@iislee/opencodex 2.11.0 → 2.31.0

package/src/sidecar/auth.ts

@@ -0,0 +1,92 @@
+/**
+ * The one place that decides whether a sidecar may treat ChatGPT or Anthropic
+ * auth as PRESENT (#2188). Web-search and vision consumed two hand-rolled
+ * copies of the Anthropic predicate and no Codex-login predicate at all —
+ * provider presence was standing in for "logged in", which let a fresh install
+ * with the built-in forward provider but no credential offer Luna as a
+ * describer it could never run.
+ *
+ * Both flags are request-context-free: they read config plus the stored
+ * account state, never headers. Per-request usability (exact accounts,
+ * generation fences) stays in resolveFirstUsableOpenAiSidecar and the
+ * executors; this module only answers "is this side worth offering at all?".
+ */
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { listOpenAiForwardSidecarCandidates } from "../providers/openai-sidecar";
+import { OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
+import { isCodexAccountUsable } from "../codex/account-usability";
+import { MAIN_CODEX_ACCOUNT_ID, isSelectableCodexPoolAccount } from "../codex/account-id";
+import { getAccountSet } from "../oauth/store";
+
+export interface SidecarAuthState {
+  /** ChatGPT login usable: canonical forward provider AND a live stored credential. */
+  isCodexAuth: boolean;
+  /** Enabled anthropic-adapter OAuth provider whose active account is not marked for reauth. */
+  isAnthropicAuth: boolean;
+  /** The provider an Anthropic-side executor would dispatch through, when isAnthropicAuth. */
+  anthropicProviderName?: string;
+  anthropicProvider?: OcxProviderConfig;
+}
+
+/**
+ * Fixed auth-slot models (#2188): logged-in sides keep these candidates even
+ * when the picker hides or disables them. The slot is the LOGIN's entitlement,
+ * not the catalog's.
+ */
+export const AUTH_SLOT_MODELS = {
+  codex: "gpt-5.6-luna",
+  anthropic: "claude-haiku-4-5",
+} as const;
+
+export interface SidecarAuthSlot {
+  provider: string;
+  id: string;
+  slot: keyof typeof AUTH_SLOT_MODELS;
+}
+
+/** Login-shaped, not provider-shaped: a forward provider with no credential is NOT Codex auth. */
+function hasUsableCodexLogin(config: OcxConfig): boolean {
+  if (listOpenAiForwardSidecarCandidates(config).length === 0) return false;
+  if (isCodexAccountUsable(config, MAIN_CODEX_ACCOUNT_ID)) return true;
+  return (config.codexAccounts ?? []).some(account =>
+    isSelectableCodexPoolAccount(account) && isCodexAccountUsable(config, account.id));
+}
+
+/**
+ * The predicate previously duplicated as findAnthropicSidecarProvider
+ * (web-search) and findAnthropicVisionProvider (vision): first enabled
+ * anthropic-adapter OAuth provider whose ACTIVE stored account holds a usable
+ * credential. getAccountSet + needsReauth, not getCredential — a terminally
+ * invalid account must not present as auth (audit F1).
+ */
+function findAnthropicAuthProvider(
+  config: OcxConfig,
+): { providerName: string; provider: OcxProviderConfig } | undefined {
+  for (const [providerName, provider] of Object.entries(config.providers)) {
+    if (provider.disabled === true) continue;
+    if (provider.adapter !== "anthropic" || provider.authMode !== "oauth") continue;
+    const set = getAccountSet(providerName);
+    const active = set?.accounts.find(account => account.id === set.activeAccountId);
+    if (active && active.needsReauth !== true) return { providerName, provider };
+  }
+  return undefined;
+}
+
+export function resolveSidecarAuth(config: OcxConfig): SidecarAuthState {
+  const anthropic = findAnthropicAuthProvider(config);
+  return {
+    isCodexAuth: hasUsableCodexLogin(config),
+    isAnthropicAuth: anthropic !== undefined,
+    ...(anthropic ? { anthropicProviderName: anthropic.providerName, anthropicProvider: anthropic.provider } : {}),
+  };
+}
+
+/** The auth-entitled fixed candidates. Emitted regardless of picker visibility. */
+export function sidecarAuthSlots(auth: SidecarAuthState): SidecarAuthSlot[] {
+  const slots: SidecarAuthSlot[] = [];
+  if (auth.isCodexAuth) slots.push({ provider: OPENAI_CODEX_PROVIDER_ID, id: AUTH_SLOT_MODELS.codex, slot: "codex" });
+  if (auth.isAnthropicAuth && auth.anthropicProviderName) {
+    slots.push({ provider: auth.anthropicProviderName, id: AUTH_SLOT_MODELS.anthropic, slot: "anthropic" });
+  }
+  return slots;
+}

