@bitkyc08/opencodex 2.90.0 → 2.91.0

package/src/cli/link.ts

@@ -2,7 +2,11 @@ import { clientLinkStatusIdentity } from "../client/link-status";
 import { clientLinkTunnelStatus } from "../client/link-tunnel";
 import { loadConfig } from "../config";
 import { projectLinkStatus, type ClientLinkIdentity, type LinkStatusConfig, type LinkStatusDto } from "../link/status-projection";
+import { isEpochMs, type LinkChildParity } from "../link/child-parity";
+import { CODEX_SETTINGS_DIGEST_PATTERN } from "../link/codex-settings";
+import type { LinkLocalPeer, LinkPeerStatus } from "../link/compatibility";
 import { runLinkEnrollment } from "./link-enrollment";
+import { runLinkCleanup, type LinkCleanupDeps } from "./link-cleanup";
 import { assertSshAlias } from "../link/ssh-argv";
 import { linkStorePath } from "../link/paths";
 import { isLinkPort } from "../link/ports";
@@ -31,8 +35,10 @@ export const LINK_USAGE = `Usage:
   ocx link status [--json]
   ocx link revoke --link-id <id> [--force --yes] [--json]
   ocx link reconnect --link-id <id> [--json]
+  ocx link cleanup [--link-id <id>] [--json]
 
-Forced revoke skips remote cleanup. Run ocx disconnect on the remote client.`;
+Forced revoke skips remote cleanup. Run ocx disconnect on the remote client.
+Cleanup finds Windows Children and explains how to move them to Hub mode; it changes nothing.`;
 
 type LinkState = "connecting" | "connected" | "reconnecting" | "failed" | "idle";
 type ListenerState = "off" | "listening" | "failed";
@@ -40,7 +46,7 @@ type ListenerState = "off" | "listening" | "failed";
 export interface LinkStatusPayload {
   role: "standalone" | "home" | "child";
   listener: { state: ListenerState; port: number | null };
-  links: Array<{
+  links: Array<LinkChildParity & {
     id: string;
     alias: string;
     direction: LinkDirection;
@@ -48,6 +54,7 @@ export interface LinkStatusPayload {
     since: string;
     reason: string | null;
     tunnelPort: number;
+    peer?: LinkPeerStatus;
   }>;
   child: null | {
     alias: string;
@@ -55,6 +62,7 @@ export interface LinkStatusPayload {
     since: string;
     reason: string | null;
   };
+  local?: LinkLocalPeer;
 }
 
 export interface LinkIssuePayload {
@@ -64,7 +72,7 @@ export interface LinkIssuePayload {
   listenerPort: number;
 }
 
-export interface LinkCliDeps extends RuntimeApiDeps {
+export interface LinkCliDeps extends RuntimeApiDeps, Omit<LinkCleanupDeps, "readStore"> {
   /** Test seam can shorten, never extend, the whole enrollment deadline. */
   enrollmentTimeoutMs?: number;
   choosePort?: () => Promise<number>;
@@ -85,9 +93,14 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 function assertExactKeys(value: Record<string, unknown>, keys: readonly string[], label: string): void {
-  const expected = new Set(keys);
+  assertKeys(value, keys, [], label);
+}
+
+/** Exact keys plus fields a newer proxy adds; an older proxy omits them. */
+function assertKeys(value: Record<string, unknown>, keys: readonly string[], optional: readonly string[], label: string): void {
+  const allowed = new Set([...keys, ...optional]);
   const actual = Object.keys(value);
-  if (actual.length !== expected.size || actual.some(key => !expected.has(key))) {
+  if (keys.some(key => !(key in value)) || actual.some(key => !allowed.has(key))) {
     throw new Error(`invalid link API response: ${label} fields`);
   }
 }
@@ -104,9 +117,42 @@ function validNullableString(value: unknown): value is string | null {
   return value === null || typeof value === "string";
 }
 
