@bitkyc08/opencodex 2.75.0 → 2.76.0

package/src/server/responses-hosted-image-display.ts

@@ -0,0 +1,225 @@
+import { mkdirSync, writeFileSync, unlinkSync } from "node:fs";
+import { createHash, randomUUID } from "node:crypto";
+import { join, posix } from "node:path";
+import { getConfigDir } from "../config";
+import { recordOwnedConfigPath } from "../lib/config-ownership";
+import {
+  chargeImageBudget, createImageBudget, decodeValidatedImageBase64,
+  artifactHttpUrl, getArtifactsDir, MAX_ENCODED_BYTES_PER_IMAGE, pruneArtifacts, sniffImageExtension,
+} from "../images/artifacts";
+import { sseDataPayload, replaceSseDataPayload, type SseBlockRewrite } from "./sse-payload-rewrite";
+
+type Row = Record<string, any>;
+const object = (v: unknown): v is Row => !!v && typeof v === "object" && !Array.isArray(v);
+const originators = new Set(["codex_cli_rs", "Codex Desktop", "codex_app", "codex_work_desktop"]);
+const generatedName = /^img-codex-[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}\.(png|jpg|webp|gif)$/;
+
+/** One spelling per local path: file URL or plain, either separator, dot segments, folded case. */
+function comparablePath(value: string, foldCase: boolean): string | undefined {
+  let path = value;
+  if (/^file:\/\//i.test(path)) {
+    try { path = decodeURIComponent(path.replace(/^file:\/\/(?:localhost)?/i, "")); } catch { return undefined; }
+    if (/^\/[A-Za-z]:/.test(path)) path = path.slice(1);
+  }
+  path = posix.normalize(path.replace(/\\/g, "/"));
+  return foldCase ? path.toLowerCase() : path;
+}
+
+/**
+ * Full client replay can include display-only messages even without their generated ids.
+ * Shared by Responses request preparation and the remote compaction handler.
+ */
+export function redactHostedImageDisplayPaths(body: unknown, platform: NodeJS.Platform = process.platform): void {
+  if (!object(body) || !Array.isArray(body.input)) return;
+  // macOS and Windows filesystems fold case by default, so either spelling names the artifact.
+  const foldCase = platform === "darwin" || platform === "win32";
+  const dir = comparablePath(getArtifactsDir(), foldCase);
+  const generatedLink = /!\[Generated image\]\(<([^>\r\n]+)>\)/g;
+  const redact = (text: string) => text.replace(generatedLink, (link, path: string) => {
+    const candidate = comparablePath(path, foldCase);
+    const slash = candidate?.lastIndexOf("/") ?? -1;
+    if (!candidate || !dir || slash < 0 || candidate.slice(0, slash) !== dir) return link;
+    const name = candidate.slice(slash + 1);
+    if (!generatedName.test(name)) return link;
+    // No file read or existence check: history may outlive artifact retention.
+    return "![Generated image](<" + artifactHttpUrl(name) + ">)";
+  });
+  for (const item of body.input) {
+    if (!object(item) || item.role !== "assistant"
+      || (item.type !== undefined && item.type !== "message")) continue;
+    if (typeof item.content === "string") item.content = redact(item.content);
+    else if (Array.isArray(item.content)) {
+      for (const part of item.content) {
+        if (object(part) && ["output_text", "input_text", "text"].includes(part.type)
+          && typeof part.text === "string") part.text = redact(part.text);
+      }
+    }
+  }
+}
+
+/** Local filesystem links are only appropriate for the loopback Codex client. */
+export function isLocalCodexImageClient(headers: Headers, admissionKind?: string, inboundWire?: string): boolean {
+  return admissionKind === "loopback"
+    && (inboundWire === undefined || inboundWire === "responses")
+    && (originators.has(headers.get("originator") ?? "")
+      || /^codex(?:[_ /-]|$)/i.test(headers.get("user-agent") ?? ""));
+}
+
+/** Client branch only: raw hosted items remain intact in the upstream replay cache. */
+export function createHostedImageDisplayRewrite(): SseBlockRewrite & { json(text: string): string } {
+  const budget = createImageBudget();
+  const states = new Map<string, { message: Row; added: boolean; done: boolean }>();
+  let extraSequence = 0;
+  let wroteArtifact = false;
+
+  function stateFor(item: Row, index: number) {
+    const key = typeof item.id === "string" ? item.id : "index:" + index;
+    let state = states.get(key);
+    if (state) return state;
+    // Bound metadata independently of the existing 100 MiB decoded-image budget.
+    if (states.size >= 128) throw new RangeError("hosted image result count exceeds local display limit");
+    const id = "msg_ocx_img_" + createHash("sha256").update(key).digest("hex").slice(0, 32);
+    state = { added: false, done: false, message: {
+      // Persist image results outside the client's collapsible progress messages.
+      id, type: "message", role: "assistant", phase: "final_answer", status: "in_progress", content: [],
+      ...(item.internal_chat_message_metadata_passthrough === undefined ? {} : {
+        internal_chat_message_metadata_passthrough: item.internal_chat_message_metadata_passthrough,
+      }),
+    } };
+    states.set(key, state);
+    return state;
+  }
+
+  function complete(item: Row, index: number) {
+    const state = stateFor(item, index);
+    if (state.message.status !== "in_progress") return state;
+    let text = item.status === "completed"
+      ? "The completed image result has no supported image data for local display."
+      : "Image generation did not complete; no image is available to display.";
+    let status = "incomplete";
+    if (item.status === "completed" && typeof item.result === "string") {
+      try {
+        if (item.result.length > MAX_ENCODED_BYTES_PER_IMAGE) throw new RangeError("image too large");
+        const bytes = decodeValidatedImageBase64(item.result);
+        chargeImageBudget(budget, bytes.length);
