@bitkyc08/opencodex 2.84.0 → 2.87.0

package/src/service/launchd.ts

@@ -11,7 +11,7 @@ import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV, durableBunRuntime, type D
 import { serviceApiTokenFilePath } from "../lib/service-secrets";
 import { recordOwnedConfigPath } from "../lib/config-ownership";
 import { writeServiceApiTokenFile, assertLiveServiceManagerAllowed } from "./guards";
-import { resolveServiceListenPort, buildServiceShellCommand, buildServiceLauncherShellCommand, installedServiceListenPort, resolvedProxyEnv } from "./health";
+import { resolveServiceListenPort, buildServiceShellCommand, buildServiceLauncherShellCommand, resolvedProxyEnv } from "./definition";
 import { SERVICE_MANAGED_ENV, LABEL, cliEntry, filterTransientServicePath, logPath, serviceStatePath, currentCodexSqliteHomeAbsolute, type ServiceInstallState, writeServiceInstallState, readServiceInstallState } from "./state";
 import { writeServiceDefinitionFile } from "./windows-ops";
 import { readTextOrNull } from "./windows-taskxml";
@@ -359,8 +359,11 @@ export function probeLaunchdLoadState(deps: {
   for (const domain of [`gui/${uid}`, `user/${uid}`]) {
     const printed = run(["print", `${domain}/${LABEL}`]);
     if (printed.status === 0) {
+      // Use this backend's plist, then the configured service port. Foreign artifacts
+      // can exist on macOS: systemdListenPort has no platform gate, so the general
+      // installed-artifact chain could incorrectly select a copied Linux unit's port.
       const expected = (deps.expectedCommand
-        ?? (() => expectedLaunchdCommand(installedServiceListenPort())))();
+        ?? (() => expectedLaunchdCommand(launchdListenPort() ?? resolveServiceListenPort())))();
       const printedText = `${printed.stdout}\n${printed.stderr}`;
       return {
         state: printedText.includes(expected) ? "loaded-current" : "loaded-stale",
@@ -382,8 +385,16 @@ export function probeLaunchdLoadState(deps: {
   return { state: "not-loaded" };
 }
 
-/** Up to ~5 × 200 ms, the launchd twin of the Windows scheduler settle delays. */
-const LAUNCHD_SETTLE_ATTEMPTS = 5;
+/**
+ * Up to 125 × 200 ms = 25 s: long enough for an evicted job to finish EXITING. Measured on
+ * macOS 26: `bootout` returns at once, the label stays registered (`state = SIGTERMed`) until
+ * the process exits, and `bootstrap` fails with 5 for that whole window. The proxy drains on
+ * SIGTERM (`shutdownTimeoutMs`, 5 s default) behind a launcher that waits for it, so a 1 s
+ * settle bootstrapped into that window, the retry and the rollback raced it too, and the old
+ * job then exited leaving nothing loaded. launchd SIGKILLs at its default `ExitTimeOut` of
+ * 20 s, which bounds this wait.
+ */
+const LAUNCHD_SETTLE_ATTEMPTS = 125;
 
 const LAUNCHD_SETTLE_DELAY_MS = 200;
 
@@ -769,6 +780,7 @@ export function restartLaunchdJob(deps: {
 export function startLaunchd(deps: {
   launchctl?: typeof runLaunchctl;
   matches?: typeof launchdJobMatchesPlist;
+  readPlist?: () => string;
 } = {}): void {
   const run = deps.launchctl ?? runLaunchctl;
   const p = plistPath();
@@ -778,16 +790,24 @@ export function startLaunchd(deps: {
   // already be bootstrapped from THIS plist, which is a no-op rather than an error.
   // `install` can assume a stale job (it just rewrote the plist); `start` cannot, and
   // throwing here would break `ocx service start` on every healthy service.
+  // A live job can outlast its deleted or unreadable plist. Only a readable
+  // definition can justify the no-op; use the same snapshot for port parsing.
+  let plist: string | null;
+  try { plist = (deps.readPlist ?? (() => readFileSync(p, "utf8")))(); }
+  catch { plist = null; }
+  // Match the same launchd-only port choice as probeLaunchdLoadState above.
   const live = (deps.matches ?? launchdJobMatchesPlist)(
-    expectedLaunchdCommand(installedServiceListenPort()),
+    expectedLaunchdCommand(launchdListenPort({ readPlist: () => plist ?? "" }) ?? resolveServiceListenPort()),
   );
-  if (live.loaded && live.matchesPlist) {
+  if (plist !== null && live.loaded && live.matchesPlist) {
     console.log("ℹ️  service was already loaded from the current plist; nothing to do.");
     return;
   }
   throw new Error(
     `launchctl could not load ${p}: ${loaded.stderr || "load reported failure"}\n`
-    + (live.loaded
+    + (plist === null
+      ? "The service plist is missing or unreadable. Run 'ocx service repair' to restore it."
+      : live.loaded
       ? `launchd is running an OLDER plist. Fix:\n  launchctl bootout ${launchdGuiDomain()}/${LABEL}\n  ocx service repair`
       : "The job is not loaded. Run 'ocx service repair' to reload it."),
   );

