@bitkyc08/opencodex 2.7.26 → 2.7.27

package/src/service.ts

@@ -16,12 +16,15 @@ import { isWslRuntime } from "./codex/home";
 import { durableBunPath, durableBunRuntime } from "./lib/bun-runtime";
 import { isProcessAlive, stopProxy } from "./lib/process-control";
 import { serviceApiTokenFilePath } from "./lib/service-secrets";
+import { defaultWinswEntry, installWinswService, startWinswService, stopWinswService, statusWinswRaw, uninstallWinswService, winswStatusSummary, WINSW_SERVICE_ID, WINSW_SHA256, WINSW_VERSION } from "./lib/winsw";
 import { hardenSecretDir, hardenSecretPath } from "./lib/windows-secret-acl";
 import { windowsEnvIndirectBatchPathList, windowsEnvIndirectBatchValue } from "./lib/win-paths";
 
 const LABEL = "com.opencodex.proxy";
 const TASK = "opencodex-proxy";
 
+export type ServiceBackend = "scheduler" | "native";
+
 function cliEntry(): { bun: string; cli: string } {
   // Bake the bundled Bun (npm global prefix, survives `ocx update`) rather than
   // a transient system Bun, so launchd/systemd/schtasks keep resolving even if a
@@ -45,6 +48,10 @@ function windowsServiceScriptPath(): string {
   return join(getConfigDir(), "opencodex-service.cmd");
 }
 
+function windowsLauncherVbsPath(): string {
+  return join(getConfigDir(), "opencodex-service-launcher.vbs");
+}
+
 function windowsTaskXmlPath(): string {
   return join(getConfigDir(), "opencodex-service-task.xml");
 }
@@ -82,22 +89,28 @@ function normalizePathForCompare(path: string): string {
 }
 
 interface ServiceInstallState {
-  version: 1;
+  version: 1 | 2;
   codexHome: string;
   opencodexHome: string;
   /** Baked at install; lets status flag paths gone stale after npm prefix/nvm moves. */
   bunPath?: string;
   cliPath?: string;
+  /** v2: which Windows backend was chosen at install; absent (v1/legacy) means scheduler. */
+  backend?: ServiceBackend;
+  winswVersion?: string;
+  winswSha256?: string;
 }
 
-function writeServiceInstallState(): void {
+function writeServiceInstallState(backend: ServiceBackend = "scheduler"): void {
   const { bun, cli } = cliEntry();
   const state: ServiceInstallState = {
-    version: 1,
+    version: 2,
     codexHome: currentCodexHome(),
     opencodexHome: currentOpenCodexHome(),
     bunPath: bun,
     cliPath: cli,
+    backend,
+    ...(backend === "native" ? { winswVersion: WINSW_VERSION, winswSha256: WINSW_SHA256 } : {}),
   };
   for (const path of serviceStatePaths()) {
     const dir = dirname(path);
@@ -112,7 +125,7 @@ function readServiceInstallState(): ServiceInstallState | null {
   for (const path of serviceStatePaths()) {
     try {
       const parsed = JSON.parse(readFileSync(path, "utf8")) as ServiceInstallState;
-      if (parsed.version === 1) return parsed;
+      if (parsed.version === 1 || parsed.version === 2) return parsed;
     } catch {
       /* try the next known state path */
     }
@@ -120,6 +133,16 @@ function readServiceInstallState(): ServiceInstallState | null {
   return null;
 }
 
+/** Single accessor for update/reinstall code — v1/legacy state maps to scheduler. */
+export function readServiceBackend(): ServiceBackend {
+  return readServiceInstallState()?.backend === "native" ? "native" : "scheduler";
+}
+
+/** The `ocx` argv that reinstalls the currently-chosen service backend (update paths). */
+export function serviceReinstallArgs(): string[] {
+  return readServiceBackend() === "native" ? ["service", "install", "--native"] : ["service", "install"];
+}
+
 export function assertServiceEnvironmentMatchesInstall(): void {
   const state = readServiceInstallState();
   if (!state) return;
@@ -256,6 +279,11 @@ function windowsSchtasks(): string {
   return existsSync(candidate) ? candidate : "schtasks.exe";
 }
 
