@bitkyc08/opencodex 2.84.0 → 2.86.0

package/README.md

@@ -154,10 +154,6 @@ See [SPONSORS.md](./SPONSORS.md).
 <td>Thanks to <a href="https://www.orcarouter.ai/?utm_source=opencodex&utm_medium=readme">OrcaRouter</a> for sponsoring this project! OrcaRouter is one OpenAI-compatible AI gateway for production AI: adaptive routing that grades every prompt and sends it to the model that clears your bar, automatic failover, routing rules as code, zero-markup provider pricing with prompt caching, and guardrails, an agent firewall, and request logs on every call across 200+ models. Pick <code>OrcaRouter</code> in the Add provider picker or run <code>ocx provider add orcarouter</code>; <code>orcarouter/auto</code> is the adaptive router.</td>
 </tr>
 <tr>
-<td width="180"><a href="https://www.packyapi.com/register?aff=k5KT"><img src="assets/sponsors/packycode.png" alt="PackyCode" width="150"></a></td>
-<td>Thanks to <a href="https://www.packyapi.com/register?aff=k5KT">PackyCode</a> for sponsoring this project! PackyCode is a stable, high-performance API relay provider, offering relay services for Claude Code, Codex, Gemini, and more. With automatic failover, smart routing, and unlimited concurrency, it turns AI into a real productivity tool. <a href="https://www.packyapi.com/register?aff=k5KT">Register via this link</a> and get started! Pick <code>PackyCode</code> in the Add provider picker or run <code>ocx provider add packycode</code>.<br><sub>PackyCode 是一家稳定、高效的 API 中转服务商，提供 Claude Code、Codex、Gemini 等多种中转服务。具备自动故障转移、智能路由和无限并发等多种功能，让 AI 编程成为真正的生产力工具。<a href="https://www.packyapi.com/register?aff=k5KT">点此链接注册</a>，立即开始使用！</sub></td>
-</tr>
-<tr>
 <td width="180"><a href="https://tokenlab.sh/r/OPENCODEX"><picture><source media="(prefers-color-scheme: dark)" srcset="assets/sponsors/tokenlab-dark.png"><img src="assets/sponsors/tokenlab-light.png" alt="TokenLab" width="150"></picture></a></td>
 <td>Thanks to <a href="https://tokenlab.sh/r/OPENCODEX">TokenLab</a> for sponsoring this project! TokenLab gives coding agents one API key for leading models, supporting OpenAI Responses and Chat Completions, Anthropic Messages, and Gemini's native API formats, with streaming and tool calling. It also provides an MCP server and agent Skills for easy integration. Choose your delivery mode and pay as you go. Pick <code>TokenLab</code> in the Add provider picker or run <code>ocx provider add tokenlab</code>.<br><sub>TokenLab 为编程智能体提供统一的多模型 API，一枚 API Key 即可接入主流模型，支持 OpenAI Responses、Chat Completions、Anthropic Messages 和 Gemini 原生 API 格式，以及流式输出和工具调用。同时提供 MCP 服务器和 Agent Skills，方便接入现有工作流；交付模式可选，按量付费。</sub></td>
 </tr>

package/bin/ocx.mjs

@@ -61,6 +61,10 @@ import {
   CODEX_CLI_VERSION_MANAGER_ROOT_ENV_SLOTS,
   isCodexCliUpdateInspectionArgv,
 } from "../src/update/codex-cli-update-launch-policy.mjs";
+import {
+  freshServingPid, hasRestartableServiceManager, readParentPid, readServiceManagerPid, restartServiceManagerJob,
+  supervisionVerdict, unsettledManagerWarning, unsupervisedRuntimeWarning,
+} from "../src/update/supervised-recovery.mjs";
 
 const PKG = "@bitkyc08/opencodex";
 const UPDATE_RECOVERY_READY_MS = 30_000;
@@ -470,6 +474,7 @@ function runPackageManagerSelfUpdate(manager) {
     ? ownershipMutationLeaseChildEnvironment(process.env, delegatedOwnershipMutationToken)
     : unprivilegedOwnershipMutationEnvironment(process.env);
 
+  /** Returns true, false, or "vetoed" when another owner holds the runtime (not a failure). */
   function startProxyDirectly() {
     const supervision = observeSupervision();
     const plan = planUpdateRuntimeHandling({ ...readOwnership(), serviceInstalled: false, supervision });
@@ -477,7 +482,7 @@ function runPackageManagerSelfUpdate(manager) {
       console.warn(supervision
         ? "OpenCodex Desktop supervises the proxy; no CLI runtime was restored."
         : plan.notice);
-      return false;
+      return "vetoed";
     }
     if (!postUpdateLauncherUsable || !existsSync(postUpdateLauncher)) {
       console.error("opencodex: cannot restart the proxy because the launcher is missing; reinstall opencodex manually.");
@@ -510,6 +515,50 @@ function runPackageManagerSelfUpdate(manager) {
     return false;
   }
 
