@remodex/rmx 1.0.3 → 1.0.5

package/src/cli/system-command.ts

@@ -20,10 +20,7 @@ const USAGE = `Usage:
   rmx system update check [--channel <latest|preview>] [--json]
   rmx system update run [--channel <latest|preview>] [--restart <on|off>] --yes [--json]
   rmx system update status <job-id> [--json]
-  rmx system update auto <on|off|status> [--channel <latest|preview>] [--json]
-  rmx system desktop-update check [--channel <latest|preview>] [--json]
-  rmx system desktop-update run [--channel <latest|preview>] [--json]
-  rmx system desktop-update status [--json]`;
+  rmx system update auto <on|off|status> [--channel <latest|preview>] [--json]`;
 
 async function status(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   const args = [...argv];
@@ -132,86 +129,6 @@ async function update(argv: string[], deps: RuntimeApiDeps): Promise<void> {
   printData(result, wantsJson, [`Update started (${channel}).`]);
 }
 
-function desktopUpdateSummary(value: unknown): string[] {
-  if (!value || typeof value !== "object") return [`Desktop update: ${String(value)}`];
-  const record = value as Record<string, unknown>;
-  const state = record.state;
-  const check = record;
-  const lines: string[] = [];
-
-  if (typeof check.currentVersion === "string") {
-    lines.push(`Current version: ${check.currentVersion}`);
-  }
-  if (typeof check.latestVersion === "string") {
-    lines.push(`Latest version: ${check.latestVersion}`);
-  }
-  if (typeof check.phase === "string") {
-    lines.push(`Status: ${check.phase}`);
-  }
-  if (state && typeof state === "object" && !Array.isArray(state)) {
-    const stateRecord = state as Record<string, unknown>;
-    if (typeof stateRecord.phase === "string") lines.push(`Status: ${stateRecord.phase}`);
-    if (typeof stateRecord.latestVersion === "string") {
-      lines.push(`Latest version: ${stateRecord.latestVersion}`);
-    }
-    if (typeof stateRecord.progress === "number") {
-      lines.push(`Progress: ${Math.round(stateRecord.progress)}%`);
-    }
-    if (typeof stateRecord.errorCode === "string") lines.push(`Error: ${stateRecord.errorCode}`);
-  }
-  if (check.updateAvailable === true) lines.push("Update available.");
-  else if (check.updateAvailable === false) lines.push("No desktop update available.");
-  if (lines.length > 0) return lines;
-  return summaryLines(value);
-}
-
-async function desktopUpdate(argv: string[], deps: RuntimeApiDeps): Promise<void> {
-  const args = [...argv];
-  const action = (args.shift() ?? "check").toLowerCase();
-  const wantsJson = takeFlag(args, "--json");
-
-  if (action === "status") {
-    rejectArgs(args, USAGE);
-    const result = await runtimeRequest("/api/desktop-update/status", {}, deps);
-    printData(result, wantsJson, desktopUpdateSummary(result));
-    return;
-  }
-
-  if (action !== "check" && action !== "run") {
-    throw new CliUsageError(`unknown desktop-update action ${action}`, USAGE);
-  }
-
-  const channel = takeOption(args, "--channel") ?? "latest";
-  if (channel !== "latest" && channel !== "preview") {
-    throw new CliUsageError("--channel must be latest or preview", USAGE);
-  }
-  rejectArgs(args, USAGE);
-
-  if (action === "check") {
-    const result = await runtimeRequest(
-      `/api/desktop-update/check?channel=${encodeURIComponent(channel)}`,
-      {},
-      deps,
-    );
-    printData(result, wantsJson, desktopUpdateSummary(result));
-    return;
-  }
-
-  // Headless callers can fetch and verify a native installer, but installation
-  // stays restricted to the exact-origin desktop/Tauri bridge. This mirrors
-  // the management API contract and prevents a shell or remote dashboard from
-  // silently launching a platform installer.
-  const result = await runtimeRequest(
-    "/api/desktop-update/run",
-    {
-      method: "POST",
-      body: JSON.stringify({ channel, install: false }),
-    },
-    deps,
-  );
-  printData(result, wantsJson, [`Desktop update download started (${channel}).`]);
-}
-
 export async function handleSystemCommand(argv: string[], deps: RuntimeApiDeps = {}): Promise<number> {
   return runCliAction(async () => {
     const [sub = "status", ...rest] = argv;
@@ -225,7 +142,6 @@ export async function handleSystemCommand(argv: string[], deps: RuntimeApiDeps =
       const args = [...rest]; const wantsJson = takeFlag(args, "--json"); rejectArgs(args, USAGE);
       printData(await runtimeRequest("/api/sync", { method: "POST" }, deps), wantsJson);
     } else if (sub === "update") await update(rest, deps);
-    else if (sub === "desktop-update") await desktopUpdate(rest, deps);
     else throw new CliUsageError(`unknown system command ${sub}`, USAGE);
   });
 }

