[WRONG BRANCH] release: promote frozen tip de411020ed to main as 2.99.0

AGENTS.md

@@ -113,10 +113,10 @@ different pointer, so every branch move and promotion dragged a diff.
   Reference *clones* are gitignored: they are third-party source carrying their
   own licenses and have no business in this repository's history.
 
-Nothing in the build, typecheck, or test path reads from `devlog/`, so a
-contributor who ignores it entirely still passes every gate. `privacy:scan` does
-read it — that is deliberate, and it is what makes a public devlog safe rather
-than merely visible.
+Build and typecheck do not read `devlog/`. The test-layout membership oracle reads
+`devlog/_fin/260905_test_modularization_and_windows/001_test_inventory.md`; sparse
+checkouts running that test must materialize this tracked input. `privacy:scan`
+also reads `devlog/` to keep public development notes safe to publish.
 
 Two mechanical guards in `tests/ci-workflows/repo-hygiene.test.ts` back this up: no `160000`
 gitlink may be tracked anywhere, and neither the vendored reference clones nor

bin/ocx.mjs

@@ -12,6 +12,7 @@ import { guardedRun, guardedSpawn, guardedSpawnSync, guardedExit, probeProcessAl
 import { probeSpawn, probeSpawnSync } from "../src/update/mutation-guard.mjs";
 import { createSupervisionLatch, inspectDesktopSupervision } from "../src/service/desktop-supervision.mjs";
 import { planDesktopCliHandoff, runDesktopCliHandoff } from "../src/lib/desktop-cli-handoff.mjs";
+import { forwardLauncherSignals } from "../src/lib/launcher-signal-forwarding.mjs";
 import { acquireSyncGuard } from "../src/update/sync-update-mutex.mjs";
 import { desktopCliRecordPath } from "../src/lib/desktop-cli-record.mjs";
 import { STOP_HISTORY_INCOMPLETE_EXIT_CODE } from "../src/update/stop-contract.mjs";
@@ -1608,6 +1609,8 @@ function createNodeLaunchContext() {
   return { launchProof, launchContext, inheritedEnv };
 }
 
+// Forwarders precede the spawn so no signal can kill this launcher by default action while the child runs.
+const forwarding = forwardLauncherSignals();
 const child = probeSpawn(bun, [cliPath, `${NODE_LAUNCH_PROOF_PREFIX}${launchProof}`, ...process.argv.slice(2).filter(arg => !arg.startsWith(NODE_LAUNCH_PROOF_PREFIX))], {
   stdio: "inherit",
   // A headless Windows parent (Task Scheduler, dashboard restart, shortcut) has no
@@ -1622,6 +1625,7 @@ const child = probeSpawn(bun, [cliPath, `${NODE_LAUNCH_PROOF_PREFIX}${launchProo
     [BUN_RUNTIME_PATH_ENV]: bunRuntime.path,
   },
 });
+forwarding.attach(child);
 let delegateError = false;
 if (child.pid) {
   try { addSyncDelegate(child.pid); }
@@ -1632,31 +1636,14 @@ if (child.pid) {
   }
 }
 
-// Windows has no real POSIX signals (no SIGHUP); forwarding is best-effort there.
-const FORWARDED = process.platform === "win32" ? ["SIGINT", "SIGTERM"] : ["SIGINT", "SIGTERM", "SIGHUP"];
-const handlers = FORWARDED.map(sig => {
-  const handler = () => {
-    try {
-      child.kill(sig);
-    } catch {
-      /* child already exited */
-    }
-  };
-  process.on(sig, handler);
-  return [sig, handler];
-});
-const clearHandlers = () => {
-  for (const [sig, handler] of handlers) process.removeListener(sig, handler);
-};
-
 child.on("error", err => {
-  clearHandlers();
+  forwarding.clear();
   console.error(`opencodex: failed to launch Bun runtime: ${err.message}`);
   process.exit(1);
 });
 
 child.on("exit", (code, signal) => {
-  clearHandlers();
+  forwarding.clear();
   releaseSyncLease();
   if (delegateError) process.exit(1);
   // Mirror the child's terminating signal/exit code so this launcher's status matches.

