test: partition Windows apply coverage and rebalance hosted shards

scripts/test-layout/layout-codex-collision.json

@@ -1,5 +1,8 @@
 {
   "codex-cli-windows-child.test.ts": "codex-integration",
+  "codex-cli-update-windows-apply-install.test.ts": "codex-integration",
+  "codex-cli-update-windows-apply-outcomes.test.ts": "codex-integration",
+  "codex-cli-update-windows-apply-shared.test.ts": "codex-integration",
   "codex-cli-update-windows-layout.test.ts": "codex-integration",
   "codex-cli-windows-plan.test.ts": "codex-integration",
   "codex-launcher-diagnostics.test.ts": "codex-integration",

structure/codex-cli-update.md

@@ -217,11 +217,14 @@ not npm's exit code. Version uses the pinned Node with the verified JS entrypoin
 then repeats selection/content observation; it does not attest arbitrary future CMD lookup.
 Cleanup errors remain separate from the result. The existing job execution layer retries result
 persistence without repeating installation. No automatic rollback or stale-lock recovery exists.
-`tests/codex-integration/codex-cli-update-windows-apply.test.ts` covers real offline npm in private
-shared fixtures, unrelated package/shim preservation, terminal close failure, partial mutations,
-absence, selection, unknown retention, async pins and persistence retry. One JS launcher executes
-a compiled CLR x64 backing fixture that verifies Job membership and returns the version. This is
-executable-fixture evidence, not a run of the vendor Codex product.
+`tests/codex-integration/codex-cli-update-windows-apply.test.ts` covers authority and toolchain pins.
+Its siblings `tests/codex-integration/codex-cli-update-windows-apply-install.test.ts`,
+`tests/codex-integration/codex-cli-update-windows-apply-outcomes.test.ts` and
+`tests/codex-integration/codex-cli-update-windows-apply-shared.test.ts` cover real offline npm,
+partial mutations, retention, persistence retry, unrelated package/shim preservation and terminal
+close failure. `tests/helpers/codex-cli-windows-apply-fixture.ts` keeps cleanup ownership per file.
+One JS launcher executes a compiled CLR x64 backing fixture that verifies Job membership and
+returns the version. This is executable-fixture evidence, not a run of the vendor Codex product.
 
