@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/codex/desktop-compatibility/windows-package-launch.ts

@@ -0,0 +1,28 @@
+import { windowsDefaultExec, windowsDesktopAppAdapter } from "../desktop-app/windows";
+import type { DesktopExec } from "../desktop-app/types";
+import { activateWindowsCodexCompatibility, validatedCompatibilityPacUrl } from "./windows-package-command";
+export { compatibilityActivationScript, validatedCompatibilityPacUrl } from "./windows-package-command";
+
+export interface CompatibilityLaunchIo {
+  exec?: DesktopExec;
+  platform?: string;
+}
+export type CompatibilityLaunchResult =
+  | { status: "started"; pid: number; packageFullName: string }
+  | { status: "refused"; reason: "unsupported_platform" | "test_environment" | "package_unavailable" | "app_running" | "process_probe_failed" | "activation_failed" };
+
+/** Never quits an app, launches the raw EXE, changes login or installs a watcher. */
+export function launchWindowsCodexCompatibility(pacUrl: string, io: CompatibilityLaunchIo = {}): CompatibilityLaunchResult {
+  validatedCompatibilityPacUrl(pacUrl);
+  if ((io.platform ?? process.platform) !== "win32") return { status: "refused", reason: "unsupported_platform" };
+  if (process.env.OCX_TEST_HOME_GUARD === "1" && !io.exec) return { status: "refused", reason: "test_environment" };
+  const exec = io.exec ?? windowsDefaultExec;
+  const install = windowsDesktopAppAdapter.discover(exec);
+  if (!install) return { status: "refused", reason: "package_unavailable" };
+  const processes = windowsDesktopAppAdapter.listProcesses(exec, install);
+  if (processes === null) return { status: "refused", reason: "process_probe_failed" };
+  if (processes.length > 0) return { status: "refused", reason: "app_running" };
+  try {
+    return { status: "started", ...activateWindowsCodexCompatibility(exec, install, pacUrl) };
+  } catch { return { status: "refused", reason: "activation_failed" }; }
+}

package/src/codex/history-provider.ts

@@ -1831,7 +1831,7 @@ export function countPendingOpencodexHistory(
       : { pendingRows: 0, backupEntries };
   }
   try {
-    const db = new Database(stateDbPath, { readonly: true });
+    const db = openCodexStateForPreflight(stateDbPath);
     try {
       db.exec("PRAGMA busy_timeout = 100");
       // Prove the expected history schema is readable without counting unowned routed rows.

package/src/codex/inject/config-write-section.ts

@@ -1,7 +1,7 @@
 import type { AtomicWriteHooks } from "../../config/atomic-write";
 import { existsSync, readFileSync } from "node:fs";
 import { withConfigMutationLockSync } from "../../config";
-import { ConfigWriteLockRefusal, assertConfigWriteDestination, publishConfigWriteTarget, watchConfigWriteTargets, withConfigWriteLockHeld, type LockHandle } from "../config-write-lock";
+import { ConfigWriteLockRefusal, assertConfigWriteDestination, publishConfigWriteTarget, removeConfigWriteEntry, watchConfigWriteTargets, withConfigWriteLockHeld, type LockHandle } from "../config-write-lock";
 import { CODEX_CONFIG_PATH, CODEX_PROFILE_PATH } from "../paths";
 import { getCodexHome } from "../paths";
 import { codexHomeIsAbsent } from "../codex-home-owner";
@@ -16,6 +16,9 @@ export function publishCodexArtifact<T>(path: string, held: LockHandle | undefin
   if (!held) throw new Error("Codex artifact publication requires a held configuration lock");
   return publishConfigWriteTarget(CODEX_CONFIG_PATH, held, path, run);
 }
+export function removeCodexProfileEntry(held: LockHandle): void {
+  removeConfigWriteEntry(CODEX_CONFIG_PATH, held, CODEX_PROFILE_PATH);
+}
 /** Courtesy cleanup re-reads provider ownership inside the same config section. */
 export function cleanExternalProviderJournal(beforeClientWrite?: () => void): void {
   if (codexHomeIsAbsent(getCodexHome())) return;

