@bitkyc08/opencodex 2.84.0 → 2.86.0

package/src/codex/catalog/parsing.ts

@@ -1,3 +1,4 @@
+import type { VendorContextInference } from "./vendor-context";
 import { isCodexControlPlaneModel } from "../control-plane-models";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
@@ -120,6 +121,8 @@ export interface CatalogModel {
   suppressSyntheticMax?: boolean;
   defaultReasoningEffort?: string;
   contextWindow?: number;
+  /** Bundled fallback only; never a serving-provider capability assertion. */
+  contextWindowInference?: VendorContextInference;
   maxInputTokens?: number;
   /** Model-scoped output-token ceiling; omitted when no authoritative value is known. */
   maxOutputTokens?: number;
@@ -139,6 +142,8 @@ export interface CatalogModel {
   supportsVerbosity?: boolean;
   /** Whether this exact routed model has a verified OpenAI-compatible service tier. */
   supportsServiceTier?: boolean;
+  /** Captured eligible service-tier wire explicitly maps ultrafast to ultrafast. */
+  supportsUltraFastTier?: boolean;
   /** Optional provider-specific copy for the advertised Fast tier. */
   fastTierDescription?: string;
   supportsReasoningSummaries?: boolean;

package/src/codex/catalog/provider-models.ts

@@ -53,6 +53,7 @@ import {
 import type { FastPolicyAuthority } from "../../providers/fastwire";
 import { effectiveGoogleMode, getProviderRegistryEntry, providerMatchesRegistryTransport, registryEntryForProviderDestination } from "../../providers/registry";
 import { parseAntigravityAvailableModels, registerAntigravityDiscoveredWireModels } from "../../providers/antigravity-models";
+import { recordAntigravityAccountRoster } from "../../providers/antigravity-account-roster";
 import { applyProviderContextCap, providerContextCap, resolveUnknownRoutedContextWindow } from "../../providers/context-cap";
 import { clampAutoCompactTokenLimit } from "../../providers/auto-compact-budget";
 import { effectiveModelAliases } from "../../providers/default-aliases";
@@ -807,6 +808,9 @@ export async function fetchProviderModelsWithAuth(
         provider: name,
         cacheGeneration,
       });
+      // Entitlement is per account (Claude 4.6 vs 5.5, Argon): remember what THIS account
+      // lists so account selection can prefer one that serves the requested model.
+      if (auth.oauthAccountId) recordAntigravityAccountRoster(name, auth.oauthAccountId, antigravity);
       if (!setCached(name, forCache, Date.now(), cacheGeneration)) {
         return observed(withConfiguredRetention(configured), "degraded");
       }

package/src/codex/catalog/retained-sync.ts

@@ -1,4 +1,5 @@
 import { projectAntigravitySelectedModels } from "../../providers/antigravity-effort-families";
+import { configuredUltraFastSlugs } from "./configured-tiers";
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 import { initializeConfigOwnership } from "../../lib/config-ownership";
@@ -509,6 +510,7 @@ function writeRetainedCatalogSync({
     : [];
   catalog.models = mergeCatalogEntriesFromObservedState({
     ultraFastTier: ultraFastTierEnabled(config),
+    configuredUltraFastSlugs: configuredUltraFastSlugs(orderedGoModels),
     modelPickerOrder,
     accountSelectors,
     catalogModels: catalogModelsForMerge,

package/src/codex/catalog/routed-gather.ts

@@ -1,5 +1,7 @@
+import { canInferVendorContext } from "./vendor-context";
 import { effectiveProviderAlias, effectiveProviderAliasDecision } from "../../providers/default-aliases";
 import { initialModelSelectionPending } from "../../providers/initial-model-selection";
+import { supportsConfiguredUltraFast } from "./configured-tiers";
 import { execFileSync } from "node:child_process";
 import { createHash, createHmac, randomBytes } from "node:crypto";
 import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync } from "node:fs";
@@ -318,6 +320,7 @@ function boundCustomNativeReasoning(
   return bounded;
 }
 
