@iislee/opencodex 2.11.0 → 2.31.0

package/src/lib/windows-service-wrappers.ts

@@ -0,0 +1,72 @@
+/**
+ * Shared termination of surviving Windows scheduler launcher/wrapper processes.
+ *
+ * `schtasks /end` ends the task instance but often leaves wscript/cmd running the
+ * `:loop` batch, which brings the proxy back during a stop, a restart, or
+ * post-update reclaim. Both the service teardown path and the update job need
+ * that guarantee, and they used to carry a copy each.
+ *
+ * The copies drifted in both directions, which is why this module exists rather
+ * than a second careful implementation: the updater received the #1589 argv
+ * cleanup that service.ts missed, and service.ts received the canonical-path
+ * scoping the updater missed. One of those gaps could force-terminate a wrapper
+ * belonging to a DIFFERENT OpenCodex home.
+ *
+ * Matching is scoped to the CANONICAL paths of one installation, never a bare
+ * filename, and the path must appear as a COMPLETE command-line token
+ * (wscript.exe spawns the .vbs as an argument; cmd.exe /c runs the .cmd). A
+ * substring match is excluded: an unrelated process whose command line merely
+ * contains the filename, and a wrapper under another home whose path ends with
+ * the same name, must both survive.
+ */
+import { spawnSync } from "node:child_process";
+
+import { resolveTrustedWindowsPowerShellExe } from "./windows-elevation";
+
+/** Quote for PowerShell: single-quote the value and double any embedded quote. */
+function quoteForPowerShell(value: string): string {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+
+/**
+ * The PowerShell that finds and stops the wrappers for exactly these paths.
+ * Exported for tests: the matching rule is the whole point of this module, and
+ * the spawn itself is best-effort and unobservable.
+ */
+export function windowsWrapperKillScript(paths: readonly string[]): string {
+  return [
+    `$pats = @(${paths.map(quoteForPowerShell).join(", ")});`,
+    "Get-CimInstance Win32_Process | Where-Object {",
+    "  if ($_.ProcessId -eq $PID) { return $false };",
+    "  $c = $_.CommandLine; if (-not $c) { return $false };",
+    "  foreach ($p in $pats) {",
+    "    $i = $c.IndexOf($p, [System.StringComparison]::OrdinalIgnoreCase);",
+    "    if ($i -lt 0) { continue };",
+    "    $before = if ($i -gt 0) { $c.Substring($i - 1, 1) } else { ' ' };",
+    "    $end = $i + $p.Length;",
+    "    $after = if ($end -lt $c.Length) { $c.Substring($end, 1) } else { ' ' };",
+    "    if ($before -match '[\\s\"'']' -and $after -match '[\\s\"'']') { return $true };",
+    "  };",
+    "  $false",
+    "} | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }",
+  ].join(" ");
+}
+
+/**
+ * Best-effort: never throws, never reports. A wrapper that survives is handled
+ * by the caller's own stop verification.
+ */
+export function killWindowsSchedulerWrappers(paths: {
+  scriptPath: string;
+  launcherPath: string;
+}): void {
+  if (process.platform !== "win32") return;
+  try {
+    spawnSync(resolveTrustedWindowsPowerShellExe(), [
+      // No `-WindowStyle Hidden` here: Bun 1.3.14 can fail that direct CLI pair
+      // before the command runs (#1589). `windowsHide` below is sufficient.
+      "-NoProfile", "-NoLogo", "-NonInteractive",
+      "-Command", windowsWrapperKillScript([paths.scriptPath, paths.launcherPath]),
+    ], { stdio: "ignore", timeout: 5000, windowsHide: true });
+  } catch { /* best-effort */ }
+}