 ## Explicit POSIX apply
 

tests/codex-integration/codex-cli-update-windows-apply-install.test.ts

@@ -0,0 +1,113 @@
+import { windowsTempAncestryPreload } from "../helpers/windows-temp-ancestry";
+import { expect } from "bun:test";
+import { copyFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { applyCodexCliUpdate } from "../../src/codex/cli-update-apply";
+import { startWindowsCliChild } from "../../src/codex/windows-cli-child";
+import { createCodexCliUpdateFence, cancelCodexCliUpdateFence, createWorkerCommitWindow, codexCliUpdateIsCancelled, allocateCodexCliUpdateGateOwner } from "../../src/codex/cli-update-selection-gate";
+import { createWindowsApplyFixtures, native, WINDOWS_APPLY_BUDGET_MS, fixtureCleanupProven, type WorkerFixtureReply, mainRoot, backingRoot, write } from "../helpers/codex-cli-windows-apply-fixture";
+
+const { liveFixtureRoots, fixture, approved } = createWindowsApplyFixtures();
+
+native("a fresh Worker runs real offline Windows FFI install and closes only after native settlement", async () => {
+  let root: string | undefined, closed = false, errored = false, worker: Worker | undefined;
+  const requestId = crypto.randomUUID(), messages: WorkerFixtureReply[] = [];
+  try {
+    const f = await fixture(undefined, created => { root = created; liveFixtureRoots.add(created); });
+    const id = await approved(f);
+    worker = new Worker(new URL("../helpers/windows-apply-worker.ts", import.meta.url),
+      { type: "module", preload: windowsTempAncestryPreload(f.root) });
+    const joined = new Promise<void>((resolve, reject) => {
+      worker!.addEventListener("message", event => { messages.push(event.data); });
+      worker!.addEventListener("error", () => { errored = true; reject(new Error("offline Worker failed")); }, { once: true });
+      worker!.addEventListener("close", () => { closed = true; resolve(); }, { once: true });
+    });
+    const gate = new SharedArrayBuffer(8), fence = createCodexCliUpdateFence();
+    worker.postMessage({ requestId, planId: id, inspectionDeps: f.deps.inspectionDeps, target: f.target, gate, fence });
+    await joined;
+    expect(messages.filter(m => m.type === "native-start")).toHaveLength(1);
+    expect(messages.filter(m => m.type === "fixture-error")).toHaveLength(0);
+    const results = messages.filter(m => m.type === "result");
+    expect(results).toHaveLength(1);
+    expect(results[0]!.result).toMatchObject({ outcome: "applied", reason: "verified_target", leaseRetained: false, cleanupErrors: [] });
+    expect(fixtureCleanupProven(messages, requestId, closed, errored)).toBe(true);
+    expect(Atomics.load(new Int32Array(gate), 0)).toBe(0);
+    expect(existsSync(join(f.prefix, ".ocx-codex-cli-apply.lock"))).toBe(false);
+  } finally {
+    // A still-live native Worker keeps its exact fixture; never terminate to fake settlement.
+    if (root && fixtureCleanupProven(messages, requestId, closed, errored)) liveFixtureRoots.delete(root);
+  }
+}, WINDOWS_APPLY_BUDGET_MS);
+
+native("Windows cancellation won inside final synchronous scan cannot create an installer", async () => {
+  const f = await fixture(undefined, root => liveFixtureRoots.add(root)), id = await approved(f);
+  const fence = createCodexCliUpdateFence(), gate = new SharedArrayBuffer(8);
+  const gateOwner = allocateCodexCliUpdateGateOwner(gate);
+  let scans = 0, starts = 0;
+  const result = await applyCodexCliUpdate(id, { ...f.deps,
+    isCancelled: codexCliUpdateIsCancelled(fence),
+    commitWindow: createWorkerCommitWindow({ gate, fence, owner: gateOwner }),
+    scanProcesses: () => {
+      scans++;
+      if (Atomics.load(new Int32Array(gate), 0) === gateOwner) expect(cancelCodexCliUpdateFence(fence)).toBe(true);
+      return { kind: "observed", processes: [] };
+    },
+    startWindowsChild: invocation => { starts++; return startWindowsCliChild(invocation); },
+  });
+  if (!result.leaseRetained) liveFixtureRoots.delete(f.root);
+  expect(scans).toBeGreaterThan(0);
