[lidge-jun]

Summary

The final-EPERM quarantine from #6861 never ran on GitHub's hosted Windows runners, so a temp tree held past the 15 s removal budget failed whichever test owned it.

Hosted runners export TEMP as the 8.3 alias C:\Users\RUNNER~1\…, while test paths arrive long-form (C:\Users\runneradmin\…). containedRunTemp resolved TEMP with the JS realpathSync, which keeps each spelling. The strict containment check therefore always failed, logging [test-temp] the locked path is not a contained temp subtree; not moving it aside., and the EPERM was rethrown.

Seen in:

• failed arrival persistence returns retryable HTTP 503 without publishing models (nightly 39154486082, job 117754828530, 16.0 s): the test finished asserting, then home.remove() spent the full retry budget on EPERM. The same file failed the same way in job 112953161862.
• service state home isolation > production preserves the startup-home mirror (job 116901924377) printed the same refusal line.

Both sides of the containment check now go through one resolver, diagnostic.realpath. It defaults to realpathSync.native, which expands 8.3 names. The safety rules are unchanged: strict containment under opencodex-test-*/tmp, refusal while any child process is alive, and no move on a failed child probe. The remove budget is not raised.

Limitation: this restores the existing mitigation and its child-process probe. It does not name the external holder. The diagnostic in those logs shows every file under the tree renaming fine after the budget, which fits the indexer/scanner hold documented in scripts/test-temp-lock.ts. If the holder is a child of the test process, the quarantine still refuses and the next red run names it.

Verification

• New regressions in tests/ci-workflows/test-temp-quarantine.test.ts: an 8.3 TEMP alias still contains the long-form locked path (injected alias resolver) and containment resolves TEMP with the 8.3-expanding native resolver by default (pins realpathSync.native as the default). Both fail on dev and pass with the fix; the whole file passes (10/10).
• bun run typecheck, bun run structure:check: pass.
• Independent review (gpt-6.1-sol and gemini-4-argon): no blocking findings. The argon nit about pinning the default resolver is addressed by the second regression. It confirmed libuv's native realpath normalizes \\?\ and UNC prefixes and that case folding still applies. The injected test checks resolver consistency only, so real 8.3 expansion is left to Windows CI.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. (Test tooling only.)
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Summary by CodeRabbit

• Bug Fixes

  • Improved temporary-directory checks on Windows by resolving short-path aliases consistently, preventing valid locked paths from being rejected.

• Tests

  • Added coverage for Windows temporary-directory aliases and native path resolution.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T07:22:05.590599Z	d0a9b44	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Note

Currently processing new changes in this PR. This may take a few minutes, please wait...

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 1805d5f4-b3f2-4aaf-9612-b32638e2c9f5

📥 Commits

Reviewing files that changed from the base of the PR and between 718692b and 4314742.

📒 Files selected for processing: 2

• scripts/test-temp-lock.ts
• tests/ci-workflows/test-temp-quarantine.test.ts

+------------------------------------------------+
| Name's Rabbit. CodeRabbit. Licensed to review. |
+------------------------------------------------+
  \
   \   (\__/)
       (•ㅅ•)
       / 　 づ

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}