lidge-jun · Oct 13, 2026 · Oct 10, 2026 · Oct 10, 2026 · Oct 10, 2026 · Oct 10, 2026
@@ -4,8 +4,10 @@ description: >-
   runtime (default), or testRunnerBun for test-runner.
 
 # Runtime 1.4.2 fixes #6684's Windows Bun.fetch stream truncation. The test runner
-# stays on 1.4.0: #4821 reverted #4064 after 1.4.2's multi-file --isolate preload
-# segfault; #6713 run 37631558263 reproduces it on Linux 1/4, macOS 2/2, Windows 9/9.
+# skipped 1.4.2: #4821 reverted #4064 after its multi-file --isolate preload segfault
+# (#6713 run 37631558263: Linux 1/4, macOS 2/2, Windows 9/9). It moved from 1.4.0 to
+# 1.4.3 for oven-sh/bun#44581: 1.4.0's Bun.spawnSync could lose a child's exit after
+# finalizers ran inside an earlier call and spin past its own timeout (#4956).
 # Rejoin only after the upstream runner crash is fixed and a green lane=all
 # dispatch proves the unified version; then delete testRunnerBun and this role input.
 inputs:

@@ -550,8 +550,9 @@ jobs:
           printf 'scheduled run tests dev at %s (workflow %s)\n' "$sha" "$GITHUB_SHA"
 
   # Bun roles (#6713): runtime 1.4.2 fixes #6684's Windows Bun.fetch streaming;
-  # test-runner 1.4.0 avoids 1.4.2's multi-file --isolate preload segfault (#4821
-  # reverted #4064; run 37631558263: Linux 1/4, macOS 2/2, Windows 9/9).
+  # the test runner skipped 1.4.2's multi-file --isolate preload segfault (#4821
+  # reverted #4064; run 37631558263: Linux 1/4, macOS 2/2, Windows 9/9) and runs
+  # 1.4.3, whose oven-sh/bun#44581 stops Bun.spawnSync losing a child's exit (#4956).
   # Rejoin after the upstream runner crash is fixed and a green lane=all dispatch
   # proves the unified version, then delete testRunnerBun and the action's role input.
   # The suite, split by file across four Linux runners.
@@ -797,23 +798,30 @@ jobs:
         run: bun run src/cli/index.ts help
 
   platform-macos:
-    name: macos ${{ matrix.shard }}/2
+    name: macos ${{ matrix.shard }}/3
     needs: changes
     # Native-gated: these legs only run when the changes job's `native` filter
     # says the macOS suite's inputs could have changed, so an ordinary source
-    # pull request stops paying for two macOS runners.
+    # pull request stops paying for three macOS runners.
     if: github.event_name != 'pull_request' || (needs.changes.outputs.ci == 'true' && needs.changes.outputs.native == 'true')
     runs-on: macos-latest
-    # Two shards. Unsharded, this job was the critical path on every green dev
+    # Three shards. Unsharded, this job was the critical path on every green dev
     # push (mean 14.9 min against a 4.7 min Linux maximum; devlog
-    # 260905_test_modularization_and_windows/003). Two halves finish in ~7.7 and
-    # cost 0.6 extra macOS minutes of setup per run. The full-membership control
-    # runs the same bounded batches without sharding on explicit dispatch.
+    # 260905_test_modularization_and_windows/003), so it was split in two. The
+    # suite then outgrew two halves: across seventeen dev dispatches from
+    # 2026-10-04 to 10-12 the slower half's test step went from 867s to 1155s,
+    # and run 38214884055 cancelled macos 2/2 at this cap with 68 files left
+    # while every test it had run was passing (#6978). Replaying the duration
+    # assignment against those runs' measured per-file times puts the slowest of
+    # three shards at 635-796s of tests, about 14 minutes with setup. The cap
+    # stays 20: the suite needs another shard, not a longer wait, and a wedged
+    # shard (#4956) is still cut off as early as before. The full-membership
+    # control runs the same bounded batches without sharding on explicit dispatch.
     timeout-minutes: 20
     strategy:
       fail-fast: false
       matrix:
-        shard: [1, 2]
+        shard: [1, 2, 3]
     steps:
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
@@ -859,7 +867,7 @@ jobs:
 
