fix: compare Codex and remote workspace file identity with bigint stat

src/codex/codex-home-owner.ts

@@ -1,6 +1,7 @@
 import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { getConfigDir } from "../config/paths";
+import { sameFileIdentity } from "../lib/file-identity";
 import { samePathIdentity } from "./user-identity";
 
 export const CODEX_HOME_JOURNAL_FILE = "opencodex-journal.json";
@@ -55,21 +56,21 @@ function validJournal(value: unknown): value is Record<string, unknown> {
 export function readCodexHomeJournal(journalPath: string): CodexHomeJournalInspection {
   let fd: number | undefined;
   try {
-    const before = lstatSync(journalPath);
-    if (!before.isFile() || before.isSymbolicLink() || before.size > MAX_JOURNAL_BYTES) return { kind: "unknown" };
+    const before = lstatSync(journalPath, { bigint: true });
+    if (!before.isFile() || before.isSymbolicLink() || before.size > BigInt(MAX_JOURNAL_BYTES)) return { kind: "unknown" };
     fd = openSync(journalPath, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0) | (constants.O_NONBLOCK ?? 0));
-    const opened = fstatSync(fd);
-    if (!opened.isFile() || opened.size > MAX_JOURNAL_BYTES || before.dev !== opened.dev || before.ino !== opened.ino) return { kind: "unknown" };
-    const bytes = Buffer.alloc(opened.size + 1);
+    const opened = fstatSync(fd, { bigint: true });
+    if (!opened.isFile() || opened.size > BigInt(MAX_JOURNAL_BYTES) || !sameFileIdentity(before, opened)) return { kind: "unknown" };
+    const bytes = Buffer.alloc(Number(opened.size) + 1);
     let length = 0;
     while (length < bytes.length) {
       const count = readSync(fd, bytes, length, bytes.length - length, null);
       if (!count) break;
       length += count;
     }
-    const after = lstatSync(journalPath);
-    if (length !== opened.size || !after.isFile() || after.dev !== opened.dev || after.ino !== opened.ino
-      || after.size !== opened.size || after.mtimeMs !== opened.mtimeMs || after.ctimeMs !== opened.ctimeMs) return { kind: "unknown" };
+    const after = lstatSync(journalPath, { bigint: true });
+    if (BigInt(length) !== opened.size || !after.isFile() || !sameFileIdentity(after, opened)
+      || after.size !== opened.size || after.mtimeNs !== opened.mtimeNs || after.ctimeNs !== opened.ctimeNs) return { kind: "unknown" };
     const journal: unknown = JSON.parse(bytes.subarray(0, length).toString("utf8"));
     return validJournal(journal) ? { kind: "read", journal } : { kind: "unknown" };
   } catch (error) {

src/codex/coordinator-doctor.ts

@@ -12,11 +12,13 @@ import {
   realpathSync,
   renameSync,
   type Stats,
+  type BigIntStats,
 } from "node:fs";
 import { join } from "node:path";
 import { pathToFileURL } from "node:url";
 
 import { Database, constants as sqliteConstants } from "bun:sqlite";
+import { sameFileIdentity, type FileIdentity as NodeIdentity } from "../lib/file-identity";
 
 import { resolveCodexHomeDir } from "./home";
 import {
@@ -33,7 +35,11 @@ import {
 const IMMUTABLE_READONLY_FLAGS =
   sqliteConstants.SQLITE_OPEN_READONLY | sqliteConstants.SQLITE_OPEN_URI;
 
-export type FileIdentity = Pick<Stats, "dev" | "ino" | "size" | "mtimeMs" | "ctimeMs">;
+export type FileIdentity = NodeIdentity & Pick<Stats, "size" | "mtimeMs" | "ctimeMs">;
+
+function milliseconds(ns: bigint): number {
+  return Number(ns / 1_000_000_000n) * 1000 + Number(ns % 1_000_000_000n) / 1e6;
+}
 
 export interface CodexCoordinatorDiagnosticEvidence {
   sizeBytes: number;
@@ -66,15 +72,14 @@ function errorCode(error: unknown): string {
 }
 
 function sameIdentity(left: FileIdentity, right: FileIdentity): boolean {
-  return left.dev === right.dev
-    && left.ino === right.ino
+  return sameFileIdentity(left, right)
     && left.size === right.size
     && left.mtimeMs === right.mtimeMs
     && left.ctimeMs === right.ctimeMs;
 }
 
 function sameNodeAndSize(left: FileIdentity, right: FileIdentity): boolean {
-  return left.dev === right.dev && left.ino === right.ino && left.size === right.size;
+  return sameFileIdentity(left, right) && left.size === right.size;
 }
 