package/src/codex/inject/remove.ts

@@ -1,8 +1,8 @@
-import { beginCodexWriteSection, publishCodexArtifact } from "./config-write-section";
-import { existsSync, readFileSync, unlinkSync } from "node:fs";
+import { beginCodexWriteSection, publishCodexArtifact, removeCodexProfileEntry } from "./config-write-section";
+import { existsSync, lstatSync, readFileSync } from "node:fs";
 import { normalizeStructuralWhitespace, rootAssignmentKey, rootSourceLines, sourceAssignment, sourceText } from "../toml-source-lines";
 import { atomicWriteFile } from "../../config";
-import { ConfigWriteLockRefusal, configWriteLockFailureMessage, withConfigWriteLockHeld } from "../config-write-lock";
+import { ConfigWriteLockRefusal, configWriteLockFailureMessage, withConfigWriteLockHeld, withConfigWriteRecovery } from "../config-write-lock";
 import type { LockHandle } from "../config-write-lock";
 import {
   REALTIME_WS_BASE_URL_KEY,
@@ -206,15 +206,26 @@ export function removeCodexConfig(
   }
   const locked = withConfigWriteLockHeld(CODEX_CONFIG_PATH, options.heldConfigWriteLock, held => {
   beginCodexWriteSection(held);
+  if (!options.preserveProfile) {
+    try {
+      if (lstatSync(CODEX_PROFILE_PATH).isSymbolicLink()) {
+        return { success: false, message: "Codex profile is a symbolic link; configuration and recovery evidence were preserved." };
+      }
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+  }
   if (!existsSync(CODEX_CONFIG_PATH)) {
     if (!options.preserveProfile && existsSync(CODEX_PROFILE_PATH))
-      publishCodexArtifact(CODEX_PROFILE_PATH, held, (path, hooks) => { hooks.validateBeforeRename?.(path); unlinkSync(path); hooks.afterRename?.(path); });
+      removeCodexProfileEntry(held);
     return {
       success: true,
       message: `Codex config not found; no native restore was needed${options.preserveProfile ? "." : ", and the opencodex profile was removed if present."}`,
     };
   }
-  const rawContent = readFileSync(CODEX_CONFIG_PATH, "utf-8");
+  const preimage = readFileSync(CODEX_CONFIG_PATH);
+  return withConfigWriteRecovery(CODEX_CONFIG_PATH, held, () => {
+  const rawContent = preimage.toString("utf-8");
   // Same EOL boundary as inject: strip in LF space, write back in the file's own ending.
   // The unchanged fast path compares in LF space so an untouched file is never rewritten.
   const eol = dominantEol(rawContent);
@@ -248,7 +259,7 @@ export function removeCodexConfig(
     publishCodexArtifact(CODEX_CONFIG_PATH, held, (path, hooks) => atomicWriteFile(path, applyEol(finalContent, eol), undefined, hooks));
   }
   if (!options.preserveProfile && existsSync(CODEX_PROFILE_PATH))
-    publishCodexArtifact(CODEX_PROFILE_PATH, held, (path, hooks) => { hooks.validateBeforeRename?.(path); unlinkSync(path); hooks.afterRename?.(path); });
+    removeCodexProfileEntry(held);
   const retainedNote = retainedBlock === null
     ? ""
     : " Kept [model_providers.opencodex] so conversations already tagged opencodex still open;"
@@ -272,6 +283,7 @@ export function removeCodexConfig(
     message: removedMessage,
     ...(retainedBlock === null ? {} : { retainedProviderTable: retainedBlock.replace(/\n+$/, "").split("\n") }),
   };
+  }, { preimage, requireMatchingPreimage: true });
   });
   if (!locked.ok) return { success: false, retryable: locked.error === "locked", message: configWriteLockFailureMessage(locked) };
   return locked.value;

package/src/codex/journal.ts

@@ -1,7 +1,7 @@
 import { beginCodexWriteSection, publishCodexArtifact } from "./inject/config-write-section";
 import { createHash } from "node:crypto";
 import type { AtomicWriteHooks } from "../config/atomic-write";
-import { existsSync, readFileSync, unlinkSync } from "node:fs";
+import { existsSync, lstatSync, readFileSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { atomicWriteFile } from "../config";
 import { assertCodexHomeOwner, codexHomeIsAbsent, CODEX_HOME_JOURNAL_FILE, CodexHomeOwnerRefusal, opencodexHomeForInjection, readCodexHomeJournal, type CodexHomeOwnerRefusalReason } from "./codex-home-owner";
@@ -347,6 +347,21 @@ export function restoreJournalState(
     };
   }
 