+function windowsWscript(): string {
+  const candidate = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "wscript.exe");
+  return existsSync(candidate) ? candidate : "wscript.exe";
+}
+
 function schtasks(args: string[]): string {
   return runFile(windowsSchtasks(), args);
 }
@@ -295,8 +323,8 @@ export function buildWindowsServiceScript(entry = cliEntry()): string {
   const lines = [
     "@echo off",
     "setlocal",
-    // The wrapper runs in its own hidden console, so switching that console to UTF-8 is
-    // safe (no leak into user shells) and lets cmd parse any UTF-8 remnants correctly.
+    // The wrapper console is hidden by the wscript launcher (window style 0), so switching
+    // it to UTF-8 is safe (no leak into user shells) and lets cmd parse UTF-8 remnants.
     "chcp 65001 >nul",
     windowsBatchSet("OCX_SERVICE", "1"),
     windowsBatchSet("PATH", path, "pathList"),
@@ -335,8 +363,31 @@ export function buildWindowsSchtasksCreateArgs(script = windowsServiceScriptPath
   return ["/create", "/tn", TASK, "/xml", xml, "/f"];
 }
 
-export function buildWindowsTaskXml(script = windowsServiceScriptPath()): string {
-  const escapedScript = taskXmlString(script);
+/**
+ * VBS launcher that starts the batch wrapper with a hidden window (style 0).
+ * bWaitOnReturn=True keeps wscript.exe resident for the wrapper's lifetime so the
+ * scheduled task stays "running": MultipleInstancesPolicy=IgnoreNew keeps preventing
+ * duplicates and `schtasks /end` still has a live task instance to stop. Without the
+ * launcher, the console batch action shows a closable cmd window in the interactive
+ * session (issue #165). VBS string literals escape `"` as `""`.
+ */
+export function buildWindowsLauncherVbs(script = windowsServiceScriptPath()): string {
+  const escaped = script.replace(/"/g, '""');
+  const lines = [
+    "' OpenCodex service launcher — runs the batch wrapper with a hidden window.",
+    "' Generated by `ocx service install`; do not edit.",
+    'Set shell = CreateObject("WScript.Shell")',
+    // WshShell.Run(command, windowStyle 0 = hidden, bWaitOnReturn True = stay resident).
+    `shell.Run """${escaped}""", 0, True`,
+  ];
+  return `${lines.join("\r\n")}\r\n`;
+}
+
+export function buildWindowsTaskXml(script = windowsServiceScriptPath(), launcher = windowsLauncherVbsPath()): string {
+  const escapedWscript = taskXmlString(windowsWscript());
+  // Escape the launcher path independently for the <Arguments> element; quoting it
+  // keeps spaces intact, and /b (batch mode) suppresses script error popups.
+  const escapedLauncherArgs = taskXmlString(`/b /nologo "${launcher}"`);
   return `<?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
@@ -372,7 +423,8 @@ export function buildWindowsTaskXml(script = windowsServiceScriptPath()): string
   </Settings>
   <Actions Context="Author">
     <Exec>
-      <Command>${escapedScript}</Command>
+      <Command>${escapedWscript}</Command>
+      <Arguments>${escapedLauncherArgs}</Arguments>
     </Exec>
   </Actions>
 </Task>
@@ -421,15 +473,70 @@ function writeServiceAssetWithRetry(path: string, content: string, encoding: "ut
 function installWindows(): void {
   if (!existsSync(getConfigDir())) mkdirSync(getConfigDir(), { recursive: true });
   writeServiceApiTokenFile();
+  // Transactional backend switch: installing the scheduler backend removes a native
+  // service first — two live managers would both respawn the proxy (conflict).
+  if (statusWinswRaw() !== "nonexistent") {
+    console.log("🔁 Removing the native (WinSW) service before installing the Task Scheduler backend...");
+    try {
+      uninstallWinswService();
+    } catch (err) {
+      throw new Error(`Cannot remove the native service before switching to Task Scheduler: ${err instanceof Error ? err.message : String(err)}. Remove it manually with 'sc delete ${WINSW_SERVICE_ID}' or retry.`);
+    }
+    if (statusWinswRaw() !== "nonexistent") {
+      throw new Error("Native service still present after removal attempt — aborting switch. Remove it manually with 'sc delete opencodex-proxy-native'.");
+    }
+  }
   // End a running task BEFORE rewriting the assets it is executing — cmd.exe reading the
   // script mid-rewrite runs a torn batch file, and its open handle can fail the write.
   try { stopWindows(); } catch { /* not running */ }
   const script = windowsServiceScriptPath();
   writeServiceAssetWithRetry(script, buildWindowsServiceScript(), "utf8");
+  // UTF-16LE + BOM: a BOM-less UTF-8 VBS mis-decodes non-ASCII (e.g. Korean) profile
+  // paths on some WSH/codepage combinations — same contract as the task XML below.
+  writeServiceAssetWithRetry(windowsLauncherVbsPath(), `\uFEFF${buildWindowsLauncherVbs(script)}`, "utf16le");
   writeServiceAssetWithRetry(windowsTaskXmlPath(), `\uFEFF${buildWindowsTaskXml(script)}`, "utf16le");
   schtasks(buildWindowsSchtasksCreateArgs(script));
   schtasks(["/run", "/tn", TASK]);
-  writeServiceInstallState();
+  writeServiceInstallState("scheduler");
+}
+
+/**
+ * Opt-in native backend (`ocx service install --native`). Transactional: removes the
+ * scheduler backend first; on failure the machine is left with NO service (explicitly
+ * reported) — never a silent fallback to the scheduler.
+ */
+async function installWindowsNative(): Promise<void> {
+  if (!existsSync(getConfigDir())) mkdirSync(getConfigDir(), { recursive: true });
+  writeServiceApiTokenFile();
+  let hadScheduler = false;
+  try {
+    hadScheduler = schtasks(["/query", "/tn", TASK]).includes(TASK);
+  } catch { /* task absent */ }
+  if (hadScheduler) {
+    console.log("🔁 Removing the Task Scheduler backend before installing the native (WinSW) service...");
+    try { stopWindows(); } catch { /* not running */ }
+    try {
+      uninstallWindows();
+    } catch (err) {
+      throw new Error(`Cannot remove the Task Scheduler backend before switching to native: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    // Verify removal — schtasks /delete can silently fail if UAC or policy blocks it.
+    try {
+      if (schtasks(["/query", "/tn", TASK]).includes(TASK)) {
+        throw new Error("Task Scheduler backend still present after removal — aborting switch.");
+      }
+    } catch (e) {
+      if (e instanceof Error && e.message.includes("still present")) throw e;
+      /* query failure = task absent, which is what we want */
+    }
+  }
+  try {
+    await installWinswService(defaultWinswEntry(import.meta.dir));
+  } catch (err) {
+    if (hadScheduler) console.error("⚠️  Native install failed AFTER removing the Task Scheduler backend — no service is installed now. Run `ocx service install` to restore the scheduler backend, or retry `--native`.");
+    throw err;
+  }
+  writeServiceInstallState("native");
 }
 function startWindows(): void { schtasks(["/run", "/tn", TASK]); }
 function stopWindows(): void { try { schtasks(["/end", "/tn", TASK]); } catch { /* not running */ } }
@@ -437,6 +544,7 @@ function statusWindows(): string { try { return schtasks(["/query", "/tn", TASK]
 function uninstallWindows(): void {
   try { schtasks(["/delete", "/tn", TASK, "/f"]); } catch { /* absent */ }
   if (existsSync(windowsServiceScriptPath())) unlinkSync(windowsServiceScriptPath());
+  if (existsSync(windowsLauncherVbsPath())) unlinkSync(windowsLauncherVbsPath());
   if (existsSync(windowsTaskXmlPath())) unlinkSync(windowsTaskXmlPath());
 }
 