package/src/sidecar/candidates.ts

@@ -0,0 +1,83 @@
+/**
+ * The unified picker-visibility candidate set both sidecars consume (#2188).
+ *
+ * Rule 1 (picker): a model may be OFFERED as a sidecar backend only if the
+ * management picker would show it — the same `listManagementModelRows` rows
+ * the GUI Models tab renders, minus disabled rows. Rule 1's only exception is
+ * the auth slots: a logged-in side keeps its fixed slot model (Luna/Haiku)
+ * even when the picker hides it, because the slot is the login's entitlement.
+ *
+ * Vision additionally applies rule 2 (− provably text-only); web-search
+ * applies its own rule 2 (∩ probed backend with an executor) in
+ * src/web-search/backends.ts. Both start from THIS set so the two sidecars
+ * cannot diverge on what "visible" means.
+ */
+import type { OcxConfig } from "../types";
+import { listManagementModelRows } from "../server/management/model-rows";
+import { modelAcceptsImageInput, type VisionCandidateModel } from "../vision/eligibility";
+import { sidecarAuthSlots, type SidecarAuthState } from "./auth";
+
+export interface SidecarCandidate {
+  provider: string;
+  id: string;
+  native?: boolean;
+  inputModalities?: string[];
+  /** True when this row is an auth-slot entitlement rather than a picker row. */
+  authSlot?: boolean;
+}
+
+/**
+ * (picker-visible rows) ∪ (auth slots). De-duplicated by provider+id with the
+ * auth-slot flag winning, so a slot model that is ALSO picker-visible still
+ * reads as slot-backed. A catalog outage degrades to slots only — the settings
+ * routes must not 500 and must keep the logged-in floor populated.
+ */
+export async function pickerVisibleSidecarCandidates(
+  config: OcxConfig,
+  auth: SidecarAuthState,
+): Promise<SidecarCandidate[]> {
+  let rows: Awaited<ReturnType<typeof listManagementModelRows>> = [];
+  try { rows = await listManagementModelRows(config); } catch { rows = []; }
+  const byKey = new Map<string, SidecarCandidate>();
+  for (const row of rows) {
+    if (row.disabled === true) continue;
+    byKey.set(`${row.provider}/${row.id}`, {
+      provider: row.provider,
+      id: row.id,
+      ...(row.inputModalities ? { inputModalities: row.inputModalities } : {}),
+      ...(row.native ? { native: true } : {}),
+    });
+  }
+  for (const slot of sidecarAuthSlots(auth)) {
+    byKey.set(`${slot.provider}/${slot.id}`, {
+      provider: slot.provider,
+      id: slot.id,
+      // Slot models are known image-capable; their only exclusion path is the
+      // provider's explicit consumer list (same stance as baselineCandidate).
+      inputModalities: ["text", "image"],
+      authSlot: true,
+    });
+  }
+  return [...byKey.values()];
+}
+
+/**
+ * Rule 2 for vision: drop rows PROVABLY text-only. Unknown stays eligible —
+ * the picker filter (rule 1) already bounded the set, so permissive-unknown
+ * no longer expands to the whole catalog.
+ */
+export function visionSidecarCandidates(
+  config: Pick<OcxConfig, "providers">,
+  all: readonly SidecarCandidate[],
+): SidecarCandidate[] {
+  return all.filter(candidate => modelAcceptsImageInput(config, toVisionCandidate(candidate)) !== false);
+}
+
+function toVisionCandidate(candidate: SidecarCandidate): VisionCandidateModel {
+  return {
+    provider: candidate.provider,
+    id: candidate.id,
+    ...(candidate.inputModalities ? { inputModalities: candidate.inputModalities } : {}),
+    ...(candidate.native ? { native: true } : {}),
+  };
+}

