Merge from upstream

bin/ocx.mjs

@@ -227,11 +227,90 @@ function runNpmSelfUpdate() {
     } catch { /* keep default */ }
   }
 
+  const launcher = fileURLToPath(import.meta.url);
+
+  function startProxyDirectly() {
+    if (!existsSync(launcher)) {
+      console.error("opencodex: cannot restart the proxy because the launcher is missing; reinstall opencodex manually.");
+      return;
+    }
+    const env = { ...process.env };
+    delete env.OCX_SERVICE;
+    console.log(`Attempting to restart the proxy on port ${bakePort}.`);
+    const child = spawn(process.execPath, [launcher, "start", "--port", String(bakePort)], {
+      detached: true,
+      stdio: "ignore",
+      windowsHide: true,
+      env,
+    });
+    child.on("error", error => {
+      console.error(`opencodex: direct proxy restart failed: ${error.message}`);
+    });
+    child.unref();
+  }
+
+  function refreshBackgroundServiceOrStartDirect() {
+    const prevBake = process.env.OCX_BAKE_PORT;
+    process.env.OCX_BAKE_PORT = String(bakePort);
+    try {
+      let svc = spawnSync(process.execPath, serviceRefreshArgs(), { stdio: "inherit", windowsHide: true });
+      // `serviceWasInstalled` is inferred from service-state.json alone, which can be
+      // STALE — present while the registration is gone. Repair refuses that case by
+      // design, and its thrown Error is indistinguishable from any other failure at
+      // this layer (plain Error, inherited stdio, generic exit status). So ask for
+      // structured state instead of parsing the failure: install only when the
+      // diagnostic says the service is genuinely absent. Installing after ANY repair
+      // failure would resurrect the elevation prompt this change exists to avoid, and
+      // could re-register a service the user just uninstalled.
+      if (svc.status !== 0 && readServiceInstalledFromStatus(launcher) === false) {
+        console.log("No registered service found — installing it instead.");
+        svc = spawnSync(process.execPath, serviceInstallArgs(), { stdio: "inherit", windowsHide: true });
+      }
+      let needDirectStart = svc.status !== 0;
+      if (!needDirectStart) {
+        // Exit 0 can still leave stale/missing assets that never bring the proxy
+        // back — match the GUI/CLI fallthrough so /healthz is not left dead.
+        try {
+          const st = spawnSync(process.execPath, [launcher, "status", "--json"], {
+            encoding: "utf8",
+            timeout: 20_000,
+            windowsHide: true,
+          });
+          if (st.status === 0 && typeof st.stdout === "string" && st.stdout.trim()) {
+            const parsed = JSON.parse(st.stdout);
+            const proxyUp = parsed?.proxy?.running === true || parsed?.proxy?.health?.ok === true;
+            const viable = parsed?.startup?.serviceViable === true;
+            if (!proxyUp && !viable) needDirectStart = true;
+          } else {
+            // status failed or empty — fail closed to direct start (match CLI).
+            needDirectStart = true;
+          }
+        } catch {
+          needDirectStart = true;
+        }
+      }
+      if (needDirectStart) {
+        // A repair needs no elevation, but it can still fail — or exit 0 while leaving
+        // a non-viable manager. Fall back to a direct detached proxy start so the
+        // update never leaves the user without a running proxy.
+        console.warn(
+          svc.status === 0
+            ? "opencodex: service refresh left a non-viable manager — starting the proxy directly instead."
+            : "opencodex: service refresh failed — starting the proxy directly instead.",
+        );
+        console.warn("  Run 'ocx service repair' to see why the background service could not restart.");
+        startProxyDirectly();
+      }
+    } finally {
+      if (prevBake === undefined) delete process.env.OCX_BAKE_PORT;
+      else process.env.OCX_BAKE_PORT = prevBake;
+    }
+  }
+
   // Never replace package files under a live proxy — stop it first (full `ocx stop`
   // semantics: graceful drain, service stop, native Codex restore). Gate on the service
   // and the runtime-port record too: a service-managed or orphaned proxy can be live
   // while ocx.pid is stale/missing.
-  const launcher = fileURLToPath(import.meta.url);
   if (trayBeforeUpdate.stopBeforeReplacement) {
     console.log("⏹  Handing off the Windows tray before updating...");
     try {
@@ -249,6 +328,17 @@ function runNpmSelfUpdate() {
   }
   const hasRuntimeState =
     existsSync(join(configDir(), "ocx.pid")) || existsSync(join(configDir(), "runtime-port.json"));
+
+  function recoverStoppedRuntimeAfterFailure() {
+    if (serviceWasInstalled) {
+      console.warn("opencodex: update failed after stopping the proxy — restoring the previous background service.");
+      refreshBackgroundServiceOrStartDirect();
+    } else if (hasRuntimeState) {
+      console.warn("opencodex: update failed after stopping the proxy — restarting the previous version directly.");
+      startProxyDirectly();
+    }
+  }
+
   if (serviceWasInstalled || hasRuntimeState) {
     console.log("⏹  Stopping the running proxy before updating...");
     const stopRes = spawnSync(process.execPath, [launcher, "stop"], { stdio: "inherit", windowsHide: true });
@@ -261,9 +351,9 @@ function runNpmSelfUpdate() {
     }
     if (historyRestoreIncomplete()) {
       console.warn(
-        "opencodex: WARNING — Codex resume history was NOT restored (history DB locked; Codex app/IDE open?).\n" +
