@bitkyc08/opencodex 2.89.0 → 2.91.0

package/src/cli/link-cleanup.ts

@@ -0,0 +1,95 @@
+/**
+ * `ocx link cleanup`: find Home-initiated Remote Link Children that run Windows and explain how to
+ * move each one to Hub mode. It never revokes or changes anything.
+ *
+ * Windows Children are refused at enrollment, but a link enrolled before that refusal existed keeps
+ * its record, key and reverse tunnel. Its record carries no platform, so this command asks the
+ * Child over the same pinned SSH trust the tunnel uses (`uname -s` through `sh`) and classifies the
+ * answer with `detectRemotePlatform` (a localized cmd or PowerShell refusal gets the fixed %OS% probe).
+ *
+ * The recovery order matters. An ordinary `ocx link revoke` runs `ocx disconnect` on the Child
+ * through the POSIX ocx prelude, which exits 125 on Windows, so for these Children the revoke must
+ * be forced after the Child disconnected itself.
+ */
+import { linkKnownHostsPath, linkStorePath } from "../link/paths";
+import { detectRemotePlatform, REMOTE_UNAME_ARGV, type RemotePlatform } from "../link/remote-platform";
+import { buildExecArgv } from "../link/ssh-argv";
+import { createSshRunner, sshFailureHint, sshRunnerErrorHint, type SshRunner } from "../link/ssh-runner";
+import { readLinkStore, type LinkStore } from "../link/store";
+import { CliUsageError, printData, rejectArgs, takeJsonFlag, takeOption } from "./runtime-api";
+
+const LINK_ID = /^lnk_[0-9a-f]{16}$/;
+const CHECK_TIMEOUT_MS = 30_000;
+
+export interface LinkCleanupDeps {
+  readStore?: () => LinkStore;
+  sshRunner?: SshRunner;
+  knownHostsFile?: string;
+}
+
+export interface LinkCleanupEntry {
+  linkId: string;
+  alias: string;
+  direction: LinkStore["links"][number]["direction"];
+  platform: RemotePlatform | "not_checked";
+  reason: string | null;
+  recovery: string[];
+}
+
+export function windowsChildRecovery(linkId: string, alias: string): string[] {
+  return [
+    `On ${alias}, run 'ocx disconnect' and then 'ocx restart' so it stops using this link.`,
+    `On this Home, run 'ocx link revoke --link-id ${linkId} --force --yes'. A plain revoke cannot disconnect a Windows Child remotely.`,
+    `Then connect ${alias} in Hub mode: run 'ocx hub invite' on a Hub and the printed 'ocx connect' command on ${alias}.`,
+  ];
+}
+
+async function checkPlatform(runner: SshRunner, alias: string, knownHostsFile: string): Promise<{ platform: RemotePlatform; reason: string | null }> {
+  try {
+    const result = await runner.run(buildExecArgv({ alias, argv: REMOTE_UNAME_ARGV, knownHostsFile }), { timeoutMs: CHECK_TIMEOUT_MS });
+    const platform = await detectRemotePlatform(runner, alias, knownHostsFile, result);
+    return { platform, reason: platform === "unknown" ? (sshFailureHint(result.stderr) ?? `ssh exited ${result.code}`) : null };
+  } catch (error) {
+    return { platform: "unknown", reason: sshRunnerErrorHint(error) ?? "ssh could not run" };
+  }
+}
+
+function humanLines(entries: LinkCleanupEntry[]): string[] {
+  if (entries.length === 0) return ["No links are recorded on this Home.", "Nothing was revoked or changed."];
+  const lines: string[] = [];
+  for (const entry of entries) {
+    const label = `${entry.linkId} (${entry.alias})`;
+    if (entry.platform === "windows") {
+      lines.push(`${label}: Windows Child. Remote Link does not support Windows Children; this link predates that refusal.`);
+      for (const [index, step] of entry.recovery.entries()) lines.push(`  ${index + 1}. ${step}`);
+    } else if (entry.platform === "posix") lines.push(`${label}: macOS or Linux Child; nothing to clean up.`);
+    else if (entry.platform === "not_checked") lines.push(`${label}: Child-initiated; this Home has no SSH route to check it.`);
+    else lines.push(`${label}: platform could not be checked (${entry.reason ?? "unknown"}); retry when it is reachable.`);
+  }
+  lines.push("Nothing was revoked or changed.");
+  return lines;
+}
+
+export async function runLinkCleanup(args: string[], deps: LinkCleanupDeps, usage: string): Promise<void> {
+  const wantsJson = takeJsonFlag(args);
+  const linkId = takeOption(args, "--link-id");
+  if (linkId !== undefined && !LINK_ID.test(linkId)) throw new CliUsageError("cleanup --link-id must be a valid link id", usage);
+  rejectArgs(args, usage);
+  const store = (deps.readStore ?? (() => readLinkStore(linkStorePath())))();
+  const records = linkId === undefined ? store.links : store.links.filter(link => link.id === linkId);
+  if (linkId !== undefined && records.length === 0) throw new CliUsageError(`No link ${linkId} is recorded on this Home.`, usage);
+  const runner = deps.sshRunner ?? createSshRunner();
+  const knownHostsFile = deps.knownHostsFile ?? linkKnownHostsPath();
+  const entries: LinkCleanupEntry[] = [];
+  // One at a time: each check is a bounded SSH command, and order keeps the report stable.
+  for (const record of records) {
+    const checked = record.direction === "hub-initiated"
+      ? await checkPlatform(runner, record.alias, knownHostsFile)
+      : { platform: "not_checked" as const, reason: null };
+    entries.push({
+      linkId: record.id, alias: record.alias, direction: record.direction, ...checked,
+      recovery: checked.platform === "windows" ? windowsChildRecovery(record.id, record.alias) : [],
+    });
+  }
+  printData({ links: entries, changed: false }, wantsJson, humanLines(entries));
+}

