fix(win): adapt desktop-host discovery to the Codex → ChatGPT app merge

CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## Unreleased
+
+- **Critical** — adapted the Windows desktop-host discovery for the Codex → ChatGPT app merge (2026-07-09; the Windows counterpart of the macOS adaptation shipped in 1.6.0). The merged host runs as `ChatGPT.exe` (MSIX package family still `OpenAI.Codex_2p2nqsd0c76g0`, non-Store installs under `%LOCALAPPDATA%\Programs\ChatGPT\`), so the old `Codex.exe`-only checks missed the running UI: switching skipped quitting the host (stale in-memory app-server on the old account) and never relaunched it. is-running / quit now enumerate both host names and classify each PID by its executable's install identity — the `OpenAI.Codex*` package family (incl. the beta channel) or a non-Store install that embeds the bundled CLI (`resources\codex.exe`, the Windows analog of the macOS `Contents/Resources/codex` qualifier) counts as ours; ChatGPT Classic (`OpenAI.ChatGPT-Desktop_…`, same `ChatGPT.exe` name) is positively excluded and never killed; unattributable PIDs still count as running (the switch aborts rather than proceeding over a possibly-live host) but are never signalled. Quit signals by PID (graceful `taskkill /PID` then `/F`) instead of `/IM <name>`. Launch prefers the detected Store package (unchanged `shell:AppsFolder` id), falling back to a qualified non-Store `ChatGPT.exe` / `Codex.exe`. CLI discovery and the Settings auto-detect suggestions gain the desktop-bundled CLI locations (MSIX `<InstallLocation>\app\resources\codex.exe` and the non-Store `Programs\{ChatGPT,Codex}\resources\codex.exe`). Facts anchored from public manifests and tooling (winget, KAPE, third-party Codex tools); not yet verified on a live Windows install.
+
 ## 1.6.0 - 2026-07-11
 
 - **Critical** — fixed the quota backfill reverting fresh data and bleeding across accounts. The root `~/.codex/profile.json` copy was only ever written at switch-in, so every write-back (switch, app launch, window close) copied that frozen snapshot over the profile's card and silently reverted the quota / plan updates recorded while it was active — permanently for API-key profiles, which no API refresh repairs; Windows had patched the switch path only (keyed off the possibly-stale `.current_profile` marker) and macOS had nothing. The write-back now folds the freshest live-session usage into the identity-verified target's card and refreshes the root copy first, on both platforms and on all four write-back paths (switch, app launch, window close, current-profile login); the legacy `codex-switch.sh` no longer copies the root `profile.json` back at all, closing its variant of the same clobber. Live-session data is scoped to entries written since the profile's activation (`activated_at` from the active marker): `~/.codex/sessions` is not swapped on switch, so the previously-live account's newer entries used to win the freshness race and show up as the current profile's quota for minutes after a switch — and when a profile has no parseable activation marker (an identity-drift target, a hand-edited marker) the fold is skipped outright rather than attributing unattributable sessions. A present-but-unreadable `profile.json` now aborts the write-back loudly instead of laundering a transient read failure into a blanked card. The duplicated Windows display path (which had already drifted: it lacked the unmanaged-account guard) now re-exports the shared implementation; an empty stored card with a newer timestamp (the deliberate downgrade-to-free clear) is no longer overridden by older live sessions; and switching kicks an immediate silent API refresh for the new card instead of priming its stored timestamp and waiting out the 5-minute tick. Known residual: a codex CLI session started under the previous account that keeps running across the switch keeps appending to a session file whose mtime passes the activation cutoff, so its usage can still be misattributed until that session exits.