fix: packaged macOS startup probes and desktop ownership safety

[lidge-jun]

Summary

Closes #6222. Carries codingbooo’s draft #6256 (commits 1e641878c9f77064fa154379f9fd2401d1e815d6 and d0b4bd5cde94329ffe324564ab498aec8dd0b883) onto current dev.

The bundled startup-health reader now re-enters the standalone CLI with selfLaunchArgv instead of trying to execute a virtual source path. macOS reports desktop protection only after matching the recorded installation, enabled and loaded login registration, and live desktop-to-bundled-proxy process paths. PID and ownership changes revoke the verdict.

A desktop claim remains held when those checks fail. Stale and failed results stay at risk, service/shim installation and repair stay disabled, and both CLI and dashboard recovery guidance point to reopening OpenCodex and checking Start at Login. The GUI no longer recommends a competing starter through its recovery commands. All ten locales and ownership/user docs are updated.

Co-authored-by: codingbo cnsdbo@163.com

Verification

• bun run typecheck — passed before and after rebasing onto fdf4177dfe.
• bun test tests/service/autostart-health.test.ts tests/service/service-desktop-startup-health.test.ts tests/service/service-desktop-startup.test.ts tests/lib/self-launch-argv.test.ts tests/gui/startup-health-ui.test.ts tests/config/settings-startup-health-seam.test.ts — focused behavior coverage passed. The layout naming mismatch discovered in the combined run was fixed by using the existing service- naming convention.
• bun test tests/test-layout-tooling.test.ts tests/test-layout.test.ts — 18 passed, 0 failed.
• bun test tests/server/startup-health-packaged-probe.test.ts — compiled default cache subprocess passed before and after executable replacement. Uses the release builder’s macOS ad-hoc signing step. A separate compiled ablation with the old arguments reproduced diagnosticStale: true.
• cd gui && bun test tests — 2,645 passed, 0 failed; after the final recovery-summary change, bun test tests/startup-minimal.test.tsx tests/startup-install-result-reconciliation.test.tsx passed all 11 cases, including starter install/repair guards and the CLI-owned control.
• cd gui && bun run lint && bun run lint:i18n && bun run build — passed; the final recovery-summary change was rebuilt.
• bun run structure:check, bun scripts/file-size-ratchet.ts, bun run privacy:scan, and git diff --check — passed.
• cd docs-site && bun install --frozen-lockfile && bun run build — passed, 545 pages and 74,719 internal links checked.
• bun run build:standalone -- --out .tmp/6222-standalone and isolated bundled ocx __startup-health — passed with a fresh result.
• Browser smoke of protected, failed-supervision and stale states — competing install actions remained disabled; recovery retained ocx restore and omitted service/shim commands. At the browser’s minimum 500px viewport, no horizontal overflow was observed.
• bun run test:changed — completed unsuccessfully on the pre-rebase head: exit 124 at the built-in 900-second bound, after a 305-second lock wait. Its buffered output records 334 failing-case entries, predominantly cleanup refusals for test-created fixtures inside this managed worktree under the protected real ~/.codex tree. It ended with tests/server/api-keys-routes.test.ts still running (857 seconds); a fresh-process attribution run of that file passed all 48 cases in 755 ms. This broad local result is not passing evidence. The focused startup regressions pass; per the owner’s updated integration rule, Cross-platform CI is deferred to the final union run rather than used as a per-PR merge gate.

Full local backend suite exception: concurrent integration worktrees share this machine and serialize through the user test lock (changed coverage waited 305 seconds). Focused regressions passed and import-connected coverage was attempted with the limitation above. Full Linux/macOS suite validation is assigned to exact-head Cross-platform CI; native Windows full-suite coverage is outside the repository’s automatic PR selection, while Windows packaging/keyring/service smokes run on this head. No reboot, signed installer/menu update, or installed desktop replacement was performed.

Screenshot from the actual Startup components with a failed desktop-supervision fixture, uploaded only on pr-assets:

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. Read-only diagnostics introduce no credential or installation dependency changes; ownership/protection failures remain conservative.

Rebased onto the latest dev (fdf4177dfe, test-only Windows fixture stabilization); current review head is 9913594337a5b5340b46d81fc5c85df2c0f84d0b. The owner subsequently changed integration policy: no further rebase unless GitHub reports an actual conflict, and Cross-platform CI is deferred to a single final union run. Per-PR run 36663535186 is not claimed as merge evidence; the earlier run was superseded by the prior rebase.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: ebdcc508-0364-49b9-a165-aa04aaef8cdd

📥 Commits

Reviewing files that changed from the base of the PR and between fdf4177 and 9913594.