+        const dir = getArtifactsDir();
+        recordOwnedConfigPath(getConfigDir(), dir);
+        mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const candidate = join(dir, "img-codex-" + randomUUID() + "." + sniffImageExtension(bytes));
+        // Bounded synchronous write: block rewriters cannot await. Never use upstream ids as paths.
+        try {
+          writeFileSync(candidate, bytes, { flag: "wx", mode: 0o600 });
+        } catch (error) {
+          if ((error as NodeJS.ErrnoException).code !== "EEXIST") {
+            try { unlinkSync(candidate); } catch { /* best-effort partial-write cleanup */ }
+          }
+          throw error;
+        }
+        wroteArtifact = true;
+        text = "![Generated image](<" + candidate + ">)";
+        status = "completed";
+      } catch {
+        // Do not expose image data, filesystem errors, or credentials in a generated message.
+        text = "The image result could not be saved for local display.";
+      }
+    }
+    state.message = { ...state.message, status, content: [{ type: "output_text", text, annotations: [] }] };
+    return state;
+  }
+
+  function doneEvents(item: Row, index: number): Row[] {
+    const state = complete(item, index);
+    if (state.done) return [];
+    const { message } = state;
+    const common = { item_id: message.id, output_index: index, content_index: 0 };
+    const part = message.content[0];
+    const events: Row[] = [];
+    if (!state.added) events.push({ type: "response.output_item.added", output_index: index,
+      item: { ...message, status: "in_progress", content: [] } });
+    events.push(
+      { type: "response.content_part.added", ...common, part: { ...part, text: "" } },
+      { type: "response.output_text.delta", ...common, delta: part.text },
+      { type: "response.output_text.done", ...common, text: part.text },
+      { type: "response.content_part.done", ...common, part },
+      { type: "response.output_item.done", output_index: index, item: message },
+    );
+    state.added = state.done = true;
+    return events;
+  }
+
+  function snapshot(response: Row, terminal: boolean, events?: Row[]): Row {
+    if (!Array.isArray(response.output)) return response;
+    // Reject oversized snapshots before saving artifacts that cannot be delivered.
+    const keys = new Set(states.keys());
+    for (const [index, item] of response.output.entries()) {
+      if (!object(item) || item.type !== "image_generation_call") continue;
+      keys.add(typeof item.id === "string" ? item.id : "index:" + index);
+      if (keys.size > 128) throw new RangeError("hosted image result count exceeds local display limit");
+    }
+    let changed = false;
+    const output = response.output.map((item: unknown, index: number) => {
+      if (!object(item) || item.type !== "image_generation_call") return item;
+      changed = true;
+      if (terminal) {
+        if (events) events.push(...doneEvents(item, index));
+        return complete(item, index).message;
+      }
+      return stateFor(item, index).message;
+    });
+    return changed ? { ...response, output } : response;
+  }
+
+  const rewrite = ((block: string): readonly string[] => {
+    const payload = sseDataPayload(block);
+    if (!payload || payload === "[DONE]") return [block];
+    let event: Row;
+    try { event = JSON.parse(payload); } catch { return [block]; }
+    if (!object(event)) return [block];
+    let result: Row[] = [event];
+    const hasIndex = Number.isSafeInteger(event.output_index) && event.output_index >= 0;
+    const index = hasIndex ? event.output_index : 0;
+    if (object(event.item) && event.item.type === "image_generation_call"
+      && (hasIndex || typeof event.item.id === "string")) {
+      if (event.type === "response.output_item.added") {
+        const state = stateFor(event.item, index);
+        result = state.added ? [] : [{ ...event, item: state.message }];
+        state.added = true;
+      } else if (event.type === "response.output_item.done") {
+        result = doneEvents(event.item, index);
+      }
+    } else if (typeof event.type === "string" && event.type.startsWith("response.image_generation_call.")) {
+      // Hosted progress/partial-image frames refer to the replaced item; never expose mismatched ids.
+      result = [];
+    } else if (object(event.response)) {
+      const terminal = ["response.completed", "response.incomplete", "response.failed"].includes(event.type);
+      const injected: Row[] = [];
+      const response = snapshot(event.response, terminal, injected);
+      if (response !== event.response) result = [...injected, { ...event, response }];
+    }
+    const sequence = Number.isSafeInteger(event.sequence_number) ? event.sequence_number + extraSequence : undefined;
+    const shift = extraSequence;
+    extraSequence += result.length - 1;
+    return result.map((value, offset) => {
+      if (value === event && shift === 0 && result.length === 1) return block;
+      const next = sequence === undefined ? value : { ...value, sequence_number: sequence + offset };
+      const data = JSON.stringify(next);
+      return value.type === event.type ? replaceSseDataPayload(block, data) : "event: " + value.type + "\ndata: " + data;
+    });
+  }) as SseBlockRewrite & { json(text: string): string };
+
+  rewrite.json = (text: string) => {
+    let response: unknown;
+    try { response = JSON.parse(text); } catch { return text; }
+    if (!object(response)) return text;
+    const next = snapshot(response, true);
+    return next === response ? text : JSON.stringify(next);
+  };
+  rewrite.dispose = () => {
+    states.clear();
+    if (wroteArtifact) {
+      wroteArtifact = false;
+      pruneArtifacts();
+    }
+  };
+  return rewrite;
+}

