Repository navigation
Conversation
Introduce cli-update-job-store-windows.ts as the NTFS backend for the durable codex-cli-update ledger: ancestors are opened relative to the held volume-root pin under trusted-ancestry and write-private ACL policies, the mkdir plus owner-record admission mutex releases only while held pins still show this call identity, and ledger writes publish through a private hardened temp that is byte, ACL and identity verified before and after the handle-bound rename. cli-update-job.ts exposes async admit, read, finish and run and dispatches to the backend through a lazy import so the FFI module stays out of the POSIX graph; cli-update-job-execution.ts shares the store bounds, lets JobWork return promises, and makes the retry helper await the operation. CLI status and apply and the management routes await the async APIs. windows-owner-acl.ts gains a shared strict line-protocol parser with per-entry private, write-private and trusted-ancestry policies plus an async verifier whose bounded PowerShell read abandons a timed-out lookup child instead of waiting for reap, which exists for handle-bearing icacls children; confined-policy trusted ownership no longer depends on the serving token elevation state. Backend is x64-only; other-SID and ARM64 behavior is unverified.
…L lookup comment Move windows-codex-cli-job-store.test.ts out of layout.json explicit into the new explicitShards map layout-windows-cli-update.json so layout.json stays at 1999 lines and needs no file-size cap entry; drop the baseline cap. Rewrite the async ACL runner comment: the read-only lookup is abandoned rather than awaited because the post-kill reap wait exists for handle-bearing icacls children, and a lingering killed child can still hold a transient Get-Acl handle on the verified owner, lock or ledger files and leave the lock busy until the kernel reaps it -- an availability limit, not a safety one; the verdict stays timedOut, the late result is never read, and the runner fails closed.
…ndows-cli-job-store-20261023 # Conflicts: # scripts/test-layout/layout.json
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: true
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
✅ Deterministic PR hygiene checks passed. |
luvs01
marked this pull request as draft
October 24, 2026 06:29
Bun.spawnSync returns SyncSubprocess, whose bun-types 1.4.0 declaration has no signal member; exitCode is non-nullable number. The intended check is the declared exitedDueToTimeout flag, which is also correct where POSIX signals do not exist.
…26-on-aligned-lower-20261025
…26-dev6672-refresh-20261025
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds protected Windows x64 durable job-ledger storage. CLI/HTTP admission, status and completion writes use asynchronous storage with held identities, private locking, bounded ACL checks and verified publication. Completion-write retries do not rerun the engine; uncertain locks are not automatically reclaimed.
The refresh also removes nine duplicate registrations of already-owned native handles. Registering the same handle twice could make release report failure after it had already been closed. Invalid-handle checks and retention of failed closes remain intact. It includes #7715's one-line Bun timeout diagnostic correction used by the stricter helper check.
Stacked on #7596 at
d662a41ed4e97d60d22a48d504921d22643a1237. Candidate0730ebd978d4d7b1b49ecd1d34811bc846b10015normally merges refreshed parentd662a41einto previous public46f36cd1; its parent-relative scope is 18 files (+1571/-165). The retained pin/open sharing policy supports the transaction child's held authority without allowing competing writes/deletes. Windows installation/apply remains disabled here.Verification
At this refreshed head, source TypeScript, structure/INDEX consistency, generated skill surface, both layout guards (29 cases / 579 assertions) and parent-relative privacy/file-size checks passed under Bun 1.4.4. Native processes exited with both output streams at EOF and no remaining direct child. The whitespace check also passed.
84930edbexactly. The previously recorded actual-ledger 1 pass / 9 assertions is retained only as historical source-unit evidence for that implementation. Pin-positive/counterfactual observations from the 849/F1e2 integration retain their own fixture/head limits; they are not a new full-suite or native-fault PASS for this commit.cbfa1f32three-case ledger/Worker run (3 pass / 31 assertions) predates the sharing-policy change and is historical, not a complete validation of this refreshed store.Draft remains. Exact-head hosted coverage and refreshed native-transaction validation remain separate; actual npm/vendor installation, other users, ARM64, filtered tokens and live service acceptance are unverified. Explicit installation/security-boundary maintainer acceptance is required before merge. No account, installer, certificate store or live session was modified.
Checklist