@bitkyc08/opencodex 2.83.0 → 2.86.0

package/src/server/responses-undeclared-tool-guard.ts

@@ -1,3 +1,4 @@
+import { UNDECLARED_TOOL_CALL_ERROR_CODE } from "../lib/errors";
 import {
   collectAmbiguousDottedAliases,
   dottedAliasIsUnambiguous,
@@ -78,7 +79,7 @@ const NAMELESS_TOOL_SPEC_TYPES = new Set([
 /** An upstream-supplied name reaches the error message; keep it bounded. */
 const MAX_REPORTED_NAME_CHARS = 100;
 
-export const UNDECLARED_TOOL_CALL_ERROR_CODE = "undeclared_tool_call";
+export { UNDECLARED_TOOL_CALL_ERROR_CODE };
 
 function isPlainObject(value: unknown): value is Record<string, unknown> {
   return !!value && typeof value === "object" && !Array.isArray(value);
@@ -370,6 +371,24 @@ export function hasExplicitWireToolCatalog(body: unknown): boolean {
   );
 }
 
+/**
+ * Whether the caller declared an explicitly EMPTY catalog — `tools: []` or an
+ * `additional_tools` item with `tools: []`. Unlike an absent or partial catalog this is an
+ * unambiguous deny-all: no deferred registry can exist under it, so even deferred wires
+ * enforce it. A hosted-only catalog is NOT empty — it still defers like an absent one.
+ */
+export function hasExplicitEmptyToolCatalog(body: unknown): boolean {
+  if (!isPlainObject(body)) return false;
+  if (Array.isArray(body.tools) && body.tools.length === 0) return true;
+  if (!Array.isArray(body.input)) return false;
+  return body.input.some(item =>
+    isPlainObject(item)
+    && item.type === "additional_tools"
+    && Array.isArray(item.tools)
+    && item.tools.length === 0
+  );
+}
+
 /**
  * Evaluates whether an individual output item represents an undeclared tool call.
  *
@@ -703,7 +722,6 @@ function failedBlocks(name: string, newline: string): readonly string[] {
  * @param providerExecutedCallTypes - Call types executed by the provider.
  * @param declaredBare - Explicitly declared bare tool names without namespace provenance.
  * @param declaredCustom - Current bare custom declarations eligible for code-mode recovery.
- * @param enforceDeclaredToolNames - Refuse undeclared calls; normalization remains active when false.
  * @returns An SSE block rewrite function.
  */
 export function createUndeclaredToolCallGuardBlockRewrite(
@@ -712,8 +730,11 @@ export function createUndeclaredToolCallGuardBlockRewrite(
   providerExecutedCallTypes: ProviderExecutedCallTypes = EMPTY_PROVIDER_EXECUTED_CALL_TYPES,
   declaredBare?: ReadonlySet<string>,
   declaredCustom?: ReadonlySet<string>,
-  enforceDeclaredToolNames = true,
+  options?: { refuseUndeclared?: boolean },
 ): SseBlockRewrite {
+  // Deferred-catalog wires (Chat/Anthropic) keep the default-namespace normalization — the
+  // client can only resolve the bare name it declared — while the refusal itself stays off.
+  const refuse = options?.refuseUndeclared !== false;
   let tripped = false;
   return (block: string) => {
     if (tripped) return [];
@@ -725,12 +746,12 @@ export function createUndeclaredToolCallGuardBlockRewrite(
     } catch {
       return [block];
     }
-    const name = enforceDeclaredToolNames
-      ? undeclaredToolCallName(parsed, declared, declaredNamelessClientCallTypes, providerExecutedCallTypes, declaredBare, declaredCustom)
-      : undefined;
-    if (name !== undefined) {
-      tripped = true;
-      return failedBlocks(name, block.includes("\r\n") ? "\r\n" : "\n");
+    if (refuse) {
+      const name = undeclaredToolCallName(parsed, declared, declaredNamelessClientCallTypes, providerExecutedCallTypes, declaredBare, declaredCustom);
+      if (name !== undefined) {
+        tripped = true;
+        return failedBlocks(name, block.includes("\r\n") ? "\r\n" : "\n");
+      }
     }
     const normalized = normalizeDefaultNamespaceInPayload(parsed, declared, declaredBare);
     if (normalized.changed) {

package/src/server/startup-action-control.ts

@@ -2,6 +2,9 @@ import { randomUUID } from "node:crypto";
 import { execFile } from "node:child_process";
 import { join } from "node:path";
 import { durableBunPath } from "../lib/bun-runtime";
+import { selfLaunchArgv } from "../lib/self-launch-argv";
+import { isDesktopSupervised } from "../lib/system-restart-contract";
+import { withLoginShellPath } from "./login-shell-path";
 import {
   WINDOWS_SCHTASKS_CREATE_ACCESS_DENIED_MARKER,
   isWindowsSchtasksCreateAccessDenied,
@@ -61,6 +64,20 @@ export function setStartupInstallFinalizeForTests(next: FinalizeFn | null): void
   finalizeImpl = next ?? finalizeWindowsSchedulerServiceRegistration;
 }
 
