[morgan-coded]

• I understand that this repository is auto-generated and my pull request may not be merged

Changes being requested

./scripts/test currently fails on macOS at the two held-inode scenarios in tests/ecosystem-cloudflare-credential-lifecycle-security.test.ts. The generated npm stub addresses the parent process's held descriptor through /proc/<ppid>/fd/<n>, which exists only on Linux. On macOS the stub exits with ENOENT: no such file or directory, open '/proc/<pid>/fd/16', so both tests report child status 1. CI runs on ubuntu-latest only, so the failure shows up on contributor machines rather than in CI, and the two scenarios currently have no coverage on macOS.

This change keeps the preload's pre-opened descriptor exactly as before and adds a portable route to the same inode: immediately after the CLI's own backup link of .dev.vars succeeds (that is, after the nlink === 1 validation has already run, so the invariant check is unaffected), the preload hard-links the original inode to a fixture-root path and exports it as CLOUDFLARE_HELD_LINK. The stub reads, writes, and chmods through that link instead of the procfs path. A hard link addresses the same inode, so the scenarios still prove the original guarantees: a reader of the original inode never observes the staged key, and concurrent edits plus mode changes made through the original inode survive restoration. Linux and macOS run the same code path, and no assertions changed.

Verified on macOS (Node 24.18.0): both tests fail on main and pass with this change; the full file passes 79/79; lint, build, and the full test battery pass.

Additional context & links

The link lives outside the worker directory, so the .dev.vars.openai-* artifact assertions are unaffected, and the fixture cleanup removes it.

[HAYDEN-OAI]

Reviewed the macOS portability change. Creating the hard link after the exclusivity check preserves inode identity, credential isolation, restoration behavior, and fixture cleanup. No actionable issues found.

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

32 mixed files remain; 0 existing customizations changed.

Compared 6992683aaf20 → 56596699c950. Generated baselines verified.

32 existing customizations unchanged

• api.md
• scripts/castiron/README.md
• scripts/castiron/custom_code_report.py
• scripts/castiron/test_custom_code_report.py
• src/client.ts
• src/resources/audio/transcriptions.ts
• src/resources/audio/translations.ts
• src/resources/beta/assistants.ts
• src/resources/beta/beta.ts
• src/resources/beta/index.ts
• src/resources/beta/responses/internal-base.ts
• src/resources/beta/responses/responses.ts
• src/resources/beta/threads/index.ts
• src/resources/beta/threads/runs/index.ts
• src/resources/beta/threads/runs/runs.ts
• src/resources/beta/threads/threads.ts
• src/resources/chat/completions/completions.ts
• src/resources/chat/completions/index.ts
• src/resources/conversations/index.ts
• src/resources/embeddings.ts
• src/resources/files.ts
• src/resources/fine-tuning/checkpoints/permissions.ts
• src/resources/images.ts
• src/resources/responses/internal-base.ts
• src/resources/responses/responses.ts
• src/resources/skills/skills.ts
• src/resources/skills/versions/versions.ts
• src/resources/vector-stores/file-batches.ts
• src/resources/vector-stores/files.ts
• src/resources/webhooks/index.ts
• src/resources/webhooks/webhooks.ts
• tests/lib/data-residency.test.ts

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 32995013233 --repo openai/openai-node \
  --name castiron-custom-code-32995013233-1 --dir /tmp/castiron-custom-code-32995013233-1
git apply --stat /tmp/castiron-custom-code-32995013233-1/custom-code.patch
cat /tmp/castiron-custom-code-32995013233-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin 6992683aaf2014d5e625e8eeebb3906bd8651ff0 56596699c95092635fdcf9f6a3f4013375174c82
python3 scripts/castiron/custom_code_report.py report \
  --base 6992683aaf2014d5e625e8eeebb3906bd8651ff0 \
  --head 56596699c95092635fdcf9f6a3f4013375174c82 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-56596699c950
cat /tmp/castiron-custom-code-56596699c950/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch