@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/codex/desktop-compatibility/windows-key-protection.ts

@@ -0,0 +1,165 @@
+import { execFile } from "node:child_process";
+import { join } from "node:path";
+import { dlopen, ptr, toArrayBuffer, type Pointer } from "bun:ffi";
+import { resolveTrustedWindowsPowerShellExe, resolveTrustedWindowsSystemDirectory } from "../../lib/windows-elevation";
+
+const MAX_INPUT = 65_536;
+const MAX_OUTPUT = 131_072;
+const PURPOSE = "opencodex/codex-desktop-compatibility/authority/v1";
+const ENTROPY = new TextEncoder().encode(PURPOSE);
+// Only the PowerShell fallback is bounded by a clock. A cold Windows PowerShell that must also load
+// System.Security has been measured past 10s on a loaded machine (Windows CI run 38591626343).
+const DPAPI_TIMEOUT_MS = 20_000;
+const SCRIPT = [
+  "$ErrorActionPreference='Stop'",
+  "Add-Type -AssemblyName System.Security",
+  "$r=[Console]::In.ReadToEnd()|ConvertFrom-Json",
+  "$data=[Convert]::FromBase64String($r.data)",
+  `if($data.Length -eq 0 -or $data.Length -gt ${MAX_INPUT}){throw 'Invalid data size'}`,
+  `$entropy=[Text.Encoding]::UTF8.GetBytes('${PURPOSE}')`,
+  "$scope=[Security.Cryptography.DataProtectionScope]::CurrentUser",
+  "if($r.operation -eq 'protect'){",
+  " $out=[Security.Cryptography.ProtectedData]::Protect($data,$entropy,$scope)",
+  "}elseif($r.operation -eq 'unprotect'){",
+  " $out=[Security.Cryptography.ProtectedData]::Unprotect($data,$entropy,$scope)",
+  "}else{throw 'Invalid operation'}",
+  "[Console]::Out.Write([Convert]::ToBase64String($out))",
+].join("\n");
+
+type Operation = "protect" | "unprotect";
+
+export interface AuthorityKeyProtection {
+  protect(cleartext: Uint8Array): Promise<Uint8Array>;
+  unprotect(ciphertext: Uint8Array): Promise<Uint8Array>;
+}
+
+// CRYPTPROTECT_UI_FORBIDDEN and no CRYPTPROTECT_LOCAL_MACHINE: the CurrentUser scope that
+// ProtectedData.Protect(..., CurrentUser) requests, so blobs written by either path read in the other.
+const CRYPTPROTECT_UI_FORBIDDEN = 0x1;
+// DATA_BLOB on x64: DWORD cbData, four bytes of padding, BYTE* pbData.
+const DATA_BLOB_BYTES = 16;
+const DPAPI_SIGNATURE = { args: ["ptr", "ptr", "ptr", "ptr", "ptr", "u32", "ptr"], returns: "i32" } as const;
+
+type NativeDpapi = (operation: Operation, data: Uint8Array) => Uint8Array;
+let nativeDpapi: NativeDpapi | undefined;
+
+function dataBlob(bytes: Uint8Array): Buffer {
+  const blob = Buffer.alloc(DATA_BLOB_BYTES);
+  blob.writeUInt32LE(bytes.byteLength, 0);
+  blob.writeBigUInt64LE(BigInt(ptr(bytes)), 8);
+  return blob;
+}
+
+/**
+ * In-process CryptProtectData/CryptUnprotectData. Spawning Windows PowerShell for every call cost
+ * seconds of cold start (past 20s on a loaded CI runner) for a call that takes milliseconds.
+ * crypt32 is loaded from the GetSystemDirectoryW path so the DLL search order cannot substitute it.
+ * Returns null where Bun's FFI is unavailable (Windows ARM64), leaving the PowerShell helper.
+ */
+function loadNativeDpapi(): NativeDpapi | null {
+  if (nativeDpapi) return nativeDpapi;
+  if (process.platform !== "win32" || process.arch !== "x64") return null;
+  let crypt32;
+  let kernel32;
+  try {
+    const systemDirectory = resolveTrustedWindowsSystemDirectory();
+    crypt32 = dlopen(join(systemDirectory, "crypt32.dll"), {
+      CryptProtectData: DPAPI_SIGNATURE,
+      CryptUnprotectData: DPAPI_SIGNATURE,
+    }).symbols;
+    kernel32 = dlopen(join(systemDirectory, "kernel32.dll"), {
+      LocalFree: { args: ["ptr"], returns: "ptr" },
+      // Wipes by address, so clearing never depends on a JS view having been created.
+      RtlZeroMemory: { args: ["ptr", "u64"], returns: "void" },
+    }).symbols;
+  } catch {
+    return null;
+  }
+  const { CryptProtectData, CryptUnprotectData } = crypt32;
+  const { LocalFree, RtlZeroMemory } = kernel32;
+  nativeDpapi = (operation, data) => {
+    const input = dataBlob(data);
+    const entropy = dataBlob(ENTROPY);
+    const output = Buffer.alloc(DATA_BLOB_BYTES);
