fix(security): drop accidental service.ts tip merge from ACL pivot

Keep the PR scoped to the timeout-memo + ADMIN_AUTH_TOKEN escape; restore service/winsw to the prior tip minus only the unverified-ACL bake.

Author: Wibias

src/lib/winsw.ts

@@ -165,12 +165,6 @@ function runWinsw(args: string[]): string {
 
 /** `install /p` prompts for the service-account password on the console — stdin must be inherited. */
 function runWinswInteractive(args: string[]): void {
-  if (!process.stdin.isTTY) {
-    throw new Error(
-      "WinSW install requires an interactive console to prompt for the service account password. "
-        + "Run `ocx service install --native` from an elevated Command Prompt or PowerShell window, not a hidden or piped session.",
-    );
-  }
   execFileSync(winswExePath(), args, { stdio: "inherit" });
 }
 

src/service.ts

@@ -6,11 +6,10 @@
  * restore it via the command.
  */
 import { execFileSync, execSync } from "node:child_process";
-import { findLiveProxy } from "./server/proxy-liveness";
 import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
-import { expandUserPath, getConfigDir, readPid, removePid, removeRuntimePort, verifyPidIdentity } from "./config";
+import { expandUserPath, getConfigDir, readPid, removePid, removeRuntimePort } from "./config";
 import { loadConfig } from "./config";
 import { restoreNativeCodex } from "./codex/inject";
 import { stripGrokConfig } from "./grok/inject";
@@ -428,70 +427,6 @@ export type WindowsSchedulerTaskProbe =
   | { status: "absent" }
   | { status: "unknown"; detail: string };
 