+  // A matching byte hash does not authorize following a newly substituted profile link.
+  // Refuse the complete pair before restoring config or deleting its recovery journal.
+  let profileIsSymlink = false;
+  if (profileUnchanged && (!comparison.profileAlreadyOriginal || comparison.originalProfile === null)) {
+    try { profileIsSymlink = lstatSync(CODEX_PROFILE_PATH).isSymbolicLink(); }
+    catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+  }
+  if (profileIsSymlink) {
+    return {
+      configRestored: comparison.configAlreadyOriginal, profileRestored: false,
+      configRewritten: false, profileRewritten: false,
+      configChanged: !configUnchanged, profileChanged: false,
+      complete: false, unverified: false, profileRestoreFailed: true as const,
+    };
+  }
   assertCodexHomeOwner(CODEX_HOME);
   let configRestored = comparison.configAlreadyOriginal;
   let profileRestored = comparison.profileAlreadyOriginal;

package/src/codex/main-account.ts

@@ -31,6 +31,12 @@ import { advanceCodexCredentialMutationEpoch } from "./credential-mutation-epoch
 import { withNativeMainExclusiveClaim } from "./native-main-claim";
 import { resolveNativeProfileContext } from "./native-profile-store";
 import { isNativeMainTrafficBlocked } from "./native-profile-startup";
+import { loadConfig } from "../config";
+import {
+  requestCodexAuthStatus,
+  resolveNativeMainRefreshMode,
+  type CodexAuthStatus,
+} from "./native-main-refresh-mode";
 
 export { MAIN_CODEX_ACCOUNT_ID } from "./account-id";
 
@@ -48,13 +54,11 @@ type MainAuthJsonCredential = {
   path: string;
   rawSha256: string;
   /**
-   * Filesystem identity of the file the hash was taken from (#2999).
-   *
-   * A content hash cannot tell "unchanged" from "replaced with a file that happens to
-   * hash the same", and more importantly it is read at a different instant than the
-   * rename. Carrying dev+ino lets the pre-rename guard ask the sharper question: is this
-   * still the same file, not merely one with the same bytes. `null` when the target could
-   * not be stat'ed, which is treated as "cannot prove identity" rather than "matches".
+   * Filesystem identity of the file the hash was taken from. It catches a writer that
+   * replaces auth.json by rename with identical bytes. It does not see Codex's own writes:
+   * Codex rewrites auth.json in place (truncate + write), which keeps dev and ino, so only
+   * the content hash notices those, and only once the new bytes are visible (#2999).
+   * `null` when the target could not be stat'ed, which fails closed.
    */
   identity: { dev: number; ino: number } | null;
   root: Record<string, unknown>;
@@ -66,6 +70,8 @@ type MainAuthJsonCredential = {
 
 export interface NativeMainRefreshDependencies {
   refreshToken?: (refreshToken: string, options: { signal: AbortSignal }) => Promise<OAuthCredentials>;
+  /** Codex-mode seam: one app-server `getAuthStatus` call. Used only when Codex owns the refresh. */
+  codexAuthStatus?: (options: { refresh: boolean; signal: AbortSignal }) => Promise<CodexAuthStatus>;
   signal?: AbortSignal;
   /** Metadata-only refresh must not retract a concurrent traffic reauth quarantine. */
   preserveReauth?: boolean;
@@ -264,10 +270,9 @@ function assertMainAuthJsonSnapshotUnchanged(expected: MainAuthJsonCredential):
   if (!current || current.path !== expected.path || current.rawSha256 !== expected.rawSha256) {
     throw new MainAuthJsonChangedDuringRefreshError();
   }
-  // Identity, not just content (#2999). A writer can land between this check and the
-  // rename, and rename(2) replaces unconditionally - so the narrower the question asked
-  // here, the smaller the window where a Codex login gets silently overwritten. An
-  // unreadable identity on either side fails closed: unprovable is not the same as equal.
+  // Also refuse a rename-based replacement with identical bytes. An unreadable identity on
+  // either side fails closed. This narrows the window; rename(2) still replaces
+  // unconditionally after this check returns.
   assertMainAuthJsonIdentityUnchanged(expected);
 }
 