package/src/codex/inject.ts

@@ -778,6 +778,8 @@ export function chooseCatalogPathForInjection(
 
 export interface CodexInjectResult {
   success: boolean;
+  /** Whether plain Codex routing in the main config.toml is owned by Remodex. */
+  routingApplied?: boolean;
   message: string;
   status?: "skipped";
   skippedReason?: "desired_disabled" | "desired_enabled";
@@ -842,6 +844,7 @@ export async function injectCodexConfig(
     if (!shouldSyncCodexOnStart(loadConfig())) {
       return {
         success: true,
+        routingApplied: false,
         status: "skipped",
         skippedReason: "desired_disabled",
         message: "Codex integration is OFF; no Codex config, catalog, cache, or history was changed.",
@@ -868,10 +871,12 @@ export async function injectCodexConfig(
       : undefined;
     return {
       success: true,
+      routingApplied: false,
       ...(nativeSubagentDefaultsWarning ? { nativeSubagentDefaultsWarning } : {}),
       message:
         `${adoptedProviderMessage}` +
         `Codex config preserved byte-for-byte with external model_provider ${tomlString(activeProvider)}.\n` +
+        `  This is why the main ${CODEX_CONFIG_PATH} did not change.\n` +
         `  Remodex Codex profile: ${CODEX_PROFILE_PATH} (codex --profile opencodex)\n` +
         (profileCatalogPath
           ? `  Codex model catalog: ${profileCatalogPath}\n`
@@ -1267,6 +1272,7 @@ export async function injectCodexConfig(
   if (keptUserBaseUrl) {
     return {
       success: true,
+      routingApplied: false,
       ...(nativeSubagentDefaultsWarning
         ? { nativeSubagentDefaultsWarning }
         : {}),
@@ -1275,7 +1281,7 @@ export async function injectCodexConfig(
         catalogMessage +
         historyMessage +
         managedDefaultsMessage +
-        `  To route plain codex through the proxy, remove your openai_base_url line from ~/.codex/config.toml and rerun 'rmx start'.\n` +
+        `  To route plain codex through the proxy, remove your openai_base_url line from ${CODEX_CONFIG_PATH} and rerun 'rmx sync'.\n` +
         `  Reference config: ${CODEX_PROFILE_PATH}`,
     };
   }
@@ -1284,6 +1290,7 @@ export async function injectCodexConfig(
     : `Pointed Codex's built-in openai provider at the Remodex proxy (openai_base_url).\n`;
   return {
     success: true,
+    routingApplied: true,
     ...(nativeSubagentDefaultsWarning ? { nativeSubagentDefaultsWarning } : {}),
     message:
       headline +

package/src/codex/sync.ts

@@ -25,6 +25,8 @@ export interface CodexSyncResult {
   catalogExists: boolean;
   catalogWritten: boolean;
   cacheSynced: boolean;
+  /** Whether plain Codex routing in config.toml is owned by Remodex. */
+  routingApplied?: boolean;
   message: string;
   warning?: string;
   comboOmissions?: ComboCatalogOmission[];
@@ -226,6 +228,7 @@ export async function syncModelsToCodex(
     catalogExists,
     catalogWritten,
     cacheSynced,
+    ...(result.routingApplied !== undefined ? { routingApplied: result.routingApplied } : {}),
     message: result.message,
     ...(warning ? { warning } : {}),
     ...(comboOmissions.length > 0 ? { comboOmissions } : {}),