📒 Files selected for processing (28)

• docs-site/src/content/docs/guides/desktop-app.md
• gui/src/i18n/de.ts
• gui/src/i18n/en.ts
• gui/src/i18n/fr.ts
• gui/src/i18n/ja.ts
• gui/src/i18n/ko.ts
• gui/src/i18n/ru.ts
• gui/src/i18n/tr.ts
• gui/src/i18n/vi.ts
• gui/src/i18n/zh-TW.ts
• gui/src/i18n/zh.ts
• gui/src/pages/startup-sections.tsx
• gui/src/pages/startup-shared.ts
• gui/src/startup-health-ui.ts
• gui/tests/startup-minimal.test.tsx
• scripts/test-layout/layout.json
• src/codex/autostart-health.ts
• src/server/startup-health-cache.ts
• src/service/desktop-startup.ts
• structure/gui-and-management-api.md
• structure/ops/service-and-sidecars.md
• structure/runtime.md
• tests/fixtures/test-layout-expected.json
• tests/helpers/startup-health-packaged-child.ts
• tests/server/startup-health-packaged-probe.test.ts
• tests/service/autostart-health.test.ts
• tests/service/service-desktop-startup-health.test.ts
• tests/service/service-desktop-startup.test.ts

 ____________________________________________________________________________________
< Half-Life 3 could have been released by now, but I'm too busy reviewing your code. >
 ------------------------------------------------------------------------------------
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 58 / 80

이 PR은 macOS에서 데스크톱 앱이 프록시를 소유할 때 Startup safety가 그걸 제대로 알아보게 고칩니다. 예전에는 패키징된 CLI가 가상 소스 경로로 프로브를 띄우다 실패했고, 데스크톱 감독도 보호로 인정하지 않았습니다. 이번에는 selfLaunchArgv로 standalone/소스 둘 다에서 __startup-health를 다시 들어가게 했고, 설치 ID·로그인 항목·앱→내장 ocx 부모/자식 경로가 맞을 때만 protection: "desktop"을 줍니다. 검사가 실패해도 데스크톱 소유 기록은 유지하고, 그동안 서비스/심 설치·수리를 막고, 앱을 다시 열고 Start at Login을 확인하라는 안내로 돌립니다. #6222와 codingbooo 초안 #6256을 현재 dev 위로 옮긴 작업입니다. base가 dev인 점은 맞습니다.

라인 - src/service/desktop-startup.ts processIdentity: /bin/ps -o ppid=,comm= 결과를 realpathSync한 뒤 번들 전체 경로(.../opencodex-desktop, .../ocx)와 === 비교합니다. macOS comm은 보통 짧은 실행 파일 이름이고, opencodex-desktop은 17자라 Darwin 16자 한도에 잘립니다. 테스트는 전체 경로를 mock이라 통과하지만, 실기기에서는 running이 거의 항상 false가 되어 데스크톱 보호가 영구히 안 잡힐 수 있습니다. 전체 경로를 주는 방식(예: command/proc_pidpath 계열)으로 바꿔야 합니다.
라인 - gui/tests/startup-minimal.test.tsx mock 객체에 serviceInstalled 키가 두 번 있습니다. 앞의 false는 뒤의 brokenStarters에 덮입니다. 의도가 “깨진 스타터면 installed”라면 한 줄로 쓰고, 아니면 테스트가 잘못된 상태를 보고 있는 겁니다.
라인 - PR이 아직 draft이고 본문에 bun run test:changed 대기 중이라고 적혀 있습니다. 그 게이트와 Cross-platform CI(특히 실제 macOS launchd/ps)가 초록이 되기 전에는 “로컬 초점 테스트 통과”만으로 merge 판단하기 어렵습니다.

메인테이너의 판단이 필요한 지점

서비스가 serviceViable이면 데스크톱보다 먼저 protection: "service"가 됩니다. 데스크톱 소유인데 CLI 서비스도 viable인 겹침 상태를 허용할지, 아니면 데스크톱 소유 중에는 서비스를 보호로 치지 않을 정책으로 못 박을지 정해야 합니다. 또한 #6256은 아직 open입니다. 이 PR이 그 초안을 대체하는 merge 경로라면 초안 쪽을 close/무효 처리할지 정해 주세요.

너의 추천

comm→전체경로 비교를 실측 가능한 방식으로 고치고, 그 회귀 테스트를 mock 전체경로가 아니라 실제 ps/comm 형태(또는 프로덕션과 같은 path resolver)로 추가한 뒤 draft 해제하세요. GUI mock 중복 키는 정리하세요. #6256 등 중복/무효 PR은 close 권장합니다. CI와 test:changed가 통과하면 merge 후보입니다.

이 댓글은 grok-bot이 작성했습니다

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-09-30T03:40:19.451025Z	9913594	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[lidge-jun]

Maintainer integration into dev, authorized by the repository owner, at head 9913594337a5b5340b46d81fc5c85df2c0f84d0b.

Local focused verification passed: startup classification (41 cases), additional desktop health policy (2), desktop ownership/login/process evidence (4), the real compiled cache subprocess before/after bundled-executable replacement (1), and GUI startup/reconciliation (11). The two new service files were renamed with the existing service- prefix to satisfy layout seeds. Layout guards passed all 18 cases. bun run typecheck passed again after the prior rebase. GUI build/lint/i18n, docs build, structure, ratchet and privacy checks passed.

The broader bun run test:changed result is not claimed as passing: it hit protected-home cleanup refusals in this managed worktree and the 900-second bound; the interrupted API-key file passed all 48 cases in a fresh process. This limitation is documented in Verification.

Per the owner’s updated rule, Cross-platform CI is deferred to one final union run after all lanes finish. Per-PR CI is not a merge gate and is not claimed as green. No further rebase is required unless GitHub reports an actual conflict; this PR is mergeable.

scripts/ci/assert-mergeable-review.sh --maintainer-integration 6286 lidge-jun/opencodex passed for this exact head and the authenticated lidge-jun actor. This records maintainer integration, not independent approval.