+/** Gather discovered and custom rows under one captured provider policy, including speed capabilities. */
 async function gatherRoutedModelsUncached(
   config: OcxConfig,
   capture: GatherFlightCapture,
@@ -358,6 +361,7 @@ async function gatherRoutedModelsUncached(
       const policy = fastPolicyForModel(apiProvider.provider, model.id, apiProvider.name);
       const supported = serviceTierSupportFromPolicy(policy);
       if (supported !== undefined) model.supportsServiceTier = supported;
+      model.supportsUltraFastTier = supportsConfiguredUltraFast(policy);
       if (supported === true && policy.fastTierDescription !== undefined) model.fastTierDescription = policy.fastTierDescription;
     }
   }
@@ -467,7 +471,7 @@ async function gatherRoutedModelsUncached(
       ...inherited,
       catalogKind: CODEX_CUSTOM_MODEL_CATALOG_KIND,
       ...(typeof custom.contextWindow === "number" && custom.contextWindow > 0
-        ? { contextWindow: custom.contextWindow }
+        ? { contextWindow: custom.contextWindow, contextWindowInference: undefined }
         : {}),
       ...(Array.isArray(custom.inputModalities)
         ? { inputModalities: [...custom.inputModalities] }
@@ -654,6 +658,7 @@ async function gatherRoutedModelsUncached(
       ...(Array.isArray(cm.reasoningEfforts) ? { reasoningEfforts: [...cm.reasoningEfforts] } : {}),
       ...(cm.defaultReasoningEffort ? { defaultReasoningEffort: cm.defaultReasoningEffort } : {}),
       ...(typeof supportsServiceTier === "boolean" ? { supportsServiceTier } : {}),
+      supportsUltraFastTier: supportsConfiguredUltraFast(fastPolicy),
       ...(supportsServiceTier === true && fastPolicy?.fastTierDescription !== undefined
         ? { fastTierDescription: fastPolicy.fastTierDescription }
         : {}),
@@ -686,7 +691,8 @@ async function gatherRoutedModelsUncached(
       : undefined;
     const merged: CatalogModel = replaced ? {
       ...base,
-      ...(base.contextWindow === undefined && replaced.contextWindow !== undefined ? { contextWindow: replaced.contextWindow } : {}),
+      ...(base.contextWindow === undefined && replaced.contextWindow !== undefined
+        ? { contextWindow: replaced.contextWindow, ...(replaced.contextWindowInference ? { contextWindowInference: replaced.contextWindowInference, contextCap: replaced.contextCap, contextCapped: replaced.contextCapped } : {}) } : {}),
       ...(mergedMaxInput !== undefined ? { maxInputTokens: mergedMaxInput } : {}),
       ...(mergedMaxOutput !== undefined ? { maxOutputTokens: mergedMaxOutput } : {}),
       ...(base.autoCompactTokenLimit === undefined && replaced.autoCompactTokenLimit !== undefined
@@ -703,17 +709,29 @@ async function gatherRoutedModelsUncached(
       ...(base.codexToolMode === undefined && replaced.codexToolMode !== undefined ? { codexToolMode: replaced.codexToolMode } : {}),
       ...(base.capabilities === undefined && replaced.capabilities !== undefined ? { capabilities: replaced.capabilities } : {}),
     } : base;
+    // A custom-only model may never appear in /models or the provider's configured roster.
+    // Fill only its absent context; a full hint overlay would overwrite custom capabilities.
+    const customContextHints = merged.contextWindow === undefined && effectiveProvider && canInferVendorContext(cm.provider, effectiveProvider)
+      ? applyProviderConfigHints(cm.provider, effectiveProvider, { provider: cm.provider, id: cm.modelId },
+        providerContextCap(config, cm.provider), metadataModelIdCaseFoldByProvider.get(cm.provider),
+        undefined, metadataConfigDirByProvider.get(cm.provider))
+      : undefined;
+    const contextResolved: CatalogModel = customContextHints?.contextWindow !== undefined
+      ? { ...merged, contextWindow: customContextHints.contextWindow,
+        ...(customContextHints.contextWindowInference ? { contextWindowInference: customContextHints.contextWindowInference } : {}),
+        ...(customContextHints.contextCap !== undefined ? { contextCap: customContextHints.contextCap, contextCapped: customContextHints.contextCapped } : {}) }
+      : merged;
     // Catalog-advertised efforts are bounded whenever the model id is a pinned native
     // slug. Desktop validates that id, so a gateway such as YYLJ/gpt-6-astra still cannot
     // advertise none/minimal. Full native identity stays behind the alias predicate.
     const nativeEffortSource = hasNativeOpenAiCapabilityMetadata(cm.modelId);
     const reasoningBounded = nativeEffortSource
       ? boundCustomNativeReasoning(
-        merged,
+        contextResolved,
         nativeReasoningEfforts(cm.modelId),
         nativeAliasDefaultEffort ?? nativeDefaultReasoningEffort(cm.modelId),
       )
-      : merged;
+      : contextResolved;
     // Vision-sidecar coverage only: when the enriched provider's shared predicate matches
     // noVisionModels or text-without-image modelInputModalities, advertise image input so the
     // Codex app lets images reach the sidecar (#349/#344). Deliberately NOT the full

