Repository navigation
[Bug]: ocx-launcher-runtime tests fail when the checkout is on a group-writable volume #7402
Description
Client or integration
Other
Area
Installation or packaging
Summary
tests/cli/ocx-launcher-runtime.test.ts fails 6 cases when the repository lives on a macOS external volume whose directories are group-writable, as with goat worktrees under /Volumes/.... The PATH-Bun trust checks reject the fixture paths. Because of this, bun run test, bun run test:changed and the prepush script can never pass on such a checkout, even on clean dev and on branches that do not touch launcher code. Expected: either the fixtures use a trusted temporary root, or the suite skips with a clear reason when the volume's permissions make the trust check impossible.
Reproduction
- Check out
devon an external APFS volume with group-writable parent directories. bun test --isolate tests/cli/ocx-launcher-runtime.test.ts(Bun 1.4.3)- 71 pass / 6 fail.
A subagent also saw 3 failures from a trusted temp path, where a parent node_modules/bun leaked into the fixture.
Version
Operating system
macOS 27 (darwin 27.0.0, arm64), external volume
Provider and model
No response
Logs or error output
(fail) real PATH Bun validation > trusted Bun symlink is accepted
(fail) real PATH Bun validation > real PATH validation rejects the small stub and accepts the complete executable
(fail) Node launcher PATH fallback activation > missing bundle reaches validated PATH Bun
(fail) Node launcher PATH fallback activation > broken bundle reaches validated PATH Bun
(fail) Node launcher PATH fallback activation > inspection bundle reaches validated PATH Bun
(fail) Node launcher PATH fallback activation > repair runtime wins over PATH
Observed while validating #7394 and #7395. Those PRs were pushed with --no-verify for this reason.
Screenshots and supporting files
No response
Redacted configuration
No response
Checks
- I searched existing issues and documentation.
- I removed secrets, tokens, account details, request credentials, and personal data.
Activity
github-actions commentedon Oct 19, 2026
Automated translation bookkeeping — detected language: English.
Ingwannu commentedon Oct 20, 2026
Checked against trusted dev
12025981e5a304cdb6b1b54f525ba8554f623977. Keep launcher trust validation intact. The relevant failure is fixture trust/provenance: a group-writable ancestor and a parent node_modules/bun can independently change which candidate is admissible. A fix should build the accepted executable fixture under a verified private root, fence candidate discovery, and separately retain rejection controls for untrusted parents. Please capture only redacted path class, UID/GID/modes and selected source for the failing fixture; no chmod of the project/volume or blanket skip. The macOS volume failure is not independently reproduced here.