package/src/cli/link-enrollment.ts

@@ -1,5 +1,6 @@
 import { createInterface } from "node:readline/promises";
 import { assertSshAlias } from "../link/ssh-argv";
+import { windowsChildRefusal } from "../link/remote-platform";
 import { CliUsageError, RuntimeApiError, runtimeBaseUrl, rejectArgs, takeJsonFlag, takeOption, printData } from "./runtime-api";
 import type { LinkCliDeps } from "./link";
 
@@ -83,6 +84,9 @@ export async function runLinkEnrollment(command: "probe" | "add", args: string[]
   catch (error) {
     if (error instanceof RuntimeApiError && record(error.body)) {
       const code = record(error.body.error) ? error.body.error.code : undefined;
+      // Refused at probe or confirm, before any key or tunnel: point at Hub mode, not at a phase.
+      // A residual response comes after key issuance; it keeps its Child recovery below.
+      if (code === "remote_platform_unsupported" && error.body.residual !== true) throw new Error(windowsChildRefusal(alias));
       const phase = typeof code === "string" && Object.hasOwn(PHASES, code) ? PHASES[code] : undefined;
       const message = phase ? "Remote Link failed during " + phase : error.message;
       if (phase || error.body.residual === true) throw new Error(message + (error.body.residual === true ? ". " + RECOVERY : ""));

package/src/cli/link.ts

@@ -2,7 +2,11 @@ import { clientLinkStatusIdentity } from "../client/link-status";
 import { clientLinkTunnelStatus } from "../client/link-tunnel";
 import { loadConfig } from "../config";
 import { projectLinkStatus, type ClientLinkIdentity, type LinkStatusConfig, type LinkStatusDto } from "../link/status-projection";
+import { isEpochMs, type LinkChildParity } from "../link/child-parity";
+import { CODEX_SETTINGS_DIGEST_PATTERN } from "../link/codex-settings";
+import type { LinkLocalPeer, LinkPeerStatus } from "../link/compatibility";
 import { runLinkEnrollment } from "./link-enrollment";
+import { runLinkCleanup, type LinkCleanupDeps } from "./link-cleanup";
 import { assertSshAlias } from "../link/ssh-argv";
 import { linkStorePath } from "../link/paths";
 import { isLinkPort } from "../link/ports";
@@ -31,8 +35,10 @@ export const LINK_USAGE = `Usage:
   ocx link status [--json]
   ocx link revoke --link-id <id> [--force --yes] [--json]
   ocx link reconnect --link-id <id> [--json]
+  ocx link cleanup [--link-id <id>] [--json]
 