package/src/codex/catalog/vendor-context.ts

@@ -0,0 +1,82 @@
+import { listModelMetadata, resolveMetadataProvider, type ModelMetadata } from "../../generated/model-metadata";
+import { PROVIDER_REGISTRY } from "../../providers/registry";
+import type { OcxProviderConfig } from "../../types";
+
+/** A bundled model-window estimate, not evidence of the serving gateway's capacity. */
+export interface VendorContextInference {
+  source: "vendor" | "aggregator";
+  provider: string;
+  modelId: string;
+  contextWindow: number;
+}
+
+// Capacity and price have different authorities: hosting vendors (Cerebras/Bedrock), Azure
+// and the Codex subscription table must not replace the original vendor's API window.
+const VENDORS = ["anthropic", "openai", "google", "moonshot", "minimax", "deepseek", "xai", "zai", "mistral", "xiaomi"];
+const AGGREGATORS = ["openrouter", "opencode-go"];
+// Snapshot names once, never consult the mutable registry after gather flight admission.
+const BUILTIN_NAMES = new Set(PROVIDER_REGISTRY.map(entry => entry.id.toLowerCase()));
+/**
+ * Opt-in only (#1073): an id-only custom row keeps the conservative fallback unless the
+ * operator sets `inferContextWindow: true`. Built-in names stay excluded even when set.
+ */
+export function canInferVendorContext(provider: string, config: Pick<OcxProviderConfig, "inferContextWindow"> | undefined): boolean {
+  return config?.inferContextWindow === true
+    && !BUILTIN_NAMES.has(provider.toLowerCase()) && !resolveMetadataProvider(provider);
+}
+
+const normalize = (id: string): string => id.toLowerCase().replaceAll(".", "-");
+type Candidate = VendorContextInference | null;
+
+/** Build a pure lookup; conflicting windows within one authority tier fail closed. */
+export function createVendorContextLookup(
+  vendors: readonly ModelMetadata[],
+  aggregators: readonly ModelMetadata[],
+): (id: string) => VendorContextInference | undefined {
+  const build = (rows: readonly ModelMetadata[], source: VendorContextInference["source"]) => {
+    const exact = new Map<string, Candidate>();
+    const normalized = new Map<string, Candidate>();
+    const add = (map: Map<string, Candidate>, id: string, value: VendorContextInference) => {
+      if (!map.has(id)) map.set(id, value);
+      else if (map.get(id)?.contextWindow !== value.contextWindow) map.set(id, null);
+    };
+    for (const row of rows) {
+      const window = row.contextWindow;
+      if (!Number.isSafeInteger(window) || window! <= 0 || row.id.startsWith("~")) continue;
+      const value: VendorContextInference = { source, provider: row.provider, modelId: row.id, contextWindow: window! };
+      const ids = source === "aggregator" ? [row.id, row.id.slice(row.id.lastIndexOf("/") + 1)] : [row.id];
+      for (const id of ids) {
+        if (!id) continue;
+        add(exact, id, value);
+        add(normalized, normalize(id), value);
+      }
+    }
+    return { exact, normalized };
+  };
+  const tiers = [build(vendors, "vendor"), build(aggregators, "aggregator")];
+  return rawId => {
+    const id = rawId.trim();
+    if (!id || id.startsWith("~")) return undefined;
+    for (const tier of tiers) {
+      // An exact spelling wins over its normalized alias. A conflicting key does not
+      // fall through to a lower-authority source and accidentally regain a larger window.
+      const map = tier.exact.has(id) ? tier.exact : tier.normalized;
+      const key = map === tier.exact ? id : normalize(id);
+      if (map.has(key)) {
+        const value = map.get(key);
+        return value ? { ...value } : undefined;
+      }
+    }
+    return undefined;
+  };
+}
+
+let lookup: ReturnType<typeof createVendorContextLookup> | undefined;
+export function vendorContextInference(modelId: string): VendorContextInference | undefined {
+  lookup ??= createVendorContextLookup(VENDORS.flatMap(listModelMetadata), AGGREGATORS.flatMap(listModelMetadata));
+  return lookup(modelId);
+}
+
+export function vendorContextWindow(modelId: string): number | undefined {
+  return vendorContextInference(modelId)?.contextWindow;
+}

