@iislee/opencodex 2.11.0 → 2.35.0

package/src/sidecar/auth.ts

@@ -0,0 +1,92 @@
+/**
+ * The one place that decides whether a sidecar may treat ChatGPT or Anthropic
+ * auth as PRESENT (#2188). Web-search and vision consumed two hand-rolled
+ * copies of the Anthropic predicate and no Codex-login predicate at all —
+ * provider presence was standing in for "logged in", which let a fresh install
+ * with the built-in forward provider but no credential offer Luna as a
+ * describer it could never run.
+ *
+ * Both flags are request-context-free: they read config plus the stored
+ * account state, never headers. Per-request usability (exact accounts,
+ * generation fences) stays in resolveFirstUsableOpenAiSidecar and the
+ * executors; this module only answers "is this side worth offering at all?".
+ */
+import type { OcxConfig, OcxProviderConfig } from "../types";
+import { listOpenAiForwardSidecarCandidates } from "../providers/openai-sidecar";
+import { OPENAI_CODEX_PROVIDER_ID } from "../providers/openai-tiers";
+import { isCodexAccountUsable } from "../codex/account-usability";
+import { MAIN_CODEX_ACCOUNT_ID, isSelectableCodexPoolAccount } from "../codex/account-id";
+import { getAccountSet } from "../oauth/store";
+
+export interface SidecarAuthState {
+  /** ChatGPT login usable: canonical forward provider AND a live stored credential. */
+  isCodexAuth: boolean;
+  /** Enabled anthropic-adapter OAuth provider whose active account is not marked for reauth. */
+  isAnthropicAuth: boolean;
+  /** The provider an Anthropic-side executor would dispatch through, when isAnthropicAuth. */
+  anthropicProviderName?: string;
+  anthropicProvider?: OcxProviderConfig;
+}
+
+/**
+ * Fixed auth-slot models (#2188): logged-in sides keep these candidates even
+ * when the picker hides or disables them. The slot is the LOGIN's entitlement,
+ * not the catalog's.
+ */
+export const AUTH_SLOT_MODELS = {
+  codex: "gpt-5.6-luna",
+  anthropic: "claude-haiku-4-5",
+} as const;
+
+export interface SidecarAuthSlot {
+  provider: string;
+  id: string;
+  slot: keyof typeof AUTH_SLOT_MODELS;
+}
+
+/** Login-shaped, not provider-shaped: a forward provider with no credential is NOT Codex auth. */
+function hasUsableCodexLogin(config: OcxConfig): boolean {
+  if (listOpenAiForwardSidecarCandidates(config).length === 0) return false;
+  if (isCodexAccountUsable(config, MAIN_CODEX_ACCOUNT_ID)) return true;
+  return (config.codexAccounts ?? []).some(account =>
+    isSelectableCodexPoolAccount(account) && isCodexAccountUsable(config, account.id));
+}
+
+/**
+ * The predicate previously duplicated as findAnthropicSidecarProvider
+ * (web-search) and findAnthropicVisionProvider (vision): first enabled
+ * anthropic-adapter OAuth provider whose ACTIVE stored account holds a usable
+ * credential. getAccountSet + needsReauth, not getCredential — a terminally
+ * invalid account must not present as auth (audit F1).
+ */
+function findAnthropicAuthProvider(
+  config: OcxConfig,
+): { providerName: string; provider: OcxProviderConfig } | undefined {
+  for (const [providerName, provider] of Object.entries(config.providers)) {
+    if (provider.disabled === true) continue;
+    if (provider.adapter !== "anthropic" || provider.authMode !== "oauth") continue;
+    const set = getAccountSet(providerName);
+    const active = set?.accounts.find(account => account.id === set.activeAccountId);
+    if (active && active.needsReauth !== true) return { providerName, provider };
+  }
+  return undefined;
+}
+
+export function resolveSidecarAuth(config: OcxConfig): SidecarAuthState {
+  const anthropic = findAnthropicAuthProvider(config);
+  return {
+    isCodexAuth: hasUsableCodexLogin(config),
+    isAnthropicAuth: anthropic !== undefined,
+    ...(anthropic ? { anthropicProviderName: anthropic.providerName, anthropicProvider: anthropic.provider } : {}),
+  };
+}
+
+/** The auth-entitled fixed candidates. Emitted regardless of picker visibility. */
+export function sidecarAuthSlots(auth: SidecarAuthState): SidecarAuthSlot[] {
+  const slots: SidecarAuthSlot[] = [];
+  if (auth.isCodexAuth) slots.push({ provider: OPENAI_CODEX_PROVIDER_ID, id: AUTH_SLOT_MODELS.codex, slot: "codex" });
+  if (auth.isAnthropicAuth && auth.anthropicProviderName) {
+    slots.push({ provider: auth.anthropicProviderName, id: AUTH_SLOT_MODELS.anthropic, slot: "anthropic" });
+  }
+  return slots;
+}

