fix(service): verify the proxy is really gone before reporting a stop (#764)

`ocx service stop` reported success and restored native Codex while a proxy
was still listening, leaving both pointing at each other.

The cause is that `ops.stop()` reports the outcome of the STOP COMMAND, not
of the process. A Windows scheduler task whose wrapper survives `schtasks
/end` respawns its child a few seconds later, so a stop that returned success
can still leave a live proxy. The tracked-pid cleanup does not catch it
either: the respawned child writes a pid this process never recorded, and
`stopTrackedProxyIfRunning` returns "none" the moment the pid file is absent.

Stop is now verified instead of inferred. After the manager and the tracked
proxy are stopped, the command polls for a live proxy across the observed
restart window; if one answers, it reports the port, leaves native Codex
alone, and exits non-zero. Restoring the config on top of a running proxy is
the part that turns a failed stop into a broken installation, so that is the
step that must not happen on an unverified stop.

Deliberately different from PR #780, which waits only when `schtasks /end`
returns an ERROR. The reported case is an /end that SUCCEEDS while the
wrapper lives — on that path there is nothing for the command to report, so
waiting on its exit status cannot help. That PR's other work (orphan
discovery, PID verification, Microsoft-account preflight) is untouched here
and still worth reviewing separately.

Four tests on an injected clock, so no wall-clock sleeping. Ablation removing
the restart-window polling in favour of a single probe: 1 pass / 3 fail,
including the respawn case itself; restored 4/4. One test asserts a genuinely
stopped proxy returns null — without it the check could report a survivor
every time and strand native Codex unrestored, which is worse than the bug.
Another asserts a throwing probe is not read as absence, since an unreachable
health endpoint means unknown, not stopped.

87 pass across service, proxy-liveness and both tray suites. Windows behavior
needs the matrix CI; the logic here is clock-injected and platform-neutral.

Author: lidge-jun

src/service.ts

@@ -1626,6 +1626,39 @@ function platformOps(backend: ServiceBackend = "scheduler"): ServiceOps | null {
 
 type TrackedProxyCleanupResult = "none" | "stale" | "stopped";
 
+/**
+ * Whether a proxy is still answering after the service manager claimed to stop it.
+ *
+ * `ops.stop()` reports the outcome of the STOP COMMAND, not of the process. A Windows scheduler
+ * task whose wrapper survives `schtasks /end` respawns its child a few seconds later, so a stop
+ * that returned success can still leave a live proxy — and `ocx service stop` then restored
+ * native Codex on top of a running one (#764). The tracked-pid cleanup does not catch it either:
+ * the respawned child writes a different pid, or none this process knows about.
+ *
+ * Probed rather than assumed, and bounded: the observed respawn window is ~5s, so a few seconds
+ * of polling either sees it come back or it is genuinely gone.
+ */
+export async function proxyStillLiveAfterStop(deps: {
+  findProxy?: () => Promise<{ port: number } | null>;
+  sleep?: (ms: number) => Promise<void>;
+  now?: () => number;
+} = {}): Promise<{ port: number } | null> {
+  const findProxy = deps.findProxy ?? findLiveProxy;
+  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)));
+  const now = deps.now ?? Date.now;
+  const deadline = now() + 7000;
+  for (;;) {
+    try {
+      const live = await findProxy();
+      if (live) return live;
+    } catch {
+      // A probe failure is not proof the proxy is gone; keep polling until the deadline.
+    }
+    if (now() >= deadline) return null;
+    await sleep(1000);
+  }
+}
+
 async function stopTrackedProxyIfRunning(): Promise<TrackedProxyCleanupResult> {
   const pid = readPid();
   if (!pid) return "none";
@@ -1952,6 +1985,20 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       if (ops.status() !== null || isServiceInstalled()) ops.stop();
       await stopTrackedProxyForServiceCommand();
       {
+        // Verify rather than trust the stop command: a surviving wrapper respawns its child
+        // seconds later, and restoring native Codex on top of a live proxy is the failure #764
+        // reports as "stop reports success without stopping the proxy".
+        const survivor = await proxyStillLiveAfterStop();
+        if (survivor) {
+          console.error(
+            `❌ service stop did not take effect: a proxy is still listening on port ${survivor.port}.`
+            + "\nNative Codex was NOT restored, because doing so while the proxy is running leaves"
+            + " both pointing at each other. Check for a second service backend (`ocx service status`)"
+            + " or a manually started proxy, then re-run `ocx service stop`.",
+          );
+          process.exitCode = 1;
+          break;
+        }
         const restore = restoreNativeCodex();
         if (restore.success) console.log("✅ service stopped + native Codex restored.");
         else console.error(`⚠️ service stopped, but native Codex restore FAILED: ${restore.message}\nRun \`ocx restore\` (or check $CODEX_HOME/config.toml) before using native Codex.`);