+    const call = operation === "protect" ? CryptProtectData : CryptUnprotectData;
+    // Description, reserved and prompt are null; Windows reports no detail worth propagating.
+    if (!call(ptr(input), null, ptr(entropy), null, null, CRYPTPROTECT_UI_FORBIDDEN, ptr(output))) {
+      throw new Error("desktop_compatibility_key_protection_failed");
+    }
+    const length = output.readUInt32LE(0);
+    const address = Number(output.readBigUInt64LE(8)) as Pointer;
+    // Every step after a successful call sits inside try so the native buffer is always
+    // released, even if creating the view over it throws.
+    let view: Uint8Array | null = null;
+    try {
+      view = length > 0 ? new Uint8Array(toArrayBuffer(address, 0, length)) : null;
+      if (length === 0 || length > MAX_INPUT) throw new Error("desktop_compatibility_key_size");
+      return Uint8Array.from(view!);
+    } finally {
+      // The unprotected buffer is cleartext key material; wipe it natively before LocalFree
+      // releases it, including when the size check or view creation fails. LocalFree still
+      // runs if wiping throws.
+      try {
+        if (operation === "unprotect" && length > 0) RtlZeroMemory(address, length);
+      } finally {
+        LocalFree(address);
+      }
+    }
+  };
+  return nativeDpapi;
+}
+
+/** The payload travels on stdin, never in process arguments, environment or logs. */
+function runPowerShellDpapi(operation: Operation, data: Uint8Array, timeoutMs = DPAPI_TIMEOUT_MS): Promise<Uint8Array> {
+  return new Promise((resolve, reject) => {
+    const child = execFile(resolveTrustedWindowsPowerShellExe(), ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", SCRIPT], {
+      timeout: timeoutMs, maxBuffer: MAX_OUTPUT, windowsHide: true, encoding: "utf8",
+    }, (error, stdout) => {
+      // Do not include PowerShell stderr, command output or the input in a propagated error.
+      if (error || !/^[A-Za-z0-9+/]+={0,2}$/.test(stdout.trim())) {
+        reject(new Error("desktop_compatibility_key_protection_failed")); return;
+      }
+      const bytes = Buffer.from(stdout.trim(), "base64");
+      if (bytes.length === 0 || bytes.length > MAX_INPUT) {
+        reject(new Error("desktop_compatibility_key_size")); return;
+      }
+      resolve(bytes);
+    });
+    child.stdin?.on("error", () => { /* execFile's completion reports the failed child. */ });
+    child.stdin?.end(JSON.stringify({ operation, data: Buffer.from(data).toString("base64") }));
+  });
+}
+
+function validated(data: Uint8Array): Uint8Array {
+  if (process.platform !== "win32") throw new Error("desktop_compatibility_windows_required");
+  if (data.byteLength === 0 || data.byteLength > MAX_INPUT) throw new Error("desktop_compatibility_key_size");
+  return data;
+}
+
+async function runDpapi(operation: Operation, data: Uint8Array): Promise<Uint8Array> {
+  validated(data);
+  const native = loadNativeDpapi();
+  return native ? native(operation, data) : runPowerShellDpapi(operation, data);
+}
+
+/** CurrentUser protects against other OS identities, not other processes of the same user. */
+export const windowsAuthorityKeyProtection: AuthorityKeyProtection = {
+  protect: bytes => runDpapi("protect", bytes),
+  unprotect: bytes => runDpapi("unprotect", bytes),
+};
+
+/**
+ * Test-only: the PowerShell helper (Windows ARM64, and every key stored before the native path).
+ * The caller owns the bound because a compatibility check must not depend on cold-start latency.
+ */
+export function powerShellAuthorityKeyProtectionForTests(timeoutMs: number): AuthorityKeyProtection {
+  return {
+    protect: async bytes => runPowerShellDpapi("protect", validated(bytes), timeoutMs),
+    unprotect: async bytes => runPowerShellDpapi("unprotect", validated(bytes), timeoutMs),
+  };
+}
+
+/** Test-only: whether this process protects keys in-process rather than through PowerShell. */
+export function usesNativeDpapiForTests(): boolean {
+  return process.platform === "win32" && loadNativeDpapi() !== null;
+}