package/src/codex/config-write-lock.ts

@@ -166,15 +166,21 @@ function canonicalFileIdentity(canonical: string): string | null {
 /** Capture before the first write; nested native children share the same recovery scope. */
 export function withConfigWriteRecovery<T>(
   configPath: string, held: LockHandle, run: () => T,
-  options: { refreshBeforeSpawn?: boolean; preimage?: Buffer } = {},
+  options: { refreshBeforeSpawn?: boolean; preimage?: Buffer; requireMatchingPreimage?: boolean } = {},
 ): T {
-  if (recoveries.has(held)) return run();
+  const nested = recoveries.get(held);
+  if (nested && !options.requireMatchingPreimage) return run();
   let canonical: string;
   try { canonical = assertConfigWriteDestination(configPath, held); }
   catch { throw new ConfigWriteDestinationChanged(); }
   const identity = canonicalFileIdentity(canonical);
   const preimage = identity === null ? null : readFileSync(canonical);
   if (canonicalFileIdentity(canonical) !== identity) throw new ConfigWriteDestinationChanged();
+  if (options.requireMatchingPreimage && (!options.preimage || !preimage?.equals(options.preimage))) {
+    throw new ConfigWriteDestinationChanged();
+  }
+  if (nested && (nested.canonical !== canonical || nested.identity !== identity)) throw new ConfigWriteDestinationChanged();
+  if (nested) return run();
   const recovery: ConfigWriteRecovery = {
     canonical, identity, preimage: options.preimage ?? preimage,
     refreshBeforeSpawn: options.refreshBeforeSpawn === true && options.preimage === undefined,
@@ -317,6 +323,38 @@ export function publishConfigWriteTarget<T>(
   });
 }
 
+export function removeConfigWriteEntry(configPath: string, held: LockHandle, path: string): void {
+  assertConfigWriteDestination(configPath, held);
+  watchConfigWriteTargets(held, [path]);
+  const watched = targets.get(held)!;
+  const expected = watched.get(path)!;
+  const current = destination(path);
+  if (expected.canonical !== current.canonical || expected.inode !== current.inode
+    || current.canonical !== join(realpathSync.native(dirname(resolve(path))), basename(resolve(path)))) {
+    throw new Error("Codex artifact destination changed; files and recovery evidence were preserved.");
+  }
+  if (expected.inode === null) return;
+
+  const entry = join(realpathSync.native(dirname(resolve(path))), basename(resolve(path)));
+  const identity = (file: { dev: bigint; ino: bigint }) => `${file.dev}:${file.ino}`;
+  const before = lstatSync(entry, { bigint: true });
+  if (before.isSymbolicLink() || !before.isFile() || identity(before) !== expected.inode) {
+    throw new Error("Codex artifact destination changed; files and recovery evidence were preserved.");
+  }
+  assertConfigWriteDestination(configPath, held);
+  const now = lstatSync(entry, { bigint: true });
+  if (now.isSymbolicLink() || !now.isFile() || identity(now) !== expected.inode) {
+    throw new Error("Codex artifact destination changed; files and recovery evidence were preserved.");
+  }
+  unlinkSync(entry);
+  assertConfigWriteDestination(configPath, held);
+  const after = destination(path);
+  if (after.inode !== null || after.canonical !== expected.canonical) {
+    throw new Error("Codex artifact destination changed; recovery evidence was preserved.");
+  }
+  watched.set(path, after);
+}
+
 export function configWriteLockFailureMessage(failure: Exclude<ConfigWriteAcquireResult, { ok: true }>): string {
   if (failure.error === "missing-parent") return `Codex configuration parent is missing or unresolved at ${failure.detail}; no files were changed.`;
   return failure.error === "unsafe"