-Forced revoke skips remote cleanup. Run ocx disconnect on the remote client.`;
+Forced revoke skips remote cleanup. Run ocx disconnect on the remote client.
+Cleanup finds Windows Children and explains how to move them to Hub mode; it changes nothing.`;
 
 type LinkState = "connecting" | "connected" | "reconnecting" | "failed" | "idle";
 type ListenerState = "off" | "listening" | "failed";
@@ -40,7 +46,7 @@ type ListenerState = "off" | "listening" | "failed";
 export interface LinkStatusPayload {
   role: "standalone" | "home" | "child";
   listener: { state: ListenerState; port: number | null };
-  links: Array<{
+  links: Array<LinkChildParity & {
     id: string;
     alias: string;
     direction: LinkDirection;
@@ -48,6 +54,7 @@ export interface LinkStatusPayload {
     since: string;
     reason: string | null;
     tunnelPort: number;
+    peer?: LinkPeerStatus;
   }>;
   child: null | {
     alias: string;
@@ -55,6 +62,7 @@ export interface LinkStatusPayload {
     since: string;
     reason: string | null;
   };
+  local?: LinkLocalPeer;
 }
 
 export interface LinkIssuePayload {
@@ -64,7 +72,7 @@ export interface LinkIssuePayload {
   listenerPort: number;
 }
 
-export interface LinkCliDeps extends RuntimeApiDeps {
+export interface LinkCliDeps extends RuntimeApiDeps, Omit<LinkCleanupDeps, "readStore"> {
   /** Test seam can shorten, never extend, the whole enrollment deadline. */
   enrollmentTimeoutMs?: number;
   choosePort?: () => Promise<number>;
@@ -85,9 +93,14 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 function assertExactKeys(value: Record<string, unknown>, keys: readonly string[], label: string): void {
-  const expected = new Set(keys);
+  assertKeys(value, keys, [], label);
+}
+
+/** Exact keys plus fields a newer proxy adds; an older proxy omits them. */
+function assertKeys(value: Record<string, unknown>, keys: readonly string[], optional: readonly string[], label: string): void {
+  const allowed = new Set([...keys, ...optional]);
   const actual = Object.keys(value);
-  if (actual.length !== expected.size || actual.some(key => !expected.has(key))) {
+  if (keys.some(key => !(key in value)) || actual.some(key => !allowed.has(key))) {
     throw new Error(`invalid link API response: ${label} fields`);
   }
 }
@@ -104,9 +117,42 @@ function validNullableString(value: unknown): value is string | null {
   return value === null || typeof value === "string";
 }
 
