fix: integrate reviewed provider, client, and desktop recovery train

desktop/src-tauri/Cargo.toml

@@ -38,6 +38,10 @@ tokio = { version = "=1.45.1", features = ["sync", "time"] }
 [target.'cfg(target_os = "linux")'.dependencies]
 dbus = "=0.9.12"
 
+# Already present in the lock graph; only Windows writes its quoted Run command.
+[target.'cfg(target_os = "windows")'.dependencies]
+winreg = "=0.55.0"
+
 [profile.release]
 codegen-units = 1
 lto = "thin"

desktop/src-tauri/src/first_run.rs

@@ -6,8 +6,13 @@ use tauri_plugin_autostart::ManagerExt;
 const MARKER: &str = "start-at-login-claimed";
 
 /// Marker file recording that the login item names the launch-origin argument.
+#[cfg(not(target_os = "windows"))]
 const ORIGIN_MARKER: &str = "start-at-login-origin-flag";
 
+// Windows must revisit registrations claimed by the earlier, unquoted writer.
+#[cfg(target_os = "windows")]
+const ORIGIN_MARKER: &str = "start-at-login-quoted-origin-flag";
+
 /// What the one-time Start at Login decision did on this launch.
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
 pub enum StartAtLogin {
@@ -63,7 +68,7 @@ pub fn apply_start_at_login_default(app: &AppHandle) -> StartAtLogin {
     if app.autolaunch().is_enabled().unwrap_or(false) {
         return StartAtLogin::AlreadyDecided;
     }
-    match app.autolaunch().enable() {
+    match crate::login_autostart::enable(app) {
         Ok(()) => StartAtLogin::Enabled,
         Err(_) => StartAtLogin::Unavailable,
     }
@@ -99,7 +104,7 @@ pub fn adopt_launch_origin_argument(app: &AppHandle) {
     // leave a login launch showing its window forever.
     match app.autolaunch().is_enabled() {
         Ok(true) => {
-            if app.autolaunch().enable().is_err() {
+            if crate::login_autostart::enable(app).is_err() {
                 return;
             }
         }

desktop/src-tauri/src/lib.rs

@@ -9,6 +9,9 @@ mod first_run;
 mod formatting;
 mod identity;
 mod logging;
+mod login_autostart;
+#[cfg(any(target_os = "windows", test))]
+mod windows_autostart_command;
 // macOS only: it exists to replace one item in a menu no other platform installs. Compiling it
 // elsewhere would leave its contents unreachable, which -D warnings rejects.
 #[cfg(target_os = "macos")]

desktop/src-tauri/src/login_autostart.rs

@@ -0,0 +1,45 @@
+use tauri::AppHandle;
+
+/// All shell-owned enables use this entry point; the plugin still owns status and disable.
+#[cfg(not(target_os = "windows"))]
+pub fn enable(app: &AppHandle) -> Result<(), String> {
+    use tauri_plugin_autostart::ManagerExt;
+    app.autolaunch().enable().map_err(|error| error.to_string())
+}
+
+#[cfg(target_os = "windows")]
+pub fn enable(app: &AppHandle) -> Result<(), String> {
+    use winreg::enums::{HKEY_CURRENT_USER, KEY_SET_VALUE, REG_BINARY};
+    use winreg::{RegKey, RegValue};
+
+    let executable = std::env::current_exe().map_err(|error| error.to_string())?;
+    let executable = executable
+        .to_str()
+        .ok_or("autostart executable path is not Unicode")?;
+    let command =
+        crate::windows_autostart_command::command(executable, crate::startup::AUTOSTART_FLAG)?;
+    let name = &app.package_info().name;
+    let hkcu = RegKey::predef(HKEY_CURRENT_USER);
+    hkcu.open_subkey_with_flags(
+        r"SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
+        KEY_SET_VALUE,
+    )
+    .and_then(|key| key.set_value(name, &command))
+    .map_err(|error| error.to_string())?;
+
+    // Match the plugin's explicit-enable behavior when Task Manager has an override.
+    if let Ok(key) = hkcu.open_subkey_with_flags(
+        r"SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run",
+        KEY_SET_VALUE,
+    ) {
+        key.set_raw_value(
+            name,
+            &RegValue {
+                vtype: REG_BINARY,
+                bytes: vec![2, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0],
+            },
+        )
+        .map_err(|error| error.to_string())?;
+    }
+    Ok(())
+}

desktop/src-tauri/src/tray.rs

@@ -208,7 +208,7 @@ pub fn install(app: &AppHandle) -> tauri::Result<()> {
                 if enabled {
                     let _ = app.autolaunch().disable();
                 } else {
-                    let _ = app.autolaunch().enable();
+                    let _ = crate::login_autostart::enable(app);
                 }
             }
             "stop-proxy" => {

