[mldangelo-oai]

Summary

Checked scan reads now retain exact file and directory identities so distinct large filesystem identifiers cannot compare equal after numeric rounding. Synthetic Git repositories also keep their LF line-ending setting local, avoiding inherited conversion warnings in Windows tests.

Changes

• Keep checked file, parent, and scan-root identities as BigInt stats through subsequent comparisons. Preserve the existing Windows device comparison, permission checks, and diagnostic text.
• Add deterministic file and directory replacement regressions using distinct identifiers that round to the same Number, plus an unchanged-file control.
• Set core.autocrlf=false at 19 disposable fixture initialization sites across 14 SDK test files. Explicit line-ending conversion tests retain their own overrides.
• Merge current main while retaining the fixture changes.

Testing

Merged main at fe9d77e1c3d9 into 6c8c23e99103. This refresh changes only the Dockerfile's two Node image references. Every other tracked file is byte-identical to ad34fa4dbc35. git diff --check passed; no runtime tests were rerun for this container-only merge. The source checks below remain attributed to their recorded pre-refresh heads; fresh hosted CI must qualify the new head.

Merged main at 5f521759e7c6 into ad34fa4dbc35. Fresh Linux checks on that earlier head passed:

• All 74 workflow, report-comparison, package-skeleton, container-workflow, and package-timeout tests.
• All 27 native-configuration and fixture-lifecycle tests.
• SDK build:ci, SDK/MCP types, full SDK formatting, and git diff --check.
• Actionlint syntax/expression checks for the two refreshed workflows; ShellCheck and Pyflakes were disabled.

Validation used Node 22.23.3 and Bun 1.3.14. Dependency lockfiles and unchanged plugin sources were matched before reusing dependency installations and private copies of existing bundled/native artifacts. Native binaries were not rebuilt. Full SDK and cross-platform suites were not rerun; fresh hosted CI was required for that earlier head.

The exact bigint file, parent, and root identity implementation is unchanged by this merge. Earlier replacement regressions remain historical; neither the seeded nor deferred unseeded full suite is claimed complete. The historical Windows failure did not record filesystem identifiers, so its precise cause remains unasserted.

Risk and rollout

The identity change preserves existing scan-file protections without changing serialized scan data or public CLI/SDK surface. Permission checks still receive the same mode and owner values, and the Windows device fallback remains intact. Fixture-local Git settings affect only disposable test repositories.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T05:43:06.973126Z	6c8c23e	New commits
🔒 Security Review	✅ Completed 2026-10-23T05:43:47.633062Z	6c8c23e	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[alandelong-oai]

Thanks for the cleanup. This owner-level merge-safety review at 147daa6 found no material issue. All 19 settings are local to disposable Git fixtures and occur before the relevant Git operations; explicit conversion coverage and production Git behavior remain intact.

With inherited core.autocrlf=true, 35 focused cases passed and two platform cases skipped. Six failures reproduced on the exact base: existing fixture ownership/Git-boundary limitations and an unchanged sparse-checkout expectation under conversion. The changed fixture cohort emitted no line-ending warnings. Types, changed-file formatting and the plugin build passed.

Native Windows behavior and the full SDK suite were not exercised locally.

[alandelong-oai]

Thanks for the fix. This owner-level merge-safety review at 587c86f found no material issue. File, parent and scan-root identities stay exact through comparisons; permission checks, the Windows device fallback and public results retain their behavior. All 19 Git settings stay local to disposable fixtures.

Types, formatting and SDK/plugin builds passed, along with 10 import-boundary and 10 inherited-CRLF fixture cases. The directory-ID collision regression passes on head and fails with the exact base implementation.

The broader contract/custom-validation run had 12 passes and 121 failures at the local environment’s existing output-ancestry boundary; two MCP fixture cases hit that boundary too. Both new file-identity cases are blocked there on base and head. Full Windows SDK CI is still running; it is not represented as passed.

[alandelong-oai]

Thanks for the fix. This owner-level merge-safety review of ad34fa4 found no material issues across all 15 changed files. Root and parent identities stay exact through comparisons; permission checks and the Windows device fallback retain their behavior. All 19 Git settings are local to disposable fixtures.

Fresh SDK/plugin builds, SDK/MCP types, formatting and 12 inherited-CRLF fixture cases passed. The root-collision regression passes on head; an exact-base control gets past the rounded identity check and reaches the later ownership guard.

The contract/custom-validation run had 12 passes and 121 failures at the existing local output-ancestry ownership boundary, including both added file-collision cases. No full local SDK or native Windows run is claimed. Hosted CI is green on a merge with the exact reviewed parents and an identical source tree.