fix(liveness): bound stop probes and harden WinSW secret tests

Stop-path discovery now shares a wall-clock deadline so multi-candidate
SERVICE_STOP_LIVENESS retries cannot overrun the verification window, and
tests assert resolved OPENCODEX_HOME plus absent API/admin token values.

Author: Wibias

src/server/proxy-liveness.ts

@@ -37,6 +37,14 @@ export interface LivenessIo {
    */
   attempts?: number;
   sleepFn?: (ms: number) => Promise<void>;
+  /**
+   * Absolute wall-clock deadline for discovery. When set, each probe attempt aborts
+   * once the remaining budget cannot cover another fetch — so multi-candidate
+   * `findLiveProxy` under `SERVICE_STOP_LIVENESS` cannot overrun the stop-path
+   * verification window (#764 / CodeRabbit).
+   */
+  deadlineAt?: number;
+  nowFn?: () => number;
 }
 
 /** Default probe options for service stop / orphan cleanup — a just-bound proxy can miss a single 750ms probe. */
@@ -86,10 +94,17 @@ export async function proxyIdentityAt(
 ): Promise<{ pid: number | null } | null> {
   const fetchFn = io.fetchFn ?? fetch;
   const sleepFn = io.sleepFn ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)));
-  const timeoutMs = io.timeoutMs ?? 750;
-  const attempts = Math.max(1, Math.min(Math.trunc(io.attempts ?? 1), 5));
+  const nowFn = io.nowFn ?? Date.now;
+  const baseTimeoutMs = io.timeoutMs ?? 750;
+  const requestedAttempts = Math.trunc(io.attempts ?? 1);
+  const attempts = Number.isNaN(requestedAttempts)
+    ? 1
+    : Math.max(1, Math.min(requestedAttempts, 5));
 
   for (let attempt = 1; attempt <= attempts; attempt++) {
+    const remainingMs = io.deadlineAt === undefined ? baseTimeoutMs : io.deadlineAt - nowFn();
+    if (remainingMs <= 0) return null;
+    const timeoutMs = Math.min(baseTimeoutMs, remainingMs);
     try {
       const res = await fetchFn(`http://${probeHostname(opts.hostname)}:${port}/healthz`, {
         signal: AbortSignal.timeout(timeoutMs),
@@ -104,6 +119,7 @@ export async function proxyIdentityAt(
       // Transport failure (timeout / refused) — retry while budget remains; a proxy that
       // has only just begun listening can miss a single short probe (#764).
       if (attempt >= attempts) return null;
+      if (io.deadlineAt !== undefined && io.deadlineAt - nowFn() <= 0) return null;
       await sleepFn(100);
     }
   }

src/service.ts

@@ -1723,11 +1723,18 @@ export async function proxyStillLiveAfterStop(deps: {
   /** Whether the stopped supervisor can respawn its child; only then is polling worth the wait. */
   canRespawn?: boolean;
 } = {}): Promise<{ port: number } | null> {
-  const findProxy = deps.findProxy ?? (() => findLiveProxy(SERVICE_STOP_LIVENESS));
   const sleep = deps.sleep ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)));
   const now = deps.now ?? Date.now;
   const canRespawn = deps.canRespawn ?? process.platform === "win32";
   const deadline = now() + (canRespawn ? 7000 : 0);
+  // Single-shot (non-respawn) still needs one full SERVICE_STOP_LIVENESS budget; respawn
+  // polling shares the outer deadline so multi-candidate discovery cannot overrun it.
+  const findProxy = deps.findProxy ?? (() => {
+    const probeDeadline = canRespawn
+      ? deadline
+      : now() + (SERVICE_STOP_LIVENESS.timeoutMs! * SERVICE_STOP_LIVENESS.attempts! + 250);
+    return findLiveProxy({ ...SERVICE_STOP_LIVENESS, deadlineAt: probeDeadline, nowFn: now });
+  });
   for (;;) {
     try {
       const live = await findProxy();
@@ -1755,7 +1762,11 @@ async function stopTrackedProxyIfRunning(): Promise<TrackedProxyCleanupResult> {
   }
   // Orphan recovery: the pid file can be missing/stale while the service wrapper keeps
   // a live proxy running — mirror `ocx stop`'s identity-checked findLiveProxy fallback.
-  const live = await findLiveProxy(SERVICE_STOP_LIVENESS);
+  // Cap multi-candidate discovery so stop cleanup cannot hang for three full retry budgets.
+  const live = await findLiveProxy({
+    ...SERVICE_STOP_LIVENESS,
+    deadlineAt: Date.now() + 7000,
+  });
   const liveKillPid = verifiedKillTarget(live?.pid);
   if (liveKillPid !== null) {
     await stopProxy(liveKillPid);