desktop/src-tauri/src/windows_autostart_command.rs

@@ -0,0 +1,41 @@
+/// Build the Run value without letting spaces split the executable path.
+pub fn command(executable: &str, argument: &str) -> Result<String, &'static str> {
+    if executable.is_empty() || executable.contains(['"', '\0']) {
+        return Err("invalid executable path for Windows autostart");
+    }
+    Ok(format!("\"{executable}\" {argument}"))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::command;
+
+    #[test]
+    fn quotes_program_files_path_and_keeps_launch_origin() {
+        assert_eq!(
+            command(
+                r"C:\Program Files\OpenCodex\opencodex-desktop.exe",
+                "--autostart"
+            )
+            .unwrap(),
+            r#""C:\Program Files\OpenCodex\opencodex-desktop.exe" --autostart"#
+        );
+    }
+
+    #[test]
+    fn quotes_paths_without_spaces_and_preserves_unicode() {
+        for path in [r"C:\OpenCodex\app.exe", r"C:\用户\OpenCodex\app.exe"] {
+            assert_eq!(
+                command(path, "--autostart").unwrap(),
+                format!("\"{path}\" --autostart")
+            );
+        }
+    }
+
+    #[test]
+    fn rejects_paths_that_cannot_be_represented_in_a_run_command() {
+        for path in ["", "bad\"path.exe", "bad\0path.exe"] {
+            assert!(command(path, "--autostart").is_err());
+        }
+    }
+}

devlog/_plan/261003_train_recovery/000_plan.md

@@ -0,0 +1,97 @@
+# Recover the integration train and prepare the production candidate
+
+The previous integration stopped after combining 31 contributor changes and before
+integrating two completed issue implementations. Preserve those commits, review the
+combined behavior in five isolated worktree lanes, repair demonstrated defects, and
+land reviewed integration candidates on dev. The final platform run establishes
+production readiness; this unit does not publish a release.
+
+Reader: the integrating maintainer, deciding what can land and what remains unverified.
+
+## Scope and completion contract
+
+- Archetype: satisfy the recovered integration specification (C4 for sensitive surfaces).
+- Trigger: continuation of the interrupted train with five worktree chats and inherited subagents.
+- Goal: reviewed dev integration, attributable commits, final cross-platform evidence.
+- Non-goals: release/promotion/deployment/install, credential changes, unrelated backlog,
+  revival of policy-blocked items, native GitHub stack registration.
+- Verifier: diff/ancestry and attribution inspection; focused explicit regression files;
+  one final root/GUI typecheck as relevant; existing structure/layout/privacy gates;
+  required final PR checks and final dev workflow_dispatch CI lane=all.
+- Stop: only after the disposition ledger and exact-SHA CI evidence support readiness;
+  absent/skipped/cancelled checks stay unverified. External acceptance limits stay explicit.
+- Memory artifact: this numbered unit; private drafts and raw session evidence stay in scratch.
+- Outcomes: DONE with evidence, NOOP for proven already-landed items, or a named unresolved
+  blocker. No arbitrary time/token bound was supplied and none is invented.
+- Escalation: unresolved product policy, external access, or new out-of-scope authority.
+  The user authorized branch preparation, PR integration and coordinator merge judgment.
+- Resources: existing local git/gh identity, five lane tasks, bounded inherited subagents;
+  no full local suites, test:changed, prepush, dependency install or native builds.
+  CI dispatch only once the candidate is assembled; necessary failure repair remains in scope.
+
+## Dependency-ordered work phases
+
+1. Roadmap: lock source commits, lane ownership and verification/closure boundaries.
