@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/service/desktop-command-guard.ts

@@ -0,0 +1,32 @@
+import { createSupervisionLatch, inspectDesktopSupervision } from "./desktop-supervision.mjs";
+
+export { createSupervisionLatch };
+export type DesktopSupervision = ReturnType<typeof inspectDesktopSupervision>;
+export type SupervisionInspector = (deps?: Parameters<typeof inspectDesktopSupervision>[0]) => DesktopSupervision;
+export type SupervisionLatch = ReturnType<typeof createSupervisionLatch>;
+
+export function desktopServiceRefusal(evidence: DesktopSupervision, blocked: boolean): string | null {
+  if (!blocked) return null;
+  const runtime = evidence.kind === "desktop" ? ` (pid ${evidence.runtimePid}, ${evidence.app})` : "";
+  return `OpenCodex Desktop supervises the running proxy${runtime}. `
+    + "Quit OpenCodex, then rerun 'ocx service install' to move startup management to this CLI.";
+}
+
+export function assertNoDesktopSupervision(
+  inspect: SupervisionInspector = inspectDesktopSupervision,
+  latch: SupervisionLatch = createSupervisionLatch(),
+): void {
+  const evidence = inspect();
+  const refusal = desktopServiceRefusal(evidence, latch.observe(evidence));
+  if (refusal) throw new Error(refusal);
+}
+
+export function desktopServiceCommandRefusal(
+  command: string,
+  inspect: SupervisionInspector = inspectDesktopSupervision,
+  latch: SupervisionLatch = createSupervisionLatch(),
+): string | null {
+  if (!["install", "repair", "start", "restart"].includes(command)) return null;
+  const evidence = inspect();
+  return desktopServiceRefusal(evidence, latch.observe(evidence));
+}

package/src/service/desktop-startup.ts

@@ -1,9 +1,10 @@
 import { execFileSync } from "node:child_process";
-import { accessSync, constants, readFileSync, readlinkSync, realpathSync } from "node:fs";
+import { accessSync, constants, readFileSync, realpathSync } from "node:fs";
 import { homedir } from "node:os";
 import { basename, dirname, isAbsolute, join, resolve } from "node:path";
 import { readPid } from "../config/process-state";
 import { resolveServiceOwnership, sameServiceOwnershipSubject, type ServiceOwnershipResolution } from "./state";
+import { inspectDesktopSupervision, processIdentity, procfs, type ProcReader } from "./desktop-supervision.mjs";
 
 export interface DesktopStartupDiagnostic {
   /** Durable desktop claim; failed supervision does not release ownership. */
@@ -11,11 +12,13 @@ export interface DesktopStartupDiagnostic {
   loginEnabled: boolean;
   running: boolean;
   viable: boolean;
+  /** Live parentage when no durable claim exists; never converts supervision into ownership. */
+  supervisor?: { supervisorPid: number; runtimePid: number; app: string };
 }
 
-/** A login item alone is insufficient: the same app must own and supervise this proxy. */
+/** A login item alone is insufficient: the same app must supervise this proxy. */
 export function deriveDesktopStartup(facts: Omit<DesktopStartupDiagnostic, "viable">): DesktopStartupDiagnostic {
-  return { ...facts, viable: facts.owned && facts.loginEnabled && facts.running };
+  return { ...facts, viable: (facts.owned || facts.supervisor !== undefined) && facts.loginEnabled && facts.running };
 }
 
 function run(command: string, args: string[]): string {
@@ -28,25 +31,12 @@ interface DesktopStartupDeps {
   uid?: number;
   ownership?: () => ServiceOwnershipResolution;
   readPid?: () => number | null;
+  readRuntimePortPid?: () => number | null;
   run?: typeof run;
   env?: NodeJS.ProcessEnv;
   proc?: ProcReader;
 }
 
-/** Linux process identity from procfs: executable target and parent pid. */
-interface ProcReader {
-  exe(pid: number): string;
-  parent(pid: number): number;
-}
-const procfs: ProcReader = {
-  exe: pid => readlinkSync(`/proc/${pid}/exe`),
-  // comm may contain spaces or parentheses, so fields are counted after the last ')'.
-  parent: pid => {
-    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
-    return Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
-  },
-};
-
 /** Cheap ownership-only snapshot: no launchd/process probes on the server request path. */
 export function desktopStartupOwnership(deps: DesktopStartupDeps = {}): DesktopStartupDiagnostic | undefined {
   const platform = deps.platform ?? process.platform;
@@ -56,9 +46,47 @@ export function desktopStartupOwnership(deps: DesktopStartupDeps = {}): DesktopS
     ? deriveDesktopStartup({ owned: true, loginEnabled: false, running: false }) : undefined;
 }
 