package/src/codex/desktop-compatibility/windows-package-command.ts

@@ -0,0 +1,86 @@
+import type { DesktopAppInstall, DesktopExec, DesktopProcess } from "../desktop-app/types";
+import { resolveTrustedWindowsPowerShellExe } from "../../lib/windows-elevation";
+import { WINDOWS_ACTIVATION_SOURCE } from "./windows-activation-source";
+import { readDesktopCompatibilityLaunch } from "./runtime-ownership";
+
+/** Only the feature's loopback PAC endpoint may become a launch argument. */
+export function validatedCompatibilityPacUrl(value: string): string {
+  let url: URL;
+  try { url = new URL(value); } catch { throw new Error("desktop_compatibility_invalid_pac_url"); }
+  if (url.protocol !== "http:" || url.hostname !== "127.0.0.1" || !url.port || Number(url.port) < 1
+    || url.username || url.password || url.search || url.hash
+    || !/^\/[a-zA-Z0-9-]{16,80}\/proxy\.pac$/.test(url.pathname)
+    || value !== url.href) throw new Error("desktop_compatibility_invalid_pac_url");
+  return url.href;
+}
+
+function literal(value: string): string { return `'${value.replaceAll("'", "''")}'`; }
+
+export function compatibilityActivationScript(install: DesktopAppInstall, pacUrl: string): string {
+  const pac = validatedCompatibilityPacUrl(pacUrl);
+  if (!/^OpenAI\.Codex(?:Beta)?_[A-Za-z0-9]+$/.test(install.id) || install.relaunch !== `${install.id}!App`) {
+    throw new Error("desktop_compatibility_invalid_package");
+  }
+  return [
+    "$ErrorActionPreference='Stop'",
+    `$family=${literal(install.id)}; $root=${literal(install.root)}; $pac=${literal(pac)}`,
+    `$p=Get-AppxPackage -Name ${literal(install.id.split("_")[0]!)}`,
+    "$p=@($p|Where-Object {$_.PackageFamilyName -eq $family -and $_.InstallLocation -ieq $root})",
+    "if($p.Count -ne 1){throw 'Package changed'}; $p=$p[0]",
+    "$manifest=Get-AppxPackageManifest -Package $p.PackageFullName",
+    "$entry=@($manifest.Package.Applications.Application|Where-Object {$_.Id -eq 'App' -and $_.Executable.Replace('/','\\') -ieq 'app\\ChatGPT.exe'})",
+    "if($entry.Count -ne 1){throw 'Application entry changed'}",
+    "Add-Type -TypeDefinition @'", WINDOWS_ACTIVATION_SOURCE, "'@",
+    "$pidValue=[OpenCodexPackageActivation]::Activate($family+'!App','--proxy-pac-url='+$pac)",
+    "if([OpenCodexPackageActivation]::PackageOf($pidValue) -ne $p.PackageFullName){throw 'Package identity missing'}",
+    "$running=Get-CimInstance Win32_Process -Filter ('ProcessId='+$pidValue)",
+    "$expected=Join-Path $p.InstallLocation 'app\\ChatGPT.exe'",
+    "if(-not $running -or $running.ExecutablePath -ine $expected -or $running.CommandLine -notmatch ('(?:^|[\\s\"])--proxy-pac-url='+[regex]::Escape($pac)+'(?:$|[\\s\"])')){throw 'Launch arguments not observed'}",
+    "[pscustomobject]@{pid=[int]$pidValue;packageFullName=$p.PackageFullName;verified=$true}|ConvertTo-Json -Compress",
+  ].join("\n");
+}
+
+
+/** Preserve only the current runtime's PAC and lifetime, never trust a URL shape alone. */
+export function captureWindowsCompatibilityContext(processes: readonly DesktopProcess[]): Record<string, string> {
+  const members = new Set(processes.map(entry => entry.pid));
+  const urls = new Set<string>();
+  for (const entry of processes.filter(value => !members.has(value.parentPid))) {
+    if (entry.commandLine !== undefined && entry.commandLine.trim() === "") {
+      throw new Error("desktop_compatibility_launch_context_unavailable");
+    }
+    for (const match of (entry.commandLine ?? "").matchAll(/(?:^|\s)"?--proxy-pac-url=([^"\s]+)"?/g)) {
+      const url = match[1]!;
+      if (url.startsWith("http://127.0.0.1:")) urls.add(validatedCompatibilityPacUrl(url));
+    }
+  }
+  if (urls.size > 1) throw new Error("desktop_compatibility_conflicting_launch_context");
+  if (urls.size === 0) return {};
+  const pacUrl = [...urls][0]!, owner = readDesktopCompatibilityLaunch();
+  if (!owner || owner.pacUrl !== pacUrl) throw new Error("desktop_compatibility_launch_owner_unverified");
+  return { codexCompatibilityPacUrl: pacUrl, codexCompatibilityGeneration: owner.generation };
+}
+
+/** Recheck after the asynchronous stop ladder: identical endpoints can belong to a new runtime. */
+export function assertWindowsCompatibilityContext(context: Record<string, string>): void {
+  const owner = readDesktopCompatibilityLaunch();
+  if (!owner || owner.pacUrl !== context.codexCompatibilityPacUrl || owner.generation !== context.codexCompatibilityGeneration) {
+    throw new Error("desktop_compatibility_launch_owner_unverified");
+  }
+}
+
+export function activateWindowsCodexCompatibility(exec: DesktopExec, install: DesktopAppInstall, pacUrl: string): { pid: number; packageFullName: string } {
+  const script = compatibilityActivationScript(install, pacUrl);
+  let text: string;
+  try { text = exec(resolveTrustedWindowsPowerShellExe(), ["-NoProfile", "-NonInteractive", "-Command", script], { timeout: 15_000, windowsHide: true }); }
+  catch { throw new Error("desktop_compatibility_activation_unverified"); }
+  let result: unknown;
+  try { result = JSON.parse(text.trim().split(/\r?\n/).at(-1) ?? ""); }
+  catch { throw new Error("desktop_compatibility_activation_unverified"); }
+  if (!result || typeof result !== "object" || Array.isArray(result)) throw new Error("desktop_compatibility_activation_unverified");
+  const value = result as Record<string, unknown>;
+  if (value.verified !== true || !Number.isSafeInteger(value.pid) || Number(value.pid) <= 0
+    || typeof value.packageFullName !== "string" || !value.packageFullName.startsWith(install.id.split("_")[0]! + "_")
+    || !value.packageFullName.endsWith("_" + install.id.split("_")[1]!)) throw new Error("desktop_compatibility_activation_unverified");
+  return { pid: Number(value.pid), packageFullName: value.packageFullName };
+}