+  expect(result).toMatchObject({ outcome: "refused", reason: "cancelled", leaseRetained: false });
+  expect(starts).toBe(0);
+  expect(Atomics.load(new Int32Array(gate), 0)).toBe(0);
+}, WINDOWS_APPLY_BUDGET_MS);
+
+native("Windows apply runs real offline npm under owned Job, then verifies full target and version", async () => {
+  const f = await fixture(), id = await approved(f);
+  const result = await applyCodexCliUpdate(id, f.deps);
+  expect(result, JSON.stringify(result)).toMatchObject({ outcome: "applied", reason: "verified_target",
+    installerExitCode: 0, installedVersion: "1.1.0", leaseRetained: false, cleanupErrors: [] });
+  expect(existsSync(join(f.prefix, ".ocx-codex-cli-apply.lock"))).toBe(false);
+}, WINDOWS_APPLY_BUDGET_MS);
+
+native("Windows terminal no-op is not_applied even with nonzero installer exit", async () => {
+  const f = await fixture(), id = await approved(f);
+  const result = await applyCodexCliUpdate(id, { ...f.deps, install: async () => ({ terminal: true, exitCode: 17 }) });
+  expect(result, JSON.stringify(result)).toMatchObject({ outcome: "not_applied", leaseRetained: false, cleanupErrors: [] });
+}, WINDOWS_APPLY_BUDGET_MS);
+
+native("Windows pack children and installer descendant share transaction ownership", async () => {
+  const f = await fixture(), realNode = join(f.deps.inspectionDeps.env.PATH, "node.exe");
+  const realNpm = join(f.deps.inspectionDeps.env.PATH, "node_modules/npm/bin/npm-cli.js");
+  const tools = join(f.root, "toolchain"), npmCli = join(tools, "node_modules/npm/bin/npm-cli.js"), trace = join(f.root, "trace.jsonl");
+  mkdirSync(dirname(npmCli), { recursive: true }); copyFileSync(realNode, join(tools, "node.exe"));
+  write(join(tools, "node_modules/npm/package.json"), JSON.stringify({ name: "npm", version: "11.16.0", bin: { npm: "bin/npm-cli.js" } }));
+  const sources = Object.fromEntries([f.target.set.main, f.target.set.backing].map((a, i) => {
+    const path = join(f.root, `${i}.tgz`); write(path, i ? f.target.backing : f.target.main); return [`${a.name}@${a.version}`, path];
+  }));
+  write(npmCli, [
+    'const fs=require("node:fs"), path=require("node:path"), cp=require("node:child_process");',
+    'const args=process.argv.slice(2);',
+    `fs.appendFileSync(${JSON.stringify(trace)},JSON.stringify(args[0])+"\\n");`,
+    `const sources=${JSON.stringify(sources)};`,
+    'if(args[0]==="pack") { const source=sources[args[1]]; if(!source)process.exit(91);',
+    'const name=path.basename(source); fs.copyFileSync(source,path.join(args[args.indexOf("--pack-destination")+1],name));',
+    'console.log(JSON.stringify([{filename:name}])); } else if(args[0]==="install") {',
+    `const r=cp.spawnSync(${JSON.stringify(realNode)},[${JSON.stringify(realNpm)},...args],{env:process.env,stdio:"inherit"});process.exit(r.status??92);`,
+    '} else process.exit(93);',
+  ].join("\n"));
+  f.deps.inspectionDeps.env.PATH = tools;
+  const id = await approved(f);
+  const result = await applyCodexCliUpdate(id, { ...f.deps, fetchArtifact: undefined });
+  expect(result, JSON.stringify(result)).toMatchObject({ outcome: "applied", leaseRetained: false, cleanupErrors: [] });
+  expect(readFileSync(trace, "utf8").trim().split("\n").map(line => JSON.parse(line))).toEqual(["pack", "pack", "install"]);
+}, WINDOWS_APPLY_BUDGET_MS);
+
+native("Windows complete readback outranks a nonzero installer exit", async () => {
+  const f = await fixture(), id = await approved(f);
+  const result = await applyCodexCliUpdate(id, { ...f.deps, install: async () => {
+    for (const [path, bytes] of Object.entries(f.target.mainFiles)) write(join(f.prefix, mainRoot, path), bytes);
+    for (const [path, bytes] of Object.entries(f.target.backingFiles)) write(join(f.prefix, backingRoot, path), bytes);
+    return { terminal: true, exitCode: 17 };
+  } });
+  expect(result, JSON.stringify(result)).toMatchObject({ outcome: "applied", installerExitCode: 17, cleanupErrors: [] });
+}, WINDOWS_APPLY_BUDGET_MS);