+function validStringList(value: unknown): value is string[] {
+  return Array.isArray(value) && value.every(validString);
+}
+
+function validateLocal(value: unknown): LinkLocalPeer {
+  if (!isRecord(value)) throw new Error("invalid link API response: local");
+  assertExactKeys(value, ["version", "relayAuth", "features"], "local");
+  if (!validString(value.version) || !validString(value.relayAuth) || !validStringList(value.features)) {
+    throw new Error("invalid link API response: local fields");
+  }
+  return { version: value.version, relayAuth: value.relayAuth, features: [...value.features] };
+}
+
+function validatePeer(value: unknown, index: number): LinkPeerStatus {
+  const fail = (): never => { throw new Error(`invalid link API response: link ${index} peer`); };
+  if (!isRecord(value)) return fail();
+  assertExactKeys(value, ["observedAt", "version", "versionRange", "relayAuth", "features", "compatibility", "reasons"], `link ${index} peer`);
+  const range = value.versionRange;
+  if (!validNullableString(value.observedAt) || !validNullableString(value.version) || !validNullableString(value.relayAuth)
+    || (value.features !== null && !validStringList(value.features)) || !validStringList(value.reasons)
+    || !["compatible", "degraded", "incompatible", "unknown"].includes(value.compatibility as string)
+    || (range !== null && (!isRecord(range) || !validNullableString(range.min) || !validString(range.below)))) fail();
+  return {
+    observedAt: value.observedAt as string | null,
+    version: value.version as string | null,
+    versionRange: range === null ? null : { min: (range as Record<string, unknown>).min as string | null, below: (range as Record<string, unknown>).below as string },
+    relayAuth: value.relayAuth as string | null,
+    features: value.features === null ? null : [...value.features as string[]],
+    compatibility: value.compatibility as LinkPeerStatus["compatibility"],
+    reasons: [...value.reasons as string[]],
+  };
+}
+
 function validateStatus(value: unknown): LinkStatusPayload {
   if (!isRecord(value)) throw new Error("invalid link API response: status object");
-  assertExactKeys(value, ["role", "listener", "links", "child"], "status");
+  assertKeys(value, ["role", "listener", "links", "child"], ["local"], "status");
   if (value.role !== "standalone" && value.role !== "home" && value.role !== "child") {
     throw new Error("invalid link API response: status role");
   }
@@ -121,7 +167,10 @@ function validateStatus(value: unknown): LinkStatusPayload {
   if (!Array.isArray(value.links)) throw new Error("invalid link API response: links");
   const links = value.links.map((candidate, index) => {
     if (!isRecord(candidate)) throw new Error(`invalid link API response: link ${index}`);
-    assertExactKeys(candidate, ["id", "alias", "direction", "state", "since", "reason", "tunnelPort"], `link ${index}`);
+    // The OCX-6 parity fields are optional on the wire (an older runtime omits them) and always
+    // present in this output, null when absent.
+    assertKeys(candidate, ["id", "alias", "direction", "state", "since", "reason", "tunnelPort"], [...PARITY_KEYS, "peer"], `link ${index}`);
+    const parity = validateParity(candidate, index);
     if (typeof candidate.id !== "string" || !LINK_ID.test(candidate.id)
       || !validString(candidate.alias) || (candidate.direction !== "hub-initiated" && candidate.direction !== "client-initiated")
       || (candidate.state !== "connecting" && candidate.state !== "connected" && candidate.state !== "reconnecting" && candidate.state !== "failed" && candidate.state !== "idle")
@@ -136,6 +185,8 @@ function validateStatus(value: unknown): LinkStatusPayload {
       since: candidate.since,
       reason: candidate.reason,
       tunnelPort: candidate.tunnelPort,
+      ...parity,
+      ...(candidate.peer !== undefined ? { peer: validatePeer(candidate.peer, index) } : {}),
     } as LinkStatusPayload["links"][number];
   });
   let child: LinkStatusPayload["child"] = null;
@@ -159,6 +210,7 @@ function validateStatus(value: unknown): LinkStatusPayload {
     listener: { state: value.listener.state, port: value.listener.port },
     links,
     child,
+    ...(value.local !== undefined ? { local: validateLocal(value.local) } : {}),
   };
 }
 