package/src/service/logging.ts

@@ -0,0 +1,135 @@
+import { closeSync, constants, fstatSync, fsyncSync, ftruncateSync, lstatSync, openSync, readSync, realpathSync, renameSync, statSync, writeSync, type BigIntStats } from "node:fs";
+import { formatWithOptions } from "node:util";
+import { basename, dirname, join } from "node:path";
+import { recordOwnedConfigPath } from "../lib/config-ownership";
+
+export const SERVICE_LOG_MAX_BYTES = 20 * 1024 * 1024;
+export const SERVICE_LOG_CHECK_INTERVAL_MS = 60_000;
+
+function regularLeaf(path: string): BigIntStats | undefined {
+  try {
+    const info = lstatSync(path, { bigint: true });
+    if (!info.isFile() || info.nlink !== 1n || info.ino === 0n) throw new Error("Unsafe service log leaf");
+    return info;
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return undefined;
+    throw error;
+  }
+}
+
+function sameFile(left: BigIntStats | undefined, right: BigIntStats | undefined): boolean {
+  return left !== undefined && right !== undefined && left.dev === right.dev && left.ino === right.ino;
+}
+
+function matchesDescriptor(path: string, fd: number, expected: BigIntStats): boolean {
+  const info = fstatSync(fd, { bigint: true });
+  return info.isFile() && info.nlink === 1n && sameFile(expected, info)
+    && sameFile(info, regularLeaf(path));
+}
+
+/** Preserve the manager's open append descriptor; retain at most two bounded archives. */
+export function rotateServiceLog(requestedPath: string, maxBytes = SERVICE_LOG_MAX_BYTES): boolean {
+  let source: number | undefined;
+  let archive: number | undefined;
+  try {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes <= 0) return false;
+    // Resolve only the parent: exclusive creation through a Windows junction
+    // can report EEXIST for a missing leaf. Never resolve away a leaf symlink.
+    const parent = dirname(requestedPath);
+    const directory = statSync(parent, { bigint: true });
+    if (!directory.isDirectory() || directory.ino === 0n) return false;
+    const canonicalParent = realpathSync(parent);
+    const path = join(canonicalParent, basename(requestedPath));
+    const sameDirectory = () => {
+      const alias = statSync(parent, { bigint: true });
+      const canonical = statSync(canonicalParent, { bigint: true });
+      return alias.isDirectory() && canonical.isDirectory()
+        && sameFile(directory, alias) && sameFile(directory, canonical);
+    };
+    const matches = (suffix: string, fd: number, expected: BigIntStats) => sameDirectory()
+      && matchesDescriptor(`${path}${suffix}`, fd, expected)
+      && matchesDescriptor(`${requestedPath}${suffix}`, fd, expected);
+    if (!sameDirectory()) return false;
+    const original = regularLeaf(requestedPath);
+    if (!original) return false;
+    // Windows does not expose O_NOFOLLOW: descriptor/leaf identity checks still
+    // apply there. Do not reject legitimate junctions in the home path.
+    const guardedFlags = process.platform === "win32" ? 0 : constants.O_NOFOLLOW | constants.O_NONBLOCK;
+    source = openSync(path, constants.O_RDWR | guardedFlags);
+    if (!matches("", source, original)) return false;
+    const size = Number(fstatSync(source, { bigint: true }).size);
+    if (!Number.isSafeInteger(size) || size <= maxBytes) return false;
+    const previous = regularLeaf(`${path}.1`);
+    const oldest = regularLeaf(`${path}.2`);