package/src/lib/windows-text.ts

@@ -0,0 +1,106 @@
+/**
+ * Decode bounded text emitted by Windows system tools.
+ *
+ * [Decision Log]
+ * - Purpose: preserve non-ASCII paths when a Windows tool writes the active
+ *   legacy code page instead of UTF-8.
+ * - Existing constraint: generated service assets may be UTF-16, while
+ *   redirected `schtasks` output follows the Windows locale on affected hosts.
+ * - Alternatives considered: replacement-character heuristics and a new
+ *   iconv dependency. The former can reinterpret valid text; the latter widens
+ *   the install/security surface for two small, already-supported codecs.
+ * - Choice: recognize UTF-16 first, accept only strict UTF-8 next, then use the
+ *   locale-appropriate WHATWG decoder (CP949 through `euc-kr`, or Windows-1252
+ *   only for locales that actually use that family). Unknown/unsupported
+ *   locales fail back to the old replacement-preserving UTF-8 result instead
+ *   of guessing another code page or throwing in diagnostics.
+ * - Impact: decoding stays dependency-free and bounded, but this deliberately
+ *   does not guess arbitrary OEM code pages that the runtime cannot identify.
+ */
+
+function trimWindowsText(value: string): string {
+  return value.replace(/^\uFEFF/, "").trim();
+}
+
+function currentWindowsLocale(): string {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().locale;
+  } catch {
+    return "en-US";
+  }
+}
+
+function decodeStrict(buffer: Uint8Array, encoding: string): string | null {
+  try {
+    return trimWindowsText(new TextDecoder(encoding, { fatal: true }).decode(buffer));
+  } catch {
+    return null;
+  }
+}
+
+function decodeUtf16Be(buffer: Uint8Array): string {
+  const payloadLength = buffer.length - 2;
+  const swapped = Buffer.alloc(payloadLength - (payloadLength % 2));
+  for (let i = 2; i + 1 < buffer.length; i += 2) {
+    swapped[i - 2] = buffer[i + 1]!;
+    swapped[i - 1] = buffer[i]!;
+  }
+  return trimWindowsText(swapped.toString("utf16le"));
+}
+
+/**
+ * CP949 is exposed by the Encoding Standard under the `euc-kr` label. Keep the
+ * Western fallback deliberately narrow: treating CP932, CP1250, or CP1251
+ * bytes as Windows-1252 can fabricate a different valid-looking filesystem
+ * path, which is worse than the previous replacement-character refusal.
+ */
+function legacyEncodingForLocale(locale: string): "euc-kr" | "windows-1252" | null {
+  const language = locale.trim().split(/[-_]/, 1)[0]?.toLowerCase();
+  if (language === "ko") return "euc-kr";
+  if (language && WINDOWS_1252_LANGUAGES.has(language)) return "windows-1252";
+  return null;
+}
+
+const WINDOWS_1252_LANGUAGES = new Set([
+  "af", "br", "ca", "co", "cy", "da", "de", "en", "es", "eu", "fi", "fo", "fr",
+  "ga", "gd", "gl", "id", "is", "it", "lb", "ms", "nl", "no", "oc", "pt", "sq",
+  "sv", "sw",
+]);
+
+export interface WindowsTextDecodeOptions {
+  /** Test seam and explicit locale override; production uses the active Intl locale. */
+  readonly locale?: string;
+}
+
+export function decodeWindowsTextBytes(
+  buffer: Uint8Array,
+  options: WindowsTextDecodeOptions = {},
+): string {
+  if (buffer.length === 0) return "";
+
+  const bomUtf16Le = buffer.length >= 2 && buffer[0] === 0xff && buffer[1] === 0xfe;
+  const bomUtf16Be = buffer.length >= 2 && buffer[0] === 0xfe && buffer[1] === 0xff;
+  const looksUtf16Le = buffer.length >= 4
+    && buffer[1] === 0x00
+    && buffer[3] === 0x00
+    && buffer[0] !== 0x00;
+
+  if (bomUtf16Le || looksUtf16Le) {
+    return trimWindowsText(Buffer.from(buffer).toString("utf16le"));
+  }
+  if (bomUtf16Be) return decodeUtf16Be(buffer);
+
+  const utf8 = decodeStrict(buffer, "utf-8");
+  if (utf8 !== null) return utf8;
+
+  const locale = options.locale ?? currentWindowsLocale();
+  const legacyEncoding = legacyEncodingForLocale(locale);
+  if (legacyEncoding !== null) {
+    const legacy = decodeStrict(buffer, legacyEncoding);
+    if (legacy !== null) return legacy;
+  }
+
+  // Preserve the previous fail-soft behavior when the runtime lacks a codec or
+  // the bytes are malformed even for the selected Windows code page.
+  return trimWindowsText(new TextDecoder("utf-8").decode(buffer));
+}

