@bitkyc08/opencodex 2.84.0 → 2.86.0

package/src/cli/claude.ts

@@ -32,7 +32,8 @@ import { DEFAULT_CATALOG_PATH } from "../codex/paths";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 import { aliasForNative, aliasForRoute, legacyAliasForNative, legacyAliasForRoute } from "../claude/alias";
-import { desktop3pAlias } from "../claude/desktop-3p";
+import { desktop3pAlias, isRealDesktop3pModelId, resolveDesktop3pAlias } from "../claude/desktop-3p";
+import { desktopProfileWireAlias, legacyDesktopProfileWireAlias } from "../claude/desktop-profile";
 import { inspectDesktopFirstParty } from "../claude/desktop-first-party";
 import { isClaudeInterceptProxyUrl, type ClaudeInterceptSettingsState } from "../claude/intercept/settings";
 import { withoutSiblingMarker } from "../codex/sibling-start";
@@ -618,11 +619,47 @@ const MODEL_ENV_SLOT_NAMES = [
   "ANTHROPIC_SMALL_FAST_MODEL",
 ] as const;
 
-const DESKTOP_3P_ALIAS = /^claude-opus-4(?:-8)?-[a-z][0-9a-z]{2}$/;
+const DESKTOP_3P_ALIAS = /^claude-(?:opus-4(?:-8)?-[a-z][0-9a-z]{2}|(?:opus-4-8|fable-5)-p[0-9a-z]{3})(?:--fast)?$/;
+
+export function nativeClaudeModelIds(config: OcxConfig): string[] {
+  const assignments = config.claudeCode?.desktopProfile?.assignments ?? {};
+  const routes = Object.keys(assignments);
+  const realProfileIds = new Set(routes.filter(route => route.startsWith("anthropic/claude-"))
+    .map(route => route.slice("anthropic/".length)));
+  // A native CLI starts without the server registry. Persisted profile bindings still
+  // identify proxy selectors, even when an old provider declaration has the same spelling.
+  const proxyProfileIds = new Set(routes.filter(route => !route.startsWith("anthropic/claude-"))
+    .flatMap(route => {
+      const alias = assignments[route]!.alias;
+      const slash = route.indexOf("/");
+      return [alias, desktopProfileWireAlias(alias), legacyDesktopProfileWireAlias(alias),
+        desktop3pAlias(route.slice(0, slash), route.slice(slash + 1))];
+    }));
+  // The configured default is a genuine declaration too: the catalog seeds it for static
+  // providers, so it must be recognized here even without a server registry.
+  const anthropic = config.providers.anthropic;
+  const declaredIds = [
+    ...(anthropic?.defaultModel ? [anthropic.defaultModel] : []),
+    ...(anthropic?.models ?? []), ...(anthropic?.selectedModels ?? []), ...(anthropic?.retainModels ?? []),
+  ];
+  return [...new Set([
+    ...realProfileIds,
+    ...declaredIds
+      .filter(id => {
+        const base = id.endsWith("--fast") ? id.slice(0, -"--fast".length) : id;
+        return id.startsWith("claude-") && (realProfileIds.has(id)
+          || (!proxyProfileIds.has(id) && !proxyProfileIds.has(base)));
+      }),
+  ])];
+}
 
