@bitkyc08/opencodex 2.90.0 → 2.92.0

package/src/codex/cli-update-plan.ts

@@ -2,10 +2,11 @@ import { spawnSync, type SpawnSyncReturns } from "node:child_process";
 import { createHash } from "node:crypto";
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
+import { join, resolve } from "node:path";
 
 import { compareStrictSemver, parseStrictSemver } from "../lib/strict-semver";
 import { npmInvocation } from "../update/npm-invocation.mjs";
+import { CODEX_CLI_TRANSPORT_ENV_KEYS } from "../update/codex-cli-update-launch-policy.mjs";
 import {
   inspectCodexCliInstall,
   type CodexCliInstallKind,
@@ -61,6 +62,7 @@ export type CodexCliUpdateRefusal =
   | "windows_inspection_deferred"
   | "not_managed"
   | "installed_version_unverified"
+  | "install_content_unverified"
   | "target_unresolved"
   | "already_current"
   | "target_not_newer"
@@ -100,6 +102,13 @@ export interface CodexCliUpdatePlan {
   readonly targetVersion: string | null;
   readonly targetIntegrity: string | null;
   readonly session: CodexCliUpdateSession;
+  /**
+   * The bounded content observation the installation report produced: digest of
+   * the manifest, declared entrypoint and resolved platform backing the plan's
+   * identity is pinned to. Not an execution guarantee — an apply phase must
+   * re-observe before it can rely on the same bytes.
+   */
+  readonly installContentDigest: string | null;
   /** Indicative install argv for the operator to read; the apply phase this plan precedes verifies a packed tarball against the bound sha512 rather than trusting a moving spec. */
   readonly command: readonly string[] | null;
 }
@@ -157,6 +166,7 @@ export function codexCliUpdatePlanId(bound: {
   readonly provenance: CodexCliInstallKind;
   readonly installedVersion: string;
   readonly installDigest: string | null;
+  readonly installContentDigest: string;
   readonly channel: CodexCliUpdateChannel;
   readonly targetVersion: string;
   readonly targetIntegrity: string;
@@ -170,6 +180,7 @@ export function codexCliUpdatePlanId(bound: {
     ["provenance", bound.provenance],
     ["installedVersion", bound.installedVersion],
     ["installDigest", bound.installDigest ?? ""],
+    ["installContentDigest", bound.installContentDigest],
     ["channel", bound.channel],
     ["targetVersion", bound.targetVersion],
     ["targetIntegrity", bound.targetIntegrity],
@@ -220,8 +231,8 @@ function npmTarget(args: readonly string[], env?: NodeJS.ProcessEnv): NpmTarget
  * shared modules from. None of these is input the updater child needs, so
  * ambient values stay out of the spawned npm. This is a denylist for
  * process-startup/output channels, not a claim that every ambient variable is
- * allowlisted. Ordinary OS environment, proxy settings and the supported
- * NODE_EXTRA_CA_CERTS extension remain available.
+ * allowlisted. When a proof-bound launcher snapshot is available, proxy and
+ * CA settings are replaced from that snapshot below.
  */
 const NPM_ENV_DROP_KEYS: ReadonlySet<string> = new Set([
   "node_options",
@@ -255,23 +266,24 @@ function codexCliUpdateNpmEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.Pro
 }
 