+    if (!matches("", source, original)) return false;
+    if (previous) {
+      if (!sameFile(previous, regularLeaf(`${path}.1`))) return false;
+      const currentOldest = regularLeaf(`${path}.2`);
+      if (oldest ? !sameFile(oldest, currentOldest) : currentOldest !== undefined) return false;
+      if (!sameDirectory()) return false;
+      renameSync(`${path}.1`, `${path}.2`);
+      if (!sameFile(previous, regularLeaf(`${path}.2`))) return false;
+    }
+    // Never truncate an existing archive, even if another rotation or a path
+    // replacement wins the gap after rename. Failure leaves the source intact.
+    if (!sameDirectory()) return false;
+    archive = openSync(`${path}.1`, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | guardedFlags, 0o600);
+    const created = fstatSync(archive, { bigint: true });
+    if (!matches(".1", archive, created)) return false;
+    // A legacy unbounded file may be huge. Copy only its newest cap-sized tail,
+    // using fixed memory, before truncating the original inode.
+    const buffer = Buffer.alloc(Math.min(64 * 1024, maxBytes));
+    let position = size - maxBytes;
+    while (position < size) {
+      const read = readSync(source, buffer, 0, Math.min(buffer.length, size - position), position);
+      if (read === 0) return false;
+      let written = 0;
+      while (written < read) {
+        if (!matches(".1", archive, created)) return false;
+        const count = writeSync(archive, buffer, written, read - written);
+        if (count === 0) return false;
+        written += count;
+      }
+      position += read;
+    }
+    fsyncSync(archive);
+    // Revalidate both names and open objects at the destructive boundary. These
+    // checks detect observed replacement; they are not an atomic namespace lock.
+    if (!matches(".1", archive, created)
+      || !matches("", source, original)) return false;
+    ftruncateSync(source, 0);
+    return true;
+  } catch {
+    return false; // Missing files, permissions and disk failures must never stop the service.
+  } finally {
+    for (const fd of [archive, source]) {
+      if (fd !== undefined) try { closeSync(fd); } catch { /* best-effort */ }
+    }
+  }
+}
+
+/** One sink wrapper covers startup, provider diagnostics and multiline errors. */
+export function startServiceLogging(
+  path: string,
+  env: NodeJS.ProcessEnv = process.env,
+  intervalMs = SERVICE_LOG_CHECK_INTERVAL_MS,
+): () => void {
+  if (!env.OCX_SERVICE) return () => {};
+  const restore: (() => void)[] = [];
+  for (const method of ["log", "info", "debug", "warn", "error"] as const) {
+    const original = console[method];
+    console[method] = (...args: unknown[]) => {
+      const at = new Date().toISOString();
+      const line = formatWithOptions({ colors: false }, ...args);
+      original.call(console, line.split("\n").map(part => `${at} ${part}`).join("\n"));
+    };
+    restore.push(() => { console[method] = original; });
+  }
+  try {
+    for (const suffix of [".1", ".2"]) recordOwnedConfigPath(dirname(path), `${path}${suffix}`);
+  } catch { /* ownership bookkeeping must not break logging */ }
+  rotateServiceLog(path);
+  const timer = setInterval(() => { rotateServiceLog(path); }, intervalMs);
+  timer.unref();
+  return () => { clearInterval(timer); for (const reset of restore) reset(); };
+}