package/src/service/managing-cli.ts

@@ -26,6 +26,13 @@ import {
 import type { ServiceInstallState } from "./state";
 
 const VERSION_PROBE_TIMEOUT_MS = 5000;
+/**
+ * A `--version` spawn is the only evidence for a PATH shim; a transient timeout or a
+ * busy cold start turns an unchanged manager into `unknown`, which flips both the
+ * takeover answer and the compatibility token the next resolve compares. One bounded
+ * retry keeps the observation stable while remaining fail-closed on a real failure.
+ */
+const VERSION_PROBE_ATTEMPTS = 2;
 
 export interface ManagingCliDeps {
   /** Environment to scan PATH/PATHEXT in. Defaults to `process.env`. */
@@ -52,12 +59,12 @@ function versionFromOutput(stdout: string): string | null {
   return null;
 }
 
-function probeVersion(
+function probeVersionOnce(
   executable: string,
   args: readonly string[],
   deps: Required<Pick<ManagingCliDeps, "spawn" | "platform" | "env">>,
+  identity: string,
 ): ManagingCliObservation {
-  const identity = [executable, ...args].join(" ");
   let result: SpawnSyncReturns<string>;
   try {
     const windowsShim =
@@ -65,10 +72,17 @@ function probeVersion(
     if (windowsShim && [executable, ...args].some(part => /[&|<>^%!"()]/.test(part))) {
       return { status: "unknown", reason: "the selected Windows command shim invocation cannot be probed safely" };
     }
+    // cmd /c re-parses the remainder of its command line: with more than one quoted
+    // part it strips the outer quotes and truncates at the first space, so every part
+    // must be quoted individually inside one wrapping pair, passed verbatim.
+    const shimCommand = `"${[executable, ...args, "--version"].map(part => `"${part}"`).join(" ")}"`;
     result = deps.spawn(
       windowsShim ? (deps.env?.ComSpec ?? "cmd.exe") : executable,
-      windowsShim ? ["/c", executable, ...args, "--version"] : [...args, "--version"],
-      { timeout: VERSION_PROBE_TIMEOUT_MS, encoding: "utf8", stdio: "pipe", windowsHide: true },
+      windowsShim ? ["/c", shimCommand] : [...args, "--version"],
+      {
+        timeout: VERSION_PROBE_TIMEOUT_MS, encoding: "utf8", stdio: "pipe",
+        windowsHide: true, ...(windowsShim ? { windowsVerbatimArguments: true } : {}),
+      },
     ) as SpawnSyncReturns<string>;
   } catch (error) {
     return {
@@ -91,6 +105,22 @@ function probeVersion(
     : { status: "observed", version, identity };
 }
 
+function probeVersion(
+  executable: string,
+  args: readonly string[],
+  deps: Required<Pick<ManagingCliDeps, "spawn" | "platform" | "env">>,
+): ManagingCliObservation {
+  const identity = [executable, ...args].join(" ");
+  let observation = probeVersionOnce(executable, args, deps, identity);
+  // One bounded retry, Windows only (the platform the flake family was verified on):
+  // a single shim-timeout answer must not flip the fingerprint of an unchanged CLI.
+  const attempts = deps.platform === "win32" ? VERSION_PROBE_ATTEMPTS : 1;
+  for (let attempt = 1; observation.status !== "observed" && attempt < attempts; attempt += 1) {
+    observation = probeVersionOnce(executable, args, deps, identity);
+  }
+  return observation;
+}
+
 /**
  * Where `ocx` resolves on PATH without spawning `where`/`which`.
  *

package/src/service/systemd-env.ts

@@ -0,0 +1,75 @@
+type SystemdHomes = { codexHome: string | null; opencodexHome: string | null };
+type SystemdHomeParse = { kind: "parsed"; homes: SystemdHomes } | { kind: "invalid" };
+