+function validStringList(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every(validString);
+}
+
+function validateLocal(value: unknown): LinkLocalPeer {
+  if (!isRecord(value)) throw new Error("invalid link API response: local");
+  assertExactKeys(value, ["version", "relayAuth", "features"], "local");
+  if (!validString(value.version) || !validString(value.relayAuth) || !validStringList(value.features)) {
+    throw new Error("invalid link API response: local fields");
+  }
+  return { version: value.version, relayAuth: value.relayAuth, features: [...value.features] };
+}
+
+function validatePeer(value: unknown, index: number): LinkPeerStatus {
+  const fail = (): never => { throw new Error(`invalid link API response: link ${index} peer`); };
+  if (!isRecord(value)) return fail();
+  assertExactKeys(value, ["observedAt", "version", "versionRange", "relayAuth", "features", "compatibility", "reasons"], `link ${index} peer`);
+  const range = value.versionRange;
+  if (!validNullableString(value.observedAt) || !validNullableString(value.version) || !validNullableString(value.relayAuth)
+    || (value.features !== null && !validStringList(value.features)) || !validStringList(value.reasons)
+    || !["compatible", "degraded", "incompatible", "unknown"].includes(value.compatibility as string)
+    || (range !== null && (!isRecord(range) || !validNullableString(range.min) || !validString(range.below)))) fail();
+  return {
+    observedAt: value.observedAt as string | null,
+    version: value.version as string | null,
+    versionRange: range === null ? null : { min: (range as Record<string, unknown>).min as string | null, below: (range as Record<string, unknown>).below as string },
+    relayAuth: value.relayAuth as string | null,
+    features: value.features === null ? null : [...value.features as string[]],
+    compatibility: value.compatibility as LinkPeerStatus["compatibility"],
+    reasons: [...value.reasons as string[]],
+  };
+}
+
 function validateStatus(value: unknown): LinkStatusPayload {
   if (!isRecord(value)) throw new Error("invalid link API response: status object");
-  assertExactKeys(value, ["role", "listener", "links", "child"], "status");
+  assertKeys(value, ["role", "listener", "links", "child"], ["local"], "status");
   if (value.role !== "standalone" && value.role !== "home" && value.role !== "child") {
     throw new Error("invalid link API response: status role");
   }
@@ -121,7 +167,10 @@ function validateStatus(value: unknown): LinkStatusPayload {
   if (!Array.isArray(value.links)) throw new Error("invalid link API response: links");
   const links = value.links.map((candidate, index) => {
     if (!isRecord(candidate)) throw new Error(`invalid link API response: link ${index}`);
-    assertExactKeys(candidate, ["id", "alias", "direction", "state", "since", "reason", "tunnelPort"], `link ${index}`);
+    // The OCX-6 parity fields are optional on the wire (an older runtime omits them) and always
+    // present in this output, null when absent.
+    assertKeys(candidate, ["id", "alias", "direction", "state", "since", "reason", "tunnelPort"], [...PARITY_KEYS, "peer"], `link ${index}`);
+    const parity = validateParity(candidate, index);
     if (typeof candidate.id !== "string" || !LINK_ID.test(candidate.id)
       || !validString(candidate.alias) || (candidate.direction !== "hub-initiated" && candidate.direction !== "client-initiated")
       || (candidate.state !== "connecting" && candidate.state !== "connected" && candidate.state !== "reconnecting" && candidate.state !== "failed" && candidate.state !== "idle")
@@ -136,6 +185,8 @@ function validateStatus(value: unknown): LinkStatusPayload {
       since: candidate.since,
       reason: candidate.reason,
       tunnelPort: candidate.tunnelPort,
+      ...parity,
+      ...(candidate.peer !== undefined ? { peer: validatePeer(candidate.peer, index) } : {}),
     } as LinkStatusPayload["links"][number];
   });
   let child: LinkStatusPayload["child"] = null;
@@ -159,6 +210,7 @@ function validateStatus(value: unknown): LinkStatusPayload {
     listener: { state: value.listener.state, port: value.listener.port },
     links,
     child,
+    ...(value.local !== undefined ? { local: validateLocal(value.local) } : {}),
   };
 }
 
@@ -258,7 +310,8 @@ async function runStatus(args: string[], deps: LinkCliDeps): Promise<void> {
     }
     throw error;
   }
-  const result = validateStatus(await linkRequest<unknown>("/api/link/status", {}, { ...deps, baseUrl }));
+  // A proxy older than the compatibility report ignores the query and answers the exact K16 shape.
+  const result = validateStatus(await linkRequest<unknown>("/api/link/status?compatibility=1", {}, { ...deps, baseUrl }));
   console.log(JSON.stringify(result));
 }
 
@@ -326,6 +379,28 @@ export async function runLinkCommand(rawArgs: string[], deps: LinkCliDeps = {}):
     else if (command === "status") await runStatus(args, deps);
     else if (command === "revoke") await runRevoke(args, deps);
     else if (command === "reconnect") await runReconnect(args, deps);
-    else throw new CliUsageError("link requires one of: probe, add, port, issue, status, revoke, reconnect", LINK_USAGE);
+    else if (command === "cleanup") await runLinkCleanup(args, deps, LINK_USAGE);
+    else throw new CliUsageError("link requires one of: probe, add, port, issue, status, revoke, reconnect, cleanup", LINK_USAGE);
   });
 }
+
+const PARITY_KEYS = ["lastApplyAt", "runtimeStartedAt", "appliedCodexSettingsDigest", "reportedAt"] as const;
+
+function validateParity(candidate: Record<string, unknown>, index: number): LinkChildParity {
+  const time = (key: "lastApplyAt" | "runtimeStartedAt" | "reportedAt"): number | null => {
+    const value = candidate[key];
+    if (value === undefined || value === null) return null;
+    if (!isEpochMs(value)) throw new Error(`invalid link API response: link ${index} ${key}`);
+    return value;
+  };
+  const digest = candidate.appliedCodexSettingsDigest;
+  if (digest !== undefined && digest !== null && (typeof digest !== "string" || !CODEX_SETTINGS_DIGEST_PATTERN.test(digest))) {
+    throw new Error(`invalid link API response: link ${index} appliedCodexSettingsDigest`);
+  }
+  return {
+    lastApplyAt: time("lastApplyAt"),
+    runtimeStartedAt: time("runtimeStartedAt"),
+    appliedCodexSettingsDigest: typeof digest === "string" ? digest : null,
+    reportedAt: time("reportedAt"),
+  };
+}

