acstack 0.0.0-stage → 0.47.0

package/assets/playwriter-bridge/register-tasks.ps1

@@ -0,0 +1,328 @@
+# register-tasks.ps1 – Register Playwriter bridge scheduled tasks.
+#
+# Creates three kinds of scheduled tasks, all at user logon, LogonType=Interactive:
+#
+#   Playwriter-Relay         – runs relay.ps1 (always one)
+#   Playwriter-Opener        – runs opener.ps1 (always one)
+#   Playwriter-Tunnel-VM1    – runs tunnel.ps1 -TargetHost <vm1>
+#   Playwriter-Tunnel-VM2    – runs tunnel.ps1 -TargetHost <vm2>
+#   ...                       (one per VM in -VMs, auto-numbered)
+#   Playwriter-OpenerTunnel-VM1 – runs tunnel.ps1 -TargetHost <vm1> -Port 19989
+#   ...                       (one per VM, carrying the opener's port)
+#
+# The opener gets its own tunnel task rather than a second -R on the bridge's
+# connection. ssh runs with ExitOnForwardFailure=yes, so one wedged port fails
+# the whole connection – sharing one would mean a stuck opener port takes the
+# bridge down too. See docs/adr/0006-document-opener-service.md.
+#
+# The tasks run as the current user, so the ssh-agent named pipe (SID-ACL'd
+# to the user) stays reachable and no password is ever stored. Each task
+# action invokes launcher.exe, which spawns PowerShell with
+# CREATE_NO_WINDOW – no console is ever allocated, so there is no flash.
+#
+# Run build-launcher.ps1 first to produce launcher.exe; this script refuses
+# to continue without it.
+#
+# Usage:
+#
+#   .\register-tasks.ps1 -VMs @("vm1.example.com", "vm2.internal")
+#   .\register-tasks.ps1 -VMs @("vm1.example.com") -TunnelUser dev
+#
+# A fresh install does not need admin. Re-registering tasks that were
+# previously created from an elevated shell will fail with "Access is
+# denied" – re-run this script from an elevated PowerShell in that case.
+#
+# Scripts are expected to live in %USERPROFILE%\playwriter-bridge\ by default.
+
+param(
+    [Parameter(Mandatory = $true)]
+    [string[]]$VMs,
+
+    [Parameter(Mandatory = $false)]
+    [string]$TunnelUser = $env:USERNAME,
+
+    [Parameter(Mandatory = $false)]
+    [string]$ScriptsDir = (Join-Path $env:USERPROFILE "playwriter-bridge")
+)
+
+$ErrorActionPreference = "Stop"
+
+# Soft elevation check. Fresh installs register fine without admin. Replacing
+# tasks that were previously registered from an elevated shell does require
+# admin – warn now so the user knows what to do if Register-ScheduledTask
+# later throws "Access is denied".
+$identity = [Security.Principal.WindowsIdentity]::GetCurrent()
+$principalCheck = New-Object Security.Principal.WindowsPrincipal($identity)
+if (-not $principalCheck.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
+    Write-Warning "Not running elevated. Fresh installs work fine. If the tasks already exist and were registered elevated, Register-ScheduledTask will fail with 'Access is denied' – re-run this from an elevated PowerShell in that case."
+}
+
+# Validate that the script files are actually where we expect them.
+foreach ($file in @("relay.ps1", "tunnel.ps1", "opener.ps1", "opener.js")) {
+    $full = Join-Path $ScriptsDir $file
+    if (-not (Test-Path $full)) {
+        Write-Error "Missing required script: $full. Copy relay.ps1, tunnel.ps1, opener.ps1 and opener.js into $ScriptsDir before running this."
+        exit 1
+    }
+}
+
+$launcherExe = Join-Path $ScriptsDir "launcher.exe"
+if (-not (Test-Path $launcherExe)) {
+    Write-Error "Missing launcher: $launcherExe. Run build-launcher.ps1 from $ScriptsDir first to compile it from launcher-src.cs."
+    exit 1
+}
+
+$psExe = Join-Path $env:WINDIR "System32\WindowsPowerShell\v1.0\powershell.exe"
+
+# The scripts themselves own resilience (tunnel.ps1 has exponential backoff
+# and fatal-error classification; relay.ps1 loops internally). The scheduler
+# restart is a soft backstop for rare PowerShell-host crashes, not a retry
+# engine. Keep it small so it does not fight manual stops.
