fix(windows): one scheduler-wrapper killer, scoped to one installation

[lidge-jun]

Summary

• src/service.ts and src/update/job.ts each carried a copy of the same teardown logic, and the copies drifted in both directions. service.ts matched canonical full paths as complete command-line tokens; update/job.ts matched the bare filenames with -like '*name*'. Meanwhile update/job.ts had received the [Bug] Windows PowerShell -WindowStyle Hidden causes EACLIDENTITY under Bun #1589 argv cleanup that service.ts had not (fixed in the parent PR).
• The bare-filename matcher is the defect. Two OpenCodex homes under one Windows account means a dashboard update for home A can force-terminate home B's scheduler wrapper, and any unrelated process whose command line contains either filename matches as well.
• Extracted the service.ts implementation, which was the correct one, into src/lib/windows-service-wrappers.ts and pointed both callers at it. The updater now passes its own config dir instead of bare names.
• windowsWrapperKillScript is exported because the matching rule is the entire point of the module and the spawn reports nothing: the script it builds is the only observable surface, which is the same source-level convention windows-deploy-close-regressions.test.ts already uses.
• Two existing assertions pinned strings that moved (windows-deploy-close-regressions.test.ts, cli-ready.test.ts). They follow the invariant to the shared module rather than being dropped.

Second of a stacked chain implementing devlog/_plan/260817_windows_stability_program/ (phase 020). Targets #1944; retarget to dev once that lands.

Verification

• Driven red first: the "neither file keeps a private matcher" assertion failed for both files before the extraction.
• bun test tests/windows-service-wrappers.test.ts — 5 pass (new file)
• bun test tests/service.test.ts tests/windows-deploy-close-regressions.test.ts tests/windows-popup-fix.test.ts tests/windows-service-wrappers.test.ts — 143 pass
• bun test tests/cli-ready.test.ts — 57 pass
• bun run typecheck — clean

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• ^dev$
• ^preview$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 248692e6-4cb2-4bad-a5d6-3b0d1021f76e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.