 /**
- * Ambient environment with the executable-selection channels replaced by the proof-bound
- * launcher snapshot. HOME, proxy variables and NODE_EXTRA_CA_CERTS stay ambient because npm
- * itself needs them; PATH/PATHEXT are the channels a project dotenv could use to supply a
- * fake npm, so they come only from the captured snapshot. A snapshot without PATH means no
- * trusted PATH at all — an empty one fails the spawn closed rather than falling back.
+ * Ambient environment with executable-selection and transport-trust channels replaced by
+ * the proof-bound launcher snapshot. Bun may add project dotenv values after that snapshot,
+ * so PATH/PATHEXT, proxies and NODE_EXTRA_CA_CERTS must all come from the captured context.
+ * A snapshot without PATH means no trusted PATH at all — an empty one fails the spawn closed.
  */
 function codexCliUpdateBoundEnv(bound: NodeJS.ProcessEnv | undefined): NodeJS.ProcessEnv {
   const merged = codexCliUpdateNpmEnv();
   if (bound === undefined) return merged;
+  // Derived from the launcher's allowlist so capture, parsing and the npm child cannot drift.
+  const boundKeys = new Set<string>(["path", "pathext", ...CODEX_CLI_TRANSPORT_ENV_KEYS]);
   for (const key of Object.keys(merged)) {
     const k = key.toLowerCase();
-    if (k === "path" || k === "pathext") delete merged[key];
+    if (boundKeys.has(k)) delete merged[key];
   }
   let hasTrustedPath = false;
   for (const [key, value] of Object.entries(bound)) {
     const k = key.toLowerCase();
-    if ((k === "path" || k === "pathext") && value !== undefined) {
+    if (boundKeys.has(k) && value !== undefined) {
       merged[key] = value;
       if (k === "path") hasTrustedPath = true;
     }
@@ -303,7 +315,7 @@ interface NpmConfigIsolation {
  * the operator's real ancestors. The sentinel package.json anchors the walk here,
  * where no .npmrc exists. --userconfig/--globalconfig replace the two file configs,
  * and the env filter removes the env-var channel. What remains is exactly the pinned
- * --registry flag plus deliberately supported proxy/CA env.
+ * --registry flag plus proxy/CA values captured before project dotenv loading.
  */
 function createNpmConfigIsolation(dir?: string, boundEnv?: NodeJS.ProcessEnv): NpmConfigIsolation {
   const ownsRoot = dir === undefined;
@@ -315,7 +327,11 @@ function createNpmConfigIsolation(dir?: string, boundEnv?: NodeJS.ProcessEnv): N
     const globalNpmrc = join(root, "ocx-update-global.npmrc");
     writeFileSync(globalNpmrc, "");
     const cache = join(root, "npm-cache");
-    return { dir: root, npmrc, globalNpmrc, cache, env: codexCliUpdateBoundEnv(boundEnv) };
+    const env = codexCliUpdateBoundEnv(boundEnv);
+    // npm enables Node's compile cache itself. Dropping the ambient output path
+    // alone recreates <tmpdir>/node-compile-cache outside this owned lifetime.
+    env.NODE_COMPILE_CACHE = resolve(root, "node-compile-cache");
+    return { dir: root, npmrc, globalNpmrc, cache, env };
   } catch (error) {
     // A mid-setup failure must not leak a directory this call created; a
     // caller-supplied directory stays the caller's responsibility.
@@ -356,7 +372,7 @@ function isolatedNpmTarget(args: readonly string[], isolation: NpmConfigIsolatio
 export function resolveCodexCliUpdateTarget(
   channel: CodexCliUpdateChannel,
   spawn: typeof spawnSync = spawnSync,
-  /** Proof-bound launcher snapshot env; executable resolution reads only its PATH/PATHEXT. */
+  /** Proof-bound pre-dotenv PATH/PATHEXT and proxy/CA env; absent settings stay absent. */
   boundEnv?: NodeJS.ProcessEnv,
 ): CodexCliUpdateTarget {
   // The pinned registry and the isolation directory together are the boundary: the
@@ -453,6 +469,7 @@ function refusedPlan(
     targetVersion: target?.kind === "resolved" ? target.version : null,
     targetIntegrity: target?.kind === "resolved" ? target.integrity : null,
     session,
+    installContentDigest: report.installContentDigest,
     command: null,
   });
 }
@@ -473,7 +490,9 @@ export async function createCodexCliUpdatePlan(deps: CodexCliUpdatePlanDeps = {}
   const channel: CodexCliUpdateChannel = deps.channel ?? "latest";
   const platform = deps.platform ?? process.platform;
   const inspect = deps.inspect ?? inspectCodexCliInstall;
-  const report = await inspect(deps.inspectionDeps ?? {});
+  // The planId binds the observed file set, so the plan is the one caller that
+  // pays the bounded content read; a bare ownership check leaves it unobserved.
+  const report = await inspect({ ...(deps.inspectionDeps ?? {}), observeInstallContent: true });
 
   // Phase 1 performs no candidate filesystem I/O at all on Windows, so there is no
   // ownership evidence to build a plan on. This stays dormant until the handle-bound
@@ -494,9 +513,15 @@ export async function createCodexCliUpdatePlan(deps: CodexCliUpdatePlanDeps = {}
     return refusedPlan("installed_version_unverified", report, channel, null, NOT_EVALUATED);
   }
 
