fix(proxy): recover lifecycle and retire the legacy dashboard

[DingDingChae]

Summary

This is the integrated repair for the “started but offline” lifecycle regression, automatic fallback ports, manual remote dashboard connection, and complete retirement of the legacy dashboard.

The change is intentionally broad: the current dev line did not contain the previously released startup repair lineage or the current Material 3 shell. Porting only one call site would leave service ownership, health correlation, packaging identity, remote authentication, and stale GUI delivery inconsistent.

Rolling investigation and milestone evidence: Discussion #7.

What changed

• Make explicit restart bypass the autostart preference while preserving an installed service manager when it owns the proxy.
• Separate safe-to-restart lifecycle state from cleanup warnings; fail closed on uncertain manager/PID/scheduler ownership.
• Require stable PID/port/hostname-correlated health before reporting direct or service startup success.
• Treat configured ports as preferences for automatic launchers; retain strict pins only for explicit/update/current-dashboard contracts.
• Add a crash-safe cross-process startup lock and collision re-probe so simultaneous starts cannot create two fallback daemons.
• Replace the legacy dashboard tree with the current Material 3 shell and package identity gate.
• Add manual remote IPv4/IPv6/hostname + port navigation without credentials in URLs or storage.
• Retain same-origin in-memory management auth and add real backend/CLI parity for changelog, export, host, launch, terminal, pairing, logs, and state history.
• Harden secret redaction, pairing bounds, local-machine actions, export handling, CSP/static asset ownership, debug sandbox behavior, and update version resolution.
• Synchronize English, Japanese, Korean, Russian, and Simplified Chinese lifecycle/remote/security documentation.

Security review required

Important

This PR changes authentication, credential handling, local process launch/install boundaries, package/update behavior, CSP/static serving, pairing, export redaction, and dependency-backed GUI packaging. It requires explicit maintainer security review before merge.

Review focus:

• Management auth remains mandatory; only bounded POST /api/host/pair/claim is unauthenticated.
• Remote dashboard URLs contain no token; local admin state is never sent cross-origin.
• Direct HTTP remote access is documented for trusted LAN only; SSH forwarding is preferred elsewhere.
• Launch/install/VS Code actions fail closed unless the live listener is known loopback.
• Dataset exports contain no key-derived substring or raw MCP argument/URL/env/header credential carrier.
• Encrypted 7z is disabled until a protected non-argv password channel exists.
• Updater version lookup failure/malformed output exits before service, tray, proxy, or package mutation.

Verification

Gate	Result
Full root suite	6,180 passed · 3 platform skips · 0 failed · 31,794 assertions · 453 files
Full GUI suite	898 passed · 0 failed · 10,340 assertions · 135 files
GUI lint / i18n lint / TypeScript / production build	passed
Docs build	146 pages
Root typecheck	passed
Privacy scan after staging every new file	passed
Cached diff check	passed

Real distributable smoke

• Final commit-identical npm pack: 466 files, SHA-256 5c9740a0e1ee92585a488548cb4115506444ebe6ef2c613080b7e2feeb78cfc6.
• M3 manifest: package 2.7.41, source hash sha256:71f63d1de518623462c0f4c23d73edb154c8782b44503379008400fe241234c6.
• Stable foreign service occupied configured 54749; automatic ensure started on 54889 and left the foreign PID alive.
• ocx host status --json had already been verified against the live fallback in the preceding package smoke; configured preference remained unchanged.
• With autostart disabled, explicit restart replaced the exact-commit proxy on 54897.
• Portable update stayed inert and preserved the proxy PID.
• Stop removed only the OpenCodex PID/runtime/listener; the foreign service remained alive.

Visible baseline

This is the genuine old bundle from the affected installation:

A genuine post-repair capture is still pending because the mandated cheap headless capture provider is unavailable in the current agent session. No substitute browser or mock is being presented as proof.

Go transition

This is not a GUI-only exception. The lifecycle, management API, liveness, service, CLI, and security contracts need a dev2-go counterpart. A needs-go-port tracking issue will name the merged dev source commit if the native port cannot land in the same merge session.

Review checklist

• Target is dev.
• Focused lifecycle, auth, export, CLI, updater, and GUI regressions added.
• Full local root/GUI/docs gates passed.
• Public docs and translated lifecycle/remote/security statements synchronized.
• Explicit maintainer security review.
• Required remote CI green.
• dev2-go port landed or a needs-go-port issue records the exact merged source commit.