@@ -288,9 +293,7 @@ function persistRefreshedMainAuthJson(
   assertNotRealCodexHomeUnderTest(resolveCodexHomeDir());
   const accessToken = refreshed.access;
   const refreshToken = refreshed.refresh || expected.refreshToken!;
-  const chatgptAccountId = refreshed.accountId
-    ?? extractAccountId(undefined, accessToken)
-    ?? expected.chatgptAccountId;
+  const { chatgptAccountId } = inFlightMainAccountToken(expected, refreshed);
   const tokens = {
     ...expected.tokens,
     access_token: accessToken,
@@ -475,6 +478,12 @@ async function resolveMainAccountToken(
   const signal = dependencies.signal
     ? AbortSignal.any([dependencies.signal, refreshTimeout])
     : refreshTimeout;
+  // An injected exchange is the guarded writer by definition. Otherwise Codex refreshes its own
+  // login whenever a supported binary exists, unless the operator chose "opencodex" (#2999).
+  const refreshMode = dependencies.refreshToken
+    ? null
+    : await resolveNativeMainRefreshMode(loadConfig());
+  if (signal.aborted) throw signal.reason;
   const lockKey = refreshGrantFingerprintForToken(initial.refreshToken);
   // Two locks, because they guard two different things that live in two different
   // homes. `withCodexRefreshFileLock` is keyed on the grant fingerprint and lives
@@ -508,6 +517,11 @@ async function resolveMainAccountToken(
           && mainAccessTokenFresh(locked.accessToken, Date.now(), MAIN_TOKEN_REFRESH_SKEW_MS)) {
           return { accessToken: locked.accessToken!, chatgptAccountId: locked.chatgptAccountId };
         }
+        if (refreshMode?.mode === "codex") {
+          const command = refreshMode.command!;
+          return refreshThroughCodex(locked, rejectedAccessToken, dependencies, refreshTimeout,
+            dependencies.codexAuthStatus ?? (options => requestCodexAuthStatus(command, options)));
+        }
         const refresh = dependencies.refreshToken ?? refreshNativeMainGrant;
         let refreshed: OAuthCredentials;
         if (signal.aborted) throw signal.reason;
@@ -539,7 +553,19 @@ async function resolveMainAccountToken(
         // Once the exchange starts, only its own timeout may abort it: a successful
         // rotating grant retires the old refresh token. Save the only live grant before
         // honoring caller cancellation, while retaining the external-writer guards.
-        const result = persistRefreshedMainAuthJson(locked, refreshed);
+        let result: { accessToken: string; chatgptAccountId: string };
+        try {
+          result = persistRefreshedMainAuthJson(locked, refreshed);
+        } catch (cause) {
+          if (!(cause instanceof MainAuthJsonChangedDuringRefreshError)) throw cause;
+          // Another writer owns auth.json now (#2999). The exchange already succeeded, so
+          // failing the request would waste it. Serve the new access token to this request
+          // only: leave the file as the other writer left it, keep nothing as the main
+          // credential, and do not retire the grant.
+          noteNativeMainRefresh("publish-refused-served-in-flight");
+          if (dependencies.signal?.aborted) throw dependencies.signal.reason;
+          return inFlightMainAccountToken(locked, refreshed);
+        }
         // A permitted in-flight success speaks only for its own profile and grant.
         clearMainRefreshGrantRejection(mainRefreshGrantKey(locked)!);
         if (dependencies.preserveReauth !== true) clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
@@ -556,6 +582,64 @@ async function resolveMainAccountToken(
   }
 }
 
+/** The refreshed bearer for one request whose save was refused; never stored anywhere. */
+function inFlightMainAccountToken(
+  expected: MainAuthJsonCredential,
+  refreshed: OAuthCredentials,
+): { accessToken: string; chatgptAccountId: string } {
+  return {
+    accessToken: refreshed.access,
+    chatgptAccountId: refreshed.accountId
+      ?? extractAccountId(undefined, refreshed.access)
+      ?? expected.chatgptAccountId,
+  };
+}
+
+/**
+ * Codex mode (#2999): Codex refreshes and stores its own login; OpenCodex only uses the bearer.
+ *
+ * auth.json is not read again after the call. In keyring mode Codex deletes the file once the
+ * keyring save succeeds, so the RPC answer is the only place the new token exists for us.
+ * The call runs on the refresh timeout alone: killing app-server mid-exchange could retire
+ * the grant before Codex saves its successor.
+ */
+async function refreshThroughCodex(
+  locked: MainAuthJsonCredential,
+  rejectedAccessToken: string | undefined,
+  dependencies: NativeMainRefreshDependencies,
+  refreshTimeout: AbortSignal,
+  authStatus: NonNullable<NativeMainRefreshDependencies["codexAuthStatus"]>,
+): Promise<{ accessToken: string; chatgptAccountId: string }> {
+  let status: CodexAuthStatus;
+  try {
+    status = await authStatus({ refresh: true, signal: refreshTimeout });
+  } catch (cause) {
+    noteNativeMainRefresh("codex-unavailable");
+    throw new MainAccountTokenRefreshError("transient", { cause });
+  }
+  if (status.authMethod === "chatgpt" && !status.authToken) {
+    // The only permanent-failure signal the response carries: Codex withholds the token once
+    // its refresh was refused for good. The specific OAuth code is not on the wire.
+    noteNativeMainRefresh("codex-reauth");
+    markMainRefreshGrantRejected(mainRefreshGrantKey(locked)!);
+    throw new MainAccountTokenRefreshError("reauth");
+  }
+  const token = status.authToken;
+  if (status.authMethod !== "chatgpt" || !token) {
+    noteNativeMainRefresh("codex-no-chatgpt-login");
+    throw new MainAccountTokenRefreshError("transient");
+  }
+  // A transient Codex refresh failure still answers with its cached bearer.
+  if (token === rejectedAccessToken || !mainAccessTokenFresh(token, Date.now(), 0)) {
+    noteNativeMainRefresh("codex-transient");
+    throw new MainAccountTokenRefreshError("transient");
+  }
+  noteNativeMainRefresh("codex-ok");
+  if (dependencies.preserveReauth !== true) clearAccountNeedsReauth(MAIN_CODEX_ACCOUNT_ID);
+  if (dependencies.signal?.aborted) throw dependencies.signal.reason;
+  return { accessToken: token, chatgptAccountId: extractAccountId(undefined, token) ?? locked.chatgptAccountId };
+}
+
 /** Refresh the CLI-owned native credential before upstream I/O and publish it atomically. */
 export function getValidMainAccountToken(
   dependencies: NativeMainRefreshDependencies = {},

