@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/codex/desktop-compatibility/usage-activation.ts

@@ -0,0 +1,86 @@
+/** Account-bound, time-limited compatibility activation; no persistent settings or timers. */
+export type Observation = 'exhausted' | 'available' | 'protected';
+export type ApplyScope = 'selected-external-model' | 'account-ui-compatibility';
+type RefreshResult = {requested:number;closed:number;failed:number};
+export class UsageActivation {
+  private mode: 'observe' | 'apply' = 'observe';
+  private phase = 'observing';
+  private generation = 0;
+  private latest: { kind:Observation; at:number } | null = null;
+  private startedAt: number | null = null;
+  private outputs = 0;
+  constructor(private binding:string, private refresh:(binding:string)=>Promise<RefreshResult>,
+    private verifyIdentity:()=>Promise<string|null>,
+    private clock:()=>number=Date.now, private timeoutMs=180000) {
+    if(!binding || !Number.isSafeInteger(timeoutMs) || timeoutMs<1 || timeoutMs>180000) throw new Error('Invalid activation limits');
+  }
+  snapshot() { return {mode:this.mode,phase:this.phase,generation:this.generation,outputs:this.outputs,
+    appCacheConfirmed:false,requestedUiScope:'account-wide',providerIsolationAvailable:false}; }
+  invalidateIdentity() {
+    this.mode='observe';this.phase='identity-invalidated';this.startedAt=null;this.latest=null;this.outputs=0;++this.generation;
+  }
+  observe(binding:string,kind:Observation) {
+    if(binding!==this.binding)return false;
+    this.latest={kind,at:this.clock()};
+    // A recovered or protected account must not silently re-enter a previous trial
+    // if a later snapshot becomes exhausted again. A new trial requires consent.
+    if(this.mode==='apply'&&kind!=='exhausted'){
+      this.mode='observe';this.phase=kind==='available'?'usage-recovered':'protected-observation';
+      this.startedAt=null;this.outputs=0;++this.generation;
+    }
+    return true;
+  }
+  private async reset(phase:string) {
+    this.mode='observe';this.phase=phase;this.startedAt=null;this.latest=null;this.outputs=0;++this.generation;
+    return this.refresh(this.binding);
+  }
+  async activate(options:{scope:ApplyScope;accountWideConsent:boolean}) {
+    if(options.scope!=='account-ui-compatibility')return{accepted:false,reason:'selected-model-scope-unavailable',...this.snapshot()};
+    if(!options.accountWideConsent)return{accepted:false,reason:'account-wide-scope-not-accepted',...this.snapshot()};
+    const beforeVerification=this.generation,binding=this.binding;
+    let verified:string|null;
+    try{verified=await this.verifyIdentity();}catch{verified=null;}
+    if(verified!==binding||this.binding!==binding||this.generation!==beforeVerification)return{accepted:false,reason:'identity-not-verified',...this.snapshot()};
+    if(this.mode==='apply')return{accepted:false,reason:'activation-already-pending',...this.snapshot()};
+    const age=this.latest?this.clock()-this.latest.at:Infinity;
+    if(!this.latest||this.latest.kind!=='exhausted'||age<0||age>300000)return{accepted:false,reason:'no-fresh-eligible-exhaustion',...this.snapshot()};
+    // An exhausted observation authorizes one trial, not every retry within its TTL.
+    this.latest=null;
+    this.mode='apply';this.phase='awaiting-fresh-usage';this.startedAt=this.clock();this.outputs=0;
+    const generation=++this.generation;
+    let refreshed:RefreshResult;
+    try { refreshed=await this.refresh(this.binding); }
+    catch {
+      if(this.generation===generation){this.mode='observe';this.phase='refresh-failed';this.startedAt=null;this.latest=null;this.outputs=0;++this.generation;}
+      return{accepted:false,reason:'refresh-failed',...this.snapshot()};
+    }
+    // Account/mode changes while a close callback awaited invalidate this activation.
+    if(this.generation!==generation)return{accepted:false,reason:'superseded',...this.snapshot()};
+    // The registry settles every close and reports failures; it does not reject the batch.
+    // Partial closure cannot leave rewriting enabled while an old app cache may survive.
+    if(!Number.isSafeInteger(refreshed.requested)||!Number.isSafeInteger(refreshed.closed)
+      ||!Number.isSafeInteger(refreshed.failed)||refreshed.requested<0||refreshed.closed<0
+      ||refreshed.failed!==0||refreshed.closed!==refreshed.requested){
+      this.mode='observe';this.phase='refresh-failed';this.startedAt=null;this.latest=null;this.outputs=0;++this.generation;
+      return{accepted:false,reason:'refresh-failed',refresh:refreshed,...this.snapshot()};
+    }
+    return{accepted:true,reason:'awaiting-new-response',refresh:refreshed,...this.snapshot()};
+  }
+  recordOutput(binding:string,generation:number) {
+    if(binding!==this.binding||generation!==this.generation||this.mode!=='apply')return false;
+    if(this.startedAt===null||this.clock()-this.startedAt<0||this.clock()-this.startedAt>=this.timeoutMs)return false;
+    ++this.outputs;this.phase='response-produced-app-confirmation-needed';return true;
+  }
+  async expireIfNeeded() {
+    if(this.startedAt===null||this.clock()-this.startedAt<this.timeoutMs&&this.clock()-this.startedAt>=0)return false;
+    await this.reset('expired-awaiting-original-response');return true;
+  }
+  async observeOnly() { return this.reset('observing-awaiting-original-response'); }
+  async changeBinding(binding:string) {
+    if(!binding)throw new Error('Verified account binding is required');
+    const previous=this.binding;
+    this.mode='observe';this.phase='account-changed';this.startedAt=null;this.latest=null;this.outputs=0;++this.generation;
+    this.binding=binding;
+    return this.refresh(previous);
+  }
+}

