Merge train round 3 B1: seven small bug fixes (#6015 #6034 #6026 #6019 #6041 #6006 #6011)

desktop/src-tauri/src/exit.rs

@@ -146,6 +146,14 @@ pub struct Supervision {
     pub reason_set: bool,
 }
 
+/// State restored when an update's coordinated restart is abandoned.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct AbortedRestart {
+    pub phase: ExitPhase,
+    /// Whether the person wanted a runtime before the drain or requested one while it ran.
+    pub runtime_was_wanted: bool,
+}
+
 impl Supervision {
     /// Nothing is in flight, nobody asked for the runtime to stop, and the app is not ending.
     pub fn allowed(self) -> bool {
@@ -161,6 +169,14 @@ struct Inner {
     deferred: bool,
     /// See [`Supervision::wanted`]. Sticky: finishing a stop does not restore it.
     wanted: bool,
+    /// The intent an update temporarily replaced with `wanted=false`; consumed if it aborts.
+    restart_wanted: Option<bool>,
+}
+
+fn remember_restart_intent(inner: &mut Inner, reason: ExitReason, prior_wanted: bool) {
+    if reason == ExitReason::CoordinatedRestart {
+        inner.restart_wanted.get_or_insert(prior_wanted);
+    }
 }
 
 /// The exit sequence's state, managed by the app.
@@ -179,6 +195,7 @@ impl ExitCoordinator {
                 hides_to_tray: TrayAvailability::assumed().hides_to_tray(),
                 deferred: false,
                 wanted: true,
+                restart_wanted: None,
             }),
         }
     }
@@ -215,17 +232,20 @@ impl ExitCoordinator {
     /// [`ExitCoordinator::finish_stop`] is holding the phase.
     pub fn claim_drain(&self, fallback: ExitReason) -> Option<ExitReason> {
         let mut inner = self.inner();
+        let prior_wanted = inner.wanted;
         // A quit or an update is on its way, whoever ends up running the drain: the runtime it
         // stops is not one to bring back.
         inner.wanted = false;
         match inner.phase {
             ExitPhase::Idle => {
                 let reason = *inner.reason.get_or_insert(fallback);
+                remember_restart_intent(&mut inner, reason, prior_wanted);
                 inner.phase = ExitPhase::Draining;
                 Some(reason)
             }
             ExitPhase::Spawning | ExitPhase::Stopping => {
-                inner.reason.get_or_insert(fallback);
+                let reason = *inner.reason.get_or_insert(fallback);
+                remember_restart_intent(&mut inner, reason, prior_wanted);
                 inner.deferred = true;
                 None
             }
@@ -235,6 +255,7 @@ impl ExitCoordinator {
             // is the one thing a user with a runtime that would not stop cannot easily do.
             ExitPhase::DrainFailed | ExitPhase::OwnershipUnknown => {
                 let reason = *inner.reason.get_or_insert(fallback);
+                remember_restart_intent(&mut inner, reason, prior_wanted);
                 inner.phase = ExitPhase::Draining;
                 Some(reason)
             }
@@ -256,10 +277,12 @@ impl ExitCoordinator {
     /// An update drains before it installs. When the install then fails, or the drain itself did,
     /// the drain's phase used to be the end of the road: `Drained` is terminal, so no runtime could
     /// be started again and a bare window close quit the app. This returns the app to `Idle` with
-    /// no claimed reason and wants a runtime again, which is what a successful update would have
-    /// ended in too. It touches nothing unless an update's restart holds the phase: a quit is never
-    /// aborted, and a drain still running belongs to whoever runs it. Returns the phase it left.
-    pub fn abort_restart(&self) -> Option<ExitPhase> {
+    /// no claimed reason and restores the runtime intent the update temporarily suppressed. A
+    /// retry requested while the drain was in flight wins too: aborting an older update must not
+    /// overwrite newer user intent. It touches nothing unless an update's restart holds the phase:
+    /// a quit is never aborted, and a
+    /// drain still running belongs to whoever runs it. Returns the phase and restored intent.
+    pub fn abort_restart(&self) -> Option<AbortedRestart> {
         let mut inner = self.inner();
         let left = inner.phase;
         let restart = inner.reason == Some(ExitReason::CoordinatedRestart);
@@ -273,8 +296,15 @@ impl ExitCoordinator {
         inner.phase = ExitPhase::Idle;
         inner.reason = None;
         inner.deferred = false;
-        inner.wanted = true;
-        Some(left)
+        // `resume` can arrive after the update captured its original intent. Preserve that newer
+        // request as well as the older snapshot; otherwise the abort races the startup retry and
+        // can leave a runtime stopped even though the person just asked for it.
+        let runtime_was_wanted = inner.wanted || inner.restart_wanted.take().unwrap_or(false);
+        inner.wanted = runtime_was_wanted;
+        Some(AbortedRestart {
+            phase: left,
+            runtime_was_wanted,
+        })
     }
 