package/src/codex/native-main-refresh-mode.ts

@@ -0,0 +1,217 @@
+/**
+ * Who refreshes the native main ChatGPT credential (#2999).
+ *
+ * Codex owns `CODEX_HOME/auth.json`. It rewrites the file in place and serializes its own
+ * refreshes only inside one process, so any second writer can race it, and a lost race
+ * retires the grant. In "codex" mode OpenCodex never writes the file: it asks the Codex
+ * binary to refresh through `app-server` `getAuthStatus` and uses the bearer that call
+ * returns. In "opencodex" mode the guarded writer in `main-account.ts` refreshes as before.
+ *
+ * The default is "codex" only when a version-checked binary is available. Without one, or
+ * when the operator sets `nativeMainRefresh: "opencodex"`, the guarded writer stays.
+ */
+import { codexExecInvocation } from "./exec-invocation";
+import { resolveCodexHomeDir } from "./home";
+import { compareCodexVersions, displayCodexRuntimePath, resolveCodexRuntimeAsync } from "./runtime";
+import type { ResolveCodexRuntimeResult } from "./runtime";
+import { isTestHomeGuardArmed } from "../lib/test-home-guard";
+import type { OcxConfig } from "../types/config";
+
+export type NativeMainRefreshMode = "codex" | "opencodex";
+
+/**
+ * Supported floor for app-server `getAuthStatus` with `includeToken`/`refreshToken` that
+ * withholds the token after a permanent refresh failure, the only reauth signal on the wire.
+ * Releases from about 0.118 already withhold it; 0.130.0 is the first with the handler in
+ * `request_processors/account_processor.rs` and is chosen conservatively.
+ */
+export const CODEX_AUTH_STATUS_MIN_VERSION = "0.130.0";
+
+export type NativeMainRefreshReason =
+  | "codex-compatible"
+  | "configured-opencodex"
+  | "codex-missing"
+  | "codex-too-old"
+  | "test-guard";
+
+export interface NativeMainRefreshResolution {
+  readonly mode: NativeMainRefreshMode;
+  readonly configured: NativeMainRefreshMode | "auto";
+  readonly reason: NativeMainRefreshReason;
+  readonly command?: string;
+  readonly version?: string | null;
+}
+
+export interface CodexAuthStatus {
+  readonly authMethod: string | null;
+  readonly authToken: string | null;
+  readonly requiresOpenaiAuth: boolean | null;
+}
+
+export class CodexAuthStatusError extends Error {
+  constructor(message: string, options?: ErrorOptions) {
+    super(message, options);
+    this.name = "CodexAuthStatusError";
+  }
+}
+
+let resolutionForTests: NativeMainRefreshResolution | null = null;
+
+/** Test seam: pin the resolution so no test spawns the developer's real Codex binary. */
+export function setNativeMainRefreshResolutionForTests(value: NativeMainRefreshResolution | null): void {
+  resolutionForTests = value;
+}
+
+function configuredMode(config: Pick<OcxConfig, "nativeMainRefresh"> | null | undefined): NativeMainRefreshMode | "auto" {
+  const value = config?.nativeMainRefresh;
+  return value === "codex" || value === "opencodex" ? value : "auto";
+}
+
+export async function resolveNativeMainRefreshMode(
+  config: Pick<OcxConfig, "nativeMainRefresh"> | null | undefined,
+  deps: { resolveRuntime?: () => Promise<ResolveCodexRuntimeResult> } = {},
+): Promise<NativeMainRefreshResolution> {
+  if (resolutionForTests) return resolutionForTests;
+  const configured = configuredMode(config);
+  if (configured === "opencodex") return { mode: "opencodex", configured, reason: "configured-opencodex" };
+  // Tests run against throwaway CODEX_HOMEs; delegating would spawn the real binary.
+  if (!deps.resolveRuntime && isTestHomeGuardArmed()) return { mode: "opencodex", configured, reason: "test-guard" };
+  const resolved = await (deps.resolveRuntime ?? (() => resolveCodexRuntimeAsync({ discoverAlternatives: false })))();
+  const { command, version, source } = resolved.runtime;
+  if (source === "fallback" && version === null) {
+    return { mode: "opencodex", configured, reason: "codex-missing" };
+  }
+  if (version === null || compareCodexVersions(version, CODEX_AUTH_STATUS_MIN_VERSION) < 0) {
+    return { mode: "opencodex", configured, reason: "codex-too-old", command, version };
+  }
+  return { mode: "codex", configured, reason: "codex-compatible", command, version };
+}
+
+/**
+ * One `getAuthStatus` round trip against a short-lived `codex app-server` on stdio.
+ *
+ * `model_provider="openai"` is forced because an authless Desktop injection sets
+ * `requires_openai_auth = false` on the OpenCodex provider, and then the server reports no
+ * credential at all. The process inherits CODEX_HOME so it reads the same login (file or
+ * keyring) Codex itself uses.
+ */
+export async function requestCodexAuthStatus(
+  command: string,
+  options: { refresh: boolean; signal: AbortSignal; codexHome?: string },
+): Promise<CodexAuthStatus> {
+  if (options.signal.aborted) throw options.signal.reason;
+  const invocation = codexExecInvocation(command, ["-c", 'model_provider="openai"', "app-server"]);
+  let proc: ReturnType<typeof Bun.spawn<"pipe", "pipe", "ignore">>;
+  try {
+    proc = Bun.spawn([invocation.file, ...invocation.args], {
+      env: { ...process.env, CODEX_HOME: options.codexHome ?? resolveCodexHomeDir() },
+      stdin: "pipe",
+      stdout: "pipe",
+      stderr: "ignore",
+      windowsVerbatimArguments: invocation.options.windowsVerbatimArguments,
+      windowsHide: true,
+    });
+  } catch (cause) {