@@ -258,7 +310,8 @@ async function runStatus(args: string[], deps: LinkCliDeps): Promise<void> {
     }
     throw error;
   }
-  const result = validateStatus(await linkRequest<unknown>("/api/link/status", {}, { ...deps, baseUrl }));
+  // A proxy older than the compatibility report ignores the query and answers the exact K16 shape.
+  const result = validateStatus(await linkRequest<unknown>("/api/link/status?compatibility=1", {}, { ...deps, baseUrl }));
   console.log(JSON.stringify(result));
 }
 
@@ -326,6 +379,28 @@ export async function runLinkCommand(rawArgs: string[], deps: LinkCliDeps = {}):
     else if (command === "status") await runStatus(args, deps);
     else if (command === "revoke") await runRevoke(args, deps);
     else if (command === "reconnect") await runReconnect(args, deps);
-    else throw new CliUsageError("link requires one of: probe, add, port, issue, status, revoke, reconnect", LINK_USAGE);
+    else if (command === "cleanup") await runLinkCleanup(args, deps, LINK_USAGE);
+    else throw new CliUsageError("link requires one of: probe, add, port, issue, status, revoke, reconnect, cleanup", LINK_USAGE);
   });
 }
+
+const PARITY_KEYS = ["lastApplyAt", "runtimeStartedAt", "appliedCodexSettingsDigest", "reportedAt"] as const;
+
+function validateParity(candidate: Record<string, unknown>, index: number): LinkChildParity {
+  const time = (key: "lastApplyAt" | "runtimeStartedAt" | "reportedAt"): number | null => {
+    const value = candidate[key];
+    if (value === undefined || value === null) return null;
+    if (!isEpochMs(value)) throw new Error(`invalid link API response: link ${index} ${key}`);
+    return value;
+  };
+  const digest = candidate.appliedCodexSettingsDigest;
+  if (digest !== undefined && digest !== null && (typeof digest !== "string" || !CODEX_SETTINGS_DIGEST_PATTERN.test(digest))) {
+    throw new Error(`invalid link API response: link ${index} appliedCodexSettingsDigest`);
+  }
+  return {
+    lastApplyAt: time("lastApplyAt"),
+    runtimeStartedAt: time("runtimeStartedAt"),
+    appliedCodexSettingsDigest: typeof digest === "string" ? digest : null,
+    reportedAt: time("reportedAt"),
+  };
+}

package/src/cli/provider.ts

@@ -28,6 +28,8 @@ import type { RuntimeApiDeps } from "./runtime-api";
 import { redactSecretArgs } from "./secret-args";
 import { projectLocalSyncResult, type LocalSyncResult } from "./local-sync-result";
 import { providerManagementConfigError } from "../server/auth-cors";
+import { readClientConnectionState, type ClientConnectionState } from "../client/state";
+import { SENSITIVE_KEY_PATTERN } from "../lib/redact";
 
 export interface ProviderCommandDeps extends RuntimeApiDeps {
   syncModels?: typeof syncModelsToCodex;
@@ -102,7 +104,46 @@ function validateAndSave(config: ReturnType<typeof loadConfig>): void {
 // provider list
 // ---------------------------------------------------------------------------
 