       - name: Test in fresh-process batches
         env:
-          TEST_SHARD: ${{ matrix.shard }}/2
+          TEST_SHARD: ${{ matrix.shard }}/3
           BUN_TEST_FILE_SCOPE: all
           BUN_TEST_BATCH_SIZE: '12'
           BUN_TEST_PARALLEL: '1'

@@ -61,8 +61,8 @@ A ready-for-review PR is the author's claim that the change is complete, underst
 
 ## Local validation and hooks
 
-The suite uses Bun 1.4.0 (`testRunnerBun`) while the shipped runtime is 1.4.2.
-`scripts/test.ts` finds a 1.4.0 binary on PATH or in `~/.bun/bin`, or uses
+The suite uses Bun 1.4.3 (`testRunnerBun`) while the shipped runtime is 1.4.2.
+`scripts/test.ts` finds a 1.4.3 binary on PATH or in `~/.bun/bin`, or uses
 `OCX_TEST_RUNNER_BUN`; install that version locally if it is missing.
 
 Run `bun run test` before review readiness. If the full local suite is too costly

@@ -1,9 +1,10 @@
 # syntax=docker/dockerfile:1
 
 # Keep the runtime aligned with package.json and pin the multi-platform image index.
-# Runtime 1.4.2 fixes #6684's Windows Bun.fetch streaming; CI tests stay on 1.4.0
+# Runtime 1.4.2 fixes #6684's Windows Bun.fetch streaming; CI tests run on 1.4.3
 # because 1.4.2 segfaults reloading preloads in multi-file --isolate (#4821;
-# #6713 run 37631558263: Linux 1/4, macOS 2/2, Windows 9/9). Rejoin after the
+# #6713 run 37631558263: Linux 1/4, macOS 2/2, Windows 9/9) and 1.4.0's spawnSync
+# can lose a child's exit (#4956, oven-sh/bun#44581). Rejoin after the
 # upstream crash fix passes a unified-version lane=all dispatch, then delete
 # package.json's testRunnerBun pin and setup-project-bun's role input.
 ARG BUN_IMAGE=oven/bun:1.4.2@sha256:9114c058aeae42162ee16dd5084b95fe9473970bb6bcb5b232ab1630f0546895

@@ -1,6 +1,6 @@
 [package]
 name = "opencodex-desktop"
-version = "2.83.0"
+version = "2.84.0"
 description = "OpenCodex desktop shell"
 authors = ["OpenCodex contributors"]
 license = "MIT"