package/src/cli/provider.ts

@@ -28,6 +28,8 @@ import type { RuntimeApiDeps } from "./runtime-api";
 import { redactSecretArgs } from "./secret-args";
 import { projectLocalSyncResult, type LocalSyncResult } from "./local-sync-result";
 import { providerManagementConfigError } from "../server/auth-cors";
+import { readClientConnectionState, type ClientConnectionState } from "../client/state";
+import { SENSITIVE_KEY_PATTERN } from "../lib/redact";
 
 export interface ProviderCommandDeps extends RuntimeApiDeps {
   syncModels?: typeof syncModelsToCodex;
@@ -102,7 +104,46 @@ function validateAndSave(config: ReturnType<typeof loadConfig>): void {
 // provider list
 // ---------------------------------------------------------------------------
 
-function handleList(args: string[]): void {
+/**
+ * Does this device's own provider config serve requests? A device linked to a Home — a Remote
+ * Link Child or a Hub-mode client — routes through the Home, so its local rows are shadowed.
+ * A standalone device and a Hub serve their own rows. An unreadable or inconsistent client
+ * state is not a link, the same reading `readLinkChildContext` takes.
+ */
+export function localProvidersActive(read: () => ClientConnectionState = readClientConnectionState): boolean {
+  try {
+    return read().kind !== "connected";
+  } catch {
+    return true;
+  }
+}
+
+const SENSITIVE_QUERY_KEY = /key|token|secret|password|passwd|signature|^sig$|auth|credential/i;
+
+/**
+ * The baseUrl as `provider list` prints it. Validation already rejects embedded credentials;
+ * this also covers a hand-edited config, dropping userinfo and masking credential-shaped query
+ * values while keeping ordinary parameters such as `api-version`.
+ */
+export function providerListBaseUrl(baseUrl: string): string {
+  let parsed: URL;
+  try { parsed = new URL(baseUrl); } catch { return baseUrl; }
+  let changed = false;
+  if (parsed.username || parsed.password) {
+    parsed.username = "";
+    parsed.password = "";
+    changed = true;
+  }
+  for (const key of [...new Set(parsed.searchParams.keys())]) {
+    if (SENSITIVE_KEY_PATTERN.test(key) || SENSITIVE_QUERY_KEY.test(key)) {
+      parsed.searchParams.set(key, "redacted");
+      changed = true;
+    }
+  }
+  return changed ? parsed.toString() : baseUrl;
+}
+
+function handleList(args: string[], active: boolean = localProvidersActive()): void {
   const wantsJson = consumeFlag(args, "--json");
   const wantsJsonl = consumeFlag(args, "--jsonl");
   rejectUnknownArgs(args, "Usage: ocx provider list [--json|--jsonl]");
@@ -120,12 +161,13 @@ function handleList(args: string[]): void {
     return {
       name,
       adapter: prov.adapter,
-      baseUrl: prov.baseUrl,
+      baseUrl: providerListBaseUrl(prov.baseUrl),
       authMode: prov.authMode ?? "key",
       defaultModel: prov.defaultModel ?? null,
       isDefault: name === config.defaultProvider,
       source: registryEntry ? "registry" : "custom",
       models: prov.models ?? [],
+      active,
     };
   });
 

package/src/cli/registry.ts

@@ -150,7 +150,7 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
   },
   {
     name: "link",
-    usage: "ocx link <port|issue|status|revoke|reconnect>",
+    usage: "ocx link <port|issue|status|revoke|reconnect|cleanup>",
     summary: "Allocate and manage a loopback remote home link.",
     details: [
       "Port: ocx link port [--json]",
@@ -158,6 +158,7 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
       "Status: ocx link status [--json]",
       "Revoke: ocx link revoke --link-id <id> [--force --yes] [--json]",
       "Reconnect: ocx link reconnect --link-id <id> [--json]",
+      "Cleanup: ocx link cleanup [--link-id <id>] [--json]",
       "Issue, status, revoke, and reconnect use the running proxy's loopback management API and admin token.",
     ],
   },
@@ -434,6 +435,17 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
       "Works both online (via live proxy API) and offline (modifies persisted config safely with atomic writes).",
     ],
   },
+  {
+    name: "fallback",
+    usage: "ocx fallback <status|off|on|clear|local> [--kind model|provider|all] [--provider <name> | --route <selector> | --device <id|alias>] [--json]",
+    summary: "Turn model and provider fallback off or on per scope, and record per-device local fallback.",
+    details: [
+      "A refused fallback answers fallback_refused with the status of the failure that triggered it, and names the command that allows it.",
+      "Precedence: a device set to off always refuses; otherwise route, then provider, then global; unset allows.",
+      "Rotation among the accounts or keys of one provider pool is not a fallback and is not governed here.",
+      "Live proxy only. On a Remote Link Child, status reads the Home; writes are refused. Run write commands on the Home.",
+    ],
+  },
   {
     name: "agent",
     usage: "ocx agent <status|injection|effort|subagents|fallback|sidecar> ...",