+/** Inverse of systemd.ts's generated quoted values, without expanding systemd specifiers. */
+function decodeQuoted(value: string): string | undefined {
+  let decoded = "";
+  for (let index = 0; index < value.length; index++) {
+    const char = value[index]!;
+    if (char === "%") {
+      if (value[++index] !== "%") return undefined;
+      decoded += "%";
+    } else if (char === "\\") {
+      const escaped = value[++index];
+      if (escaped === "n") decoded += "\n";
+      else if (escaped === "\\" || escaped === '"') decoded += escaped;
+      else return undefined;
+    } else if (char === '"' || char === "\0") {
+      return undefined;
+    } else {
+      decoded += char;
+    }
+  }
+  return decoded;
+}
+
+/**
+ * Missing homes are null; unsupported or ambiguous assignments invalidate the entire definition.
+ *
+ * A directive name is everything before the first `=`, stripped — systemd matches that
+ * name literally and case-sensitively, so only the exact `Environment` can carry the
+ * home assignments this parser decodes. Every other name must be a plain
+ * non-environment identifier to be skipped: `EnvironmentFile=`, `PassEnvironment=` and
+ * `UnsetEnvironment=` mutate the applied environment the same way, an escaped or
+ * malformed name cannot be proven inert, and a line ending in an odd number of
+ * backslashes continues into the next under systemd's parser rather than standing on
+ * its own — all of them invalidate the definition instead of passing over silently.
+ */
+export function parseSystemdUnitHomes(body: string): SystemdHomeParse {
+  const homes: SystemdHomes = { codexHome: null, opencodexHome: null };
+  for (const rawLine of body.split(/\r?\n/)) {
+    const line = rawLine.trim();
+    if (!line || /^[#;\[]/.test(line)) continue;
+    // systemd folds physical continuations before recognizing directive names. The writer never
+    // emits them; accepting individual lines could hide an override or invent a home assignment.
+    const trailingBackslashes = /\\+$/.exec(rawLine)?.[0].length ?? 0;
+    if (trailingBackslashes % 2 === 1) return { kind: "invalid" };
+    const separator = line.indexOf("=");
+    const lvalue = (separator === -1 ? line : line.slice(0, separator)).trim();
+    if (lvalue !== "Environment") {
+      if (!/^[A-Za-z][A-Za-z0-9_.\-]*$/.test(lvalue) || lvalue.includes("Environment")) {
+        return { kind: "invalid" };
+      }
+      continue;
+    }
+    const directive = /^Environment\s*=\s*(.*)$/.exec(line);
+    if (!directive) return { kind: "invalid" };
+    const encoded = directive[1]!;
+    let assignment: string | undefined;
+    if (encoded.startsWith('"') && encoded.endsWith('"')) {
+      assignment = decodeQuoted(encoded.slice(1, -1));
+    } else if (encoded.length > 0 && !/[\s"'\\%\0]/.test(encoded)) {
+      // Older writers emitted one unquoted assignment. Anything needing quoting stays unknown.
+      assignment = encoded;
+    }
+    if (assignment === undefined) return { kind: "invalid" };
+    const pair = /^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/s.exec(assignment);
+    if (!pair) return { kind: "invalid" };
+    const name = pair[1]!;
+    if (name !== "CODEX_HOME" && name !== "OPENCODEX_HOME") continue;
+    const key = name === "CODEX_HOME" ? "codexHome" : "opencodexHome";
+    if (homes[key] !== null || pair[2] === "") return { kind: "invalid" };
+    homes[key] = pair[2]!;
+  }
+  return { kind: "parsed", homes };
+}