@@ -187,7 +187,75 @@ impl Record {
 pub struct Store {
     pub root: PathBuf,
     pub rc_allowed: Vec<PathBuf>,
-    _lock: fs::File,
+    _lock: LockGuard,
+}
+struct LockGuard {
+    file: fs::File,
+}
+impl LockGuard {
+    fn unlock(&self) -> i32 {
+        #[cfg(unix)]
+        {
+            use std::os::fd::AsRawFd;
+            // LOCK_UN releases the shared file description even if a fork retains a duplicate.
+            unsafe { flock(self.file.as_raw_fd(), 8) }
+        }
+        #[cfg(windows)]
+        {
+            use std::os::windows::io::AsRawHandle;
+            let mut v = Overlapped::zero();
+            unsafe { UnlockFileEx(self.file.as_raw_handle(), 0, 1, 0, &mut v) }
+        }
+    }
+    #[cfg(test)]
+    fn release_for_test(&self) -> i32 {
+        self.unlock()
+    }
+}
+impl Drop for LockGuard {
+    fn drop(&mut self) {
+        let _ = self.unlock();
+    }
+}
+#[cfg(windows)]
+#[repr(C)]
+struct Overlapped {
+    internal: usize,
+    high: usize,
+    offset: u32,
+    offset_high: u32,
+    event: *mut std::ffi::c_void,
+}
+#[cfg(windows)]
+impl Overlapped {
+    fn zero() -> Self {
+        Self {
+            internal: 0,
+            high: 0,
+            offset: 0,
+            offset_high: 0,
+            event: std::ptr::null_mut(),
+        }
+    }
+}
+#[cfg(windows)]
+#[link(name = "kernel32")]
+unsafe extern "system" {
+    fn LockFileEx(
+        h: *mut std::ffi::c_void,
+        flags: u32,
+        reserved: u32,
+        low: u32,
+        high: u32,
+        overlapped: *mut Overlapped,
+    ) -> i32;
+    fn UnlockFileEx(
+        h: *mut std::ffi::c_void,
+        reserved: u32,
+        low: u32,
+        high: u32,
+        overlapped: *mut Overlapped,
+    ) -> i32;
 }
 #[cfg(unix)]
 unsafe extern "C" {
@@ -533,7 +601,7 @@ pub fn atomic(path: &Path, before: Option<&[u8]>, after: &[u8], mode: u32) -> Re
     let _ = fs::remove_file(tmp);
     result
 }
-fn lock(root: &Path) -> Result<fs::File> {
+fn lock(root: &Path) -> Result<LockGuard> {
     let p = root.join("cli.lock");
     let existed = fs::symlink_metadata(&p).is_ok();
     if fs::symlink_metadata(&p).is_ok() {
@@ -561,45 +629,21 @@ fn lock(root: &Path) -> Result<fs::File> {
     #[cfg(unix)]
     {
         use std::os::fd::AsRawFd;
-        // LOCK_EX | LOCK_NB: OS releases the lock on close/process death; no stale PID deletion.
+        // LOCK_EX | LOCK_NB: immediate exclusion; the guard unlocks before closing.
         if unsafe { flock(f.as_raw_fd(), 2 | 4) } != 0 {
             return Err("lock-busy".into());
         }
     }
     #[cfg(windows)]
     {
         use std::os::windows::io::AsRawHandle;
-        #[repr(C)]
-        struct Overlapped {
-            internal: usize,
-            high: usize,
-            offset: u32,
-            offset_high: u32,
-            event: *mut std::ffi::c_void,
-        }
-        #[link(name = "kernel32")]
-        unsafe extern "system" {
-            fn LockFileEx(
-                h: *mut std::ffi::c_void,
-                flags: u32,
-                reserved: u32,
-                low: u32,
-                high: u32,
-                overlapped: *mut Overlapped,
-            ) -> i32;
-        }
-        let mut v = Overlapped {
-            internal: 0,
-            high: 0,
-            offset: 0,
-            offset_high: 0,
-            event: std::ptr::null_mut(),
-        };
+        let mut v = Overlapped::zero();
         if unsafe { LockFileEx(f.as_raw_handle(), 1 | 2, 0, 1, 0, &mut v) } == 0 {
             return Err("lock-busy".into());
         }
     }
-    Ok(f)
+    // A failed acquisition must only close its own file, never unlock another owner.
+    Ok(LockGuard { file: f })
 }
 impl Store {
     pub fn open(root: PathBuf, rc_allowed: Vec<PathBuf>) -> Result<Self> {
@@ -1807,6 +1851,120 @@ pub(crate) mod tests {
         assert!(s.validate(&r, false).is_err());
     }
     #[test]
+    fn lock_drop_releases_and_held_store_excludes_second_open() {
+        let t = Temp::new();
+        let s = t.store();
+        let root = s.root.clone();
+        assert_eq!(
+            Store::open(root.clone(), vec![]).err().as_deref(),