package/src/codex/convergence.ts

@@ -1,4 +1,5 @@
 import { projectAntigravitySelectedModels } from "../providers/antigravity-effort-families";
+import { configuredUltraFastSlugs } from "./catalog/configured-tiers";
 import { join } from "node:path";
 import { sameCatalogHealPath } from "./catalog/heal-observation";
 
@@ -371,6 +372,7 @@ function prepareCatalog(
   );
   const mergedModels = mergeCatalogEntriesFromObservedState({
     ultraFastTier: ultraFastTierEnabled(config),
+    configuredUltraFastSlugs: configuredUltraFastSlugs(ordered),
     modelPickerOrder,
     accountSelectors,
     catalogModels,

package/src/codex/desktop-app/types.ts

@@ -51,6 +51,8 @@ export interface DesktopProcess {
   createdAt: string;
   /** Absolute executable path, used for membership and the shell predicate. */
   executable: string;
+  /** Windows-only private launch context; never included in restart results or logs. */
+  commandLine?: string;
 }
 
 export interface DesktopAppAdapter {

package/src/codex/desktop-app/windows.ts

@@ -13,6 +13,7 @@
 import { execFileSync } from "node:child_process";
 import { sep, win32 } from "node:path";
 import { resolveTrustedWindowsPowerShellExe, resolveTrustedWindowsTaskkillExe } from "../../lib/windows-elevation";
+import { activateWindowsCodexCompatibility, assertWindowsCompatibilityContext, captureWindowsCompatibilityContext } from "../desktop-compatibility/windows-package-command";
 import {
   isUnderRoot,
   type DesktopAppAdapter,
@@ -50,8 +51,7 @@ function isMemberExecutable(executable: string, root: string): boolean {
  * changes between builds, so a literal AUMID would silently stop matching and
  * then either do nothing or — worse — match a package we did not mean.
  */
-function discoverPackage(exec: DesktopExec): DesktopAppInstall | null {
-  const script = [
+export const WINDOWS_PACKAGE_DISCOVERY_SCRIPT = [
     "$ErrorActionPreference='SilentlyContinue'",
     "Import-Module Appx -ErrorAction SilentlyContinue",
     "$p = Get-AppxPackage -Name OpenAI.Codex",
@@ -60,12 +60,8 @@ function discoverPackage(exec: DesktopExec): DesktopAppInstall | null {
     "  $p.PackageFamilyName; $p.InstallLocation; \"$($p.PackageFamilyName)!App\"",
     "}",
   ].join("; ");
-  let stdout: string;
-  try {
-    stdout = exec(resolveTrustedWindowsPowerShellExe(), ["-NoProfile", "-NonInteractive", "-Command", script], POWERSHELL_PROBE_OPTIONS);
-  } catch {
-    return null;
-  }
+
+export function parseWindowsDesktopPackage(stdout: string): DesktopAppInstall | null {
   const lines = stdout.split(/\r?\n/).map(line => line.trim()).filter(line => line.length > 0);
   if (lines.length < 3 || lines[0] === "MISS") return null;
   const [family, installLocation, aumid] = lines;
@@ -73,6 +69,16 @@ function discoverPackage(exec: DesktopExec): DesktopAppInstall | null {
   return { id: family, root: installLocation, relaunch: aumid };
 }
 