-function processIdentity(pid: number, execute: typeof run): { parent: number; executable: string } | null {
-  const row = /^(\d+)\s+(.+)$/.exec(execute("/bin/ps", ["-p", String(pid), "-o", "ppid=,comm="]));
-  return row ? { parent: Number(row[1]), executable: realpathSync(row[2]!) } : null;
+function macLoginRegistration(deps: DesktopStartupDeps) {
+  const execute = deps.run ?? run;
+  const path = join(deps.home ?? homedir(), "Library", "LaunchAgents", "OpenCodex.plist");
+  const plist = JSON.parse(execute("/usr/bin/plutil", ["-convert", "json", "-o", "-", path]));
+  const args = plist.ProgramArguments;
+  if (plist.Label !== "OpenCodex" || plist.RunAtLoad !== true || !Array.isArray(args)
+    || args.length !== 2 || args[1] !== "--autostart" || typeof args[0] !== "string"
+    || !args[0].endsWith("/Contents/MacOS/opencodex-desktop")
+    || (plist.Program !== undefined && plist.Program !== args[0])) return null;
+  const app = realpathSync(args[0]);
+  const proxy = realpathSync(join(dirname(app), "ocx"));
+  accessSync(app, constants.X_OK);
+  accessSync(proxy, constants.X_OK);
+  const domain = `gui/${deps.uid ?? process.getuid!()}`;
+  const disabled = execute("/bin/launchctl", ["print-disabled", domain]);
+  const loaded = execute("/bin/launchctl", ["print", `${domain}/OpenCodex`]);
+  const program = /^\s*program = (.+)$/m.exec(loaded)?.[1];
+  const loadedPath = /^\s*path = (.+)$/m.exec(loaded)?.[1];
+  const loginEnabled = /^\s*disabled services = \{[\s\S]*\}\s*$/.test(disabled)
+    && !/"OpenCodex"\s*=>\s*(?:disabled|true)/.test(disabled)
+    && program !== undefined && realpathSync(program) === app
+    && loadedPath !== undefined && realpathSync(loadedPath) === realpathSync(path);
+  return { app, proxy, loginEnabled };
+}
+
+function diagnoseSupervisedStartup(deps: DesktopStartupDeps, ownerRevision: number, loginFor: (app: string) => boolean): DesktopStartupDiagnostic | undefined {
+  const evidence = inspectDesktopSupervision(deps);
+  if (evidence.kind !== "desktop") return undefined;
+  let loginEnabled = false;
+  try { loginEnabled = loginFor(evidence.app); }
+  catch { /* Login failure revokes restart viability, not the observed live supervisor. */ }
+  if ((deps.ownership ?? resolveServiceOwnership)().kind !== "none") return undefined;
+  // Login probes can outlive the runtime or its parent; only the same live chain gets credit.
+  const final = inspectDesktopSupervision({ ...deps, targetPid: evidence.runtimePid });
+  if (final.kind !== "desktop" || final.runtimePid !== evidence.runtimePid
+    || final.supervisorPid !== evidence.supervisorPid || final.app !== evidence.app) return undefined;
+  // A new claim or revision during the last process probe invalidates the unowned projection.
+  const finalOwner = (deps.ownership ?? resolveServiceOwnership)();
+  if (finalOwner.kind !== "none" || finalOwner.revision !== ownerRevision) return undefined;
+  const { supervisorPid, runtimePid, app } = evidence;
+  return deriveDesktopStartup({ owned: false, loginEnabled, running: true, supervisor: { supervisorPid, runtimePid, app } });
 }
 