package/src/lib/windows-user-principal.ts

@@ -0,0 +1,341 @@
+/**
+ * Resolve the effective Windows token to the locale-independent SID form that
+ * icacls accepts ("*S-1-..."). Environment values such as USERDOMAIN are not
+ * an authority for the current token: on workgroup machines USERDOMAIN may be
+ * the literal WORKGROUP even though the account belongs to the local computer.
+ *
+ * There is deliberately NO name-shaped fallback. A `DOMAIN\User` string has a
+ * valid shape, but shape is not evidence that the account is the current
+ * token's subject, and both environment variables are writable by whatever
+ * launched us. A wrong principal here is not cosmetic: `runIcacls` grants it
+ * Full Control and then removes inheritance, so a wrong grant either leaves a
+ * different account holding the secret or strands the file with no usable ACE.
+ * When the SID cannot be resolved, the caller declines to touch the ACL at all.
+ *
+ * Budget caveat: callers pass their REMAINING harden budget, which becomes the
+ * child process timeout. Trusted-executable resolution (a `GetSystemDirectoryW`
+ * FFI call) and spawn setup happen before that timeout starts, and the async
+ * timer only arms once `Bun.spawn` returns. Both are small in practice, but the
+ * lookup is not bounded by the deadline to the microsecond. Tightening that
+ * would mean passing an absolute deadline through the runner interface.
+ */
+
+import { existsSync } from "node:fs";
+import { win32 as windowsPath } from "node:path";
+
+import {
+  resolveTrustedWindowsPowerShellExe,
+  WindowsSystemDirectoryFfiUnavailableError,
+} from "./windows-elevation";
+
+const SID_PATTERN = /^S-1-(?:\d+-)+\d+$/i;
+const SID_EXPRESSION =
+  "[System.Security.Principal.WindowsIdentity]::GetCurrent().User.Value";
+const DEFAULT_WINDOWS_ARM64_POWERSHELL = windowsPath.join(
+  "C:\\Windows\\System32",
+  "WindowsPowerShell",
+  "v1.0",
+  "powershell.exe",
+);
+
+type PrincipalExecutableResolution = Readonly<{
+  platform: NodeJS.Platform;
+  arch: string;
+  resolveTrusted: () => string;
+  pathExists: (path: string) => boolean;
+}>;
+
+/**
+ * Bun's Windows ARM64 build cannot currently execute the `bun:ffi` call used
+ * by the general System32 resolver. The ACL identity lookup has a narrower
+ * authority than the elevation helpers: it starts one non-elevated PowerShell
+ * command and accepts only a SID-shaped result. Keep its fallback equally
+ * narrow by using the fixed, OS-protected default installation path only.
+ *
+ * Environment and PATH lookup are deliberately absent. A Windows installation
+ * outside C:\\Windows keeps failing closed rather than executing a binary chosen
+ * by caller-controlled `SystemRoot`, `WINDIR`, or `PATH` values.
+ */
+function resolveWindowsPrincipalPowerShellExecutable(
+  resolution: PrincipalExecutableResolution = {
+    platform: process.platform,
+    arch: process.arch,
+    resolveTrusted: resolveTrustedWindowsPowerShellExe,
+    pathExists: existsSync,
+  },
+): string {
+  try {
+    return resolution.resolveTrusted();
+  } catch (error) {
+    if (
+      !(error instanceof WindowsSystemDirectoryFfiUnavailableError) ||
+      resolution.platform !== "win32" ||
+      resolution.arch !== "arm64" ||
+      !resolution.pathExists(DEFAULT_WINDOWS_ARM64_POWERSHELL)
+    ) {
+      throw error;
+    }
+    return DEFAULT_WINDOWS_ARM64_POWERSHELL;
+  }
+}
+
+/** Test-only dependency-injected view of the Windows ARM64 executable boundary. */
+export function resolveWindowsPrincipalPowerShellExecutableForTests(
+  resolution: PrincipalExecutableResolution,
+): string {
+  return resolveWindowsPrincipalPowerShellExecutable(resolution);
+}
+
+export interface WindowsPrincipalLookupResult {
+  success: boolean;
+  exitCode: number | null;
+  timedOut: boolean;
+  stdout: string;
+}
+
+export type WindowsPrincipalRunner = (
+  timeoutMs: number,
+) => WindowsPrincipalLookupResult;
+
+export type AsyncWindowsPrincipalRunner = (
+  timeoutMs: number,
+) => Promise<WindowsPrincipalLookupResult>;
+
+const POWERSHELL_ARGS = [
+  "-NoLogo",
+  "-NoProfile",
+  "-NonInteractive",
+  "-Command",
+  SID_EXPRESSION,
+] as const;
+
+function windowsPrincipalPowerShellCommand(): string[] {