+function discoverPackage(exec: DesktopExec): DesktopAppInstall | null {
+  let stdout: string;
+  try {
+    stdout = exec(resolveTrustedWindowsPowerShellExe(), ["-NoProfile", "-NonInteractive", "-Command", WINDOWS_PACKAGE_DISCOVERY_SCRIPT], POWERSHELL_PROBE_OPTIONS);
+  } catch {
+    return null;
+  }
+  return parseWindowsDesktopPackage(stdout);
+}
+
 /**
  * Only `ChatGPT.exe` processes whose image lives under the discovered install
  * location AND owned by the current user. The install location alone is not
@@ -100,7 +106,8 @@ function listPackageProcesses(exec: DesktopExec, install: DesktopAppInstall): De
     "    if ($o -and $o.ReturnValue -eq 0 -and $o.User) {",
     "      $owner = if ($o.Domain) { \"$($o.Domain)\\$($o.User)\" } else { $o.User }",
     "      if ($owner -ieq $me) {",
-    "        \"$($_.ProcessId) $($_.ParentProcessId) $($_.CreationDate.ToString('o')) $($_.ExecutablePath)\"",
+    "        $encoded=[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes([string]$_.CommandLine))",
+    "        \"$($_.ProcessId) $($_.ParentProcessId) $($_.CreationDate.ToString('o')) $($_.ExecutablePath)`t$encoded\"",
     "      }",
     "    }",
     "  }",
@@ -126,7 +133,9 @@ function listPackageProcesses(exec: DesktopExec, install: DesktopAppInstall): De
 }
 
 function parseProcessLine(line: string, root: string): DesktopProcess | null {
-  const match = /^\s*(\d+)\s+(\d+)\s+(\S+)(?:\s+(.+))?$/.exec(line);
+  const [listing, encoded, ...extra] = line.split("\t");
+  if (extra.length || (encoded && (encoded.length > 65_536 || !/^[A-Za-z0-9+/]+={0,2}$/.test(encoded)))) return null;
+  const match = /^\s*(\d+)\s+(\d+)\s+(\S+)(?:\s+(.+))?$/.exec(listing ?? "");
   if (!match) return null;
   const pid = Number(match[1]);
   const parentPid = Number(match[2]);
@@ -143,7 +152,8 @@ function parseProcessLine(line: string, root: string): DesktopProcess | null {
   // Authoritative membership. PowerShell StartsWith already cheap-filtered, but
   // that test is a string prefix and is how a sibling install would sneak in.
   if (!isMemberExecutable(executable, root)) return null;
-  return { pid, parentPid, createdAt, executable };
+  return { pid, parentPid, createdAt, executable,
+    ...(encoded !== undefined ? { commandLine: Buffer.from(encoded, "base64").toString("utf8") } : {}) };
 }
 
 /**
@@ -215,13 +225,16 @@ export const windowsDesktopAppAdapter: DesktopAppAdapter = {
     exec(resolveTrustedWindowsTaskkillExe(), ["/PID", String(root.pid), "/T", "/F"], POWERSHELL_PROBE_OPTIONS);
   },
 
-  captureRelaunchContext(): Record<string, string> {
-    // The session is supplied by the shell:AppsFolder launch, so nothing needs
-    // carrying forward.
-    return {};
+  captureRelaunchContext(_exec, _install, processes): Record<string, string> {
+    return captureWindowsCompatibilityContext(processes);
   },
 
-  relaunch(exec, install): void {
+  relaunch(exec, install, context): void {
+    if (context.codexCompatibilityPacUrl) {
+      assertWindowsCompatibilityContext(context);
+      activateWindowsCodexCompatibility(exec, install, context.codexCompatibilityPacUrl);
+      return;
+    }
     // Throws on failure so the ladder reports relaunch_failed. The old code
     // returned targets_survived here, which was dishonest: everything HAD died
     // and it was the relaunch that failed.