package/src/service/repair.ts

@@ -6,7 +6,8 @@ import { randomUUID } from "node:crypto";
 import { defaultWinswEntry, installWinswService } from "../lib/winsw";
 import { resolveWindowsTaskDiagnosticUserId, diagnoseService } from "./diagnostics";
 import type { ServiceDiagnostic } from "./diagnostics";
-import { assertServiceEnvironmentMatchesInstall, assertServiceAuthEnvironment } from "./guards";
+import { assertServiceAuthEnvironment } from "./auth-preflight";
+import { assertServiceEnvironmentMatchesInstall } from "./guards";
 import { installLaunchd, restartLaunchdJob } from "./launchd";
 import type { LaunchdInstallOutcome } from "./launchd";
 import { TASK, writeServiceInstallState, serviceSourceDir, resolveServiceOwnership, serviceLauncherPathDiagnostic } from "./state";

package/src/service/state.ts

@@ -172,20 +172,19 @@ function defaultOpenCodexHome(): string {
 }
 
 export function serviceStatePathsForOpenCodexHome(opencodexHome: string): string[] {
-  return serviceStateFilesFor(opencodexHome, defaultOpenCodexHome());
+  // Bun caches the startup home: parallel workers inherit the wrapper's HOME even
+  // after the preload gives each one a sandbox. Tests must not share that mirror,
+  // including serial cases that select different OPENCODEX_HOME fixtures.
+  return serviceStateFilesFor(opencodexHome, isTestHomeGuardArmed() ? opencodexHome : defaultOpenCodexHome());
 }
 
 export function serviceStatePaths(): string[] {
   const paths = serviceStatePathsForOpenCodexHome(currentOpenCodexHome());
   if (!isTestHomeGuardArmed()) return paths;
   /*
-   * Under an armed test process the legacy default-home entry IS the developer's real
-   * `~/.opencodex/service-state.json`. It is there so an install made before
-   * OPENCODEX_HOME was set can still be found, but it means a test whose OPENCODEX_HOME
-   * points at a sandbox still writes their live install state — observed while building
-   * the launchd repair coverage: one case replaced the real record's codexHome and
-   * opencodexHome with temp-directory paths. Drop it rather than deny the write, so the
-   * sandbox path keeps working and the real one is simply not in the list.
+   * The test resolver omits the legacy mirror; still reject an explicit or fallback
+   * OPENCODEX_HOME that names the developer's real home. A missing fixture pin must
+   * never allow a test to read or replace their live service installation.
    *
    * The predicate is the guard's own, not a local `resolve()` compare: the guard
    * canonicalizes through `realpath`, and on macOS a sandbox under `/var/folders/...`

package/src/service/systemd.ts

@@ -8,7 +8,7 @@ import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV, durableBunRuntime, type D
 import { recordOwnedConfigPath } from "../lib/config-ownership";
 import { systemdProperty } from "../service-manager-probe";
 import { writeServiceApiTokenFile, sh } from "./guards";
-import { shellQuote, buildServiceShellCommand, buildServiceLauncherShellCommand, resolvedProxyEnv } from "./health";
+import { shellQuote, buildServiceShellCommand, buildServiceLauncherShellCommand, resolvedProxyEnv } from "./definition";
 import type { ServiceInstallCleanupOps } from "./orchestration";
 import { SERVICE_MANAGED_ENV, TASK, cliEntry, filterTransientServicePath, stableLauncherEntry, logPath, serviceStatePath, currentCodexSqliteHomeAbsolute, writeServiceInstallState } from "./state";
 import { writeServiceDefinitionFile } from "./windows-ops";

package/src/service/windows-guarded-manager.ts

@@ -29,7 +29,8 @@ import { cachedCurrentWindowsIdentity, resolveCurrentWindowsPrincipal, WINDOWS_P
 import { statusWinswRaw, winswExePath, WINSW_SERVICE_ID, type WinswStatus } from "../lib/winsw";
 import type { GuardedManagerStopped, GuardedManagerTarget } from "./guarded-manager-target";
 import { TASK, windowsLauncherVbsPath, windowsServiceScriptPath } from "./state";
-import { probeWindowsSchedulerTask, querySchtasks, windowsWscript, type WindowsSchedulerTaskProbe } from "./windows-scheduler";
+import { probeWindowsSchedulerTask, querySchtasks, type WindowsSchedulerTaskProbe } from "./windows-scheduler";
+import { windowsWscript } from "./windows-wscript";
 import { windowsTaskRegistrationHealthy, windowsTaskRegistrationRefreshableLegacy } from "./windows-taskxml";
 
 /** Runtime table of one Win32 process; a null parent means the chain is unreadable. */

package/src/service/windows-ops.ts

@@ -5,7 +5,7 @@ import { winswXmlPath } from "../lib/winsw";
 import { hardenSecretPath } from "../lib/windows-secret-acl";
 import { durableBunRuntime, type DurableBunRuntime } from "../lib/bun-runtime";
 import { assertSelectedRuntimeWritable, type RuntimePreflightDeps } from "../lib/bun-runtime-preflight";
-import { parseBakedListenPort } from "./health";
+import { parseBakedListenPort } from "./definition";
 import { windowsServiceScriptPath } from "./state";
 import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, mkdtempSync, rmdirSync, unlinkSync } from "node:fs";