+    throw new CodexAuthStatusError("could not start codex app-server", { cause });
+  }
+  // Abort settles the call by itself. Waiting for stdout to close would hang on a child that
+  // ignores SIGTERM or a launcher descendant that keeps the pipe open.
+  let onAbort = () => {};
+  const aborted = new Promise<never>((_, reject) => {
+    onAbort = () => reject(options.signal.reason);
+    options.signal.addEventListener("abort", onAbort, { once: true });
+  });
+  aborted.catch(() => { /* observed through the race below */ });
+  try {
+    const send = (message: unknown) => proc.stdin.write(JSON.stringify(message) + "\n");
+    send({ id: 1, method: "initialize", params: { clientInfo: { name: "opencodex", title: null, version: "0" } } });
+    send({ method: "initialized" });
+    send({ id: 2, method: "getAuthStatus", params: { includeToken: true, refreshToken: options.refresh } });
+    await Promise.race([proc.stdin.flush(), aborted]);
+    const response = await Promise.race([readResponse(proc.stdout, 2), aborted]);
+    if (options.signal.aborted) throw options.signal.reason;
+    return parseAuthStatus(response);
+  } catch (cause) {
+    if (options.signal.aborted) throw options.signal.reason;
+    if (cause instanceof CodexAuthStatusError) throw cause;
+    throw new CodexAuthStatusError("codex app-server getAuthStatus failed", { cause });
+  } finally {
+    options.signal.removeEventListener("abort", onAbort);
+    stopAppServer(proc);
+  }
+}
+
+const APP_SERVER_KILL_GRACE_MS = 2_000;
+
+/** SIGTERM now, SIGKILL if the child is still alive after a grace period; never awaited. */
+function stopAppServer(proc: { stdin: { end(): unknown }; kill(signal?: number | NodeJS.Signals): void; exited: Promise<number> }): void {
+  try { proc.stdin.end(); } catch { /* already closed */ }
+  let exited = false;
+  void proc.exited.then(() => { exited = true; }, () => { exited = true; });
+  try { proc.kill("SIGTERM"); } catch { /* already gone */ }
+  const timer = setTimeout(() => {
+    if (!exited) try { proc.kill("SIGKILL"); } catch { /* already gone */ }
+  }, APP_SERVER_KILL_GRACE_MS);
+  (timer as { unref?: () => void }).unref?.();
+}
+
+const MAX_APP_SERVER_LINE_BYTES = 1_048_576;
+
+async function readResponse(stream: ReadableStream<Uint8Array>, id: number): Promise<Record<string, unknown>> {
+  const decoder = new TextDecoder();
+  let buffered = "";
+  for await (const chunk of stream) {
+    buffered += decoder.decode(chunk, { stream: true });
+    let newline: number;
+    while ((newline = buffered.indexOf("\n")) >= 0) {
+      const line = buffered.slice(0, newline).trim();
+      buffered = buffered.slice(newline + 1);
+      if (!line) continue;
+      let message: unknown;
+      try { message = JSON.parse(line); } catch { continue; }
+      if (!message || typeof message !== "object") continue;
+      const record = message as Record<string, unknown>;
+      if (record.id !== id) continue;
+      if (record.error !== undefined) throw new CodexAuthStatusError("codex app-server rejected getAuthStatus");
+      if (!record.result || typeof record.result !== "object") {
+        throw new CodexAuthStatusError("codex app-server returned no getAuthStatus result");
+      }
+      return record.result as Record<string, unknown>;
+    }
+    if (buffered.length > MAX_APP_SERVER_LINE_BYTES) throw new CodexAuthStatusError("codex app-server line too long");
+  }
+  throw new CodexAuthStatusError("codex app-server exited before answering getAuthStatus");
+}
+
+function parseAuthStatus(result: Record<string, unknown>): CodexAuthStatus {
+  const authMethod = typeof result.authMethod === "string" ? result.authMethod : null;
+  const authToken = typeof result.authToken === "string" && result.authToken ? result.authToken : null;
+  const requiresOpenaiAuth = typeof result.requiresOpenaiAuth === "boolean" ? result.requiresOpenaiAuth : null;
+  return { authMethod, authToken, requiresOpenaiAuth };
+}
+
+/** `ocx doctor` lines for the active refresh owner. Never includes a credential. */
+export function formatNativeMainRefreshDoctorLines(resolution: NativeMainRefreshResolution): string[] {
+  const configured = resolution.configured === "auto" ? "auto" : `nativeMainRefresh: "${resolution.configured}"`;
+  const binary = resolution.command
+    ? `${displayCodexRuntimePath(resolution.command)} (${resolution.version ?? "unknown"})`
+    : "none";
+  switch (resolution.reason) {
+    case "codex-compatible":
+      return [`  ok  codex: Codex refreshes the main login through app-server (${binary}; ${configured})`];
+    case "configured-opencodex":
+      return [`  --  opencodex: OpenCodex refreshes auth.json with its guarded writer (${configured})`];
+    case "test-guard":
+      return ["  --  opencodex: test guard is armed; Codex delegation is disabled"];
+    case "codex-missing":
+      return [
+        `  !!  opencodex: no Codex binary found, so OpenCodex refreshes auth.json itself (${configured})`,
+        `       Install Codex ${CODEX_AUTH_STATUS_MIN_VERSION} or newer to let Codex own its login.`,
+      ];
+    case "codex-too-old":
+      return [
+        `  !!  opencodex: Codex ${binary} is older than ${CODEX_AUTH_STATUS_MIN_VERSION}, so OpenCodex refreshes auth.json itself (${configured})`,
+        "       Update Codex to let Codex own its login.",
+      ];
+  }
+}