package/src/codex/desktop-compatibility/windows-package-launch.ts

@@ -0,0 +1,28 @@
+import { windowsDefaultExec, windowsDesktopAppAdapter } from "../desktop-app/windows";
+import type { DesktopExec } from "../desktop-app/types";
+import { activateWindowsCodexCompatibility, validatedCompatibilityPacUrl } from "./windows-package-command";
+export { compatibilityActivationScript, validatedCompatibilityPacUrl } from "./windows-package-command";
+
+export interface CompatibilityLaunchIo {
+  exec?: DesktopExec;
+  platform?: string;
+}
+export type CompatibilityLaunchResult =
+  | { status: "started"; pid: number; packageFullName: string }
+  | { status: "refused"; reason: "unsupported_platform" | "test_environment" | "package_unavailable" | "app_running" | "process_probe_failed" | "activation_failed" };
+
+/** Never quits an app, launches the raw EXE, changes login or installs a watcher. */
+export function launchWindowsCodexCompatibility(pacUrl: string, io: CompatibilityLaunchIo = {}): CompatibilityLaunchResult {
+  validatedCompatibilityPacUrl(pacUrl);
+  if ((io.platform ?? process.platform) !== "win32") return { status: "refused", reason: "unsupported_platform" };
+  if (process.env.OCX_TEST_HOME_GUARD === "1" && !io.exec) return { status: "refused", reason: "test_environment" };
+  const exec = io.exec ?? windowsDefaultExec;
+  const install = windowsDesktopAppAdapter.discover(exec);
+  if (!install) return { status: "refused", reason: "package_unavailable" };
+  const processes = windowsDesktopAppAdapter.listProcesses(exec, install);
+  if (processes === null) return { status: "refused", reason: "process_probe_failed" };
+  if (processes.length > 0) return { status: "refused", reason: "app_running" };
+  try {
+    return { status: "started", ...activateWindowsCodexCompatibility(exec, install, pacUrl) };
+  } catch { return { status: "refused", reason: "activation_failed" }; }
+}

package/src/codex/features.ts

@@ -44,6 +44,10 @@ import { resolveCodexHomeDir } from "./home";
 import { resolveAndPersistCodexRuntime } from "./runtime";
 import { decodeOverlayState } from "./shim-state-file";
 import { canonicalizeOpenCodexModeHint } from "./multi-agent-mode-policy";
+import { rootAssignmentKey, sourceText, splitSourceLines } from "./toml-source-lines";
+
+const AGENTS_THREAD_LIMIT_KEY = "max_concurrent_threads_per_session";
+const LEGACY_AGENTS_THREAD_LIMIT_KEY = "max_threads";
 
 /** Upstream codex-rs feature key: allow `request_user_input` in Default mode. */
 export const DEFAULT_MODE_REQUEST_USER_INPUT_FEATURE_KEY = "default_mode_request_user_input";
@@ -328,36 +332,31 @@ export function isDefaultModeRequestUserInputEnabled(configPath?: string): boole
 }
 
 /**
- * TRUE when config.toml still carries `[agents] max_threads` — codex-rs REFUSES to
- * boot with that key while multi_agent_v2 is enabled ("agents.max_threads cannot be
- * set when features.multi_agent_v2 is enabled", core/src/config/mod.rs:1421). The
- * `ocx v2 on` flow warns about it instead of editing config itself.
+ * Whether either spelling of the [agents] limit is present, including invalid
+ * values. Keep the exported compatibility name; migrations must remove both.
  */
 export function hasAgentsMaxThreads(configPath?: string): boolean {
   const content = readConfigText(configPath);
   if (content === null) return false;
   const parsed = parsedTomlTable(content, "agents");
-  if (parsed !== null) return Object.hasOwn(parsed, "max_threads");
-  const agents = tomlTableBody(content, "agents");
-  if (agents === null) return false;
-  return /^\s*max_threads\s*=/m.test(agents);
+  if (parsed !== null) return Object.hasOwn(parsed, AGENTS_THREAD_LIMIT_KEY) || Object.hasOwn(parsed, LEGACY_AGENTS_THREAD_LIMIT_KEY);
+  return agentsThreadLimitEntries(content).entries.length > 0;
 }
 
