fix: bug-PR merge train batch 4 (#5824 adaptive thinking display, #5750 Linux updater scope)

docs-site/src/content/docs/reference/adapters.md

@@ -242,6 +242,10 @@ MiMo model Command Code serves.
   maps reasoning effort to a budget (minimal 1024 … max 32000), then computes a safe `max_tokens` with
   output headroom, and **drops `temperature`/`top_p`** when thinking is enabled (Anthropic forbids
   them there).
+- **Adaptive thinking display:** adaptive-thinking models (Opus 4.7+, Sonnet 5, Fable) are asked
+  for `thinking.display: "summarized"`, so a long think reaches Chat and Responses clients as
+  reasoning deltas instead of minutes of heartbeats. A request that hides the reasoning summary
+  (`reasoning.summary: "none"`) keeps the provider default.
 - **Structured output:** Responses `text.format` and Chat Completions `response_format` requests
   with `type: "json_schema"` become Anthropic `output_config.format`. The format merges into an
   existing adaptive-thinking output configuration, preserving a compatible `output_config.effort`.

scripts/test-layout/layout.json

@@ -1782,6 +1782,7 @@
     "update-desktop-badge.test.ts": "update",
     "update-desktop-owner.test.ts": "update",
     "update-job.test.ts": "update",
+    "update-worker-launch.test.ts": "update",
     "update-notify.test.ts": "update",
     "update-npm-cache-preflight.test.ts": "update",
     "update-npm-invocation.test.ts": "update",

src/adapters/anthropic.ts

@@ -1099,7 +1099,12 @@ export function createAnthropicAdapter(provider: OcxProviderConfig, cacheRetenti
           // `thinking.type: "enabled"` outright. `max_tokens` still caps thinking plus visible
           // output, so high effort needs the same total-token headroom as budget thinking or a
           // default 8192-token request can spend everything on thought and return empty text.
-          body.thinking = { type: "adaptive" };
+          // Opus 4.7+ defaults `display` to "omitted": the stream then carries signature-only
+          // thinking blocks, so a Chat client sees minutes of heartbeats and no reasoning delta
+          // during a long think (#5824). Ask for summarized thinking unless the caller hides it.
+          body.thinking = parsed.options.hideThinkingSummary
+            ? { type: "adaptive" }
+            : { type: "adaptive", display: "summarized" };
           const effort = adaptiveEffort(effectiveReasoning);
           body.output_config = { effort };
           const explicitMaxOut = parsed.options.maxOutputTokens;

src/update/job.ts

@@ -60,6 +60,7 @@ import {
   runNpmCachePreflight,
   type NpmCachePreflightReason,
 } from "./npm-cache-preflight.mjs";
+import { guiUpdateWorkerCommand } from "./worker-launch";
 
 const RELEASE_NOTES_URL = "https://github.com/lidge-jun/opencodex/releases/latest";
 const UPDATE_JOB_FILENAME = "update-job.json";
@@ -574,7 +575,8 @@ export function spawnGuiUpdateWorker(
     restart ? "restart" : "no-restart",
   ]);
   if (process.platform !== "win32") {
-    return spawn(process.execPath, args, {
+    const launch = guiUpdateWorkerCommand(process.execPath, args);
+    return spawn(launch.command, launch.argv, {
       detached: true,
       stdio: "ignore",
       windowsHide: true,