+  // #7043: before any detached start, ask launchd/systemd to restart the job it already holds,
+  // and count it only when the serving proxy is that job (or its launcher's child). Returns
+  // "supervised", "failed", or "unsettled" when the manager may still finish the restart.
+  function restartThroughServiceManager() {
+    if (!hasRestartableServiceManager()) return "failed";
+    console.log("opencodex: asking the service manager to restart the background service.");
+    const before = readCurrentRuntimeTarget();
+    const staleRecordPid = before.kind === "target" ? before.target.pid : null;
+    const restarted = restartServiceManagerJob();
+    const unsettled = !restarted.ok && restarted.unsettled === true;
+    let verdict;
+    if (!restarted.ok && !unsettled) {
+      verdict = { kind: "failed", reason: restarted.reason };
+    } else {
+      let servingPid = null;
+      const deadline = Date.now() + UPDATE_RECOVERY_READY_MS;
+      while (servingPid === null && Date.now() < deadline) {
+        const current = readCurrentRuntimeTarget();
+        if (current.kind === "target" && current.target.port === bakePort
+          && freshServingPid(current.target.pid, staleRecordPid) !== null
+          && probeProxyLiveness(current.target.port, current.target.hostname ?? bakeHostname) === "live") {
+          servingPid = current.target.pid;
+        } else {
+          Atomics.wait(UPDATE_RECOVERY_SLEEP, 0, 0, UPDATE_RECOVERY_POLL_MS);
+        }
+      }
+      verdict = supervisionVerdict({ servingPid, managerPid: readServiceManagerPid(), parentPid: pid => readParentPid(pid) });
+    }
+    if (verdict.kind === "supervised") {
+      console.log(`opencodex: the proxy is healthy on port ${bakePort} under the service manager (pid ${verdict.managerPid}).`);
+      return "supervised";
+    }
+    if (unsettled) {
+      console.warn(unsettledManagerWarning(bakePort));
+      return "unsettled";
+    }
+    console.warn(`opencodex: the service manager did not recover a supervised proxy: ${verdict.reason}.`);
+    return "failed";
+  }
+
+  /**
+   * Returns "unsupervised" when only a detached fallback was attempted, or "unsettled" when the
+   * manager may still finish its restart; callers exit non-zero for both.
+   */
   function refreshBackgroundServiceOrStartDirect() {
     const mayRefresh = () => {
       const supervision = observeSupervision();
@@ -576,6 +625,10 @@ function runPackageManagerSelfUpdate(manager) {
             : nowOwned.notice ?? "opencodex: the background runtime is owned elsewhere; not starting a second proxy.");
           return;
         }
+        // #7043: the manager first. Only a proxy it owns counts as recovered.
+        const managed = restartThroughServiceManager();
+        if (managed === "supervised") return;
+        if (managed === "unsettled") return "unsettled";
         // Repair normally avoids elevation for a healthy registration, but a stale Windows
         // scheduler definition can require it. It can also fail — or exit 0 while leaving
         // a non-viable manager. Fall back to a direct detached proxy start so the
@@ -586,7 +639,11 @@ function runPackageManagerSelfUpdate(manager) {
             : "opencodex: service refresh failed — starting the proxy directly instead.",
         );
         console.warn("  Run 'ocx service repair' to see why the background service could not restart.");
-        startProxyDirectly();
+        const started = startProxyDirectly();
+        // An ownership veto is the correct outcome, not a degraded one.
+        if (started === "vetoed") return;
+        if (started) console.warn(unsupervisedRuntimeWarning(bakePort));
+        return "unsupervised";
       }
     } finally {
       if (prevBake === undefined) delete process.env.OCX_BAKE_PORT;
@@ -895,7 +952,8 @@ function runPackageManagerSelfUpdate(manager) {
     // launcher so the new files write the baked paths and the service restarts.
     if (postInstallPlan.mayRestoreService) {
       console.log("Refreshing the background service with the updated files...");
-      refreshBackgroundServiceOrStartDirect();
+      const refreshed = refreshBackgroundServiceOrStartDirect();
+      if (refreshed === "unsupervised" || refreshed === "unsettled") process.exit(1);
     } else if (postInstallPlan.mayStopRuntime) {
       console.log(`Restart the proxy:  ${launcherStartHint(postUpdateLauncher, bakePort)}`);
     }