+interface StartupInstallLaunch {
+  execFile?: typeof execFile;
+  /** Overrides Bun's own standalone detection, which a source-mode test cannot flip. */
+  isStandaloneExecutable?: boolean;
+  isDesktopSupervised?: () => boolean;
+  withLoginShellPath?: (env: NodeJS.ProcessEnv) => Promise<NodeJS.ProcessEnv>;
+}
+let installLaunch: StartupInstallLaunch = {};
+
+/** Test-only seam: observe the installer child's argv and simulate a compiled `ocx`. */
+export function setStartupInstallLaunchForTests(next: StartupInstallLaunch | null): void {
+  installLaunch = next ?? {};
+}
+
 /** Snapshot of the install lock for diagnostics and tests. */
 export function getStartupInstallState(): StartupInstallState {
   return installState;
@@ -156,20 +173,37 @@ export function installFailureDetail(stdout: string, stderr: string, error: Erro
   return classifyCliInstallFailure(stdout, stderr, error).detail;
 }
 
-function runCliInstall(
+/**
+ * Under OpenCodex Desktop the proxy has the GUI launch PATH, where no user-installed Codex is
+ * visible. The shim installer gets the user's login-shell PATH instead (#6971).
+ */
+async function installChildEnv(action: StartupInstallAction): Promise<NodeJS.ProcessEnv> {
+  if (action !== "install-shim" || !(installLaunch.isDesktopSupervised ?? isDesktopSupervised)()) return process.env;
+  return (installLaunch.withLoginShellPath ?? withLoginShellPath)(process.env);
+}
+
+async function runCliInstall(
   action: StartupInstallAction,
   options?: { repair?: boolean },
 ): Promise<{ stdout: string; stderr: string }> {
   const bun = durableBunPath();
   const cli = join(import.meta.dir, "..", "cli", "index.ts");
-  const argv = [cli, ...startupInstallArgv(action, options)];
+  // The Desktop app and the Linux deb run a compiled `ocx`, where `process.execPath` is the CLI
+  // itself: prefixing the source entrypoint made it an unknown command and every dashboard
+  // Install/Repair failed (#6963). Same builder as the startup-health probe.
+  const argv = selfLaunchArgv(startupInstallArgv(action, options), {
+    sourceEntrypoint: cli,
+    isStandaloneExecutable: installLaunch.isStandaloneExecutable,
+  });
+  const run = installLaunch.execFile ?? execFile;
+  const env = await installChildEnv(action);
   return new Promise((resolve, reject) => {
     const timeout = process.platform === "win32" && action === "install-service"
       ? 0
       : 60_000;
-    execFile(bun, argv, {
+    run(bun, argv, {
       encoding: "utf8",
-      env: process.env,
+      env,
       // A fresh Windows scheduler install now owns its UAC prompt inside this CLI
       // transaction. Killing only the CLI at 60s can orphan its elevated schtasks child,
       // which may register the task after the Dashboard has reported failure. Keep the

package/src/server/startup-health-cache.ts

@@ -9,6 +9,7 @@ import { selfLaunchArgv } from "../lib/self-launch-argv";
 import { desktopStartupOwnership } from "../service/desktop-startup";
 import type { OcxConfig } from "../types";
 import { truncateRetainedUtf8 } from "../lib/admission";
+import { isPassiveRead } from "../lib/passive-read";
 