+  // A managed install whose observed content could not be bound produces no
+  // usable plan id — spending a registry query on it can only widen the claim.
+  if (!report.installContentDigest) {
+    return refusedPlan("install_content_unverified", report, channel, null, NOT_EVALUATED);
+  }
+
   // The npm evidence channels are bound to the same environment snapshot the
-  // ownership inspection ran against: PATH/PATHEXT from the proof-bound launcher
-  // context, never the ambient ones a project dotenv could point at a fake npm.
+  // ownership inspection ran against: PATH/PATHEXT and proxy/CA from the proof-bound
+  // pre-dotenv launcher context, never ambient executable or transport overrides.
   // When the caller had no trusted snapshot, inspectionDeps.env is the fail-closed
   // { PATH: "" } form, so this resolution cannot silently fall back to ambient.
   const resolveTarget = deps.resolveTarget
@@ -543,6 +568,7 @@ export async function createCodexCliUpdatePlan(deps: CodexCliUpdatePlanDeps = {}
       provenance: report.provenance,
       installedVersion,
       installDigest: report.installDigest,
+      installContentDigest: report.installContentDigest,
       channel,
       targetVersion: target.version,
       targetIntegrity: target.integrity,
@@ -555,6 +581,7 @@ export async function createCodexCliUpdatePlan(deps: CodexCliUpdatePlanDeps = {}
     targetVersion: target.version,
     targetIntegrity: target.integrity,
     session: Object.freeze({ state: "none" as const, matches: 0 }),
+    installContentDigest: report.installContentDigest,
     command: codexCliUpdateCommand(target.version),
   });
 }

package/src/codex/desktop-app/picker-freshness.ts

@@ -9,16 +9,17 @@
  *
  * The one thing an app-server restart cannot refresh is the picker: the renderer builds
  * the roster once when the shell launches, and `model_catalog_json` is startup-only. So
- * the shell has to restart only when it launched before the catalog it should show was
- * written. The catalog writer skips byte-identical rewrites to keep this mtime honest
- * (`src/codex/catalog/retained-sync.ts`), which is what makes the comparison usable.
+ * a running shell has to restart unless there is affirmative evidence that it loaded the
+ * current binding. The catalog writer skips byte-identical rewrites
+ * (`src/codex/catalog/retained-sync.ts`), so a file timestamp alone is not that evidence.
  *
  * The mtime only means something for the catalog `config.toml` actually binds. With no
  * `model_catalog_json` the shell shows Codex's own roster, which no local file dates, so
  * an unbound config is `unknown`. `config.toml`'s own mtime is no substitute: injection
  * rewrites it on every sync even when the bytes are identical. A binding changed by THIS
- * request's sync is caught by the caller comparing it across the sync; one changed by an
- * earlier sync over a byte-identical catalog file is not observable here.
+ * request's sync is caught by the caller comparing it across the sync. If the shell is
+ * newer than the catalog, however, its launch time cannot prove which binding it loaded:
+ * an earlier sync may have rebound an already-existing, byte-identical catalog.
  *
  * Anything we cannot read answers `unknown`, and the caller falls back to the full
  * desktop restart: a stale picker the operator asked us to fix is the failure this
@@ -38,8 +39,8 @@ export type DesktopPickerState = CodexDesktopPickerState;
  * Pure decision. `shellStartsMs === null` means the shells could not be listed; a null
  * entry means one shell's start time was unreadable.
  *
- * Strictly later, never equal: macOS `ps lstart` has one-second granularity, so a shell
- * that started in the same second as the catalog write may predate it.
+ * A shell no newer than the catalog is definitely stale. A newer shell is `unknown`, not
+ * current, because timestamps carry no evidence of which catalog binding it loaded.
  */
 export function classifyDesktopPicker(
   shellStartsMs: readonly (number | null)[] | null,
@@ -48,8 +49,9 @@ export function classifyDesktopPicker(
   if (shellStartsMs === null) return "unknown";
   if (shellStartsMs.length === 0) return "not_running";
   if (catalogMtimeMs === null) return "unknown";
+  if (shellStartsMs.some(start => start !== null && start <= catalogMtimeMs)) return "stale";
   if (shellStartsMs.some(start => start === null)) return "unknown";
-  return shellStartsMs.every(start => start! > catalogMtimeMs) ? "current" : "stale";
+  return "unknown";
 }
 