package/src/service/windows-guarded-manager.ts

@@ -59,6 +59,13 @@ export interface WindowsGuardedManagerDeps {
   winProcs?: () => WindowsProcessEntry[] | null;
   winTaskXml?: () => string;
   winTaskState?: () => WindowsTaskState;
+  /**
+   * Presence re-probe, invoked only on the failure paths that cannot tell a
+   * DELETED registration from an unreadable one. Absence is the one answer
+   * that changes the verdict — a registration that is gone can respawn
+   * nothing; "present" and "unknown" both stay unknown.
+   */
+  winTaskProbe?: () => WindowsSchedulerTaskProbe;
   winService?: () => WindowsWinswServiceInfo | null;
   winRegistrationOurs?: (xml: string, expectedUserIds: readonly string[] | null) => boolean;
   winTaskUserIds?: () => readonly string[] | null;
@@ -121,6 +128,18 @@ export function windowsProcessList(): WindowsProcessEntry[] | null {
   }
 }
 
+/**
+ * The PowerShell behind windowsScheduledTaskState — exported so the folder scope
+ * is reviewable. `-TaskName` alone is a folder-AGNOSTIC name filter: a same-named
+ * task in any folder answers the query (and several answers leave `.State` an
+ * array that reads as "unknown"), while every `/tn` operation the caller runs is
+ * root-folder scoped. `-TaskPath '\'` pins the read to the root registration.
+ */
+export function windowsScheduledTaskStateQuery(taskName: string): string {
+  return "(Get-ScheduledTask -TaskName '" + taskName.replace(/'/g, "''")
+    + "' -TaskPath '\\' -ErrorAction Stop).State";
+}
+
 /**
  * The registered task's RUNNING state, read through Get-ScheduledTask whose State
  * values are enum names and therefore locale-independent — parsing schtasks table
@@ -129,9 +148,7 @@ export function windowsProcessList(): WindowsProcessEntry[] | null {
 export function windowsScheduledTaskState(taskName = TASK): WindowsTaskState {
   if (process.platform !== "win32") return "unknown";
   try {
-    const output = runPowerShell(
-      "(Get-ScheduledTask -TaskName '" + taskName.replace(/'/g, "''") + "' -ErrorAction Stop).State",
-    ).trim();
+    const output = runPowerShell(windowsScheduledTaskStateQuery(taskName)).trim();
     if (/^running$/i.test(output)) return "running";
     if (/^(ready|disabled)$/i.test(output)) return "not-running";
     return "unknown";
@@ -229,6 +246,9 @@ function resolveWindowsDeps(deps: WindowsGuardedManagerDeps, live: boolean): Res
       throw new Error("Windows task query is unavailable in this context");
     }),
     winTaskState: deps.winTaskState ?? (live ? () => windowsScheduledTaskState() : () => "unknown"),
+    winTaskProbe: deps.winTaskProbe ?? (live
+      ? () => probeWindowsSchedulerTask()
+      : () => ({ status: "unknown", detail: "the Task Scheduler probe is unavailable in this context" })),
     winService: deps.winService ?? (live ? () => windowsWinswServiceInfo() : () => null),
     winRegistrationOurs: deps.winRegistrationOurs ?? ((xml, expectedUserIds) =>
       windowsTaskRegistrationIsOurs(xml, expectedUserIds, (deps.winLauncherPath ?? windowsLauncherVbsPath)())),
@@ -367,12 +387,6 @@ function inspectWindowsSchedulerManager(
   approvedPid: number,
   io: ResolvedWindowsDeps,
 ): GuardedManagerTarget {
-  let xml: string;
-  try {
-    xml = io.winTaskXml();
-  } catch {
-    return unknown("the Task Scheduler registration could not be read");
-  }
   const processes = io.winProcs();
   if (processes === null) return unknown("the Windows process list could not be read");
   const paths = wrapperPaths(io);
@@ -381,16 +395,34 @@ function inspectWindowsSchedulerManager(