[DingDingChae]

🔐 Maintainer review request / 維護者審核請求

Important

MAINTAINERS.md requires at least one maintainer approval and explicit security review for this change. I will not self-approve or merge around that rule.

GitHub rejected formal review requests for @Ingwannu, @Wibias, and @lidge-jun with HTTP 422: “Reviews may only be requested from collaborators.” The repository permission endpoint currently reports each listed maintainer at read, while the pull-request review-request endpoint does not recognize them as eligible collaborators.

Current gate	State
Local full root/GUI/docs verification	✅ Passed
Remote CI	⏳ Running
Explicit maintainer security review	⛔ Awaiting an eligible maintainer/repository permission correction
Self-approval or policy bypass	🚫 Will not be used

請列於 MAINTAINERS.md 的維護者在權限容許後進行正式 security review。現時 GitHub 拒絕 review request，我會如實保留此 blocker，唔會自行批核或繞過合併規則。

[MatDayProjects]

🧪 CI-gate correction pushed

Commit e9344f72 scopes the React Doctor pull-request trigger to gui/**.

The previous run 31276738715 had no GUI files in its change set, but the action's empty-file fallback performed an unrelated GUI scan and exited with SCAN_STATUS=1. The full-tree scan remains enabled for pushes to main.

Local verification: bun test --isolate tests/ci-workflows.test.ts — 64 tests, 662 assertions; git diff --check passed.

The new React Doctor run 31278350443 and the cross-platform run 31278350304 are still running. This comment does not claim green CI or security approval.

[MatDayProjects]

❌ React Doctor verification — 2026-08-08T17:15:00-04:00\n\nRun 31278350443 completed failure at commit �9344f72: the action finished with SCAN_STATUS=1 against the PR's genuinely GUI-heavy diff. The job log exposes no React Doctor finding text—only the failing exit and the Node 20 deprecation annotation—so I am not inventing a diagnosis from an opaque report. The workflow path filter is present and the action did receive directory: gui, scope: changed, and base c0ad57a; this remains a red required check until the findings are inspectable and addressed or a maintainer accepts a scoped policy change.\n\nLocal �un test --isolate tests/ci-workflows.test.ts remains green (64 tests, 662 assertions). The cross-platform run 31278350304 is still running. No merge or security-review claim is made.\n\nCantonese: React Doctor 個結果真係紅咗，但工作紀錄冇列出實際發現，只見 SCAN_STATUS=1；我唔會靠估亂修，等可以睇到報告先處理。

[MatDayProjects]

🧱 Maintainer and security review still required

main is verified at f80d001a, but this pull request targets dev and changes authentication, process lifecycle, packaging, CSP, pairing, export, and release behavior. MAINTAINERS.md requires explicit security review and at least one maintainer approval; the current pull request has no approval and no accepted reviewer assignment. I will not self-approve or merge it into main while that gate is missing.

The codex/fix-proxy-offline checkout and pull request remain preserved so the reviewed work is recoverable. The open tracking path is unchanged until a maintainer supplies the required review and target-line decision.

🧱 仍需維護者及安全審核

main 已在 f80d001a 驗證，但此 PR 目標是 dev，並涉及認證、程序生命週期、打包、CSP、配對、匯出及發布流程。依 MAINTAINERS.md，必須有明確安全審核及至少一名維護者批准；目前沒有批准或可接受的審核人，因此不會自行批准，也不會在缺少審核時合併到 main。

[MatDayProjects]

Fresh merge preflight — 2026-08-08T23:00:35-04:00

main is verified at commit f80d001 (f80d001), and the current Windows CI, React Doctor, artifact, and release runs are green. A fresh git merge-tree --write-tree origin/main 225c2cc reports 74 conflicts across runtime, docs, GUI, and tests, including content, add/add, and modify/delete cases.

This PR targets dev and changes authentication, process lifecycle, packaging, CSP, pairing, export, and release behavior. MAINTAINERS.md requires explicit security review and at least one maintainer approval. No accepted approval is present, so I am preserving the branch and not resolving by choosing one side or merging without that review.

廣東話：main 而家係綠燈，但呢個 PR 同 main 有 74 個真衝突，仲涉及安全同發布路徑；未有正式 maintainer security review 同批准，我唔會亂揀一邊硬合併。