 export interface DesktopPickerIo extends DesktopAppRestartIo {

package/src/codex/desktop-compatibility/usage-activation.ts

@@ -40,7 +40,8 @@ export class UsageActivation {
     const beforeVerification=this.generation,binding=this.binding;
     let verified:string|null;
     try{verified=await this.verifyIdentity();}catch{verified=null;}
-    if(verified!==binding||this.binding!==binding||this.generation!==beforeVerification)return{accepted:false,reason:'identity-not-verified',...this.snapshot()};
+    if(this.binding!==binding||this.generation!==beforeVerification)return{accepted:false,reason:'identity-not-verified',...this.snapshot()};
+    if(verified!==binding){this.invalidateIdentity();return{accepted:false,reason:'identity-not-verified',...this.snapshot()};}
     if(this.mode==='apply')return{accepted:false,reason:'activation-already-pending',...this.snapshot()};
     const age=this.latest?this.clock()-this.latest.at:Infinity;
     if(!this.latest||this.latest.kind!=='exhausted'||age<0||age>300000)return{accepted:false,reason:'no-fresh-eligible-exhaustion',...this.snapshot()};

package/src/codex/desktop-compatibility/usage-controller.ts

@@ -72,7 +72,13 @@ export class UsageRelayController {
         || !Number.isSafeInteger(envelope.sequence) || Number(envelope.sequence) <= 0))) { stream?.exclude(); return null; }
     const original = envelope ? envelope.usage : parsed;
     if (!object(original) || original.account_id !== this.account.id || original.user_id !== this.account.userId
-      || original.plan_type !== this.account.plan) { stream?.exclude(); return null; }
+      || original.plan_type !== this.account.plan) {
+      if (object(original) && [[original.account_id, this.account.id], [original.user_id, this.account.userId],
+        [original.plan_type, this.account.plan]].some(([actual, expected]) => typeof actual === 'string' && actual.length > 0 && actual !== expected)) {
+        this.activation.invalidateIdentity();
+      }
+      stream?.exclude(); return null;
+    }
     const rate = original.rate_limit;
     if (!object(rate) || typeof rate.allowed !== 'boolean' || typeof rate.limit_reached !== 'boolean') {
       stream?.exclude(); return null;

package/src/codex/desktop-compatibility/windows-key-protection.ts

@@ -10,17 +10,24 @@ const ENTROPY = new TextEncoder().encode(PURPOSE);
 // Only the PowerShell fallback is bounded by a clock. A cold Windows PowerShell that must also load
 // System.Security has been measured past 10s on a loaded machine (Windows CI run 38591626343).
 const DPAPI_TIMEOUT_MS = 20_000;
+// Cmdlet-free on purpose. The first cmdlet a PowerShell session runs (Add-Type, ConvertFrom-Json)
+// sends it through command discovery and module auto-loading, which without a module-analysis cache
+// for the profile scans the modules on PSModulePath. The test runner gives every run a fresh profile
+// and CI images carry large module sets, so that scan, not DPAPI, is what cold runs waited on.
+// Assembly loading, string splitting and base64 are plain .NET calls outside command discovery.
+// The request is "<operation>\n<base64 data>" on stdin.
 const SCRIPT = [
   "$ErrorActionPreference='Stop'",
-  "Add-Type -AssemblyName System.Security",
-  "$r=[Console]::In.ReadToEnd()|ConvertFrom-Json",
-  "$data=[Convert]::FromBase64String($r.data)",
+  "[void][Reflection.Assembly]::Load('System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a')",
+  "$r=[Console]::In.ReadToEnd().Split([char]10)",
+  "if($r.Length -ne 2){throw 'Invalid request'}",
+  "$data=[Convert]::FromBase64String($r[1])",
   `if($data.Length -eq 0 -or $data.Length -gt ${MAX_INPUT}){throw 'Invalid data size'}`,
   `$entropy=[Text.Encoding]::UTF8.GetBytes('${PURPOSE}')`,
   "$scope=[Security.Cryptography.DataProtectionScope]::CurrentUser",
-  "if($r.operation -eq 'protect'){",
+  "if($r[0] -ceq 'protect'){",
   " $out=[Security.Cryptography.ProtectedData]::Protect($data,$entropy,$scope)",
-  "}elseif($r.operation -eq 'unprotect'){",
+  "}elseif($r[0] -ceq 'unprotect'){",
   " $out=[Security.Cryptography.ProtectedData]::Unprotect($data,$entropy,$scope)",
   "}else{throw 'Invalid operation'}",
   "[Console]::Out.Write([Convert]::ToBase64String($out))",
@@ -126,7 +133,7 @@ function runPowerShellDpapi(operation: Operation, data: Uint8Array, timeoutMs =
       resolve(bytes);
     });
     child.stdin?.on("error", () => { /* execFile's completion reports the failed child. */ });
-    child.stdin?.end(JSON.stringify({ operation, data: Buffer.from(data).toString("base64") }));
+    child.stdin?.end(`${operation}\n${Buffer.from(data).toString("base64")}`);
   });
 }
 