-export function isProxyOnlyModelId(value: string, providerNames: readonly string[] = []): boolean {
+export function isProxyOnlyModelId(value: string, providerNames: readonly string[] = [], realAnthropicIds: readonly string[] = []): boolean {
   const id = value.trim().replace(/\[1m\]$/, "");
   if (!id) return false;
+  if (isRealDesktop3pModelId(id)) return false;
+  const base = id.endsWith("--fast") ? id.slice(0, -"--fast".length) : id;
+  if (resolveDesktop3pAlias(id) || resolveDesktop3pAlias(base)) return true;
+  if (realAnthropicIds.includes(id)) return false;
   const aliasPrefixes = [CLAUDE_ALIAS_PREFIX_CURRENT, CLAUDE_ALIAS_PREFIX_CURRENT_V2, CLAUDE_ALIAS_PREFIX_V1, CLAUDE_ALIAS_PREFIX_V2];
   if (aliasPrefixes.some(prefix => id.startsWith(prefix)) || DESKTOP_3P_ALIAS.test(id)) {
     return true;
@@ -684,9 +721,10 @@ export function buildNativeClaudeEnv(
   // otherwise settings.env can replace the destination while retaining the credential.
   if (hasOwnedAdmission) delete env.CLAUDE_CODE_PROVIDER_MANAGED_BY_HOST;
   const providerNames = Object.keys(config.providers);
+  const realAnthropicIds = nativeClaudeModelIds(config);
   for (const name of MODEL_ENV_SLOT_NAMES) {
     const value = env[name];
-    if (!value || !isProxyOnlyModelId(value, providerNames)) continue;
+    if (!value || !isProxyOnlyModelId(value, providerNames, realAnthropicIds)) continue;
     delete env[name];
     // The label opencodex paired with this slot names a proxy route the native session cannot use.
     const labelName = `${name}_NAME`;
@@ -702,11 +740,12 @@ export function nativeModelOverride(
   configuredModel: string | undefined,
   args: readonly string[],
   providerNames: readonly string[] = [],
+  realAnthropicIds: readonly string[] = [],
 ): { flag?: string[]; warning?: string } {
-  if (!pickedModel || !isProxyOnlyModelId(pickedModel, providerNames)) return {};
+  if (!pickedModel || !isProxyOnlyModelId(pickedModel, providerNames, realAnthropicIds)) return {};
   if (args.some(arg => arg === "--model" || arg.startsWith("--model="))) return {};
   const fallback = configuredModel?.trim();
-  if (fallback && !isProxyOnlyModelId(fallback, providerNames)) {
+  if (fallback && !isProxyOnlyModelId(fallback, providerNames, realAnthropicIds)) {
     return {
       flag: ["--model", fallback],
       warning: `ℹ️ The saved model (${pickedModel}) requires the proxy. This native session will use ${fallback}.`,
@@ -867,6 +906,7 @@ async function launchNativeClaude(config: OcxConfig, args: string[], notice: str
     config.claudeCode?.model,
     args,
     providerNames,
+    nativeClaudeModelIds(config),
   );
   if (override.warning) console.error(override.warning);
   const allowRootSkipPermissions = shouldAllowRootSkipPermissions(args);

package/src/cli/dispatch.ts

@@ -484,7 +484,7 @@ const commandRunners: Record<string, CommandRunner> = {
             },
             config,
             port: live.port,
-          }, ["mcode", "pi", "raycast", "omo", "cline", "commandcode", "droid", "opencode", "kilo"]));
+          }, ["mcode", "pi", "raycast", "omo", "cline", "commandcode", "droid", "opencode", "kilo", "qoder"]));
         } catch (error) {
           console.warn(`Client integrations were not refreshed: ${error instanceof Error ? error.message : String(error)}`);
         }
@@ -834,6 +834,10 @@ const commandRunners: Record<string, CommandRunner> = {
     const { handleComboCommand } = await import("./combo");
     return await handleComboCommand(deps.args.slice(1));
   },
+  advisor: async deps => {
+    const { handleAdvisorCommand } = await import("./advisor");
+    return await handleAdvisorCommand(deps.args.slice(1));
+  },
   companion: async deps => {
     const { handleCompanionCommand } = await import("./companion");
     return await handleCompanionCommand(deps.args.slice(1), { findLiveProxy: deps.findLiveProxy });

package/src/cli/doctor.ts

@@ -1428,6 +1428,15 @@ export async function runDoctor(args: string[] = []): Promise<void> {
     }
   }
 
+  // #2999: which process refreshes the native main login in CODEX_HOME.
+  console.log("\nNative main refresh");
+  {
+    const { loadConfig } = await import("../config");
+    const { formatNativeMainRefreshDoctorLines, resolveNativeMainRefreshMode } = await import("../codex/native-main-refresh-mode");
+    const resolution = await resolveNativeMainRefreshMode(loadConfig());
+    for (const line of formatNativeMainRefreshDoctorLines(resolution)) console.log(line);
+  }
+
   // Mirrors `ocx status` through the same comparison rather than a second implementation:
   // two diagnostics disagreeing about whether an install is stale is worse than one (#2701).
   // No extra probe -- findLiveProxy already carried the version back.