package/src/sidecar/candidates.ts

@@ -0,0 +1,83 @@
+/**
+ * The unified picker-visibility candidate set both sidecars consume (#2188).
+ *
+ * Rule 1 (picker): a model may be OFFERED as a sidecar backend only if the
+ * management picker would show it — the same `listManagementModelRows` rows
+ * the GUI Models tab renders, minus disabled rows. Rule 1's only exception is
+ * the auth slots: a logged-in side keeps its fixed slot model (Luna/Haiku)
+ * even when the picker hides it, because the slot is the login's entitlement.
+ *
+ * Vision additionally applies rule 2 (− provably text-only); web-search
+ * applies its own rule 2 (∩ probed backend with an executor) in
+ * src/web-search/backends.ts. Both start from THIS set so the two sidecars
+ * cannot diverge on what "visible" means.
+ */
+import type { OcxConfig } from "../types";
+import { listManagementModelRows } from "../server/management/model-rows";
+import { modelAcceptsImageInput, type VisionCandidateModel } from "../vision/eligibility";
+import { sidecarAuthSlots, type SidecarAuthState } from "./auth";
+
+export interface SidecarCandidate {
+  provider: string;
+  id: string;
+  native?: boolean;
+  inputModalities?: string[];
+  /** True when this row is an auth-slot entitlement rather than a picker row. */
+  authSlot?: boolean;
+}
+
+/**
+ * (picker-visible rows) ∪ (auth slots). De-duplicated by provider+id with the
+ * auth-slot flag winning, so a slot model that is ALSO picker-visible still
+ * reads as slot-backed. A catalog outage degrades to slots only — the settings
+ * routes must not 500 and must keep the logged-in floor populated.
+ */
+export async function pickerVisibleSidecarCandidates(
+  config: OcxConfig,
+  auth: SidecarAuthState,
+): Promise<SidecarCandidate[]> {
+  let rows: Awaited<ReturnType<typeof listManagementModelRows>> = [];
+  try { rows = await listManagementModelRows(config); } catch { rows = []; }
+  const byKey = new Map<string, SidecarCandidate>();
+  for (const row of rows) {
+    if (row.disabled === true) continue;
+    byKey.set(`${row.provider}/${row.id}`, {
+      provider: row.provider,
+      id: row.id,
+      ...(row.inputModalities ? { inputModalities: row.inputModalities } : {}),
+      ...(row.native ? { native: true } : {}),
+    });
+  }
+  for (const slot of sidecarAuthSlots(auth)) {
+    byKey.set(`${slot.provider}/${slot.id}`, {
+      provider: slot.provider,
+      id: slot.id,
+      // Slot models are known image-capable; their only exclusion path is the
+      // provider's explicit consumer list (same stance as baselineCandidate).
+      inputModalities: ["text", "image"],
+      authSlot: true,
+    });
+  }
+  return [...byKey.values()];
+}
+
+/**
+ * Rule 2 for vision: drop rows PROVABLY text-only. Unknown stays eligible —
+ * the picker filter (rule 1) already bounded the set, so permissive-unknown
+ * no longer expands to the whole catalog.
+ */
+export function visionSidecarCandidates(
+  config: Pick<OcxConfig, "providers">,
+  all: readonly SidecarCandidate[],
+): SidecarCandidate[] {
+  return all.filter(candidate => modelAcceptsImageInput(config, toVisionCandidate(candidate)) !== false);
+}
+
+function toVisionCandidate(candidate: SidecarCandidate): VisionCandidateModel {
+  return {
+    provider: candidate.provider,
+    id: candidate.id,
+    ...(candidate.inputModalities ? { inputModalities: candidate.inputModalities } : {}),
+    ...(candidate.native ? { native: true } : {}),
+  };
+}