package/src/service/windows-scheduler.ts

@@ -1,7 +1,6 @@
 import { execFileSync } from "node:child_process";
 import { findLiveProxy } from "../server/proxy-liveness";
 import { existsSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
 import { randomUUID } from "node:crypto";
 import { ELEVATION_REQUEST_TIMEOUT_MS, OCX_ELEVATED_PROTOCOL_FAILED, raceWithTimeout, resolveTrustedWindowsSchtasksExe, startElevatedSchtasksCreateAndRun, runWindowsElevated, toWindowsSchtasksError, WindowsElevationError, type ElevatedSchedulerOutcome, type ElevatedSchtasksCreateAndRunExecution, type ElevatedSchtasksCreateAndRunResult } from "../lib/windows-elevation";
 import { statusWinswRaw } from "../lib/winsw";
@@ -10,9 +9,10 @@ import { isTestHomeGuardArmed } from "../lib/test-home-guard";
 import { TASK, windowsServiceScriptPath, windowsLauncherVbsPath, windowsTaskXmlPath, writeServiceInstallState } from "./state";
 import { buildWindowsSchtasksCreateArgs, windowsTaskRegistrationOwnedByAttempt, windowsTaskRegistrationHealthy } from "./windows-taskxml";
 import type { ExpectedWindowsTaskUserId } from "./windows-taskxml";
-import { win32 } from "node:path";
 import { WINSW_SERVICE_ID } from "../lib/winsw";
 
+export { windowsWscript } from "./windows-wscript";
+
 /**
  * Decode schtasks stdout. `/query /xml` emits UTF-16LE (often with BOM) because the
  * registered task document is UTF-16; reading that as UTF-8 makes every health check
@@ -69,11 +69,6 @@ function windowsSchtasks(): string {
   return resolveTrustedWindowsSchtasksExe();
 }
 
-export function windowsWscript(): string {
-  const candidate = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "wscript.exe");
-  return existsSync(candidate) ? candidate : "wscript.exe";
-}
-
 let querySchtasksForTests: ((args: string[]) => string) | null = null;
 
 export function querySchtasks(args: string[]): string {

package/src/service/windows-taskxml.ts

@@ -1,14 +1,14 @@
 import { WINDOWS_WRAPPER_PROTOCOL_ENV, WINDOWS_WRAPPER_STAY_OUT_EXIT_CODE } from "./windows-wrapper-exit";
 import { readFileSync } from "node:fs";
 import { TASK, windowsServiceScriptPath, windowsLauncherVbsPath, windowsTaskXmlPath } from "./state";
-import { windowsWscript } from "./windows-scheduler";
+import { windowsWscript } from "./windows-wscript";
 import { join } from "node:path";
 import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV } from "../lib/bun-runtime";
 import { REAL_BUN_MIN_BYTES } from "../lib/bun-binary-validator.mjs";
 import { serviceApiTokenFilePath } from "../lib/service-secrets";
 import { windowsEnvIndirectBatchPathList, windowsEnvIndirectBatchValue } from "../lib/win-paths";
 import { cachedCurrentWindowsIdentity, resolveCurrentWindowsPrincipal, WINDOWS_PRINCIPAL_LOOKUP_TIMEOUT_MS } from "../lib/windows-user-principal";
-import { resolveServiceListenPort, resolvedProxyEnv } from "./health";
+import { resolveServiceListenPort, resolvedProxyEnv } from "./definition";
 import { cliEntry, filterTransientServicePath, serviceLogPath, currentCodexSqliteHomeAbsolute } from "./state";
 
 function windowsBatchValue(value: string): string {

package/src/service/windows-wscript.ts

@@ -0,0 +1,14 @@
+/**
+ * The `wscript.exe` the Task Scheduler XML must name.
+ *
+ * Leaf module on purpose: `windows-taskxml.ts` needs it to render the task document,
+ * and taking it from `windows-scheduler.ts` made the two one cyclic component.
+ * `windows-scheduler` owns the schtasks process surface, not this one path lookup.
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+
+export function windowsWscript(): string {
+  const candidate = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "wscript.exe");
+  return existsSync(candidate) ? candidate : "wscript.exe";
+}