+$settings = New-ScheduledTaskSettingsSet `
+    -AllowStartIfOnBatteries `
+    -DontStopIfGoingOnBatteries `
+    -DontStopOnIdleEnd `
+    -ExecutionTimeLimit ([TimeSpan]::Zero) `
+    -RestartCount 2 `
+    -RestartInterval (New-TimeSpan -Minutes 5)
+
+$userId = "$env:USERDOMAIN\$env:USERNAME"
+$principal = New-ScheduledTaskPrincipal -UserId $userId -LogonType Interactive -RunLevel Limited
+$trigger = New-ScheduledTaskTrigger -AtLogOn -User $userId
+
+# Unregister-ScheduledTask removes the task definition but does not take down a
+# running instance, and the scheduler force-terminates launcher.exe without
+# letting its ProcessExit handler run - so the launcher's WMI descendant kill
+# never fires and the child PowerShell, plus the ssh.exe or node.exe it was
+# holding, survives as an orphan still bound to 19988/19989. The task registered
+# next then never binds. Observed on Windows 11 26200 re-running this script
+# over a live bridge: two orphaned tunnel trees competing on 19988, each with
+# its own retry counter, writing interleaved lines into one log.
+#
+# Scoped by the task's own registered argument string so a tunnel task never
+# reaps its sibling on the other port or the other VM. launcher.exe drops the
+# quotes around -File when it builds the child command line, hence the de-quoted
+# comparison on both sides.
+function Stop-BridgeTaskTree {
+    param([string]$Name)
+
+    $task = Get-ScheduledTask -TaskName $Name -ErrorAction SilentlyContinue
+    $want = if ($task) { ($task.Actions.Arguments -replace '"', '') } else { $null }
+
+    Stop-ScheduledTask -TaskName $Name -ErrorAction SilentlyContinue
+
+    for ($i = 0; $i -lt 20; $i++) {
+        $state = (Get-ScheduledTask -TaskName $Name -ErrorAction SilentlyContinue).State
+        if ($state -ne 'Running') { break }
+        Start-Sleep -Milliseconds 250
+    }
+
+    if (-not $want) { return }
+
+    $survivors = @(Get-CimInstance Win32_Process -ErrorAction SilentlyContinue | Where-Object {
+        $_.ProcessId -ne $PID -and $_.CommandLine -and ($_.CommandLine -replace '"', '') -eq $want
+    })
+    foreach ($p in $survivors) {
+        # Children first. Killing the supervisor alone re-orphans the ssh.exe or
+        # node.exe it was holding, which is the whole bug this guards against.
+        Get-CimInstance Win32_Process -Filter "ParentProcessId=$($p.ProcessId)" -ErrorAction SilentlyContinue |
+            ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }
+        Stop-Process -Id $p.ProcessId -Force -ErrorAction SilentlyContinue
+        Write-Host "  reaped surviving $Name process (PID $($p.ProcessId))"
+    }
+}
+
+function Register-BridgeTask {
+    param(
+        [string]$Name,
+        [string]$ScriptFile,
+        [string[]]$ExtraArgs = @()
+    )
+    $scriptPath = Join-Path $ScriptsDir $ScriptFile
+    # launcher.exe spawns args[0] (PowerShell) with CREATE_NO_WINDOW. Its
+    # remaining args get joined and passed as PowerShell's Arguments. Any
+    # path with spaces must be pre-quoted here.
+    $launcherArgs = @(
+        "`"$psExe`"",
+        "-NoProfile",
+        "-ExecutionPolicy", "Bypass",
+        "-File", "`"$scriptPath`""
+    ) + $ExtraArgs
+    $argString = $launcherArgs -join ' '
+
+    $action = New-ScheduledTaskAction -Execute $launcherExe -Argument $argString
+
+    # Explicit Unregister: do NOT silently swallow "Access is denied".
+    # Previous versions hid that error, then Register-ScheduledTask threw
+    # a non-terminating CIM "Cannot create a file when that file already
+    # exists" and the old task (possibly with stale settings) stayed put
+    # while the script falsely reported success.
+    $existing = Get-ScheduledTask -TaskName $Name -ErrorAction SilentlyContinue
+    if ($existing) {
+        # Take the running instance down first, children included. Unregistering
+        # a running task leaves its process tree alive and holding the port.