package/src/server/management/android-remote-routes.ts

@@ -134,7 +134,7 @@ async function statusDTO(
     ? await controller.cloudflareConfiguration()
     : {
         mode: state.settings.tunnelMode,
-        ...(state.settings.namedTunnelHostname
+        ...(state.settings.tunnelMode === "named" && state.settings.namedTunnelHostname
           ? { namedHostname: state.settings.namedTunnelHostname }
           : {}),
         hasNamedTunnelToken: false,

package/src/server/management/config-routes.ts

@@ -377,86 +377,6 @@ export async function handleConfigRoutes(ctx: ManagementContext): Promise<Respon
     return jsonResponse({ ok: true, job });
   }
 
-  /**
-   * Native desktop releases are deliberately separate from the npm runtime
-   * updater above.  The manifest/check/download state is shared with the
-   * Tauri tray through `desktop-update.json`; a normal browser can inspect it
-   * and check GitHub. Installer launch never crosses this management route;
-   * only the exact-origin Tauri bridge can request it.
-   */
-  if (url.pathname === "/api/desktop-update/check" && req.method === "GET") {
-    const checkDesktopReleaseUpdate = deps.checkDesktopReleaseUpdate
-      ?? (await import("../../update/desktop-release")).checkDesktopReleaseUpdate;
-    const rawChannel = url.searchParams.get("channel");
-    if (rawChannel && rawChannel !== "latest" && rawChannel !== "preview") {
-      return jsonResponse({ error: "channel must be latest or preview" }, 400, req, config);
-    }
-    return jsonResponse(
-      await checkDesktopReleaseUpdate(
-        rawChannel === "preview" ? "preview" : "latest",
-        // A management request is never proof that a verified native shell
-        // initiated it. Browser callers may check and download only; the
-        // Tauri bridge owns installation.
-        { desktopShell: () => false },
-      ),
-      200,
-      req,
-      config,
-    );
-  }
-
-  if (url.pathname === "/api/desktop-update/run" && req.method === "POST") {
-    const desktopRelease = await import("../../update/desktop-release");
-    const startDesktopUpdateJob = deps.startDesktopUpdateJob
-      ?? desktopRelease.startDesktopUpdateJob;
-    let body: unknown;
-    try {
-      body = await readManagementJsonBody(req);
-    } catch (error) {
-      rethrowManagementBodyTooLarge(error);
-      return jsonResponse({ error: "invalid JSON body" }, 400, req, config);
-    }
-    if (!body || typeof body !== "object" || Array.isArray(body)) {
-      return jsonResponse({ error: "invalid JSON body" }, 400, req, config);
-    }
-    const update = body as { channel?: unknown; install?: unknown };
-    if (update.channel !== undefined && update.channel !== "latest" && update.channel !== "preview") {
-      return jsonResponse({ error: "channel must be latest or preview" }, 400, req, config);
-    }
-    if (update.install !== undefined && typeof update.install !== "boolean") {
-      return jsonResponse({ error: "install boolean is required" }, 400, req, config);
-    }
-    if (update.install === true) {
-      return jsonResponse(
-        {
-          error: "Open the Remodex desktop application to install this update.",
-          code: "desktop_required",
-        },
-        409,
-        req,
-        config,
-      );
-    }
-    try {
-      const job = startDesktopUpdateJob(
-        update.channel === "preview" ? "preview" : "latest",
-        { install: false },
-      );
-      return jsonResponse({ ok: true, state: job }, 202, req, config);
-    } catch (error) {
-      if (error instanceof desktopRelease.DesktopUpdateError) {
-        return jsonResponse({ error: error.message, code: error.code }, error.status, req, config);
-      }
-      return jsonResponse({ error: "desktop update could not start", code: "download_failed" }, 500, req, config);
-    }
-  }
-
-  if (url.pathname === "/api/desktop-update/status" && req.method === "GET") {
-    const readDesktopUpdateState = deps.readDesktopUpdateState
-      ?? (await import("../../update/desktop-release")).readDesktopUpdateState;
-    return jsonResponse({ ok: true, state: readDesktopUpdateState() }, 200, req, config);
-  }
-
   if (url.pathname === "/api/sidecar-settings" && req.method === "GET") {
     const ws = config.webSearchSidecar ?? {};
     const vs = config.visionSidecar ?? {};