package/src/cli/ensure-desktop-cold-start.ts

@@ -0,0 +1,329 @@
+/**
+ * Cold start for `ocx ensure` when OpenCodex Desktop owns or runs the proxy (#6971).
+ *
+ * The Codex launcher shim runs `ocx ensure` before every Codex launch. Without this policy,
+ * ensure spawned a detached CLI proxy whenever nothing answered on the port. That is wrong in two
+ * Desktop situations: during the Desktop supervisor's restart backoff, and after Desktop quit
+ * while its durable ownership claim remains. In both, the CLI proxy took the port and Desktop came
+ * back as a guest without supervision. That is why the dashboard used to disable the shim under
+ * Desktop.
+ *
+ * Rules, in order:
+ * - A running Desktop app is the supervisor. Wait for its proxy; never start a competing one.
+ * - A durable Desktop claim with no running app: start Desktop (hidden, as a login launch would)
+ *   where that is possible, then wait. Elsewhere, fail with guidance. A missing Desktop process
+ *   never authorizes a CLI proxy by itself; handing ownership to the CLI stays an explicit
+ *   `ocx service install` consent step.
+ * - Ownership or the process list that cannot be read is not evidence of absence: refuse.
+ * - No claim and no running app: the ordinary CLI cold start.
+ *
+ * Concurrent shim launches share one Desktop launch through a lease file held by a live process;
+ * every caller then waits on the same readiness probe.
+ */
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { existsSync, linkSync, readdirSync, readFileSync, readlinkSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join, win32 } from "node:path";
+import { getConfigDir } from "../config/paths";
+import { resolveServiceOwnership } from "../service/state";
+
+export type DesktopProcessState = "running" | "absent" | "unknown";
+export type DesktopOwnershipState = "desktop" | "other" | "unknown";
+
+export type EnsureColdStartPlan =
+  | { kind: "spawn-cli" }
+  | { kind: "wait-desktop" }
+  | { kind: "launch-desktop" }
+  | { kind: "refuse"; reason: "desktop-unlaunchable" | "unverified" };
+
+export function planEnsureColdStart(facts: {
+  ownership: DesktopOwnershipState;
+  desktopProcess: DesktopProcessState;
+  platform: NodeJS.Platform;
+}): EnsureColdStartPlan {
+  if (facts.desktopProcess === "running") return { kind: "wait-desktop" };
+  if (facts.ownership === "unknown" || facts.desktopProcess === "unknown") return { kind: "refuse", reason: "unverified" };
+  if (facts.ownership === "other") return { kind: "spawn-cli" };
+  return facts.platform === "darwin" ? { kind: "launch-desktop" } : { kind: "refuse", reason: "desktop-unlaunchable" };
+}
+
+/** Desktop restart backoff tops out at 30 s; the budget covers it plus a cold sidecar start. */
+export const DESKTOP_COLD_START_TIMEOUT_MS = 40_000;
+
+export type DesktopColdStartResult<T> =
+  | { kind: "cli" }
+  | { kind: "live"; live: T }
+  | { kind: "failed"; message: string };
+
+export interface DesktopColdStartDeps<T> {
+  platform: NodeJS.Platform;
+  ownership: () => DesktopOwnershipState;
+  desktopProcess: () => DesktopProcessState;
+  /** Start the Desktop app hidden. Returns false when the request could not be made. */
+  launchDesktop: () => boolean;
+  /** Returns a release function when this caller should launch, or null when another caller already did. */
+  acquireLaunchLease: () => (() => void) | null;
+  waitForProxy: (timeoutMs: number) => Promise<T | null>;
+  info?: (line: string) => void;
+}
+
+const QUIT_HINT = "To run the proxy from this CLI instead, quit OpenCodex and run `ocx service install` or `ocx start`.";
+
+export async function runDesktopColdStart<T>(deps: DesktopColdStartDeps<T>): Promise<DesktopColdStartResult<T>> {
+  const plan = planEnsureColdStart({
+    ownership: deps.ownership(),
+    desktopProcess: deps.desktopProcess(),
+    platform: deps.platform,
+  });
+  if (plan.kind === "spawn-cli") return { kind: "cli" };
+  if (plan.kind === "refuse") {
+    return { kind: "failed", message: plan.reason === "unverified"
+      ? "Could not verify whether OpenCodex Desktop manages this proxy, so no CLI proxy was started. Run `ocx doctor`, or start the proxy explicitly with `ocx start`."
+      : `OpenCodex Desktop manages this proxy but is not running. Open OpenCodex to start it. ${QUIT_HINT}` };
+  }
+  if (plan.kind === "launch-desktop") {
+    const release = deps.acquireLaunchLease();
+    try {
+      if (release) {
+        deps.info?.("Starting OpenCodex Desktop, which manages this proxy...");
+        if (!deps.launchDesktop()) {
+          return { kind: "failed", message: `OpenCodex Desktop manages this proxy, but it could not be started. Open OpenCodex manually. ${QUIT_HINT}` };
+        }
+      }
+      const live = await deps.waitForProxy(DESKTOP_COLD_START_TIMEOUT_MS);
+      if (live) return { kind: "live", live };
+      return { kind: "failed", message: `OpenCodex Desktop was started, but its proxy did not answer in time. Check the OpenCodex menu. ${QUIT_HINT}` };
+    } finally { release?.(); }
+  }
+  deps.info?.("Waiting for OpenCodex Desktop to restart its proxy...");
+  const live = await deps.waitForProxy(DESKTOP_COLD_START_TIMEOUT_MS);
+  if (live) return { kind: "live", live };