package/src/codex/native-profile-startup.ts

@@ -20,6 +20,7 @@ import { withNativeMainExclusiveClaim } from "./native-main-claim";
 import { scrubNativeMainAuthTempResidues } from "./native-main-auth-temp";
 import { NATIVE_STAGE_SWEEP_INTERVAL_MS } from "./native-profile-stage-store";
 import type { NativeCodexOwnership } from "../integrations/native/ownership-preflight";
+import { isPassiveRead } from "../lib/passive-read";
 
 export type NativeMainStartupGateSnapshot =
   | { status: "ready"; homeId: string | null }
@@ -701,7 +702,9 @@ export async function releaseNativeMainStartupLifecycle(server: object): Promise
 
 export function isNativeMainTrafficBlocked(): boolean {
   const reason = activeServiceOwnershipBlockReason();
-  if (reason !== null && reprobeServiceOwnership(reason)) {
+  // A passive read (a Remote Link Child's, #6959) reports the gate as it stands: re-inspecting
+  // service ownership can activate the native-main lifecycle and its recovery on this machine.
+  if (reason !== null && !isPassiveRead() && reprobeServiceOwnership(reason)) {
     // The host became ownable after boot (#2108): the fence lifts here rather than
     // waiting for the restart the reporter had to perform by hand.
     return activeServiceOwnershipBlockReason() !== null || snapshot.status === "blocked";