+2. Integration: consume existing patches, review/repair each lane, reconcile the union,
+   publish ready A-D first, then E, and land eligible work through the maintainer integration policy.
+3. Verification: run full cross-platform CI on final dev and prepare the readiness handoff.
+
+Detailed executable operations are in 010_integration.md and 020_verification.md.
+Architecture/source-of-truth remains structure/INDEX.md and its owned documents; each
+runtime repair must update its owner doc in the same change.
+
+## Baseline and exclusions
+
+Local train: da40c734a558ea32ce391613f5a0309d14cfce81. Remote dev observed:
+2e3acab46e (TokenLab #6474); Grok #6482 is also already landed. The existing train
+contains a historical #6474 carry; preserve history but introduce no duplicate content.
+
+Accepted source sets (recovered lane-a.md through lane-d.md packets): A #6474 #6463 #6445 #6470 #6417 #6254 #6382 #6416 #6461;
+B #6450 #6449 #6451 #6452 #6453 #6192 #6466;
+C #6459 #6479 #6119 #6455 #6477 #6457 #6460 #6415 #6335;
+D #6426 #6471 #6149 #6151 #6405 #6458.
+Issue implementations #6313 and #6223 are explicitly included.
+
+Deferred dispositions: #6378 #6143 #6472 #6370 #6076 #6301 #6381 #6436 #6336;
+#5253 is superseded by the selected locale contribution. Research-only #2511 #4961
+#4198 stay deferred for unresolved policy/access. Preserve existing rationale; do not
+mistake an effort estimate for a product rejection.
+
+Do not close #6220 without real launcher acceptance or #6473 without native Windows
+acceptance. Passing source tests alone is insufficient. Other issue closures require
+fresh acceptance review, not just a commit message.
+
+## Consultation and evidence
+
+Recovery explorer established the source scope and original cancellation; main checked
+the original user request and follow-up dispatch. Existing lane reports and logs are
+historical evidence, not current verification. The architect proposal, main decisions,
+reflection, independent audit and current lane manifest are recorded in scratch and
+summarized here when received. No private transcript is copied into public git.
+
+Architect consultation: REC-ARCH-01/04/06/07 accepted; REC-ARCH-02/03/05 amended
+to keep original A-D carry ownership and put both complete issue slices in E.
+REC-ARCH-08 amended to final dev dispatch after merge, preserving pre-merge PR CI.
+Same architect returned ALIGNED on the three documents; its two verification gaps
+were folded in: check returned headSha and require fresh comprehensive evidence after
+a repaired candidate changes SHA. Independent audit remains a separate gate.
+
+Roadmap audit: independent reviewer PASS, no blockers. Fresh reader understood the
+answer (preserve and review the recovered train), evidence (pinned git objects and
+workflow/policy contracts), and next action (bounded implementation handoff). No
+reader-structure repair remained. Document checker passed on numbered documents,
+source object existence/parentage, workflow inputs and diff whitespace.
+
+## Integration cycle entry
+
+Previous D: roadmap 995dee54a0 locked after semantic audit and document receipt.
+Direction remains to integrate five lane handoffs. The executable 010 design is
+unchanged. Fresh preflight confirms the contributor train is clean, original work
+remains preserved, and current dev is 2e3acab46e. Five lane tasks now own bounded
+implementation/verification, with production code changes limited to demonstrated
+defects and the two authorized issue implementations. Root/GUI dependency manifests
+and lockfiles match an available existing dependency tree; no install is required.
+
+User steering: land ready work progressively. A-D is ready for its PR now; E follows
+in a separate PR. Do not wait for E to publish or land A-D. Final manual lane=all
+remains after both landings.