 const CACHE_TTL_MS = 30_000;
 const PROBE_TIMEOUT_MS = startupHealthProbeBudgetMs();
@@ -69,6 +70,8 @@ export function getStartupHealthSnapshot(
 ): StartupHealth {
   const now = deps.now ?? Date.now;
   if (cached && now() - cached.timestamp < CACHE_TTL_MS) return cached.value;
+  // A passive read (a Remote Link Child's, #6959) starts no diagnostic process on this machine.
+  if (isPassiveRead()) return staleOrFallback(config);
   refreshInBackground(config, deps);
   return staleOrFallback(config);
 }
@@ -114,6 +117,7 @@ function conservativeFallback(config: Pick<OcxConfig, "codexAutoStart">): Startu
     serviceSupported: process.platform === "win32" || process.platform === "darwin" || process.platform === "linux",
     shimInstalled: shim.installed,
     shimHealthy: shim.healthy,
+    ...(shim.activationPending ? { shimActivationPending: true } : {}),
     platform: process.platform,
     diagnosticStale: true,
   });
@@ -189,6 +193,7 @@ export async function getCachedStartupHealth(
 ): Promise<StartupHealth> {
   const now = deps.now ?? Date.now;
   if (cached && now() - cached.timestamp < CACHE_TTL_MS) return cached.value;
+  if (isPassiveRead()) return staleOrFallback(config);
   refreshInBackground(config, deps);
   // An expired or empty read is an explicit protection check. Wait for the
   // isolated probe instead of presenting a synthetic failure while that probe

package/src/server/system-env-shell.ts

@@ -1,7 +1,7 @@
 import { accessSync, constants, readFileSync, writeFileSync, unlinkSync, mkdirSync, statSync } from "node:fs";
 import { delimiter, join } from "node:path";
 import { getConfigDir } from "../config";
-import { claudeToolSearchEnv, resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
+import { claudeTierDisplayName, claudeToolSearchEnv, isClaudeTierLabelSlot, resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
 import { PROXY_MARKER, defaultAuthDetectDeps, detectClaudeAuth, ownAdmissionTokens, type AuthDetectDeps } from "../claude/auth-detect";
 import { resolveClaudeAuthMode } from "../claude/auth-mode";
 import { ANTHROPIC_PARENT_ENV_SLOTS, trustedNodeLauncherContext, type AnthropicParentEnvSlot } from "../cli/launcher-context";
@@ -115,7 +115,12 @@ export function writeShellEnvFile(
   }
   for (const [name, value] of Object.entries(modelEnv)) {
     if (name === "ANTHROPIC_MODEL") continue;
-    lines.push(conditional(name, value));
+    // An alias tier slot carries its picker label (#6926) in the same branch, so the label is
+    // exported only when this file writes the slot and the shell has no label of its own.
+    const label = isClaudeTierLabelSlot(name) ? claudeTierDisplayName(value) : undefined;
+    lines.push(label === undefined
+      ? conditional(name, value)
+      : `${conditional(name, value)} && [ -z "\${${name}_NAME+x}" ] && export ${name}_NAME=${shellValue(label)}`);
   }
   const maxCtx = config.claudeCode?.maxContextTokens;
   if (typeof maxCtx === "number" && Number.isFinite(maxCtx) && maxCtx > 0) {

package/src/server/system-env.ts

@@ -2,7 +2,7 @@ import { execFileSync } from "node:child_process";
 import { readFileSync, writeFileSync, unlinkSync, mkdirSync } from "node:fs";
 import { join } from "node:path";
 import { getConfigDir } from "../config";
-import { claudeToolSearchEnv, resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
+import { CLAUDE_TIER_LABEL_SLOTS, claudeTierDisplayName, claudeToolSearchEnv, resolveAutoContext, type AutoContextMode } from "../claude/context-windows";
 import { PROXY_MARKER } from "../claude/auth-detect";
 import { isProxyAdmissionSecret } from "./auth-cors";
 import type { OcxConfig } from "../types";
@@ -30,6 +30,8 @@ const MANAGED_SYSTEM_ENV_NAMES = new Set<string>([
   "ANTHROPIC_DEFAULT_FABLE_MODEL",
   "ANTHROPIC_DEFAULT_HAIKU_MODEL",
   "ANTHROPIC_SMALL_FAST_MODEL",
+  // Picker labels paired with an alias tier slot this instance injected (#6926).
+  ...CLAUDE_TIER_LABEL_SLOTS.map(slot => `${slot}_NAME`),
   "CLAUDE_CODE_MAX_CONTEXT_TOKENS",
   "DISABLE_COMPACT",
   "CLAUDE_CODE_AUTO_COMPACT_WINDOW",
@@ -315,6 +317,14 @@ export async function injectSystemEnv(
       if (name === "ANTHROPIC_MODEL") continue; // legacy slot handled by shell file only (back-compat)
       injectLever(name, value);
     }
+    // Picker labels (#6926) only for alias tier slots this instance owns after the loop above: a
+    // launchd slot the user set keeps whatever label it has, and a label nothing produces any
+    // more is unset by the produced-key sweep below like any other tracked lever.
+    for (const slot of CLAUDE_TIER_LABEL_SLOTS) {
+      const value = modelEnv[slot];
+      const label = value === undefined ? undefined : claudeTierDisplayName(value);
+      if (label !== undefined && injectedKeys.includes(slot)) injectLever(`${slot}_NAME`, label);
+    }
     const maxCtx = config.claudeCode?.maxContextTokens;
     if (typeof maxCtx === "number" && Number.isFinite(maxCtx) && maxCtx > 0) {
       injectLever("CLAUDE_CODE_MAX_CONTEXT_TOKENS", String(Math.floor(maxCtx)));

