[luvs01]

Summary

Adds a read-only verifier for Windows x64 Codex CLI archives and the expected installed layout. It checks main/backing package linkage, the codex.exe PE header, Windows path ambiguity, three supported npm shims, and the relative path, size and digest of every expected package file.

Windows tar checks are opt-in. The native header comes from the same verified stream with at most 4 KiB of extra buffering. The result explicitly carries applicable: false and mutationAuthority: false; there is no apply consumer.

Stacked on #7596 at refreshed head f7e55ab0. This is one part of #2811.

Limits

Supports x64, ASCII archive paths, sibling backing packages and the specified node-shebang shim grammar. PE header sanity is not signature, loadability or execution proof. Byte equality does not establish prefix ownership, selection or write authority. Real npm installation and native acceptance remain unverified.

Verification

• Current head 29f3d2c5cbbb6423fdba23f04334edac14cca747 is a normal-merge composition of original head aa396701 and refreshed parent f7e55ab0 (current dev plus the shared Bun 1.4.4 baseline from chore(test): align Bun runner with the 1.4.4 security baseline #7627), plus the shared one-row CI duration-table correction. The Windows layout/path verifiers and their fixtures/tests are unchanged.
• Runtime and configured test runner are now both Bun 1.4.4.
• On this exact head, official Bun 1.4.4, native Windows, bun test --isolate --timeout 60000: tests/codex-integration/codex-cli-update-windows-layout.test.ts 40 passed / 0 failed / 69 assertions. Root tsc --noEmit, structure SSOT, skill-surface and scoped static checks all exited 0.
• The new duration-table row is a scheduling sample from a successful Bun 1.4.4 integration run, not a measurement of every current parent head.
• Dependency inputs are byte-identical across the eight refreshed heads; versus dev only testRunnerBun changes to 1.4.4.
• The stack fan-in head (feat(codex): apply Windows CLI updates with owned transactions #7648, bc08a484), which contains this change, passed 510 tests / 64 platform skips / 0 failures / 2,911 assertions across 18 units on the same validation.
• Remaining: real npm installation and native acceptance (per Limits), native POSIX execution, and required maintainer security acceptance. Current-head CI is pending on this head; additional native runs follow sequentially after the first wave. No live configuration, provider, installer or OS certificate store was changed.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}