fix(update): reject stub Bun probes and re-kill reused reclaim PIDs

Gate live-package Bun bind probes with isRealBunBinary so a postinstall
stub cannot block pinned start, and clear the reclaim killed-set when a
LISTEN owner is dead so a respawn that reuses the PID is not skipped.

Author: Wibias

src/server/port-reclaim.ts

@@ -4,8 +4,9 @@
  *
  * Killing is never the default. A process may be killed only when the caller
  * sets `killOcxHolders` and either supplies a non-empty `onlyKillPids` allowlist
- * or enables `killAllOcxOnPort` for revalidated ocx listeners. Foreign (non-ocx)
- * processes are never killed.
+ * (trusted teardown PIDs, including allowlisted holders that fail ocx revalidate)
+ * or enables `killAllOcxOnPort` for revalidated ocx listeners. Unknown foreign
+ * (non-ocx, non-allowlisted) processes are never killed.
  */
 import { execFileSync } from "node:child_process";
 import { verifyPidIdentity } from "../config";
@@ -222,7 +223,12 @@ export async function reclaimListenPort(
 
       for (const pid of scan.pids) {
         if (pid === process.pid) continue;
-        if (!isAliveFn(pid)) continue; // Windows may still list a dead owner briefly
+        if (!isAliveFn(pid)) {
+          // Clear "already tried" so a later respawn that reuses this PID slot
+          // is not skipped (Windows service :loop / npm rename respawns).
+          killed.delete(pid);
+          continue; // Windows may still list a dead owner briefly
+        }
         const isOcx = verifyOcxFn(pid) === pid;
         const allowlisted = allowedKillPids.has(pid);
         // Pre-update PIDs can fail verify while still LISTENing (dead owner still

src/update/job.ts

@@ -35,6 +35,7 @@ import {
   updateCommandStr,
 } from "./index";
 import { isNewer } from "./notify";
+import { isRealBunBinary } from "../lib/bun-binary-validator.mjs";
 import { handoffWindowsTrayForUpdate, planWindowsTrayUpdate } from "./tray-update-plan.mjs";
 
 const RELEASE_NOTES_URL = "https://github.com/lidge-jun/opencodex/releases/latest";
@@ -147,14 +148,15 @@ function spawnBindProbe(bin: string, script: string): boolean {
 
 /**
  * Live global package Bun — not the npm rename tree the update worker may still
- * be executing from (`@bitkyc08/.opencodex-*`).
+ * be executing from (`@bitkyc08/.opencodex-*`). Reject the tiny postinstall
+ * stub so probes fall back to the worker runtime instead of failing forever.
  */
 function livePackageBunPath(): string | null {
   const launcher = packageLauncherPath();
   const root = join(dirname(launcher), "..");
   for (const name of ["bun.exe", "bun"]) {
     const candidate = join(root, "node_modules", "bun", "bin", name);
-    if (existsSync(candidate)) return candidate;
+    if (isRealBunBinary(candidate)) return candidate;
   }
   return null;
 }

tests/port-reclaim.test.ts

@@ -556,4 +556,32 @@ describe("reclaimListenPort", () => {
     expect(killed).toEqual([14772]);
     expect(dropped).toEqual([10100]);
   });
+
+  test("dead ghost then same PID reused is killed again under killAllOcxOnPort", async () => {
+    const killed: number[] = [];
+    let phase: "first-live" | "ghost" | "reuse" = "first-live";
+    let available = false;
+    await expect(reclaimListenPort(10100, "127.0.0.1", {
+      timeoutMs: 200,
+      intervalMs: 20,
+      scanIntervalMs: 20,
+      dropTcpRows: false,
+      killOcxHolders: true,
+      killAllOcxOnPort: true,
+      onlyKillPids: [],
+      isAvailableFn: async () => available,
+      listListenPidsFn: () => [4242],
+      isAliveFn: () => phase !== "ghost",
+      verifyOcxFn: pid => pid,
+      killFn: pid => {
+        killed.push(pid);
+        if (phase === "first-live") phase = "ghost";
+        else if (phase === "reuse") available = true;
+      },
+      sleepMs: async () => {
+        if (phase === "ghost") phase = "reuse";
+      },
+    })).resolves.toBe(true);
+    expect(killed).toEqual([4242, 4242]);
+  });
 });