fix(deploy): close windows-deploy-stability audit — restart EINVAL, systemd SSH, localhost bind

Audit (5 parallel reviewers) of devlog 260702_windows-deploy-stability confirmed all prior-loop
fixes landed except two, now fixed:
- update-job restart spawned ocx.cmd shell-less → EINVAL on Windows bun/source GUI restart
  (CVE-2024-27980 class). Restart now uses process.execPath + package launcher (real exe, no shell).
- F9: isSystemd() hard-failed on `systemctl --user show-environment` in no-DBUS SSH sessions,
  wrongly refusing first-time install. Add userRuntimeDir()/ensureUserBusEnv(): set XDG_RUNTIME_DIR
  to /run/user/<uid> and fall back to its existence as the systemd-present signal.
- Bind canonicalizes explicit hostname "localhost" → 127.0.0.1 (F4 symmetry); wildcards untouched.

Guarded by tests/windows-deploy-close-regressions.test.ts. tsc 0, suite 1375 pass/0 fail.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: lidge-jun

src/server.ts

@@ -2102,9 +2102,15 @@ export function startServer(port?: number) {
   const listenPort = port ?? config.port ?? 10100;
   setCorsOrigin(listenPort);
 
+  // Canonicalize an explicit "localhost" bind to IPv4 so it matches the injected base_url (which
+  // resolves localhost→127.0.0.1): on Windows `localhost` resolves ::1-first, but the injected URL
+  // is 127.0.0.1, so binding literal "localhost" would reintroduce the F4 refusal. Wildcards
+  // (0.0.0.0/::) and specific hosts are left untouched so intentional exposure is preserved.
+  const bindHost = /^localhost$/i.test(config.hostname ?? "") ? "127.0.0.1" : (config.hostname ?? "127.0.0.1");
+
   const server: Server<WsData> = Bun.serve<WsData>({
     port: listenPort,
-    hostname: config.hostname ?? "127.0.0.1",
+    hostname: bindHost,
     idleTimeout: 255,
     async fetch(req, requestServer): Promise<Response> {
       const url = new URL(req.url);

src/service.ts

@@ -493,12 +493,41 @@ WantedBy=default.target
 `;
 }
 
+/** The per-user runtime dir systemd creates (holds the user-bus socket), or null. */
+function userRuntimeDir(): string | null {
+  const fromEnv = process.env.XDG_RUNTIME_DIR;
+  if (fromEnv && existsSync(fromEnv)) return fromEnv;
+  if (typeof process.getuid === "function") {
+    const candidate = `/run/user/${process.getuid()}`;
+    if (existsSync(candidate)) return candidate;
+  }
+  return null;
+}
+
+/**
+ * SSH sessions frequently start without `XDG_RUNTIME_DIR`/`DBUS_SESSION_BUS_ADDRESS`, so
+ * `systemctl --user` can't find the user bus even when systemd is running. Point `XDG_RUNTIME_DIR`
+ * at the per-user runtime dir when it exists so the `--user` probe and install commands reach the
+ * bus. No-op when already set or when no runtime dir exists (e.g. genuinely non-systemd hosts).
+ */
+function ensureUserBusEnv(): void {
+  if (process.env.XDG_RUNTIME_DIR) return;
+  const dir = userRuntimeDir();
+  if (dir) process.env.XDG_RUNTIME_DIR = dir;
+}
+
 function isSystemd(): boolean {
   try { execSync("systemctl --version", { stdio: "pipe" }); } catch { return false; }
-  try { execSync("systemctl --user show-environment", { stdio: "pipe" }); return true; } catch { return false; }
+  ensureUserBusEnv();
+  // Prefer the user-bus probe; but an SSH session without a user D-Bus fails it even when systemd
+  // is present (F9). Fall back to the per-user runtime dir existing — a strong signal the user
+  // systemd instance is available — so a first-time `ocx service install` isn't wrongly refused.
+  try { execSync("systemctl --user show-environment", { stdio: "pipe" }); return true; } catch { /* no user bus in this session */ }
+  return userRuntimeDir() !== null;
 }
 
 function installSystemd(): void {
+  ensureUserBusEnv(); // reach the user bus over a bare SSH session (F9)
   const dir = unitDir();
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
   if (!existsSync(getConfigDir())) mkdirSync(getConfigDir(), { recursive: true });

src/update-job.ts

@@ -78,10 +78,6 @@ function nodeBin(): string {
   return process.platform === "win32" ? "node.exe" : "node";
 }
 