-/** Current legacy v1 `[agents] max_threads`, or null when absent/invalid. */
+/** Canonical [agents] limit, falling back to max_threads only when absent. */
 export function getAgentsMaxThreads(configPath?: string): number | null {
   const content = readConfigText(configPath);
   if (content === null) return null;
   const parsed = parsedTomlTable(content, "agents");
   if (parsed !== null) {
-    const value = parsed.max_threads;
+    const value = Object.hasOwn(parsed, AGENTS_THREAD_LIMIT_KEY) ? parsed[AGENTS_THREAD_LIMIT_KEY] : parsed[LEGACY_AGENTS_THREAD_LIMIT_KEY];
     return typeof value === "number" && Number.isInteger(value) && value >= 1 ? value : null;
   }
-  const agents = tomlTableBody(content, "agents");
-  if (agents === null) return null;
-  const m = agents.match(/^\s*max_threads\s*=\s*(\d+)\s*(?:#.*)?$/m);
-  if (!m) return null;
-  const value = Number(m[1]);
-  return Number.isInteger(value) && value >= 1 ? value : null;
+  // Unrelated valid 64-bit integers can make Bun reject the whole document.
+  // Decode the same isolated structural assignment the editor uses, including
+  // quoted keys and non-decimal integers, rather than treating unreadable as unset.
+  const entries = agentsThreadLimitEntries(content).entries;
+  return (entries.find(entry => entry.key === AGENTS_THREAD_LIMIT_KEY) ?? entries[0])?.value ?? null;
 }
 
 /**
@@ -1310,33 +1309,59 @@ function editAgentsMaxThreads(value: number | null, configPath?: string, migrate
   const path = configPath ?? activeCodexConfigPath();
   return editCodexConfigToml(path, (content): TomlEditOutcome => {
     const eol = dominantEol(content);
-    const lines = content.split(/\r?\n/);
-    const headerIdx = lines.findIndex(l => /^\s*\[agents\]\s*(?:#.*)?$/.test(l));
+    const { lines, headerIdx, entries } = agentsThreadLimitEntries(content);
     if (headerIdx === -1) {
       if (value === null) return { next: content };
-      const separator = lines.length > 0 && lines[lines.length - 1] !== "" ? [""] : [];
-      lines.push(...separator, "[agents]", `max_threads = ${value}${migratedComment ?? ""}`);
-      return { next: applyEol(lines.join("\n"), eol) };
+      const separator = content.length > 0 && !content.endsWith("\n") ? eol : "";
+      return { next: `${content}${separator}${eol}[agents]${eol}${AGENTS_THREAD_LIMIT_KEY} = ${value}${migratedComment ?? ""}${eol}` };
     }
-    let end = lines.length;
-    for (let i = headerIdx + 1; i < lines.length; i++) {
-      if (/^\s*\[/.test(lines[i])) { end = i; break; }
+    const selected = entries.find(entry => entry.key === AGENTS_THREAD_LIMIT_KEY) ?? entries[0];
+    if (entries.length === 1 && selected?.key === AGENTS_THREAD_LIMIT_KEY && selected.value === value
+      && value !== null && mergeTrailingComments(selected.comment, migratedComment) === (selected.comment ?? "")) return { next: content };
+    let comment = selected?.comment;
+    for (const entry of entries) comment = mergeTrailingComments(comment, entry.comment);
+    comment = mergeTrailingComments(comment, migratedComment);
+    for (const entry of [...entries].reverse()) {
+      if (value !== null && entry === selected) {
+        const line = lines[entry.index]!;
+        line.text = `${line.text.match(/^\s*/)?.[0] ?? ""}${AGENTS_THREAD_LIMIT_KEY} = ${value}${comment}`;
+      } else lines.splice(entry.index, 1);
     }
-    const keyRe = /^(\s*)max_threads\s*=\s*(\d+)(\s*#.*)?$/;
-    for (let i = headerIdx + 1; i < end; i++) {
-      const m = lines[i].match(keyRe);
-      if (!m) continue;
-      if (value === null) lines.splice(i, 1);
-      else if (Number(m[2]) === value && (!migratedComment || migratedComment === m[3])) return { next: content };
-      else lines[i] = `${m[1]}max_threads = ${value}${mergeTrailingComments(m[3], migratedComment)}`;
-      return { next: applyEol(lines.join("\n"), eol) };
+    if (value !== null && !selected) {
+      if (!lines[headerIdx]!.eol) lines[headerIdx]!.eol = eol;
+      lines.splice(headerIdx + 1, 0, { text: `${AGENTS_THREAD_LIMIT_KEY} = ${value}${comment}`, eol, structural: true });
     }
-    if (value === null) return { next: content };
-    lines.splice(headerIdx + 1, 0, `max_threads = ${value}${migratedComment ?? ""}`);
-    return { next: applyEol(lines.join("\n"), eol) };
+    return { next: sourceText(lines) };
   });
 }
 