 function coordinatorPathWithoutCreation(): { kind: "absent"; path: string | null } | { kind: "path"; path: string } {
@@ -113,9 +118,9 @@ function inspectTarget(
   path: string,
   options: { allowSqliteSidecars?: boolean } = {},
 ): { kind: "absent" } | { kind: "file"; identity: FileIdentity } | { kind: "unsafe"; reason: string } {
-  let entry: Stats;
+  let entry: BigIntStats;
   try {
-    entry = lstatSync(path);
+    entry = lstatSync(path, { bigint: true });
   } catch (cause) {
     if (errorCode(cause) === "ENOENT") return { kind: "absent" };
     return { kind: "unsafe", reason: "the coordinator file cannot be inspected" };
@@ -132,7 +137,7 @@ function inspectTarget(
   }
   if (process.platform !== "win32") {
     const uid = process.getuid?.();
-    if (uid === undefined || entry.uid !== uid || (entry.mode & 0o777) !== 0o600) {
+    if (uid === undefined || Number(entry.uid) !== uid || (Number(entry.mode) & 0o777) !== 0o600) {
       return { kind: "unsafe", reason: "the coordinator file has unsafe ownership or permissions" };
     }
   }
@@ -143,7 +148,8 @@ function inspectTarget(
       }
     }
   }
-  return { kind: "file", identity: entry };
+  return { kind: "file", identity: { dev: entry.dev, ino: entry.ino, size: Number(entry.size),
+    mtimeMs: milliseconds(entry.mtimeNs), ctimeMs: milliseconds(entry.ctimeNs) } };
 }
 
 function classifyOpenedDatabase(

src/codex/history-provider.ts

@@ -7,6 +7,7 @@ import { Database } from "bun:sqlite";
 import { resolveCodexStateDbPath } from "./paths";
 import { openCodexStateForPreflight } from "./history-state-open";
 import { atomicWriteFile, getConfigDir } from "../config";
+import { sameFileIdentity, statTimeMs, type FileIdentity } from "../lib/file-identity";
 import {
   CODEX_HISTORY_RESUMABLE_SOURCES,
   codexHistoryBackupId,
@@ -268,15 +269,15 @@ function readFirstLineProviderValue(path: string, expectedId: string): string |
 
 function patchFirstLineProviderInPlace(
   path: string, expectedId: string, provider: string,
-  expectedIdentity: { dev: number | bigint; ino: number | bigint },
+  expectedIdentity: FileIdentity,
 ): FirstLineProviderResult {
   historyAppendHooks?.beforeFirstLineOpen?.(path);
   const fd = openSync(path, "r+");
   try {
     const assertIdentity = (): void => {
       assertHistoryDescriptorIdentity(path, fd);
-      const held = fstatSync(fd);
-      if (held.dev !== expectedIdentity.dev || held.ino !== expectedIdentity.ino) {
+      const held = fstatSync(fd, { bigint: true });
+      if (!sameFileIdentity(held, expectedIdentity)) {
         throw new CodexHistoryIntegrityError("history_rollout_identity_changed");
       }
     };
@@ -360,10 +361,10 @@ function assertLegacyHistoryRecord(line: string): void {
 }
 
 function assertHistoryDescriptorIdentity(path: string, fd: number): void {
-  const held = fstatSync(fd);
-  let current: ReturnType<typeof lstatSync>;
-  try { current = lstatSync(path); } catch { throw new CodexHistoryIntegrityError("history_rollout_identity_changed"); }
-  if (!current.isFile() || current.isSymbolicLink() || current.dev !== held.dev || current.ino !== held.ino) {
+  const held = fstatSync(fd, { bigint: true });
+  let current: import("node:fs").BigIntStats;
+  try { current = lstatSync(path, { bigint: true }); } catch { throw new CodexHistoryIntegrityError("history_rollout_identity_changed"); }
+  if (!current.isFile() || current.isSymbolicLink() || !sameFileIdentity(current, held)) {
     throw new CodexHistoryIntegrityError("history_rollout_identity_changed");
   }
 }
@@ -693,8 +694,8 @@ function inspectBackupForNoop(path: string, stateDbPath: string): StrictBackupIn
 