 /** Read-only macOS desktop ownership, login registration and live parent/child checks. */
@@ -66,6 +94,10 @@ export function diagnoseMacDesktopStartup(deps: DesktopStartupDeps = {}): Deskto
   if ((deps.platform ?? process.platform) !== "darwin") return undefined;
   const ownership = deps.ownership ?? resolveServiceOwnership;
   const owner = ownership();
+  if (owner.kind === "none") return diagnoseSupervisedStartup(deps, owner.revision, app => {
+    const login = macLoginRegistration(deps);
+    return login !== null && login.app === app && login.loginEnabled;
+  });
   if (owner.kind !== "owned" || owner.ownership.owner !== "desktop") return undefined;
   const facts = { owned: true, loginEnabled: false, running: false };
   const execute = deps.run ?? run;
@@ -74,26 +106,10 @@ export function diagnoseMacDesktopStartup(deps: DesktopStartupDeps = {}): Deskto
     const home = deps.home ?? homedir();
     const id = readFileSync(join(home, "Library", "Application Support", "com.opencodex.desktop", "install-id"), "utf8").trim();
     if (id !== owner.ownership.installId) return deriveDesktopStartup(facts);
-    const path = join(home, "Library", "LaunchAgents", "OpenCodex.plist");
-    const plist = JSON.parse(execute("/usr/bin/plutil", ["-convert", "json", "-o", "-", path]));
-    const args = plist.ProgramArguments;
-    if (plist.Label !== "OpenCodex" || plist.RunAtLoad !== true || !Array.isArray(args)
-      || args.length !== 2 || args[1] !== "--autostart" || typeof args[0] !== "string"
-      || !args[0].endsWith("/Contents/MacOS/opencodex-desktop")
-      || (plist.Program !== undefined && plist.Program !== args[0])) return deriveDesktopStartup(facts);
-    const app = realpathSync(args[0]);
-    const proxy = realpathSync(join(dirname(app), "ocx"));
-    accessSync(app, constants.X_OK);
-    accessSync(proxy, constants.X_OK);
-    const domain = `gui/${deps.uid ?? process.getuid!()}`;
-    const disabled = execute("/bin/launchctl", ["print-disabled", domain]);
-    const loaded = execute("/bin/launchctl", ["print", `${domain}/OpenCodex`]);
-    const program = /^\s*program = (.+)$/m.exec(loaded)?.[1];
-    const loadedPath = /^\s*path = (.+)$/m.exec(loaded)?.[1];
-    facts.loginEnabled = /^\s*disabled services = \{[\s\S]*\}\s*$/.test(disabled)
-      && !/"OpenCodex"\s*=>\s*(?:disabled|true)/.test(disabled)
-      && program !== undefined && realpathSync(program) === app
-      && loadedPath !== undefined && realpathSync(loadedPath) === realpathSync(path);
+    const login = macLoginRegistration(deps);
+    if (!login) return deriveDesktopStartup(facts);
+    const { app, proxy } = login;
+    facts.loginEnabled = login.loginEnabled;
     const pid = pidReader();
     if (pid !== null) {
       const child = processIdentity(pid, execute);
@@ -135,6 +151,16 @@ export function diagnoseLinuxDesktopStartup(deps: DesktopStartupDeps = {}): Desk
   if ((deps.platform ?? process.platform) !== "linux") return undefined;
   const ownership = deps.ownership ?? resolveServiceOwnership;
   const owner = ownership();
+  if (owner.kind === "none") return diagnoseSupervisedStartup(deps, owner.revision, app => {
+    const home = deps.home ?? homedir();
+    const configured = (deps.env ?? process.env).XDG_CONFIG_HOME;
+    const config = configured && isAbsolute(configured) ? configured : join(home, ".config");
+    // auto-launch's HOME entry must remain inside the session's XDG autostart search path.
+    if (resolve(config) !== resolve(home, ".config")) return false;
+    const entry = readFileSync(join(home, ".config", "autostart", "OpenCodex.desktop"), "utf8");
+    const login = linuxLoginApp(entry);
+    return login !== null && realpathSync(login) === app;
+  });
   if (owner.kind !== "owned" || owner.ownership.owner !== "desktop") return undefined;
   const facts = { owned: true, loginEnabled: false, running: false };
   const proc = deps.proc ?? procfs;