+        Stop-BridgeTaskTree -Name $Name
+        try {
+            Unregister-ScheduledTask -TaskName $Name -Confirm:$false -ErrorAction Stop
+        } catch {
+            Write-Error ("Cannot replace task '{0}': {1}`n" -f $Name, $_.Exception.Message) -ErrorAction Continue
+            Write-Error "This task was probably registered from an elevated PowerShell. Re-run this script from an elevated PowerShell (Run as Administrator)." -ErrorAction Continue
+            throw "Unregister-ScheduledTask failed for $Name"
+        }
+    }
+
+    try {
+        Register-ScheduledTask `
+            -TaskName $Name `
+            -Action $action `
+            -Trigger $trigger `
+            -Principal $principal `
+            -Settings $settings `
+            -ErrorAction Stop | Out-Null
+    } catch {
+        Write-Error ("Register-ScheduledTask failed for '{0}': {1}" -f $Name, $_.Exception.Message) -ErrorAction Continue
+        throw
+    }
+
+    # Verify the new settings actually landed. Guards against a silent
+    # partial failure where the task exists but with old settings. We check
+    # every field whose property name is identical on the input
+    # ScheduledTaskSettings object and on the fetched task's Settings – the
+    # battery/idle switch-params invert to 'Disallow*'/'StopIf*' in the
+    # stored representation and aren't safely comparable by name, so they
+    # are left out. RestartCount, RestartInterval and ExecutionTimeLimit
+    # map 1:1 on both sides and are the fields most likely to silently
+    # reject.
+    $check = Get-ScheduledTask -TaskName $Name -ErrorAction SilentlyContinue
+    if (-not $check) {
+        throw "Post-register check: task '$Name' is missing."
+    }
+    $fieldsToCheck = @('RestartCount', 'RestartInterval', 'ExecutionTimeLimit')
+    $mismatches = @()
+    foreach ($key in $fieldsToCheck) {
+        $want = $settings.$key
+        $got = $check.Settings.$key
+        if ($got -ne $want) {
+            $mismatches += ("{0}: got '{1}', expected '{2}'" -f $key, $got, $want)
+        }
+    }
+    if ($mismatches.Count -gt 0) {
+        throw ("Post-register check: task '{0}' has stale settings ({1}). The register silently applied stale settings – re-run from an elevated PowerShell." -f $Name, ($mismatches -join '; '))
+    }
+
+    Write-Host ("Registered: {0} ({1} settings fields verified: {2})" -f $Name, $fieldsToCheck.Count, ($fieldsToCheck -join ', '))
+}
+
+Register-BridgeTask -Name "Playwriter-Relay" -ScriptFile "relay.ps1"
+Register-BridgeTask -Name "Playwriter-Opener" -ScriptFile "opener.ps1"
+
+for ($i = 0; $i -lt $VMs.Count; $i++) {
+    $vm = $VMs[$i]
+    Register-BridgeTask `
+        -Name "Playwriter-Tunnel-VM$($i + 1)" `
+        -ScriptFile "tunnel.ps1" `
+        -ExtraArgs @("-TargetHost", $vm, "-User", $TunnelUser)
+    Register-BridgeTask `
+        -Name "Playwriter-OpenerTunnel-VM$($i + 1)" `
+        -ScriptFile "tunnel.ps1" `
+        -ExtraArgs @("-TargetHost", $vm, "-User", $TunnelUser, "-Port", "19989")
+}
+
+# The opener refuses every request that does not carry this, so each VM needs
+# a copy. Generated here if the opener has not already made one; pushed over
+# the same ssh the tunnel uses, so it needs no new access. A VM that cannot be
+# reached is a warning, not a failure: the tunnel tasks are still worth
+# registering, and the token can be copied by hand afterwards.
+$tokenFile = Join-Path $env:LOCALAPPDATA "playwriter-bridge\opener.token"
+if (-not (Test-Path $tokenFile)) {
+    New-Item -Path (Split-Path $tokenFile) -ItemType Directory -Force | Out-Null
+    $bytes = New-Object byte[] 32
+    [System.Security.Cryptography.RandomNumberGenerator]::Create().GetBytes($bytes)
+    Set-Content -Path $tokenFile -Value ([System.BitConverter]::ToString($bytes).Replace('-', '').ToLower()) -NoNewline -Encoding ascii
+    Write-Host "Generated opener token: $tokenFile"
+}
+$token = (Get-Content $tokenFile -Raw).Trim()
+
+Write-Host ""
+Write-Host "Pushing opener token to VMs..."