package/src/server/management/context.ts

@@ -12,10 +12,6 @@ import type { AndroidRemoteGatewayController } from "../../android-remote/gatewa
 import type { AndroidRemoteCloudflareProvisioner } from "../../android-remote/cloudflare-provisioning";
 
 export interface ManagementApiDeps {
-  /** Native desktop-update seams keep route tests off the network and real owner state. */
-  checkDesktopReleaseUpdate?: typeof import("../../update/desktop-release").checkDesktopReleaseUpdate;
-  startDesktopUpdateJob?: typeof import("../../update/desktop-release").startDesktopUpdateJob;
-  readDesktopUpdateState?: typeof import("../../update/desktop-release").readDesktopUpdateState;
   /** Android Remote persistence seam. Tests inject an in-memory store. */
   androidRemoteStore?: AndroidRemoteStore;
   /** Shared Android Remote gateway. Production and management routes use one controller. */

package/src/tray/windows-tray.ps1

@@ -109,7 +109,7 @@ function Start-OcxCommand([string[]]$CommandArgs, [switch]$TrackExit) {
     return $true
   } catch {
     Write-ActionLog "launch failed: $($_.Exception.GetType().Name)"
-    $notify.ShowBalloonTip(5000, "Remodex action failed", "The action could not start. Open the logs folder or run rmx doctor.", [System.Windows.Forms.ToolTipIcon]::Error)
+    $notify.ShowBalloonTip(5000, "Remodex action failed", "The action could not start. Run rmx doctor for details.", [System.Windows.Forms.ToolTipIcon]::Error)
     return $false
   }
 }
@@ -152,20 +152,27 @@ function Read-JsonUrl([string]$Url) {
 
 $notify = New-Object System.Windows.Forms.NotifyIcon
 $menu = New-Object System.Windows.Forms.ContextMenuStrip
-$statusItem = New-Object System.Windows.Forms.ToolStripMenuItem
-$statusItem.Enabled = $false
-$safetyItem = New-Object System.Windows.Forms.ToolStripMenuItem
-$safetyItem.Enabled = $false
-$openItem = $menu.Items.Add("Open Dashboard")
-$startItem = $menu.Items.Add("Start Proxy")
-$stopItem = $menu.Items.Add("Stop Proxy and Restore Native Routing")
-$restartItem = $menu.Items.Add("Restart Proxy")
+$statusItem = $menu.Items.Add("🔴 Offline · Refresh")
+$openItem = $menu.Items.Add("Open dashboard")
 [void]$menu.Items.Add((New-Object System.Windows.Forms.ToolStripSeparator))
-[void]$menu.Items.Add($statusItem)
-[void]$menu.Items.Add($safetyItem)
-$logsItem = $menu.Items.Add("Open Logs Folder")
+$proxyLifecycleItem = $menu.Items.Add("Start Proxy")
+$applyChangesItem = $menu.Items.Add("Apply Changes")
+$restartCodexItem = $menu.Items.Add("Restart Codex")
+$restartRemodexItem = $menu.Items.Add("Restart Remodex")
 [void]$menu.Items.Add((New-Object System.Windows.Forms.ToolStripSeparator))
-$exitItem = $menu.Items.Add("Exit Tray")
+$restartDesktopItem = $menu.Items.Add("Restart desktop application (advanced)…")
+$checkUpdateItem = $menu.Items.Add("Check package updates")
+[void]$menu.Items.Add((New-Object System.Windows.Forms.ToolStripSeparator))
+$exitItem = $menu.Items.Add("Quit desktop shell")
+
+$actionItems = @(
+  $proxyLifecycleItem,
+  $applyChangesItem,
+  $restartCodexItem,
+  $restartRemodexItem,
+  $restartDesktopItem,
+  $checkUpdateItem
+)
 