package/src/service/desktop-supervision.d.mts

@@ -0,0 +1,26 @@
+export type SupervisionEvidence =
+  | { kind: "desktop"; runtimePid: number; supervisorPid: number; app: string; proxy: string }
+  | { kind: "none" }
+  | { kind: "unknown"; reason: string; desktopSeen: boolean }
+  | { kind: "unsupported" };
+
+export interface ProcReader {
+  exe(pid: number): string;
+  parent(pid: number): number;
+}
+
+export interface DesktopSupervisionDeps {
+  targetPid?: number;
+  platform?: NodeJS.Platform;
+  run?: (command: string, args: string[]) => string;
+  proc?: ProcReader;
+  readPid?: () => number | null;
+  readRuntimePortPid?: () => number | null;
+}
+
+export function desktopSupervisionPaths(): { pid: string; runtimePort: string };
+export const procfs: ProcReader;
+export function processIdentity(pid: number, execute?: DesktopSupervisionDeps["run"], onExecutable?: (path: string) => void):
+  { parent: number; executable: string } | null;
+export function inspectDesktopSupervision(deps?: DesktopSupervisionDeps): SupervisionEvidence;
+export function createSupervisionLatch(): { observe(evidence: SupervisionEvidence): boolean };

package/src/service/desktop-supervision.mjs

@@ -0,0 +1,140 @@
+import { execFileSync } from "node:child_process";
+import { accessSync, constants, readFileSync, readlinkSync, realpathSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join, resolve } from "node:path";
+
+// Node >=18 also imports this module from bin/ocx.mjs; do not import TS or Bun APIs.
+function run(command, args) {
+  return execFileSync(command, args, {
+    encoding: "utf8", timeout: 750, maxBuffer: 128 * 1024, stdio: ["ignore", "pipe", "pipe"],
+  }).trim();
+}
+
+// Mirror src/config/paths.ts getConfigDir/expandUserPath and process-state.ts paths.
+// Keep this Node-safe copy in sync; the focused startup test pins both implementations.
+export function desktopSupervisionPaths() {
+  const raw = process.env.OPENCODEX_HOME?.trim();
+  const expanded = raw === "~" ? homedir()
+    : raw?.startsWith("~/") || raw?.startsWith("~\\") ? join(homedir(), raw.slice(2)) : raw;
+  const home = expanded ? resolve(expanded) : join(homedir(), ".opencodex");
+  return { pid: join(home, "ocx.pid"), runtimePort: join(home, "runtime-port.json") };
+}
+
+function validPid(pid) {
+  return Number.isSafeInteger(pid) && pid > 0;
+}
+
+function readState(path, parse) {
+  try { return parse(readFileSync(path, "utf8")); }
+  catch (error) {
+    if (error?.code === "ENOENT") return null;
+    throw error;
+  }
+}
+
+function readPidFile() {
+  return readState(desktopSupervisionPaths().pid, raw => {
+    const text = raw.trim();
+    if (!/^\d+$/.test(text) || !validPid(Number(text))) throw new Error("invalid pid");
+    return Number(text);
+  });
+}
+
+function readRuntimePortPid() {
+  return readState(desktopSupervisionPaths().runtimePort, raw => {
+    // Only project pid: no credential validation, serialization or returned port state.
+    const pid = JSON.parse(raw)?.pid;
+    if (!validPid(pid)) throw new Error("invalid runtime pid");
+    return pid;
+  });
+}
+
+/** Linux identity fields count from the end of comm, which may contain spaces or ')'. */
+export const procfs = {
+  exe: pid => readlinkSync(`/proc/${pid}/exe`),
+  parent: pid => {
+    const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+    return Number(stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1]);
+  },
+};
+
+export function processIdentity(pid, execute = run, onExecutable) {
+  const text = execute("/bin/ps", ["-p", String(pid), "-o", "ppid=,comm="]).trim();
+  const row = /^(\d+)\s+(.+)$/.exec(text);
+  if (!row) {