+  return {
+    kind: "failed",
+    message: `OpenCodex Desktop is running but its proxy is not answering. Use Start Proxy in the OpenCodex menu. ${QUIT_HINT}`,
+  };
+}
+
+type Execute = (command: string, args: string[], timeoutMs: number) => string;
+
+function execute(command: string, args: string[], timeoutMs: number): string {
+  return execFileSync(command, args, {
+    encoding: "utf8", timeout: timeoutMs, maxBuffer: 4 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"], windowsHide: true,
+  });
+}
+
+/** A Desktop app executable: `opencodex-desktop`, inside an app bundle's Contents/MacOS on macOS. */
+export function isDesktopExecutable(path: string, platform: NodeJS.Platform): boolean {
+  if (basename(path) !== "opencodex-desktop") return false;
+  return platform !== "darwin" || (basename(dirname(path)) === "MacOS" && basename(dirname(dirname(path))) === "Contents");
+}
+
+export interface DesktopProcessOptions {
+  platform?: NodeJS.Platform;
+  uid?: number;
+  env?: NodeJS.ProcessEnv;
+  run?: Execute;
+  /** Linux: executable paths of this user's processes, or \`unverified\`. */
+  linuxExecutables?: (uid: number) => string[] | "unverified";
+  /** Linux: whether procfs hides processes (hidepid=2/4). */
+  procfsHidesProcesses?: () => boolean;
+  /** Linux: whether this machine shows evidence of an OpenCodex Desktop install. */
+  desktopInstalled?: () => boolean;
+}
+
+/**
+ * Linux: hidepid=2 (invisible) or 4 (ptraceable) can hide a same-uid process whose credentials
+ * differ from the caller's (for example after newgrp), so an empty scan proves nothing there.
+ * An unreadable mount table is treated as filtering.
+ */
+export function procfsHidesProcesses(mountinfo = "/proc/self/mountinfo"): boolean {
+  let text: string;
+  try { text = readFileSync(mountinfo, "utf8"); } catch { return true; }
+  return text.split("\n").some(line => {
+    const [mount, fs] = line.split(" - ");
+    if (mount?.split(" ")[4] !== "/proc" || !fs) return false;
+    const [type, , options = ""] = fs.split(" ");
+    return type === "proc" && options.split(",").some(option => /^hidepid=(2|4|invisible|ptraceable)$/.test(option));
+  });
+}
+
+function linuxDesktopInstalled(): boolean {
+  return existsSync(join(homedir(), ".opencodex-desktop")) || existsSync("/usr/bin/opencodex-desktop");
+}
+
+/** Linux truncates comm to 15 bytes. */
+const LINUX_DESKTOP_COMM = "opencodex-desktop".slice(0, 15);
+
+/**
+ * Linux: executables of this user's processes. A process that exited mid-scan or belongs to someone
+ * else is skipped. A non-dumpable process (ssh-agent, gpg-agent) hides its executable but not its
+ * comm, so it is ruled out by name; one whose comm could be Desktop makes the answer unverifiable.
+ * The scan must also see this process, or procfs is filtered and absence proves nothing.
+ */
+export function scanLinuxExecutables(uid: number, selfPid: number = process.pid, proc = "/proc"): string[] | "unverified" {
+  const paths: string[] = [];
+  let sawSelf = false;
+  const code = (error: unknown) => (error as { code?: unknown } | null)?.code;
+  for (const entry of readdirSync(proc)) {
+    if (!/^\d+$/.test(entry)) continue;
+    if (Number(entry) === selfPid) sawSelf = true;
+    try {
+      if (statSync(`${proc}/${entry}`).uid !== uid) continue;
+      paths.push(readlinkSync(`${proc}/${entry}/exe`).replace(/ \(deleted\)$/, ""));
+    } catch (error) {
+      if (code(error) === "ENOENT" || code(error) === "ESRCH") continue;
+      try {
+        if (readFileSync(`${proc}/${entry}/comm`, "utf8").trim() !== LINUX_DESKTOP_COMM) continue;
+      } catch (commError) {
+        if (code(commError) === "ENOENT" || code(commError) === "ESRCH") continue;
+      }
+      return "unverified";
+    }
+  }
+  return sawSelf ? paths : "unverified";
+}
+
+/** Whether this user runs an OpenCodex Desktop app, judged by executable identity, never arguments. */
+export function inspectDesktopProcess(options: DesktopProcessOptions = {}): DesktopProcessState {
+  const platform = options.platform ?? process.platform;
+  const run = options.run ?? execute;
+  try {
+    const uid = options.uid ?? process.getuid?.();
+    if (platform === "linux") {
+      if (uid === undefined) return "unknown";
+      const executables = (options.linuxExecutables ?? scanLinuxExecutables)(uid);
+      if (executables === "unverified") return "unknown";
+      if (executables.some(path => isDesktopExecutable(path, platform))) return "running";
+      // A filtered procfs cannot prove absence where Desktop may be installed. Without an install
+      // there is nothing to hide, so hardened hosts keep the plain CLI cold start.
+      return (options.procfsHidesProcesses ?? procfsHidesProcesses)() && (options.desktopInstalled ?? linuxDesktopInstalled)()
+        ? "unknown" : "absent";
+    }
+    if (platform === "darwin") {
+      if (uid === undefined) return "unknown";
+      // macOS reports the full executable path as comm.
+      const output = run("/bin/ps", ["-U", String(uid), "-o", "comm="], 3_000);
+      return output.split("\n").some(line => isDesktopExecutable(line.trim(), platform)) ? "running" : "absent";
+    }
+    if (platform === "win32") {
