[lidge-jun]

Summary

The dev lane=all batch 40819570452 fails on macOS (job 123269441240) in tests/windows/windows-atomic-write-acl-rearm.test.ts, added by #7891. The cleanup leaves an empty residual without spending the recovery attempt case throws a plain ETIMEDOUT instead of AtomicWriteResidualTempError.

The cause is in the fixture. The test refuses unlinkSync only for paths under join(root, "secret.json.ocx."), where root came from mkdtempSync(tmpdir()). atomicWriteFile resolves the destination's real parent (src/config/atomic-write.ts:40), and macOS tmpdir() is a symlink (/var -> /private/var). The cleanup therefore unlinks /private/var/.../secret.json.ocx.*, the fixture's prefix check misses, the unlink succeeds, and no residual is left. The writer behaves correctly; the fixture watched the wrong path.

This sets root to realpathSync(mkdtempSync(...)), so the fixture matches the path the writer actually uses. No assertion, timeout or product code changes.

Verification

All on Windows x64 with OCX_TEST_NO_QUEUE=1, bun test tests/windows/windows-atomic-write-acl-rearm.test.ts:

• Red before the fix, with TEMP/TMP pointed at a directory junction (the same shape as the macOS symlink): 17 pass / 6 fail (the cleanup case for the sync, streamed and async writers, plus the three sequential retries retain one ACL child cases).
• Green after the fix, same junction: 23 pass / 0 fail.
• Green after the fix, plain temp directory: 23 pass / 0 fail.
• NOT RUN locally: macOS. Hosted macOS runs only in the batched dev check.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. N/A: test fixture only.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. N/A: no product code changes.

Summary by CodeRabbit

• Tests
  • Improved Windows test coverage for atomic-write permission cleanup when temporary directories resolve through symbolic links. This helps ensure the behavior is checked against the same resolved destination path used during writes.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T05:21:02.568144Z	82017fe	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: fix/atomic-acl-rearm-realpath
• File: .coderabbit.yaml
• Commit: 82017fe
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 112ddcb8-39e3-4f37-9c27-2fc49721fbd6

Commits

Reviewing files that changed from the base of the PR and between f4eef7b and 82017fe.

Files selected for processing: 1

• tests/windows/windows-atomic-write-acl-rearm.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

Walkthrough

The Windows atomic-write ACL re-arm test now resolves its temporary directory to a real path before assigning it to root.

Changes: Windows ACL re-arm test setup

Layer / File(s)	Summary
Resolve the temporary test root tests/windows/windows-atomic-write-acl-rearm.test.ts:65-67	The setup resolves the created temporary directory with realpathSync before assigning it to root.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Possibly related PRs

• lidge-jun/opencodex#7891: This PR adds the Windows ACL timeout re-arm test that this change updates.
• lidge-jun/opencodex#7943: This PR registers the same test in the test-layout mapping.
• lidge-jun/opencodex#7843: This PR adds atomic-writer ACL timeout re-arm behavior and a related regression test.

Suggested reviewers: ingwannu

Merge Risk: Minimal · up to 82017

The fixture change is appropriately scoped and introduces no identified merge-blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "test(windows): resolve the atomic-write fixture root before matching cleanup paths" matches the main change. The raw summary says the test setup now resolves the temporary root to its real …
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "test(windows): resolve the atomic-write fixture root before matching cleanup paths" matches the main change. The raw summary says the test setup now resolves the temporary root to its real path, and the PR objectives confirm the fixture uses realpathSync(mkdtempSync(...)) to match the writer's resolved destination path. The title is short, single-sentence, specific, and states the primary change. It does not cover the test-result details, but that is expected. No search was needed, since the check depends only on the supplied PR context.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.