package/src/codex/desktop-compatibility/usage-controlled-fetch.ts

@@ -0,0 +1,59 @@
+import { UsageRelayController } from './usage-controller';
+import { controlledUsageSse } from './usage-sse-controller';
+import { boundedJsonBody } from './json-body';
+
+/** Inject as the listener's fetchImpl. Existing auth forwarding/TLS/WS code stays unchanged. */
+export function createUsageControlledFetch(controller: UsageRelayController, upstreamFetch: typeof fetch = fetch): typeof fetch {
+  return (async (input: Parameters<typeof fetch>[0], init?: Parameters<typeof fetch>[1]) => {
+    const upstream = await upstreamFetch(input, init);
+    const pathname = new URL(input instanceof Request ? input.url : String(input)).pathname;
+    const method = init?.method ?? (input instanceof Request ? input.method : 'GET');
+    const exchange = { pathname, method, status: upstream.status };
+    if (method !== 'GET' || upstream.status !== 200 || !upstream.body
+      || !['/backend-api/wham/usage', '/backend-api/wham/usage/stream'].includes(pathname)) return upstream;
+    const contentType = upstream.headers.get('content-type') ?? '';
+    const headers = new Headers(upstream.headers);
+    const output = (body: BodyInit, transformed = false) => {
+      headers.delete('content-length'); headers.delete('content-encoding');
+      if (transformed) {
+        for (const name of ['etag', 'last-modified', 'digest', 'content-md5']) headers.delete(name);
+        headers.set('cache-control', 'no-store');
+      }
+      return new Response(body, { status: upstream.status, statusText: upstream.statusText, headers });
+    };
+    if (contentType.includes('application/json') || contentType.endsWith('+json')) {
+      const body = await boundedJsonBody(upstream.body);
+      if ('stream' in body) return output(body.stream);
+      let text: string;
+      try { text = new TextDecoder('utf-8', { fatal: true }).decode(body.bytes); }
+      catch { return output(new Uint8Array(body.bytes)); }
+      const changed = await controller.rewriteJson(text, exchange);
+      return output(changed ?? new Uint8Array(body.bytes), changed !== null);
+    }
+    if (!contentType.includes('text/event-stream') || pathname !== '/backend-api/wham/usage/stream') return upstream;
+    let registration: ReturnType<UsageRelayController['registerStream']> = null;
+    const reader = upstream.body.pipeThrough(controlledUsageSse(text => controller.rewriteJson(text, exchange, registration))).getReader();
+    let ended = false, sink: ReadableStreamDefaultController<Uint8Array>;
+    const close = async () => {
+      if (ended) return;
+      ended = true; registration?.release();
+      const cancelled = reader.cancel();
+      try { sink.close(); } catch { /* caller already cancelled */ }
+      await cancelled;
+    };
+    const body = new ReadableStream<Uint8Array>({
+      start(value) { sink = value; },
+      async pull(value) {
+        try {
+          const next = await reader.read();
+          if (ended) return;
+          if (next.done) { ended = true; registration?.release(); value.close(); }
+          else value.enqueue(next.value);
+        } catch (error) { if (!ended) { ended = true; registration?.release(); value.error(error); } }
+      },
+      cancel: close,
+    });
+    registration = controller.registerStream(exchange, close);
+    return output(body, true);
+  }) as typeof fetch;
+}

package/src/codex/desktop-compatibility/usage-controller.ts

@@ -0,0 +1,107 @@
+import { UsageActivation, type ApplyScope } from './usage-activation';
+import { UsageRefreshRegistry } from './usage-refresh';
+import { evaluateUsageRewrite, type UsageRewriteContext } from './usage-policy';
+
+export type UsageIdentity = NonNullable<UsageRewriteContext['account']> & { credentialGeneration?: string };
+type Registration = NonNullable<ReturnType<UsageRefreshRegistry['register']>>;
+type Exchange = { method: string; pathname: string; status: number };
+const same = (a: UsageIdentity | null, b: UsageIdentity) => a !== null
+  && a.id === b.id && a.userId === b.userId && a.plan === b.plan && a.structure === b.structure
+  && a.credentialGeneration === b.credentialGeneration;
+const object = (value: unknown): value is Record<string, unknown> => value !== null
+  && typeof value === 'object' && !Array.isArray(value);
+
+/** Response-level controller. Construction never starts a listener, timer or trust operation. */
+export class UsageRelayController {
+  private readonly account: UsageIdentity;
+  private readonly key: string;
+  private readonly refresh = new UsageRefreshRegistry();
+  private readonly activation: UsageActivation;
+  private jsonSnapshots = 0;
+  private streamSnapshots = 0;
+  private lastSnapshotAt: number | null = null;
+  constructor(account: UsageIdentity, private readonly readCurrentIdentity: () => Promise<UsageIdentity | null>,
+    verifyFreshIdentity: () => Promise<UsageIdentity | null>, private readonly clock: () => number,
+    private readonly expiresAt: number, timeoutMs = 180000, private readonly contextValid: () => boolean | Promise<boolean> = () => true) {
+    if (!account.id || !account.userId || !['plus', 'pro'].includes(account.plan)
+      || account.structure !== 'personal' || !Number.isFinite(expiresAt) || expiresAt <= clock()) {
+      throw new Error('A verified supported identity and finite safety deadline are required');
+    }
+    this.account = { ...account };
+    this.key = JSON.stringify([account.id, account.userId, account.plan, account.credentialGeneration ?? null]);
+    this.activation = new UsageActivation(this.key, key => this.refresh.refresh(key), async () => {
+      return same(await verifyFreshIdentity(), this.account) ? this.key : null;
+    }, clock, timeoutMs);
+  }
+  snapshot() { return { ...this.activation.snapshot(), trackedStreams: this.refresh.size, expired: this.clock() >= this.expiresAt,
+    observation: { jsonSnapshots: this.jsonSnapshots, streamSnapshots: this.streamSnapshots,
+      validatedActiveStreams: this.refresh.boundSize, lastSnapshotAt: this.lastSnapshotAt,
+      sourceProcessVerified: false as const, composerRecoveryVerified: false as const } }; }
+  private async checkContext() { try { return await this.contextValid(); } catch { return false; } }
+  async activate(options: { scope: ApplyScope; accountWideConsent: boolean }) {
+    const generation = this.activation.snapshot().generation, valid = await this.checkContext();
+    if (generation !== this.activation.snapshot().generation) return { accepted: false, reason: 'superseded', ...this.snapshot() };
+    if (!valid) { this.activation.invalidateIdentity(); return { accepted: false, reason: 'native-context-changed', ...this.snapshot() }; }
+    if (this.clock() >= this.expiresAt) { this.activation.invalidateIdentity(); return { accepted: false, reason: 'safety-deadline', ...this.snapshot() }; }
+    return this.activation.activate(options);
+  }
+  observeOnly() { return this.activation.observeOnly(); }
+  expireIfNeeded() { return this.activation.expireIfNeeded(); }
+  registerStream(exchange: Exchange, close: () => Promise<void>): Registration | null {
+    if (exchange.status !== 200) return null;
+    return this.refresh.register(exchange.method, exchange.pathname, close);
+  }
+  /** Only a complete original usage record may establish the stream's account binding. */