tests/codex-integration/codex-cli-update-windows-apply-outcomes.test.ts

@@ -0,0 +1,112 @@
+import { windowsTempAncestryPreload } from "../helpers/windows-temp-ancestry";
+import { expect } from "bun:test";
+import { mkdirSync, readFileSync, writeFileSync, existsSync, renameSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { applyCodexCliUpdate } from "../../src/codex/cli-update-apply";
+import { createCodexCliUpdatePlan } from "../../src/codex/cli-update-plan";
+import { inspectCodexCliInstall } from "../../src/codex/cli-install-provenance";
+import { holdWindowsCodexCliPlanToolchain, withWindowsCodexCliPlanToolchain } from "../../src/codex/cli-windows-plan-provenance";
+import { repoPath, repoRoot } from "../helpers/repo-root";
+import { spawnTestChild } from "../helpers/spawn-test-child";
+import { runCodexCliUpdateJobWork } from "../../src/codex/cli-update-job-execution";
+import { createWindowsApplyFixtures, native, WINDOWS_APPLY_BUDGET_MS, WINDOWS_APPLY_CHILD_BUDGET_MS, mainRoot, backingRoot, nativePath, write } from "../helpers/codex-cli-windows-apply-fixture";
+
+const { fixture, approved } = createWindowsApplyFixtures();
+
+native("Windows cancellation and unknown session observation cannot start an installer", async () => {
+  const f = await fixture(), id = await approved(f); let installs = 0;
+  const install = async () => { installs++; return { terminal: true, exitCode: 0 }; };
+  const abort = new AbortController(); abort.abort();
+  expect((await applyCodexCliUpdate(id, { ...f.deps, install, signal: abort.signal })).reason).toBe("cancelled");
+  expect((await applyCodexCliUpdate(id, { ...f.deps, install,
+    scanProcesses: () => ({ kind: "unavailable" }) })).reason).toBe("blocked_process_state_unknown");
+  let scans = 0;
+  expect((await applyCodexCliUpdate(id, { ...f.deps, install,
+    scanProcesses: () => ++scans < 3 ? { kind: "observed", processes: [] } : { kind: "unavailable" } })).reason)
+    .toBe("blocked_process_state_unknown");
+  expect(scans).toBe(3);
+  expect(installs).toBe(0);
+}, WINDOWS_APPLY_BUDGET_MS);
+
+native.each(["auxiliary", "shim", "hidden-lock", "extra-file", "new-empty-backing", "selection"] as const)("Windows partial %s refuses not_applied", async kind => {
+  const f = await fixture();
+  if (kind === "new-empty-backing") {
+    const nested = join(f.prefix, mainRoot, "bin", "node_modules", "@openai", "codex-win32-x64");
+    mkdirSync(dirname(nested), { recursive: true }); renameSync(join(f.prefix, backingRoot), nested);
+  }
+  const id = await approved(f);
+  const result = await applyCodexCliUpdate(id, { ...f.deps, install: async () => {
+    if (kind === "auxiliary") write(join(f.prefix, mainRoot, "README.md"), "changed");
+    if (kind === "shim") write(join(f.prefix, "codex.ps1"), "changed");
+    if (kind === "hidden-lock") write(join(f.prefix, "node_modules/.package-lock.json"), "{}");
+    if (kind === "extra-file") write(join(f.prefix, backingRoot, "unexpected.txt"), "extra");
+    if (kind === "new-empty-backing") mkdirSync(join(f.prefix, backingRoot));
+    if (kind === "selection") f.deps.inspectionDeps.env.CODEX_CLI_PATH = join(f.prefix, "other.cmd");
+    return { terminal: true, exitCode: 1 };
+  } });
+  expect(result, JSON.stringify(result)).toMatchObject({ outcome: "ambiguous", leaseRetained: false });
+}, WINDOWS_APPLY_BUDGET_MS);
+
+native("Windows uncertain installer retains lease and staging until owning process exits", async () => {
+  const f = await fixture(), id = await approved(f);
+  const entry = join(f.root, "uncertain.test.ts"), receipt = join(f.root, "result.json");
+  const literals = JSON.stringify({ id, inspectionDeps: f.deps.inspectionDeps, target: f.deps.resolveTarget(),
+    main: f.target.main.toString("base64"), backing: f.target.backing.toString("base64"), receipt, prefix: f.prefix });
+  writeFileSync(entry, [