devlog/_plan/261003_train_recovery/010_integration.md

@@ -0,0 +1,69 @@
+# Assemble and review the existing patches
+
+Depends on: roadmap closure. Existing production code is not recreated during roadmap.
+
+## Exact baseline delta
+
+In the coordinator checkout on codex/recover-train-261003, preserve current docs commit,
+then merge da40c734a558ea32ce391613f5a0309d14cfce81, then origin/dev after a fresh fetch.
+Inspect each conflict with both source hunks and the owning invariant; never concatenate
+JSON or prose mechanically. Preserve the two existing union fixes 2a3652c4da and
+da40c734a5. Exact inherited file deltas are the existing git objects, inspected with
+`git diff 762501439442fa00ec950802e9285f72af949167...da40c734a558ea32ce391613f5a0309d14cfce81`.
+No deletion or rewrite of original worktrees/branches is needed.
+
+Lane E adds the exact existing issue deltas from 8e2152fa30913955b6640b61b14f6bc522eb3301
+and 3fec4a4e312cefe7fe5e11f313e1b6bdefc66148, based on da40c734a5. Their authoritative
+before/after patches are `git show <sha>`. The first changes Claude model-force config,
+launch env, management routes, CLI, Subagents UI/tests/docs. The second changes RemoteLink
+UI, all locale catalogs, its focused tests, docs and structure/remote-link.md.
+These are modifications/new files exactly enumerated by `git diff-tree --no-commit-id
+--name-status -r <sha>`; no speculative implementation outside those deltas is prescribed.
+New defect repairs require a concrete lane plan with paths and activation evidence first.
+
+## Five lane ownerships
+
+- A: original A Responses/SSE/provider/header/log contracts and adjacent tests/docs.
+- B: original B account/credit/trust/buffer boundaries and negative tests/docs.
+- C: original C platform/CLI/service/shim/desktop zoom and adjacent tests/docs.
+- D: original D GUI/usage/compaction/client exports/locale and adjacent tests/docs.
+- E: #6313 and #6223 complete implementation, their tests and interface/doc updates.
+
+Each task starts from the same train snapshot in its own managed worktree and uses
+inherited subagents for bounded investigation/review. Preliminary dispatch is read-only.
+Only after the roadmap closes does the coordinator grant implementation. Each lane
+creates its own codex/recover-train-261003-<letter> branch and returns commits; no lane
+push/PR/merge/CI permission. Shared locale/layout/docs conflicts are coordinator-owned
+at integration time. E resolves conflicts between its two issue patches; main resolves
+conflicts between lanes. No concurrent writer touches the coordinator branch.
+
+## Activation and review acceptance
+
+A: forced-answer tool declarations, CR/LF framing, opt-in metadata/header behavior and
+ordinary-path stripping; no credential headers. B: default-off credit spending, scoped
+provider access, oversized catalog/image/stream bounds and trust rejection. C: quoting
+and stopped-port detection, nonblocking mirror reads, stable fnm launch, zoom persistence.
+D: rapid visibility toggles, weighted throughput, source-scoped compaction, editor override
+preservation and exhaustive locale coverage. E: unset force preserves launch behavior;
+set force reaches runtime/CLI/API/UI; invalid model rejected; RemoteLink failed/empty/retry,
+manual entry, keyboard access and fingerprint confirmation remain distinct and usable.
+
+Run only explicit focused test files in bounded sequential batches (GUI --isolate).
+New tests register both layout maps. Reuse available dependency trees without installing.
+Missing dependencies are missing evidence. Coordinate typechecks to avoid resource contention.
+Rendered UI evidence must be observed; keep screenshots off the PR branch and publish
+through the existing pr-assets mechanism if needed for the final PR description.
+
+## Final integration operation
+
+Inspect lane diffs and negative-path evidence, fix union conflicts and generated maps,
+check co-author trailers and docs ownership, record explicit security review. Preserve
+required CI and existing maintainer objections. User steering now requires rolling landing: publish the verified A-D candidate first,
+then E as a separate follow-up PR. Open each ready PR targeting dev with all template sections, accurate verification limits and
+GUI evidence. Attach it to this chat. Revalidate live actor, base, head, reviews, membership
+and check evidence before coordinator-authorized maintainer integration. Do not bypass
+failed required checks. Use an ordinary PR, not native stack operations.
+
+User delivery correction: do not hold verified A-D behind E. Required checks gate each
+PR; the full manual cross-platform run remains after the last dev landing. This changes
+delivery order, not scope or verification requirements.

devlog/_plan/261003_train_recovery/020_verification.md

@@ -0,0 +1,30 @@
+# Verify final dev and record production readiness
+
+Depends on: reviewed integration landing. No production code change is planned here;
+any failing behavior returns to a concrete repair plan and receives fresh evidence.
+
+1. Read .github/workflows/ci.yml at final dev, enumerate expected jobs and supported
+   workflow_dispatch inputs. Confirm the selected reference resolves to the landed SHA.
+2. Dispatch the existing Cross-platform CI with lane=all on dev, after all train changes
+   have landed. Preserve dispatch run ID/event/head SHA/attempt and every expected job.
+   Require the returned run headSha to equal the intended candidate. At completion,
+   verify dev still equals it or limit readiness explicitly to the tested SHA.
+3. Watch one aggregate observation at a time with intervals appropriate for hosted jobs;
+   avoid parallel polling by lanes. Pending, skipped, cancelled, approval-blocked and
+   failed have distinct recorded outcomes. Do not call a zero-failure empty set passing.
+4. Diagnose any failures from the actual job logs, distinguish baseline/environment from
+   changed-code failures, and repair authorized regressions through PRs. Rerun only the
+   failed/missing jobs only for the same SHA. A repair that changes the candidate needs
+   a fresh comprehensive run; do not combine passing jobs from different SHAs.
+5. Record final dev SHA, merged PR, original carry/issue dispositions, security review,
+   executed Linux/macOS/Windows coverage, GUI evidence and residual live/native limits.
+   No release, npm publish, main promotion, install, or deployment is part of this unit.
+
+MODIFY 000_plan.md: append evidence-backed terminal summary and remaining acceptance limits.
+NEW 090_outcome.md: concise reader handoff with exact commit/run links and deferred items.
+Move this unit to devlog/_fin only after a real terminal outcome is recorded. Public records
+contain shipped outcomes, never private vulnerability drafts or raw personal session data.
+
+Proposed CI command is subject to the workflow-source check before execution:
+`gh workflow run ci.yml -R lidge-jun/opencodex --ref dev -f lane=all`.
+This command has not run during roadmap and does not itself prove a job passed.