+  async rewriteJson(text: string, exchange: Exchange, stream?: Registration | null): Promise<string | null> {
+    if (exchange.method !== 'GET' || exchange.status !== 200
+      || !['/backend-api/wham/usage', '/backend-api/wham/usage/stream'].includes(exchange.pathname)) return null;
+    if (this.clock() >= this.expiresAt) { this.activation.invalidateIdentity(); stream?.exclude(); return null; }
+    const observedGeneration = this.activation.snapshot().generation;
+    let current: UsageIdentity | null;
+    try { current = await this.readCurrentIdentity(); } catch { current = null; }
+    if (!same(current, this.account)) { this.activation.invalidateIdentity(); stream?.exclude(); return null; }
+    // Do not apply an activation that raced this response's identity read.
+    if (observedGeneration !== this.activation.snapshot().generation) return null;
+    if (this.clock() >= this.expiresAt) { this.activation.invalidateIdentity(); stream?.exclude(); return null; }
+    if (Buffer.byteLength(text, 'utf8') > 262144) { stream?.exclude(); return null; }
+    let parsed: unknown;
+    try { parsed = JSON.parse(text); } catch { stream?.exclude(); return null; }
+    const envelope = object(parsed) && 'usage' in parsed ? parsed : null;
+    if ((exchange.pathname.endsWith('/stream') && !envelope)
+      || (envelope && (envelope.version !== 1 || typeof envelope.stream_id !== 'string' || !envelope.stream_id
+        || !Number.isSafeInteger(envelope.sequence) || Number(envelope.sequence) <= 0))) { stream?.exclude(); return null; }
+    const original = envelope ? envelope.usage : parsed;
+    if (!object(original) || original.account_id !== this.account.id || original.user_id !== this.account.userId
+      || original.plan_type !== this.account.plan) { stream?.exclude(); return null; }
+    const rate = original.rate_limit;
+    if (!object(rate) || typeof rate.allowed !== 'boolean' || typeof rate.limit_reached !== 'boolean') {
+      stream?.exclude(); return null;
+    }
+    if (stream && !stream.bind(this.key)) return null;
+    // Identity-checked responses received by this relay do not establish the
+    // sending process or prove that an authoritative UI cache consumed them.
+    if (exchange.pathname.endsWith('/stream')) this.streamSnapshots = Math.min(Number.MAX_SAFE_INTEGER, this.streamSnapshots + 1);
+    else this.jsonSnapshots = Math.min(Number.MAX_SAFE_INTEGER, this.jsonSnapshots + 1);
+    this.lastSnapshotAt = this.clock();
+    const context: UsageRewriteContext = { enabled: true, mode: 'observe', status: exchange.status,
+      pathname: exchange.pathname, account: this.account };
+    const observed = evaluateUsageRewrite(original, context);
+    this.activation.observe(this.key, observed.eligible ? 'exhausted'
+      : rate.allowed === true && rate.limit_reached === false ? 'available' : 'protected');
+    const state = this.activation.snapshot();
+    if (state.mode !== 'apply') return null;
+    const result = evaluateUsageRewrite(original, { ...context, mode: 'apply' });
+    if (!result.changed) return null;
+    // Observe and unchanged responses never spawn an installed-package probe.
+    const valid = await this.checkContext();
+    if (state.generation !== this.activation.snapshot().generation) return null;
+    if (!valid) { this.activation.invalidateIdentity(); stream?.exclude(); return null; }
+    // A native account or trial can change while the asynchronous build check runs.
+    try { current = await this.readCurrentIdentity(); } catch { current = null; }
+    if (state.generation !== this.activation.snapshot().generation) return null;
+    if (!same(current, this.account)) { this.activation.invalidateIdentity(); stream?.exclude(); return null; }
+    if (this.clock() >= this.expiresAt) { this.activation.invalidateIdentity(); stream?.exclude(); return null; }
+    if (!this.activation.recordOutput(this.key, state.generation)) return null;
+    return JSON.stringify(envelope ? { ...envelope, usage: result.value } : result.value);
+  }
+}