+      const env = options.env ?? process.env;
+      const root = env.SystemRoot ?? env.windir ?? "C:\\Windows";
+      const user = env.USERNAME?.trim();
+      const args = ["/FI", "IMAGENAME eq opencodex-desktop.exe", ...(user ? ["/FI", `USERNAME eq ${user}`] : []), "/FO", "CSV", "/NH"];
+      const output = run(win32.join(root, "System32", "tasklist.exe"), args, 3_000);
+      return /^"opencodex-desktop\.exe",/im.test(output) ? "running" : "absent";
+    }
+    return "absent";
+  } catch {
+    return "unknown";
+  }
+}
+
+/** Start the macOS app hidden, the same way its login item does. */
+export function launchDesktopApp(options: { platform?: NodeJS.Platform; run?: Execute } = {}): boolean {
+  if ((options.platform ?? process.platform) !== "darwin") return false;
+  try {
+    (options.run ?? execute)("/usr/bin/open", ["-g", "-b", "com.opencodex.desktop", "--args", "--autostart"], 10_000);
+    return true;
+  } catch { return false; }
+}
+
+function processAlive(pid: number): boolean {
+  try { process.kill(pid, 0); return true; }
+  catch (error) { return (error as NodeJS.ErrnoException | null)?.code === "EPERM"; }
+}
+
+function readHolder(path: string): number | null {
+  const pid = Number(readFileSync(path, "utf8").trim());
+  return Number.isSafeInteger(pid) && pid > 0 ? pid : null;
+}
+
+const LEASE_FILE = /^desktop-launch\.(\d+)\.lease$/;
+
+/**
+ * One Desktop launch per cold start. Leases are numbered generations, each published whole with
+ * link(2), which fails if the name exists, so exactly one contender can create generation N+1. A
+ * caller launches only after creating the next generation while the newest one belongs to a dead
+ * process (or none exists). A lease stays valid while its holder lives, so a slow launch never
+ * expires under its owner. Nothing ever moves or overwrites another holder's lease.
+ */
+export function acquireDesktopLaunchLease(
+  configDir: string,
+  io: { pid?: number; alive?: (pid: number) => boolean } = {},
+): (() => void) | null {
+  const pid = io.pid ?? process.pid;
+  const alive = io.alive ?? processAlive;
+  const leasePath = (generation: number) => join(configDir, `desktop-launch.${generation}.lease`);
+  for (let attempt = 0; attempt < 4; attempt++) {
+    let generations: number[];
+    try {
+      generations = readdirSync(configDir).flatMap(name => {
+        const match = LEASE_FILE.exec(name);
+        return match ? [Number(match[1])] : [];
+      }).sort((a, b) => b - a);
+    } catch {
+      // An unreadable lease directory must not suppress the launch; it only loses deduplication.
+      return () => {};
+    }
+    const newest = generations[0];
+    if (newest !== undefined) {
+      try {
+        const holder = readHolder(leasePath(newest));
+        if (holder !== null && alive(holder)) return null;
+      } catch (error) {
+        if ((error as { code?: unknown })?.code === "ENOENT") continue;
+        return null;
+      }
+    }
+    const next = (newest ?? 0) + 1;
+    const staged = join(configDir, `desktop-launch.${randomUUID()}.tmp`);
+    try {
+      writeFileSync(staged, String(pid), { flag: "wx", mode: 0o600 });
+      linkSync(staged, leasePath(next));
+    } catch (error) {
+      if ((error as { code?: unknown })?.code === "EEXIST") continue;
+      return () => {};
+    } finally {
+      try { unlinkSync(staged); } catch { /* not created */ }
+    }
+    const withdraw = () => {
+      try { if (readHolder(leasePath(next)) === pid) unlinkSync(leasePath(next)); } catch { /* already gone */ }
+    };
+    // A contender with a stale directory read can publish a generation a winner already cleaned
+    // up. The highest generation is the one launcher; anyone below it stands down.
+    try {
+      if (readdirSync(configDir).some(name => Number(LEASE_FILE.exec(name)?.[1] ?? 0) > next)) {
+        withdraw();
+        return null;
+      }
+    } catch { /* keep the lease: the directory was readable a moment ago */ }
+    // Older generations belong to dead holders: the newest was checked before publishing above it.
+    for (const generation of generations) {
+      try { unlinkSync(leasePath(generation)); } catch { /* already gone */ }
+    }
+    // The newest generation is never deleted on release: removing it would let numbering restart
+    // below a stale contender. It stops counting once this process exits.
+    return () => {};
+  }
+  return null;
+}
+
+/** Production wiring; `waitForProxy` is ensure's identity-checked readiness probe. */
+export function productionDesktopColdStartDeps<T>(waitForProxy: (timeoutMs: number) => Promise<T | null>): DesktopColdStartDeps<T> {
+  return {
+    platform: process.platform,
+    ownership: () => {
+      try {
+        const owner = resolveServiceOwnership();
+        if (owner.kind === "unknown") return "unknown";
+        return owner.kind === "owned" && owner.ownership.owner === "desktop" ? "desktop" : "other";
+      } catch { return "unknown"; }
+    },
+    desktopProcess: () => inspectDesktopProcess(),
+    launchDesktop: () => launchDesktopApp(),
+    acquireLaunchLease: () => acquireDesktopLaunchLease(getConfigDir()),
+    waitForProxy,
+    info: line => console.log(line),
+  };
+}