-function handleList(args: string[]): void {
+/**
+ * Does this device's own provider config serve requests? A device linked to a Home — a Remote
+ * Link Child or a Hub-mode client — routes through the Home, so its local rows are shadowed.
+ * A standalone device and a Hub serve their own rows. An unreadable or inconsistent client
+ * state is not a link, the same reading `readLinkChildContext` takes.
+ */
+export function localProvidersActive(read: () => ClientConnectionState = readClientConnectionState): boolean {
+  try {
+    return read().kind !== "connected";
+  } catch {
+    return true;
+  }
+}
+
+const SENSITIVE_QUERY_KEY = /key|token|secret|password|passwd|signature|^sig$|auth|credential/i;
+
+/**
+ * The baseUrl as `provider list` prints it. Validation already rejects embedded credentials;
+ * this also covers a hand-edited config, dropping userinfo and masking credential-shaped query
+ * values while keeping ordinary parameters such as `api-version`.
+ */
+export function providerListBaseUrl(baseUrl: string): string {
+  let parsed: URL;
+  try { parsed = new URL(baseUrl); } catch { return baseUrl; }
+  let changed = false;
+  if (parsed.username || parsed.password) {
+    parsed.username = "";
+    parsed.password = "";
+    changed = true;
+  }
+  for (const key of [...new Set(parsed.searchParams.keys())]) {
+    if (SENSITIVE_KEY_PATTERN.test(key) || SENSITIVE_QUERY_KEY.test(key)) {
+      parsed.searchParams.set(key, "redacted");
+      changed = true;
+    }
+  }
+  return changed ? parsed.toString() : baseUrl;
+}
+
+function handleList(args: string[], active: boolean = localProvidersActive()): void {
   const wantsJson = consumeFlag(args, "--json");
   const wantsJsonl = consumeFlag(args, "--jsonl");
   rejectUnknownArgs(args, "Usage: ocx provider list [--json|--jsonl]");
@@ -120,12 +161,13 @@ function handleList(args: string[]): void {
     return {
       name,
       adapter: prov.adapter,
-      baseUrl: prov.baseUrl,
+      baseUrl: providerListBaseUrl(prov.baseUrl),
       authMode: prov.authMode ?? "key",
       defaultModel: prov.defaultModel ?? null,
       isDefault: name === config.defaultProvider,
       source: registryEntry ? "registry" : "custom",
       models: prov.models ?? [],
+      active,
     };
   });
 

package/src/cli/registry.ts

@@ -150,7 +150,7 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
   },
   {
     name: "link",
-    usage: "ocx link <port|issue|status|revoke|reconnect>",
+    usage: "ocx link <port|issue|status|revoke|reconnect|cleanup>",
     summary: "Allocate and manage a loopback remote home link.",
     details: [
       "Port: ocx link port [--json]",
@@ -158,6 +158,7 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
       "Status: ocx link status [--json]",
       "Revoke: ocx link revoke --link-id <id> [--force --yes] [--json]",
       "Reconnect: ocx link reconnect --link-id <id> [--json]",
+      "Cleanup: ocx link cleanup [--link-id <id>] [--json]",
       "Issue, status, revoke, and reconnect use the running proxy's loopback management API and admin token.",
     ],
   },
@@ -434,6 +435,17 @@ export const CLI_COMMANDS: CliCommandEntry[] = [
       "Works both online (via live proxy API) and offline (modifies persisted config safely with atomic writes).",
     ],
   },
+  {
+    name: "fallback",
+    usage: "ocx fallback <status|off|on|clear|local> [--kind model|provider|all] [--provider <name> | --route <selector> | --device <id|alias>] [--json]",
+    summary: "Turn model and provider fallback off or on per scope, and record per-device local fallback.",
+    details: [
+      "A refused fallback answers fallback_refused with the status of the failure that triggered it, and names the command that allows it.",
+      "Precedence: a device set to off always refuses; otherwise route, then provider, then global; unset allows.",
+      "Rotation among the accounts or keys of one provider pool is not a fallback and is not governed here.",
+      "Live proxy only. On a Remote Link Child, status reads the Home; writes are refused. Run write commands on the Home.",
+    ],
+  },
   {
     name: "agent",
     usage: "ocx agent <status|injection|effort|subagents|fallback|sidecar> ...",

package/src/cli/restart-failure.ts

@@ -16,6 +16,10 @@ export function reportRestartFailure(result: Extract<ProxyRestartResult, { ok: f
       console.error("The proxy home or lifecycle ownership could not be verified. Run `ocx status`; if a service owns the proxy, use its installation's `ocx service restart`, otherwise use the owning app or supervisor. No changes were made.");
     } else if (code === "restart_package_tree_unsettled") {
       console.error(`The proxy's package files are unsettled. Wait for the install to finish, then run \`ocx restart\`. ${INCOMPLETE_INSTALL_RECOVERY}`);
+    } else if (code === "restart_supervised_service") {
+      console.error("Restart not performed; the running client runtime was kept. Its background service owns it: run `ocx service restart`.");
+    } else if (code === "restart_supervised_desktop") {
+      console.error("Restart not performed; the running client runtime was kept. The OpenCodex desktop app owns it: restart it from the app.");
     } else {
       console.error("Proxy restart request could not be confirmed; no fallback stop/start was attempted. Run `ocx status` to inspect ownership and runtime state.");
     }