@@ -561,15 +669,18 @@ function uninstallSystemd(): void {
 }
 
 type ServiceOps = {
-  install: () => void; start: () => void; stop: () => void;
+  install: () => void | Promise<void>; start: () => void; stop: () => void;
   status: () => string; uninstall: () => void;
 };
 
-function platformOps(): ServiceOps | null {
+function platformOps(backend: ServiceBackend = "scheduler"): ServiceOps | null {
   if (process.platform === "darwin")
     return { install: installLaunchd, start: startLaunchd, stop: stopLaunchd, status: statusLaunchd, uninstall: uninstallLaunchd };
-  if (process.platform === "win32")
+  if (process.platform === "win32") {
+    if (backend === "native")
+      return { install: installWindowsNative, start: startWinswService, stop: stopWinswService, status: winswStatusSummary, uninstall: uninstallWinswService };
     return { install: installWindows, start: startWindows, stop: stopWindows, status: statusWindows, uninstall: uninstallWindows };
+  }
   if (process.platform === "linux") {
     if (existsSync("/.dockerenv")) {
       console.error("Docker detected. Run 'ocx start' directly instead of using the service manager.");
@@ -623,10 +734,15 @@ export function stopServiceIfInstalled(): boolean {
       try { stopLaunchd(); return true; } catch { return false; }
     }
   } else if (process.platform === "win32") {
+    // Query BOTH backends regardless of state: a failed switch or stale state can leave
+    // two managers installed, and either one would respawn the proxy after `ocx stop`.
+    let stopped = false;
     try {
       const q = schtasks(["/query", "/tn", TASK]);
-      if (q.includes(TASK)) { stopWindows(); return true; }
+      if (q.includes(TASK)) { stopWindows(); stopped = true; }
     } catch { /* task not found */ }
+    if (statusWinswRaw() !== "nonexistent") { stopWinswService(); stopped = true; }
+    if (stopped) return true;
   } else if (process.platform === "linux" && isSystemd() && existsSync(unitPath())) {
     try { stopSystemd(); return true; } catch { return false; }
   }
@@ -652,10 +768,13 @@ export function uninstallServiceIfInstalled(): boolean {
       try { uninstallLaunchd(); removeServiceInstallState(); return true; } catch { return false; }
     }
   } else if (process.platform === "win32") {
+    let removed = false;
     try {
       const q = schtasks(["/query", "/tn", TASK]);
-      if (q.includes(TASK)) { uninstallWindows(); removeServiceInstallState(); return true; }
+      if (q.includes(TASK)) { uninstallWindows(); removed = true; }
     } catch { /* task not found */ }
+    if (statusWinswRaw() !== "nonexistent") { uninstallWinswService(); removed = true; }
+    if (removed) { removeServiceInstallState(); return true; }
   } else if (process.platform === "linux" && existsSync(unitPath())) {
     try { uninstallSystemd(); removeServiceInstallState(); return true; } catch {
       try { unlinkSync(unitPath()); removeServiceInstallState(); return true; } catch { return false; }
@@ -677,8 +796,11 @@ export function serviceStatusSummary(): string {
     return status ? `installed (launchd; ${diagnostics})` : `installed, not loaded (${diagnostics})`;
   }
   if (process.platform === "win32") {
-    const status = statusWindows();
-    return status ? `installed (Task Scheduler; ${diagnostics})` : `not installed (${diagnostics})`;
+    const scheduler = statusWindows();
+    const native = winswStatusSummary();
+    if (scheduler && native) return `installed (CONFLICT: Task Scheduler AND native WinSW both present — run 'ocx service uninstall' then reinstall one; ${diagnostics})`;
+    if (native) return `installed (${native}; ${diagnostics})`;
+    return scheduler ? `installed (Task Scheduler; ${diagnostics})` : `not installed (${diagnostics})`;
   }
   if (process.platform === "linux") {
     if (existsSync("/.dockerenv")) return "unsupported in Docker";
@@ -694,19 +816,66 @@ export function normalizeServiceSubcommand(sub?: string): string {
   return sub ?? "install";
 }
 