package/src/storage/cleanup.ts

@@ -1091,7 +1091,7 @@ function writeSatelliteBackup(
     throw new Error("test_fail_satellite_backup_replace");
   }
   try {
-    renameAtomicFile(tmp, dest);
+    renameAtomicFile(tmp, dest, undefined, "storage-cleanup");
   } catch (error) {
     try { unlinkSync(tmp); } catch { /* */ }
     throw error;
@@ -2435,7 +2435,7 @@ function writeRestorePending(
     throw new Error("test_fail_pending_rename");
   }
   try {
-    renameSync(tmp, dest);
+    renameAtomicFile(tmp, dest, undefined, "storage-cleanup");
   } catch (error) {
     try { unlinkSync(tmp); } catch { /* */ }
     throw error;

package/src/storage/scanner.ts

@@ -16,7 +16,7 @@ const IMMUTABLE_READONLY_FLAGS = constants.SQLITE_OPEN_READONLY | constants.SQLI
 
 /**
  * Read-only CODEX_HOME storage scanner — Phase 1 of the Storage page epic
- * (devlog/_plan/500_storage-page-session-cleanup). Pure measurement: sizes via
+ * (devlog/_fin/500_storage-page-session-cleanup). Pure measurement: sizes via
  * fs.stat walks, DB row counts via immutable readonly opens that degrade to
  * null on lock/corruption. Performs zero writes under CODEX_HOME.
  */

package/src/storage/worker-lifecycle.ts

@@ -11,10 +11,9 @@
  * time (so we cannot miss `self.close()` / early exit), stays in `liveWorkers`
  * until that close settles, and `drainStorageWorkers()` joins every in-flight
  * terminate. Spawns are serialized through `withStorageWorkerSpawnGate` so the
- * next Worker cannot be created until prior threads have exited. On Windows and
- * macOS, a post-close settle covers the OS join gap Bun does not expose
- * (Windows unbalanced join panic; macOS Silicon balanced-count segfault under
- * `bun test --isolate`).
+ * next Worker cannot be created until prior threads have exited. A post-close
+ * settle covers the OS/runtime join gap Bun does not expose on Windows, macOS,
+ * and Linux (including Bun 1.3.14 isolate crashes and Linux `epoll_ctl` reuse).
  */
 
 import { createAdmissionGate, type AdmissionMetrics, type AdmissionReservation } from "../lib/admission";
@@ -52,15 +51,15 @@ let spawnCancelEpoch = 0;
 /**
  * OS-join gap after the `close` event on platforms where Bun's Worker reclaim
  * races the isolate/file boundary (not a CI job-timeout bump).
- * Windows GHA at 250ms and 750ms still left `workers_spawned(N)
- * workers_terminated(N-1)` panics under isolate (seen mid
- * `storage-mutation-race` with 11/10). 1500ms covers deferred reclaim under
- * stacked policy/restore workers. Darwin uses 250ms.
+ * Windows GHA at 250ms and 750ms still left `workers_spawned(N)`
+ * `workers_terminated(N-1)` panics under isolate, so Windows keeps 1500ms.
+ * Darwin and Linux use a shorter settle for the balanced-count/epoll reclaim
+ * window seen on Bun 1.3.14.
  */
-const WORKER_OS_JOIN_MS = process.platform === "win32" ? 1_500 : 250;
-
-function needsWorkerOsJoinSettle(): boolean {
-  return process.platform === "win32" || process.platform === "darwin";
+export function storageWorkerOsJoinSettleMs(platform = process.platform): number {
+  if (platform === "win32") return 1_500;
+  if (platform === "darwin" || platform === "linux") return 250;
+  return 0;
 }
 