package/src/cli/runtime-api.ts

@@ -202,7 +202,7 @@ export async function runtimeRequest<T = unknown>(
     if (!linkChildReadable(method, path)) {
       throw new RuntimeApiError(linkChildRefusal(link, `${method} ${pathname}`), 503, null, "link_child_management_unavailable");
     }
-    const { status, body } = await readLinkHomeJson(link, path, deps.linkHome);
+    const { status, body } = await readLinkHomeJson(link, path, deps.linkHome, init.signal ? { signal: init.signal } : {});
     if (status < 200 || status >= 300) throw new RuntimeApiError(responseMessage(body, status), status, body);
     return body as T;
   }

package/src/cli/status-codex-settings.ts

@@ -0,0 +1,56 @@
+/**
+ * The OCX-6 fields of `ocx status --json`: which Codex settings this machine applied, when, and
+ * when its client runtime started.
+ *
+ * - `appliedCodexSettingsDigest` (any device): the digest of the values this machine applies. On a
+ *   Remote Link Child that is its apply record (the Home's values its last sync wrote); on a Home or
+ *   standalone install, its own projection, which is also exactly what it serves its Children. Null
+ *   on a hub client and on a Child that has no apply record yet.
+ * - `lastApplyAt` (Child): epoch ms of the last successful apply of a different Home settings
+ *   document; null elsewhere.
+ * - `runtimeStartedAt` (Child): epoch ms the live client runtime reports as its start; null when no
+ *   client runtime answers.
+ */
+import type { LiveProxy } from "../server/proxy-liveness";
+import type { OcxConfig } from "../types";
+
+export interface CliAppliedCodexSettingsStatus {
+  appliedCodexSettingsDigest: string | null;
+  lastApplyAt: number | null;
+  runtimeStartedAt: number | null;
+}
+
+export interface AppliedCodexSettingsStatusDeps {
+  readStartedAt?: (live: LiveProxy) => Promise<number | null>;
+}
+
+export async function collectAppliedCodexSettingsStatus(
+  config: OcxConfig,
+  live: LiveProxy | null,
+  deps: AppliedCodexSettingsStatusDeps = {},
+): Promise<CliAppliedCodexSettingsStatus> {
+  const { codexSettingsDigest, projectHomeCodexSettings } = await import("../link/codex-settings");
+  if (config.runtimeRole !== "client") {
+    return {
+      appliedCodexSettingsDigest: codexSettingsDigest(projectHomeCodexSettings(config, "0.0.0").settings),
+      lastApplyAt: null,
+      runtimeStartedAt: null,
+    };
+  }
+  const linkId = config.client?.transport === "link" ? config.client.link?.linkId : undefined;
+  if (!linkId) return { appliedCodexSettingsDigest: null, lastApplyAt: null, runtimeStartedAt: null };
+  const { readHomeCodexSettingsRecord } = await import("../client/link-home");
+  const record = readHomeCodexSettingsRecord(linkId);
+  const appliedAt = record ? Date.parse(record.appliedAt) : Number.NaN;
+  let runtimeStartedAt: number | null = null;
+  if (live?.role === "client") {
+    const read = deps.readStartedAt ?? (async (target: LiveProxy) =>
+      (await import("./link-apply-restart")).readClientRuntimeStartedAt(target));
+    runtimeStartedAt = await read(live);
+  }
+  return {
+    appliedCodexSettingsDigest: record ? codexSettingsDigest(record.document.settings) : null,
+    lastApplyAt: Number.isFinite(appliedAt) ? appliedAt : null,
+    runtimeStartedAt,
+  };
+}