+  return [resolveWindowsPrincipalPowerShellExecutable(), ...POWERSHELL_ARGS];
+}
+
+/** Test-only readback of the exact trusted executable and static arguments. */
+export function windowsPrincipalPowerShellCommandForTests(): string[] {
+  return windowsPrincipalPowerShellCommand();
+}
+
+function defaultWindowsPrincipalRunner(timeoutMs: number): WindowsPrincipalLookupResult {
+  const result = Bun.spawnSync(windowsPrincipalPowerShellCommand(), {
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "ignore",
+    timeout: Math.max(1, timeoutMs),
+    windowsHide: true,
+  });
+  return {
+    success: result.success,
+    exitCode: result.exitCode,
+    timedOut: result.exitedDueToTimeout ?? false,
+    stdout: result.stdout ? result.stdout.toString() : "",
+  };
+}
+
+async function defaultAsyncWindowsPrincipalRunner(
+  timeoutMs: number,
+): Promise<WindowsPrincipalLookupResult> {
+  const proc = Bun.spawn(windowsPrincipalPowerShellCommand(), {
+    stdin: "ignore",
+    stdout: "pipe",
+    stderr: "ignore",
+    windowsHide: true,
+  });
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    try { proc.kill(); } catch { /* already exited */ }
+  }, Math.max(1, timeoutMs));
+  let exitCode: number | null = null;
+  try {
+    exitCode = await proc.exited;
+  } finally {
+    clearTimeout(timer);
+  }
+  const stdout = proc.stdout
+    ? await new Response(proc.stdout).text().catch(() => "")
+    : "";
+  return {
+    success: !timedOut && exitCode === 0,
+    exitCode: timedOut ? null : exitCode,
+    timedOut,
+    stdout,
+  };
+}
+
+let principalRunner: WindowsPrincipalRunner = defaultWindowsPrincipalRunner;
+let asyncPrincipalRunner: AsyncWindowsPrincipalRunner = defaultAsyncWindowsPrincipalRunner;
+let cachedPrincipal: string | null = null;
+let asyncLookupInFlight: Promise<string> | null = null;
+
+/**
+ * POSIX CI drives the Windows ACL branch through `setPlatformForTests("win32")`,
+ * on hosts that have neither System32 nor PowerShell. Those runs need SOME
+ * principal, so this seam supplies a synthetic one.
+ *
+ * It lives here rather than in `windows-secret-acl.ts` for one reason that is
+ * not cosmetic: an explicitly injected runner must be able to beat it. When the
+ * synthetic value was chosen first, in the ACL module, a test could not inject a
+ * lookup FAILURE on POSIX at all — so the fail-closed and memo-isolation cases
+ * were guarded with `if (process.platform !== "win32") return;` and never ran
+ * outside Windows. Resolution order below is what makes those cases executable
+ * on every runner.
+ */
+let syntheticPrincipalForTests: string | null = null;
+
+/**
+ * Test seam: supply the principal used when no runner was injected and the host
+ * is not really Windows. Pass null to disable.
+ */
+export function setSyntheticWindowsPrincipalForTests(principal: string | null): void {
+  syntheticPrincipalForTests = principal;
+  cachedPrincipal = null;
+}
+
+/** True when an explicit runner override is installed and must take precedence. */
+function hasSyncRunnerOverride(): boolean {
+  return principalRunner !== defaultWindowsPrincipalRunner;
+}
+
+function hasAsyncRunnerOverride(): boolean {
+  return asyncPrincipalRunner !== defaultAsyncWindowsPrincipalRunner;
+}
+
+function identityError(reason: string): NodeJS.ErrnoException {
+  const error = new Error(`Windows effective-account SID lookup ${reason}`) as NodeJS.ErrnoException;
+  // Keep identity lookup failures distinct from icacls timeouts. In particular,
+  // they must not populate windows-secret-acl's destination timeout memo.
+  error.code = "EACLIDENTITY";
+  return error;
+}
+
+function principalFromResult(result: WindowsPrincipalLookupResult): string {
+  if (!result.success) {
+    throw identityError(result.timedOut
+      ? "timed out"
+      : `exited ${result.exitCode ?? "null"}`);
+  }
+  const sid = result.stdout.trim();
+  if (!SID_PATTERN.test(sid)) {
+    throw identityError(sid ? "returned an invalid SID" : "returned an empty SID");
+  }
+  return `*${sid.toUpperCase()}`;
+}
+
+/** Resolve and process-cache the effective token SID for synchronous ACL paths. */
+export function resolveCurrentWindowsPrincipal(timeoutMs: number): string {