   if (unreadableAncestorWrapperPids(approvedPid, processes).length > 0) {
     return unknown("a possible scheduler wrapper has an unreadable command line");
   }
+  // A registration that cannot run anything owes only the stray-wrapper check.
+  // That covers BOTH a not-running task and a task proven deleted between the
+  // caller's presence probe and this inspection: in either case nothing
+  // registered can respawn the proxy, while a surviving wrapper still can —
+  // schtasks /end would report success on the inert task and leave it alive.
+  const inertVerdict = (): GuardedManagerTarget => strays.length === 0
+    ? { kind: "absent" }
+    : unknown("a surviving scheduler wrapper could not be tied to the registered task");
   const state = io.winTaskState();
-  if (state === "unknown") return unknown("the registered task's running state could not be proven");
-  if (state === "not-running") {
-    // A task with no running instance owes nothing ONLY when no wrapper survives.
-    // A live wrapper outside a task instance — whether it parents the approved
-    // PID or not — is unaccounted supervision: schtasks /end would report success
-    // on the inert task while the wrapper stayed alive to respawn the proxy.
-    return strays.length === 0
-      ? { kind: "absent" }
-      : unknown("a surviving scheduler wrapper could not be tied to the registered task");
+  if (state === "unknown") {
+    // Missing vs unreadable: the state query also fails for a task deleted
+    // between probes. A re-probe that proves absence is the inert verdict; a
+    // registration that persists or stays unanswerable keeps failing closed.
+    return io.winTaskProbe().status === "absent"
+      ? inertVerdict()
+      : unknown("the registered task's running state could not be proven");
+  }
+  if (state === "not-running") return inertVerdict();
+  // Only the running path needs the registered definition: an unreadable
+  // registration cannot prove the task is ours, but it must not hold an
+  // otherwise-provable inert verdict unknown.
+  let xml: string;
+  try {
+    xml = io.winTaskXml();
+  } catch {
+    return io.winTaskProbe().status === "absent"
+      ? inertVerdict()
+      : unknown("the Task Scheduler registration could not be read");
   }
   if (!io.winRegistrationOurs(xml, io.winTaskUserIds())) {
     return unknown("the registered task is not a recognized OpenCodex definition");
@@ -520,8 +552,17 @@ export function observeWindowsGuardedManagerStopped(
   if (native === "started") return "active";
   if (scheduler.status === "present") {
     const state = (deps.winTaskState ?? (live ? () => windowsScheduledTaskState() : () => "unknown"))();
-    if (state === "unknown") return "unknown";
     if (state === "running") return "active";
+    if (state === "unknown") {
+      // The state read also fails for a task deleted between the presence probe
+      // and this observation. A registration that is GONE cannot respawn
+      // anything, so re-probe before failing closed — only a persisting or
+      // unanswerable task stays unknown. Proven absence still owes the
+      // unreadable-former-manager check below.
+      if ((deps.scheduler ?? probeWindowsSchedulerTask)().status !== "absent") {
+        return "unknown";
+      }
+    }
   }
   if (deps.formerManagerPid !== undefined && unreadableWrappersOfManager(deps.formerManagerPid, procs).length > 0) {
     return "unknown";

package/src/service/windows-scheduler.ts

@@ -47,11 +47,20 @@ export function decodeSchtasksOutput(
   return decodeWindowsTextBytes(buffer, options);
 }
 