package/src/cli/status-fallback.ts

@@ -0,0 +1,29 @@
+/**
+ * `ocx status --json` `fallback` (OCX-11). The live proxy's `GET /api/fallback` when it answers
+ * (on a Remote Link Child that read is the Home's, over the link); otherwise the policy from this
+ * machine's config with no events, marked `source: "local"`. Never fails the status report.
+ */
+import type { OcxConfig } from "../types";
+import { buildFallbackState, type FallbackStateView } from "../routing/fallback-state";
+import { runtimeRequest, type RuntimeApiDeps } from "./runtime-api";
+
+export type StatusFallback = (FallbackStateView | ReturnType<typeof buildFallbackState>) & { source: "live" | "home" | "local" };
+
+const STATUS_FALLBACK_TIMEOUT_MS = 2_000;
+
+export async function collectStatusFallback(
+  config: Pick<OcxConfig, "fallback">,
+  options: { live: boolean; linkChild: boolean; deps?: RuntimeApiDeps },
+): Promise<StatusFallback> {
+  if (options.live) {
+    try {
+      const state = await runtimeRequest<FallbackStateView>("/api/fallback", {
+        signal: AbortSignal.timeout(STATUS_FALLBACK_TIMEOUT_MS),
+      }, options.deps ?? {});
+      if (state && typeof state === "object" && state.schema === "ocx.fallback/1") {
+        return { ...state, source: options.linkChild ? "home" : "live" };
+      }
+    } catch { /* an older or unreachable proxy: report the local policy instead */ }
+  }
+  return { ...buildFallbackState(options.linkChild ? {} : config), source: "local" };
+}

package/src/cli/status-install.ts

@@ -0,0 +1,52 @@
+import { detectInstallOwnership, type InstallOwnership } from "../update";
+
+/** How this ocx is installed, from the updater's own ownership detector. */
+export type InstallMethod = "bun" | "npm" | "pnpm" | "mise" | "source" | "standalone" | "unknown";
+
+/**
+ * `ocx status --json` `install`. Additive within `schemaVersion: 1`.
+ *
+ * The verdict is the one `ocx update` acts on (`src/update/install-detection.mjs`), read
+ * from the running package's own location — PATH is never consulted, because a machine can
+ * carry several package managers at once. `evidence` names what decided it without adding
+ * a path: the package layout, mise's backend record (tool alias and backend only), the
+ * compiled standalone binary, or nothing when detection itself failed.
+ */
+export type InstallDetectionStatus = {
+  method: InstallMethod;
+  evidence: {
+    basis: "package-layout" | "mise-backend-record" | "standalone-binary" | "unavailable";
+    mise?: { tool: string; backend: string };
+    error?: "metadata_unreadable" | "metadata_inconsistent" | "detection_failed";
+  };
+};
+
+export function installDetectionStatus(
+  detect: () => InstallOwnership = detectInstallOwnership,
+): InstallDetectionStatus {
+  let ownership: InstallOwnership;
+  try {
+    ownership = detect();
+  } catch {
+    return { method: "unknown", evidence: { basis: "unavailable", error: "detection_failed" } };
+  }
+  switch (ownership.installer) {
+    case "standalone":
+      return { method: "standalone", evidence: { basis: "standalone-binary" } };
+    case "mise":
+      if (ownership.owner) {
+        return {
+          method: "mise",
+          evidence: { basis: "mise-backend-record", mise: { tool: ownership.owner.tool, backend: ownership.owner.backend } },
+        };
+      }
+      return { method: "mise", evidence: { basis: "mise-backend-record", error: ownership.error ?? "metadata_unreadable" } };
+    case "bun":
+    case "npm":
+    case "pnpm":
+    case "source":
+      return { method: ownership.installer, evidence: { basis: "package-layout" } };
+    default:
+      return { method: "unknown", evidence: { basis: "unavailable", error: "detection_failed" } };
+  }
+}

package/src/cli/status.ts

@@ -36,6 +36,8 @@ export type { ListenTarget } from "./status-probes";
 import { checkProxyHealth, probeUncleanExitState, type ListenTarget } from "./status-probes";
 import { LOCAL_MANAGEMENT_READ_PATHS } from "../lib/local-management-capability";
 import { fetchBoundLocalManagementRead } from "../server/local-management-read-client";
+import { collectAppliedCodexSettingsStatus, type CliAppliedCodexSettingsStatus } from "./status-codex-settings";
+import { installDetectionStatus, type InstallDetectionStatus } from "./status-install";
 