+# Resolve ssh the same way tunnel.ps1 does. A bare 'ssh' can resolve to the Git
+# for Windows build, which cannot reach the Windows ssh-agent named pipe and so
+# fails with "Permission denied (publickey)" - the push would then be skipped
+# with only a warning and the VM would 401 on every opener request.
+$sshExe = Join-Path $env:WINDIR "System32\OpenSSH\ssh.exe"
+if (-not (Test-Path $sshExe)) {
+    $onPath = Get-Command ssh -ErrorAction SilentlyContinue
+    if ($onPath) {
+        $sshExe = $onPath.Source
+    } else {
+        # A warning, never a throw. The tasks are already registered by this
+        # point and the start loop is still ahead, so throwing here left every
+        # task registered and none of them running.
+        Write-Warning "ssh.exe not found, so the opener token was not pushed. Enable the Windows OpenSSH Client optional feature, then copy $tokenFile to ~/.config/acstack/opener.token on each VM by hand."
+        $sshExe = $null
+    }
+}
+foreach ($vm in $VMs) {
+    if (-not $sshExe) { break }
+    $remote = "$TunnelUser@$vm"
+    # Single-quoted on the remote side so the shell there cannot interpret it,
+    # and 0600 because it is a bearer credential for opening pages on this
+    # screen.
+    $cmd = "mkdir -p ~/.config/acstack && umask 077 && printf '%s' '$token' > ~/.config/acstack/opener.token"
+    # $ErrorActionPreference is 'Stop' for this script, and merging a native
+    # command's stderr into the pipeline under it turns any stderr line into a
+    # terminating NativeCommandError. ssh writes one on a first connection:
+    # "Warning: Permanently added ... to the list of known hosts". That aborted
+    # the run before the start loop, on nothing but a routine notice. Discard
+    # stderr and read the real result from the exit code.
+    $prevEap = $ErrorActionPreference
+    $ErrorActionPreference = 'Continue'
+    & $sshExe -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10 $remote $cmd 2>$null | Out-Null
+    $sshCode = $LASTEXITCODE
+    $ErrorActionPreference = $prevEap
+    if ($sshCode -eq 0) {
+        Write-Host "  $vm : token installed at ~/.config/acstack/opener.token"
+    } else {
+        Write-Warning "  $vm : could not push the token (ssh exit $sshCode). Copy $tokenFile to ~/.config/acstack/opener.token on that VM by hand."
+    }
+}
+
+# Tasks whose VM is not in -VMs. A re-run with a shorter list leaves the earlier
+# tunnels registered and untouched: this script removes nothing. The case that
+# matters is a VM behind a VPN that was down at registration time. Its
+# Playwriter-Tunnel-VM2 must survive a re-run that could not reach it, because
+# dropping the task would silently drop that VM from the bridge - and the user
+# would find out the next time they needed a browser on it.
+#
+# Reported here rather than after the start loop, because a warning printed
+# under "Starting tasks..." reads as a task that failed to start.
+$leftover = @()
+foreach ($t in @(Get-ScheduledTask -TaskName 'Playwriter-Tunnel-*','Playwriter-OpenerTunnel-*' -ErrorAction SilentlyContinue)) {
+    # The VM is in the action arguments, not the task name: an index-based guess
+    # would mislabel every task whenever -VMs is reordered.
+    $argText = ($t.Actions | ForEach-Object { $_.Arguments }) -join ' '
+    if ($argText -match '-TargetHost\s+(\S+)') {
+        $taskTarget = $Matches[1].Trim('"')
+        if ($VMs -notcontains $taskTarget) {
+            $leftover += [pscustomobject]@{ Name = $t.TaskName; Target = $taskTarget }
+        }
+    }
+}
+if ($leftover.Count -gt 0) {
+    Write-Host ""
+    foreach ($l in $leftover) {
+        Write-Warning ("Left alone: task '{0}' forwards to {1}, which is not in -VMs. It stays registered and keeps running. This script removes nothing. Re-run with {1} in -VMs to update it, or delete the task yourself in Task Scheduler." -f $l.Name, $l.Target)
+    }
+}
+
+Write-Host ""
+Write-Host "Starting tasks..."
+Start-ScheduledTask -TaskName "Playwriter-Relay"
+Start-ScheduledTask -TaskName "Playwriter-Opener"
+Start-Sleep -Seconds 2
+for ($i = 0; $i -lt $VMs.Count; $i++) {
+    Start-ScheduledTask -TaskName "Playwriter-Tunnel-VM$($i + 1)"
+    Start-ScheduledTask -TaskName "Playwriter-OpenerTunnel-VM$($i + 1)"
+}
+
+Write-Host "Done. Logs: $env:LOCALAPPDATA\playwriter-bridge\"

package/assets/playwriter-bridge/relay.ps1

@@ -0,0 +1,50 @@
+# relay.ps1 – Playwriter relay with auto-reconnect.