package/src/storage/cleanup.ts

@@ -1091,7 +1091,7 @@ function writeSatelliteBackup(
     throw new Error("test_fail_satellite_backup_replace");
   }
   try {
-    renameAtomicFile(tmp, dest);
+    renameAtomicFile(tmp, dest, undefined, "storage-cleanup");
   } catch (error) {
     try { unlinkSync(tmp); } catch { /* */ }
     throw error;
@@ -2435,7 +2435,7 @@ function writeRestorePending(
     throw new Error("test_fail_pending_rename");
   }
   try {
-    renameSync(tmp, dest);
+    renameAtomicFile(tmp, dest, undefined, "storage-cleanup");
   } catch (error) {
     try { unlinkSync(tmp); } catch { /* */ }
     throw error;

package/src/storage/policy-job.ts

@@ -38,6 +38,7 @@ export interface PolicyJobOutcome {
   freedBytes?: number;
   removed?: number;
   trashDir?: string;
+  metadataPersistenceError?: PolicyRunResult["metadataPersistenceError"];
 }
 
 export interface PolicyJobState {
@@ -238,6 +239,7 @@ export async function abortStorageCleanupPolicyJobAsync(): Promise<void> {
   }
 }
 
+/** Project a run result into the bounded management-API job outcome. */
 function outcomeFromResult(result: PolicyRunResult): PolicyJobOutcome {
   return {
     ok: result.ok,
@@ -248,18 +250,26 @@ function outcomeFromResult(result: PolicyRunResult): PolicyJobOutcome {
     ...(result.freedBytes !== undefined ? { freedBytes: result.freedBytes } : {}),
     ...(result.removed !== undefined ? { removed: result.removed } : {}),
     ...(result.trashDir ? { trashDir: result.trashDir } : {}),
+    ...(result.metadataPersistenceError
+      ? { metadataPersistenceError: result.metadataPersistenceError }
+      : {}),
   };
 }
 
+/** Publish one completed evaluation without losing successful cleanup effects. */
 function applyFinished(result: PolicyRunResult): void {
   // Prefer the latest persisted policy over `result.policy`. The worker (or
   // in-process run) already merged run metadata into disk; a concurrent PUT
   // may also have landed after that write. Re-reading avoids applying a stale
   // start-of-job snapshot when the run skipped without saving.
-  try {
-    livePolicyApply?.(readStorageCleanupPolicyFromConfig());
-  } catch {
-    livePolicyApply?.(result.policy);
+  // A best-effort fallback policy may predate concurrent edits; keep the current
+  // live config untouched when the durable metadata write did not land.
+  if (!result.metadataPersistenceError) {
+    try {
+      livePolicyApply?.(readStorageCleanupPolicyFromConfig());
+    } catch {
+      livePolicyApply?.(result.policy);
+    }
   }
   state = {
     status: "idle",

package/src/storage/policy.ts

@@ -8,7 +8,7 @@
  * Privacy: logs never include host paths, digests of file contents, or secrets.
  */
 import { resolveCodexHomeDir } from "../codex/home";
-import { loadConfig, saveConfigPreservingClaudeCode } from "../config";
+import { loadConfig, mutatePersistedConfig, saveConfigPreservingClaudeCode } from "../config";
 import type { StorageCleanupPolicy } from "../types";
 import {
   computePreviewDigest,
@@ -38,6 +38,7 @@ export function setStorageCleanupPolicyLiveSink(
 
 export type PolicySchedule = StorageCleanupPolicy["schedule"];
 export type PolicyRunReason = "startup" | "schedule" | "manual";
+export type PolicyMetadataPersistenceError = "missing" | "invalid" | "conflict" | "write_failed";
 
 export type PolicySkipReason =
   | "disabled"
@@ -54,6 +55,7 @@ export interface PolicyRunResult {
   freedBytes?: number;
   removed?: number;
   trashDir?: string;
+  metadataPersistenceError?: PolicyMetadataPersistenceError;
   policy: StorageCleanupPolicy;
 }
 