package/src/service.ts

@@ -13,8 +13,10 @@ export { acquireOwnershipMutationLease, withOwnershipMutationLease } from "./ser
 export type { ManagingCliRole, ManagingCliObservation, RegisteredManagingCliInvocation, ServiceTakeoverCompatibilityInput, ServiceTakeoverCompatibility } from "./service/ownership-compatibility";
 export { registeredManagingCliInvocation, assessServiceTakeoverCompatibility, sameServiceTakeoverCompatibility } from "./service/ownership-compatibility";
 export type { ServiceApiTokenOrigin, ProvisionedServiceApiToken } from "./service/guards";
-export { ServiceOwnershipError, isServiceOwnershipError, serviceEnvironmentOwnedHere, assertServiceEnvironmentMatchesInstall, serviceRetryCommand, assertNotAdminToken, assertServiceAuthEnvironment, writeServiceApiTokenFile, assertLiveServiceManagerAllowed } from "./service/guards";
-export { resolveServiceListenPort, installedServiceListenPort, SERVICE_INSTALL_HEALTH_MS, SERVICE_INSTALL_HEALTH_WINDOWS_MS, serviceInstallHealthMs, confirmServiceServing, reportServiceServing, resolvedProxyEnv } from "./service/health";
+export { ServiceOwnershipError, isServiceOwnershipError, serviceEnvironmentOwnedHere, assertServiceEnvironmentMatchesInstall, assertNotAdminToken, writeServiceApiTokenFile, assertLiveServiceManagerAllowed } from "./service/guards";
+export { serviceRetryCommand, assertServiceAuthEnvironment } from "./service/auth-preflight";
+export { resolveServiceListenPort, resolvedProxyEnv } from "./service/definition";
+export { installedServiceListenPort, SERVICE_INSTALL_HEALTH_MS, SERVICE_INSTALL_HEALTH_WINDOWS_MS, serviceInstallHealthMs, confirmServiceServing, reportServiceServing } from "./service/health";
 export type { LaunchdLoadState, LaunchdLoadProbe, LaunchdInstallOutcome } from "./service/launchd";
 export { buildPlist, reusePreviousPlistPathVariable, expectedLaunchdCommand, launchdListenPort, runLaunchctl, launchctlLoadFailed, launchdJobMatchesPlist, launchdEvictionTargets, probeLaunchdLoadState, installLaunchd, restartLaunchdJob, startLaunchd } from "./service/launchd";
 export { systemdListenPort, buildUnit, systemdNeedsDaemonReload, uninstallSystemd, systemdServiceInstallCleanupOps } from "./service/systemd";

package/src/sidecar/auth.ts

@@ -134,6 +134,8 @@ function findAnthropicAuthProvider(
     // its token path and the token guardian refuse an unmarked row of that name, so offering such a
     // custom row here would advertise credentials no helper executor will spend.
     if (providerName === "anthropic2") continue;
+    // The DSH account token is pinned to its own adapter and DeepSeek host; no helper may spend it.
+    if (providerName === "dsh-account") continue;
     if (provider.disabled === true) continue;
     if (provider.adapter !== "anthropic" || provider.authMode !== "oauth") continue;
     const set = getAccountSet(providerName);

package/src/tray/windows-tray.ps1

@@ -201,14 +201,10 @@ function Start-StartupHealthProbe {
     if ($null -ne $script:startupProbeProcess) {
       # Process.Start succeeded but the async pipe setup failed: Dispose alone
       # would leave the Bun child running, so terminate it before cleanup.
-      try {
-        $script:startupProbeProcess.Kill()
-        [void]$script:startupProbeProcess.WaitForExit(3000)
-      } catch {
-        Write-ActionLog "startup-health probe launch cleanup failed: $($_.Exception.GetType().Name)"
-      }
+      Stop-StartupHealthProbe
+    } else {
+      Complete-StartupHealthProbe
     }
-    Complete-StartupHealthProbe
   }
 }
 
@@ -217,8 +213,11 @@ function Complete-StartupHealthProbe {
   $script:startupProbeProcess = $null
   $script:startupProbeOutputTask = $null
   $script:startupProbeErrorTask = $null
+  $script:startupProbeTerminating = $false
   if ($null -ne $process) {
     try {
+      $process.StandardOutput.Dispose()
+      $process.StandardError.Dispose()
       $process.Dispose()
     } catch {
       Write-ActionLog "startup-health probe dispose failed: $($_.Exception.GetType().Name)"
@@ -226,6 +225,31 @@ function Complete-StartupHealthProbe {
   }
 }
 