package/src/codex/desktop-app-restart.ts

@@ -89,6 +89,7 @@ export type DesktopAppRestartReason =
   | "self_ancestry"
   | "restart_in_flight"
   | "handoff_started"
+  | "relaunch_context_failed"
   | "targets_survived"
   | "relaunch_failed";
 
@@ -263,7 +264,9 @@ export function restartCodexDesktopApp(io: DesktopAppRestartIo = {}): DesktopApp
     // graphical session variables, and after termination there is nothing to read them
     // from. Ordering this wrongly works on macOS and Windows and produces a Linux app
     // that cannot reach the compositor.
-    const context = adapter.captureRelaunchContext(exec, install, processes);
+    let context: Record<string, string>;
+    try { context = adapter.captureRelaunchContext(exec, install, processes); }
+    catch { return skipped("relaunch_context_failed"); }
 
     const isAlive = io.isAlive ?? defaultIsAlive;
     const sleep = io.sleep ?? defaultSleep;
@@ -345,4 +348,3 @@ export function restartCodexDesktopApp(io: DesktopAppRestartIo = {}): DesktopApp
     if (!handedOff) releaseDesktopRestartLock(io.lock);
   }
 }
-

package/src/codex/desktop-compatibility/certificate-service.ts

@@ -0,0 +1,99 @@
+import { join } from "node:path";
+import { getConfigDir } from "../../config/paths";
+import { windowsDefaultExec, windowsDesktopAppAdapter } from "../desktop-app/windows";
+import { ensureDesktopCompatibilityAuthority, inspectDesktopCompatibilityAuthority, loadDesktopCompatibilityAuthority, renewDesktopCompatibilityAuthority, type DesktopAuthorityInspection, type StoredDesktopAuthority } from "./certificate-store";
+import { createWindowsCertificateTrust, inspectWindowsCertificateTrust, type DesktopCertificateTrust } from "./windows-certificate-trust";
+import { acquireDesktopCertificateMutation, desktopCompatibilityRuntimeActive } from "./runtime-ownership";
+
+export interface DesktopCertificateStatus {
+  supported: boolean;
+  state: "missing" | "invalid" | "expired" | "renewal-required" | "prepared" | "trusted" | "unknown";
+  fingerprint?: string;
+  expiresAt?: number;
+  renewalDue?: boolean;
+  trust?: DesktopCertificateTrust;
+  busy: "prepare" | "trust" | "remove-trust" | "renew" | null;
+}
+
+export interface DesktopCertificateServiceIo {
+  platform?: string;
+  inspect?: () => DesktopAuthorityInspection;
+  prepare?: () => Promise<StoredDesktopAuthority>;
+  load?: (allowExpiredForRemoval: boolean) => Promise<StoredDesktopAuthority>;
+  renew?: (fingerprint: string) => Promise<StoredDesktopAuthority>;
+  readTrust?: (authority: Extract<DesktopAuthorityInspection, { fingerprint: string }>) => Promise<DesktopCertificateTrust>;
+  changeTrust?: (authority: StoredDesktopAuthority, action: "trust" | "remove") => Promise<DesktopCertificateTrust>;
+  appRunning?: () => Promise<boolean | null>;
+}
+
+export class DesktopCertificateServiceError extends Error {
+  constructor(readonly code: "unsupported" | "busy" | "not_prepared" | "fingerprint_changed" | "app_running" | "runtime_running" | "app_state_unknown" | "trust_unknown" | "trust_not_applied") {
+    super(`desktop_compatibility_${code}`); this.name = "DesktopCertificateServiceError";
+  }
+}
+
+/** This service owns setup only: no proxy listeners, app restart, account or quota writes. */
+export function createDesktopCertificateService(directory = join(getConfigDir(), "codex-desktop-compatibility"), io: DesktopCertificateServiceIo = {}) {
+  const platform = io.platform ?? process.platform;
+  const inspect = io.inspect ?? (() => inspectDesktopCompatibilityAuthority(directory));
+  const prepare = io.prepare ?? (() => ensureDesktopCompatibilityAuthority({ directory }));
+  const load = io.load ?? (allowExpired => loadDesktopCompatibilityAuthority({ directory }, allowExpired));
+  const renew = io.renew ?? (fingerprint => renewDesktopCompatibilityAuthority({ directory }, fingerprint));
+  const readTrust = io.readTrust ?? (value => inspectWindowsCertificateTrust(value.certPem, value.fingerprint));
