[Bug]: Windows standalone 2.71.0 service wrapper is rejected by the ownership probe #6237

Client or integration

Codex App

Area

Service lifecycle

Summary

On Windows, a service installed by the OpenCodex 2.71.0 standalone executable writes a valid opencodex-service.cmd, but ocx sync refuses to update the Codex configuration because the ownership probe rejects that wrapper.

The generator and validator disagree:

• The standalone generator intentionally emits:
  "%OCX_BUN%" start --port ...
  because a standalone executable has no source CLI entry.
• The ownership validator accepts only:
  "%OCX_BUN%" "%OCX_CLI%" start ...

As a result, a wrapper generated by OpenCodex itself is classified as unknown.

Expected behavior: accept both wrapper forms generated by OpenCodex, while continuing to reject malformed or inconsistent wrappers.

Reproduction

1. Install the official OpenCodex 2.71.0 Windows standalone executable.
2. Run ocx service install.
3. Run ocx sync, or trigger model synchronization from the dashboard.
4. Observe that synchronization is refused because ownership cannot be proven.
5. Inspect %USERPROFILE%\.opencodex\opencodex-service.cmd and confirm that the standalone wrapper invokes "%OCX_BUN%" start --port ... without OCX_CLI.

The same contradiction is visible in source:

• src/service/windows-taskxml.ts generates a direct "%OCX_BUN%" start command for standalone entries.
• src/service-manager-probe.ts only recognizes the "%OCX_BUN%" "%OCX_CLI%" start form.

Version

2.71.0 (Windows standalone executable)

Operating system

Windows 11 25H2, x64, build 26200.9457

Provider and model

Not provider-specific.

Logs or error output

Refusing to write because ownership could not be proven: the launcher wrapper does not look like a generated opencodex service wrapper: C:\Users\<user>\.opencodex\opencodex-service.cmd

Screenshots and supporting files

No response

Redacted configuration

{
  "note": "The failure is not provider- or routing-configuration-dependent."
}

Checks

• I searched existing issues and documentation.
• I removed secrets, tokens, account details, request credentials, and personal data.