+function Stop-StartupHealthProbe([switch]$Shutdown) {
+  if ($null -eq $script:startupProbeProcess) { return }
+  $script:startupProbeTerminating = $true
+  try {
+    if (-not $script:startupProbeProcess.HasExited) { $script:startupProbeProcess.Kill() }
+  } catch { Write-ActionLog "startup-health probe kill failed: $($_.Exception.GetType().Name)" }
+  if ($Shutdown) {
+    # Shutdown alone may wait. Timeout ticks keep the child tracked until actual exit.
+    try { [void]$script:startupProbeProcess.WaitForExit(500) } catch { $null = $_ }
+    $exited = $false
+    try { $exited = $script:startupProbeProcess.HasExited } catch { $null = $_ }
+    if ($exited) {
+      # Exit does not mean both pipe readers finished; give them the same bounded wait.
+      $readers = @($script:startupProbeOutputTask, $script:startupProbeErrorTask) | Where-Object { $null -ne $_ }
+      if ($readers.Count -gt 0) {
+        try { [void][System.Threading.Tasks.Task]::WaitAll([System.Threading.Tasks.Task[]]$readers, 500) } catch { $null = $_ }
+      }
+      Complete-StartupHealthProbe
+    } else {
+      # Releasing the only reference would orphan a live child; keep it tracked.
+      Write-ActionLog "startup-health probe still running at shutdown; leaving it tracked"
+    }
+  }
+}
+
 function Initialize-UpdateBadgeReader {
   if (([System.Management.Automation.PSTypeName]"TrayUpdateBadgeReader").Type) { return }
   Add-Type -TypeDefinition @'
@@ -433,6 +457,7 @@ $script:startupRefreshMs = 20000L
 $script:startupProbeProcess = $null
 $script:startupProbeOutputTask = $null
 $script:startupProbeErrorTask = $null
+$script:startupProbeTerminating = $false
 $script:startupProbeStarted = 0L
 $script:startupProbeTimeoutMs = 30000L
 $script:updateAvailable = $false
@@ -520,10 +545,16 @@ function Update-TrayState {
     try {
       $probeExited = $script:startupProbeProcess.HasExited
     } catch {
-      $probeExited = $true
+      # Failed inspection is not proof of exit; keep ownership and request termination.
+      Stop-StartupHealthProbe
     }
     $probeTimedOut = ($now - $script:startupProbeStarted) -gt $script:startupProbeTimeoutMs
-    if ($probeExited -and $null -ne $script:startupProbeOutputTask -and $script:startupProbeOutputTask.IsCompleted) {
+    $probeDrained = ($null -eq $script:startupProbeOutputTask -or $script:startupProbeOutputTask.IsCompleted) -and
+      ($null -eq $script:startupProbeErrorTask -or $script:startupProbeErrorTask.IsCompleted)
+    if ($script:startupProbeTerminating) {
+      if ($probeExited -and $probeDrained) { Complete-StartupHealthProbe }
+      elseif (-not $probeExited) { Stop-StartupHealthProbe }
+    } elseif ($probeExited -and $probeDrained -and $null -ne $script:startupProbeOutputTask) {
       $probeStartup = $null
       try {
         $probeStartup = Parse-StartupHealthText $script:startupProbeOutputTask.Result
@@ -537,14 +568,8 @@ function Update-TrayState {
       # A hung diagnostic must not survive its refresh slot: terminate it so the
       # next refresh cannot stack another orphaned Bun process behind it.
       Write-ActionLog "startup-health probe timed out; terminating it"
-      try {
-        $script:startupProbeProcess.Kill()
-        [void]$script:startupProbeProcess.WaitForExit(3000)
-      } catch {
-        Write-ActionLog "startup-health probe kill failed: $($_.Exception.GetType().Name)"
-      }
+      Stop-StartupHealthProbe
       $script:startupHealth = $null
-      Complete-StartupHealthProbe
       $script:startupHealthCheckedAt = $now
     }
   }
@@ -710,14 +735,8 @@ try {
     # A probe still running when the tray shuts down would outlive it: Dispose()
     # releases the handle but does not terminate the child, so kill the active
     # probe, wait briefly for exit, then release the probe state.
-    try {
-      Write-ActionLog "terminating active startup-health probe on tray shutdown"
-      $script:startupProbeProcess.Kill()
-      [void]$script:startupProbeProcess.WaitForExit(3000)
-    } catch {
-      Write-ActionLog "startup-health probe shutdown kill failed: $($_.Exception.GetType().Name)"
-    }
-    Complete-StartupHealthProbe
+    Write-ActionLog "terminating active startup-health probe on tray shutdown"
+    Stop-StartupHealthProbe -Shutdown
   }
   Stop-UpdateBadgeProbe -Shutdown
   $notify.Dispose()