desktop/src-tauri/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "opencodex-desktop"
-version = "2.98.0"
+version = "2.99.0"
 description = "OpenCodex desktop shell"
 authors = ["OpenCodex contributors"]
 license = "MIT"

desktop/src-tauri/src/lib.rs

@@ -56,6 +56,8 @@ mod runtime_stop;
 mod sidecar;
 mod startup;
 mod supervisor;
+#[cfg_attr(not(target_os = "macos"), allow(dead_code))]
+mod traffic_lights;
 mod tray;
 mod tray_availability;
 mod updater;
@@ -405,14 +407,16 @@ pub fn run() {
             // zoom the window through `plugin:window` commands granted by
             // `capabilities/dashboard-titlebar.json`. Windows and Linux keep the native title
             // bar — the shell ships no min/max/close widgets of its own — while the sidebar-top
-            // layout applies unchanged.
+            // layout applies unchanged. The vertical inset depends on the macOS release, whose
+            // button metrics changed in 26 (`traffic_lights.rs`).
             #[cfg(target_os = "macos")]
             let builder = builder
                 .title_bar_style(tauri::TitleBarStyle::Overlay)
                 .hidden_title(true)
                 .min_inner_size(360.0, 320.0)
                 .traffic_light_position(tauri::Position::Logical(tauri::LogicalPosition::new(
-                    18.0, 22.0,
+                    traffic_lights::X,
+                    traffic_lights::y_for(traffic_lights::macos_major()),
                 )));
             let window = builder.build()?;
             window::configure(&window);

desktop/src-tauri/src/native_tray_accounts.rs

@@ -151,7 +151,7 @@ fn windows(quota: &Value, plan: &str) -> Vec<Value> {
 }
 
 pub fn provider(source: &Source, body: Option<&Value>, unavailable: bool) -> Value {
-    let parsed = body.and_then(parse_accounts);
+    let parsed = body.and_then(|body| parse_accounts(body, source.switch));
     let malformed = body.is_some() && parsed.is_none();
     let accounts = parsed.unwrap_or_default();
     let mut row = json!({"id":source.name,"label":source.label,
@@ -165,7 +165,7 @@ pub fn provider(source: &Source, body: Option<&Value>, unavailable: bool) -> Val
     row
 }
 
-fn parse_accounts(body: &Value) -> Option<Vec<Value>> {
+fn parse_accounts(body: &Value, kind: Option<AccountSwitchKind>) -> Option<Vec<Value>> {
     let rows = body
         .get("accounts")
         .or_else(|| body.get("keys"))?
@@ -175,9 +175,16 @@ fn parse_accounts(body: &Value) -> Option<Vec<Value>> {
         .find_map(|key| body[key].as_str());
     rows.iter().enumerate().map(|(index,row)| {
         let id = row["id"].as_str()?;
-        let email = row["email"].as_str().map(mask_email);
-        let label = [row["alias"].as_str(),row["label"].as_str(),email.as_deref(),row["logLabel"].as_str(),Some(id)]
-            .into_iter().flatten().find(|v| !v.is_empty()).unwrap_or(id);
+        let oauth = kind == Some(AccountSwitchKind::OAuth);
+        let email = if oauth { None } else { row["email"].as_str().map(mask_email) };
+        let label = if oauth {
+            [row["alias"].as_str(), row["maskedLabel"].as_str()]
+                .into_iter().flatten().map(str::trim).find(|v| !v.is_empty())
+                .map(str::to_owned).unwrap_or_else(|| format!("Account {}", index + 1))