-        "  Routed threads stay hidden in the native Codex app until restored.\n" +
-        "  After the update: close the Codex app, then run 'ocx stop' once to restore.",
+        "opencodex: WARNING — Codex resume-history metadata restore is incomplete (a backup manifest remains).\n" +
+        "  The DB may be busy or the manifest/target may need review; untracked routed history is intentionally unchanged.\n" +
+        "  After the update: close the Codex app, run 'ocx doctor', then run 'ocx stop' once to retry.",
       );
     }
   }
@@ -309,7 +399,8 @@ function runNpmSelfUpdate() {
     // it recreates the #1849 destruction path. Report and stop; the boot probe and the
     // recovery marker cover the swap-window states.
     console.error(`opencodex: transactional update failed unexpectedly (${error?.message ?? error}). ` +
-      "The live install was not knowingly modified; run 'ocx update' again or reinstall with npm install -g.");
+      `The live install was not knowingly modified; run 'ocx update' again or reinstall with ` +
+      `npm install -g --allow-scripts=bun ${PKG}@${tag}.`);
     res = { status: 1 };
   }
   if (res.status === 0) {
@@ -329,77 +420,15 @@ function runNpmSelfUpdate() {
     // launcher so the new files write the baked paths and the service restarts.
     if (serviceWasInstalled) {
       console.log("Refreshing the background service with the updated files...");
-      const prevBake = process.env.OCX_BAKE_PORT;
-      process.env.OCX_BAKE_PORT = String(bakePort);
-      try {
-        let svc = spawnSync(process.execPath, serviceRefreshArgs(), { stdio: "inherit", windowsHide: true });
-        // `serviceWasInstalled` is inferred from service-state.json alone, which can be
-        // STALE — present while the registration is gone. Repair refuses that case by
-        // design, and its thrown Error is indistinguishable from any other failure at
-        // this layer (plain Error, inherited stdio, generic exit status). So ask for
-        // structured state instead of parsing the failure: install only when the
-        // diagnostic says the service is genuinely absent. Installing after ANY repair
-        // failure would resurrect the elevation prompt this change exists to avoid, and
-        // could re-register a service the user just uninstalled.
-        if (svc.status !== 0 && readServiceInstalledFromStatus(launcher) === false) {
-          console.log("No registered service found — installing it instead.");
-          svc = spawnSync(process.execPath, serviceInstallArgs(), { stdio: "inherit", windowsHide: true });
-        }
-        let needDirectStart = svc.status !== 0;
-        if (!needDirectStart) {
-          // Exit 0 can still leave stale/missing assets that never bring the proxy
-          // back — match the GUI/CLI fallthrough so /healthz is not left dead.
-          try {
-            const st = spawnSync(process.execPath, [launcher, "status", "--json"], {
-              encoding: "utf8",
-              timeout: 20_000,
-              windowsHide: true,
-            });
-            if (st.status === 0 && typeof st.stdout === "string" && st.stdout.trim()) {
-              const parsed = JSON.parse(st.stdout);
-              const proxyUp = parsed?.proxy?.running === true || parsed?.proxy?.health?.ok === true;
-              const viable = parsed?.startup?.serviceViable === true;
-              if (!proxyUp && !viable) needDirectStart = true;
-            } else {
-              // status failed or empty — fail closed to direct start (match CLI).
-              needDirectStart = true;
-            }
-          } catch {
-            needDirectStart = true;
-          }
-        }
-        if (needDirectStart) {
-          // A repair needs no elevation, but it can still fail — or exit 0 while leaving
-          // a non-viable manager. Fall back to a direct detached proxy start so the
-          // update never leaves the user without a running proxy.
-          console.warn(
-            svc.status === 0
-              ? "opencodex: service refresh left a non-viable manager — starting the proxy directly instead."
-              : "opencodex: service refresh failed — starting the proxy directly instead.",
-          );
-          console.warn("  Run 'ocx service repair' to see why the background service could not restart.");
-          const env = { ...process.env };
-          delete env.OCX_SERVICE;
-          const child = spawn(process.execPath, [launcher, "start", "--port", String(bakePort)], {
-            detached: true,
-            stdio: "ignore",
-            windowsHide: true,
-            env,
-          });
-          child.unref();
-          console.log(`Proxy starting on port ${bakePort}.`);
-        }
-      } finally {
-        if (prevBake === undefined) delete process.env.OCX_BAKE_PORT;
-        else process.env.OCX_BAKE_PORT = prevBake;
-      }
+      refreshBackgroundServiceOrStartDirect();
     } else {
       console.log("Restart the proxy:  ocx start");
     }
     process.exit(0);
   }
   if (trayBeforeUpdate.restoreOnFailure) runTrayLifecycle(launcher, "start");
-  console.error(`\nUpdate failed (npm exit ${res.status ?? "?"}). Try manually:  npm install -g ${PKG}@${tag}`);
+  recoverStoppedRuntimeAfterFailure();
+  console.error(`\nUpdate failed (npm exit ${res.status ?? "?"}). Try manually:  npm install -g --allow-scripts=bun ${PKG}@${tag}`);
   process.exit(1);
 }
 