@@ -399,6 +401,21 @@ export type PolicyRunMetadataPatch = {
   lastRun?: StorageCleanupPolicy["lastRun"];
 };
 
+/** Apply only run-owned fields while preserving the supplied policy settings. */
+function applyPolicyRunMetadata(
+  policy: StorageCleanupPolicy,
+  patch: PolicyRunMetadataPatch,
+): StorageCleanupPolicy {
+  let next =
+    patch.nextRun === "defer_busy"
+      ? deferBusy(policy, patch.now)
+      : advanceNextRun(policy, patch.now);
+  if (patch.lastRun) {
+    next = { ...next, lastRun: patch.lastRun };
+  }
+  return next;
+}
+
 /**
  * Reload the latest persisted policy and write only run-owned metadata
  * (`lastRun` / `nextRun`). Preserves concurrent edits to enabled, trigger,
@@ -410,17 +427,57 @@ export function commitPolicyRunMetadata(
   patch: PolicyRunMetadataPatch,
 ): StorageCleanupPolicy {
   const latest = normalizeStorageCleanupPolicy(load());
-  let next =
-    patch.nextRun === "defer_busy"
-      ? deferBusy(latest, patch.now)
-      : advanceNextRun(latest, patch.now);
-  if (patch.lastRun) {
-    next = { ...next, lastRun: patch.lastRun };
-  }
+  const next = applyPolicyRunMetadata(latest, patch);
   save(next);
   return next;
 }
 
+type PolicyRunMetadataCommit = {
+  policy: StorageCleanupPolicy;
+  persistenceError?: PolicyMetadataPersistenceError;
+};
+
+/** Attach the durable metadata outcome without replacing cleanup status or metrics. */
+function withMetadataCommit(
+  result: Omit<PolicyRunResult, "policy" | "metadataPersistenceError">,
+  committed: PolicyRunMetadataCommit,
+): PolicyRunResult {
+  return {
+    ...result,
+    policy: committed.policy,
+    ...(committed.persistenceError ? { metadataPersistenceError: committed.persistenceError } : {}),
+  };
+}
+
+/** Recompute run-owned metadata from the latest config inside the mutation lock. */
+function commitPolicyRunMetadataToConfig(
+  patch: PolicyRunMetadataPatch,
+  fallbackPolicy: StorageCleanupPolicy,
+): PolicyRunMetadataCommit {
+  const unavailable = (reason: PolicyMetadataPersistenceError): PolicyRunMetadataCommit => {
+    console.warn(`[storage-policy] metadata_persist_failed reason=${reason}`);
+    return {
+      policy: applyPolicyRunMetadata(fallbackPolicy, patch),
+      persistenceError: reason,
+    };
+  };
+  try {
+    const outcome = mutatePersistedConfig(config => {
+      const next = applyPolicyRunMetadata(
+        normalizeStorageCleanupPolicy(config.storageCleanupPolicy),
+        patch,
+      );
+      config.storageCleanupPolicy = next;
+      return { changed: true, value: next };
+    });
+    if (outcome.status === "unavailable") return unavailable(outcome.reason);
+    livePolicySink?.(outcome.value);
+    return { policy: outcome.value };
+  } catch {
+    return unavailable("write_failed");
+  }
+}
+
 function logPolicyEvent(message: string): void {
   console.log(`[storage-policy] ${message}`);
 }
@@ -434,8 +491,14 @@ export function runStorageCleanupPolicy(deps: PolicyRunDeps): PolicyRunResult {
   const load = deps.loadPolicy ?? readStorageCleanupPolicyFromConfig;
   const save = deps.savePolicy ?? writeStorageCleanupPolicyToConfig;
   const execute = deps.execute ?? executeArchivedCleanup;
-
   const policy = normalizeStorageCleanupPolicy(load());
+  // Injected stores retain the existing load/save contract. The production path
+  // recomputes metadata from the latest persisted policy inside the config lock.
+  const commitMetadata = deps.loadPolicy !== undefined || deps.savePolicy !== undefined
+    ? (patch: PolicyRunMetadataPatch): PolicyRunMetadataCommit => ({
+        policy: commitPolicyRunMetadata(load, save, patch),
+      })
+    : (patch: PolicyRunMetadataPatch) => commitPolicyRunMetadataToConfig(patch, policy);
 