@@ -163,3 +170,8 @@ export function powerShellAuthorityKeyProtectionForTests(timeoutMs: number): Aut
 export function usesNativeDpapiForTests(): boolean {
   return process.platform === "win32" && loadNativeDpapi() !== null;
 }
+
+/** Test-only: the PowerShell helper's script, so its cmdlet-free contract can be checked anywhere. */
+export function powerShellDpapiScriptForTests(): string {
+  return SCRIPT;
+}

package/src/codex/pool-refresh-backoff.ts

@@ -125,6 +125,8 @@ export function noteCodexPoolRefreshFailure(
   reason: string,
   now = currentNow(),
   fence?: string,
+  // Resolved only when a line is actually written; the caller knows the account's durable label.
+  logLabel: (accountId: string) => string = fallbackCodexAccountLogLabel,
 ): { consecutiveFailures: number; cooldownUntil: number; openedWindow: boolean } {
   const existing = backoffByAccount.get(accountId);
   // A flight that started before the account's failures were cleared is speaking for a grant
@@ -153,7 +155,7 @@ export function noteCodexPoolRefreshFailure(
   const consecutiveFailures = (existing?.consecutiveFailures ?? 0) + 1;
   const cooldownUntil = now + delayFor(consecutiveFailures);
   backoffByAccount.set(accountId, { consecutiveFailures, cooldownUntil, reason });
-  const label = fallbackCodexAccountLogLabel(accountId);
+  const label = logLabel(accountId);
   console.warn(
     `[codex-auth] Codex pool account ${label} credential refresh failed (${reason})`,
   );

package/src/codex/quota-history.ts

@@ -92,6 +92,13 @@ export class CodexQuotaHistory {
     return { samples: structuredClone(bucket.samples.slice(-capped)), truncated: bucket.samples.length > capped };
   }
 
+  /** The newest sample's origin, without pruning or clearing: a passive read changes nothing. */
+  peekLatestSource(accountId: string, identity: string | undefined): QuotaHistorySample["source"] | undefined {
+    const bucket = this.accounts.get(accountId);
+    if (!identity || !bucket || bucket.identity !== identity) return undefined;
+    return bucket.samples.at(-1)?.source;
+  }
+
   clear(accountId?: string): number {
     if (accountId === undefined) {
       const count = this.accounts.size;

package/src/codex/quota.ts

@@ -1099,3 +1099,13 @@ export function getAccountQuotaHistory(accountId: string, limit: number = QUOTA_
   return { observations: result.samples.map(({ credentialGeneration: _generation, ...sample }) => sample),
     truncated: result.truncated, retention: { maxObservations: QUOTA_HISTORY_LIMITS.perAccount, maxAgeDays: 30 } };
 }
+
+/**
+ * Where the newest stored reading for a pool account came from (a WHAM usage body or upstream
+ * response headers), or undefined when no current history exists. Read-only: unlike
+ * `getAccountQuotaHistory` it never prunes or clears a mismatched bucket.
+ */
+export function latestCodexQuotaObservationSource(accountId: string): "wham" | "response-header" | undefined {
+  hydrateAccountQuotasFromDisk();
+  return quotaHistory.peekLatestSource(accountId, poolQuotaHistoryIdentity(accountId));
+}