+  // Order matters: an explicitly injected runner outranks the synthetic value,
+  // so a test can inject a FAILURE on a POSIX host. See the seam comment above.
+  if (hasSyncRunnerOverride()) {
+    if (cachedPrincipal) return cachedPrincipal;
+    if (timeoutMs <= 0) throw identityError("had no remaining deadline");
+    let overridden: WindowsPrincipalLookupResult;
+    try {
+      overridden = principalRunner(timeoutMs);
+    } catch {
+      throw identityError("could not start");
+    }
+    const principal = principalFromResult(overridden);
+    cachedPrincipal = principal;
+    return principal;
+  }
+  if (cachedPrincipal) return cachedPrincipal;
+  if (syntheticPrincipalForTests) return syntheticPrincipalForTests;
+  if (timeoutMs <= 0) throw identityError("had no remaining deadline");
+  let result: WindowsPrincipalLookupResult;
+  try {
+    result = principalRunner(timeoutMs);
+  } catch {
+    throw identityError("could not start");
+  }
+  const principal = principalFromResult(result);
+  cachedPrincipal = principal;
+  return principal;
+}
+
+async function waitForExistingLookup(
+  lookup: Promise<string>,
+  timeoutMs: number,
+): Promise<string> {
+  if (timeoutMs <= 0) throw identityError("had no remaining deadline");
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  try {
+    return await Promise.race([
+      lookup,
+      new Promise<never>((_, reject) => {
+        timer = setTimeout(
+          () => reject(identityError("timed out while awaiting the shared lookup")),
+          Math.max(1, timeoutMs),
+        );
+      }),
+    ]);
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+
+/**
+ * Async counterpart. Concurrent callers share one owned child lookup; a later
+ * caller may exhaust its own budget without cancelling the lookup owned by the
+ * first caller. The first caller owns that child and its process timeout; a
+ * later, longer budget deliberately does not extend an already-running child.
+ */
+export async function resolveCurrentWindowsPrincipalAsync(timeoutMs: number): Promise<string> {
+  const overridden = hasAsyncRunnerOverride();
+  if (cachedPrincipal) return cachedPrincipal;
+  if (asyncLookupInFlight) return waitForExistingLookup(asyncLookupInFlight, timeoutMs);
+  // Same precedence rule as the sync path: an injected runner beats the synthetic.
+  if (!overridden && syntheticPrincipalForTests) return syntheticPrincipalForTests;
+  if (timeoutMs <= 0) throw identityError("had no remaining deadline");
+
+  const lookup = (async (): Promise<string> => {
+    let result: WindowsPrincipalLookupResult;
+    try {
+      result = await asyncPrincipalRunner(timeoutMs);
+    } catch {
+      throw identityError("could not start");
+    }
+    const principal = principalFromResult(result);
+    cachedPrincipal = principal;
+    return principal;
+  })();
+  asyncLookupInFlight = lookup;
+  try {
+    return await lookup;
+  } finally {
+    if (asyncLookupInFlight === lookup) asyncLookupInFlight = null;
+  }
+}
+
+/** Test seam: replace the sync resolver process and clear its successful cache. */
+export function setWindowsPrincipalRunnerForTests(
+  runner: WindowsPrincipalRunner | null,
+): void {
+  if (asyncLookupInFlight) {
+    throw new Error("Cannot replace the Windows principal runner while a lookup is in flight.");
+  }
+  principalRunner = runner ?? defaultWindowsPrincipalRunner;
+  cachedPrincipal = null;
+}
+
+/** Test seam: replace the async resolver process and clear its successful cache. */
+export function setAsyncWindowsPrincipalRunnerForTests(
+  runner: AsyncWindowsPrincipalRunner | null,
+): void {
+  if (asyncLookupInFlight) {
+    throw new Error("Cannot replace the Windows principal runner while a lookup is in flight.");
+  }
+  asyncPrincipalRunner = runner ?? defaultAsyncWindowsPrincipalRunner;
+  cachedPrincipal = null;
+}
+
+/** Test seam: clear only process-local principal state. */
+export function resetWindowsPrincipalForTests(): void {
+  if (asyncLookupInFlight) {
+    throw new Error("Cannot reset the Windows principal while a lookup is in flight.");
+  }
+  cachedPrincipal = null;
+  syntheticPrincipalForTests = null;
+}

