No security concerns identified. The browser SSRF policy changes (assertCdpEndpointAllowed) improve security by blocking private-network CDP URLs when a strict policy is configured.

1. src/daemon/schtasks.ts, line 537-547 (link)

   Unused stdout parameter

   After removing the stdout.write() call, the stdout parameter in restartStartupEntry is no longer referenced in the function body. Since this is a private (non-exported) function, the unused parameter could be dropped to avoid a potential Oxlint no-unused-vars warning.

   The two call sites in restartScheduledTask would also need their stdout argument removed accordingly.

   Prompt To Fix With AI

   This is a comment left during a code review.
   Path: src/daemon/schtasks.ts
   Line: 537-547
   
   Comment:
   **Unused `stdout` parameter**
   
   After removing the `stdout.write()` call, the `stdout` parameter in `restartStartupEntry` is no longer referenced in the function body. Since this is a private (non-exported) function, the unused parameter could be dropped to avoid a potential Oxlint `no-unused-vars` warning.
   
   
   
   The two call sites in `restartScheduledTask` would also need their `stdout` argument removed accordingly.
   
   How can I resolve this? If you propose a fix, please make it concise.

Best possible solution:

Centralize Windows gateway restart success messaging so schtasks and startup-fallback completed restart flows print exactly one human success line after the final retry/check path, while keeping browser CDP SSRF policy work in a separate security-reviewed change.

Do we have a high-confidence way to reproduce the issue?

Yes. Current main has deterministic source evidence: schtasks/startup-fallback restart paths write to stdout, and stale-PID post-restart recovery can invoke the same restart implementation again.

Is this the best way to solve the issue?

No. Removing the service-layer writes alone is not the best fix because completed restarts are not centrally printed today, and the browser SSRF changes are outside the Windows restart-output scope.

Full review comments:

• [P2] Preserve one completed restart success line — src/daemon/schtasks.ts:805-806
  This path still returns completed, and runServiceRestart() only prints central human output for scheduled restarts or handled recovery messages. Removing the schtasks/login-item writes makes ordinary successful Windows restarts silent; move one final success message to the lifecycle flow instead of deleting all completed-restart output.
  Confidence: 0.88

Overall correctness: patch is incorrect
Overall confidence: 0.86

Security concerns:

• [medium] Split CDP SSRF policy changes — extensions/browser/src/browser/cdp.helpers.ts:44
  The diff changes assertCdpEndpointAllowed() so trusted private-network mode with no hostname allowlist can return before hostname policy resolution, and it adds profile-creation CDP validation in the same branch as the schtasks output fix. That security boundary should be reviewed separately on its own threat model.
  Confidence: 0.84

Acceptance criteria:

• pnpm test src/cli/daemon-cli/lifecycle-core.test.ts src/cli/daemon-cli/lifecycle.test.ts src/daemon/schtasks.test.ts src/daemon/schtasks.stop.test.ts src/daemon/schtasks.startup-fallback.test.ts
• pnpm exec oxfmt --check --threads=1 src/daemon/schtasks.ts src/cli/daemon-cli/lifecycle.ts src/cli/daemon-cli/lifecycle-core.ts src/cli/daemon-cli/lifecycle-core.test.ts src/cli/daemon-cli/lifecycle.test.ts
• pnpm check:changed in Testbox before handoff if runtime files change

What I checked:

• Current main still writes scheduled-task restart output in the service layer: restartScheduledTask() calls runScheduledTaskOrThrow() and then writes Restarted Scheduled Task directly to stdout before returning { outcome: "completed" }. (src/daemon/schtasks.ts:1013, a7a8c8121a67)
• Current main still writes startup-fallback restart output in the service layer: restartStartupEntry() writes Restarted Windows login item directly to stdout before returning a completed restart result. (src/daemon/schtasks.ts:596, a7a8c8121a67)
• Stale-PID retry can call the restart implementation again: When post-restart health finds stale gateway PIDs, lifecycle.ts terminates them and calls service.restart({ env: process.env, stdout }) a second time, so service-layer success writes can repeat. (src/cli/daemon-cli/lifecycle.ts:264, a7a8c8121a67)
• Completed restarts are not centrally printed today: runServiceRestart() only routes scheduled restart statuses through emitScheduledRestart(); after a completed restart it emits JSON state and prints only handled recovery messages, so deleting the schtasks writes would make normal completed restarts silent. (src/cli/daemon-cli/lifecycle-core.ts:523, a7a8c8121a67)
• PR diff removes the scheduled-task success write without adding central completed output: The PR diff changes restartScheduledTask() from explicit /Run plus stdout success output to only await runScheduledTaskOrThrow(taskName); return { outcome: "completed" };. (src/daemon/schtasks.ts:805, e1b40c4701f8)
• Current main has fallback-aware scheduled-task launch behavior that a replacement must preserve: runScheduledTaskOrThrow() now receives taskName, env, and scriptPath, and restartScheduledTask() passes those arguments so accepted-but-not-started scheduled tasks can relaunch through the fallback script. (src/daemon/schtasks.ts:1008, a7a8c8121a67)

Likely related people:

• steipete: Current-main blame/history for the Windows schtasks restart flow, lifecycle restart handling, and browser CDP/profile files points to Peter Steinberger; this is the clearest available routing signal for both affected surfaces. (role: recent maintainer; confidence: medium; commits: 0bb52118e6c8, a7a8c8121a67; files: src/daemon/schtasks.ts, src/cli/daemon-cli/lifecycle.ts, src/cli/daemon-cli/lifecycle-core.ts)

Remaining risk / open question:

• No Windows live smoke was run in this read-only review; the duplicate path is clear from source, but final validation should include targeted tests and preferably a Windows manual run.
• The browser CDP SSRF changes overlap current-main behavior and should be split from this gateway fix rather than carried through an automated replacement.

Codex review notes: model gpt-5.5, reasoning high; reviewed against a7a8c8121a67.