 function historyFileIdentity(path: string): string | null {
   try {
-    const stat = statSync(path);
-    return [stat.dev, stat.ino, stat.size, stat.mtimeMs, stat.ctimeMs].join(":");
+    const stat = statSync(path, { bigint: true });
+    return [stat.dev, stat.ino, Number(stat.size), statTimeMs(stat.mtimeNs), statTimeMs(stat.ctimeNs)].join(":");
   } catch {
     return null;
   }
@@ -1132,7 +1133,7 @@ function updateSessionMeta(
   } = {},
 ): SessionMetaUpdateResult {
   if (!path || !existsSync(path)) return { changed: false, durableProvider: false };
-  const validatedIdentity = lstatSync(path);
+  const validatedIdentity = lstatSync(path, { bigint: true });
   if (options.expectedFileIdentity !== undefined
     && historyFileIdentity(path) !== options.expectedFileIdentity) {
     return { changed: false, durableProvider: false, conflict: true };

src/codex/inject/bounded-config-reader.ts

@@ -1,4 +1,5 @@
-import { closeSync, constants, fstatSync, openSync, readSync, statSync, type Stats } from "node:fs";
+import { closeSync, constants, fstatSync, openSync, readSync, statSync, type BigIntStats } from "node:fs";
+import { sameFileIdentity } from "../../lib/file-identity";
 
 const MAX_CODEX_CONFIG_BYTES = 1024 * 1024;
 
@@ -14,15 +15,15 @@ const MAX_CODEX_CONFIG_BYTES = 1024 * 1024;
 export function readBoundedCodexConfig(path: string): string | null {
   let fd: number | undefined;
   try {
-    let namedBefore: Stats;
+    let namedBefore: BigIntStats;
     try {
-      namedBefore = statSync(path);
+      namedBefore = statSync(path, { bigint: true });
     } catch (error) {
       const code = (error as NodeJS.ErrnoException).code;
       if (code === "ENOENT" || code === "ENOTDIR") return null;
       throw error;
     }
-    if (!namedBefore.isFile() || namedBefore.size > MAX_CODEX_CONFIG_BYTES) {
+    if (!namedBefore.isFile() || namedBefore.size > BigInt(MAX_CODEX_CONFIG_BYTES)) {
       throw new Error("config.toml is not a bounded regular file");
     }
     // Deliberately no O_NOFOLLOW: Codex and the injector read through a symlinked
@@ -33,27 +34,27 @@ export function readBoundedCodexConfig(path: string): string | null {
       ? 0
       : (constants.O_NONBLOCK ?? 0);
     fd = openSync(path, constants.O_RDONLY | guardedFlags);
-    const before = fstatSync(fd);
-    if (before.dev !== namedBefore.dev || before.ino !== namedBefore.ino) {
+    const before = fstatSync(fd, { bigint: true });
+    if (!sameFileIdentity(before, namedBefore)) {
       throw new Error("config.toml changed while it was read");
     }
-    if (!before.isFile() || before.size > MAX_CODEX_CONFIG_BYTES) {
+    if (!before.isFile() || before.size > BigInt(MAX_CODEX_CONFIG_BYTES)) {
       throw new Error("config.toml is not a bounded regular file");
     }
 
-    const buffer = Buffer.allocUnsafe(before.size + 1);
+    const buffer = Buffer.allocUnsafe(Number(before.size) + 1);
     let bytesRead = 0;
     while (bytesRead < buffer.length) {
       const count = readSync(fd, buffer, bytesRead, buffer.length - bytesRead, null);
       if (count === 0) break;
       bytesRead += count;
     }
-    const after = fstatSync(fd);
-    const namedAfter = statSync(path);
-    if (bytesRead !== before.size || after.size !== before.size
-      || after.mtimeMs !== before.mtimeMs || after.ctimeMs !== before.ctimeMs
+    const after = fstatSync(fd, { bigint: true });
+    const namedAfter = statSync(path, { bigint: true });
+    if (BigInt(bytesRead) !== before.size || after.size !== before.size
+      || after.mtimeNs !== before.mtimeNs || after.ctimeNs !== before.ctimeNs
       || !namedAfter.isFile()
-      || namedAfter.dev !== before.dev || namedAfter.ino !== before.ino) {
+      || !sameFileIdentity(namedAfter, before)) {
       throw new Error("config.toml changed while it was read");
     }
     return buffer.toString("utf8", 0, bytesRead);

