[lidge-jun]

Summary

Follow-up to #7397. It fixes the two real failures from the post-merge Ubuntu CI run (39331404182).

#7401: the Windows shim refresh identity check depended on Linux filesystem behavior. src/codex/shim-windows-refresh.ts replaces an obsolete Windows Codex wrapper by moving it aside, creating an exclusive stage, and hard-linking that stage into place. Each step checked that a file was still "ours" by comparing only device and inode numbers. Two Linux behaviors break that check, both verified on an ext4 host:

• A freed inode number goes straight to the next file or symlink created. 20 of 20 symlinks created right after an unlink got the unlinked file's inode.
• link(2) on a symlink source creates a symlink entry. macOS follows the symlink instead.

So on Linux, a stage swapped for a symlink was reported as published, and a substituted aside was restored as the launcher. The two round-4 tests caught this on Ubuntu but passed on macOS. It's a real defect in the code, not a test assumption, so the tests stay strict and are not skipped on Linux.

The fix makes the guarantee independent of platform behavior:

• Identities include whether the entry is a symlink, so a symlink never matches a regular file.
• The stage and the moved wrapper are held open for the whole transaction, so their inode numbers can't be reused while they are being compared.
• Every failure path, including a throwing fstat, closes its descriptors and puts the wrapper back. That gap was found by the security re-review.

#7400: missing cold-spawn disposition. tests/codex-integration/codex-shim-bypass-token.test.ts (added in #7397) times spawned children against the deadline but had no entry in tests/ci-workflows/cold-spawn-warmup.test.ts. It is now recorded as unwarmed, with the same reasoning as its codex-shim-ensure-failure neighbour: the children are /bin/sh stand-ins, so no repository module graph exists to warm.

Fixes #7400
Fixes #7401

Verification

• bun run typecheck, bun run structure:check, bun run privacy:scan: pass.
• bun test --isolate over the file-size and import-cycle ratchets, the test-layout guards, the core/Lab boundary, cold-spawn-warmup, codex-shim-bypass-token and codex-shim-windows-revision: 115 pass, 0 fail (before the descriptor-hygiene test was added). codex-shim-windows-revision alone is now 15/15 on macOS.
• Windows-related cases in codex-shim.test.ts and codex-shim-readiness.test.ts: 14 pass, 23 platform skips, 0 fail.
• Linux (Ubuntu kernel 6.17, ext4), in a temporary clone of dev on a separate host:
  • Unmodified dev reproduces the CI failures (12 pass, 2 fail, the same two round-4 cases).
  • With this change, codex-shim-windows-revision + cold-spawn-warmup pass 35/35 on each of 3 runs. The clone was deleted afterwards.
• The new descriptor-hygiene test fails without its fix.
• Native Windows was not run. Windows handle semantics (libuv opens with delete sharing, so unlink, rename and link of an open file still work) were reviewed from source by the security reviewer.

Security review

SECURITY REVIEW: PASS

Dedicated sol (gpt-6.1-sol) review of the refresh change:

• Round 1 found one Medium: a throwing fstat leaked the aside descriptor and left the launcher missing. Fixed, with a regression test.
• Round 2: no findings. SECURITY REVIEW: PASS

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. (No user-facing change; the module's own contract comment is updated.)
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Bug Fixes
  • Improved the reliability of Windows shim updates by verifying files before replacing them. If a file does not pass validation, the original wrapper is restored when safe, and temporary resources are cleaned up. These safeguards help prevent unintended file changes and leave the existing shim in place when an update cannot be completed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T22:51:43.712331Z	5f66c1a	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 0db2b514-22de-4109-9756-092487d741bc

📥 Commits

Reviewing files that changed from the base of the PR and between 1cf98c0 and 5f66c1a.

📒 Files selected for processing: 3

• src/codex/shim-windows-refresh.ts
• tests/ci-workflows/cold-spawn-warmup.test.ts
• tests/codex-integration/codex-shim-windows-revision.test.ts

+---------------------------------------------------+
| Brace yourself. Winter is coming...for your bugs. |
+---------------------------------------------------+
  \
   \     /)/)
        ( '')
        /  |
      o(___)

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5f66c1aefc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Bind the fingerprint to the held aside file

If a concurrent installer replaces aside after shimPathFingerprint() finishes but before holdExisting() performs its first lookup, movedFingerprint still describes the observed wrapper while moved pins the replacement. Because these results are validated independently, the transaction proceeds, publishes the generated shim, and then discard(aside, moved) deletes the concurrent install. Derive the fingerprint from the held descriptor, or explicitly verify that the fingerprint and held identity describe the same entry before proceeding.

Useful? React with 👍 / 👎.