package/src/service/cli.ts

@@ -27,6 +27,8 @@ import { win32 } from "node:path";
 import { serviceDiagnosticsSummary } from "./diagnostics";
 import { runServiceClaim } from "./claim";
 import { createSupervisionLatch, desktopServiceCommandRefusal } from "./desktop-command-guard";
+import { linuxServiceBootHint } from "./linux-linger";
+import { diagnoseDesktopStartup, desktopLoginStatusSummary } from "./desktop-startup";
 
 /**
  * `restart` is NO LONGER folded into `repair`.
@@ -336,7 +338,7 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       // and the baked one cannot have diverged yet — unlike `start`, which reads the
       // installed artifact instead.
       await reportServiceServing("installed", { port: resolveServiceListenPort() });
-      if (process.platform === "linux") console.log("   For auto-start on boot: loginctl enable-linger $USER");
+      if (process.platform === "linux") console.log(linuxServiceBootHint());
       // Service users never reach the `ocx start` prompt: the proxy they run is the
       // supervised child, which always carries OCX_SERVICE=1. This command, though, is
       // hand-typed in a real terminal, so it is the one interactive moment they get.
@@ -433,6 +435,8 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       const lease = ownershipMutationLeaseStatusLine(serviceStatePaths());
       if (lease) console.log(lease);
       console.log(`Diagnostics: ${serviceDiagnosticsSummary()}`);
+      const desktop = diagnoseDesktopStartup();
+      if (desktop) console.log(desktopLoginStatusSummary(desktop));
       break;
     }
     case "uninstall":

package/src/service/desktop-startup.ts

@@ -1,18 +1,24 @@
 import { execFileSync } from "node:child_process";
-import { accessSync, constants, readFileSync, realpathSync } from "node:fs";
+import { accessSync, constants, lstatSync, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
-import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { basename, dirname, isAbsolute, join, resolve, win32 } from "node:path";
 import { readPid } from "../config/process-state";
 import { resolveServiceOwnership, sameServiceOwnershipSubject, type ServiceOwnershipResolution } from "./state";
-import { inspectDesktopSupervision, processIdentity, procfs, type ProcReader } from "./desktop-supervision.mjs";
+import { inspectDesktopSupervision, processIdentity, procfs, type DesktopSupervisionDeps, type ProcReader } from "./desktop-supervision.mjs";
 
 export interface DesktopStartupDiagnostic {
   /** Durable desktop claim; failed supervision does not release ownership. */
   owned: boolean;
   loginEnabled: boolean;
+  /** Verified enabled macOS registration; absence means registration is not credited. */
+  loginRegistration?: "loaded" | "registered-not-loaded";
   running: boolean;
   viable: boolean;
-  /** Live parentage when no durable claim exists; never converts supervision into ownership. */
+  /**
+   * Proven live parentage; never converts supervision into ownership. macOS and Linux report it
+   * only without a durable claim. Windows also reports it beside a durable Desktop claim, because
+   * older Windows runtimes never published a Desktop diagnostic that status could defer to.
+   */
   supervisor?: { supervisorPid: number; runtimePid: number; app: string };
 }
 
@@ -21,6 +27,14 @@ export function deriveDesktopStartup(facts: Omit<DesktopStartupDiagnostic, "viab
   return { ...facts, viable: (facts.owned || facts.supervisor !== undefined) && facts.loginEnabled && facts.running };
 }
 
+export function desktopLoginStatusSummary(desktop: DesktopStartupDiagnostic): string {
+  if (!desktop.loginEnabled) return "Desktop Start at Login: not registered, disabled, or could not be verified.";
+  if (desktop.loginRegistration === "registered-not-loaded") {
+    return "Desktop Start at Login: registered and enabled for next login; not loaded in this session.";
+  }
+  return `Desktop Start at Login: enabled${desktop.loginRegistration === "loaded" ? " and loaded in this session" : ""}.`;
+}
+
 function run(command: string, args: string[]): string {
   return execFileSync(command, args, { encoding: "utf8", timeout: 750, maxBuffer: 128 * 1024, stdio: ["ignore", "pipe", "pipe"] }).trim();
 }
@@ -35,12 +49,16 @@ interface DesktopStartupDeps {
   run?: typeof run;
   env?: NodeJS.ProcessEnv;
   proc?: ProcReader;
+  windowsProcesses?: DesktopSupervisionDeps["windowsProcesses"];
+  now?: () => number;
+  /** The Desktop's own install id (Tauri app_config_dir); null when unreadable. */
+  readWindowsInstallId?: () => string | null;
 }
 