-export async function serviceCommand(sub?: string): Promise<void> {
-  const ops = platformOps();
+export interface ParsedServiceArgs {
+  sub: string;
+  backend: ServiceBackend | null;
+  invalid: string[];
+}
+
+/**
+ * `ocx service [sub] [--native|--scheduler]`. The first non-flag token is the
+ * subcommand; backend flags are only meaningful for `install` (validated by the caller).
+ */
+export function parseServiceArgs(args: string[]): ParsedServiceArgs {
+  let sub: string | undefined;
+  let backend: ServiceBackend | null = null;
+  const invalid: string[] = [];
+  for (const arg of args) {
+    if (arg === "--native") {
+      if (backend === "scheduler") { invalid.push("--native (conflicts with --scheduler)"); continue; }
+      backend = "native";
+    }
+    else if (arg === "--scheduler") {
+      if (backend === "native") { invalid.push("--scheduler (conflicts with --native)"); continue; }
+      backend = "scheduler";
+    }
+    else if (arg.startsWith("--")) invalid.push(arg);
+    else if (sub === undefined) sub = arg;
+    else invalid.push(arg);
+  }
+  return { sub: normalizeServiceSubcommand(sub), backend, invalid };
+}
+
+export async function serviceCommand(...args: (string | undefined)[]): Promise<void> {
+  const parsed = parseServiceArgs(args.filter((a): a is string => Boolean(a)));
+  const command = parsed.sub;
+  if (parsed.invalid.length > 0) {
+    console.error(`Unknown service option: ${parsed.invalid.join(" ")}`);
+    process.exit(1);
+  }
+  if (parsed.backend && command !== "install") {
+    console.error("--native/--scheduler apply to `ocx service install` only; other subcommands use the installed backend.");
+    process.exit(1);
+  }
+  if (parsed.backend === "native" && process.platform !== "win32") {
+    console.error("--native (WinSW) is Windows-only.");
+    process.exit(1);
+  }
+  // Non-install subcommands follow the backend recorded at install time (state v2).
+  const backend: ServiceBackend = parsed.backend ?? (process.platform === "win32" ? readServiceBackend() : "scheduler");
+  const ops = platformOps(backend);
   if (!ops) {
     console.error("ocx service supports macOS (launchd), Windows (Task Scheduler), and Linux (systemd).");
     process.exit(1);
   }
-  const command = normalizeServiceSubcommand(sub);
   switch (command) {
     case "install":
       assertServiceEnvironmentMatchesInstall();
       assertServiceAuthEnvironment();
-      ops.install();
-      console.log("✅ opencodex service installed + started (auto-starts on login, auto-restarts on crash).");
+      await ops.install();
+      console.log(backend === "native"
+        ? "✅ opencodex native service installed + started (windowless, starts at boot, auto-restarts on crash)."
+        : "✅ opencodex service installed + started (auto-starts on login, auto-restarts on crash).");
       if (process.platform === "linux") console.log("   For auto-start on boot: loginctl enable-linger $USER");
       break;
     case "start":
@@ -732,9 +901,17 @@ export async function serviceCommand(sub?: string): Promise<void> {
     case "uninstall":
     case "remove":
       assertServiceEnvironmentMatchesInstall();
-      ops.stop();
+      try { ops.stop(); } catch (err) {
+        console.warn(`⚠️  Service stop failed: ${err instanceof Error ? err.message : String(err)}`);
+      }
       await stopTrackedProxyForServiceCommand();
-      ops.uninstall();
+      try {
+        ops.uninstall();
+      } catch (err) {
+        console.error(`❌ Service uninstall failed: ${err instanceof Error ? err.message : String(err)}`);
+        console.error("The service may still be installed. Check with 'ocx service status' or remove manually.");
+        process.exit(1);
+      }
       {
         const restore = restoreNativeCodex();
         if (!restore.success) {
@@ -746,8 +923,9 @@ export async function serviceCommand(sub?: string): Promise<void> {
       console.log("✅ service uninstalled.");
       break;
     default:
-      console.error("Usage: ocx service [install|start|stop|status|uninstall|remove]");
+      console.error("Usage: ocx service [install|start|stop|status|uninstall|remove] [--native|--scheduler]");
       console.error("       With no subcommand, installs/updates and starts the background service.");
+      console.error("       --native (Windows only): register a real SCM service via WinSW instead of Task Scheduler.");
       process.exit(1);
   }
 }