package/src/codex/subagent-model-fallback.ts

@@ -38,6 +38,7 @@ import {
   isCanonicalOpenAiForwardProvider,
 } from "../providers/openai-tiers";
 import { routeModel, type RouteResult } from "../router";
+import { guardFallbackHop, type FallbackAdmission } from "../routing/fallback-policy";
 import { sweepExpiredOnWrite } from "../lib/state-store-sweeper";
 import { codexAccountNamespaceForModel } from "./account-namespace-match";
 import { ACCOUNT_GATED_NATIVE_OPENAI_MODELS, NATIVE_MAIN_DRAIN_SENTINEL_MODELS } from "./catalog/native-models";
@@ -629,7 +630,8 @@ export function applySubagentModelFallback(
   modelEligibleAccountIdsForModel?: SubagentModelEligibleAccountIds,
   resolvedFallbackChain?: readonly string[] | null,
   restrictedRouteEligible?: SubagentFallbackRouteEligibility,
-): { from?: string; to?: string; skipped?: string[] } | null {
+  admission?: FallbackAdmission,
+): { from?: string; to?: string; skipped?: string[]; refusal?: Response } | null {
   if (!isThreadSpawnRequest(headers)) return null;
   const fallbackChain = resolvedFallbackChain === undefined
     ? resolveSubagentFallbackChain(parsed, config)
@@ -653,10 +655,31 @@ export function applySubagentModelFallback(
     ? { from: parsed.modelId, to: parsed.modelId, skipped: selection.skipped }
     : null;
   const from = parsed.modelId;
+  // OCX-11: the rewrite is a proactive hop away from an unavailable primary. Refused, the spawn
+  // keeps its model and the caller answers with the refusal instead of sending anything.
+  const hop = guardFallbackHop(config, {
+    site: "subagent",
+    route: from,
+    from: fallbackTargetOf(config, from),
+    to: fallbackTargetOf(config, selection.model),
+    trigger: "unavailable",
+    admission,
+    now,
+  });
+  if (!hop.ok) return { from, to: from, skipped: selection.skipped, refusal: hop.response };
+  // The rewrite is this site's admission: the spawn now carries the fallback model.
+  hop.commit();
   rewriteParsedModel(parsed, selection.model);
   return { from, to: selection.model, skipped: selection.skipped };
 }
 
+function fallbackTargetOf(config: OcxConfig, model: string): { provider: string; model: string } {
+  const route = tryRouteFallbackModel(config, model);
+  if (route) return { provider: route.providerName, model: route.modelId };
+  const slash = model.indexOf("/");
+  return slash > 0 ? { provider: model.slice(0, slash), model: model.slice(slash + 1) } : { provider: "", model };
+}
+
 /** Resolve the effective fallback chain once for one logical spawn request. */
 export function resolveSubagentFallbackChain(
   parsed: OcxParsedRequest,

package/src/codex/user-identity.ts

@@ -19,6 +19,7 @@ import { isAbsolute, join, resolve } from "node:path";
 
 import { resolveTrustedWindowsPowerShellExe } from "../lib/windows-elevation";
 import { WINDOWS_PRINCIPAL_LOOKUP_TIMEOUT_MS } from "../lib/windows-user-principal";
+import { resolveWindowsCurrentSid } from "./windows-current-sid";
 import { resolveWindowsLocalAppData } from "./windows-local-appdata";
 
 import type {
@@ -213,8 +214,8 @@ export function decodeWindowsIdentityPowerShellOutputForTests(output: Uint8Array
  * Both helper values -- the effective token's SID and its known-folder local AppData --
  * are fixed for the lifetime of a process: neither can change without a new logon
  * token, and the lookups deliberately ignore the environment, so nothing a caller
- * does between two calls can alter the answer. The native x64 known-folder path
- * avoids this helper entirely. Each fallback call otherwise spawns a fresh
+ * does between two calls can alter the answer. The native x64 SID and known-folder
+ * paths avoid this helper entirely. Each fallback call otherwise spawns a fresh
  * PowerShell, roughly 150ms for the SID and 310ms for the folder, and the
  * coordinator asks for both on every config write and lock acquisition. That cost
  * pushed real multi-process injection tests past their budget while proving
@@ -259,14 +260,42 @@ function powershellValue(expression: string): string {
   return value;
 }
 
-function resolveWindowsSid(): string {
-  const sid = powershellValue(
-    "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value",
-  );
+const WINDOWS_SID_EXPRESSION = "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value";
+
+/**
+ * Windows x64 reads the token SID in-process (`windows-current-sid.ts`, #7544);
+ * the PowerShell helper runs only where `bun:ffi` cannot. Every failure either
+ * path reports — a helper timeout, a native API error — refuses.
+ */
+function resolveWindowsSidWith(
+  powershellLookup: () => string,
+  nativeLookup?: (() => string) | null,
+): string {
+  let sid: string;
+  try {
+    sid = nativeLookup === undefined
+      ? resolveWindowsCurrentSid(powershellLookup)
+      : resolveWindowsCurrentSid(powershellLookup, nativeLookup);
+  } catch (cause) {
+    if (cause instanceof CodexUserIdentityRefusal) throw cause;
+    refuse("Windows effective-account lookup failed.", cause);
+  }
   if (!SID_PATTERN.test(sid)) refuse("Windows effective-account lookup returned an invalid SID.");
   return sid.toUpperCase();
 }
 