+        } else {
+            [row["alias"].as_str(),row["label"].as_str(),email.as_deref(),row["logLabel"].as_str(),Some(id)]
+                .into_iter().flatten().find(|v| !v.is_empty()).unwrap_or(id).to_owned()
+        };
         let unavailable = row["quotaUnavailable"].as_bool()==Some(true)
             || text(row,"quotaMode")=="unsupported" || !row["quota"].is_object();
         let is_active = active.map_or(row["active"].as_bool()==Some(true),|selected|selected==id);
@@ -230,6 +237,66 @@ fn exhausted(quota: &Value, plan: &str) -> bool {
 #[cfg(test)]
 mod tests {
     use super::*;
+    fn parse_accounts(body: &Value) -> Option<Vec<Value>> {
+        super::parse_accounts(body, None)
+    }
+
+    fn oauth_accounts(body: Value) -> Vec<Value> {
+        let source = Source {
+            name: "example".into(),
+            label: "Example".into(),
+            path: None,
+            switch: Some(AccountSwitchKind::OAuth),
+        };
+        provider(&source, Some(&body), false)["accounts"]
+            .as_array()
+            .unwrap()
+            .clone()
+    }
+
+    #[test]
+    fn oauth_alias_is_trimmed_and_does_not_expose_legacy_email() {
+        let rows = oauth_accounts(json!({"accounts":[{"id":"private-id","alias":"  Work  ",
+            "maskedLabel":"m•••@e•••.com","email":"person@example.com"}]}));
+        assert_eq!(rows[0]["label"], "Work");
+        assert!(rows[0]["email"].is_null());
+        assert_eq!(rows[0]["accountId"], "private-id");
+        assert_eq!(rows[0]["id"], "private-id:0");
+    }
+
+    #[test]
+    fn oauth_masked_label_follows_blank_alias() {
+        let rows = oauth_accounts(json!({"accounts":[{"id":"private-id","alias":"   ",
+            "maskedLabel":"  m•••@e•••.com  ","label":"legacy","email":"person@example.com"}]}));
+        assert_eq!(rows[0]["label"], "m•••@e•••.com");
+        assert!(rows[0]["email"].is_null());
+    }
+
+    #[test]
+    fn oauth_legacy_payload_uses_ordinal_instead_of_identifiers() {
+        let rows = oauth_accounts(json!({"accounts":[
+            {"id":"private-id","email":"person@example.com","label":"legacy", "logLabel":"legacy-log"},
+            {"id":"another-private-id","alias":" ","maskedLabel":" "}]}));
+        assert_eq!(rows[0]["label"], "Account 1");
+        assert_eq!(rows[1]["label"], "Account 2");
+        assert!(rows[0]["email"].is_null());
+        assert!(rows[1]["email"].is_null());
+        assert_eq!(rows[0]["accountId"], "private-id");
+        assert_eq!(rows[1]["accountId"], "another-private-id");
+    }
+
+    #[test]
+    fn codex_and_api_key_labels_keep_the_existing_projection() {
+        let body = json!({"accounts":[{"id":"id","label":"Legacy label",
+            "maskedLabel":"ignored","email":"person@example.com"}]});
+        for kind in [AccountSwitchKind::Codex, AccountSwitchKind::ApiKey] {
+            let rows = super::parse_accounts(&body, Some(kind)).unwrap();
+            assert_eq!(rows[0]["label"], "Legacy label");
+            assert_eq!(rows[0]["email"], "p•••@e•••.com");
+            assert_eq!(rows[0]["accountId"], "id");
+        }
+    }
+
     #[test]
     fn source_routes_are_encoded_and_never_forward_credentials() {
         let rows = sources(&json!({"providers":{