 $script:online = $false
 $script:port = 10100
@@ -175,8 +182,29 @@ $script:pendingStarted = 0L
 $script:pendingDeadline = 0L
 $script:pendingOldProxyPid = $null
 $script:pendingProcess = $null
+$script:pendingExpectation = $null
+$script:pendingItem = $null
+
+function Reset-ActionLabels {
+  $proxyLifecycleItem.Text = if ($script:online) { "Stop Proxy" } else { "Start Proxy" }
+  $applyChangesItem.Text = "Apply Changes"
+  $restartCodexItem.Text = "Restart Codex"
+  $restartRemodexItem.Text = "Restart Remodex"
+  $restartDesktopItem.Text = "Restart desktop application (advanced)…"
+  $checkUpdateItem.Text = "Check package updates"
+}
+
+function Update-ActionAvailability {
+  $busy = $null -ne $script:pendingAction
+  foreach ($item in $actionItems) { $item.Enabled = -not $busy }
+}
 
-function Set-PendingAction([string]$Action, [int]$TimeoutSeconds) {
+function Set-PendingAction(
+  [string]$Action,
+  [int]$TimeoutSeconds,
+  [ValidateSet("online", "offline", "restarted", "process")][string]$Expectation,
+  [System.Windows.Forms.ToolStripMenuItem]$Item
+) {
   if ($null -ne $script:pendingAction) {
     Write-ActionLog "$Action ignored because $($script:pendingAction) is still pending"
     return $false
@@ -193,6 +221,9 @@ function Set-PendingAction([string]$Action, [int]$TimeoutSeconds) {
   $script:pendingStarted = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
   $script:pendingDeadline = $script:pendingStarted + ($TimeoutSeconds * 1000)
   $script:pendingOldProxyPid = $script:proxyPid
+  $script:pendingExpectation = $Expectation
+  $script:pendingItem = $Item
+  Update-ActionAvailability
   return $true
 }
 
@@ -200,6 +231,8 @@ function Complete-PendingAction([bool]$Success) {
   if ($null -eq $script:pendingAction) { return }
   $action = $script:pendingAction
   $script:pendingAction = $null
+  $script:pendingExpectation = $null
+  $script:pendingItem = $null
   if ($null -ne $script:pendingProcess) {
     try {
       $script:pendingProcess.Dispose()
@@ -213,7 +246,29 @@ function Complete-PendingAction([bool]$Success) {
     $notify.ShowBalloonTip(2500, "Remodex", "$action completed.", [System.Windows.Forms.ToolTipIcon]::Info)
   } else {
     Write-ActionLog "$action failed to reach the expected state"
-    $notify.ShowBalloonTip(5000, "Remodex action failed", "$action did not reach the expected state. Open the logs folder or run rmx doctor.", [System.Windows.Forms.ToolTipIcon]::Error)
+    $notify.ShowBalloonTip(5000, "Remodex action failed", "$action did not reach the expected state. Run rmx doctor for details.", [System.Windows.Forms.ToolTipIcon]::Error)
+  }
+  Reset-ActionLabels
+  Update-ActionAvailability
+}
+
+function Start-PendingCommand(
+  [string]$Action,
+  [string]$ProgressLabel,
+  [string[]]$CommandArgs,
+  [int]$TimeoutSeconds,
+  [ValidateSet("online", "offline", "restarted", "process")][string]$Expectation,
+  [System.Windows.Forms.ToolStripMenuItem]$Item
+) {
+  if (-not (Set-PendingAction -Action $Action -TimeoutSeconds $TimeoutSeconds -Expectation $Expectation -Item $Item)) {
+    return
+  }
+  $Item.Text = $ProgressLabel
+  $pending = Start-OcxCommand $CommandArgs -TrackExit
+  if ($pending -is [System.Diagnostics.Process]) {
+    $script:pendingProcess = $pending
+  } else {
+    Complete-PendingAction $false
   }
 }
 