+/** Only structural assignments in the supported agents table are editable. */
+function agentsThreadLimitEntries(content: string) {
+  const lines = splitSourceLines(content);
+  const headerIdx = lines.findIndex(line => line.structural && /^\s*\[agents\]\s*(?:#.*)?$/.test(line.text));
+  const entries: Array<{ index: number; key: string; value: number | null; comment?: string; editable: boolean }> = [];
+  if (headerIdx !== -1) {
+    for (let index = headerIdx + 1; index < lines.length; index++) {
+      const line = lines[index]!;
+      if (!line.structural) continue;
+      if (/^\s*\[/.test(line.text)) break;
+      const key = rootAssignmentKey(line.text);
+      if (key !== AGENTS_THREAD_LIMIT_KEY && key !== LEGACY_AGENTS_THREAD_LIMIT_KEY) continue;
+      const assignment = findTomlAssignment(line.text, key);
+      const editable = assignment !== null && (index + 1 === lines.length || lines[index + 1]!.structural);
+      let value: unknown;
+      try { value = (Bun.TOML.parse(line.text) as Record<string, unknown>)[key]; } catch {
+        // Match the reader's large-integer fallback without widening edit syntax.
+        const integer = assignment && /^\d+$/.exec(line.text.slice(assignment.valueStart, assignment.valueEnd).trim());
+        if (integer) value = Number(integer[0]);
+      }
+      entries.push({ index, key, editable, value: typeof value === "number" && Number.isInteger(value) && value >= 1 ? value : null,
+        comment: assignment ? line.text.slice(assignment.valueEnd).match(/\s*#.*$/)?.[0] : undefined });
+    }
+  }
+  return { lines, headerIdx, entries };
+}
+
 function removeMaxConcurrentThreads(configPath?: string): ConfigEditResult {
   const path = configPath ?? activeCodexConfigPath();
   return editCodexConfigToml(path, (content): TomlEditOutcome => {
@@ -1439,7 +1464,9 @@ function discoverStoredThreadLimit(configPath?: string): { value: number; units:
 }
 
 function activeThreadComment(content: string, v2Enabled: boolean): string | undefined {
-  const legacy = tomlTableBody(content, "agents")?.match(/^\s*max_threads\s*=\s*\d+(\s*#.*)$/m)?.[1];
+  const entries = agentsThreadLimitEntries(content).entries;
+  let legacy = (entries.find(entry => entry.key === AGENTS_THREAD_LIMIT_KEY) ?? entries[0])?.comment;
+  for (const entry of entries) legacy = mergeTrailingComments(legacy, entry.comment) || undefined;
   const dedicated = tomlTableBody(content, "features.multi_agent_v2")
     ?.match(/^\s*max_concurrent_threads_per_session\s*=\s*\d+(\s*#.*)$/m)?.[1];
   const features = tomlTableBody(content, "features");
@@ -1503,8 +1530,8 @@ export type MultiAgentV2TransitionResult =
   | { ok: true; changed: boolean; threadLimit: number | null }
   | { ok: false; error: string; retryable?: boolean };
 
