopStartup(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
-  return (deps.platform ?? process.platform) === "linux" ? diagnoseLinuxDesktopStartup(deps) : diagnoseMacDesktopStartup(deps);
+  const platform = deps.platform ?? process.platform;
+  if (platform === "linux") return diagnoseLinuxDesktopStartup(deps);
+  if (platform === "win32") return diagnoseWindowsDesktopStartup(deps);
+  return diagnoseMacDesktopStartup(deps);
+}
+
+/** Tauri resolves app_config_dir to the roaming AppData folder plus the bundle identifier. */
+function readWindowsInstallId(env: NodeJS.ProcessEnv): string | null {
+  const appData = env.APPDATA;
+  if (!appData || !/^[A-Za-z]:[\\/]/.test(appData)) return null;
+  try {
+    return readFileSync(win32.join(appData, "com.opencodex.desktop", "install-id"), "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read-only Windows desktop ownership and live parent/child checks. Windows Start at Login is
+ * not verified, so it is never credited and Desktop never reads as startup protection here;
+ * the diagnostic still names the supervisor so status and doctor stop recommending service repairs.
+ */
+export function diagnoseWindowsDesktopStartup(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
+  if ((deps.platform ?? process.platform) !== "win32") return undefined;
+  const ownership = deps.ownership ?? resolveServiceOwnership;
+  const owner = ownership();
+  if (owner.kind === "none") return diagnoseSupervisedStartup(deps, owner.revision, () => ({ loginEnabled: false }));
+  if (owner.kind !== "owned" || owner.ownership.owner !== "desktop") return undefined;
+  const facts = { owned: true, loginEnabled: false, running: false };
+  try {
+    const installId = deps.readWindowsInstallId ? deps.readWindowsInstallId() : readWindowsInstallId(deps.env ?? process.env);
+    if (installId !== owner.ownership.installId) return deriveDesktopStartup(facts);
+    const evidence = inspectDesktopSupervision(deps);
+    if (evidence.kind !== "desktop") return deriveDesktopStartup(facts);
+    // Only the same live chain, read again after the claim, earns running and the supervisor.
+    const final = inspectDesktopSupervision({ ...deps, targetPid: evidence.runtimePid });
+    const current = ownership();
+    if (final.kind !== "desktop" || final.runtimePid !== evidence.runtimePid
+      || final.supervisorPid !== evidence.supervisorPid || final.app !== evidence.app
+      || current.kind === "unknown" || !sameServiceOwnershipSubject(owner, current)) return deriveDesktopStartup(facts);
+    const { supervisorPid, runtimePid, app } = final;
+    return deriveDesktopStartup({ ...facts, running: true, supervisor: { supervisorPid, runtimePid, app } });
+  } catch {
+    // Unreadable evidence never grants running or releases the claim.
+    return deriveDesktopStartup(facts);
+  }
 }

package/src/service/desktop-supervision.d.mts

@@ -9,18 +9,44 @@ export interface ProcReader {
   parent(pid: number): number;
 }
 
+/** One Win32_Process row; `created` is UTC ticks as a decimal string (exceeds 2^53). */
+export interface WindowsProcessRow {
+  pid: number;
+  parent: number;
+  exe: string | null;
+  session: number;
+  created: string;
+}
+
+export interface WindowsProcessPair {
+  child: WindowsProcessRow | null;
+  parent: WindowsProcessRow | null;
+}
+
+export interface WindowsProcessReadOptions {
+  /** Called with the parent image before row validation, so partial Desktop evidence keeps its veto. */
+  onExecutable?: (path: string) => void;
+  timeoutMs?: number;
+  env?: NodeJS.ProcessEnv;
+}
+
 export interface DesktopSupervisionDeps {
   targetPid?: number;
   platform?: NodeJS.Platform;
-  run?: (command: string, args: string[]) => string;
+  run?: (command: string, args: string[], timeoutMs?: number) => string;
   proc?: ProcReader;
   readPid?: () => number | null;
   readRuntimePortPid?: () => number | null;
+  windowsProcesses?: (pid: number, options: Pick<WindowsProcessReadOptions, "onExecutable" | "timeoutMs">) => WindowsProcessPair | null;
+  env?: NodeJS.ProcessEnv;
+  now?: () => number;
 }
 
 export function desktopSupervisionPaths(): { pid: string; runtimePort: string };
 export const procfs: ProcReader;
 export function processIdentity(pid: number, execute?: DesktopSupervisionDeps["run"], onExecutable?: (path: string) => void):
   { parent: number; executable: string } | null;
+export function windowsPowerShellPath(env?: NodeJS.ProcessEnv): string;
+export function windowsProcessPair(pid: number, execute?: DesktopSupervisionDeps["run"], options?: WindowsProcessReadOptions): WindowsProcessPair;
 export function inspectDesktopSupervision(deps?: DesktopSupervisionDeps): SupervisionEvidence;
 export function createSupervisionLatch(): { observe(evidence: SupervisionEvidence): boolean };