+/**
+ * Every schtasks operation is sub-second on a healthy system; a wedged Task
+ * Scheduler service must not block a guarded stop forever. A killed command
+ * throws into the same unreadable/failed classification a nonzero exit would —
+ * the guarded verdicts stay fail-closed either way.
+ */
+const SCHTASKS_TIMEOUT_MS = 15_000;
+
 function runFile(file: string, args: string[]): string {
   const buffer = execFileSync(file, args, {
     encoding: "buffer",
     stdio: ["ignore", "pipe", "pipe"],
     windowsHide: true,
+    timeout: SCHTASKS_TIMEOUT_MS,
   }) as Buffer;
   return decodeSchtasksOutput(buffer);
 }
@@ -173,17 +182,27 @@ export function schtasksErrorDetail(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
 
-/** True when a schtasks CSV listing line refers to the given task name. */
+/**
+ * True when a schtasks CSV listing line refers to the given task name.
+ * "Given task name" means the task of that name in the ROOT folder — the only
+ * one every `/tn` operation here can address; a same-named task inside a task
+ * folder is a different registration and must not count.
+ */
 export function windowsSchedulerCsvIncludesTask(csv: string, taskName: string): boolean {
   const needle = taskName.toLowerCase();
   for (const line of csv.split(/\r?\n/)) {
     const lower = line.toLowerCase();
     if (!lower.includes(needle)) continue;
-    // Prefer exact CSV field matches ("\TaskName" / "TaskName") before a substring hit.
+    // Prefer exact CSV field matches ("\TaskName" / "TaskName") before a looser
+    // boundary hit. A bare backslash is NOT a boundary: `folder\name` is a path
+    // separator, not the root task — every /tn operation here resolves a bare
+    // name in the root folder only, so `,\Tools\opencodex-proxy,` is a different
+    // registration this probe can neither read nor stop. The optional `\\?`
+    // covers the unquoted root form `,\opencodex-proxy,` only.
     if (
       lower.includes(`"\\${needle}"`)
       || lower.includes(`"${needle}"`)
-      || new RegExp(`(^|[,\\\\])${needle.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}([,"]|$)`).test(lower)
+      || new RegExp(`(^|,)\\\\?${needle.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}([,"]|$)`).test(lower)
     ) {
       return true;
     }

package/src/service/windows-taskxml.ts

@@ -4,6 +4,7 @@ import { TASK, windowsServiceScriptPath, windowsLauncherVbsPath, windowsTaskXmlP
 import { windowsWscript } from "./windows-scheduler";
 import { join } from "node:path";
 import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV } from "../lib/bun-runtime";
+import { REAL_BUN_MIN_BYTES } from "../lib/bun-binary-validator.mjs";
 import { serviceApiTokenFilePath } from "../lib/service-secrets";
 import { windowsEnvIndirectBatchPathList, windowsEnvIndirectBatchValue } from "../lib/win-paths";
 import { cachedCurrentWindowsIdentity, resolveCurrentWindowsPrincipal, WINDOWS_PRINCIPAL_LOOKUP_TIMEOUT_MS } from "../lib/windows-user-principal";
@@ -54,6 +55,10 @@ function taskXmlRunLevelAcceptable(principal: string): boolean {
   return value === "leastprivilege" || value === "highestavailable";
 }
 