 /** Invalidate spawn callbacks still waiting on the gate (reset / server drain). */
@@ -181,9 +180,10 @@ export function terminateStorageWorker(worker: Worker, timeoutMs = 5_000): Promi
       // only forces `closed`, it does not prove the OS thread has exited.
       // Callers that catch and continue (e.g. drainAndShutdown) still need
       // that gap before the next isolate reclaim or server.stop.
-      if (needsWorkerOsJoinSettle()) {
+      const settleMs = storageWorkerOsJoinSettleMs();
+      if (settleMs > 0) {
         await Bun.sleep(0);
-        await Bun.sleep(WORKER_OS_JOIN_MS);
+        await Bun.sleep(settleMs);
       }
       if (timedOut) {
         throw new Error(`storage worker did not exit within ${timeoutMs}ms`);

package/src/tray/windows-tray.ps1

@@ -3,6 +3,9 @@ param(
   [Parameter(Mandatory = $true)][string]$CliPath,
   [Parameter(Mandatory = $true)][string]$CodexHome,
   [Parameter(Mandatory = $true)][string]$OpenCodexHome,
+  # Provenance of $BunPath, chosen when the tray entry was built. Optional so an
+  # already-installed launcher command from an older version still starts.
+  [ValidateSet("", "override", "bundled", "process")][string]$BunRuntimeSource = "",
   [ValidateSet("Run", "Stop")][string]$Mode = "Run",
   [int]$HostPid = 0
 )
@@ -81,7 +84,7 @@ function ConvertTo-NativeArgument([string]$Value) {
   return '"' + $Value + '"'
 }
 
-function Start-OcxCommand([string[]]$CommandArgs) {
+function Start-OcxCommand([string[]]$CommandArgs, [switch]$TrackExit) {
   try {
     $allArgs = @($CliPath) + $CommandArgs
     $psi = New-Object System.Diagnostics.ProcessStartInfo
@@ -92,9 +95,17 @@ function Start-OcxCommand([string[]]$CommandArgs) {
     $psi.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden
     $psi.EnvironmentVariables["CODEX_HOME"] = $CodexHome
     $psi.EnvironmentVariables["OPENCODEX_HOME"] = $OpenCodexHome
+    if ($BunRuntimeSource) {
+      $psi.EnvironmentVariables["OCX_BUN_RUNTIME_SOURCE"] = $BunRuntimeSource
+      # Paired with the source so a later relaunch can tell the marker still describes
+      # this binary rather than one it merely inherited.
+      $psi.EnvironmentVariables["OCX_BUN_RUNTIME_PATH"] = $BunPath
+    }
     $process = [System.Diagnostics.Process]::Start($psi)
-    if ($null -ne $process) { $process.Dispose() }
+    if ($null -eq $process) { throw "Process did not start" }
     Write-ActionLog "dispatched $($CommandArgs -join ' ')"
+    if ($TrackExit) { return $process }
+    $process.Dispose()
     return $true
   } catch {
     Write-ActionLog "launch failed: $($_.Exception.GetType().Name)"
@@ -163,18 +174,40 @@ $script:pendingAction = $null
 $script:pendingStarted = 0L
 $script:pendingDeadline = 0L
 $script:pendingOldProxyPid = $null
+$script:pendingProcess = $null
 
 function Set-PendingAction([string]$Action, [int]$TimeoutSeconds) {
+  if ($null -ne $script:pendingAction) {
+    Write-ActionLog "$Action ignored because $($script:pendingAction) is still pending"
+    return $false
+  }
+  if ($null -ne $script:pendingProcess) {
+    try {
+      $script:pendingProcess.Dispose()
+    } catch {
+      Write-ActionLog "pending process dispose failed: $($_.Exception.GetType().Name)"
+    }
+    $script:pendingProcess = $null
+  }
   $script:pendingAction = $Action
   $script:pendingStarted = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
   $script:pendingDeadline = $script:pendingStarted + ($TimeoutSeconds * 1000)
   $script:pendingOldProxyPid = $script:proxyPid
+  return $true
 }
 