src/update/worker-launch.ts

@@ -0,0 +1,46 @@
+import { spawnSync } from "node:child_process";
+
+/**
+ * How to launch the dashboard update worker on POSIX.
+ *
+ * A worker spawned from the systemd user service stays in that service's cgroup even when
+ * detached, and the generated unit keeps the default `KillMode=control-group`. The updater then
+ * stops `opencodex-proxy.service` and systemd kills the worker with it, leaving the proxy offline
+ * on the old package (#5750). `systemd-run --user --scope` moves the worker into its own
+ * transient scope first; `--scope` execs the command in place, so the returned PID is still the
+ * worker's. Outside a systemd-started process (`INVOCATION_ID` unset), or when `systemd-run` is
+ * missing, the plain detached spawn is unchanged.
+ */
+export const SYSTEMD_SCOPE_ARGS = ["--user", "--scope", "--quiet", "--collect", "--"] as const;
+
+export interface WorkerLaunchContext {
+  platform?: NodeJS.Platform;
+  env?: NodeJS.ProcessEnv;
+  hasSystemdRun?: () => boolean;
+}
+
+let systemdRunProbe: boolean | undefined;
+
+function probeSystemdRun(): boolean {
+  if (systemdRunProbe === undefined) {
+    // Run a real no-op scope rather than `--version`: a present binary without a reachable user
+    // bus would otherwise pass the probe and then fail to start the worker at all.
+    const probe = spawnSync("systemd-run", [...SYSTEMD_SCOPE_ARGS, "true"], { stdio: "ignore", timeout: 5_000 });
+    systemdRunProbe = !probe.error && probe.status === 0;
+  }
+  return systemdRunProbe;
+}
+
+export function guiUpdateWorkerCommand(
+  execPath: string,
+  args: readonly string[],
+  context: WorkerLaunchContext = {},
+): { command: string; argv: string[] } {
+  const platform = context.platform ?? process.platform;
+  const env = context.env ?? process.env;
+  const underSystemd = platform === "linux" && Boolean(env.INVOCATION_ID);
+  if (underSystemd && (context.hasSystemdRun ?? probeSystemdRun)()) {
+    return { command: "systemd-run", argv: [...SYSTEMD_SCOPE_ARGS, execPath, ...args] };
+  }
+  return { command: execPath, argv: [...args] };
+}

structure/ops/service-and-sidecars.md

@@ -275,3 +275,5 @@ src/update/refresh-scheduler.ts owns the package cache timer and per-channel sin
 src/update/async-check.ts uses the existing owner-bound registry target with a bounded asynchronous child; pnpm owner discovery runs in src/update/pnpm-owner-worker.ts off the request loop. `src/update/notify.ts` writes successful results atomically and preserves a dismissal only for the same channel and version. The interactive pre-bind prompt reads the cache and does not launch a second detached refresh. `src/update/badge.ts` only reads the cache and reports unknown at 40 hours.
 
 The desktop badge snapshot in src/update/desktop-badge.ts is process-local display state keyed by a Tauri session id. A 60-second shell heartbeat renews receipt time; entries expire after 180 seconds and the store retains at most 32 sessions. It is separate from the package version cache and from the updater job/ownership transaction. A proxy restart reports unknown until a bound desktop shell republishes; no update installation can be authorized by this snapshot.
+
+On Linux, a dashboard update worker started from the systemd user service is launched through `systemd-run --user --scope --quiet --collect` (`src/update/worker-launch.ts`), so it leaves the service cgroup before the updater stops `opencodex-proxy.service`; the default `KillMode=control-group` otherwise kills it with the proxy (#5750). The path applies only when `INVOCATION_ID` is set and a no-op scope probe succeeds; every other case keeps the plain detached spawn. `--scope` moves `systemd-run` itself into the scope and then execs the worker, so the recorded PID is the worker's (`tests/update/update-worker-launch.test.ts`).

tests/adapters/anthropic/anthropic-reasoning.test.ts

@@ -98,13 +98,17 @@ describe("anthropic extended-thinking gate", () => {
     "claude-opus-4-8.1",
   ])("adaptive-thinking model %s sends thinking.adaptive + output_config.effort", async (modelId) => {
     const b = await bodyOf(parsed("xhigh", { temperature: 0.3, topP: 0.9 }, modelId));
-    expect(b.thinking).toEqual({ type: "adaptive" });
+    expect(b.thinking).toEqual({ type: "adaptive", display: "summarized" });
     expect(b.output_config).toEqual({ effort: "xhigh" });
     expect(b.temperature).toBeUndefined();
     expect(b.top_p).toBeUndefined();
   });
 