+    if (text) throw new Error("invalid process identity");
+    return null;
+  }
+  onExecutable?.(row[2]);
+  return { parent: Number(row[1]), executable: realpathSync(row[2]) };
+}
+
+/** Live supervision is evidence, never a durable ownership claim. */
+export function inspectDesktopSupervision(deps = {}) {
+  const platform = deps.platform ?? process.platform;
+  if (platform !== "darwin" && platform !== "linux") return { kind: "unsupported" };
+  let desktopSeen = false;
+  const unknown = reason => ({ kind: "unknown", reason, desktopSeen });
+  const seen = executable => { if (basename(executable) === "opencodex-desktop") desktopSeen = true; };
+  const readPid = deps.readPid ?? readPidFile;
+  const readPortPid = deps.readRuntimePortPid ?? readRuntimePortPid;
+  const proc = deps.proc ?? procfs;
+  const execute = deps.run ?? run;
+  function identity(pid, parent = false) {
+    if (platform === "darwin") return processIdentity(pid, execute, parent ? seen : undefined);
+    const executable = proc.exe(pid);
+    if (parent) seen(executable);
+    const parentPid = proc.parent(pid);
+    if (!Number.isSafeInteger(parentPid) || parentPid < 0) throw new Error("invalid parent pid");
+    return { parent: parentPid, executable: realpathSync(executable) };
+  }
+  function capture() {
+    const pidFile = readPid();
+    const portPid = readPortPid();
+    const pids = [deps.targetPid, pidFile, portPid].filter(pid => pid !== undefined && pid !== null);
+    if (pids.some(pid => !validPid(pid))) return { error: "invalid-pid" };
+    if (pids.some(pid => pid !== pids[0])) return { error: "pid-mismatch" };
+    const runtimePid = pids[0] ?? null;
+    const child = runtimePid !== null ? identity(runtimePid) : null;
+    const parent = child && child.parent > 1 ? identity(child.parent, true) : null;
+    const snapshot = { pidFile, portPid, runtimePid, child, parent };
+    if (!runtimePid || !child || !parent || basename(parent.executable) !== "opencodex-desktop") {
+      return { ...snapshot, kind: "none" };
+    }
+    seen(parent.executable);
+    const app = parent.executable;
+    if (platform === "darwin" && (basename(dirname(app)) !== "MacOS"
+      || basename(dirname(dirname(app))) !== "Contents")) return { error: "app-mismatch" };
+    const proxy = realpathSync(join(dirname(app), "ocx"));
+    if (child.executable !== proxy || (platform === "linux"
+      && (dirname(proxy) !== dirname(app) || basename(proxy) !== "ocx"))) return { error: "proxy-mismatch" };
+    accessSync(app, constants.X_OK);
+    accessSync(proxy, constants.X_OK);
+    return { ...snapshot, kind: "desktop", app, proxy };
+  }
+  try {
+    const first = capture();
+    if (first.error) return unknown(first.error);
+    const final = capture();
+    if (final.error) return unknown(final.error);
+    if (JSON.stringify(first) !== JSON.stringify(final)) return unknown("snapshot-changed");
+    return final.kind === "desktop"
+      ? { kind: "desktop", runtimePid: final.runtimePid, supervisorPid: final.child.parent, app: final.app, proxy: final.proxy }
+      : { kind: "none" };
+  } catch {
+    // Error messages can contain paths or file contents; expose only the bounded reason.
+    return unknown("probe-failed");
+  }
+}
+
+/** One operation retains its Desktop veto through inconclusive later probes. */
+export function createSupervisionLatch() {
+  let blocked = false;
+  return {
+    observe(evidence) {
+      if (evidence.kind === "none") blocked = false;
+      else if (evidence.kind === "desktop" || (evidence.kind === "unknown" && evidence.desktopSeen)) blocked = true;
+      return blocked;
+    },
+  };
+}