@@ -226,34 +281,27 @@ function Update-TrayState {
   $pidMatches = $null -eq $target.pid -or [int]$target.pid -eq [int]$health.pid
   $script:online = $null -ne $health -and $health.status -eq "ok" -and $health.service -eq "opencodex" -and [int]$health.port -eq $script:port -and $pidMatches
   $script:proxyPid = if ($script:online) { [int]$health.pid } else { $null }
+  $degraded = $false
   if ($script:online) {
-    $statusItem.Text = "Proxy: Online (port $($script:port))"
     $notify.Text = "Remodex: Online"
-    $startItem.Enabled = $false
-    $stopItem.Enabled = $true
-    $restartItem.Enabled = $true
     try {
       $startup = Read-JsonUrl "$origin/api/startup-health"
-      $label = if ($startup.status -eq "at-risk") { "At risk" } elseif ($startup.status -eq "protected") { "Protected" } else { "Native routing" }
-      $safetyItem.Text = "Restart safety: $label"
-      $notify.Icon = if ($startup.status -eq "at-risk") { $warningIcon } else { $onlineIcon }
+      $degraded = $startup.status -eq "at-risk"
+      $notify.Icon = if ($degraded) { $warningIcon } else { $onlineIcon }
     } catch {
-      $safetyItem.Text = "Restart safety: unavailable"
+      $degraded = $true
       $notify.Icon = $warningIcon
     }
+    $dot = if ($degraded) { "🟠" } else { "🟢" }
+    $label = if ($degraded) { "Degraded" } else { "Ready" }
+    $statusItem.Text = "$dot $label · port $($script:port) · PID $($script:proxyPid) · Refresh"
   } else {
-    $statusItem.Text = "Proxy: Offline"
-    $safetyItem.Text = "Restart safety: start the proxy to inspect"
+    $statusItem.Text = "🔴 Offline · Refresh"
     $notify.Text = "Remodex: Offline"
     $notify.Icon = $offlineIcon
-    $startItem.Enabled = $true
-    $stopItem.Enabled = $false
-    $restartItem.Enabled = $false
   }
   if ($null -ne $script:pendingAction) {
-    $startItem.Enabled = $false
-    $stopItem.Enabled = $false
-    $restartItem.Enabled = $false
+    $statusItem.Text = "🟡 $($script:pendingAction)…"
   }
   $heartbeat = @{ pid = $PID; timestamp = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds() }
   if ($HostPid -gt 0) { $heartbeat.hostPid = $HostPid }
@@ -263,13 +311,15 @@ function Update-TrayState {
   if ($null -ne $script:pendingAction) {
     $now = [DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()
     $elapsed = $now - $script:pendingStarted
-    $reached = ($script:pendingAction -eq "Start Proxy" -and $script:online) -or
-      ($script:pendingAction -eq "Stop Proxy" -and -not $script:online) -or
-      ($script:pendingAction -eq "Restart Proxy" -and $elapsed -gt 3000 -and $script:online -and $script:proxyPid -ne $script:pendingOldProxyPid)
+    $reached = ($script:pendingExpectation -eq "online" -and $script:online) -or
+      ($script:pendingExpectation -eq "offline" -and -not $script:online) -or
+      ($script:pendingExpectation -eq "restarted" -and $elapsed -gt 3000 -and $script:online -and $script:proxyPid -ne $script:pendingOldProxyPid)
     $commandFailed = $false
+    $commandComplete = $false
     if ($null -ne $script:pendingProcess) {
       try {
-        $commandFailed = $script:pendingProcess.HasExited -and $script:pendingProcess.ExitCode -ne 0
+        $commandComplete = $script:pendingProcess.HasExited
+        $commandFailed = $commandComplete -and $script:pendingProcess.ExitCode -ne 0
       } catch {
         Write-ActionLog "pending process result inspection failed: $($_.Exception.GetType().Name)"
         # If we cannot inspect the tracked command, we cannot prove it is still
@@ -279,52 +329,45 @@ function Update-TrayState {
       }
     }
     if ($commandFailed) { Complete-PendingAction $false }
+    elseif ($script:pendingExpectation -eq "process" -and $commandComplete) { Complete-PendingAction $true }
     elseif ($reached) { Complete-PendingAction $true }
     elseif ($now -gt $script:pendingDeadline) { Complete-PendingAction $false }
   }
+  if ($null -eq $script:pendingAction) { Reset-ActionLabels }
+  Update-ActionAvailability
 }
 