package/src/cli/export-command.ts

@@ -169,7 +169,7 @@ export async function handleExportCommand(argv: string[], deps: ExportCommandDep
     const spec = EXPORT_CLIENTS[client];
     const root = await runtimeBaseUrl(deps);
     let built: { document: unknown; text: string };
-    if (client === "raycast" || client === "droid") {
+    if (client === "raycast" || client === "droid" || client === "qoder") {
       // The dial address alone cannot distinguish a wildcard authenticated bind
       // from loopback. Let the live server resolve its admission/listener policy;
       // saved config can differ from the process serving this request.

package/src/cli/help.ts

@@ -92,11 +92,12 @@ Usage:
   ocx api-key <sub>           Alias of ocx access key
   ocx access <sub>            External API keys and endpoint information
   ocx api <sub>               Protocol paths: vocabulary, request-path preview, and policy
-  ocx export --client <id>    Print a client config wired to the running proxy (18 clients)
+  ocx export --client <id>    Print a client config wired to the running proxy (19 clients)
   ocx integration client <sub> Enable, disable, inspect or roll back a client integration
   ocx grok <sub>              Grok Build model selection and apply
   ocx system <sub>            Runtime settings, startup, sync, OpenCodex updates, and Codex CLI inspection
   ocx config [sub]            Validated configuration show/get/set/import/export
+  ocx advisor <status|on|off|set|consent>  Advisor sidecar settings and context-sharing consent
   ocx companion <show|set|reset>  Menu-bar and widget companion usage settings
   ocx lab <sub>               Inspect Lab evidence and control local automation
   ocx chatgpt <sub>          Experimental app-server shim: launch|restore|status (macOS)