tests/service-stop-verification.test.ts

@@ -0,0 +1,77 @@
+import { describe, expect, test } from "bun:test";
+import { proxyStillLiveAfterStop } from "../src/service";
+
+/**
+ * #764: `ocx service stop` reported success while the proxy kept running, and native Codex was
+ * restored on top of it.
+ *
+ * The subtlety is which failure mode matters. PR #780 waited only when `schtasks /end` returned
+ * an ERROR -- but the reported case is an /end that SUCCEEDS while the wrapper survives and
+ * respawns its child a few seconds later. On that path the stop command has nothing to report,
+ * so the outcome has to be probed rather than inferred from the command's exit status.
+ */
+
+/** Deterministic clock: no wall-clock sleeping, and the deadline is reached by construction. */
+function fakeClock(startMs = 0) {
+  let current = startMs;
+  return {
+    now: () => current,
+    sleep: async (ms: number) => { current += ms; },
+  };
+}
+
+describe("service stop verification (#764)", () => {
+  test("a proxy that respawns inside the restart window is detected", async () => {
+    // The reported failure: /end succeeded, the wrapper lived, and the child came back at ~5s.
+    // A single probe immediately after the stop command would have seen nothing and passed.
+    const clock = fakeClock();
+    let probes = 0;
+    const live = await proxyStillLiveAfterStop({
+      findProxy: async () => {
+        probes += 1;
+        return probes >= 5 ? { port: 10100 } : null;
+      },
+      ...clock,
+    });
+    expect(live).toEqual({ port: 10100 });
+    expect(probes).toBeGreaterThan(1);
+  });
+
+  test("a genuinely stopped proxy returns null within the bound", async () => {
+    // The control. Without it the check could report a survivor every time and block every
+    // legitimate stop -- worse than the bug, since it would strand native Codex unrestored.
+    const clock = fakeClock();
+    let probes = 0;
+    const live = await proxyStillLiveAfterStop({
+      findProxy: async () => { probes += 1; return null; },
+      ...clock,
+    });
+    expect(live).toBeNull();
+    expect(probes).toBeGreaterThan(1);
+  });
+
+  test("a probe that throws does not count as proof the proxy is gone", async () => {
+    // A failing health probe means "unknown", not "stopped". Treating an exception as absence
+    // would restore native Codex on top of a proxy that is merely unreachable for a moment.
+    const clock = fakeClock();
+    let probes = 0;
+    const live = await proxyStillLiveAfterStop({
+      findProxy: async () => {
+        probes += 1;
+        if (probes < 4) throw new Error("connection refused");
+        return { port: 10100 };
+      },
+      ...clock,
+    });
+    expect(live).toEqual({ port: 10100 });
+  });
+
+  test("an immediately live proxy is caught on the first probe", async () => {
+    const clock = fakeClock();
+    const live = await proxyStillLiveAfterStop({
+      findProxy: async () => ({ port: 10100 }),
+      ...clock,
+    });
+    expect(live).toEqual({ port: 10100 });
+  });
+});