+#
+# Runs `playwriter serve --host 127.0.0.1 --replace` in a loop. Intended to
+# be invoked through launcher.exe by a scheduled task registered by
+# register-tasks.ps1. Logs to %LOCALAPPDATA%\playwriter-bridge\relay.log.
+#
+# Console hiding is handled by launcher.exe (spawns PowerShell with
+# CREATE_NO_WINDOW). Nothing to do here.
+
+$ErrorActionPreference = "Continue"
+
+$logDir = Join-Path $env:LOCALAPPDATA "playwriter-bridge"
+New-Item -Path $logDir -ItemType Directory -Force | Out-Null
+$logFile = Join-Path $logDir "relay.log"
+
+function Write-Log {
+    param([string]$Message)
+    "[$(Get-Date -Format 'yyyy-MM-dd HH:mm:ss')] $Message" | Out-File -Append -FilePath $logFile
+}
+
+function Resolve-PlaywriterCommand {
+    # Prefer the npm shim on PATH – it routes through Node correctly without
+    # us needing to know where either lives.
+    $cmd = Get-Command playwriter -ErrorAction SilentlyContinue
+    if ($cmd) { return @{ Exe = $cmd.Source; Args = @() } }
+
+    # Fallback: invoke Node directly against the installed CLI JS.
+    $node = Get-Command node -ErrorAction SilentlyContinue
+    if (-not $node) {
+        throw "Neither 'playwriter' nor 'node' is on PATH. Install Node LTS and 'npm install -g playwriter' first."
+    }
+    $cliJs = Join-Path $env:APPDATA "npm\node_modules\playwriter\dist\cli.js"
+    if (-not (Test-Path $cliJs)) {
+        throw "Found Node but not Playwriter CLI at $cliJs. Run 'npm install -g playwriter'."
+    }
+    return @{ Exe = $node.Source; Args = @($cliJs) }
+}
+
+while ($true) {
+    try {
+        $resolved = Resolve-PlaywriterCommand
+        Write-Log "Starting Playwriter relay ($($resolved.Exe))"
+        $allArgs = $resolved.Args + @("serve", "--host", "127.0.0.1", "--replace")
+        & $resolved.Exe @allArgs 2>&1 | Out-File -Append -FilePath $logFile
+        Write-Log "Relay exited (code $LASTEXITCODE), sleeping 5s"
+    } catch {
+        Write-Log "Error: $($_.Exception.Message). Sleeping 5s"
+    }
+    Start-Sleep -Seconds 5
+}

package/assets/playwriter-bridge/stop.ps1

@@ -0,0 +1,125 @@
+# stop.ps1 – Canonical "stop the bridge" entry point.
+#
+# Stops every Playwriter-* scheduled task - which covers the document opener
+# and its tunnel too, both registered under the same prefix - kills any
+# lingering bridge
+# processes (relay.ps1, tunnel.ps1), reaps orphan ssh.exe children that
+# were carrying the reverse forward, and confirms 127.0.0.1:19988 is no
+# longer bound. Prints a one-line verdict.
+#
+# Safe to run at any time. No-ops if the bridge is already down.
+#
+# Implementation notes:
+# - The sweep matches on command line. Since this script itself may run
+#   from a shell whose command line contains 'playwriter-bridge', we
+#   exclude $PID (and its parent) to avoid self-kill.
+# - When the launcher is force-killed, its ProcessExit handler does NOT
+#   run, so the ssh.exe child it spawned is orphaned. A dedicated pass
+#   looks for ssh.exe processes carrying the 19988 reverse forward and
+#   kills them explicitly.
+
+$ErrorActionPreference = 'Continue'
+
+$selfPid = $PID
+try { $selfParent = (Get-CimInstance Win32_Process -Filter "ProcessId=$selfPid").ParentProcessId } catch { $selfParent = 0 }
+
+function Should-Skip {
+    param([int]$TargetPid)
+    return ($TargetPid -eq $selfPid) -or ($TargetPid -eq $selfParent)
+}
+
+Write-Host "Stopping Playwriter-* scheduled tasks..."