package/src/cli/index.ts

@@ -16,7 +16,6 @@ import { UpdateRestartRequired } from "./update-restart-candidate";
 import { describeUpdateRestartFailure, restartFromCurrentInstallation } from "./update-restart";
 import { findGuiDist } from "../server/gui-static";
 import { inspectGuiBundleFreshness, staleGuiBundleLines } from "../server/gui-freshness";
-
 // Best-effort recovery for runtime execution and spawned children if launched
 // from an unlinked/deleted working directory (runs after hoisted ESM module imports).
 try {
@@ -156,9 +155,9 @@ import {
   reconcileEnsureDesiredIntegrations,
 } from "./ensure-desired-integrations";
 import { ENSURE_READY_TIMEOUT_MS, ensureKeepWaiting, waitForLiveProxy } from "./ensure-readiness";
+import { productionDesktopColdStartDeps, runDesktopColdStart } from "./ensure-desktop-cold-start";
 import { refreshOwnedCatalogIntegrations } from "../integrations/catalog-refresh";
 import { loadExportModels } from "../server/management/model-rows";
-
 import { removeOwnedConfigAfterDesktopCleanup } from "./uninstall-client-state";
 import { withProcessRuntimeProvenance } from "../lib/bun-runtime";
 import { startArgv } from "../lib/self-launch-argv";
@@ -169,6 +168,7 @@ import { recoverStartStateUnderOwnershipLease } from "./start-owner-fence";
 import { handledSignalExitCode } from "../lib/handled-signal-exit";
 import { createLocalAttestationSecret } from "../lib/local-management-attestation";
 import { MEMORY_DRAIN_RESTART_MS, REPLACEMENT_READY_TIMEOUT_MS } from "../lib/system-restart-contract";
+import { startServiceLogging } from "../service/logging";
 
 /**
  * A failed shell-hook reconcile is not cosmetic: a stale hook keeps sourcing
@@ -208,6 +208,7 @@ async function refreshOwnedRaycastCatalog(
   }
 }
 
+if (process.argv[2] === "start" && process.env.OCX_SERVICE) startServiceLogging(join(getConfigDir(), "service.log"));
 const updateRestartChild = admitUpdateRestartChild(process.argv.slice(2));
 initializeNodeLauncherContext();
 // The compiled executable is also the capture-only MCP server's launcher.
@@ -282,6 +283,7 @@ async function chooseListenPort(
       `Port ${preferred} is reserved for unauthenticatedLoopbackListener; choose a different proxy port.`,
     );
   }
+  await (await import("./auxiliary-listener-preflight")).assertAuxiliaryListenerPortsAvailable(config);
   // Soft start: brief prefer-retry then ephemeral hop.
   // Explicit `--port` (service wrappers / update restart): wait for the pinned port
   // to free without killing any listener (healthy ocx / foreign). Never hop.
@@ -816,9 +818,16 @@ async function handleEnsure(options: { existingIsSuccess?: boolean; forceStart?:
     console.log("Codex autostart is disabled.");
     return false;
   }
-  const live = owner.live;
+  let live = owner.live;
+  if (!live) {
+    // OpenCodex Desktop owns or runs this proxy: wait for it or start it, never a competing CLI proxy (#6971).
+    const desktopStart = await runDesktopColdStart(productionDesktopColdStartDeps(timeoutMs => waitForProxy(timeoutMs)));
+    if (desktopStart.kind === "failed") { console.error(`❌ ${desktopStart.message}`); process.exitCode = 1; return false; }
+    // Also for restart: the proxy was absent and Desktop started it, so the live tail below applies.
+    if (desktopStart.kind === "live") live = desktopStart.live;
+  }
   if (live) {
-    if (options.existingIsSuccess === false) {
+    if (options.existingIsSuccess === false && live === owner.live) {
       console.error("Proxy appeared while restart was confirming absence; no start was attempted.");
       return false;
     }

package/src/cli/integration-plan-dto.ts

@@ -26,6 +26,7 @@ export const FILE_INTEGRATION_CLIENTS = [
   "commandcode",
   "kilo",
   "droid",
+  "qoder",
 ] as const;
 
 export const INTEGRATION_REFUSAL_REASONS: ReadonlySet<string> = new Set<IntegrationRefusalReason>([
@@ -65,6 +66,7 @@ const PLAN_SCHEMA_PATHS = new Set([
   "settings.providers.opencodex",
   "catalog.providers.opencodex",
   "customModels.*",
+  "modelConfigs.customModels.*",
   // ZCode reads its providers from a second file; a plan for it publishes that
   // file's templates, and a path missing here is rejected as an invalid preview.
   "config.providerConfigRules.providerRules.[providerId=opencodex]",