   if (typeof deps.holdAfterLoadMs === "number" && Number.isFinite(deps.holdAfterLoadMs) && deps.holdAfterLoadMs > 0) {
     Bun.sleepSync(Math.floor(deps.holdAfterLoadMs));
@@ -451,15 +514,15 @@ export function runStorageCleanupPolicy(deps: PolicyRunDeps): PolicyRunResult {
 
   const selection = selectPolicyPreview(policy, deps.codexHome);
   if (selection.archivedBytes <= policy.trigger.archivedBytesOver) {
-    const saved = commitPolicyRunMetadata(load, save, { now, nextRun: "advance" });
+    const committed = commitMetadata({ now, nextRun: "advance" });
     logPolicyEvent("skip under_threshold");
-    return { ok: true, skipped: "under_threshold", policy: saved };
+    return withMetadataCommit({ ok: true, skipped: "under_threshold" }, committed);
   }
 
   if (selection.count === 0) {
-    const saved = commitPolicyRunMetadata(load, save, { now, nextRun: "advance" });
+    const committed = commitMetadata({ now, nextRun: "advance" });
     logPolicyEvent("skip nothing_selected");
-    return { ok: true, skipped: "nothing_selected", policy: saved };
+    return withMetadataCommit({ ok: true, skipped: "nothing_selected" }, committed);
   }
 
   const result = execute({
@@ -473,25 +536,28 @@ export function runStorageCleanupPolicy(deps: PolicyRunDeps): PolicyRunResult {
   });
 
   if (!result.ok && result.error === "codex_busy") {
-    const saved = commitPolicyRunMetadata(load, save, { now, nextRun: "defer_busy" });
+    const committed = commitMetadata({ now, nextRun: "defer_busy" });
     logPolicyEvent("defer codex_busy");
-    return { ok: false, deferred: "codex_busy", error: "codex_busy", policy: saved };
+    return withMetadataCommit({
+      ok: false,
+      deferred: "codex_busy",
+      error: "codex_busy",
+    }, committed);
   }
 
   if (!result.ok) {
     // Non-busy failure: still advance schedule so we do not tight-loop.
-    const saved = commitPolicyRunMetadata(load, save, { now, nextRun: "advance" });
+    const committed = commitMetadata({ now, nextRun: "advance" });
     logPolicyEvent(`fail ${result.error ?? "cleanup_failed"}`);
-    return {
+    return withMetadataCommit({
       ok: false,
       error: result.error,
       mode: result.mode,
       ...(result.trashDir ? { trashDir: result.trashDir } : {}),
-      policy: saved,
-    };
+    }, committed);
   }
 
-  const saved = commitPolicyRunMetadata(load, save, {
+  const committed = commitMetadata({
     now,
     nextRun: "advance",
     lastRun: {
@@ -503,14 +569,13 @@ export function runStorageCleanupPolicy(deps: PolicyRunDeps): PolicyRunResult {
   logPolicyEvent(
     `ok mode=${result.mode} removed=${result.count} freedBytes=${result.bytes}`,
   );
-  return {
+  return withMetadataCommit({
     ok: true,
     mode: result.mode,
     freedBytes: result.bytes,
     removed: result.count,
     ...(result.trashDir ? { trashDir: result.trashDir } : {}),
-    policy: saved,
-  };
+  }, committed);
 }
 