-function ocxBin(): string {
-  return process.platform === "win32" ? "ocx.cmd" : "ocx";
-}
-
 function packageLauncherPath(): string {
   return join(dirname(fileURLToPath(import.meta.url)), "..", "bin", "ocx.mjs");
 }
@@ -163,8 +159,11 @@ export function restartCommand(
     const args = serviceInstalled ? [launcher, "service", "install"] : [launcher, "start"];
     return { mode, bin, args, display: formatCommand(bin, args) };
   }
-  const bin = ocxBin();
-  const args = serviceInstalled ? ["service", "install"] : ["start"];
+  // bun/source installs: restart via the current runtime executable + package launcher (both real
+  // .exe files), NOT the `ocx.cmd` shim. Spawning a `.cmd` shell-less throws EINVAL on Windows
+  // Node/Bun ≥18.20/20.12 (CVE-2024-27980 hardening) — the same class the npm path (nodeBin) avoids.
+  const bin = process.execPath;
+  const args = serviceInstalled ? [launcher, "service", "install"] : [launcher, "start"];
   return { mode, bin, args, display: formatCommand(bin, args) };
 }
 

tests/windows-deploy-close-regressions.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+// Source-contract regressions for the final fixes that let devlog
+// 260702_windows-deploy-stability close: the ocx.cmd shell-less restart (A), F9 systemd no-DBUS
+// SSH detection (E), and the F4 explicit-localhost bind symmetry (D). These files run top-level or
+// platform-gated logic, so guard the invariants at the source level (repo convention — see
+// ocx-launcher-source.test.ts / service.test.ts).
+const read = (rel: string) => readFileSync(join(import.meta.dir, "..", rel), "utf8");
+
+describe("update-job restart avoids the shell-less .cmd EINVAL (Windows, bun/source)", () => {
+  const src = read("src/update-job.ts");
+  test("no ocx.cmd shim is spawned for restart", () => {
+    expect(src).not.toContain('"ocx.cmd"');
+    expect(src).not.toMatch(/function ocxBin/);
+  });
+  test("bun/source restart uses the runtime executable + launcher (a real .exe, no shell)", () => {
+    // restartCommand's non-npm branch resolves to process.execPath + the package launcher.
+    expect(src).toMatch(/const bin = process\.execPath;\s*\n\s*const args = serviceInstalled \? \[launcher, "service", "install"\] : \[launcher, "start"\];/);
+  });
+});
+
+describe("systemd detection tolerates a no-DBUS SSH session (F9)", () => {
+  const src = read("src/service.ts");
+  test("isSystemd falls back to the per-user runtime dir when the user-bus probe fails", () => {
+    expect(src).toContain("function userRuntimeDir()");
+    expect(src).toContain("function ensureUserBusEnv()");
+    // The version probe passing + a runtime dir existing is enough — not a hard fail on the --user probe.
+    expect(src).toMatch(/catch \{ \/\* no user bus in this session \*\/ \}\s*\n\s*return userRuntimeDir\(\) !== null;/);
+  });
+  test("install ensures the user-bus env before touching systemctl --user", () => {
+    expect(src).toMatch(/function installSystemd\(\): void \{\s*\n\s*ensureUserBusEnv\(\);/);
+  });
+});
+
+describe("server bind canonicalizes explicit localhost but preserves wildcards (F4 symmetry)", () => {
+  const src = read("src/server.ts");
+  test("literal localhost binds to 127.0.0.1; 0.0.0.0/:: exposure is untouched", () => {
+    expect(src).toContain('/^localhost$/i.test(config.hostname ?? "") ? "127.0.0.1"');
+    expect(src).toContain("hostname: bindHost,");
+    // Must not blanket-rewrite the bind host (that would break intentional 0.0.0.0 exposure).
+    expect(src).not.toContain('hostname: "127.0.0.1",');
+  });
+});