 function Complete-PendingAction([bool]$Success) {
   if ($null -eq $script:pendingAction) { return }
   $action = $script:pendingAction
   $script:pendingAction = $null
+  if ($null -ne $script:pendingProcess) {
+    try {
+      $script:pendingProcess.Dispose()
+    } catch {
+      Write-ActionLog "pending process dispose failed: $($_.Exception.GetType().Name)"
+    }
+    $script:pendingProcess = $null
+  }
   if ($Success) {
     Write-ActionLog "$action completed (port=$($script:port), pid=$($script:proxyPid))"
     $notify.ShowBalloonTip(2500, "opencodex", "$action completed.", [System.Windows.Forms.ToolTipIcon]::Info)
@@ -217,6 +250,11 @@ function Update-TrayState {
     $stopItem.Enabled = $false
     $restartItem.Enabled = $false
   }
+  if ($null -ne $script:pendingAction) {
+    $startItem.Enabled = $false
+    $stopItem.Enabled = $false
+    $restartItem.Enabled = $false
+  }
   $heartbeat = @{ pid = $PID; timestamp = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds() }
   if ($HostPid -gt 0) { $heartbeat.hostPid = $HostPid }
   $heartbeatJson = $heartbeat | ConvertTo-Json -Compress
@@ -228,26 +266,59 @@ function Update-TrayState {
     $reached = ($script:pendingAction -eq "Start Proxy" -and $script:online) -or
       ($script:pendingAction -eq "Stop Proxy" -and -not $script:online) -or
       ($script:pendingAction -eq "Restart Proxy" -and $elapsed -gt 3000 -and $script:online -and $script:proxyPid -ne $script:pendingOldProxyPid)
-    if ($reached) { Complete-PendingAction $true }
+    $commandFailed = $false
+    if ($null -ne $script:pendingProcess) {
+      try {
+        $commandFailed = $script:pendingProcess.HasExited -and $script:pendingProcess.ExitCode -ne 0
+      } catch {
+        Write-ActionLog "pending process result inspection failed: $($_.Exception.GetType().Name)"
+        # If we cannot inspect the tracked command, we cannot prove it is still
+        # healthy. Fail the pending action instead of silently waiting for a later
+        # timeout and presenting an indeterminate process as success-capable.
+        $commandFailed = $true
+      }
+    }
+    if ($commandFailed) { Complete-PendingAction $false }
+    elseif ($reached) { Complete-PendingAction $true }
     elseif ($now -gt $script:pendingDeadline) { Complete-PendingAction $false }
   }
 }
 
 $openItem.add_Click({ Start-OcxCommand @("gui") })
 $startItem.add_Click({
+  if (-not (Set-PendingAction "Start Proxy" 75)) { return }
   $statusItem.Text = "Proxy: Starting..."
-  Set-PendingAction "Start Proxy" 15
-  if (-not (Start-OcxCommand @("__tray-start"))) { $script:pendingAction = $null }
+  # service start can spend 20s and the CLI then observes health for another 40s.
+  $startProcess = Start-OcxCommand @("__tray-start") -TrackExit
+  if ($startProcess -is [System.Diagnostics.Process]) {
+    $script:pendingProcess = $startProcess
+  } else {
+    Complete-PendingAction $false
+  }
 })
 $stopItem.add_Click({
+  if (-not (Set-PendingAction "Stop Proxy" 15)) { return }
   $statusItem.Text = "Proxy: Stopping..."
-  Set-PendingAction "Stop Proxy" 15
-  if (-not (Start-OcxCommand @("stop"))) { $script:pendingAction = $null }
+  $stopProcess = Start-OcxCommand @("stop") -TrackExit
+  if ($stopProcess -is [System.Diagnostics.Process]) {
+    $script:pendingProcess = $stopProcess
+  } else {
+    Complete-PendingAction $false
+  }
 })
 $restartItem.add_Click({
+  if (-not (Set-PendingAction "Restart Proxy" 160)) { return }
   $statusItem.Text = "Proxy: Restarting..."
-  Set-PendingAction "Restart Proxy" 20
-  if (-not (Start-OcxCommand @("__tray-restart"))) { $script:pendingAction = $null }
+  # /api/system/restart may drain active work for 60s and then spend up to 70s
+  # handing off to an identity-verified replacement. The tray observes health/PID
+  # rather than the detached CLI exit, so keep a watchdog margin around that shared
+  # lifecycle budget. The CLI remains the lifecycle owner; the tray never kills.
+  $restartProcess = Start-OcxCommand @("__tray-restart") -TrackExit
+  if ($restartProcess -is [System.Diagnostics.Process]) {
+    $script:pendingProcess = $restartProcess
+  } else {
+    Complete-PendingAction $false
+  }
 })
 $logsItem.add_Click({
   $psi = New-Object System.Diagnostics.ProcessStartInfo
@@ -280,6 +351,9 @@ try {
   $timer.Stop()
   $timer.Dispose()
   $notify.Visible = $false
+  if ($null -ne $script:pendingProcess) {
+    try { $script:pendingProcess.Dispose() } catch { $null = $_ }
+  }
   $notify.Dispose()
   foreach ($icon in $script:ownedIcons) { $icon.Dispose() }
   $menu.Dispose()

