[mldangelo-oai]

Summary

On Windows a reader can briefly hold a file in a validated plugin ZIP's staging directory and prevent the final directory rename. The SDK could report the archive as invalid even when every entry had extracted successfully.

Changes

• Apply the plugin builder's bounded Windows rename retry to ZIP publication. Stop promptly on cancellation and preserve a destination created by a competing publisher.
• Report publication failures with their native rename cause. If a persistent file handle also prevents cleanup, identify the retained staging directory in the diagnostic.
• Provide the shared helper's signature to TypeScript projects that compile SDK source with JavaScript discovery disabled.

Testing

• Passed all 13 Windows ZIP tests and all 14 plugin-builder tests, plus SDK type and format checks.
• Reproduced the strict eval build's missing declaration error, then passed build:evals and 61 archive tests. The rebuilt tarball was byte-identical to the previous candidate.
• A real Windows file handle caused the first rename to return EPERM. Publication succeeded after the handle closed. A continuously held handle exhausted the bounded attempts and produced the native cause. Two simultaneous publishers produced one complete destination.
• On Linux, the public API replaced an empty destination atomically and preserved a nonempty destination on ENOTEMPTY.
• Built and installed the 956-entry npm archive. The real CLI accepted an explicit plugin ZIP and reached agent preflight. A separate sandbox input-access issue prevented completion of that scan.

Risk and rollout

Retries apply to Windows EPERM, EACCES, and EBUSY during publication. A persistent file lock can retain the private staging directory until the handle closes. The tests cover archive validation, competing publications, cancellation and builder rollback.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-09T20:20:49.619703Z	4f4011a	New commits
🔒 Security Review	✅ Completed 2026-11-09T20:21:33.677433Z	4f4011a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for fixing this. No blocking findings in this merge-safety review. Reusing the existing bounded retry preserves builder rollback, and ZIP publication now retains native errors while protecting competing destinations.

Focused ZIP tests passed (12 cases; two Windows-only cases skipped), as did builder tests (11 cases; three Windows-only cases skipped), TypeScript, and formatting. Native Windows locks were not independently exercised locally; the current hosted Windows test shards and installed-package checks passed.

Twelve public-SDK extraction/simulated-Windows scenarios passed, including backoff cancellation, competing writers, and cleanup diagnostics. The built package contains the helper and declarations, and a strict source-consumer check passed. Full eval compilation remains unverified locally because eval-only dependencies are absent.