 /** Cheap ownership-only snapshot: no launchd/process probes on the server request path. */
 export function desktopStartupOwnership(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
   const platform = deps.platform ?? process.platform;
-  if (platform !== "darwin" && platform !== "linux") return undefined;
+  if (platform !== "darwin" && platform !== "linux" && platform !== "win32") return undefined;
   const owner = (deps.ownership ?? resolveServiceOwnership)();
   return owner.kind === "owned" && owner.ownership.owner === "desktop"
     ? deriveDesktopStartup({ owned: true, loginEnabled: false, running: false }) : undefined;
@@ -49,33 +67,99 @@ export function desktopStartupOwnership(deps: DesktopStartupDeps = {}): DesktopS
 function macLoginRegistration(deps: DesktopStartupDeps) {
   const execute = deps.run ?? run;
   const path = join(deps.home ?? homedir(), "Library", "LaunchAgents", "OpenCodex.plist");
-  const plist = JSON.parse(execute("/usr/bin/plutil", ["-convert", "json", "-o", "-", path]));
-  const args = plist.ProgramArguments;
-  if (plist.Label !== "OpenCodex" || plist.RunAtLoad !== true || !Array.isArray(args)
-    || args.length !== 2 || args[1] !== "--autostart" || typeof args[0] !== "string"
-    || !args[0].endsWith("/Contents/MacOS/opencodex-desktop")
-    || (plist.Program !== undefined && plist.Program !== args[0])) return null;
-  const app = realpathSync(args[0]);
-  const proxy = realpathSync(join(dirname(app), "ocx"));
-  accessSync(app, constants.X_OK);
-  accessSync(proxy, constants.X_OK);
   const domain = `gui/${deps.uid ?? process.getuid!()}`;
-  const disabled = execute("/bin/launchctl", ["print-disabled", domain]);
-  const loaded = execute("/bin/launchctl", ["print", `${domain}/OpenCodex`]);
+  const identity = (file: string) => {
+    const stat = lstatSync(file, { bigint: true });
+    return [stat.dev, stat.ino, stat.size, stat.mode, stat.mtimeNs, stat.ctimeNs].map(String).join(":");
+  };
+  const capture = () => {
+    const registrationPath = realpathSync(path);
+    const plistIdentity = identity(path), targetIdentity = identity(registrationPath);
+    const definition = execute("/usr/bin/plutil", ["-convert", "json", "-o", "-", path]);
+    const plist = JSON.parse(definition);
+    const args = plist.ProgramArguments;
+    if (plist.Label !== "OpenCodex" || plist.RunAtLoad !== true || !Array.isArray(args)
+      || args.length !== 2 || args[1] !== "--autostart" || typeof args[0] !== "string"
+      || !args[0].endsWith("/Contents/MacOS/opencodex-desktop")
+      || (plist.Program !== undefined && plist.Program !== args[0])
+      || (plist.Disabled !== undefined && typeof plist.Disabled !== "boolean")) return null;
+    const app = realpathSync(args[0]);
+    const proxy = realpathSync(join(dirname(app), "ocx"));
+    accessSync(app, constants.X_OK);
+    accessSync(proxy, constants.X_OK);
+    const appIdentity = identity(app), proxyIdentity = identity(proxy);
+    const disabled = execute("/bin/launchctl", ["print-disabled", domain]);
+    const mentions = disabled.match(/"OpenCodex"/g)?.length ?? 0;
+    const override = /"OpenCodex"\s*=>\s*(enabled|false|disabled|true)(?=\s*(?:\r?\n|[,;}]|$))/.exec(disabled)?.[1];
+    const loginEnabled = /^\s*disabled services = \{[\s\S]*\}\s*$/.test(disabled)
+      && (mentions === 0 ? plist.Disabled !== true : mentions === 1 && (override === "enabled" || override === "false"));
+    if (registrationPath !== realpathSync(path) || plistIdentity !== identity(path) || targetIdentity !== identity(registrationPath)
+      || app !== realpathSync(args[0]) || proxy !== realpathSync(join(dirname(app), "ocx"))
+      || appIdentity !== identity(app) || proxyIdentity !== identity(proxy)) return null;
+    return { app, proxy, loginEnabled, registrationPath, plistIdentity, targetIdentity, definition, appIdentity, proxyIdentity, disabled };
+  };
+  const first = capture();
+  if (!first) return null;
+  const { app, proxy } = first;
+  if (!first.loginEnabled) return { app, proxy, loginEnabled: false };
+  let loaded: string;
+  try { loaded = execute("/bin/launchctl", ["print", `${domain}/OpenCodex`]); }
+  catch (error) {
+    // execFileSync's specific service-not-found result is absence, not a failed probe.
+    // Timeout, permission denial, missing tools and another domain remain unverified.
+    const failure = error as { status?: number; stderr?: unknown; signal?: unknown; code?: unknown } | null;
+    const stderr = typeof failure?.stderr === "string" ? failure.stderr
+      : Buffer.isBuffer(failure?.stderr) ? failure.stderr.toString("utf8") : "";
+    const message = `Could not find service "OpenCodex" in domain for user gui: ${domain.slice(4)}`;
+    const missing = failure?.status === 113 && !failure.signal && !failure.code
+      && [message, `Bad request.\n${message}`].includes(stderr.trim());
+    if (!missing) throw error;
+    // The absent job supplies no durable registration evidence. Re-read the entire
+    // registration and enabled state; replacement or ambiguity revokes login credit.
+    const final = capture();
+    if (!final || JSON.stringify(first) !== JSON.stringify(final)) return { app, proxy, loginEnabled: false };
+    return { app, proxy, loginEnabled: true, loginRegistration: "registered-not-loaded" as const };
+  }
   const program = /^\s*program = (.+)$/m.exec(loaded)?.[1];
   const loadedPath = /^\s*path = (.+)$/m.exec(loaded)?.[1];
-  const loginEnabled = /^\s*disabled services = \{[\s\S]*\}\s*$/.test(disabled)
-    && !/"OpenCodex"\s*=>\s*(?:disabled|true)/.test(disabled)
-    && program !== undefined && realpathSync(program) === app
-    && loadedPath !== undefined && realpathSync(loadedPath) === realpathSync(path);
-  return { app, proxy, loginEnabled };
+  // macOS 13+ Background Task Management can take over the user LaunchAgent and resubmit it
+  // through smd; launchctl then names the submitter instead of the plist (#7019). The loaded
+  // job no longer points at the registration, so credit it like an unloaded job: same program,
+  // and the entire registration re-read unchanged.
+  if (program !== undefined && loadedPath !== undefined && SMD_SUBMITTED.test(loadedPath)
+    && /^\s*managed_by = (.+)$/m.exec(loaded)?.[1] === SERVICE_MANAGEMENT && realpathSync(program) === app) {
+    const final = capture();
+    if (!final || JSON.stringify(first) !== JSON.stringify(final)) return { app, proxy, loginEnabled: false };
+    return { app, proxy, loginEnabled: true, loginRegistration: "loaded" as const };
+  }
+  const loginEnabled = program !== undefined && realpathSync(program) === app
+    && loadedPath !== undefined && realpathSync(loadedPath) === first.registrationPath;
+  return { app, proxy, loginEnabled, ...(loginEnabled ? { loginRegistration: "loaded" as const } : {}) };
+}
+
+/** launchctl's `path` for a job Background Task Management resubmitted through smd. */
+const SMD_SUBMITTED = /^\(submitted by smd\.\d+\)$/;
+const SERVICE_MANAGEMENT = "com.apple.xpc.ServiceManagement";
+
+type DesktopLoginFacts = Pick<DesktopStartupDiagnostic, "loginEnabled" | "loginRegistration">;
+
+/**
+ * Start at Login credit for one Desktop app copy. The tray's Start at Login item ports this
+ * judgment (desktop/src-tauri/src/login_registration.rs); both run the cases in
+ * tests/fixtures/desktop-login-registration-cases.json. Throws when evidence is unreadable.
+ */
+export function macLoginFactsFor(app: string, deps: DesktopStartupDeps): DesktopLoginFacts {
+  const login = macLoginRegistration(deps);
+  return login !== null && login.app === app
+    ? { loginEnabled: login.loginEnabled, ...(login.loginRegistration ? { loginRegistration: login.loginRegistration } : {}) }
+    : { loginEnabled: false };
 }
 