-function transitionConfigError(content: string): string | null {
-  if (/^\s*(?:features\.multi_agent_v2(?:\.[A-Za-z0-9_]+)?|agents\.max_threads)\s*=/m.test(content)) {
+function transitionConfigError(content: string, explicitThreadLimit: boolean): string | null {
+  if (/^\s*(?:features\.multi_agent_v2(?:\.[A-Za-z0-9_]+)?|agents\.(?:max_threads|max_concurrent_threads_per_session))\s*=/m.test(content)) {
     return "dotted multi-agent config keys are not supported for automatic migration";
   }
   const dedicatedTables = content.match(/^\s*\[features\.multi_agent_v2\]\s*(?:#.*)?$/gm) ?? [];
@@ -1521,9 +1548,18 @@ function transitionConfigError(content: string): string | null {
   if (features && /^\s*multi_agent_v2\.(?:enabled|max_concurrent_threads_per_session)\s*=/m.test(features)) {
     return "dotted multi_agent_v2 fields are not supported for automatic migration";
   }
-  const agents = tomlTableBody(content, "agents");
-  if ((agents?.match(/^\s*max_threads\s*=/gm) ?? []).length > 1) {
-    return "duplicate agents.max_threads definitions cannot be migrated safely";
+  const entries = agentsThreadLimitEntries(content).entries;
+  const parsedAgents = parsedTomlTable(content, "agents");
+  for (const key of [AGENTS_THREAD_LIMIT_KEY, LEGACY_AGENTS_THREAD_LIMIT_KEY]) {
+    const matches = entries.filter(entry => entry.key === key);
+    if (matches.length > 1) return `duplicate agents.${key} definitions cannot be migrated safely`;
+    if (parsedAgents && Object.hasOwn(parsedAgents, key) && matches.length === 0) {
+      return "unsupported agents thread-limit storage cannot be migrated safely";
+    }
+  }
+  if (entries.some(entry => !entry.editable)) return "unsupported agents thread-limit value cannot be migrated safely";
+  if (!explicitThreadLimit && (entries.some(entry => entry.value === null) || (entries.length === 2 && entries[0]!.value !== entries[1]!.value))) {
+    return "conflicting or invalid agents thread-limit aliases require an explicit thread limit";
   }
   const dedicated = tomlTableBody(content, "features.multi_agent_v2");
   if ((dedicated?.match(/^\s*max_concurrent_threads_per_session\s*=/gm) ?? []).length > 1) {
@@ -1542,15 +1578,15 @@ export function transitionMultiAgentV2(
   toggleFeature: (enabled: boolean, env: NodeJS.ProcessEnv, validateBeforeSpawn: () => void) => void,
   options: { configPath?: string; threadLimit?: number; heldConfigWriteLock?: LockHandle } = {},
 ): MultiAgentV2TransitionResult {
-  if (options.threadLimit !== undefined && (!Number.isInteger(options.threadLimit) || options.threadLimit < 1)) {
-    return { ok: false, error: "thread limit must be an integer >= 1" };
+  if (options.threadLimit !== undefined && (!Number.isSafeInteger(options.threadLimit) || options.threadLimit < 1)) {
+    return { ok: false, error: "thread limit must be a safe integer >= 1" };
   }
   const path = options.configPath ?? activeCodexConfigPath();
   if (codexHomeIsAbsent(dirname(path))) return { ok: false, error: `config.toml not readable at ${path}` };
   const runTransition = (held: LockHandle): MultiAgentV2TransitionResult => {
   const original = readConfigText(path);
   if (original === null) return { ok: false, error: `config.toml not readable at ${path}` };
-  const preflightError = transitionConfigError(original);
+  const preflightError = transitionConfigError(original, options.threadLimit !== undefined);
   if (preflightError) return { ok: false, error: preflightError };
   const beforeEnabled = isMultiAgentV2Enabled(path);
   // A caller-supplied limit is already in the DESTINATION backend's units and is
@@ -1573,6 +1609,9 @@ export function transitionMultiAgentV2(
       ? v1ChildLimitToV2TotalLimit(discovered.value)
       : v2TotalLimitToV1ChildLimit(discovered.value);
   }
+  if (threadLimit !== null && !Number.isSafeInteger(threadLimit)) {
+    return { ok: false, error: "stored thread limit cannot be written safely; supply an explicit safe integer limit" };
+  }
   const migratedComment = activeThreadComment(original, beforeEnabled);
   try {
     return withConfigWriteRecovery(path, held, () => {
@@ -1606,7 +1645,8 @@ export function transitionMultiAgentV2(
           return editAgentsMaxThreads(threadLimit, tempPath, migratedComment);
         });
         if (!target.ok) throw new Error(target.error);
-        if (getMaxConcurrentThreads(path) !== null || getAgentsMaxThreads(path) !== threadLimit) throw new Error("v1 thread-limit migration postcondition failed");
+        const agents = parsedTomlTable(readConfigText(path) ?? "", "agents");
+        if (getMaxConcurrentThreads(path) !== null || getAgentsMaxThreads(path) !== threadLimit || (agents && Object.hasOwn(agents, LEGACY_AGENTS_THREAD_LIMIT_KEY))) throw new Error("v1 thread-limit migration postcondition failed");
       }
       return { ok: true, changed: readConfigText(path) !== original, threadLimit };
     });

package/src/codex/history-provider.ts

@@ -1831,7 +1831,7 @@ export function countPendingOpencodexHistory(
       : { pendingRows: 0, backupEntries };
   }
   try {
-    const db = new Database(stateDbPath, { readonly: true });
+    const db = openCodexStateForPreflight(stateDbPath);
     try {
       db.exec("PRAGMA busy_timeout = 100");
       // Prove the expected history schema is readable without counting unowned routed rows.

package/src/codex/inject/config-write-section.ts

@@ -1,7 +1,7 @@
 import type { AtomicWriteHooks } from "../../config/atomic-write";
 import { existsSync, readFileSync } from "node:fs";
 import { withConfigMutationLockSync } from "../../config";
-import { ConfigWriteLockRefusal, assertConfigWriteDestination, publishConfigWriteTarget, watchConfigWriteTargets, withConfigWriteLockHeld, type LockHandle } from "../config-write-lock";
+import { ConfigWriteLockRefusal, assertConfigWriteDestination, publishConfigWriteTarget, removeConfigWriteEntry, watchConfigWriteTargets, withConfigWriteLockHeld, type LockHandle } from "../config-write-lock";
 import { CODEX_CONFIG_PATH, CODEX_PROFILE_PATH } from "../paths";
 import { getCodexHome } from "../paths";
 import { codexHomeIsAbsent } from "../codex-home-owner";
@@ -16,6 +16,9 @@ export function publishCodexArtifact<T>(path: string, held: LockHandle | undefin
   if (!held) throw new Error("Codex artifact publication requires a held configuration lock");
   return publishConfigWriteTarget(CODEX_CONFIG_PATH, held, path, run);
 }
+export function removeCodexProfileEntry(held: LockHandle): void {
+  removeConfigWriteEntry(CODEX_CONFIG_PATH, held, CODEX_PROFILE_PATH);
+}
 /** Courtesy cleanup re-reads provider ownership inside the same config section. */
 export function cleanExternalProviderJournal(beforeClientWrite?: () => void): void {
   if (codexHomeIsAbsent(getCodexHome())) return;