devlog/_plan/260822_260822-bun14-followup-memory/000_plan.md

@@ -0,0 +1,17 @@
+# 000_plan — unit map
+
+- 000_research.md — claim ledger + gap analysis
+- 010_memory_diagnostics.md — extraMemorySize observability (PR parent, base dev)
+- 020_watchdog_gc_relief.md — measurement-FIRST GC evaluation (Phase A harness),
+  conditional idle-gated production hook (Phase B) per the 260731 gate
+- 030_smol_workers.md — smol:true gated on per-worker large-fixture A/B
+- 040_macmini_measurement.md — live measurement protocol (feeds 020 Phase A)
+
+Stack shape: PR-A(010, base dev) → PR-B(020 Phase A harness + evaluation,
+base PR-A head) → conditional PR for Phase B only on gate PASS;
+PR-C(030, base dev, lands per-call-site with A/B evidence).
+One decade doc = one work-phase = one PABCD cycle (LOOP-UNIT-CHAIN-01).
+Audit round 1: FAIL (4 findings) → docs revised: 020 restructured
+measurement-first honoring 260731_macos_rss_retention/040_allocator_residual
+gate; 010 static-import sync seam; 030 pre-landing A/B gate; separate
+lastReliefAt. See ledger.

devlog/_plan/260822_260822-bun14-followup-memory/000_research.md

@@ -0,0 +1,70 @@
+# 000 — Bun 1.4 follow-up memory patches: research and claim ledger
+
+Date: 2026-08-22
+Unit: 260822_260822-bun14-followup-memory
+Question: from today's viewpoint (bundled Bun 1.4.0, released 2026-08-19), which
+ADDITIONAL memory patches are possible and worthwhile in opencodex?
+
+## Method
+
+Luna 5-lane discovery swarm (official releases / GitHub issues+PRs / JSC-runtime /
+community / server-SSE-proxy), then Tier-2 proof by the main agent via `gh api`
+against oven-sh/bun. App-side baseline re-audited against
+devlog/_fin/260813_bun_canary_dogfood/050_memory_patch_roadmap.md and current src/.
+
+## Claim ledger (Tier-2 proven unless noted)
+
+| # | Claim | Proof | Status |
+|---|---|---|---|
+| C1 | No Bun 1.4.x patch release exists after v1.4.0 (2026-08-19). | `gh api repos/oven-sh/bun/releases` → latest tag `bun-v1.4.0`; bun-v1.4.1/2/3 404. | verified |
+| C2 | Bun PR #36467 (TLS Bun.serve use-after-free on `server.stop(true)` sibling-socket close) merged 2026-07-31, sha 529adec09, and IS an ancestor of bun-v1.4.0 (`compare/bun-v1.4.0...sha` → status=behind). Already in our bundled runtime; no action. | gh api pulls/36467 + compare | verified |
+| C3 | Bun PR #32662 (fetch: release buffered response body + error reader on streaming abort) merged 2026-07-22, sha 4b7241669, ancestor of v1.4.0. In bundled runtime. | gh api pulls/32662 + compare | verified |
+| C4 | Bun PR #35093 (fetch: error body stream when fully-buffered response aborted) merged 2026-07-28, sha 789be97db, ancestor of v1.4.0. In bundled runtime. | gh api pulls/35093 + compare | verified |
+| C5 | Bun issue #34917: `--max-old-space-size`, `BUN_JSC_gcMaxHeapSize`, `BUN_JSC_forceRAMSize` are NOT reliable heap caps on the 1.4 line; still OPEN (created 2026-07-21, closed:null). Container/OOM bounding must come from app-side watchdog + supervision, not JSC flags. | gh api issues/34917 | verified |
+| C6 | `Bun.gc(true)` on 1.4 asks JSC to collect AND asks mimalloc to release fragmented non-JS pages (allocator shared with JSC since the 1.4 Rust/allocator work). | Bun docs (bun.com/reference/bun/gc) opened by L3; local probe `typeof Bun.gc === "function"` on 1.4.0. | verified (docs) |
+| C7 | `bun:jsc` heapStats exposes `extraMemorySize`/`heapCapacity`; `Bun.unsafe.mimallocDump` exists on 1.4.0. | local probe on bundled 1.4.0: `{"heapSize":…,"heapCapacity":…,"extraMemorySize":…}`, mimallocDump:function | verified (executed) |