tests/proxy-liveness.test.ts

@@ -82,6 +82,39 @@ describe("proxyIdentityAt", () => {
     expect(identity).toBeNull();
     expect(calls).toBe(1);
   });
+
+  test("NaN attempts fall back to a single probe", async () => {
+    let calls = 0;
+    const identity = await proxyIdentityAt(10100, {}, {
+      attempts: Number.NaN,
+      fetchFn: (async () => {
+        calls += 1;
+        return healthz(OURS);
+      }) as typeof fetch,
+    });
+    expect(identity).toEqual({ pid: 4242 });
+    expect(calls).toBe(1);
+  });
+
+  test("honors an aggregate deadline across transport retries", async () => {
+    let calls = 0;
+    let clock = 1_000;
+    const identity = await proxyIdentityAt(10100, {}, {
+      attempts: 3,
+      timeoutMs: 1_500,
+      deadlineAt: 1_000 + 1_200,
+      nowFn: () => clock,
+      sleepFn: async () => { clock += 100; },
+      fetchFn: (async () => {
+        calls += 1;
+        clock += 1_500;
+        throw new Error("timeout");
+      }) as typeof fetch,
+    });
+    expect(identity).toBeNull();
+    // First attempt spends the budget; remaining retries must not fire.
+    expect(calls).toBe(1);
+  });
 });
 
 describe("findLiveProxy", () => {

tests/service.test.ts

@@ -664,8 +664,8 @@ describe("service lifecycle cleanup ordering", () => {
     expect(service).toContain('import { findLiveProxy, SERVICE_STOP_LIVENESS } from "./server/proxy-liveness";');
     expect(service).toContain('type TrackedProxyCleanupResult = "none" | "stale" | "stopped";');
     expect(service).toContain("async function stopTrackedProxyIfRunning(): Promise<TrackedProxyCleanupResult>");
-    expect(service).toContain("await findLiveProxy(SERVICE_STOP_LIVENESS)");
-    expect(service).toContain("(() => findLiveProxy(SERVICE_STOP_LIVENESS))");
+    expect(service).toContain("...SERVICE_STOP_LIVENESS");
+    expect(service).toContain("deadlineAt:");
     expect(service).toContain("SERVICE_STOP_LIVENESS");
     expect(service).toContain("await stopProxy(trackedKillPid);");
     expect(service).toContain("await stopProxy(liveKillPid);");

tests/winsw.test.ts

@@ -2,12 +2,23 @@ import { describe, expect, test } from "bun:test";
 import { buildWinswXml, ensureWinswBinary, parseWinswStatus, probeScmRegistration, sha256Hex, installWinswService, statusWinswRaw, WINSW_SHA256, WINSW_SERVICE_ID } from "../src/lib/winsw";
 import { parseServiceArgs, serviceReinstallArgs } from "../src/service";
 import { loadServiceTokenFromFile } from "../src/lib/service-secrets";
+import { getConfigDir } from "../src/config";
 import { mkdtempSync, readFileSync, writeFileSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 const entry = { bun: "C:\\OpenCodex\\bun.exe", cli: "C:\\Open Codex\\cli & co\\index.ts" };
 
+function winswEnvValue(xml: string, name: string): string | null {
+  const match = xml.match(new RegExp(`<env name="${name}" value="([^"]*)"/>`));
+  if (!match) return null;
+  return match[1]!
+    .replace(/&amp;/g, "&")
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"');
+}
+
 describe("winsw xml", () => {
   const env = { USERDOMAIN: "WORKGROUP", USERNAME: "jun", PATH: "C:\\bin;C:\\tools & more" } as NodeJS.ProcessEnv;
 
@@ -30,7 +41,7 @@ describe("winsw xml", () => {
     expect(xml).toContain('<env name="OCX_SERVICE" value="1"/>');
     expect(xml).toContain('<env name="OCX_API_TOKEN_FILE"');
     expect(xml).toContain('<env name="PATH" value="C:\\bin;C:\\tools &amp; more"/>');
-    expect(xml).toContain('<env name="OPENCODEX_HOME"');
+    expect(winswEnvValue(xml, "OPENCODEX_HOME")).toBe(getConfigDir());
     // Token VALUES never land in the XML — only file pointers / non-secret budgets.
     expect(xml).not.toContain("OPENCODEX_API_AUTH_TOKEN");
     expect(xml).not.toContain("OPENCODEX_ADMIN_AUTH_TOKEN");
@@ -39,14 +50,17 @@ describe("winsw xml", () => {
   test("bakes install-time ACL timeout and never embeds the admin token (#764)", () => {
     const xml = buildWinswXml(entry, {
       ...env,
+      OPENCODEX_API_AUTH_TOKEN: "api-secret-value",
       OPENCODEX_ADMIN_AUTH_TOKEN: "admin-secret & more",
       OPENCODEX_ACL_TIMEOUT_MS: "10000",
     });
 
     expect(xml).toContain('<env name="OPENCODEX_ACL_TIMEOUT_MS" value="10000"/>');
-    expect(xml).toContain('<env name="OPENCODEX_HOME"');
+    expect(winswEnvValue(xml, "OPENCODEX_HOME")).toBe(getConfigDir());
     expect(xml).not.toContain("OPENCODEX_ADMIN_AUTH_TOKEN");
+    expect(xml).not.toContain("OPENCODEX_API_AUTH_TOKEN");
     expect(xml).not.toContain("admin-secret");
+    expect(xml).not.toContain("api-secret-value");
   });
 
   test("escapes executable/arguments and configures restart + graceful stop", () => {