package/src/codex/desktop-compatibility/usage-policy.ts

@@ -0,0 +1,59 @@
+/** Pure response policy. Real quota windows, credits and spending restrictions stay unchanged. */
+export interface UsageRewriteContext {
+  enabled: boolean;
+  mode: 'observe' | 'apply';
+  status: number;
+  pathname: string;
+  account: {
+    id: string;
+    userId: string;
+    plan: 'plus' | 'pro';
+    structure: 'personal';
+  } | null;
+}
+
+type RecordValue = Record<string, unknown>;
+function record(value: unknown): value is RecordValue {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+/**
+ * Transform only a complete, matched personal-account usage snapshot.
+ * Account context must come from a trusted live integration; this module does not
+ * discover it or prove provider isolation. Never persist the adjusted snapshot as
+ * actual provider/account capacity. Unknown or protected states pass unchanged.
+ */
+export function evaluateUsageRewrite(value: unknown, context: UsageRewriteContext) {
+  const unchanged = (reason: string) => ({ value, changed: false, eligible: false, reason });
+  if (!context.enabled) return unchanged('off');
+  if (context.status !== 200) return unchanged('non-success-response');
+  if (!['/backend-api/wham/usage', '/backend-api/wham/usage/stream'].includes(context.pathname)) return unchanged('unowned-path');
+  const account = context.account;
+  if (!account || !account.id || !account.userId || account.structure !== 'personal' || !['plus', 'pro'].includes(account.plan)) return unchanged('unsupported-account');
+  if (!record(value) || value.account_id !== account.id || value.user_id !== account.userId || value.plan_type !== account.plan) return unchanged('identity-mismatch');
+  const rate = value.rate_limit;
+  if (!record(rate) || rate.allowed !== false || rate.limit_reached !== true) return unchanged('not-explicitly-exhausted');
+  const spend = value.spend_control;
+  // Absence is unknown, not evidence that no protected spending restriction exists.
+  if (!record(spend) || spend.reached !== false) return unchanged('protected-or-unknown-spend');
+  const reason = value.rate_limit_reached_type;
+  if (reason != null && (!record(reason) || reason.type !== 'rate_limit_reached')) return unchanged('protected-or-unknown-reason');
+  const credits = value.credits;
+  if (!record(credits) || typeof credits.has_credits !== 'boolean' || typeof credits.unlimited !== 'boolean') return unchanged('unknown-credit-schema');
+  if (credits.overage_limit_reached != null && credits.overage_limit_reached !== false) return unchanged('overage-restriction');
+  // These entitlements already keep the native gate open. Rewriting the ordinary
+  // rate limit would unnecessarily change the app's Reserve activation predicate.
+  if (credits.has_credits || credits.unlimited) return unchanged('credits-available');
+  const upsell = value.rate_limit_upsell, additional = value.additional_rate_limits;
+  if (upsell != null && !record(upsell)) return unchanged('unknown-reserve-schema');
+  if (additional != null && (!Array.isArray(additional) || additional.some(limit => !record(limit)
+    || limit.limit_name === 'gpt-reserve' && (!record(limit.rate_limit) || typeof limit.rate_limit.allowed !== 'boolean')))) return unchanged('unknown-reserve-schema');
+  if (record(upsell) && upsell.banner_type === 'luna_reserve' && Array.isArray(additional)
+    && additional.some(limit => record(limit) && limit.limit_name === 'gpt-reserve'
+      && record(limit.rate_limit) && limit.rate_limit.allowed === true)) return unchanged('reserve-active');
+  if (context.mode !== 'apply') return { value, changed: false, eligible: true, reason: 'observe-only' };
+  return {
+    value: { ...value, rate_limit: { ...rate, allowed: true, limit_reached: false } },
+    changed: true, eligible: true, reason: 'personal-usage-only',
+  };
+}

package/src/codex/desktop-compatibility/usage-refresh.ts

@@ -0,0 +1,33 @@
+/** Exact usage-stream refresh registry. No timers, sockets or core-path imports. */
+export class UsageRefreshRegistry {
+  private entries = new Set<{ binding: string | null; tainted: boolean; close: () => Promise<void> }>();
+  register(method: string, pathname: string, close: () => Promise<void>) {
+    if (method !== 'GET' || pathname !== '/backend-api/wham/usage/stream') return null;
+    const entry = { binding: null as string | null, tainted: false, close };
+    this.entries.add(entry);
+    return {
+      // Caller must invoke only after validating a complete upstream snapshot's identity.
+      // A connection that changes account identity never becomes a refresh target again.
+      bind: (verifiedBinding: string) => {
+        if (!verifiedBinding || entry.tainted || !this.entries.has(entry)) return false;
+        if (entry.binding !== null && entry.binding !== verifiedBinding) {
+          entry.tainted = true; entry.binding = null; return false;
+        }
+        entry.binding = verifiedBinding; return true;
+      },
+      exclude: () => { entry.tainted = true; entry.binding = null; },
+      release: () => { this.entries.delete(entry); },
+    };
+  }
+  async refresh(binding: string) {
+    if (!binding) throw new Error('Verified account binding is required');
+    const selected = [...this.entries].filter(e => !e.tainted && e.binding === binding);
+    // Detach before awaiting; concurrent refreshes cannot close the same stream twice.
+    for (const entry of selected) this.entries.delete(entry);
+    const results = await Promise.allSettled(selected.map(entry => Promise.resolve().then(entry.close)));
+    return { requested: selected.length, closed: results.filter(r => r.status === 'fulfilled').length,
+      failed: results.filter(r => r.status === 'rejected').length };
+  }
+  get size() { return this.entries.size; }
+  get boundSize() { return [...this.entries].filter(entry => !entry.tainted && entry.binding !== null).length; }
+}

package/src/codex/desktop-compatibility/usage-sse-controller.ts

@@ -0,0 +1,86 @@
+type Rewrite = (text: string) => Promise<string | null>;
+
+async function rewriteRecord(bytes: Buffer, first: boolean, rewrite: Rewrite): Promise<Buffer> {
+  let text: string;
+  try { text = new TextDecoder('utf-8', { fatal: true, ignoreBOM: true }).decode(bytes); }
+  catch { return Buffer.from(bytes); }
+  const lines = [...text.matchAll(/([^\r\n]*)(\r\n|\r|\n|$)/g)].filter(m => m[0].length > 0);
+  const data: string[] = [], indexes = new Set<number>(); let event = '';
+  lines.forEach((line, i) => {
+    const content = first && i === 0 ? line[1]!.replace(/^\uFEFF/, '') : line[1]!;
+    if (content.startsWith(':')) return;
+    const colon = content.indexOf(':');
+    const key = colon < 0 ? content : content.slice(0, colon);
+    const value = colon < 0 ? '' : content.slice(colon + 1).replace(/^ /, '');
+    if (key === 'event') event = value;
+    if (key === 'data') { data.push(value); indexes.add(i); }
+  });
+  if (event !== 'usage.snapshot' || !data.length) return Buffer.from(bytes);
+  const changed = await rewrite(data.join('\n'));
+  if (changed === null) return Buffer.from(bytes);
+  let written = false;
+  return Buffer.from(lines.map((line, i) => {
+    if (!indexes.has(i)) return line[0];
+    if (written) return '';
+    written = true;
+    const bom = first && i === 0 && line[1]!.startsWith('\uFEFF') ? '\uFEFF' : '';
+    return `${bom}data: ${changed}${line[2]}`;
+  }).join(''));
+}
+
+/** Byte-bounded SSE framing; never fabricates events or changes stream sequence numbers. */
+export function controlledUsageSse(rewrite: Rewrite, cap = 262144): TransformStream<Uint8Array, Uint8Array> {
+  if (!Number.isSafeInteger(cap) || cap < 1 || cap > 1048576) throw new Error('Invalid record limit');
+  const buffer = Buffer.alloc(cap);
+  let used = 0, lineHasBytes = false, pendingCR = false, first = true, passthrough = false;
+  return new TransformStream({
+    async transform(chunk, controller) {
+      let rawStart = passthrough ? 0 : -1;
+      const enterPassthrough = (start: number) => {
+        controller.enqueue(Buffer.from(buffer.subarray(0, used)));
+        used = 0; passthrough = true; rawStart = start;
+      };
+      const endRecord = async (rawEnd: number) => {
+        if (passthrough) {
+          if (rawEnd > rawStart) controller.enqueue(chunk.subarray(rawStart, rawEnd));
+          passthrough = false; rawStart = -1;
+        } else {
+          controller.enqueue(await rewriteRecord(buffer.subarray(0, used), first, rewrite));
+        }
+        first = false; used = 0; lineHasBytes = false;
+      };
+      for (let i = 0; i < chunk.length; i++) {
+        const byte = chunk[i]!;
+        if (pendingCR) {
+          pendingCR = false;
+          if (byte !== 10) {
+            if (!lineHasBytes) await endRecord(i);
+            lineHasBytes = false;
+          }
+          else {
+            if (!passthrough && used === cap) enterPassthrough(i);
+            if (!passthrough) buffer[used++] = byte;
+            const blankLine = !lineHasBytes;
+            lineHasBytes = false;
+            if (blankLine) await endRecord(i + 1);
+            continue;
+          }
+        }
+        if (!passthrough && used === cap) enterPassthrough(i);
+        if (!passthrough) buffer[used++] = byte;
+        if (byte === 13) pendingCR = true;
+        else if (byte === 10) {
+          const blankLine = !lineHasBytes;
+          lineHasBytes = false;
+          if (blankLine) await endRecord(i + 1);
+        } else lineHasBytes = true;
+      }
+      if (passthrough && rawStart < chunk.length) controller.enqueue(chunk.subarray(rawStart));
+    },
+    async flush(controller) {
+      if (passthrough) return;
+      if (pendingCR && !lineHasBytes) { controller.enqueue(await rewriteRecord(buffer.subarray(0, used), first, rewrite)); used = 0; }
+      if (used > 0) controller.enqueue(Buffer.from(buffer.subarray(0, used)));
+    },
+  });
+}