package/src/cli/restart-failure.ts

@@ -16,6 +16,10 @@ export function reportRestartFailure(result: Extract<ProxyRestartResult, { ok: f
       console.error("The proxy home or lifecycle ownership could not be verified. Run `ocx status`; if a service owns the proxy, use its installation's `ocx service restart`, otherwise use the owning app or supervisor. No changes were made.");
     } else if (code === "restart_package_tree_unsettled") {
       console.error(`The proxy's package files are unsettled. Wait for the install to finish, then run \`ocx restart\`. ${INCOMPLETE_INSTALL_RECOVERY}`);
+    } else if (code === "restart_supervised_service") {
+      console.error("Restart not performed; the running client runtime was kept. Its background service owns it: run `ocx service restart`.");
+    } else if (code === "restart_supervised_desktop") {
+      console.error("Restart not performed; the running client runtime was kept. The OpenCodex desktop app owns it: restart it from the app.");
     } else {
       console.error("Proxy restart request could not be confirmed; no fallback stop/start was attempted. Run `ocx status` to inspect ownership and runtime state.");
     }

package/src/cli/runtime-api.ts

@@ -202,7 +202,7 @@ export async function runtimeRequest<T = unknown>(
     if (!linkChildReadable(method, path)) {
       throw new RuntimeApiError(linkChildRefusal(link, `${method} ${pathname}`), 503, null, "link_child_management_unavailable");
     }
-    const { status, body } = await readLinkHomeJson(link, path, deps.linkHome);
+    const { status, body } = await readLinkHomeJson(link, path, deps.linkHome, init.signal ? { signal: init.signal } : {});
     if (status < 200 || status >= 300) throw new RuntimeApiError(responseMessage(body, status), status, body);
     return body as T;
   }

package/src/cli/status-codex-settings.ts

@@ -0,0 +1,56 @@
+/**
+ * The OCX-6 fields of `ocx status --json`: which Codex settings this machine applied, when, and
+ * when its client runtime started.
+ *
+ * - `appliedCodexSettingsDigest` (any device): the digest of the values this machine applies. On a
+ *   Remote Link Child that is its apply record (the Home's values its last sync wrote); on a Home or
+ *   standalone install, its own projection, which is also exactly what it serves its Children. Null
+ *   on a hub client and on a Child that has no apply record yet.
+ * - `lastApplyAt` (Child): epoch ms of the last successful apply of a different Home settings
+ *   document; null elsewhere.
+ * - `runtimeStartedAt` (Child): epoch ms the live client runtime reports as its start; null when no
+ *   client runtime answers.
+ */
+import type { LiveProxy } from "../server/proxy-liveness";
+import type { OcxConfig } from "../types";
+
+export interface CliAppliedCodexSettingsStatus {
+  appliedCodexSettingsDigest: string | null;
+  lastApplyAt: number | null;
+  runtimeStartedAt: number | null;
+}
+
+export interface AppliedCodexSettingsStatusDeps {
+  readStartedAt?: (live: LiveProxy) => Promise<number | null>;
+}
+
+export async function collectAppliedCodexSettingsStatus(
+  config: OcxConfig,
+  live: LiveProxy | null,
+  deps: AppliedCodexSettingsStatusDeps = {},
+): Promise<CliAppliedCodexSettingsStatus> {
+  const { codexSettingsDigest, projectHomeCodexSettings } = await import("../link/codex-settings");
+  if (config.runtimeRole !== "client") {
+    return {
+      appliedCodexSettingsDigest: codexSettingsDigest(projectHomeCodexSettings(config, "0.0.0").settings),
+      lastApplyAt: null,
+      runtimeStartedAt: null,
+    };
+  }
+  const linkId = config.client?.transport === "link" ? config.client.link?.linkId : undefined;
+  if (!linkId) return { appliedCodexSettingsDigest: null, lastApplyAt: null, runtimeStartedAt: null };
+  const { readHomeCodexSettingsRecord } = await import("../client/link-home");
+  const record = readHomeCodexSettingsRecord(linkId);
+  const appliedAt = record ? Date.parse(record.appliedAt) : Number.NaN;
+  let runtimeStartedAt: number | null = null;
+  if (live?.role === "client") {
+    const read = deps.readStartedAt ?? (async (target: LiveProxy) =>
+      (await import("./link-apply-restart")).readClientRuntimeStartedAt(target));
+    runtimeStartedAt = await read(live);
+  }
+  return {
+    appliedCodexSettingsDigest: record ? codexSettingsDigest(record.document.settings) : null,
+    lastApplyAt: Number.isFinite(appliedAt) ? appliedAt : null,
+    runtimeStartedAt,
+  };
+}