package/src/tray/windows.ts

@@ -1,12 +1,15 @@
 import { execFile, execFileSync, spawn } from "node:child_process";
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join, resolve } from "node:path";
 import { expandUserPath, getConfigDir } from "../config";
-import { durableBunPath } from "../lib/bun-runtime";
-import { forgetHardenedSecretPath, hardenSecretDir, hardenSecretPath } from "../lib/windows-secret-acl";
+import { durableBunRuntime } from "../lib/bun-runtime";
+import type { BunRuntimeSource } from "../lib/bun-runtime";
+import { forgetEphemeralSecretPath, hardenSecretDir, hardenSecretPath } from "../lib/windows-secret-acl";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
+import { renameAtomicFile } from "../lib/windows-atomic-replace";
+import { decodeWindowsTextBytes } from "../lib/windows-text";
 
 const RUN_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run";
 const RUN_PARENT_KEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion";
@@ -20,6 +23,8 @@ const TRAY_ICON_FILES = [
 
 export interface WindowsTrayEntry {
   bun: string;
+  /** Provenance of `bun`, resolved together with it. */
+  bunRuntimeSource: BunRuntimeSource;
   cli: string;
   script: string;
   codexHome: string;
@@ -81,8 +86,10 @@ function currentCodexHome(): string {
 }
 
 function currentEntry(): WindowsTrayEntry {
+  const runtime = durableBunRuntime();
   return {
-    bun: durableBunPath(),
+    bun: runtime.path,
+    bunRuntimeSource: runtime.source,
     cli: join(import.meta.dir, "..", "cli", "index.ts"),
     script: installedTrayScriptPath(),
     codexHome: currentCodexHome(),
@@ -111,12 +118,31 @@ function registryExe(): string {
   return existsSync(candidate) ? candidate : "reg.exe";
 }
 
+/**
+ * Decode `reg.exe` output the way the rest of the product decodes Windows console
+ * output.
+ *
+ * `reg.exe` writes the console ANSI code page when its output is redirected, not
+ * UTF-8. Reading it as utf8 corrupts every non-ASCII byte, so a profile path such
+ * as `C:\Users\M<o-umlaut>tz` came back with replacement characters, the
+ * comparison against the value we wrote could never match, `registrationOwned`
+ * went false, and the CLI reported the tray registration as
+ * "foreign, stale, or points to missing package files" over an entry that was
+ * correct and owned (#1933).
+ *
+ * `decodeWindowsTextBytes` already solves this for `schtasks` (#1573). The tray
+ * reader was the site that class fix missed.
+ */
+function decodeRegistryOutput(stdout: Buffer | string): string {
+  const bytes = typeof stdout === "string" ? Buffer.from(stdout, "binary") : stdout;
+  return decodeWindowsTextBytes(bytes).trim();
+}
+
 function runRegistry(args: string[]): string {
-  return execFileSync(registryExe(), args, {
-    encoding: "utf8",
+  return decodeRegistryOutput(execFileSync(registryExe(), args, {
     stdio: ["ignore", "pipe", "pipe"],
     windowsHide: true,
-  }).trim();
+  }));
 }
 