package/src/service/managing-cli.ts

@@ -81,6 +81,7 @@ function probeVersionOnce(
       windowsShim ? ["/c", shimCommand] : [...args, "--version"],
       {
         timeout: VERSION_PROBE_TIMEOUT_MS, encoding: "utf8", stdio: "pipe",
+        env: { ...deps.env, OCX_NO_DESKTOP_HANDOFF: "1" },
         windowsHide: true, ...(windowsShim ? { windowsVerbatimArguments: true } : {}),
       },
     ) as SpawnSyncReturns<string>;

package/src/service/orchestration.ts

@@ -1,5 +1,7 @@
 import { findLiveProxy, SERVICE_STOP_LIVENESS } from "../server/proxy-liveness";
 import { existsSync, unlinkSync } from "node:fs";
+import { durableBunRuntime, type DurableBunRuntime } from "../lib/bun-runtime";
+import { assertSelectedRuntimeWritable, type RuntimePreflightDeps } from "../lib/bun-runtime-preflight";
 import { getConfigDir } from "../config";
 import { readPid, removePid, removeRuntimePort, verifyPidIdentity } from "../config/process-state";
 import { isWslRuntime } from "../codex/home";
@@ -14,16 +16,17 @@ import { assertSchedulerRegistrationBeforeStart } from "./repair";
 import { SERVICE_MANAGED_ENV, TASK, plistPath, removeServiceInstallStateRecords, writeServiceInstallState } from "./state";
 import type { ServiceBackend } from "./state";
 import { unitPath, isSystemd, installSystemd, startSystemd, stopSystemd, statusSystemd, uninstallSystemd, systemdServiceInstallCleanupOps } from "./systemd";
-import { writeWindowsSchedulerAssets, stageWindowsSchedulerRegistrationXml, removeWindowsSchedulerRegistrationStage, registerFreshWindowsSchedulerTask, recordWindowsSchedulerOwnership, removeNativeWindowsServiceForScheduler, installWindows, installWindowsNative, startWindows, isWindowsSchedulerEndBenign, stopWindows, stopWindowsChecked, statusWindows, statusWindowsXml, killWindowsServiceWrapperProcesses, uninstallWindows, classifyWindowsServiceStop } from "./windows-ops";
+import { writeWindowsSchedulerAssets, stageWindowsSchedulerRegistrationXml, removeWindowsSchedulerRegistrationStage, registerFreshWindowsSchedulerTask, recordWindowsSchedulerOwnership, removeNativeWindowsServiceForScheduler, commitWindowsInstall, commitWindowsNativeInstall, type WindowsServiceInstallDeps, startWindows, isWindowsSchedulerEndBenign, stopWindows, stopWindowsChecked, statusWindows, statusWindowsXml, killWindowsServiceWrapperProcesses, uninstallWindows, classifyWindowsServiceStop } from "./windows-ops";
 import { schtasks, probeWindowsSchedulerTask, rollbackWindowsSchedulerTaskOwnedByAttempt, settleDelay } from "./windows-scheduler";
 import type { WindowsSchedulerTaskProbe } from "./windows-scheduler";
 import { windowsTaskRegistrationOwnedByAttempt, windowsTaskRegistrationHealthy } from "./windows-taskxml";
 import { win32 } from "node:path";
 import { launchdGuiDomain } from "./launchd";
 import { LABEL } from "./state";
+import { assertNoDesktopSupervision, createSupervisionLatch, type SupervisionInspector, type SupervisionLatch } from "./desktop-command-guard";
 
 type ServiceOps = {
-  install: () => void | Promise<void>; start: () => void; stop: () => void;
+  install: (runtime: DurableBunRuntime) => void | Promise<void>; start: () => void; stop: () => void;
   status: () => string; uninstall: () => void;
 };
 
@@ -32,18 +35,19 @@ export type ServiceInstallCleanupOps = {
   stop: () => void;
 };
 
-export function platformOps(backend: ServiceBackend = "scheduler"): ServiceOps | null {
-  if (process.platform === "darwin")
+export function platformOps(backend: ServiceBackend = "scheduler", deps: { platform?: NodeJS.Platform; windowsInstall?: WindowsServiceInstallDeps } = {}): ServiceOps | null {
+  const platform = deps.platform ?? process.platform;
+  if (platform === "darwin")
     // Wrapped, not passed: `installLaunchd` reports whether it reloaded launchd, and only
     // `repairService` (for the `restart` verb) has any use for that. `ServiceOps.install` is
     // the generic install seam and deliberately promises nothing about a return value.
     return { install: () => { installLaunchd(); }, start: startLaunchd, stop: stopLaunchd, status: statusLaunchd, uninstall: uninstallLaunchd };
-  if (process.platform === "win32") {
+  if (platform === "win32") {
     if (backend === "native")
-      return { install: installWindowsNative, start: startWinswService, stop: stopWinswService, status: winswStatusSummary, uninstall: uninstallWinswService };
-    return { install: installWindows, start: startWindows, stop: stopWindows, status: statusWindows, uninstall: uninstallWindows };
+      return { install: runtime => commitWindowsNativeInstall(runtime, deps.windowsInstall), start: startWinswService, stop: stopWinswService, status: winswStatusSummary, uninstall: uninstallWinswService };
+    return { install: runtime => commitWindowsInstall(runtime, deps.windowsInstall), start: startWindows, stop: stopWindows, status: statusWindows, uninstall: uninstallWindows };
   }
-  if (process.platform === "linux") {
+  if (platform === "linux") {
     if (existsSync("/.dockerenv")) {
       console.error("Docker detected. Run 'ocx start' directly instead of using the service manager.");
       process.exit(1);
@@ -229,7 +233,9 @@ export async function stopTrackedProxyForServiceCommand(): Promise<TrackedProxyC
   }
 }
 