package/src/codex/prompt-journal.ts

@@ -318,7 +318,7 @@ export function recoverIfNeeded(
       };
     }
     try {
-      publishConfigWrite(expectedTargets.configPath, held, (destination, hooks) => restore(destination, record.preConfigBytes, hooks));
+      publishConfigWrite(expectedTargets.configPath, held, (destination, hooks) => restore(destination, record.preConfigBytes, expectingImage(hooks, record.postConfig)));
     } catch (error) {
       return {
         ok: false,
@@ -336,7 +336,7 @@ export function recoverIfNeeded(
       };
     }
     try {
-      publishConfigWriteTarget(expectedTargets.configPath, held, expectedTargets.storePath, (destination, hooks) => restore(destination, record.preStoreBytes, hooks));
+      publishConfigWriteTarget(expectedTargets.configPath, held, expectedTargets.storePath, (destination, hooks) => restore(destination, record.preStoreBytes, expectingImage(hooks, record.postStore)));
     } catch (error) {
       return {
         ok: false,
@@ -363,3 +363,21 @@ function restore(path: string, bytes: string | null, hooks: AtomicWriteHooks): v
   if (bytes === null) durableDelete(path, hooks);
   else durableWrite(path, bytes, hooks);
 }
+
+/**
+ * Bind a write to the image the caller classified. The rename retry hooks check
+ * path and inode identity only; an in-place edit by another process during a
+ * Windows sharing-violation retry keeps the inode, so without this re-read a
+ * later attempt would replace newer bytes. Checked before every attempt.
+ */
+export function expectingImage(hooks: AtomicWriteHooks, expectedHash: string): AtomicWriteHooks {
+  return {
+    ...hooks,
+    validateBeforeRename: (targetPath: string) => {
+      hooks.validateBeforeRename?.(targetPath);
+      if (hashBytes(readOrNull(targetPath)) !== expectedHash) {
+        throw new Error(targetPath + " changed during the write; refusing to overwrite it. Files and recovery evidence were preserved.");
+      }
+    },
+  };
+}

package/src/codex/prompt-layers/encoding.ts

@@ -119,3 +119,52 @@ export function decodeTomlBasicString(literal: string): string | null {
   }
   return out;
 }
+
+/** Shared scalar assignment matching; quoted and escaped keys retain their spelling. */
+export function matchKeyHead(line: string, key: string): { prefix: string; rest: string } | null {
+  const m = /^\s*("(?:[^"\\]|\\.)*"|'[^']*'|[A-Za-z0-9_-]+)\s*=\s*/.exec(line);
+  if (!m) return null;
+  const token = m[1]!;
+  const decoded = token.startsWith('"') ? decodeTomlBasicString(token)
+    : token.startsWith("'") ? token.slice(1, -1) : token;
+  return decoded === key ? { prefix: m[0], rest: line.slice(m[0].length) } : null;
+}
+
+/**
+ * For each line, whether it begins outside every string and composite span, or
+ * `null` when a span never closes and the scope of later lines is unknown.
+ *
+ * Line matchers for assignments and table headers must only look at lines that
+ * start at top level: `"model_instructions_file" = "x"` written inside a
+ * `"""…"""` value or a multi-line array is prose, not syntax. Readers and
+ * editors share this so a write and the snapshot read back agree.
+ */
+export function lexicalLineStarts(lines: readonly string[]): boolean[] | null {
+  const starts: boolean[] = [];
+  let open: string | null = null;
+  let depth = 0;
+  for (const line of lines) {
+    starts.push(open === null && depth === 0);
+    for (let i = 0; i < line.length; i += 1) {
+      const char = line[i]!;
+      if (open !== null) {
+        if (char === "\\" && (open === '"' || open === '"""')) { i += 1; continue; }
+        if (char !== open[0]) continue;
+        if (open.length === 1) { open = null; continue; }
+        let run = 0;
+        while (line[i + run] === char) run += 1;
+        // Up to two quotes may sit inside the value just before the closing three.
+        if (run >= 3) open = null;
+        i += run - 1;
+      } else if (char === "#") break;
+      else if (char === '"' || char === "'") {
+        open = line.startsWith(char.repeat(3), i) ? char.repeat(3) : char;
+        i += open.length - 1;
+      } else if (char === "[" || char === "{") depth += 1;
+      else if (char === "]" || char === "}") { depth -= 1; if (depth < 0) return null; }
+    }
+    // Single-line strings cannot cross a newline.
+    if (open !== null && open.length === 1) return null;
+  }
+  return open === null && depth === 0 ? starts : null;
+}