 $openItem.add_Click({ Start-OcxCommand @("gui") })
-$startItem.add_Click({
-  if (-not (Set-PendingAction "Start Proxy" 75)) { return }
-  $statusItem.Text = "Proxy: Starting..."
-  # service start can spend 20s and the CLI then observes health for another 40s.
-  $startProcess = Start-OcxCommand @("__tray-start") -TrackExit
-  if ($startProcess -is [System.Diagnostics.Process]) {
-    $script:pendingProcess = $startProcess
-  } else {
-    Complete-PendingAction $false
-  }
+$statusItem.add_Click({
+  $statusItem.Text = "↻ Checking runtime…"
+  Update-TrayState
 })
-$stopItem.add_Click({
-  if (-not (Set-PendingAction "Stop Proxy" 15)) { return }
-  $statusItem.Text = "Proxy: Stopping..."
-  $stopProcess = Start-OcxCommand @("stop") -TrackExit
-  if ($stopProcess -is [System.Diagnostics.Process]) {
-    $script:pendingProcess = $stopProcess
+$proxyLifecycleItem.add_Click({
+  if ($script:online) {
+    Start-PendingCommand -Action "Stop Proxy" -ProgressLabel "Stopping Proxy…" -CommandArgs @("stop") -TimeoutSeconds 20 -Expectation "offline" -Item $proxyLifecycleItem
   } else {
-    Complete-PendingAction $false
+    # service start can spend 20s and the CLI then observes health for another 40s.
+    Start-PendingCommand -Action "Start Proxy" -ProgressLabel "Starting Proxy…" -CommandArgs @("__tray-start") -TimeoutSeconds 75 -Expectation "online" -Item $proxyLifecycleItem
   }
 })
-$restartItem.add_Click({
-  if (-not (Set-PendingAction "Restart Proxy" 160)) { return }
-  $statusItem.Text = "Proxy: Restarting..."
+$applyChangesItem.add_Click({
+  Start-PendingCommand -Action "Apply Changes" -ProgressLabel "Applying changes…" -CommandArgs @("sync") -TimeoutSeconds 180 -Expectation "process" -Item $applyChangesItem
+})
+$restartCodexItem.add_Click({
+  Start-PendingCommand -Action "Restart Codex" -ProgressLabel "Restarting Codex…" -CommandArgs @("__desktop-restart-codex") -TimeoutSeconds 60 -Expectation "process" -Item $restartCodexItem
+})
+$restartRemodexItem.add_Click({
   # /api/system/restart may drain active work for 60s and then spend up to 70s
   # handing off to an identity-verified replacement. The tray observes health/PID
   # rather than the detached CLI exit, so keep a watchdog margin around that shared
   # lifecycle budget. The CLI remains the lifecycle owner; the tray never kills.
-  $restartProcess = Start-OcxCommand @("__tray-restart") -TrackExit
-  if ($restartProcess -is [System.Diagnostics.Process]) {
-    $script:pendingProcess = $restartProcess
-  } else {
-    Complete-PendingAction $false
-  }
+  Start-PendingCommand -Action "Restart Remodex" -ProgressLabel "Restarting Remodex…" -CommandArgs @("__tray-restart") -TimeoutSeconds 160 -Expectation "restarted" -Item $restartRemodexItem
+})
+$restartDesktopItem.add_Click({
+  Start-PendingCommand -Action "Restart desktop application" -ProgressLabel "Restarting desktop application…" -CommandArgs @("__desktop-restart-client") -TimeoutSeconds 60 -Expectation "process" -Item $restartDesktopItem
 })
-$logsItem.add_Click({
-  $psi = New-Object System.Diagnostics.ProcessStartInfo
-  $psi.FileName = $OpenCodexHome
-  $psi.UseShellExecute = $true
-  [void][System.Diagnostics.Process]::Start($psi)
+$checkUpdateItem.add_Click({
+  Start-PendingCommand -Action "Open package updater" -ProgressLabel "Opening package updater…" -CommandArgs @("gui", "--update") -TimeoutSeconds 90 -Expectation "process" -Item $checkUpdateItem
 })
 $exitItem.add_Click({ [System.Windows.Forms.Application]::Exit() })
 $notify.add_DoubleClick({ Start-OcxCommand @("gui") })