 function safePath(value: string): string {
@@ -133,9 +159,9 @@ export function windowsTrayProcessArgs(entry: WindowsTrayEntry, mode: "Run" | "S
     "-NonInteractive",
     "-STA",
     "-ExecutionPolicy", "Bypass",
-    "-WindowStyle", "Hidden",
     "-File", safePath(entry.script),
     "-BunPath", safePath(entry.bun),
+    "-BunRuntimeSource", entry.bunRuntimeSource,
     "-CliPath", safePath(entry.cli),
     "-CodexHome", safePath(entry.codexHome),
     "-OpenCodexHome", safePath(entry.opencodexHome),
@@ -167,9 +193,9 @@ export function buildWindowsTrayPowerShellCommand(entry: WindowsTrayEntry, power
     "-NonInteractive",
     "-STA",
     "-ExecutionPolicy", "Bypass",
-    "-WindowStyle", "Hidden",
     "-File", quoteRunValue(entry.script),
     "-BunPath", quoteRunValue(entry.bun),
+    "-BunRuntimeSource", entry.bunRuntimeSource,
     "-CliPath", quoteRunValue(entry.cli),
     "-CodexHome", quoteRunValue(entry.codexHome),
     "-OpenCodexHome", quoteRunValue(entry.opencodexHome),
@@ -233,10 +259,11 @@ export function replaceWindowsTrayOwnedFile(
     harden: target => {
       try { chmodSync(target, 0o600); } catch { /* best-effort */ }
       if (process.platform !== "win32") return;
-      const hardened = hardenSecretPath(target, { required: true });
+      // Destination-keyed timeout memo: retries share one memo per final path.
+      const hardened = hardenSecretPath(target, { required: true, timeoutMemoKey: path });
       if (!hardened.ok) throw new Error("Windows tray ACL hardening did not complete; refusing to persist executable state.");
     },
-    rename: renameSync,
+    rename: (source, destination) => renameAtomicFile(source, destination, undefined, "tray"),
     unlink: unlinkSync,
   },
 ): void {
@@ -247,14 +274,14 @@ export function replaceWindowsTrayOwnedFile(
     io.harden(temporary);
     io.rename(temporary, path);
     renamed = true;
-    forgetHardenedSecretPath(temporary);
+    forgetEphemeralSecretPath(temporary);
   } finally {
     if (!renamed) {
       try {
         io.unlink(temporary);
-        forgetHardenedSecretPath(temporary);
+        forgetEphemeralSecretPath(temporary);
       } catch (error) {
-        if ((error as NodeJS.ErrnoException).code === "ENOENT") forgetHardenedSecretPath(temporary);
+        if ((error as NodeJS.ErrnoException).code === "ENOENT") forgetEphemeralSecretPath(temporary);
       }
     }
   }
@@ -328,13 +355,13 @@ function readOwnedRunValue(runValue = windowsTrayRunValue(getConfigDir())): stri
 function runRegistryAsync(args: string[]): Promise<string> {
   return new Promise((resolvePromise, rejectPromise) => {
     execFile(registryExe(), args, {
-      encoding: "utf8",
+      encoding: "buffer",
       timeout: 2_000,
       windowsHide: true,
       maxBuffer: 64 * 1024,
     }, (error, stdout) => {
       if (error) rejectPromise(error);
-      else resolvePromise(stdout.trim());
+      else resolvePromise(decodeRegistryOutput(stdout));
     });
   });
 }

package/src/types/accounts.ts

@@ -0,0 +1,37 @@
+export interface CodexAccount {
+  id: string;
+  email: string;
+  /** User-owned display label; never participates in routing or identity checks. */
+  alias?: string;
+  plan?: string;
+  /**
+   * Provenance of `plan`. WHAM (live quota API) is authoritative; the JWT
+   * `chatgpt_plan_type` claim is a fallback that may lag a plan change. A JWT write
+   * must never overwrite a WHAM-sourced plan observed for the same credential
+   * generation — only a newer generation (token refresh after the WHAM read) may.
+   */
+  planSource?: "jwt" | "wham";
+  /** Credential generation at which `plan`/`planSource` was recorded. */
+  planCredentialGeneration?: number;
+  chatgptAccountId?: string;
+  logLabel?: string;
+  isMain: boolean;
+}
+
+export interface CodexAccountCredentials {
+  accessToken: string;
+  refreshToken: string;
+  expiresAt: number;
+  chatgptAccountId: string;
+}
+
+export interface CodexAccountCredentialRecord {
+  credential?: CodexAccountCredentials;
+  generation: number;
+  refreshGrantFingerprint?: string;
+  deletedAt?: number;
+  replacedAt?: number;
+  lastCodexValidatedAt?: number;
+  lastCodexValidationStatus?: "ok" | "failed";
+  lastCodexValidationError?: string;
+}