 /** Startup / schedule tick entry — swallows unexpected errors. */

package/src/storage/scanner.ts

@@ -16,7 +16,7 @@ const IMMUTABLE_READONLY_FLAGS = constants.SQLITE_OPEN_READONLY | constants.SQLI
 
 /**
  * Read-only CODEX_HOME storage scanner — Phase 1 of the Storage page epic
- * (devlog/_plan/500_storage-page-session-cleanup). Pure measurement: sizes via
+ * (devlog/_fin/500_storage-page-session-cleanup). Pure measurement: sizes via
  * fs.stat walks, DB row counts via immutable readonly opens that degrade to
  * null on lock/corruption. Performs zero writes under CODEX_HOME.
  */

package/src/storage/worker-lifecycle.ts

@@ -11,10 +11,9 @@
  * time (so we cannot miss `self.close()` / early exit), stays in `liveWorkers`
  * until that close settles, and `drainStorageWorkers()` joins every in-flight
  * terminate. Spawns are serialized through `withStorageWorkerSpawnGate` so the
- * next Worker cannot be created until prior threads have exited. On Windows and
- * macOS, a post-close settle covers the OS join gap Bun does not expose
- * (Windows unbalanced join panic; macOS Silicon balanced-count segfault under
- * `bun test --isolate`).
+ * next Worker cannot be created until prior threads have exited. A post-close
+ * settle covers the OS/runtime join gap Bun does not expose on Windows, macOS,
+ * and Linux (including Bun 1.3.14 isolate crashes and Linux `epoll_ctl` reuse).
  */
 
 import { createAdmissionGate, type AdmissionMetrics, type AdmissionReservation } from "../lib/admission";
@@ -52,15 +51,15 @@ let spawnCancelEpoch = 0;
 /**
  * OS-join gap after the `close` event on platforms where Bun's Worker reclaim
  * races the isolate/file boundary (not a CI job-timeout bump).
- * Windows GHA at 250ms and 750ms still left `workers_spawned(N)
- * workers_terminated(N-1)` panics under isolate (seen mid
- * `storage-mutation-race` with 11/10). 1500ms covers deferred reclaim under
- * stacked policy/restore workers. Darwin uses 250ms.
+ * Windows GHA at 250ms and 750ms still left `workers_spawned(N)`
+ * `workers_terminated(N-1)` panics under isolate, so Windows keeps 1500ms.
+ * Darwin and Linux use a shorter settle for the balanced-count/epoll reclaim
+ * window seen on Bun 1.3.14.
  */
-const WORKER_OS_JOIN_MS = process.platform === "win32" ? 1_500 : 250;
-
-function needsWorkerOsJoinSettle(): boolean {
-  return process.platform === "win32" || process.platform === "darwin";
+export function storageWorkerOsJoinSettleMs(platform = process.platform): number {
+  if (platform === "win32") return 1_500;
+  if (platform === "darwin" || platform === "linux") return 250;
+  return 0;
 }
 
 /** Invalidate spawn callbacks still waiting on the gate (reset / server drain). */
@@ -181,9 +180,10 @@ export function terminateStorageWorker(worker: Worker, timeoutMs = 5_000): Promi
       // only forces `closed`, it does not prove the OS thread has exited.
       // Callers that catch and continue (e.g. drainAndShutdown) still need
       // that gap before the next isolate reclaim or server.stop.
-      if (needsWorkerOsJoinSettle()) {
+      const settleMs = storageWorkerOsJoinSettleMs();
+      if (settleMs > 0) {
         await Bun.sleep(0);
-        await Bun.sleep(WORKER_OS_JOIN_MS);
+        await Bun.sleep(settleMs);
       }
       if (timedOut) {
         throw new Error(`storage worker did not exit within ${timeoutMs}ms`);

package/src/tray/windows-tray.ps1

@@ -3,6 +3,9 @@ param(
   [Parameter(Mandatory = $true)][string]$CliPath,
   [Parameter(Mandatory = $true)][string]$CodexHome,
   [Parameter(Mandatory = $true)][string]$OpenCodexHome,
+  # Provenance of $BunPath, chosen when the tray entry was built. Optional so an
+  # already-installed launcher command from an older version still starts.
+  [ValidateSet("", "override", "bundled", "process")][string]$BunRuntimeSource = "",
   [ValidateSet("Run", "Stop")][string]$Mode = "Run",
   [int]$HostPid = 0
 )
@@ -81,7 +84,7 @@ function ConvertTo-NativeArgument([string]$Value) {
   return '"' + $Value + '"'
 }
 