package/src/codex/inject/history-failure.ts

@@ -0,0 +1,27 @@
+import { describeHistoryJobFailure, type CodexHistoryJobOutcome } from "../history-job";
+
+/**
+ * Frame one failed apply history job honestly.
+ *
+ * A genuine lock keeps the established deferred/SKIPPED wording; any other
+ * reason names itself instead of blaming the Codex app/IDE.
+ */
+export function formatApplyHistoryFailure(outcome: CodexHistoryJobOutcome, legacyMode: boolean): string {
+  // A busy database is a deferral no matter which half observed it: the lock
+  // contended (blocked/busy), or the worker acquired the lock and then found
+  // SQLite busy (failed with a busy history reason). Only those keep the
+  // deferred headline; every other failure is a real "NOT changed".
+  const busy =
+    (outcome.kind === "blocked" && outcome.reason === "busy") ||
+    (outcome.kind === "failed" && outcome.historyFailureReason === "busy");
+  const partiallyChanged = outcome.kind === "failed"
+    && ((outcome.rows ?? 0) > 0 || (outcome.files ?? 0) > 0);
+  const headline = partiallyChanged
+    ? "Codex resume history changed but did not converge"
+    : legacyMode
+      ? "Codex resume history sync SKIPPED"
+      : busy
+      ? "Codex resume history metadata restore deferred"
+      : "Codex resume history NOT changed";
+  return `  ⚠️ ${headline}: ${describeHistoryJobFailure(outcome, "apply", legacyMode)}\n`;
+}

package/src/codex/inject/remove.ts

@@ -1,8 +1,8 @@
-import { beginCodexWriteSection, publishCodexArtifact } from "./config-write-section";
-import { existsSync, readFileSync, unlinkSync } from "node:fs";
+import { beginCodexWriteSection, publishCodexArtifact, removeCodexProfileEntry } from "./config-write-section";
+import { existsSync, lstatSync, readFileSync } from "node:fs";
 import { normalizeStructuralWhitespace, rootAssignmentKey, rootSourceLines, sourceAssignment, sourceText } from "../toml-source-lines";
 import { atomicWriteFile } from "../../config";
-import { ConfigWriteLockRefusal, configWriteLockFailureMessage, withConfigWriteLockHeld } from "../config-write-lock";
+import { ConfigWriteLockRefusal, configWriteLockFailureMessage, withConfigWriteLockHeld, withConfigWriteRecovery } from "../config-write-lock";
 import type { LockHandle } from "../config-write-lock";
 import {
   REALTIME_WS_BASE_URL_KEY,
@@ -206,15 +206,26 @@ export function removeCodexConfig(
   }
   const locked = withConfigWriteLockHeld(CODEX_CONFIG_PATH, options.heldConfigWriteLock, held => {
   beginCodexWriteSection(held);
+  if (!options.preserveProfile) {
+    try {
+      if (lstatSync(CODEX_PROFILE_PATH).isSymbolicLink()) {
+        return { success: false, message: "Codex profile is a symbolic link; configuration and recovery evidence were preserved." };
+      }
+    } catch (error) {
+      if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+    }
+  }
   if (!existsSync(CODEX_CONFIG_PATH)) {
     if (!options.preserveProfile && existsSync(CODEX_PROFILE_PATH))
-      publishCodexArtifact(CODEX_PROFILE_PATH, held, (path, hooks) => { hooks.validateBeforeRename?.(path); unlinkSync(path); hooks.afterRename?.(path); });
+      removeCodexProfileEntry(held);
     return {
       success: true,
       message: `Codex config not found; no native restore was needed${options.preserveProfile ? "." : ", and the opencodex profile was removed if present."}`,
     };
   }
-  const rawContent = readFileSync(CODEX_CONFIG_PATH, "utf-8");
+  const preimage = readFileSync(CODEX_CONFIG_PATH);
+  return withConfigWriteRecovery(CODEX_CONFIG_PATH, held, () => {
+  const rawContent = preimage.toString("utf-8");
   // Same EOL boundary as inject: strip in LF space, write back in the file's own ending.
   // The unchanged fast path compares in LF space so an untouched file is never rewritten.
   const eol = dominantEol(rawContent);
@@ -248,7 +259,7 @@ export function removeCodexConfig(
     publishCodexArtifact(CODEX_CONFIG_PATH, held, (path, hooks) => atomicWriteFile(path, applyEol(finalContent, eol), undefined, hooks));
   }
   if (!options.preserveProfile && existsSync(CODEX_PROFILE_PATH))
-    publishCodexArtifact(CODEX_PROFILE_PATH, held, (path, hooks) => { hooks.validateBeforeRename?.(path); unlinkSync(path); hooks.afterRename?.(path); });
+    removeCodexProfileEntry(held);
   const retainedNote = retainedBlock === null
     ? ""
     : " Kept [model_providers.opencodex] so conversations already tagged opencodex still open;"
@@ -272,6 +283,7 @@ export function removeCodexConfig(
     message: removedMessage,
     ...(retainedBlock === null ? {} : { retainedProviderTable: retainedBlock.replace(/\n+$/, "").split("\n") }),
   };
+  }, { preimage, requireMatchingPreimage: true });
   });
   if (!locked.ok) return { success: false, retryable: locked.error === "locked", message: configWriteLockFailureMessage(locked) };
   return locked.value;