+    'import { test, expect } from "bun:test";',
+    'import { existsSync, writeFileSync } from "node:fs";',
+    `import { applyCodexCliUpdate } from ${JSON.stringify(repoPath("src/codex/cli-update-apply.ts"))};`,
+    `const f = ${literals};`,
+    'test("retained transaction", async () => {',
+    'const result = await applyCodexCliUpdate(f.id, { platform:"win32", inspectionDeps:f.inspectionDeps,',
+    'resolveTarget:()=>f.target, scanProcesses:()=>({kind:"observed",processes:[]}),',
+    'fetchArtifact:async a=>Buffer.from(a.installName==="@openai/codex"?f.main:f.backing,"base64"),',
+    'install:async()=>({terminal:false,exitCode:null}) });',
+    'const stage=existsSync(f.prefix+"/.ocx-codex-cli-apply.lock/stage");',
+    'writeFileSync(f.receipt,JSON.stringify({result,stage}));',
+    'expect(result.outcome).toBe("ambiguous"); expect(result.leaseRetained).toBe(true); expect(stage).toBe(true);',
+    `},${WINDOWS_APPLY_CHILD_BUDGET_MS});`,
+  ].join("\n"));
+  const child = await spawnTestChild([process.execPath, "test", "--preload", windowsTempAncestryPreload(f.root),
+    "--no-env-file", "--no-install", "--timeout", String(WINDOWS_APPLY_CHILD_BUDGET_MS), entry],
+    { cwd: repoRoot(), env: process.env, deadlineMs: WINDOWS_APPLY_CHILD_BUDGET_MS + 5000 });
+  expect(child.reaped).toBe(true); expect(child.pipesClosed).toBe(true); expect(child.exitCode, child.stderr).toBe(0);
+  expect(JSON.parse(readFileSync(receipt, "utf8"))).toMatchObject({ stage: true,
+    result: { outcome: "ambiguous", reason: "installer_state_unknown", leaseRetained: true } });
+  // The child has exited: only now can the fixture's retained kernel handles be gone.
+}, WINDOWS_APPLY_BUDGET_MS);
+
+native("Windows completion persistence retry does not repeat the installer", async () => {
+  const f = await fixture(), id = await approved(f); let installs = 0, finishes = 0;
+  await runCodexCliUpdateJobWork(() => applyCodexCliUpdate(id, { ...f.deps,
+    install: async () => { installs++; return { terminal: true, exitCode: 0 }; } }), {
+    begin: async () => 1,
+    finish: async (_revision, result) => {
+      expect(result.outcome).toBe("not_applied");
+      if (++finishes < 3) throw Object.assign(new Error("fixture busy"), { code: "EBUSY" });
+      return null;
+    }, read: async () => null, release: async () => {},
+  });
+  expect(installs).toBe(1); expect(finishes).toBe(3);
+}, WINDOWS_APPLY_BUDGET_MS);
+
+native("Windows toolchain pins survive an awaited callback; bounded shared prefix is eligible", async () => {
+  const f = await fixture();
+  const tools = join(f.root, "toolchain"), npmCli = join(tools, "node_modules/npm/bin/npm-cli.js");
+  write(join(tools, "node.exe"), f.old.backingFiles[nativePath]);
+  write(join(tools, "node_modules/npm/package.json"), JSON.stringify({ name: "npm", version: "11.0.0", bin: { npm: "bin/npm-cli.js" } }));
+  write(npmCli, "// never executed\n"); f.deps.inspectionDeps.env.PATH = tools;
+  const report = await inspectCodexCliInstall({ ...f.deps.inspectionDeps, observeInstallContent: true });
+  expect(report.managed).toBe(true);
+  expect(await withWindowsCodexCliPlanToolchain(report, async () => {
+    await Bun.sleep(10);
+    // This write must still be denied after await; returning a promise while
+    // releasing native pins early would make this assertion fail.
+    expect(() => writeFileSync(npmCli, "replacement")).toThrow(); return 42;
+  })).toBe(42);
+  writeFileSync(npmCli, "// changed after release\n");
+  const refreshed = await inspectCodexCliInstall({ ...f.deps.inspectionDeps, observeInstallContent: true });
+  const pin = await holdWindowsCodexCliPlanToolchain(refreshed); expect(pin).not.toBeNull(); expect(await pin!.release()).toBe(true);
+  mkdirSync(join(f.prefix, "node_modules", "unrelated"));
+  expect((await createCodexCliUpdatePlan(f.deps)).applicable).toBe(true);
+}, WINDOWS_APPLY_BUDGET_MS);