-function diagnoseSupervisedStartup(deps: DesktopStartupDeps, ownerRevision: number, loginFor: (app: string) => boolean): DesktopStartupDiagnostic | undefined {
+function diagnoseSupervisedStartup(deps: DesktopStartupDeps, ownerRevision: number, loginFor: (app: string) => DesktopLoginFacts): DesktopStartupDiagnostic | undefined {
   const evidence = inspectDesktopSupervision(deps);
   if (evidence.kind !== "desktop") return undefined;
-  let loginEnabled = false;
-  try { loginEnabled = loginFor(evidence.app); }
+  let login: DesktopLoginFacts = { loginEnabled: false };
+  try { login = loginFor(evidence.app); }
   catch { /* Login failure revokes restart viability, not the observed live supervisor. */ }
   if ((deps.ownership ?? resolveServiceOwnership)().kind !== "none") return undefined;
   // Login probes can outlive the runtime or its parent; only the same live chain gets credit.
@@ -86,7 +170,7 @@ function diagnoseSupervisedStartup(deps: DesktopStartupDeps, ownerRevision: numb
   const finalOwner = (deps.ownership ?? resolveServiceOwnership)();
   if (finalOwner.kind !== "none" || finalOwner.revision !== ownerRevision) return undefined;
   const { supervisorPid, runtimePid, app } = evidence;
-  return deriveDesktopStartup({ owned: false, loginEnabled, running: true, supervisor: { supervisorPid, runtimePid, app } });
+  return deriveDesktopStartup({ owned: false, ...login, running: true, supervisor: { supervisorPid, runtimePid, app } });
 }
 
