Repository navigation
Conversation
Opt-in helper for the disabled Windows CLI apply path (#2811). Starts an explicit drive-absolute .exe via CreateProcessW(CREATE_SUSPENDED), assigns it to an unnamed non-inheritable Job, then resumes. STARTUPINFOEXW whitelists exactly the three owned inheritable stdio handles; output flows over a private single-principal overlapped named pipe. Terminal proof requires the original primary handle signaled plus a successful Job accounting query reporting zero active processes; WAIT_FAILED, query failure, PID absence, acknowledged termination and exit 259 are handled exactly. Installer and pack policies add no deadline, process cap, abort kill or kill-on-close; only the version probe keeps its existing 16 KiB / 8 s / 1 s reap policy. No consumer imports it yet; Windows apply remains refused and ARM64 is unsupported.
…uncher arch anchor
…the shim interpreter
…ndows-apply-transaction-20261023
…ndows-apply-transaction-20261023 # Conflicts: # scripts/test-layout/layout-codex-collision.json # structure/codex-cli-update.md
…ndows-apply-transaction-20261023
…ndows-apply-transaction-20261023
…ndows-apply-transaction-20261023
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review: 2
Please check the settings in the CodeRabbit UI or the
 |
|
There are no GUI layout or interaction changes requiring screenshots. The only |
|
✅ Deterministic PR hygiene checks passed. |
|
Fixed the two Windows 3/9 fixture failures from run 40052614948 in The unsafe-store test now creates an explicit junction and verifies rejection before ledger creation. The metadata test uses a private fixture, checks applicability against the observed session state, and verifies exactly three metadata queries, no candidate/installer execution, unchanged files, and child cleanup. Production code and security checks are unchanged. The changed cases passed under official Bun 1.4.4; the final ACL preparation change passed its affected case (31 assertions). The earlier 1.4.3 run is comparison evidence only. Independent review found the assertions stronger; its remaining fixture-ACL concern is addressed in this head. Type/privacy checks passed before the final fixture-only adjustment. Fresh hosted CI remains pending; this PR stays Draft. |
Align the seven locale summaries (fr, ja, ko, ru, tr, zh-cn, zh-tw) in cli.md and cli/agents.md with the English contract: the held-bound Node/npm toolchain is prefix-local when present, otherwise the captured-PATH pair anchored to the launcher architecture; a managed Windows result classifies the observed installation layout only and does not guarantee which interpreter a later codex.cmd resolves; PATH-only selection, OpenCodex autostart wrappers, and global/vendor fallback stay deferred with apply disabled.
…48-fanin-current-parent-20261024 # Conflicts: # docs-site/src/content/docs/ko/reference/cli.md # src/codex/cli-update-apply.ts # src/codex/cli-windows-plan-provenance.ts # src/codex/windows-installation-files.ts # tests/codex-integration/codex-cli-update-artifacts.test.ts # tests/codex-integration/codex-cli-windows-plan.test.ts
…48-fanin-current-parent-20261024
|
I’m returning this PR to draft while integrating the updated Worker parent. The Windows transaction path needs to carry the shared cancellation and final installer commit gate through that execution boundary, followed by owned native-child and transaction tests. The earlier main-realm validation does not qualify that new integration; I’ll keep the existing evidence separate from the updated candidate. |
Summary
Enable explicitly confirmed Windows x64 npm-global CLI updates through the existing durable job admission and fresh
planIdchecks. Hold prefix and toolchain authority before packing, installing and checking the version, then verify the installed target.Preserve unrelated packages, shims and npm metadata in bounded shared prefixes. Unknown child lifetime or incomplete native cleanup retains ownership, lease and staging. Result-persistence retries never rerun installation.
Stacked on #7626, with #7614, #7618 and #7619 as sibling prerequisites. Current head
bc08a4849543994417f5fa14c8a5c30bb6b61dd8incorporates their refreshed heads through normal merges. It preserves the original Windows transaction while adopting the parent's asynchronous metadata/process observation, post-scan synchronous guard, opt-in content observation and handles held across awaited callbacks. No history was rewritten.Documentation now distinguishes read-only inspection from conditional applicability and confirmed apply in English and seven translated locales. The broken confirmation link now points to the actual heading fragment.
Verification
bc08a4849543994417f5fa14c8a5c30bb6b61dd8is the stack fan-in: a normal-merge composition of original headfb855aa4and refreshed parentd06d85ec, which carries currentdev(0aeaf0cb), the shared Bun 1.4.4 baseline from chore(test): align Bun runner with the 1.4.4 security baseline #7627 and all refreshed siblings.bun test --isolate --timeout 60000: the 18-unit fan-in suite passed 510 tests / 64 platform skips / 0 failures / 2,911 assertions, covering the Windows apply file, real child/Job ownership, offline npm fixtures, shared-prefix preservation and mutation rejection, selection fencing and result-persistence retries. One initial sparse-fixture failure was classified as missing tracked fixture materialization, corrected, and retained as evidence; it was not a source assertion regression.tests/codex-integration/codex-cli-update-apply.test.tsmatches the measured test blob here.tsc --noEmit, structure SSOT, skill-surface and scoped static checks all exited 0. Dependency inputs are byte-identical across the eight refreshed heads; versusdevonlytestRunnerBunchanges to 1.4.4.Checklist
Ready for review with exact-head full CI complete. Explicit maintainer/security acceptance is still required before merge; local fixtures and source review are not deployment or merge approval.