-export interface ServiceInstallPreparationDeps {
+export interface ServiceInstallPreparationDeps extends RuntimePreflightDeps {
+  inspectSupervision?: SupervisionInspector;
+  supervisionLatch?: SupervisionLatch;
   diagnose?: () => ServiceDiagnostic;
   managerOps?: (backend: ServiceBackend) => ServiceInstallCleanupOps | null;
   stopTrackedProxy?: () => Promise<unknown>;
@@ -245,6 +251,8 @@ export async function prepareServiceInstall(
   requestedBackend: ServiceBackend,
   deps: ServiceInstallPreparationDeps = {},
 ): Promise<void> {
+  const latch = deps.supervisionLatch ?? createSupervisionLatch();
+  assertNoDesktopSupervision(deps.inspectSupervision, latch);
   const diagnostic = (deps.diagnose ?? diagnoseService)();
   const platform = deps.platform ?? process.platform;
   const resolveOps = deps.managerOps ?? platformServiceInstallCleanupOps;
@@ -276,27 +284,35 @@ export async function prepareServiceInstall(
 
 export async function installServiceSafely(
   requestedBackend: ServiceBackend,
-  install: () => void | Promise<void>,
+  install: (runtime: DurableBunRuntime) => void | Promise<void>,
   deps: ServiceInstallPreparationDeps = {},
 ): Promise<void> {
-  await prepareServiceInstall(requestedBackend, deps);
-  await install();
+  const latch = deps.supervisionLatch ?? createSupervisionLatch();
+  assertNoDesktopSupervision(deps.inspectSupervision, latch);
+  const runtime = Object.freeze({ ...(deps.selectRuntime ?? durableBunRuntime)() });
+  const configDir = (deps.configDir ?? getConfigDir)();
+  (deps.assertRuntimeWritable ?? assertSelectedRuntimeWritable)(runtime, configDir, { platform: deps.platform, rootWasAbsent: !existsSync(configDir) });
+  await prepareServiceInstall(requestedBackend, { ...deps, supervisionLatch: latch });
+  assertNoDesktopSupervision(deps.inspectSupervision, latch);
+  await install(runtime);
 }
 
-export interface FreshWindowsSchedulerInstallDeps {
+export interface FreshWindowsSchedulerInstallDeps extends RuntimePreflightDeps {
+  inspectSupervision?: SupervisionInspector;
+  supervisionLatch?: SupervisionLatch;
   stageRegistrationXml?: (attemptNonce: string) => string;
   register?: (xmlPath: string, attemptNonce: string) => Promise<void>;
   recordOwnership?: () => boolean;
   prepare?: () => Promise<void>;
   removeNativeService?: () => void;
-  publishAssets?: () => void;
+  publishAssets?: (runtime: DurableBunRuntime) => void;
   verifyBeforeRun?: (attemptNonce: string) => void | Promise<void>;
   /** Reads the newly registered task; empty or throwing reads are retried before rollback. */
   readSchedulerXml?: () => string;
   /** Bounded wait before retrying an unreadable fresh-install registration. */
   settleSchedulerRead?: (delayMs: number) => void | Promise<void>;
   runTask?: () => void;
-  writeState?: () => void;
+  writeState?: (runtime: DurableBunRuntime) => void;
   rollbackTask?: (attemptNonce: string) => Promise<string | null>;
   removeStagedXml?: (xmlPath: string) => void;
 }
@@ -312,10 +328,14 @@ export interface FreshWindowsSchedulerInstallDeps {
 export async function installFreshWindowsSchedulerSafely(
   deps: FreshWindowsSchedulerInstallDeps = {},
 ): Promise<void> {
+  const latch = deps.supervisionLatch ?? createSupervisionLatch();
+  assertNoDesktopSupervision(deps.inspectSupervision, latch);
   const stage = deps.stageRegistrationXml ?? stageWindowsSchedulerRegistrationXml;
   const register = deps.register ?? registerFreshWindowsSchedulerTask;
   const recordOwnership = deps.recordOwnership ?? recordWindowsSchedulerOwnership;
-  const prepare = deps.prepare ?? (() => prepareServiceInstall("scheduler"));
+  const prepare = deps.prepare ?? (() => prepareServiceInstall("scheduler", {
+    inspectSupervision: deps.inspectSupervision, supervisionLatch: latch,
+  }));
   const removeNativeService = deps.removeNativeService ?? removeNativeWindowsServiceForScheduler;
   const publishAssets = deps.publishAssets ?? writeWindowsSchedulerAssets;
   const verifyBeforeRun = deps.verifyBeforeRun ?? ((nonce: string) => (
@@ -331,7 +351,7 @@ export async function installFreshWindowsSchedulerSafely(
     )
   ));
   const runTask = deps.runTask ?? startWindows;
-  const writeState = deps.writeState ?? (() => writeServiceInstallState("scheduler"));
+  const writeState = deps.writeState ?? ((runtime: DurableBunRuntime) => writeServiceInstallState("scheduler", undefined, {}, runtime));
   const rollbackTask = deps.rollbackTask ?? ((attemptNonce: string) => (
     rollbackWindowsSchedulerTaskOwnedByAttempt(attemptNonce, TASK)
   ));
@@ -341,13 +361,16 @@ export async function installFreshWindowsSchedulerSafely(
 