+  const changeTrust = io.changeTrust ?? ((authority, action) => createWindowsCertificateTrust(authority, authority.fingerprint)[action]());
+  const appRunning = io.appRunning ?? (async () => {
+    const install = windowsDesktopAppAdapter.discover(windowsDefaultExec);
+    if (!install) return null; // Unknown installation is not proof that no app uses the authority.
+    const processes = windowsDesktopAppAdapter.listProcesses(windowsDefaultExec, install);
+    return processes === null ? null : processes.length > 0;
+  });
+  let busy: DesktopCertificateStatus["busy"] = null;
+  async function status(): Promise<DesktopCertificateStatus> {
+    if (platform !== "win32") return { supported: false, state: "missing", busy };
+    const stored = inspect();
+    if (!("fingerprint" in stored)) return { supported: true, state: stored.status, busy };
+    const trusted = await readTrust(stored).catch(() => "unknown" as const);
+    return { supported: true, state: stored.status === "expired" ? "expired"
+      : stored.status === "renewal-required" ? "renewal-required"
+      : trusted === "trusted" ? "trusted" : trusted === "not-trusted" ? "prepared" : "unknown",
+      fingerprint: stored.fingerprint, expiresAt: stored.expiresAt, renewalDue: stored.renewalDue, trust: trusted, busy };
+  }
+  async function action(kind: NonNullable<DesktopCertificateStatus["busy"]>, expectedFingerprint?: string): Promise<DesktopCertificateStatus> {
+    if (platform !== "win32") throw new DesktopCertificateServiceError("unsupported");
+    if (busy !== null) throw new DesktopCertificateServiceError("busy");
+    if (desktopCompatibilityRuntimeActive()) throw new DesktopCertificateServiceError("runtime_running");
+    let release: () => void;
+    try { release = acquireDesktopCertificateMutation(); } catch { throw new DesktopCertificateServiceError("busy"); }
+    busy = kind;
+    try {
+      if (kind !== "prepare") {
+        const before = inspect();
+        if (!("fingerprint" in before)) throw new DesktopCertificateServiceError("not_prepared");
+        if (before.fingerprint !== expectedFingerprint) throw new DesktopCertificateServiceError("fingerprint_changed");
+        if (kind === "remove-trust" || kind === "renew") {
+          const running = await appRunning();
+          if (running === null) throw new DesktopCertificateServiceError("app_state_unknown");
+          if (running) throw new DesktopCertificateServiceError("app_running");
+        }
+      }
+      const authority = kind === "prepare" ? await prepare() : await load(kind !== "trust");
+      if (kind !== "prepare") {
+        if (authority.fingerprint !== expectedFingerprint) throw new DesktopCertificateServiceError("fingerprint_changed");
+        const current = inspect();
+        if (!("fingerprint" in current) || current.fingerprint !== authority.fingerprint) throw new DesktopCertificateServiceError("fingerprint_changed");
+        const result = await changeTrust(authority, kind === "trust" ? "trust" : "remove");
+        if (result === "unknown") throw new DesktopCertificateServiceError("trust_unknown");
+        if (result !== (kind === "trust" ? "trusted" : "not-trusted")) throw new DesktopCertificateServiceError("trust_not_applied");
+        // Never discard the only removable old identity until OS trust removal is proven.
+        // Publication failure leaves its protected envelope intact for an explicit retry.
+        if (kind === "renew") await renew(authority.fingerprint);
+      }
+      busy = null;
+      return status();
+    } finally { busy = null; release(); }
+  }
+  return { status, prepare: () => action("prepare"), trust: (fingerprint: string) => action("trust", fingerprint),
+    removeTrust: (fingerprint: string) => action("remove-trust", fingerprint), renew: (fingerprint: string) => action("renew", fingerprint) };
+}
+
+export type DesktopCertificateService = ReturnType<typeof createDesktopCertificateService>;