-function Start-OcxCommand([string[]]$CommandArgs) {
+function Start-OcxCommand([string[]]$CommandArgs, [switch]$TrackExit) {
   try {
     $allArgs = @($CliPath) + $CommandArgs
     $psi = New-Object System.Diagnostics.ProcessStartInfo
@@ -92,9 +95,17 @@ function Start-OcxCommand([string[]]$CommandArgs) {
     $psi.WindowStyle = [System.Diagnostics.ProcessWindowStyle]::Hidden
     $psi.EnvironmentVariables["CODEX_HOME"] = $CodexHome
     $psi.EnvironmentVariables["OPENCODEX_HOME"] = $OpenCodexHome
+    if ($BunRuntimeSource) {
+      $psi.EnvironmentVariables["OCX_BUN_RUNTIME_SOURCE"] = $BunRuntimeSource
+      # Paired with the source so a later relaunch can tell the marker still describes
+      # this binary rather than one it merely inherited.
+      $psi.EnvironmentVariables["OCX_BUN_RUNTIME_PATH"] = $BunPath
+    }
     $process = [System.Diagnostics.Process]::Start($psi)
-    if ($null -ne $process) { $process.Dispose() }
+    if ($null -eq $process) { throw "Process did not start" }
     Write-ActionLog "dispatched $($CommandArgs -join ' ')"
+    if ($TrackExit) { return $process }
+    $process.Dispose()
     return $true
   } catch {
     Write-ActionLog "launch failed: $($_.Exception.GetType().Name)"
@@ -163,18 +174,40 @@ $script:pendingAction = $null
 $script:pendingStarted = 0L
 $script:pendingDeadline = 0L
 $script:pendingOldProxyPid = $null
+$script:pendingProcess = $null
 
 function Set-PendingAction([string]$Action, [int]$TimeoutSeconds) {
+  if ($null -ne $script:pendingAction) {
+    Write-ActionLog "$Action ignored because $($script:pendingAction) is still pending"
+    return $false
+  }
+  if ($null -ne $script:pendingProcess) {
+    try {
+      $script:pendingProcess.Dispose()
+    } catch {
+      Write-ActionLog "pending process dispose failed: $($_.Exception.GetType().Name)"
+    }
+    $script:pendingProcess = $null
+  }
   $script:pendingAction = $Action
   $script:pendingStarted = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
   $script:pendingDeadline = $script:pendingStarted + ($TimeoutSeconds * 1000)
   $script:pendingOldProxyPid = $script:proxyPid
+  return $true
 }
 