+            Some("lock-busy")
+        );
+        drop(s);
+        let reopened = Store::open(root.clone(), vec![]).unwrap();
+        assert_eq!(
+            Store::open(root, vec![]).err().as_deref(),
+            Some("lock-busy")
+        );
+        drop(reopened);
+    }
+    #[cfg(unix)]
+    #[test]
+    fn lock_drop_releases_even_with_duplicate_file_description() {
+        let t = Temp::new();
+        let s = t.store();
+        let root = s.root.clone();
+        let duplicate = s._lock.file.try_clone().unwrap();
+        drop(s);
+        let reopened = Store::open(root.clone(), vec![]).unwrap();
+        assert_eq!(
+            Store::open(root, vec![]).err().as_deref(),
+            Some("lock-busy")
+        );
+        assert_eq!(reopened._lock.release_for_test(), 0);
+        drop(duplicate);
+    }
+    #[cfg(unix)]
+    #[test]
+    fn lock_drop_releases_during_concurrent_process_spawns() {
+        use std::{
+            process::Command,
+            sync::{atomic::AtomicBool, atomic::Ordering, Barrier},
+            thread,
+        };
+        // Present on macOS and on Linux runners; macOS has no /bin/true.
+        const TRUE: &str = "/usr/bin/true";
+        let t = Temp::new();
+        let root = t.store().root.clone();
+        let stop = AtomicBool::new(false);
+        let ready = Barrier::new(5);
+        let mut busy = 0;
+        let mut errors = Vec::new();
+        let spawns = thread::scope(|scope| {
+            let workers: Vec<_> = (0..4)
+                .map(|_| {
+                    scope.spawn(|| {
+                        ready.wait();
+                        let mut spawns = 0;
+                        while !stop.load(Ordering::Relaxed) {
+                            assert!(Command::new(TRUE).status().unwrap().success());
+                            spawns += 1;
+                        }
+                        spawns
+                    })
+                })
+                .collect();
+            ready.wait();
+            for _ in 0..2000 {
+                // Each cycle opens, drops and reopens, without waiting or retrying a busy lock.
+                for _ in 0..2 {
+                    match Store::open(root.clone(), vec![]) {
+                        Ok(store) => drop(store),
+                        Err(e) if e == "lock-busy" => busy += 1,
+                        Err(e) => errors.push(e),
+                    }
+                }
+            }
+            stop.store(true, Ordering::Relaxed);
+            workers
+                .into_iter()
+                .map(|worker| worker.join().unwrap())
+                .sum::<usize>()
+        });
+        eprintln!("lock stress: cycles=2000, spawners=4, spawns={spawns}, lock-busy={busy}");
+        assert!(spawns >= 4, "process spawners did not run");
+        assert!(errors.is_empty(), "unexpected open errors: {errors:?}");
+        assert_eq!(busy, 0);
+    }
+    #[test]
+    fn failed_open_after_lock_acquisition_releases_lock() {
+        let t = Temp::new();
+        let s = t.store();
+        let root = s.root.clone();
+        atomic(&root.join("cli.json"), None, b"{", 0o600).unwrap();
+        drop(s);
+        assert_eq!(
+            Store::open(root.clone(), vec![]).err().as_deref(),
+            Some("record-invalid")
+        );
+        let guard = lock(&root).unwrap();
+        assert_eq!(lock(&root).err().as_deref(), Some("lock-busy"));
+        drop(guard);
+        let _guard = lock(&root).unwrap();
+    }
+    #[cfg(windows)]
+    #[test]
+    fn lock_guard_windows_explicit_release_allows_second_handle_to_relock() {
+        let t = Temp::new();
+        let s = t.store();
+        assert_ne!(s._lock.release_for_test(), 0);
+        let root = s.root.clone();
+        let second = lock(&root).unwrap();
+        drop(s);
+        assert_eq!(lock(&root).err().as_deref(), Some("lock-busy"));
+        assert_ne!(second.release_for_test(), 0);
+        let _third = lock(&root).unwrap();
+    }
+    #[test]
     fn lock_and_atomic_write_preserve_concurrent_user_edits() {
         let t = Temp::new();
         let s = t.store();