+$tasks = Get-ScheduledTask -TaskName 'Playwriter-*' -ErrorAction SilentlyContinue
+foreach ($t in $tasks) {
+    try {
+        Stop-ScheduledTask -TaskName $t.TaskName -ErrorAction SilentlyContinue
+        Write-Host "  stopped: $($t.TaskName)"
+    } catch {
+        Write-Host "  (could not stop $($t.TaskName): $_)"
+    }
+}
+
+# Pass 1: kill launcher.exe / PowerShell children that were driving the
+# bridge. Excludes this script and its parent so we do not kill ourselves.
+$bridgePattern = 'playwriter-bridge'
+$pass1 = Get-CimInstance Win32_Process -ErrorAction SilentlyContinue |
+    Where-Object {
+        $_.CommandLine -and
+        $_.CommandLine -match $bridgePattern -and
+        -not (Should-Skip $_.ProcessId)
+    }
+
+foreach ($p in $pass1) {
+    try {
+        Stop-Process -Id $p.ProcessId -Force -ErrorAction SilentlyContinue
+        Write-Host "  killed: PID $($p.ProcessId) ($($p.Name))"
+    } catch { }
+}
+
+Start-Sleep -Milliseconds 500
+
+# Pass 2: reap orphan ssh.exe reverse-forward children. Required because
+# Stop-Process -Force on the launcher does not run the launcher's
+# ProcessExit handler, so the ssh.exe it parented survives. Match on the
+# reverse-forward argument pattern (narrow, scoped to the two ports this setup
+# owns - 19988 for the bridge, 19989 for the document opener) so this never
+# touches an unrelated ssh session.
+$sshRemnants = Get-CimInstance Win32_Process -ErrorAction SilentlyContinue |
+    Where-Object {
+        $_.Name -eq 'ssh.exe' -and
+        $_.CommandLine -and
+        ($_.CommandLine -match '1998[89]:127\.0\.0\.1:1998[89]' -or $_.CommandLine -match '-R\s+"?1998[89]:') -and
+        -not (Should-Skip $_.ProcessId)
+    }
+
+foreach ($p in $sshRemnants) {
+    try {
+        Stop-Process -Id $p.ProcessId -Force -ErrorAction SilentlyContinue
+        Write-Host "  killed: PID $($p.ProcessId) (ssh.exe, reverse forward)"
+    } catch { }
+}
+
+Start-Sleep -Milliseconds 500
+
+# Pass 3: reap the orphan node.exe that relay.ps1 spawned (playwriter serve)
+# and still binds 19988, and the one opener.ps1 spawned and still binds 19989.
+# Identify each by whatever owns the port, then kill only if its command line
+# names the thing we expect - so we never touch an unrelated listener that
+# happens to be on either port.
+$owned = @{ 19988 = 'playwriter'; 19989 = 'opener\.js' }
+foreach ($port in $owned.Keys) {
+    $listener = Get-NetTCPConnection -LocalPort $port -State Listen -ErrorAction SilentlyContinue
+    foreach ($conn in $listener) {
+        $ownerPid = [int]$conn.OwningProcess
+        if ($ownerPid -le 0) { continue }
+        if (Should-Skip $ownerPid) { continue }
+        $proc = Get-CimInstance Win32_Process -Filter "ProcessId=$ownerPid" -ErrorAction SilentlyContinue
+        if (-not $proc) { continue }
+        if ($proc.CommandLine -and $proc.CommandLine -match $owned[$port]) {
+            try {
+                Stop-Process -Id $ownerPid -Force -ErrorAction SilentlyContinue
+                Write-Host "  killed: PID $ownerPid ($($proc.Name), orphan listener on $port)"
+            } catch { }
+        } else {
+            Write-Host "  NOT killing PID $ownerPid ($($proc.Name)): command line does not match '$($owned[$port])'" -ForegroundColor Yellow
+        }
+    }
+}
+
+Start-Sleep -Milliseconds 500
+
+$stillUp = @()
+foreach ($port in $owned.Keys) {
+    if (Get-NetTCPConnection -LocalPort $port -State Listen -ErrorAction SilentlyContinue) {
+        $stillUp += $port
+    }
+}
+if ($stillUp) {
+    Write-Host ""
+    Write-Host "VERDICT: PARTIALLY down – something still listens on $($stillUp -join ', ')" -ForegroundColor Yellow
+    exit 1
+}
+
+Write-Host ""
+Write-Host "VERDICT: bridge and opener are down" -ForegroundColor Green
+exit 0