 function Complete-PendingAction([bool]$Success) {
   if ($null -eq $script:pendingAction) { return }
   $action = $script:pendingAction
   $script:pendingAction = $null
+  if ($null -ne $script:pendingProcess) {
+    try {
+      $script:pendingProcess.Dispose()
+    } catch {
+      Write-ActionLog "pending process dispose failed: $($_.Exception.GetType().Name)"
+    }
+    $script:pendingProcess = $null
+  }
   if ($Success) {
     Write-ActionLog "$action completed (port=$($script:port), pid=$($script:proxyPid))"
     $notify.ShowBalloonTip(2500, "opencodex", "$action completed.", [System.Windows.Forms.ToolTipIcon]::Info)
@@ -217,6 +250,11 @@ function Update-TrayState {
     $stopItem.Enabled = $false
     $restartItem.Enabled = $false
   }
+  if ($null -ne $script:pendingAction) {
+    $startItem.Enabled = $false
+    $stopItem.Enabled = $false
+    $restartItem.Enabled = $false
+  }
   $heartbeat = @{ pid = $PID; timestamp = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds() }
   if ($HostPid -gt 0) { $heartbeat.hostPid = $HostPid }
   $heartbeatJson = $heartbeat | ConvertTo-Json -Compress
@@ -228,26 +266,59 @@ function Update-TrayState {
     $reached = ($script:pendingAction -eq "Start Proxy" -and $script:online) -or
       ($script:pendingAction -eq "Stop Proxy" -and -not $script:online) -or
       ($script:pendingAction -eq "Restart Proxy" -and $elapsed -gt 3000 -and $script:online -and $script:proxyPid -ne $script:pendingOldProxyPid)
-    if ($reached) { Complete-PendingAction $true }
+    $commandFailed = $false
+    if ($null -ne $script:pendingProcess) {
+      try {
+        $commandFailed = $script:pendingProcess.HasExited -and $script:pendingProcess.ExitCode -ne 0
+      } catch {
+        Write-ActionLog "pending process result inspection failed: $($_.Exception.GetType().Name)"
+        # If we cannot inspect the tracked command, we cannot prove it is still
+        # healthy. Fail the pending action instead of silently waiting for a later
+        # timeout and presenting an indeterminate process as success-capable.
+        $commandFailed = $true
+      }
+    }
+    if ($commandFailed) { Complete-PendingAction $false }
+    elseif ($reached) { Complete-PendingAction $true }
     elseif ($now -gt $script:pendingDeadline) { Complete-PendingAction $false }
   }
 }
 
 $openItem.add_Click({ Start-OcxCommand @("gui") })
 $startItem.add_Click({
+  if (-not (Set-PendingAction "Start Proxy" 75)) { return }
   $statusItem.Text = "Proxy: Starting..."
-  Set-PendingAction "Start Proxy" 15
-  if (-not (Start-OcxCommand @("__tray-start"))) { $script:pendingAction = $null }
+  # service start can spend 20s and the CLI then observes health for another 40s.
+  $startProcess = Start-OcxCommand @("__tray-start") -TrackExit
+  if ($startProcess -is [System.Diagnostics.Process]) {
+    $script:pendingProcess = $startProcess
+  } else {
+    Complete-PendingAction $false
+  }
 })
 $stopItem.add_Click({
+  if (-not (Set-PendingAction "Stop Proxy" 15)) { return }
   $statusItem.Text = "Proxy: Stopping..."
-  Set-PendingAction "Stop Proxy" 15
-  if (-not (Start-OcxCommand @("stop"))) { $script:pendingAction = $null }
+  $stopProcess = Start-OcxCommand @("stop") -TrackExit
+  if ($stopProcess -is [System.Diagnostics.Process]) {
+    $script:pendingProcess = $stopProcess
+  } else {
+    Complete-PendingAction $false
+  }
 })
 $restartItem.add_Click({
+  if (-not (Set-PendingAction "Restart Proxy" 160)) { return }
   $statusItem.Text = "Proxy: Restarting..."
-  Set-PendingAction "Restart Proxy" 20
-  if (-not (Start-OcxCommand @("__tray-restart"))) { $script:pendingAction = $null }
+  # /api/system/restart may drain active work for 60s and then spend up to 70s
+  # handing off to an identity-verified replacement. The tray observes health/PID
+  # rather than the detached CLI exit, so keep a watchdog margin around that shared
+  # lifecycle budget. The CLI remains the lifecycle owner; the tray never kills.
+  $restartProcess = Start-OcxCommand @("__tray-restart") -TrackExit
+  if ($restartProcess -is [System.Diagnostics.Process]) {
+    $script:pendingProcess = $restartProcess
+  } else {
+    Complete-PendingAction $false
+  }
 })
 $logsItem.add_Click({
   $psi = New-Object System.Diagnostics.ProcessStartInfo
@@ -280,6 +351,9 @@ try {
   $timer.Stop()
   $timer.Dispose()
   $notify.Visible = $false
+  if ($null -ne $script:pendingProcess) {
+    try { $script:pendingProcess.Dispose() } catch { $null = $_ }
+  }
   $notify.Dispose()
   foreach ($icon in $script:ownedIcons) { $icon.Dispose() }
   $menu.Dispose()