   let stagedXml: string | null = null;
   const attemptNonce = randomUUID();
-  const configRootWasAbsent = !existsSync(getConfigDir());
+  const configDir = (deps.configDir ?? getConfigDir)();
+  const configRootWasAbsent = !existsSync(configDir);
+  const runtime = Object.freeze({ ...(deps.selectRuntime ?? durableBunRuntime)() });
   let registered = false;
   let started = false;
   try {
     stagedXml = stage(attemptNonce);
     await register(stagedXml, attemptNonce);
     registered = true;
+    assertNoDesktopSupervision(deps.inspectSupervision, latch);
 
     // The destructive boundary begins only after Task Scheduler accepted the definition.
     // The registration has consumed its temporary XML. Remove it before claiming a newly
@@ -361,13 +384,16 @@ export async function installFreshWindowsSchedulerSafely(
         + "aborting before service-manager cleanup or asset publication.",
       );
     }
+    (deps.assertRuntimeWritable ?? assertSelectedRuntimeWritable)(runtime, configDir, { platform: deps.platform, rootWasAbsent: false });
     await prepare();
+    assertNoDesktopSupervision(deps.inspectSupervision, latch);
     removeNativeService();
-    publishAssets();
+    publishAssets(runtime);
     await verifyBeforeRun(attemptNonce);
+    assertNoDesktopSupervision(deps.inspectSupervision, latch);
     runTask();
     started = true;
-    writeState();
+    writeState(runtime);
   } catch (error) {
     const detail = error instanceof Error ? error.message : String(error);
     if (registered && !started) {

package/src/service/ownership-mutation-lease.d.mts

@@ -5,7 +5,7 @@ export interface OwnershipMutationLeaseOptions {
   readonly processAlive?: (pid: number) => boolean;
   readonly beforeRelease?: (lockPath: string) => void;
   readonly joinToken?: string;
-  /** Names the current executable at the recorded PID, identity unverified; defaults to `tasklist` or `ps`. */
+  /** Names the current executable at the recorded PID, identity unverified; uses `ps` on POSIX and omits the default image lookup on Windows. */
   readonly processImage?: (pid: number) => string | null;
 }
 

package/src/service/ownership-mutation-lease.mjs

@@ -112,13 +112,11 @@ function readIncompleteOwner(path) {
 /** The current executable at the recorded PID, identity unverified; null if unreadable within a second. */
 function processImage(pid) {
   try {
-    if (process.platform === "win32") {
-      const listed = spawnSync("tasklist", ["/FI", `PID eq ${pid}`, "/FO", "CSV", "/NH"], {
-        encoding: "utf8", timeout: 1_000, windowsHide: true,
-      });
-      const match = /^"([^"]+)","(\d+)"/.exec((listed.stdout ?? "").trim());
-      return listed.status === 0 && match && Number(match[2]) === pid ? match[1] : null;
-    }
+    // This module also runs in the Node npm/pnpm launcher, before Bun is available.
+    // Without a kernel-backed system-directory resolver, omit the optional Windows
+    // image label rather than searching the caller's directory/PATH or trusting env roots.
+    // PID, liveness, age and lease ownership decisions do not depend on this label.
+    if (process.platform === "win32") return null;
     const listed = spawnSync("ps", ["-o", "comm=", "-p", String(pid)], { encoding: "utf8", timeout: 1_000 });
     const command = (listed.stdout ?? "").trim();
     return listed.status === 0 && command ? basename(command) : null;