 /** Read-only macOS desktop ownership, login registration and live parent/child checks. */
@@ -94,12 +178,9 @@ export function diagnoseMacDesktopStartup(deps: DesktopStartupDeps = {}): Deskto
   if ((deps.platform ?? process.platform) !== "darwin") return undefined;
   const ownership = deps.ownership ?? resolveServiceOwnership;
   const owner = ownership();
-  if (owner.kind === "none") return diagnoseSupervisedStartup(deps, owner.revision, app => {
-    const login = macLoginRegistration(deps);
-    return login !== null && login.app === app && login.loginEnabled;
-  });
+  if (owner.kind === "none") return diagnoseSupervisedStartup(deps, owner.revision, app => macLoginFactsFor(app, deps));
   if (owner.kind !== "owned" || owner.ownership.owner !== "desktop") return undefined;
-  const facts = { owned: true, loginEnabled: false, running: false };
+  const facts: Omit<DesktopStartupDiagnostic, "viable"> = { owned: true, loginEnabled: false, running: false };
   const execute = deps.run ?? run;
   const pidReader = deps.readPid ?? readPid;
   try {
@@ -110,6 +191,7 @@ export function diagnoseMacDesktopStartup(deps: DesktopStartupDeps = {}): Deskto
     if (!login) return deriveDesktopStartup(facts);
     const { app, proxy } = login;
     facts.loginEnabled = login.loginEnabled;
+    if (login.loginRegistration) facts.loginRegistration = login.loginRegistration;
     const pid = pidReader();
     if (pid !== null) {
       const child = processIdentity(pid, execute);
@@ -156,10 +238,10 @@ export function diagnoseLinuxDesktopStartup(deps: DesktopStartupDeps = {}): Desk
     const configured = (deps.env ?? process.env).XDG_CONFIG_HOME;
     const config = configured && isAbsolute(configured) ? configured : join(home, ".config");
     // auto-launch's HOME entry must remain inside the session's XDG autostart search path.
-    if (resolve(config) !== resolve(home, ".config")) return false;
+    if (resolve(config) !== resolve(home, ".config")) return { loginEnabled: false };
     const entry = readFileSync(join(home, ".config", "autostart", "OpenCodex.desktop"), "utf8");
     const login = linuxLoginApp(entry);
-    return login !== null && realpathSync(login) === app;
+    return { loginEnabled: login !== null && realpathSync(login) === app };
   });
   if (owner.kind !== "owned" || owner.ownership.owner !== "desktop") return undefined;
   const facts = { owned: true, loginEnabled: false, running: false };
@@ -212,5 +294,50 @@ export function diagnoseLinuxDesktopStartup(deps: DesktopStartupDeps = {}): Desk
 