+/**
+ * Batch wrapper the scheduled task runs: restarts the proxy on exit, restores a transactional-update
+ * backup when the install is gone, and waits while bundled Bun is still npm's placeholder.
+ */
 export function buildWindowsServiceScript(
   entry = cliEntry(),
   port = resolveServiceListenPort(),
@@ -101,17 +106,21 @@ export function buildWindowsServiceScript(
     'if not exist "%OCX_BUN%" (',
     "  call :restore_backup",
     ")",
-    'if not exist "%OCX_BUN%" (',
-    '  >>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] installation is incomplete: bundled Bun is missing; reinstall opencodex, then run ocx service repair',
-    "  exit /b 3",
-    ")",
+    // Locale dates can contain parentheses. Keep timestamp expansion outside blocks.
+    'if not exist "%OCX_BUN%" goto bun_missing',
+    // An in-place npm install extracts the bun package's tiny placeholder before its postinstall
+    // swaps in the real binary. Executing it fails with exit 216 and, in an interactive session,
+    // a modal "Unsupported 16-Bit Application" dialog that blocks this loop until dismissed.
+    // The install can also remove the file between the exist check and this read; an empty size
+    // would turn the comparison into a syntax error that ends the wrapper.
+    'set "OCX_BUN_BYTES="',
+    'for %%F in ("%OCX_BUN%") do set "OCX_BUN_BYTES=%%~zF"',
+    'if not defined OCX_BUN_BYTES goto bun_not_ready',
+    `if %OCX_BUN_BYTES% LSS ${REAL_BUN_MIN_BYTES} goto bun_not_ready`,
     cli ? 'if not exist "%OCX_CLI%" (' : null,
     cli ? "  call :restore_backup" : null,
     cli ? ")" : null,
-    cli ? 'if not exist "%OCX_CLI%" (' : null,
-    cli ? '  >>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] installation is incomplete: CLI entry is missing; reinstall opencodex, then run ocx service repair' : null,
-    cli ? "  exit /b 3" : null,
-    cli ? ")" : null,
+    cli ? 'if not exist "%OCX_CLI%" goto cli_missing' : null,
     cli ? `"%OCX_BUN%" "%OCX_CLI%" start --port ${port} >>"%OCX_SERVICE_LOG%" 2>&1` : `"%OCX_BUN%" start --port ${port} >>"%OCX_SERVICE_LOG%" 2>&1`,
     // Stop commands kill the wrapper; a zero child exit alone is not a stop request.
     `if "%ERRORLEVEL%"=="${WINDOWS_WRAPPER_STAY_OUT_EXIT_CODE}" goto stopped`,
@@ -123,6 +132,16 @@ export function buildWindowsServiceScript(
     ":stopped",
     "endlocal",
     "exit /b 0",
+    ":bun_not_ready",
+    '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] bundled Bun is not ready (%OCX_BUN_BYTES% bytes, npm placeholder or mid-install); waiting for its postinstall, retrying in 5s - if this persists, reinstall opencodex with bun scripts allowed',
+    "ping -n 6 127.0.0.1 >nul",
+    "goto loop",
+    ":bun_missing",
+    '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] installation is incomplete: bundled Bun is missing; reinstall opencodex, then run ocx service repair',
+    "exit /b 3",
+    cli ? ":cli_missing" : null,
+    cli ? '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] installation is incomplete: CLI entry is missing; reinstall opencodex, then run ocx service repair' : null,
+    cli ? "exit /b 3" : null,
     "",
     // #1942/#1849: a power loss mid-swap leaves the live package dir missing/broken and
     // a sibling .ocx-backup-* holding the previous version. This wrapper lives OUTSIDE
@@ -135,13 +154,16 @@ export function buildWindowsServiceScript(
     '    if exist "%OCX_PKG_DIR%" rmdir /s /q "%OCX_PKG_DIR%" 2>nul',
     '    move "%OCX_PKG_DIR%\\..\\%%B\\opencodex" "%OCX_PKG_DIR%" >nul 2>&1',
     '    if exist "%OCX_PKG_DIR%\\package.json" (',
-    '      >>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] restored previous install from %%B',
-    "      goto :eof",
+    '      set "OCX_RESTORED_BACKUP=%%B"',
+    "      goto backup_restored",
     "    )",
     "  )",
     ")",
     '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] no restorable backup found',
     "goto :eof",
+    ":backup_restored",
+    '>>"%OCX_SERVICE_LOG%" echo [%DATE% %TIME%] restored previous install from %OCX_RESTORED_BACKUP%',
+    "goto :eof",
   ].filter((line): line is string => Boolean(line));
   return `${lines.join("\r\n")}\r\n`;
 }