     /// What the runtime supervisor reads before it acts.
@@ -293,7 +323,14 @@ impl ExitCoordinator {
 
     /// A person asked for a runtime again (the startup page's retry).
     pub fn resume(&self) {
-        self.inner().wanted = true;
+        let mut inner = self.inner();
+        inner.wanted = true;
+        // A pending update snapshot must learn about the request too. A retried install that finds
+        // the drain already settled clears `wanted` again without replacing the snapshot, so a
+        // retry recorded only in `wanted` would be lost when that install fails and aborts.
+        if let Some(snapshot) = inner.restart_wanted.as_mut() {
+            *snapshot = true;
+        }
     }
 
     /// Reserve the right to start a runtime. False once something else owns the phase.
@@ -624,7 +661,7 @@ fn hide_windows(app: &AppHandle) {
 #[cfg(test)]
 mod tests {
     use super::{
-        decide, DrainVerdict, ExitCoordinator, ExitDecision, ExitPhase, ExitReason,
+        decide, AbortedRestart, DrainVerdict, ExitCoordinator, ExitDecision, ExitPhase, ExitReason,
         RestartReadiness, Supervision,
     };
     use crate::tray_availability::TrayAvailability;
@@ -707,7 +744,13 @@ mod tests {
             );
             coordinator.finish_drain(verdict);
             let left = coordinator.phase();
-            assert_eq!(coordinator.abort_restart(), Some(left));
+            assert_eq!(
+                coordinator.abort_restart(),
+                Some(AbortedRestart {
+                    phase: left,
+                    runtime_was_wanted: true,
+                })
+            );
             assert_eq!(coordinator.phase(), ExitPhase::Idle);
             // A bare close hides again instead of quitting out of a terminal phase.
             assert_eq!(coordinator.decision(), ExitDecision::Hide);
@@ -716,6 +759,85 @@ mod tests {
         }
     }
 