package/src/cli/registry.ts

@@ -378,6 +378,18 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
     usage: "ocx model <subcommand>",
     summary: "Alias of ocx models.",
   },
+  {
+    name: "advisor",
+    usage: "ocx advisor <status|on|off|consent|set> ...",
+    summary: "Inspect and configure the advisor sidecar (expert consultation for routed workers).",
+    details: [
+      "ocx advisor and ocx advisor status read the resolved settings; use --json for machine-readable output.",
+      "ocx advisor on requires current context-sharing consent. Pass --ack-context-sharing to record consent v1 and enable. ocx advisor off disables the sidecar without granting consent.",
+      "ocx advisor consent records consent v1 after printing the disclosure. ocx advisor consent --revoke removes it and stops task-context transfer.",
+      "ocx advisor set updates --model, --effort, --policy and --timeout-ms; the model may be any routable model string (bare native, provider/model, or account-qualified). set does not grant consent.",
+      "policy manual consults only when the worker calls the synthetic advisor tool; policy preflight also attempts one automatic consultation per task with a stable conversation identity, once the task shows orientation evidence. Without a stable identity, each eligible request may trigger another consultation. Both require current consent before any task context is sent.",
+    ],
+  },
   {
     name: "companion",
     usage: "ocx companion <show|set|reset|usage|timeline> ...",
@@ -469,13 +481,13 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
       "protocols [--provider <name>]   Contract version, API surfaces, protocol settings and feature vocabulary.",
       "explain --model <id> --inbound <responses|chat|messages> [--feature <key>]...   Preview the request path; sends nothing upstream.",
       "policy                          Read the protocol policy; with --messages, --unrepresentable or --rollout <switch>=<on|off> it changes config.",
-      "Every rollout switch defaults off. `ocx api policy` writes only when a setting flag is given.",
+      "Every rollout switch defaults off except antigravityDirect. `ocx api policy` writes only when a setting flag is given.",
     ],
   },
   {
     name: "export",
-    usage: "ocx export --client <opencode|pi|omp|hermes|openclaw|kimi|gajae|dsh|mcode|zcode|commandcode|prime|aside|raycast|omo|cline|kilo|droid> [--json] [--out <path>] [--force]",
-    summary: "Print a client config (OpenCode, Pi, OMP, Hermes, OpenClaw, Kimi Code, gjc, DeepSeek Harness, MiniMax Code, ZCode, Command Code, Prime Agent, Aside, Raycast, omo, Cline, Kilo, Factory Droid) wired to the running proxy.",
+    usage: "ocx export --client <qoder|opencode|pi|omp|hermes|openclaw|kimi|gajae|dsh|mcode|zcode|commandcode|prime|aside|raycast|omo|cline|kilo|droid> [--json] [--out <path>] [--force]",
+    summary: "Print a client config (OpenCode, Pi, OMP, Hermes, OpenClaw, Kimi Code, gjc, DeepSeek Harness, MiniMax Code, ZCode, Command Code, Prime Agent, Aside, Raycast, omo, Cline, Kilo, Factory Droid, Qoder) wired to the running proxy.",
     details: [
       "--json prints the generated document as JSON on stdout; use --out for the client's native format.",
       "--out <path> writes the native config there and refuses to replace an existing file without --force.",

package/src/cli/restart-scope.ts

@@ -173,6 +173,9 @@ export async function handleDesktopAppRestart(
         + "Quit and relaunch the desktop app manually to refresh the model picker.",
       );
       return result;
+    case "relaunch_context_failed":
+      log.error("Codex desktop launch options could not be preserved safely, so the app was not stopped. Review its current launch options before retrying.");
+      return result;
     case "no_targets":
       log.log("Codex desktop app is not running; nothing to restart.");
       return result;
@@ -189,4 +192,3 @@ export async function handleDesktopAppRestart(
       return result;
   }
 }
-

package/src/clients/config-export/contracts.ts

@@ -202,6 +202,7 @@ export interface ExportContext {
 export type DroidReasoningDefaults = Record<string, string>;
 
 export type ExportClientId =
+  | "qoder"
   | "opencode"
   | "pi"
   | "omp"

package/src/clients/config-export/model-metadata.ts

@@ -9,8 +9,9 @@ import { shouldInjectApiAuthHeader } from "../../codex/inject";
 
 
 /**
- * Authoritative context window, or undefined. Never guesses: a missing, non-finite, or
- * non-positive value means the serializer omits every context-derived field.
+ * Validate the supplied catalog window (which may be a labelled vendor estimate).
+ * A missing, non-finite, or non-positive value omits every context-derived field;
+ * this serializer does not independently infer a window.
  */
 export function authoritativeContextWindow(contextWindow: number | undefined): number | undefined {
   if (typeof contextWindow === "number" && Number.isFinite(contextWindow) && contextWindow > 0) {