   test("adaptive-thinking model maps unsupported 'minimal' effort to 'low'", async () => {
+    // #5824: summarized thinking keeps a long think visible as reasoning deltas; a caller that
+    // hides the summary keeps the provider default instead.
+    const hidden = await bodyOf(parsed("high", { hideThinkingSummary: true }, "claude-opus-4-8"));
+    expect(hidden.thinking).toEqual({ type: "adaptive" });
     const b = await bodyOf(parsed("minimal", {}, "claude-fable-5"));
     expect(b.output_config).toEqual({ effort: "low" });
     expect(b.max_tokens).toBe(12_288);
@@ -259,7 +263,7 @@ describe("anthropic extended-thinking gate", () => {
     // Exact regression: effort=max budget is 32000; adaptive ceiling adds OUTPUT_HEADROOM (8192)
     // so max_tokens = 40192, genuinely above the reasoning budget at full effort.
     expect(b.max_tokens as number).toBe(40_192);
-    expect(b.thinking).toEqual({ type: "adaptive" });
+    expect(b.thinking).toEqual({ type: "adaptive", display: "summarized" });
     expect(b.output_config).toEqual({ effort: "max" });
   });
 
@@ -354,7 +358,7 @@ describe("anthropic extended-thinking gate", () => {
     "claude-opus-4-8/vendor-suffix",
   ])("adaptive-thinking model %s keeps the adaptive wire shape", async (modelId) => {
     const b = await bodyOf(parsed("high", {}, modelId));
-    expect(b.thinking).toEqual({ type: "adaptive" });
+    expect(b.thinking).toEqual({ type: "adaptive", display: "summarized" });
     expect(b.output_config).toEqual({ effort: "high" });
   });
 

tests/fixtures/test-layout-expected.json

@@ -1608,6 +1608,7 @@
   "update-desktop-badge.test.ts": "update",
   "update-desktop-owner.test.ts": "update",
   "update-job.test.ts": "update",
+  "update-worker-launch.test.ts": "update",
   "update-notify.test.ts": "update",
   "update-npm-cache-preflight.test.ts": "update",
   "update-npm-invocation.test.ts": "update",

tests/update/update-worker-launch.test.ts

@@ -0,0 +1,30 @@
+import { describe, expect, test } from "bun:test";
+import { guiUpdateWorkerCommand, SYSTEMD_SCOPE_ARGS } from "../../src/update/worker-launch";
+
+// #5750: a worker spawned by the systemd user service must leave the service cgroup before the
+// updater stops that service, or systemd kills it along with the proxy.
+describe("dashboard update worker launch", () => {
+  const args = ["/opt/ocx/src/cli/index.ts", "__gui-update-worker", "job-1", "stable", "restart"];
+
+  test("a systemd-started Linux proxy launches the worker in its own scope", () => {
+    const launch = guiUpdateWorkerCommand("/usr/bin/bun", args, {
+      platform: "linux", env: { INVOCATION_ID: "abc" }, hasSystemdRun: () => true,
+    });
+    expect(launch).toEqual({ command: "systemd-run", argv: [...SYSTEMD_SCOPE_ARGS, "/usr/bin/bun", ...args] });
+  });
+
+  test("without systemd-run, outside systemd, or off Linux the spawn is unchanged", () => {
+    const plain = { command: "/usr/bin/bun", argv: args };
+    expect(guiUpdateWorkerCommand("/usr/bin/bun", args, {
+      platform: "linux", env: { INVOCATION_ID: "abc" }, hasSystemdRun: () => false,
+    })).toEqual(plain);
+    let probed = false;
+    expect(guiUpdateWorkerCommand("/usr/bin/bun", args, {
+      platform: "linux", env: {}, hasSystemdRun: () => { probed = true; return true; },
+    })).toEqual(plain);
+    expect(probed).toBe(false);
+    expect(guiUpdateWorkerCommand("/usr/bin/bun", args, {
+      platform: "darwin", env: { INVOCATION_ID: "abc" }, hasSystemdRun: () => true,
+    })).toEqual(plain);
+  });
+});