package/src/cli/status-fallback.ts

@@ -0,0 +1,29 @@
+/**
+ * `ocx status --json` `fallback` (OCX-11). The live proxy's `GET /api/fallback` when it answers
+ * (on a Remote Link Child that read is the Home's, over the link); otherwise the policy from this
+ * machine's config with no events, marked `source: "local"`. Never fails the status report.
+ */
+import type { OcxConfig } from "../types";
+import { buildFallbackState, type FallbackStateView } from "../routing/fallback-state";
+import { runtimeRequest, type RuntimeApiDeps } from "./runtime-api";
+
+export type StatusFallback = (FallbackStateView | ReturnType<typeof buildFallbackState>) & { source: "live" | "home" | "local" };
+
+const STATUS_FALLBACK_TIMEOUT_MS = 2_000;
+
+export async function collectStatusFallback(
+  config: Pick<OcxConfig, "fallback">,
+  options: { live: boolean; linkChild: boolean; deps?: RuntimeApiDeps },
+): Promise<StatusFallback> {
+  if (options.live) {
+    try {
+      const state = await runtimeRequest<FallbackStateView>("/api/fallback", {
+        signal: AbortSignal.timeout(STATUS_FALLBACK_TIMEOUT_MS),
+      }, options.deps ?? {});
+      if (state && typeof state === "object" && state.schema === "ocx.fallback/1") {
+        return { ...state, source: options.linkChild ? "home" : "live" };
+      }
+    } catch { /* an older or unreachable proxy: report the local policy instead */ }
+  }
+  return { ...buildFallbackState(options.linkChild ? {} : config), source: "local" };
+}

package/src/cli/status-install.ts

@@ -0,0 +1,52 @@
+import { detectInstallOwnership, type InstallOwnership } from "../update";
+
+/** How this ocx is installed, from the updater's own ownership detector. */
+export type InstallMethod = "bun" | "npm" | "pnpm" | "mise" | "source" | "standalone" | "unknown";
+
+/**
+ * `ocx status --json` `install`. Additive within `schemaVersion: 1`.
+ *
+ * The verdict is the one `ocx update` acts on (`src/update/install-detection.mjs`), read
+ * from the running package's own location — PATH is never consulted, because a machine can
+ * carry several package managers at once. `evidence` names what decided it without adding
+ * a path: the package layout, mise's backend record (tool alias and backend only), the
+ * compiled standalone binary, or nothing when detection itself failed.
+ */
+export type InstallDetectionStatus = {
+  method: InstallMethod;
+  evidence: {
+    basis: "package-layout" | "mise-backend-record" | "standalone-binary" | "unavailable";
+    mise?: { tool: string; backend: string };
+    error?: "metadata_unreadable" | "metadata_inconsistent" | "detection_failed";
+  };
+};
+
+export function installDetectionStatus(
+  detect: () => InstallOwnership = detectInstallOwnership,
+): InstallDetectionStatus {
+  let ownership: InstallOwnership;
+  try {
+    ownership = detect();
+  } catch {
+    return { method: "unknown", evidence: { basis: "unavailable", error: "detection_failed" } };
+  }
+  switch (ownership.installer) {
+    case "standalone":
+      return { method: "standalone", evidence: { basis: "standalone-binary" } };
+    case "mise":
+      if (ownership.owner) {
+        return {
+          method: "mise",
+          evidence: { basis: "mise-backend-record", mise: { tool: ownership.owner.tool, backend: ownership.owner.backend } },
+        };
+      }
+      return { method: "mise", evidence: { basis: "mise-backend-record", error: ownership.error ?? "metadata_unreadable" } };
+    case "bun":
+    case "npm":
+    case "pnpm":
+    case "source":
+      return { method: ownership.installer, evidence: { basis: "package-layout" } };
+    default:
+      return { method: "unknown", evidence: { basis: "unavailable", error: "detection_failed" } };
+  }
+}