-export type WindowsSchedulerProxyProbe =
-  | { status: "running"; port: number }
-  | { status: "not-running" }
-  | { status: "unknown" };
-
-/**
- * Render Task Scheduler status without exposing localized `schtasks` table output.
- * The task probe answers installation state; the identity-checked health probe answers
- * runtime state. Keep probe details out of this user-facing line because they can contain
- * incorrectly decoded, locale-specific command output.
- */
-export function formatWindowsSchedulerServiceStatus(
-  task: WindowsSchedulerTaskProbe,
-  proxy: WindowsSchedulerProxyProbe,
-): string {
-  if (task.status === "present") {
-    if (proxy.status === "running") {
-      return `✅ service installed (Task Scheduler); OpenCodex proxy running on port ${proxy.port}.`;
-    }
-    if (proxy.status === "not-running") {
-      return "⚠️  service installed (Task Scheduler); OpenCodex proxy not running.";
-    }
-    return "⚠️  service installed (Task Scheduler); OpenCodex proxy status unknown.";
-  }
-  if (task.status === "absent") {
-    if (proxy.status === "running") {
-      return `❌ service not installed (Task Scheduler); OpenCodex proxy is running independently on port ${proxy.port}.`;
-    }
-    if (proxy.status === "unknown") {
-      return "❌ service not installed (Task Scheduler); OpenCodex proxy status unknown.";
-    }
-    return "❌ service not installed (Task Scheduler).";
-  }
-  if (proxy.status === "running") {
-    return `⚠️  Task Scheduler registration unknown; OpenCodex proxy running on port ${proxy.port}.`;
-  }
-  if (proxy.status === "not-running") {
-    return "⚠️  service status unknown (Task Scheduler query failed); OpenCodex proxy not running.";
-  }
-  return "⚠️  service status unknown (Task Scheduler and proxy checks failed).";
-}
-
-export async function inspectWindowsSchedulerServiceStatus(io: {
-  probeTask?: () => WindowsSchedulerTaskProbe;
-  findProxy?: () => Promise<{ port: number } | null>;
-} = {}): Promise<string> {
-  let task: WindowsSchedulerTaskProbe;
-  try {
-    task = (io.probeTask ?? probeWindowsSchedulerTask)();
-  } catch (error) {
-    task = { status: "unknown", detail: schtasksErrorDetail(error) };
-  }
-
-  let proxy: WindowsSchedulerProxyProbe;
-  try {
-    const live = await (io.findProxy ?? findLiveProxy)();
-    proxy = live ? { status: "running", port: live.port } : { status: "not-running" };
-  } catch {
-    proxy = { status: "unknown" };
-  }
-
-  return formatWindowsSchedulerServiceStatus(task, proxy);
-}
-
 function schtasksErrorDetail(error: unknown): string {
   return error instanceof Error ? error.message : String(error);
 }
@@ -1428,38 +1363,7 @@ export async function repairService(deps: RepairServiceDeps = {}): Promise<void>
  * scheduler backend first; on failure the machine is left with NO service (explicitly
  * reported) — never a silent fallback to the scheduler.
  */
-/** Refuse WinSW when the interactive user is a Microsoft account (SCM cannot authenticate it). */
-export function assertWindowsNativeServiceAccountSupported(): void {
-  if (process.platform !== "win32") return;
-  const source = readWindowsPrincipalSource();
-  if (source?.toLowerCase() === "microsoftaccount") {
-    throw new Error(
-      "The native (WinSW) service backend cannot run under a Microsoft-account Windows login. "
-        + "Keep the Task Scheduler backend (`ocx service install`) or sign in with a local/domain account before `ocx service install --native`.",
-    );
-  }
-}
-
-function readWindowsPrincipalSource(): string | null {
-  if (process.platform !== "win32") return null;
-  const ps = join(process.env.SystemRoot ?? "C:\\Windows", "System32", "WindowsPowerShell", "v1.0", "powershell.exe");
-  if (!existsSync(ps)) return null;
-  try {
-    const out = execFileSync(ps, [
-      "-NoLogo",
-      "-NoProfile",
-      "-NonInteractive",
-      "-Command",
-      "(Get-LocalUser -Name $env:USERNAME -ErrorAction SilentlyContinue).PrincipalSource",
-    ], { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], windowsHide: true }).trim();
-    return out || null;
-  } catch {
-    return null;
-  }
-}
-
 async function installWindowsNative(): Promise<void> {
-  assertWindowsNativeServiceAccountSupported();
   recordOwnedConfigPath(getConfigDir(), serviceStatePath());
   if (!existsSync(getConfigDir())) mkdirSync(getConfigDir(), { recursive: true });
   writeServiceApiTokenFile();
@@ -1494,49 +1398,11 @@ async function installWindowsNative(): Promise<void> {
   writeServiceInstallState("native");
 }
 function startWindows(): void { schtasks(["/run", "/tn", TASK]); }
-
-export function isWindowsSchedulerEndBenign(error: unknown): boolean {
-  const detail = schtasksErrorDetail(error).toLowerCase();
-  return detail.includes("no running instance")
-    || detail.includes("not currently running")
-    || detail.includes("0x41330");
-}
-
-/**
- * End the scheduler task. "Already stopped" is success; other `/end` failures are
- * swallowed so callers can still run tracked-proxy + live-proxy cleanup.
- *
- * Do not key a restart-window wait on `/end` failure: the #764 case is an `/end`
- * that *succeeds* while the wrapper survives and respawns. That verification lives
- * on the stop-verification path (poll across the restart window), not here.
- */
-export function stopWindows(): void {
-  try {
-    schtasks(["/end", "/tn", TASK]);
-  } catch (error) {
-    if (isWindowsSchedulerEndBenign(error)) return;
-  }
-}
+function stopWindows(): void { try { schtasks(["/end", "/tn", TASK]); } catch { /* not running */ } }
 function statusWindows(): string { try { return schtasks(["/query", "/tn", TASK]); } catch { return ""; } }
 function statusWindowsXml(): string { try { return schtasks(["/query", "/tn", TASK, "/xml"]); } catch { return ""; } }
 function uninstallWindows(): void {
-  const probe = probeWindowsSchedulerTask(TASK);
-  if (probe.status === "present") {
-    try {
-      schtasks(["/delete", "/tn", TASK, "/f"]);
-    } catch (error) {
-      throw new Error(`Failed to delete Task Scheduler task ${TASK}: ${error instanceof Error ? error.message : String(error)}`);
-    }
-    const afterDelete = probeWindowsSchedulerTask(TASK);
-    if (afterDelete.status === "present") {
-      throw new Error(`Task Scheduler task ${TASK} is still present after delete — refusing to remove service assets. Retry from an elevated shell.`);
-    }
-    if (afterDelete.status === "unknown") {
-      throw new Error(`Task Scheduler task ${TASK} presence could not be verified after delete — refusing to remove service assets.`);
-    }
-  } else if (probe.status === "unknown") {
-    throw new Error(`Task Scheduler task ${TASK} presence could not be verified — refusing to remove service assets.`);
-  }
+  try { schtasks(["/delete", "/tn", TASK, "/f"]); } catch { /* absent */ }
   if (existsSync(windowsServiceScriptPath())) unlinkSync(windowsServiceScriptPath());
   if (existsSync(windowsLauncherVbsPath())) unlinkSync(windowsLauncherVbsPath());
   if (existsSync(windowsTaskXmlPath())) unlinkSync(windowsTaskXmlPath());
@@ -1695,77 +1561,18 @@ function platformOps(backend: ServiceBackend = "scheduler"): ServiceOps | null {
 
 type TrackedProxyCleanupResult = "none" | "stale" | "stopped";
 