+| C8 | `new Worker(url, {smol:true})` works on bundled 1.4.0 (selects JSC Small heap growth policy per Bun docs). | local probe: "smol worker OK" | verified (executed) |
+| C9 | RSS retention after GC (issue #27514) and SSE-proxy reader-cancel segfault (#31159) were closed as DUPLICATES, not demonstrated fixed; #26321 (Windows file-stream RSS) duplicate-closed too. Continued A/B measurement remains necessary. | gh issue pages opened by L2/L5 | verified |
+| C10 | Community: Bun 1.4 advertises up to ~35% memory reduction (allocator rewrite, thread-local page purging, lazy zeroing); no long-running independent RSS measurements yet. | Reddit announcements (L4), snippet-grade | lead |
+| C11 | Medium post claims 1.4-era HTTP long-connection RSS still grew 280→340MB over 7 days; page returned 403. | unreachable | candidate — unverified |
+
+## App-side baseline (what is already done — do not re-patch)
+
+- 260813 roadmap patches #1–#4 ALL landed since: native-main hardened-identity LRU
+  (src/codex/native-main-claim.ts:25-33), installation-salt LRU
+  (src/lab/subject/installation-salt.ts:7-17), mode-hint capability LRU
+  (src/codex/features.ts:1097-1106), Lab ledger event-id process index REMOVED
+  (no `eventIdIndexByLedger` in src/lab/ledger/store.ts).
+- `Bun.serve({ idleTimeout: 255 })` (src/server/index.ts:736) and per-request
+  `server.timeout(req, 0)` for streaming (src/server/responses/fetch-helpers.ts:113)
+  already implement the SSE-timeout guidance the swarm surfaced.
+- eager-relay vs legacy-tee runtime gate: src/lib/bun-stream-caps.ts
+  (MIN_FIXED_BUN_VERSION="1.4.0").
+- Memory watchdog: warn-only ring sampler (src/server/memory-watchdog.ts), exposed at
+  /api/system/memory with bun:jsc heapSize/heapCapacity/objectCount.
+- 36-store bounded-memory audit closed (devlog/_fin/260813…/050): only remaining
+  investigation is model-cache generation tombstones — needs an authority-token
+  redesign, NOT an eviction patch; excluded from this unit.
+
+## Gap analysis → patch set for THIS unit
+
+What Bun 1.4 newly makes possible, that opencodex does not use yet:
+
+1. **Diagnostics gap** — /api/system/memory and the watchdog ignore
+   `extraMemorySize` (JSC-visible native memory) and the watchdog samples carry no
+   JSC data at all. On 1.4, extraMemorySize is the counter that moved most
+   (external-memory reporting fixes #31422/#32653/#34142). → doc 010.
+2. **Reclaim gap** — nothing in the tree ever calls `Bun.gc`. On 1.4 a full
+   `Bun.gc(true)` also purges mimalloc pages (C6) — the exact mitigation for the
+   "heap shrinks, RSS stays" pattern (#27514) that JSC flags cannot deliver (C5).
+   A config-gated, rate-limited watchdog relief hook is now worth having. → doc 020.
+3. **Worker heap gap** — history/restore/policy workers are short-lived batch jobs;
+   `smol: true` (C8) bounds their JSC heap growth policy at a small perf cost,
+   reducing peak RSS during storage jobs. → doc 030.
+4. **Proof gap** — every claim above is config/diagnostic-grade until measured.
+   macmini-cf (arm64, bun 1.3.14 installed → good A/B host) runs the live
+   measurement protocol. → doc 040.
+
+Explicit non-goals: no Bun runtime patching/fork (upstream 1.4.0 already carries
+C2–C4); no JSC env-var "caps" (C5 proves them unreliable); no smol for the main
+proxy process (throughput cost, unmeasured); no model-cache tombstone work.