package/src/cli/status.ts

@@ -36,6 +36,8 @@ export type { ListenTarget } from "./status-probes";
 import { checkProxyHealth, probeUncleanExitState, type ListenTarget } from "./status-probes";
 import { LOCAL_MANAGEMENT_READ_PATHS } from "../lib/local-management-capability";
 import { fetchBoundLocalManagementRead } from "../server/local-management-read-client";
+import { collectAppliedCodexSettingsStatus, type CliAppliedCodexSettingsStatus } from "./status-codex-settings";
+import { installDetectionStatus, type InstallDetectionStatus } from "./status-install";
 
 /**
  * The state of the data-plane admission secret the SERVICE will use. State only -- never the value.
@@ -118,6 +120,8 @@ export type CliRemoteHubStatus = {
 
 export type CliStatusJson = {
   mainAccountHardLock?: CodexMainAccountPolicyHealth;
+  /** OCX-11 fallback state; see src/cli/status-fallback.ts. */
+  fallback?: import("./status-fallback").StatusFallback;
   schemaVersion: 1;
   /**
    * This machine's topology role, named rather than inferred (#4236).
@@ -229,8 +233,10 @@ export type CliStatusJson = {
    */
   versionSkew: VersionSkew;
   cliCommand: CliPathDiagnostics;
+  /** Installer ownership from the updater's detector (OCX-10); additive, `schemaVersion` stays 1. */
+  install: InstallDetectionStatus;
   startupSource: "live" | "local" | "local-supervision-override";
-};
+} & CliAppliedCodexSettingsStatus;
 
 export type CliStatusView = {
   json: CliStatusJson;
@@ -853,12 +859,22 @@ export async function collectStatus(options: { mainAccountPolicy?: boolean } = {
   const mainAccountHardLock = options.mainAccountPolicy && live
     ? (await (await import("../oauth/health")).fetchCodexHealthFromLiveProxy(undefined, async () => live)).mainAccountHardLock
     : undefined;
+  // Same `--json`-only gate as the hard-lock read above: the human report stays one probe.
+  const fallback = options.mainAccountPolicy
+    ? await (await import("./status-fallback")).collectStatusFallback(config, {
+      live: Boolean(live), linkChild: config.client?.transport === "link",
+      deps: { findLiveProxy: async () => live },
+    })
+    : undefined;
   const pidFile = readPid();
   // Preserve an authoritative null from orphan/legacy liveness — do not restore pidFile.
   const pid = resolveStatusPid(live, pidFile);
   // No extra request: findLiveProxy's identity probe already parsed and validated the
   // healthz body, so the version came back with the liveness result.
   const versionSkew = computeVersionSkew(packageVersion(), live?.version);
+  // OCX-6: what this machine applied and, on a Child, when its runtime started. Additive and
+  // always present (null when unknown), so `schemaVersion` stays 1.
+  const appliedCodexSettings = await collectAppliedCodexSettingsStatus(config, live);
   const listen = live
     ? {
       port: live.port,
@@ -1005,6 +1021,7 @@ export async function collectStatus(options: { mainAccountPolicy?: boolean } = {
     healthLabel: formatCliStatusHealthLabel(health.label, cliCommand, remoteHub.connected),
     json: {
       ...(mainAccountHardLock ? { mainAccountHardLock } : {}),
+      ...(fallback ? { fallback } : {}),
       schemaVersion: 1,
       runtimeRole: config.runtimeRole ?? "standalone",
       proxy: {
@@ -1067,7 +1084,9 @@ export async function collectStatus(options: { mainAccountPolicy?: boolean } = {
       // print it under the wrong heading (#2701).
       versionSkew,
       cliCommand,
+      install: installDetectionStatus(),
       startupSource,
+      ...appliedCodexSettings,
     },
   };
 }