+function resolveWindowsSid(): string {
+  return resolveWindowsSidWith(() => powershellValue(WINDOWS_SID_EXPRESSION));
+}
+
+/** Test-only: the SID resolution and refusal mapping with both lookups injected. */
+export function resolveWindowsSidForTests(
+  powershellLookup: () => string,
+  nativeLookup: (() => string) | null,
+): string {
+  return resolveWindowsSidWith(powershellLookup, nativeLookup);
+}
+
 function windowsLocalAppData(): string {
   try {
     return resolveWindowsLocalAppData(() => powershellValue(windowsLocalAppDataExpression()));

package/src/codex/windows-current-sid.ts

@@ -0,0 +1,162 @@
+/**
+ * The effective process token's SID, read in-process on Windows x64.
+ *
+ * The PowerShell helper this replaces is correct but slow to start: a cold
+ * `powershell.exe` on a loaded runner spent more than the 30s lookup budget
+ * before evaluating one constant of the process token, and `ocx service install`
+ * refused (#7544). Widening that budget again would only move the line. The SID
+ * itself costs three advapi32 calls, so the x64 path asks the OS directly and the
+ * helper keeps running only where `bun:ffi` cannot (Windows ARM64).
+ *
+ * The answer is the PROCESS token's user. `WindowsIdentity.GetCurrent()` would
+ * prefer a thread impersonation token, but nothing in this process impersonates,
+ * so the two agree; the process token is also what Task Scheduler and the ACL
+ * code grant to.
+ *
+ * Fail-closed is preserved: when the native API is available and fails, the
+ * lookup throws and the caller refuses. It never falls back to the helper, whose
+ * environment the native path exists to avoid depending on.
+ */
+import { dlopen, ptr, read, type Pointer } from "bun:ffi";
+import { win32 } from "node:path";
+import { resolveTrustedWindowsSystemDirectory } from "../lib/windows-elevation";
+
+const TOKEN_QUERY = 0x0008;
+const TOKEN_USER_INFORMATION_CLASS = 1;
+/**
+ * TOKEN_USER is one SID_AND_ATTRIBUTES (an 8-byte SID pointer and a 4-byte
+ * attribute word, padded to 16) followed by the SID it points at. A SID is at
+ * most SECURITY_MAX_SID_SIZE (68) bytes, so 256 bytes always suffices and a
+ * larger reported length is treated as a malformed answer.
+ */
+const TOKEN_USER_BUFFER_BYTES = 256;
+const TOKEN_USER_HEADER_BYTES = 16;
+/** "S-1-" plus at most 15 sub-authorities of up to 10 digits each, with room to spare. */
+const MAX_SID_STRING_CODE_UNITS = 256;
+const SID_PATTERN = /^S-1-(?:\d+-)+\d+$/i;
+
+export interface WindowsTokenSidApi {
+  /** OpenProcessToken(GetCurrentProcess(), access, &token). Non-zero BOOL is success. */
+  openProcessToken(desiredAccess: number, token: BigUint64Array): number;
+  /** GetTokenInformation(token, class, buffer, buffer.length, &returnLength). */
+  getTokenInformation(
+    token: bigint,
+    informationClass: number,
+    buffer: Uint8Array,
+    returnLength: Uint32Array,
+  ): number;
+  /** ConvertSidToStringSidW(sid, &string). The string is LocalAlloc'd on success. */
+  convertSidToStringSid(sidAddress: number, output: BigUint64Array): number;
+  readCodeUnit(address: number, byteOffset: number): number;
+  localFree(address: number): void;
+  closeHandle(token: bigint): void;
+}
+
+function lookupError(detail: string): Error {
+  return new Error(`Windows effective-account token lookup ${detail}.`);
+}
+
+function readSidString(api: WindowsTokenSidApi, address: number): string {
+  const units: number[] = [];
+  for (let index = 0; index < MAX_SID_STRING_CODE_UNITS; index += 1) {
+    const unit = api.readCodeUnit(address, index * 2);
+    if (unit === 0) return String.fromCharCode(...units);
+    units.push(unit);
+  }
+  throw lookupError("returned an unterminated SID");
+}
+
+/** Same token user the PowerShell helper reports, without starting a process. */
+export function readWindowsCurrentSid(api: WindowsTokenSidApi): string {
+  const tokenOutput = new BigUint64Array(1);
+  if (api.openProcessToken(TOKEN_QUERY, tokenOutput) === 0 || tokenOutput[0] === 0n) {