+    #[test]
+    fn a_failed_update_preserves_a_completed_tray_stop() {
+        let coordinator = ExitCoordinator::new();
+        coordinator.set_tray(TrayAvailability::Available);
+        assert!(coordinator.begin_stop());
+        assert_eq!(coordinator.finish_stop(), None);
+        assert!(!coordinator.supervision().wanted);
+
+        assert_eq!(
+            coordinator.claim_drain(ExitReason::CoordinatedRestart),
+            Some(ExitReason::CoordinatedRestart)
+        );
+        coordinator.finish_drain(DrainVerdict::Drained);
+        assert_eq!(
+            coordinator.abort_restart(),
+            Some(AbortedRestart {
+                phase: ExitPhase::Drained,
+                runtime_was_wanted: false,
+            })
+        );
+        assert_eq!(coordinator.phase(), ExitPhase::Idle);
+        assert_eq!(coordinator.decision(), ExitDecision::Hide);
+        assert!(!coordinator.supervision_allowed());
+    }
+
+    #[test]
+    fn a_startup_retry_during_an_update_drain_is_not_overwritten_by_abort() {
+        let coordinator = ExitCoordinator::new();
+        coordinator.set_tray(TrayAvailability::Available);
+        assert!(coordinator.begin_stop());
+        assert_eq!(coordinator.finish_stop(), None);
+        assert!(!coordinator.supervision().wanted);
+
+        assert_eq!(
+            coordinator.claim_drain(ExitReason::CoordinatedRestart),
+            Some(ExitReason::CoordinatedRestart)
+        );
+        coordinator.resume();
+        // The ending claim still prevents supervision until the failed update is handed back.
+        assert!(!coordinator.supervision_allowed());
+        coordinator.finish_drain(DrainVerdict::Drained);
+        assert_eq!(
+            coordinator.abort_restart(),
+            Some(AbortedRestart {
+                phase: ExitPhase::Drained,
+                runtime_was_wanted: true,
+            })
+        );
+        assert!(coordinator.supervision_allowed());
+    }
+
+    #[test]
+    fn a_retry_between_update_attempts_survives_the_second_claim() {
+        let coordinator = ExitCoordinator::new();
+        coordinator.set_tray(TrayAvailability::Available);
+        assert!(coordinator.begin_stop());
+        assert_eq!(coordinator.finish_stop(), None);
+
+        assert_eq!(
+            coordinator.claim_drain(ExitReason::CoordinatedRestart),
+            Some(ExitReason::CoordinatedRestart)
+        );
+        coordinator.finish_drain(DrainVerdict::Drained);
+        coordinator.resume();
+        // The next install attempt finds the drain settled and clears `wanted` again.
+        assert_eq!(
+            coordinator.claim_drain(ExitReason::CoordinatedRestart),
+            None
+        );
+        assert_eq!(
+            coordinator.abort_restart(),
+            Some(AbortedRestart {
+                phase: ExitPhase::Drained,
+                runtime_was_wanted: true,
+            })
+        );
+        assert!(coordinator.supervision_allowed());
+    }
+
     #[test]
     fn a_quit_or_a_drain_in_flight_is_never_aborted() {
         let coordinator = ExitCoordinator::new();

desktop/src-tauri/src/updater.rs

@@ -1,5 +1,5 @@
 use crate::{
-    exit::{ExitCoordinator, ExitPhase, RestartReadiness},
+    exit::{AbortedRestart, ExitCoordinator, ExitPhase, RestartReadiness},
     logging, tray,
 };
 use serde::Serialize;
@@ -422,8 +422,13 @@ pub async fn install(app: &AppHandle, update: Update) -> Result<(), String> {
 
 /// Hand a failed install back to a running app. True when the drain had already stopped the
 /// runtime, so the startup sequence has to bring one back; a drain that failed left it running.
+/// Intent captured before the drain and a newer startup retry are both authoritative.
 fn after_install_failure(coordinator: &ExitCoordinator) -> bool {
-    coordinator.abort_restart() == Some(ExitPhase::Drained)
+    coordinator.abort_restart()
+        == Some(AbortedRestart {
+            phase: ExitPhase::Drained,
+            runtime_was_wanted: true,
+        })
 }
 
 fn recover_after_failed_install(app: &AppHandle) {
@@ -507,6 +512,7 @@ mod tests {
         DesktopUpdateState, InstallClaim, UiProjection,
     };
     use crate::exit::{DrainVerdict, ExitCoordinator, ExitDecision, ExitReason};
+    use crate::tray_availability::TrayAvailability;
     use std::sync::atomic::{AtomicBool, Ordering};
     use std::sync::{mpsc, Arc};
     use tauri_utils::config::BundleType;
@@ -533,6 +539,26 @@ mod tests {
         coordinator.finish_drain(DrainVerdict::Drained);
         assert!(!after_install_failure(&coordinator));
         assert_eq!(coordinator.decision(), ExitDecision::Proceed);
+
+        // A completed tray Stop remains the person's intent across repeated failed updates.
+        let coordinator = ExitCoordinator::new();
+        coordinator.set_tray(TrayAvailability::Available);
+        assert!(coordinator.begin_stop());
+        assert_eq!(coordinator.finish_stop(), None);
+        for _ in 0..2 {
+            coordinator.claim_drain(ExitReason::CoordinatedRestart);
+            coordinator.finish_drain(DrainVerdict::Drained);
+            assert!(!after_install_failure(&coordinator));
+            assert!(!coordinator.supervision_allowed());
+            assert_eq!(coordinator.decision(), ExitDecision::Hide);
+        }
+
+        // A newer retry wins over the stopped intent that the update captured at claim time.
+        coordinator.claim_drain(ExitReason::CoordinatedRestart);
+        coordinator.resume();
+        coordinator.finish_drain(DrainVerdict::Drained);
+        assert!(after_install_failure(&coordinator));
+        assert!(coordinator.supervision_allowed());
     }
 