package/src/lib/winsw.ts

@@ -17,10 +17,11 @@ import { createHash } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { join, resolve, win32 } from "node:path";
 import { expandUserPath, getConfigDir, loadConfig } from "../config";
 import { recordOwnedConfigPath } from "./config-ownership";
-import { durableBunPath } from "./bun-runtime";
+import { BUN_RUNTIME_PATH_ENV, BUN_RUNTIME_SOURCE_ENV, durableBunRuntime } from "./bun-runtime";
+import type { BunRuntimeSource } from "./bun-runtime";
 import { serviceApiTokenFilePath } from "./service-secrets";
 
 export const WINSW_VERSION = "2.12.0";
@@ -62,8 +63,15 @@ function currentCodexHomeAbsolute(): string {
   return raw ? resolve(expandUserPath(raw)) : join(homedir(), ".codex");
 }
 
+function windowsServicePathAbsolute(raw: string): string {
+  const expanded = expandUserPath(raw);
+  return win32.isAbsolute(expanded) ? win32.normalize(expanded) : resolve(expanded);
+}
+
 export interface WinswEntry {
   bun: string;
+  /** Provenance of `bun`, resolved together with it so the two can never disagree. */
+  bunRuntimeSource: BunRuntimeSource;
   cli: string;
 }
 
@@ -95,9 +103,12 @@ export function buildWinswXml(entry: WinswEntry, env: NodeJS.ProcessEnv = proces
   const aclTimeout = env.OPENCODEX_ACL_TIMEOUT_MS?.trim();
   const envLines = [
     `  <env name="OCX_SERVICE" value="1"/>`,
+    `  <env name="${BUN_RUNTIME_SOURCE_ENV}" value="${xmlEscape(entry.bunRuntimeSource)}"/>`,
+    `  <env name="${BUN_RUNTIME_PATH_ENV}" value="${xmlEscape(entry.bun)}"/>`,
     `  <env name="OCX_API_TOKEN_FILE" value="${xmlEscape(serviceApiTokenFilePath())}"/>`,
     `  <env name="PATH" value="${xmlEscape(env.PATH ?? "")}"/>`,
     env.CODEX_HOME?.trim() ? `  <env name="CODEX_HOME" value="${xmlEscape(currentCodexHomeAbsolute())}"/>` : null,
+    env.CODEX_SQLITE_HOME?.trim() ? `  <env name="CODEX_SQLITE_HOME" value="${xmlEscape(windowsServicePathAbsolute(env.CODEX_SQLITE_HOME.trim()))}"/>` : null,
     `  <env name="OPENCODEX_HOME" value="${xmlEscape(getConfigDir())}"/>`,
     aclTimeout ? `  <env name="OPENCODEX_ACL_TIMEOUT_MS" value="${xmlEscape(aclTimeout)}"/>` : null,
   ].filter((line): line is string => Boolean(line));
@@ -323,7 +334,23 @@ export async function installWinswService(entry: WinswEntry, deps: WinswInstallD
 }
 