desktop/src-tauri/src/traffic_lights.rs

@@ -0,0 +1,126 @@
+//! Where the macOS traffic lights sit over the overlay title bar.
+//!
+//! The dashboard's sidebar strip (`gui/src/components/app-titlebar.css`) is a 40pt row with an
+//! 80pt lead inset, and the native lights have to sit centered on that row. tao places them by
+//! resizing the title-bar container to `close button height + y` and moving each button to
+//! `x + i * spacing`; the button keeps its own offset inside the container. So the same `y`
+//! lands differently when AppKit's button metrics change, and they did change in macOS 26:
+//!
+//! | design          | close button | spacing | y=22 centers at | y centering on 20 |
+//! |-----------------|--------------|---------|-----------------|-------------------|
+//! | macOS 26 Tahoe  | 14 x 14      | 23      | 20              | 22                |
+//! | macOS 15 and up | 14 x 16      | 20      | 24 (4pt low)    | 18                |
+//!
+//! Both rows were measured with an AppKit probe that replays tao 0.37.2's
+//! `inset_traffic_lights` on an overlay window: once with the Tahoe design and once with the
+//! pre-Tahoe design forced through `UIDesignRequiresCompatibility` (#8280). Horizontally both
+//! designs start at x and end inside the strip's 80pt inset (Tahoe at 78pt, pre-Tahoe at 72pt),
+//! so only `y` depends on the OS.
+
+/// Lead inset of the close button, in points. `--tl-inset` in app-titlebar.css is this plus
+/// 52pt of lights and 10pt of air.
+pub const X: f64 = 18.0;
+/// macOS 26 (Tahoe) and later: 14pt-tall buttons centered on the 40pt row.
+pub const Y_TAHOE: f64 = 22.0;
+/// macOS 15 (Sequoia) and earlier: 16pt-tall buttons need 4pt less to land on the same line.
+pub const Y_PRE_TAHOE: f64 = 18.0;
+/// The first release with the taller title bar metrics. Apple went from 15 straight to 26.
+const TAHOE_MAJOR: u32 = 26;
+
+/// The `y` for a given macOS major version. An unknown version keeps the Tahoe value, which is
+/// what every build shipped before this distinction existed.
+pub fn y_for(macos_major: Option<u32>) -> f64 {
+    match macos_major {
+        Some(major) if major < TAHOE_MAJOR => Y_PRE_TAHOE,
+        _ => Y_TAHOE,
+    }
+}
+
+/// The major component of a product version such as `15.7.1` or `26.0`.
+fn parse_major(version: &str) -> Option<u32> {
+    version.trim().split('.').next()?.parse().ok()
+}
+
+/// The running macOS major version, from `kern.osproductversion`. Unlike the
+/// `SystemVersion.plist` reads behind some version APIs, this sysctl is not redirected by
+/// `SYSTEM_VERSION_COMPAT`, so it reports the real release.
+#[cfg(target_os = "macos")]
+pub fn macos_major() -> Option<u32> {
+    use std::ffi::{c_char, c_int, c_void, CStr};
+    extern "C" {
+        fn sysctlbyname(
+            name: *const c_char,
+            oldp: *mut c_void,
+            oldlenp: *mut usize,
+            newp: *mut c_void,
+            newlen: usize,
+        ) -> c_int;
+    }
+    let mut buffer = [0u8; 32];
+    let mut len = buffer.len();
+    // SAFETY: the name is NUL-terminated, `buffer` is writable for `len` bytes, and no new
+    // value is set.
+    let status = unsafe {
+        sysctlbyname(
+            c"kern.osproductversion".as_ptr(),
+            buffer.as_mut_ptr().cast(),
+            &mut len,
+            std::ptr::null_mut(),
+            0,
+        )
+    };
+    if status != 0 {
+        return None;
+    }
+    let version = CStr::from_bytes_until_nul(&buffer[..len.min(buffer.len())]).ok()?;
+    parse_major(version.to_str().ok()?)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{parse_major, y_for, X, Y_PRE_TAHOE, Y_TAHOE};
+
+    #[test]
+    fn product_versions_parse_to_their_major() {
+        assert_eq!(parse_major("26.6.2"), Some(26));
+        assert_eq!(parse_major("15.7.1"), Some(15));
+        assert_eq!(parse_major("14.0"), Some(14));
+        assert_eq!(parse_major("10.16"), Some(10));
+        assert_eq!(parse_major(" 13 "), Some(13));
+        assert_eq!(parse_major(""), None);
+        assert_eq!(parse_major("abc"), None);
+    }
+
+    #[test]
+    fn sequoia_and_earlier_lift_the_lights_onto_the_strip() {
+        for major in [10, 11, 12, 13, 14, 15] {
+            assert_eq!(y_for(Some(major)), Y_PRE_TAHOE, "macOS {major}");
+        }
+        for major in [26, 27, 30] {
+            assert_eq!(y_for(Some(major)), Y_TAHOE, "macOS {major}");
+        }
+        assert_eq!(y_for(None), Y_TAHOE);
+    }
+
+    /// The measured geometry behind the constants: tao sets the container to
+    /// `button_height + y`, AppKit keeps the button's default offset from the container's bottom
+    /// edge, and the light should be centered on the 40pt strip row.
+    #[test]
+    fn both_designs_center_on_the_strip_row() {
+        // Center of the light, measured from the window's top edge.
+        let center = |height: f64, bottom: f64, y: f64| (height + y) - bottom - height / 2.0;
+        // Tahoe: a 14pt button whose default frame origin is (9, 9).
+        assert_eq!(center(14.0, 9.0, Y_TAHOE), 20.0);
+        // Pre-Tahoe: a 16pt button whose default frame origin is (7, 6).
+        assert_eq!(center(16.0, 6.0, Y_PRE_TAHOE), 20.0);
+        assert_eq!(center(16.0, 6.0, Y_TAHOE), 24.0);
+        assert_eq!(X, 18.0);
+    }
+
+    #[cfg(target_os = "macos")]
+    #[test]
+    fn the_running_macos_reports_a_major_version() {
+        let major = super::macos_major().expect("kern.osproductversion");
+        assert!(major >= 10, "{major}");
+    }
+}

desktop/src-tauri/tauri.conf.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://schema.tauri.app/config/2",
   "productName": "OpenCodex",
-  "version": "2.98.0",
+  "version": "2.99.0",
   "identifier": "com.opencodex.desktop",
   "build": {
     "frontendDist": "../ui",