     #[test]

devlog/_plan/260927_merge_train_3/000_roadmap.md

@@ -0,0 +1,30 @@
+# Merge train round 3 — roadmap
+
+Inventory at `dev` `99d0a9400e` (2026-09-27, after round 2 in `devlog/_plan/260927_merge_train_2/`). Round 2's
+outcome carries forward: its owner-decision list (#5831, #5964, #5956, #5995, #5800, #5912, #5879) and its blocked list
+(#5977 unauthenticated status proof, #5893 Bun NO_PROXY patterns, #5927 security, #5925 needs a split, #5953 overbroad
+override, #5539, #5497, #5947, #5782, #4222 and the stale feature drafts) stay out of this lane unless their authors
+changed the premise.
+
+Goal: land the open bug fixes and non-GUI enhancements that opened after round 2's inventory, close what they resolve,
+and bring open issues and PRs to at most 40 each (61 issues and 80 PRs at the start). One lane, serialized batches,
+each rebased on the newest `dev`.
+
+Every carried PR is one squashed commit with the author or a `Co-authored-by` trailer. Each item's GitHub page is read
+through Aside's signed-in browser (captures in `.tmp/aside/`, gitignored) before it is carried or closed. Kimi
+subagents review each PR and audit each batch diff; auth, credential and link-relay changes get a dedicated security
+review whose specifics stay in scratch.
+
+## Batches
+
+| Batch | PRs | Issues |
+|---|---|---|
+| B1 | #6041, #6019, #6015, #6011, #6006, #6026, #6034 (security review) | #6033, #6017, #6014, #4191 (only if the fix, not just a pin, lands), #6005, #5960, #6032 |
+| B2 | luvs01 non-GUI bug fixes: #6048, #6047, #6046, #6038, #6036, #6035, #6057; #6022 (mdwsk88) | per PR |
+| B3 | #6020 or #6056 (same quota-activation code; pick one), #6027, rebased #6050 #6049 #6037, #6042 (security review), #6030, #6003 | #6018, #5569 |
+| B4 | bugs found through Aside that have no PR yet, implemented in this lane | per issue |
+
+## Out of scope
+
+GUI changes: #6043, #6007, #5983, #5905, #5950, #6025, #6010, and the GUI feature drafts. #6044 is a conflicting draft
+that also edits a GUI test.