package/src/codex/desktop-compatibility/windows-activation-source.ts

@@ -0,0 +1,44 @@
+// Kept inline so source and standalone Bun distributions carry the same COM adapter.
+export const WINDOWS_ACTIVATION_SOURCE = String.raw`using System;
+using System.Runtime.InteropServices;
+using System.Text;
+
+// Windows.Launch preserves package identity and forwards explicit application arguments.
+public static class OpenCodexPackageActivation {
+    [ComImport, Guid("2E941141-7F97-4756-BA1D-9DECDE894A3D"), InterfaceType(ComInterfaceType.InterfaceIsIUnknown)]
+    private interface IApplicationActivationManager {
+        [PreserveSig] int ActivateApplication([MarshalAs(UnmanagedType.LPWStr)] string appId, [MarshalAs(UnmanagedType.LPWStr)] string arguments, uint options, out uint processId);
+        [PreserveSig] int ActivateForFile([MarshalAs(UnmanagedType.LPWStr)] string appId, IntPtr items, [MarshalAs(UnmanagedType.LPWStr)] string verb, out uint processId);
+        [PreserveSig] int ActivateForProtocol([MarshalAs(UnmanagedType.LPWStr)] string appId, IntPtr items, out uint processId);
+    }
+    [DllImport("ole32.dll", PreserveSig=true)]
+    private static extern int CoCreateInstance(ref Guid clsid, IntPtr outer, uint context, ref Guid iid, [MarshalAs(UnmanagedType.Interface)] out IApplicationActivationManager manager);
+    [DllImport("kernel32.dll", SetLastError=true)] private static extern IntPtr OpenProcess(uint access, bool inherit, uint pid);
+    [DllImport("kernel32.dll")] private static extern bool CloseHandle(IntPtr handle);
+    [DllImport("kernel32.dll", CharSet=CharSet.Unicode)] private static extern int GetPackageFullName(IntPtr process, ref uint length, StringBuilder name);
+    private static IApplicationActivationManager Manager() {
+        var clsid=new Guid("45BA127D-10A8-46EA-8AB7-56EA9078943C");
+        var iid=new Guid("2E941141-7F97-4756-BA1D-9DECDE894A3D");
+        IApplicationActivationManager manager;
+        // LOCAL_SERVER preserves activation argument lifetime after the short launcher exits.
+        Marshal.ThrowExceptionForHR(CoCreateInstance(ref clsid,IntPtr.Zero,4,ref iid,out manager));
+        return manager;
+    }
+    public static void ValidateActivationService() {var manager=Manager();Marshal.FinalReleaseComObject(manager);}
+    public static uint Activate(string appId,string arguments) {
+        var manager=Manager();
+        try {uint pid;Marshal.ThrowExceptionForHR(manager.ActivateApplication(appId,arguments,0,out pid));return pid;}
+        finally {Marshal.FinalReleaseComObject(manager);}
+    }
+    public static string PackageOf(uint pid) {
+        var handle=OpenProcess(0x1000,false,pid);
+        if(handle==IntPtr.Zero)throw new System.ComponentModel.Win32Exception(Marshal.GetLastWin32Error());
+        try {uint length=0;int status=GetPackageFullName(handle,ref length,null);
+            if(status==15700)return null;
+            if(status!=122)throw new System.ComponentModel.Win32Exception(status);
+            var value=new StringBuilder((int)length);status=GetPackageFullName(handle,ref length,value);
+            if(status!=0)throw new System.ComponentModel.Win32Exception(status);
+            return value.ToString();
+        }finally{CloseHandle(handle);}
+    }
+}`;