-function verifiedKillTarget(pid: number | null | undefined): number | null {
-  if (typeof pid !== "number" || !Number.isSafeInteger(pid) || pid <= 0) return null;
-  const verified = verifyPidIdentity(pid);
-  return verified === pid ? verified : null;
-}
-
-/**
- * Whether a proxy is still answering after the service manager claimed to stop it.
- *
- * `ops.stop()` reports the outcome of the STOP COMMAND, not of the process. A Windows scheduler
- * task whose wrapper survives `schtasks /end` respawns its child a few seconds later, so a stop
- * that returned success can still leave a live proxy — and `ocx service stop` then restored
- * native Codex on top of a running one (#764). The tracked-pid cleanup does not catch it either:
- * the respawned child writes a different pid, or none this process knows about.
- *
- * Probed rather than assumed, and bounded. The respawn risk is specific to a supervisor that can
- * restart its child — the Windows scheduler wrapper — so only that case pays the restart window.
- * Everywhere else a single probe answers the question, because nothing is going to bring the
- * proxy back after `launchctl unload` or `systemctl stop`. Making every platform wait 7s on a
- * stop that already succeeded would trade one bug for a worse everyday one.
- */
-export async function proxyStillLiveAfterStop(deps: {
-  findProxy?: () => Promise<{ port: number } | null>;
-  sleep?: (ms: number) => Promise<void>;
-  now?: () => number;
-  /** Whether the stopped supervisor can respawn its child; only then is polling worth the wait. */
-  canRespawn?: boolean;
-} = {}): Promise<{ port: number } | null> {
-  const findProxy = deps.findProxy ?? findLiveProxy;
-  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>(r => setTimeout(r, ms)));
-  const now = deps.now ?? Date.now;
-  const canRespawn = deps.canRespawn ?? process.platform === "win32";
-  const deadline = now() + (canRespawn ? 7000 : 0);
-  for (;;) {
-    try {
-      const live = await findProxy();
-      if (live) return live;
-    } catch {
-      // A probe failure is not proof the proxy is gone; keep polling until the deadline.
-    }
-    if (now() >= deadline) return null;
-    await sleep(1000);
-  }
-}
-
 async function stopTrackedProxyIfRunning(): Promise<TrackedProxyCleanupResult> {
-  let stopped = false;
   const pid = readPid();
-  const trackedKillPid = verifiedKillTarget(pid);
-  if (trackedKillPid !== null && isProcessAlive(trackedKillPid)) {
-    await stopProxy(trackedKillPid);
-    removePid(trackedKillPid);
-    removeRuntimePort(trackedKillPid);
-    stopped = true;
-  } else if (pid) {
+  if (!pid) return "none";
+  if (!isProcessAlive(pid)) {
     removePid(pid);
     removeRuntimePort(pid);
+    return "stale";
   }
-  // Orphan recovery: the pid file can be missing/stale while the service wrapper keeps
-  // a live proxy running — mirror `ocx stop`'s identity-checked findLiveProxy fallback.
-  const live = await findLiveProxy({ timeoutMs: 1500 });
-  const liveKillPid = verifiedKillTarget(live?.pid);
-  if (liveKillPid !== null) {
-    await stopProxy(liveKillPid);
-    removePid(liveKillPid);
-    removeRuntimePort(liveKillPid);
-    stopped = true;
-  }
-  if (stopped) return "stopped";
-  if (pid) return "stale";
-  return "none";
+  await stopProxy(pid);
+  removePid(pid);
+  removeRuntimePort(pid);
+  return "stopped";
 }
 
 async function stopTrackedProxyForServiceCommand(): Promise<TrackedProxyCleanupResult> {
@@ -2073,29 +1880,13 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       ops.start();
       console.log("✅ service started.");
       break;
-    case "stop": {
+    case "stop":
       assertServiceEnvironmentMatchesInstall();
       // Only stop what is actually installed. The unguarded call ran a real `launchctl unload`
       // (and its Windows/Linux twins) even with nothing installed.
-      if (ops.status() !== null || isServiceInstalled()) {
-        ops.stop();
-      }
+      if (ops.status() !== null || isServiceInstalled()) ops.stop();
       await stopTrackedProxyForServiceCommand();
       {
-        // Verify rather than trust the stop command: a surviving wrapper respawns its child
-        // seconds later, and restoring native Codex on top of a live proxy is the failure #764
-        // reports as "stop reports success without stopping the proxy".
-        const survivor = await proxyStillLiveAfterStop();
-        if (survivor) {
-          console.error(
-            `❌ service stop did not take effect: a proxy is still listening on port ${survivor.port}.`
-            + "\nNative Codex was NOT restored, because doing so while the proxy is running leaves"
-            + " both pointing at each other. Check for a second service backend (`ocx service status`)"
-            + " or a manually started proxy, then re-run `ocx service stop`.",
-          );
-          process.exitCode = 1;
-          break;
-        }
         const restore = restoreNativeCodex();
         if (restore.success) console.log("✅ service stopped + native Codex restored.");
         else console.error(`⚠️ service stopped, but native Codex restore FAILED: ${restore.message}\nRun \`ocx restore\` (or check $CODEX_HOME/config.toml) before using native Codex.`);
@@ -2106,14 +1897,9 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
         else if (!grok.ok) console.error(`⚠️  ${grok.message}`);
       }
       break;
-    }
     case "status": {
-      if (process.platform === "win32" && backend === "scheduler") {
-        console.log(await inspectWindowsSchedulerServiceStatus());
-      } else {
-        const s = ops.status();
-        console.log(s ? `✅ running:\n${s}` : "❌ service not installed/running.");
-      }
+      const s = ops.status();
+      console.log(s ? `✅ running:\n${s}` : "❌ service not installed/running.");
       console.log(`Diagnostics: ${serviceDiagnosticsSummary()}`);
       break;
     }
@@ -2152,4 +1938,3 @@ export async function serviceCommand(...args: (string | undefined)[]): Promise<v
       process.exit(1);
   }
 }
-