devlog/_plan/260927_merge_train_3/010_batch1.md

@@ -0,0 +1,30 @@
+# B1 — small bug fixes with owner-filed issues
+
+Base: `dev` `99d0a9400e`. Branch `codex/train3-b1`.
+
+| PR | Author | Issue | Change | Risk |
+|---|---|---|---|---|
+| #6041 | Ingwannu | #6033 | `abort_restart()` restores the pre-update wanted intent instead of forcing `wanted = true` (desktop/src-tauri exit.rs, updater.rs) | Tauri; hosted macOS/Windows/Linux desktop jobs |
+| #6019 | Ingwannu | #6017 | macOS ACL parser stops trusting the `user:0`/`root` display name as root identity | plugin trust; must only tighten |
+| #6015 | Ingwannu | #6014 | picker route test binds real listeners instead of probing then releasing ports | test only plus a runtime option |
+| #6011 | Ingwannu | #4191 | pins established-WebSocket failure behavior with a test and ADR | issue closes only if behavior is fixed |
+| #6006 | Ingwannu | #6005 | translated Anthropic output schemas claim `strict` only when strict-eligible | adapter contract |
+| #6026 | codingbooo | #5960 | `ocx models` derives catalog price estimates when no manual price is set | CLI output |
+| #6034 | Ingwannu | #6032 | link relay strips provider credential headers | security boundary; dedicated review |
+
+## Method
+
+1. Kimi review per PR (verdict LAND / LAND-WITH-FIXES / HOLD); #6034 also gets the security verdict.
+2. Squash each PR onto the branch in the table order, preserving the author; fold review fixes as separate commits.
+3. Reconcile test-layout registries and the file-size ratchet once for the batch.
+4. Local: `bun install`, `bun run typecheck`, the focused test files each PR touches, `bun run structure:check`,
+   `bun run privacy:scan`.
+5. Push, open the batch PR with the template, wait for exact-head CI, merge with `--admin --merge
+   --match-head-commit`, then close the source PRs and issues with the merge commit.
+
+## Aside evidence
+
+Captured to `.tmp/aside/` for every PR and issue above. All seven issues are owner-filed today with reproduction and
+code pointers that match the PR premises. #4191's thread records the owner's position (Sep 21) that an established
+WebSocket dying mid-turn is a failed leg rather than an SSE fallback, plus two contributor data sets (Sep 23) asking for
+a fallback, so a test-and-ADR PR does not by itself resolve that issue.

docs-site/src/content/docs/guides/local-plugins.md

@@ -31,9 +31,10 @@ Put plugin files in `plugins/` inside the opencodex home (`~/.opencodex/plugins/
   `chmod go-w ~/.opencodex/plugins ~/.opencodex/plugins/*`; on systems whose default umask is
   `002`, check the parent directories too. On macOS, an ACL grant to another user or group that
   can write, delete, change permissions, or add/remove path entries blocks loading, even if the
-  mode is `0600`; inspect with `ls -le`. Read-only, deny, inheritance-only, and grants only to
-  the path owner, the running user, or root do not block loading. On Linux, extended ACLs are
-  checked when `getfacl` is installed. Without it, only owner and mode bits are verified.
+  mode is `0600`; inspect the path itself with `/bin/ls -lebd -- <path>`. Read-only, deny,
+  inheritance-only, and grants only to the path owner or running user do not block loading. ACL
+  display names such as `root` or `0` are not treated as numeric UID proof. On Linux, extended
+  ACLs are checked when `getfacl` is installed. Without it, only owner and mode bits are verified.
 - On Windows automatic plugin loading is disabled until an ACL trust check is available.
 
 Restart the proxy after adding, changing or removing a plugin (`ocx service restart`, or stop and

docs-site/src/content/docs/guides/remote-link.md

@@ -73,7 +73,7 @@ When a step fails, the dashboard shows the reason and, when SSH reported one, th
 
 ## Security
 
-The Child uses the Home computer's providers and provider credentials through the link. The Home creates a separate link key for each Child; removing the link revokes that key. On the Child, the key stays inside OpenCodex: credentials that Codex or Claude Code send there are not forwarded to the Home, and any program on the Child that reaches `127.0.0.1:<port>` uses the Home without a key, the same local trust a standalone install gives. Web pages from other sites are refused. Compare the host fingerprint before confirmation so a wrong machine or changed host key is not accepted by mistake. Dashboard sessions issued from a Tailscale identity cannot manage machine links.
+The Child uses the Home computer's providers and provider credentials through the link. The Home creates a separate link key for each Child; removing the link revokes that key. On the Child, the key stays inside OpenCodex: credentials that Codex or Claude Code send there are not forwarded to the Home, including Bearer, Azure `api-key`, Anthropic-compatible `x-api-key`, and Google `x-goog-api-key` forms. Any program on the Child that reaches `127.0.0.1:<port>` uses the Home without a key, the same local trust a standalone install gives. Web pages from other sites are refused. Compare the host fingerprint before confirmation so a wrong machine or changed host key is not accepted by mistake. Dashboard sessions issued from a Tailscale identity cannot manage machine links.
 
 ## CLI reference