package/src/tray/windows.ts

@@ -647,7 +647,13 @@ export function installWindowsTray(startNow = true): WindowsTrayStatus {
   try {
     const hardenedDir = hardenSecretDir(getConfigDir(), { required: true });
     if (!hardenedDir.ok) throw new Error("Windows tray directory ACL hardening did not complete; refusing to install persistence.");
-    replaceWindowsTrayOwnedFile(entry.script, readFileSync(sourceScript));
+    // Windows PowerShell 5.1 treats a BOM-less script as the active ANSI code
+    // page. The parity menu deliberately uses the same Unicode status dots and
+    // ellipsis as the desktop shell, so install the trusted source as UTF-8 BOM.
+    replaceWindowsTrayOwnedFile(
+      entry.script,
+      Buffer.concat([Buffer.from([0xef, 0xbb, 0xbf]), readFileSync(sourceScript)]),
+    );
     for (const pair of iconPairs) replaceWindowsTrayOwnedFile(pair.installed, readFileSync(pair.source));
     replaceWindowsTrayOwnedFile(launcherPath, Buffer.from("\uFEFF" + buildWindowsTrayLauncherScript(entry), "utf16le"));
     runRegistry(["add", RUN_KEY, "/v", runValue, "/t", "REG_SZ", "/d", runCommand, "/f", "/reg:64"]);

package/src/update/auto-scheduler.ts

@@ -736,6 +736,26 @@ function systemdQuote(value: string): string {
     .replace(/%/g, "%%")}"`;
 }
 
+/**
+ * `WorkingDirectory=` accepts a path value, not the quoted argument form used
+ * by `ExecStart=` and `Environment=`. Encode whitespace and unit-significant
+ * characters as systemd escapes so paths with spaces remain valid without
+ * leaving literal quotes in the directory name.
+ */
+function systemdPath(value: string): string {
+  let escaped = "";
+  for (const character of value) {
+    if (character === "\\") escaped += "\\\\";
+    else if (character === "%") escaped += "%%";
+    else if (character === " ") escaped += "\\x20";
+    else if (character === "\t") escaped += "\\x09";
+    else if (character === "\n") escaped += "\\x0a";
+    else if (character === '"') escaped += "\\x22";
+    else escaped += character;
+  }
+  return escaped;
+}
+
 function systemdEnvironment(name: string, value: string): string {
   return `Environment=${systemdQuote(`${name}=${value}`)}`;
 }
@@ -760,7 +780,7 @@ Wants=network-online.target
 [Service]
 Type=oneshot
 ExecStart=${systemdQuote(input.nodePath)} ${systemdQuote(input.launcherPath)} __auto-update
-WorkingDirectory=${systemdQuote(input.configDir)}
+WorkingDirectory=${systemdPath(input.configDir)}
 ${env.join("\n")}
 TimeoutStartSec=15min