+    throw lookupError("could not open the process token");
+  }
+  const token = tokenOutput[0]!;
+  let stringAddress = 0;
+  try {
+    // Keep `buffer` referenced until the conversion returns: the SID pointer
+    // inside it points back into this same allocation.
+    const buffer = new Uint8Array(TOKEN_USER_BUFFER_BYTES);
+    const returnLength = new Uint32Array(1);
+    if (api.getTokenInformation(token, TOKEN_USER_INFORMATION_CLASS, buffer, returnLength) === 0) {
+      throw lookupError("could not read the token user");
+    }
+    const length = returnLength[0]!;
+    if (length <= TOKEN_USER_HEADER_BYTES || length > buffer.byteLength) {
+      throw lookupError("returned a malformed token user");
+    }
+    const sidAddress = Number(
+      new DataView(buffer.buffer, buffer.byteOffset, buffer.byteLength).getBigUint64(0, true),
+    );
+    if (!Number.isSafeInteger(sidAddress) || sidAddress <= 0) {
+      throw lookupError("returned a null SID");
+    }
+    const stringOutput = new BigUint64Array(1);
+    const converted = api.convertSidToStringSid(sidAddress, stringOutput);
+    const candidate = Number(stringOutput[0]);
+    if (converted === 0 || !Number.isSafeInteger(candidate) || candidate <= 0) {
+      throw lookupError("could not format the SID");
+    }
+    stringAddress = candidate;
+    const sid = readSidString(api, stringAddress);
+    if (!SID_PATTERN.test(sid)) throw lookupError("returned an invalid SID");
+    return sid.toUpperCase();
+  } finally {
+    if (stringAddress > 0) api.localFree(stringAddress);
+    api.closeHandle(token);
+  }
+}
+
+let nativeLookup: (() => string) | null | undefined;
+
+function loadNativeLookup(): (() => string) | null {
+  if (nativeLookup !== undefined) return nativeLookup;
+  if (process.platform !== "win32" || process.arch !== "x64") return null;
+  try {
+    const systemDirectory = resolveTrustedWindowsSystemDirectory();
+    const advapi = dlopen(win32.join(systemDirectory, "advapi32.dll"), {
+      OpenProcessToken: { args: ["u64", "u32", "ptr"], returns: "i32" },
+      GetTokenInformation: { args: ["u64", "u32", "ptr", "u32", "ptr"], returns: "i32" },
+      ConvertSidToStringSidW: { args: ["ptr", "ptr"], returns: "i32" },
+    });
+    let kernel;
+    try {
+      kernel = dlopen(win32.join(systemDirectory, "kernel32.dll"), {
+        GetCurrentProcess: { args: [], returns: "u64" },
+        CloseHandle: { args: ["u64"], returns: "i32" },
+        LocalFree: { args: ["ptr"], returns: "ptr" },
+      });
+    } catch (error) {
+      advapi.close();
+      throw error;
+    }
+    const api: WindowsTokenSidApi = {
+      openProcessToken: (access, token) => advapi.symbols.OpenProcessToken(
+        kernel.symbols.GetCurrentProcess(), access, ptr(token),
+      ),
+      getTokenInformation: (token, informationClass, buffer, returnLength) =>
+        advapi.symbols.GetTokenInformation(
+          token, informationClass, ptr(buffer), buffer.byteLength, ptr(returnLength),
+        ),
+      convertSidToStringSid: (sidAddress, output) => advapi.symbols.ConvertSidToStringSidW(
+        sidAddress as Pointer, ptr(output),
+      ),
+      readCodeUnit: (address, offset) => read.u16(address as Pointer, offset),
+      localFree: address => { kernel.symbols.LocalFree(address as Pointer); },
+      closeHandle: token => { kernel.symbols.CloseHandle(token); },
+    };
+    nativeLookup = () => readWindowsCurrentSid(api);
+  } catch {
+    nativeLookup = null;
+  }
+  return nativeLookup;
+}
+
+/** Unsupported FFI keeps the bounded trusted helper; an OS API failure still refuses. */
+export function resolveWindowsCurrentSid(
+  powershellLookup: () => string,
+  lookup: (() => string) | null = loadNativeLookup(),
+): string {
+  return lookup ? lookup() : powershellLookup();
+}

package/src/combos/index.ts

@@ -23,6 +23,7 @@ export {
   advanceComboAfterFailure,
   clearComboSelectionState,
   comboExclusionReasons,
+  comboTargetSkipTrigger,
   NoAvailableComboTargetsError,
   noteComboFailure,
   noteComboSuccess,