 /** Platform dispatch for the full (probing) desktop startup diagnostic. */
 export function diagnoseDesktopStartup(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
-  return (deps.platform ?? process.platform) === "linux" ? diagnoseLinuxDesktopStartup(deps) : diagnoseMacDesktopStartup(deps);
+  const platform = deps.platform ?? process.platform;
+  if (platform === "linux") return diagnoseLinuxDesktopStartup(deps);
+  if (platform === "win32") return diagnoseWindowsDesktopStartup(deps);
+  return diagnoseMacDesktopStartup(deps);
+}
+
+/** Tauri resolves app_config_dir to the roaming AppData folder plus the bundle identifier. */
+function readWindowsInstallId(env: NodeJS.ProcessEnv): string | null {
+  const appData = env.APPDATA;
+  if (!appData || !/^[A-Za-z]:[\\/]/.test(appData)) return null;
+  try {
+    return readFileSync(win32.join(appData, "com.opencodex.desktop", "install-id"), "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read-only Windows desktop ownership and live parent/child checks. Windows Start at Login is
+ * not verified, so it is never credited and Desktop never reads as startup protection here;
+ * the diagnostic still names the supervisor so status and doctor stop recommending service repairs.
+ */
+export function diagnoseWindowsDesktopStartup(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
+  if ((deps.platform ?? process.platform) !== "win32") return undefined;
+  const ownership = deps.ownership ?? resolveServiceOwnership;
+  const owner = ownership();
+  if (owner.kind === "none") return diagnoseSupervisedStartup(deps, owner.revision, () => ({ loginEnabled: false }));
+  if (owner.kind !== "owned" || owner.ownership.owner !== "desktop") return undefined;
+  const facts = { owned: true, loginEnabled: false, running: false };
+  try {
+    const installId = deps.readWindowsInstallId ? deps.readWindowsInstallId() : readWindowsInstallId(deps.env ?? process.env);
+    if (installId !== owner.ownership.installId) return deriveDesktopStartup(facts);
+    const evidence = inspectDesktopSupervision(deps);
+    if (evidence.kind !== "desktop") return deriveDesktopStartup(facts);
+    // Only the same live chain, read again after the claim, earns running and the supervisor.
+    const final = inspectDesktopSupervision({ ...deps, targetPid: evidence.runtimePid });
+    const current = ownership();
+    if (final.kind !== "desktop" || final.runtimePid !== evidence.runtimePid
+      || final.supervisorPid !== evidence.supervisorPid || final.app !== evidence.app
+      || current.kind === "unknown" || !sameServiceOwnershipSubject(owner, current)) return deriveDesktopStartup(facts);
+    const { supervisorPid, runtimePid, app } = final;
+    return deriveDesktopStartup({ ...facts, running: true, supervisor: { supervisorPid, runtimePid, app } });
+  } catch {
+    // Unreadable evidence never grants running or releases the claim.
+    return deriveDesktopStartup(facts);
+  }
 }

package/src/service/desktop-supervision.d.mts

@@ -9,18 +9,44 @@ export interface ProcReader {
   parent(pid: number): number;
 }
 
+/** One Win32_Process row; `created` is UTC ticks as a decimal string (exceeds 2^53). */
+export interface WindowsProcessRow {
+  pid: number;
+  parent: number;
+  exe: string | null;
+  session: number;
+  created: string;
+}
+
+export interface WindowsProcessPair {
+  child: WindowsProcessRow | null;
+  parent: WindowsProcessRow | null;
+}
+
+export interface WindowsProcessReadOptions {
+  /** Called with the parent image before row validation, so partial Desktop evidence keeps its veto. */
+  onExecutable?: (path: string) => void;
+  timeoutMs?: number;
+  env?: NodeJS.ProcessEnv;
+}
+
 export interface DesktopSupervisionDeps {
   targetPid?: number;
   platform?: NodeJS.Platform;
-  run?: (command: string, args: string[]) => string;
+  run?: (command: string, args: string[], timeoutMs?: number) => string;
   proc?: ProcReader;
   readPid?: () => number | null;
   readRuntimePortPid?: () => number | null;
+  windowsProcesses?: (pid: number, options: Pick<WindowsProcessReadOptions, "onExecutable" | "timeoutMs">) => WindowsProcessPair | null;
+  env?: NodeJS.ProcessEnv;
+  now?: () => number;
 }
 
 export function desktopSupervisionPaths(): { pid: string; runtimePort: string };
 export const procfs: ProcReader;
 export function processIdentity(pid: number, execute?: DesktopSupervisionDeps["run"], onExecutable?: (path: string) => void):
   { parent: number; executable: string } | null;
+export function windowsPowerShellPath(env?: NodeJS.ProcessEnv): string;
+export function windowsProcessPair(pid: number, execute?: DesktopSupervisionDeps["run"], options?: WindowsProcessReadOptions): WindowsProcessPair;
 export function inspectDesktopSupervision(deps?: DesktopSupervisionDeps): SupervisionEvidence;
 export function createSupervisionLatch(): { observe(evidence: SupervisionEvidence): boolean };