package/src/codex/desktop-compatibility/windows-certificate-trust.ts

@@ -0,0 +1,81 @@
+import { execFile } from "node:child_process";
+import { X509Certificate } from "node:crypto";
+import { resolveTrustedWindowsPowerShellExe } from "../../lib/windows-elevation";
+import type { StoredDesktopAuthority } from "./certificate-store";
+import { isTestHomeGuardArmed } from "../../lib/test-home-guard";
+import { isServerAuthOnlyCertificate } from "../../claude/intercept/local-ca";
+
+export type DesktopCertificateTrust = "trusted" | "not-trusted" | "unknown";
+export type TrustOperation = "inspect" | "trust" | "remove";
+export type CertificateTrustRunner = (operation: TrustOperation, certificateDer: string, fingerprint: string) => Promise<DesktopCertificateTrust>;
+
+const SCRIPT = [
+  "$ErrorActionPreference='Stop'",
+  "$inputData=[Console]::In.ReadToEnd()|ConvertFrom-Json",
+  "$bytes=[Convert]::FromBase64String($inputData.certificate)",
+  "$cert=[Security.Cryptography.X509Certificates.X509Certificate2]::new($bytes)",
+  "$sha=[Security.Cryptography.SHA256]::Create()",
+  "try {$fingerprint=([BitConverter]::ToString($sha.ComputeHash($bytes))).Replace('-','')}finally{$sha.Dispose()}",
+  "if($fingerprint -cne $inputData.fingerprint){throw 'Certificate changed'}",
+  "$store=[Security.Cryptography.X509Certificates.X509Store]::new('Root','CurrentUser')",
+  "$mode=if($inputData.operation -eq 'inspect'){[Security.Cryptography.X509Certificates.OpenFlags]::ReadOnly}else{[Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite}",
+  "try {",
+  " $store.Open($mode)",
+  " $foundCertificates=@($store.Certificates.Find([Security.Cryptography.X509Certificates.X509FindType]::FindByThumbprint,$cert.Thumbprint,$false))",
+  " foreach($certificateMatch in $foundCertificates){if([Convert]::ToBase64String($certificateMatch.RawData) -cne [Convert]::ToBase64String($bytes)){throw 'Certificate mismatch'}}",
+  " if($inputData.operation -eq 'trust'){if($foundCertificates.Count -eq 0){$store.Add($cert)}}",
+  " elseif($inputData.operation -eq 'remove'){foreach($certificateMatch in $foundCertificates){$store.Remove($certificateMatch)}}",
+  " elseif($inputData.operation -ne 'inspect'){throw 'Unknown operation'}",
+  " $present=@($store.Certificates.Find([Security.Cryptography.X509Certificates.X509FindType]::FindByThumbprint,$cert.Thumbprint,$false)).Count -gt 0",
+  " if($present){[Console]::Out.Write('trusted')}else{[Console]::Out.Write('not-trusted')}",
+  "}finally{$store.Close();$store.Dispose();$cert.Dispose()}",
+].join("\n");
+
+const run: CertificateTrustRunner = (operation, certificateDer, fingerprint) => {
+  if (process.platform !== "win32") return Promise.resolve("unknown");
+  if (operation !== "inspect" && isTestHomeGuardArmed()) return Promise.resolve("unknown");
+  return new Promise(resolve => {
+    const child = execFile(resolveTrustedWindowsPowerShellExe(), ["-NoProfile", "-NonInteractive", "-Command", SCRIPT], {
+      timeout: operation === "inspect" ? 10_000 : 120_000, maxBuffer: 4096, windowsHide: true, encoding: "utf8",
+    }, (error, stdout) => resolve(!error && (stdout.trim() === "trusted" || stdout.trim() === "not-trusted")
+      ? stdout.trim() as DesktopCertificateTrust : "unknown"));
+    child.stdin?.on("error", () => { /* completion and readback decide the result */ });
+    child.stdin?.end(JSON.stringify({ operation, certificate: certificateDer, fingerprint }));
+  });
+};
+
+/** Public status cannot create a certificate, decrypt a key or alter OS trust. */
+export async function inspectWindowsCertificateTrust(certPem: string, expectedFingerprint: string, runner: CertificateTrustRunner = run): Promise<DesktopCertificateTrust> {
+  const certificate = new X509Certificate(certPem);
+  const fingerprint = certificate.fingerprint256.replaceAll(":", "");
+  if (!certificate.ca || fingerprint !== expectedFingerprint || !/^[A-F0-9]{64}$/.test(expectedFingerprint)) {
+    throw new Error("desktop_compatibility_certificate_mismatch");
+  }
+  return runner("inspect", certificate.raw.toString("base64"), fingerprint).catch(() => "unknown" as const);
+}
+
+/** Mutations require the store-validated private key, not unverified public status metadata. */
+export function createWindowsCertificateTrust(authority: StoredDesktopAuthority, expectedFingerprint: string, runner: CertificateTrustRunner = run) {
+  const certificate = new X509Certificate(authority.authority.certPem);
+  const fingerprint = certificate.fingerprint256.replaceAll(":", "");
+  if (fingerprint !== expectedFingerprint || !certificate.ca || !certificate.checkPrivateKey(authority.authority.privateKey)
+    || !certificate.verify(authority.authority.publicKey) || !/^OpenCodex Codex Desktop [0-9a-f-]{36}$/.test(authority.commonName)
+    || !certificate.subject.split("\n").includes(`CN=${authority.commonName}`)) throw new Error("desktop_compatibility_certificate_mismatch");
+  const encoded = certificate.raw.toString("base64");
+  const inspect = () => runner("inspect", encoded, fingerprint).catch(() => "unknown" as const);
+  let pending: Promise<DesktopCertificateTrust> | null = null;
+  const change = (operation: "trust" | "remove") => {
+    if (pending) return Promise.reject(new Error("desktop_compatibility_trust_busy"));
+    if (operation === "trust" && Date.parse(certificate.validTo) <= Date.now()) return Promise.reject(new Error("desktop_compatibility_authority_expired"));
+    if (operation === "trust" && !isServerAuthOnlyCertificate(certificate)) return Promise.reject(new Error("desktop_compatibility_authority_renewal_required"));
+    pending = (async () => {
+      const before = await inspect();
+      if (before === "unknown") return before;
+      if (before === (operation === "trust" ? "trusted" : "not-trusted")) return before;
+      try { await runner(operation, encoded, fingerprint); } catch { /* read the exact store after an uncertain action */ }
+      return inspect();
+    })().finally(() => { pending = null; });
+    return pending;
+  };
+  return { inspect, trust: () => change("trust"), remove: () => change("remove") };
+}