 /**
  * The state of the data-plane admission secret the SERVICE will use. State only -- never the value.
@@ -118,6 +120,8 @@ export type CliRemoteHubStatus = {
 
 export type CliStatusJson = {
   mainAccountHardLock?: CodexMainAccountPolicyHealth;
+  /** OCX-11 fallback state; see src/cli/status-fallback.ts. */
+  fallback?: import("./status-fallback").StatusFallback;
   schemaVersion: 1;
   /**
    * This machine's topology role, named rather than inferred (#4236).
@@ -229,8 +233,10 @@ export type CliStatusJson = {
    */
   versionSkew: VersionSkew;
   cliCommand: CliPathDiagnostics;
+  /** Installer ownership from the updater's detector (OCX-10); additive, `schemaVersion` stays 1. */
+  install: InstallDetectionStatus;
   startupSource: "live" | "local" | "local-supervision-override";
-};
+} & CliAppliedCodexSettingsStatus;
 
 export type CliStatusView = {
   json: CliStatusJson;
@@ -853,12 +859,22 @@ export async function collectStatus(options: { mainAccountPolicy?: boolean } = {
   const mainAccountHardLock = options.mainAccountPolicy && live
     ? (await (await import("../oauth/health")).fetchCodexHealthFromLiveProxy(undefined, async () => live)).mainAccountHardLock
     : undefined;
+  // Same `--json`-only gate as the hard-lock read above: the human report stays one probe.
+  const fallback = options.mainAccountPolicy
+    ? await (await import("./status-fallback")).collectStatusFallback(config, {
+      live: Boolean(live), linkChild: config.client?.transport === "link",
+      deps: { findLiveProxy: async () => live },
+    })
+    : undefined;
   const pidFile = readPid();
   // Preserve an authoritative null from orphan/legacy liveness — do not restore pidFile.
   const pid = resolveStatusPid(live, pidFile);
   // No extra request: findLiveProxy's identity probe already parsed and validated the
   // healthz body, so the version came back with the liveness result.
   const versionSkew = computeVersionSkew(packageVersion(), live?.version);
+  // OCX-6: what this machine applied and, on a Child, when its runtime started. Additive and
+  // always present (null when unknown), so `schemaVersion` stays 1.
+  const appliedCodexSettings = await collectAppliedCodexSettingsStatus(config, live);
   const listen = live
     ? {
       port: live.port,
@@ -1005,6 +1021,7 @@ export async function collectStatus(options: { mainAccountPolicy?: boolean } = {
     healthLabel: formatCliStatusHealthLabel(health.label, cliCommand, remoteHub.connected),
     json: {
       ...(mainAccountHardLock ? { mainAccountHardLock } : {}),
+      ...(fallback ? { fallback } : {}),
       schemaVersion: 1,
       runtimeRole: config.runtimeRole ?? "standalone",
       proxy: {
@@ -1067,7 +1084,9 @@ export async function collectStatus(options: { mainAccountPolicy?: boolean } = {
       // print it under the wrong heading (#2701).
       versionSkew,
       cliCommand,
+      install: installDetectionStatus(),
       startupSource,
+      ...appliedCodexSettings,
     },
   };
 }

package/src/cli/system-restart-client.ts

@@ -1,4 +1,5 @@
 import { readRuntimePort } from "../config/process-state";
+import { readBoundedResponseBytes } from "../lib/bounded-body";
 import {
   LOCAL_ATTESTATION_CHALLENGE_HEADER,
   LOCAL_ATTESTATION_PROOF_HEADER,
@@ -6,6 +7,8 @@ import {
   verifyLocalAttestationProof,
 } from "../lib/local-management-attestation";
 import {
+  CLIENT_RESTART_REQUEST_MIN_REMAINING_MS,
+  RESTART_SUPERVISED_ERROR,
   SYSTEM_RESTART_CAPABILITY_HEADER,
   SYSTEM_RESTART_CAPABILITY_VERSION,
   SYSTEM_RESTART_EXPECTED_PID_HEADER,
@@ -182,6 +185,13 @@ export async function requestBoundSystemRestart(
   );
   if (!capability) return rejected("restart_capability_unavailable");
 