 export function startWinswService(): void { runWinsw(["start"]); }
-export function stopWinswService(): void { try { runWinsw(["stopwait"]); } catch { /* not running */ } }
+
+/**
+ * Stop the native service and prove it is no longer running. `stopwait` can fail both
+ * for the benign already-stopped case and for real access/timeout failures, so a bare
+ * catch cannot decide whether it is safe for lifecycle callers to continue. Re-read
+ * SCM state and only accept the two states that cannot still own the proxy listener.
+ */
+export function stopWinswService(): void {
+  try { runWinsw(["stopwait"]); } catch { /* classify by verified state below */ }
+  const status = statusWinswRaw();
+  if (status === "stopped" || status === "nonexistent") return;
+  if (status === "unknown") {
+    throw new Error("Native service stop could not be verified.");
+  }
+  throw new Error("Native service is still running after stop.");
+}
+
 export function uninstallWinswService(): void {
   if (!existsSync(winswExePath())) {
     // The binary is gone but the SCM registration can outlive it (quarantine, partial
@@ -363,7 +390,7 @@ export function winswStatusSummary(): string {
   if (status === "nonexistent") {
     // A stale SCM service can outlive a deleted exe; surface the repair path.
     return existsSync(winswXmlPath()) && !existsSync(winswExePath())
-      ? "native assets present but WinSW binary missing — run 'ocx service install --native' to repair"
+      ? "native assets present but WinSW binary missing — run 'ocx service repair'"
       : "";
   }
   return `native (WinSW ${WINSW_VERSION}): ${status}`;
@@ -371,5 +398,6 @@ export function winswStatusSummary(): string {
 
 /** Default entry mirrors the Task Scheduler baking: durable Bun + cli.ts. */
 export function defaultWinswEntry(cliDir: string): WinswEntry {
-  return { bun: durableBunPath(), cli: join(cliDir, "cli", "index.ts") };
+  const runtime = durableBunRuntime();
+  return { bun: runtime.path, bunRuntimeSource: runtime.source, cli: join(cliDir, "cli", "index.ts") };
 }

package/src/oauth/account-import/google-antigravity-adapter.ts

@@ -0,0 +1,74 @@
+import { validateAntigravityImportCredential } from "../google-antigravity";
+import { upsertCredentialByIdentity } from "../store";
+import type { OAuthCredentials } from "../types";
+import {
+  ACCOUNT_IMPORT_FORMAT,
+  ACCOUNT_IMPORT_MAX_EMAIL_LENGTH,
+  ACCOUNT_IMPORT_PROVIDER,
+  throwIfAccountImportAborted,
+  type AccountImportAdapter,
+  type CockpitAccountRecord,
+  type ValidatedAntigravityCredential,
+} from "./types";
+
+export interface AntigravityImportAdapterDeps {
+  validate(refreshToken: string, signal?: AbortSignal): Promise<ValidatedAntigravityCredential>;
+  upsert(credential: OAuthCredentials): Promise<"inserted" | "updated">;
+}
+
+function safeProviderEmail(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const normalized = value.toLowerCase();
+  if (
+    normalized.length === 0
+    || normalized.length > ACCOUNT_IMPORT_MAX_EMAIL_LENGTH
+    || normalized !== normalized.trim()
+    || /[\x00-\x20\x7f]/.test(normalized)
+  ) return null;
+  return normalized;
+}
+
+export function createAntigravityAccountImportAdapter(
+  deps: AntigravityImportAdapterDeps = {
+    validate: validateAntigravityImportCredential,
+    upsert: credential => upsertCredentialByIdentity(ACCOUNT_IMPORT_PROVIDER, credential),
+  },
+): AccountImportAdapter {
+  return {
+    provider: ACCOUNT_IMPORT_PROVIDER,
+    format: ACCOUNT_IMPORT_FORMAT,
+    async importRecord(record: CockpitAccountRecord, signal?: AbortSignal) {
+      throwIfAccountImportAborted(signal);
+      let credential: ValidatedAntigravityCredential;
+      try {
+        credential = await deps.validate(record.refreshToken, signal);
+      } catch {
+        throwIfAccountImportAborted(signal);
+        return { status: "failed", code: "credential_rejected" };
+      }
+
+      throwIfAccountImportAborted(signal);
+
+      const providerEmail = safeProviderEmail(credential.email);
+      if (!providerEmail) return { status: "failed", code: "credential_rejected" };
+      if (providerEmail !== record.email) return { status: "failed", code: "identity_mismatch" };
+      if (typeof credential.projectId !== "string" || credential.projectId.length === 0) {
+        return { status: "failed", code: "missing_project" };
+      }
+
+      throwIfAccountImportAborted(signal);
+      try {
+        const disposition = await deps.upsert({
+          ...credential,
+          email: providerEmail,
+          source: "credential-file",
+        });
+        return disposition === "updated"
+          ? { status: "updated", code: "updated" }
+          : { status: "imported", code: "imported" };
+      } catch {
+        return { status: "failed", code: "persist_failed" };
+      }
+    },
+  };
+}