package/src/update/index.ts

@@ -58,6 +58,24 @@ function npmSpawnTarget(bin: string): { bin: string; shell: boolean } {
   return { bin: "npm.cmd", shell: true };
 }
 
+/**
+ * The GUI update worker sets OCX_SERVICE=1 and has stdio ignored — inheriting that for
+ * `npm.cmd` (shell:true) opens stacked visible consoles on Windows. Pipe instead and
+ * relay bounded output after the child exits. (Ported from PR #167.)
+ */
+function updateChildStdio(): "inherit" | "pipe" {
+  if (process.env.OCX_SERVICE === "1") return "pipe";
+  if (typeof process.stdout.isTTY === "boolean" && !process.stdout.isTTY) return "pipe";
+  return "inherit";
+}
+
+function logSpawnOutput(label: string, result: { stdout?: string | Buffer | null; stderr?: string | Buffer | null }): void {
+  const stdout = typeof result.stdout === "string" ? result.stdout.trim() : "";
+  const stderr = typeof result.stderr === "string" ? result.stderr.trim() : "";
+  if (stdout) console.log(stdout.length > 4000 ? `${label}${stdout.slice(-4000)}` : stdout);
+  if (stderr) console.error(stderr.length > 4000 ? `${label}${stderr.slice(-4000)}` : stderr);
+}
+
 /** Latest published version from the registry (best-effort; null if npm isn't available). */
 export function latestVersion(tag: string): string | null {
   const npm = npmSpawnTarget("npm");
@@ -160,7 +178,13 @@ export async function runUpdate(): Promise<void> {
   // Full `ocx stop` semantics (drain, service stop, restore).
   if (serviceWasInstalled || readPid() || readRuntimePort()) {
     console.log("⏹  Stopping the running proxy before updating...");
-    const stop = spawnSync(process.execPath, [process.argv[1], "stop"], { stdio: "inherit", windowsHide: true });
+    const stopStdio = updateChildStdio();
+    const stop = spawnSync(process.execPath, [process.argv[1], "stop"], {
+      stdio: stopStdio,
+      encoding: stopStdio === "pipe" ? "utf8" : undefined,
+      windowsHide: true,
+    });
+    if (stopStdio === "pipe") logSpawnOutput("", stop);
     if (stop.status !== 0 || readPid() || readRuntimePort()) {
       console.error("⚠️  Could not stop the running proxy; aborting the update. Run 'ocx stop' and retry.");
       process.exit(1);
@@ -178,7 +202,15 @@ export async function runUpdate(): Promise<void> {
   console.log(`Updating${latest ? ` to v${latest}` : ""}…\n$ ${bin} ${cmdArgs.join(" ")}`);
 