+  // A connected client runtime keeps serving when its replacement fails, but its rollback takes
+  // up to CLIENT_RESTART_BUDGET_MS. Ask only while that still ends before this CLI stops observing,
+  // or the recovery start below could race the rollback for the port (OCX-6).
+  if (body.role === "client" && deadlineAt - now() < CLIENT_RESTART_REQUEST_MIN_REMAINING_MS) {
+    return rejected("restart_deadline_expired");
+  }
+
   const requestBudget = remaining(deadlineAt, now, SYSTEM_RESTART_REQUEST_TIMEOUT_MS);
   if (requestBudget <= 0) return rejected("restart_deadline_expired");
   try {
@@ -194,10 +204,31 @@ export async function requestBoundSystemRestart(
       },
       signal: AbortSignal.timeout(requestBudget),
     });
-    return response.ok ? { accepted: true } : rejected(`restart_request_http_${response.status}`);
+    if (response.ok) return { accepted: true };
+    if (response.status === 409) {
+      const supervisor = await supervisedRefusal(response);
+      if (supervisor) return rejected(`${RESTART_SUPERVISED_ERROR}_${supervisor}`);
+    }
+    return rejected(`restart_request_http_${response.status}`);
   } catch {
     // The server may have accepted the restart before the response connection failed.
     // The coordinator observes the original PID for replacement instead of replaying.
     return uncertain("restart_request_outcome_unknown");
   }
 }
+
+/**
+ * A client runtime under the desktop app or a service answers 409 `restart_supervised` and keeps
+ * serving (OCX-6). Read that small body and return the validated supervisor, or null.
+ */
+async function supervisedRefusal(response: Response): Promise<"service" | "desktop" | null> {
+  try {
+    const read = await readBoundedResponseBytes(response, { maxBytes: 1024, signal: AbortSignal.timeout(SYSTEM_RESTART_REQUEST_TIMEOUT_MS) });
+    if (read.oversized) return null;
+    const body = JSON.parse(new TextDecoder().decode(read.bytes)) as { error?: { code?: unknown; supervisor?: unknown } } | null;
+    if (body?.error?.code !== RESTART_SUPERVISED_ERROR) return null;
+    return body.error.supervisor === "service" || body.error.supervisor === "desktop" ? body.error.supervisor : null;
+  } catch {
+    return null;
+  }
+}

package/src/cli/update-restart-child.ts

@@ -20,10 +20,11 @@ function parseMarker(raw: string): UpdateRestartChildMarker {
     || typeof value.home.serviceRecord.digest !== "string" || !/^[a-f0-9]{64}$/.test(value.home.serviceRecord.digest)) throw new Error("update_restart_child_marker_invalid");
   for (const directory of [value.home.config, value.home.codex]) {
     // Windows reports 64-bit NTFS file ids (MFT sequence in the high 16 bits) as doubles above
-    // 2^53. Parent and child read them through the same stat API, so any finite integer is a
-    // faithful identity token; assertUpdateRestartHome still compares path, dev and ino exactly.
+    // 2^53, where neighbouring ids collapse. dev and ino may be large finite integers; fileId
+    // carries the exact "dev:ino" that assertUpdateRestartHome actually relies on.
     if (!directory || typeof directory.path !== "string" || !directory.path
-      || !Number.isInteger(directory.dev) || !Number.isInteger(directory.ino)) {
+      || !Number.isInteger(directory.dev) || !Number.isInteger(directory.ino)
+      || typeof directory.fileId !== "string" || !/^\d{1,20}:\d{1,20}$/.test(directory.fileId)) {
       throw new Error("update_restart_child_marker_invalid");
     }
   }