src/codex/main-account.ts

@@ -4,6 +4,7 @@ import { classifyChatgptRefreshFailure, noteChatgptRefreshFailure } from "./chat
 import { readBoundedResponseBody } from "../lib/bounded-body";
 import { createHash } from "node:crypto";
 import { lstatSync, readFileSync, statSync } from "node:fs";
+import { sameFileIdentity, type FileIdentity } from "../lib/file-identity";
 import { dirname, join, resolve } from "node:path";
 import { readCodexTokens } from "./auth-collision";
 import {
@@ -86,7 +87,7 @@ type MainAuthJsonCredential = {
    * the content hash notices those, and only once the new bytes are visible (#2999).
    * `null` when the target could not be stat'ed, which fails closed.
    */
-  identity: { dev: number; ino: number } | null;
+  identity: FileIdentity | null;
   root: Record<string, unknown>;
   tokens: Record<string, unknown>;
   accessToken?: string;
@@ -201,10 +202,10 @@ function sha256(value: string): string {
  * fail closed, because the whole point here is refusing to overwrite a file we can no
  * longer vouch for.
  */
-function statIdentity(path: string): { dev: number; ino: number } | null {
+function statIdentity(path: string): FileIdentity | null {
   try {
-    const stat = statSync(path);
-    return { dev: Number(stat.dev), ino: Number(stat.ino) };
+    const stat = statSync(path, { bigint: true });
+    return { dev: stat.dev, ino: stat.ino };
   } catch {
     return null;
   }
@@ -316,8 +317,7 @@ function assertMainAuthJsonIdentityUnchanged(expected: MainAuthJsonCredential):
   const identity = statIdentity(expected.path);
   if (!identity
     || !expected.identity
-    || identity.dev !== expected.identity.dev
-    || identity.ino !== expected.identity.ino) {
+    || !sameFileIdentity(identity, expected.identity)) {
     throw new MainAuthJsonChangedDuringRefreshError();
   }
 }

src/codex/native-main-lock-file.ts

@@ -6,15 +6,16 @@ import {
   fstatSync,
   lstatSync,
   openSync,
-  type Stats,
+  type BigIntStats,
 } from "node:fs";
 
 import { hardenSecretPathAsync } from "../lib/windows-secret-acl";
+import { sameFileIdentity } from "../lib/file-identity";
 
 export interface StableLockFile {
   readonly fd: number;
-  readonly dev: number;
-  readonly ino: number;
+  readonly dev: bigint;
+  readonly ino: bigint;
   close(): void;
 }
 
@@ -27,8 +28,8 @@ export class StableLockPathUnsafeError extends Error {
 
 interface StableLockEntry {
   readonly fd: number;
-  readonly dev: number;
-  readonly ino: number;
+  readonly dev: bigint;
+  readonly ino: bigint;
   refs: number;
 }
 
@@ -55,7 +56,7 @@ function reference(path: string, entry: StableLockEntry): StableLockFile {
   };
 }
 
-function assertRegular(stats: Stats, path: string): void {
+function assertRegular(stats: BigIntStats, path: string): void {
   if (!stats.isFile() || stats.isSymbolicLink()) {
     throw new StableLockPathUnsafeError(`unsafe SQLite lock path: ${path}`);
   }
@@ -67,8 +68,8 @@ function errorCode(error: unknown): string | undefined {
     : undefined;
 }
 
-function matches(handle: StableLockFile, stats: Stats): boolean {
-  return handle.dev === stats.dev && handle.ino === stats.ino;
+function matches(handle: StableLockFile, stats: BigIntStats): boolean {
+  return sameFileIdentity(handle, stats);
 }
 
 export function openStableLockFile(path: string, platform: NodeJS.Platform = process.platform): StableLockFile {
@@ -84,11 +85,11 @@ export function openStableLockFile(path: string, platform: NodeJS.Platform = pro
       throw error;
     }
   }
-  if (existsSync(path)) assertRegular(lstatSync(path), path);
+  if (existsSync(path)) assertRegular(lstatSync(path, { bigint: true }), path);
   const noFollow = platform === "win32" ? 0 : constants.O_NOFOLLOW;
   const fd = openSync(path, constants.O_RDWR | constants.O_CREAT | noFollow, 0o600);
   try {
-    const descriptor = fstatSync(fd);
+    const descriptor = fstatSync(fd, { bigint: true });
     assertRegular(descriptor, path);
     const entry: StableLockEntry = {
       fd,
@@ -109,9 +110,9 @@ export function openStableLockFile(path: string, platform: NodeJS.Platform = pro
 }
 
 export function assertStableLockFile(path: string, handle: StableLockFile): void {
-  let pathStats: Stats;
+  let pathStats: BigIntStats;
   try {
-    pathStats = lstatSync(path);
+    pathStats = lstatSync(path, { bigint: true });
   } catch (error) {
     if (errorCode(error) === "ENOENT") {
       throw new StableLockPathUnsafeError(`SQLite lock path identity changed: ${path}`);