   const target = npmSpawnTarget(bin);
-  const r = spawnSync(target.bin, cmdArgs, { stdio: "inherit", timeout: 180000, windowsHide: true, shell: target.shell });
+  const installStdio = updateChildStdio();
+  const r = spawnSync(target.bin, cmdArgs, {
+    stdio: installStdio,
+    encoding: installStdio === "pipe" ? "utf8" : undefined,
+    timeout: 180000,
+    windowsHide: true,
+    shell: target.shell,
+  });
+  if (installStdio === "pipe") logSpawnOutput("", r);
   if (r.status === 0) {
     console.log(`\n✅ Updated${latest ? ` to v${latest}` : ""}.`);
     // Re-bake the bundled Bun path into the Codex autostart shim on every
@@ -197,7 +229,14 @@ export async function runUpdate(): Promise<void> {
     // launchd/schtasks/systemd user isn't left with the background proxy down.
     if (serviceWasInstalled) {
       console.log("🔁 Reinstalling the background service with the updated files...");
-      const svc = spawnSync(process.execPath, [process.argv[1], "service", "install"], { stdio: "inherit", windowsHide: true });
+      const { serviceReinstallArgs } = await import("../service");
+      const svcStdio = updateChildStdio();
+      const svc = spawnSync(process.execPath, [process.argv[1], ...serviceReinstallArgs()], {
+        stdio: svcStdio,
+        encoding: svcStdio === "pipe" ? "utf8" : undefined,
+        windowsHide: true,
+      });
+      if (svcStdio === "pipe") logSpawnOutput("", svc);
       if (svc.status !== 0) console.warn("⚠️  Service refresh failed — run 'ocx service install' manually.");
     } else {
       console.log("Restart the proxy:  ocx start");

package/src/update/job.ts

@@ -160,22 +160,24 @@ export function restartCommand(
   installer: Installer,
   launcher = packageLauncherPath(),
   port?: number,
+  serviceArgs?: string[],
 ): { mode: "service" | "proxy"; bin: string; args: string[]; display: string } {
   const mode = serviceInstalled ? "service" : "proxy";
   const pinPort = !serviceInstalled && typeof port === "number" && Number.isFinite(port) && port > 0;
   const startArgs = pinPort
     ? [launcher, "start", "--port", String(Math.trunc(port))]
     : [launcher, "start"];
+  const svcArgs = serviceInstalled ? [launcher, ...(serviceArgs ?? ["service", "install"])] : startArgs;
   if (installer === "npm") {
     const bin = nodeBin();
-    const args = serviceInstalled ? [launcher, "service", "install"] : startArgs;
+    const args = svcArgs;
     return { mode, bin, args, display: formatCommand(bin, args) };
   }
   // bun/source installs: restart via the current runtime executable + package launcher (both real
   // .exe files), NOT the `ocx.cmd` shim. Spawning a `.cmd` shell-less throws EINVAL on Windows
   // Node/Bun ≥18.20/20.12 (CVE-2024-27980 hardening) — the same class the npm path (nodeBin) avoids.
   const bin = process.execPath;
-  const args = serviceInstalled ? [launcher, "service", "install"] : startArgs;
+  const args = svcArgs;
   return { mode, bin, args, display: formatCommand(bin, args) };
 }
 
@@ -303,7 +305,14 @@ async function restartAfterUpdate(
   // port to wait on; config is only the cold-start fallback.
   const port = captured?.port ?? config.port ?? 10100;
   const hostname = captured?.hostname ?? config.hostname ?? "127.0.0.1";
-  const cmd = restartCommand(serviceInstalled, job.installer, packageLauncherPath(), port);
+  let svcArgs: string[] | undefined;
+  if (serviceInstalled) {
+    try {
+      const { serviceReinstallArgs } = await import("../service");
+      svcArgs = serviceReinstallArgs();
+    } catch { /* fallback to default service install */ }
+  }
+  const cmd = restartCommand(serviceInstalled, job.installer, packageLauncherPath(), port, svcArgs);
   if (serviceInstalled) {
     const result = runLoggedCommand(job, cmd.bin, cmd.args, RESTART_TIMEOUT_MS);
     if (result.status !== 0) {