fix(windows): recover interrupted Codex CLI child publication by lidge-jun · Pull Request #7909 · lidge-jun/opencodex

lidge-jun · 2026-10-28T14:04:23Z

Summary

Recover Windows runtime selection, shim operations and owned app/session launch admission after an interrupted Codex CLI child-record publication. Restart inspection now adopts a complete pending child only when its token, parent and Job match the armed authority, a matching protected terminal guardian proof exists, the parent is absent, the exact child PID/creation lifetime is gone or reused, and the whole Job is absent or has zero active processes.
Reuse the protected ACL/flush/handle-bound rename path while preserving the pending file until atomic publication. Any mismatch, unreadable state or failed publication stays fenced. Guardian death before terminal proof remains fenced and is outside this fix. Ambiguous job results, installation leases and staging are unchanged.
Update the owning structure contract and English operating reference; add native regressions and register the new test file. Needs maintainer security review for recovery fencing before merge. Do not merge this draft.

Verification

Branched from origin/dev 12c0ec6edbcb002fdd25882db0add10c4e657573; bun install --frozen-lockfile passed with Bun 1.4.4 on Windows x64.
Red on unmodified base: new native regression 19 pass / 3 fail at the expected admission assertions; separate byte-for-byte replay of copied retained artifacts 0 pass / 1 fail. Originals remained unchanged.
Final exact-head focused command: OCX_TEST_NO_QUEUE=1 bun test tests/codex-integration/codex-cli-update-windows-pending.test.ts ./.tmp/release-recovery/retained-replay.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts — 60 pass / 0 fail (30 pending cases, 1 private retained-byte replay, 29 layout checks). Includes pending file-identity preservation and native PID/FILETIME overflow refusal.
Native serial run: OCX_TEST_NO_QUEUE=1, one bun test process per file discovered by rg -l 'cli-update' tests -g '*.test.ts' — 32 files, 871 pass / 92 existing skips / 1 fail. Windows recovery 12/0, Windows apply 31/0, existing recovery 61/0, native Job store 19/0. The sole failure is ocx package launcher effective Bun runtime > uses a valid OPENCODEX_BUN_PATH for the actual proxy process: owned launcher/proxy remained at its bounded cleanup observation. Both owned PIDs were absent afterward. The test, launcher and process-control sources are unchanged. One isolated comparison at pristine base 12c0ec6edbcb002fdd25882db0add10c4e657573, after frozen install, ran OCX_TEST_NO_QUEUE=1 bun test tests/cli/ocx-launcher-runtime.test.ts --test-name-pattern 'uses a valid OPENCODEX_BUN_PATH for the actual proxy process': exit 0, 1 pass / 0 fail / 90 filtered, 5.98 seconds. The base failure was not reproduced; this does not establish a green PR or prove the failure inherited. The PR-head failure remains unresolved and has not been rerun to green. The final focused run follows the two additional width guards; unchanged passing broad tests were not repeated.
Negative coverage: token/parent/Job mismatch, live or inaccessible parent, live exact child, active Job, missing/invalid/foreign/nonterminal proof, malformed/incomplete pending identity, native observation failure, and publication flush/hardening/rename/readback failures. Refusals preserve fencing; unpublished identity survives failures before rename.
bun run typecheck, bun run structure:check, bun run privacy:scan, bun scripts/file-size-ratchet.ts, and git diff --check passed. Docs frozen install and bun run build passed (593 pages, 85,235 internal links).
Independent source security/correctness review of exact head e719164d4a94f512204bdba180c46fa2abb5c14a passed with zero blockers, including width guards. Agent review does not constitute maintainer security approval.
NOT RUN: full repository suite and test:changed (shared Windows host contention; the complete affected file set was run serially instead), native macOS/Linux/ARM64, release/promoted binary validation. Hosted PR checks are pending on this exact head; no workflow dispatch or CI rerun requested. PR remains draft for the retained local failure and maintainer security review.

Checklist

Scope stays focused and avoids unrelated cleanup.
Docs or release notes were updated when needed.
Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. Maintainer security review is required for this recovery-fencing change.

Summary by CodeRabbit

Bug Fixes
- Improved Windows CLI update recovery: a pending child record can be reconciled when its identity and terminal evidence are verified and the parent, child, and Job are confirmed gone.
- Recovery remains blocked when evidence is missing, incomplete, or inconsistent, or when publication fails.
Documentation
- Clarified Windows recovery requirements, including cases where guardian termination alone is insufficient to restore admission.

coderabbitai · 2026-10-28T14:04:31Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: lidge-jun/opencodex
Branch: fix/windows-cli-pending-recovery
File: .coderabbit.yaml
Commit: e719164
Layers: Repository YAML
Review profile: ASSERTIVE
Plan: Advanced
Run ID: 50d9f795-2c6f-4b0f-b969-0fd7256bcd58

Commits

Reviewing files that changed from the base of the PR and between 83062fc and e719164.

Files selected for processing: 7

docs-site/src/content/docs/reference/cli/agents.md
scripts/test-layout/layout-codex-collision.json
src/codex/cli-update-job-store-windows.ts
src/codex/cli-update-recovery.ts
structure/codex-cli-update.md
tests/codex-integration/codex-cli-update-windows-pending.test.ts
tests/fixtures/test-layout-expected.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

Walkthrough

Windows CLI update recovery can publish and reconcile a pending child record when its identity matches the armed record and required termination evidence is valid. Failed or incomplete checks keep admission blocked. New Windows integration tests cover successful reconciliation and failure cases.

Changes: Windows recovery admission

Layer / File(s)	Summary
Recovery-store publication `src/codex/cli-update-job-store-windows.ts`	The recovery store can write during publication and adopt an existing pending file. The adopted file is flushed before rename, and the published record is read back.
Pending-child validation and reconciliation `src/codex/cli-update-recovery.ts`, `structure/codex-cli-update.md`, `docs-site/src/content/docs/reference/cli/agents.md`	Windows recovery can publish a pending child record when its identity matches the armed record and the parent, child lifetime, guardian proof, and Job checks pass. Failed or incomplete checks keep admission blocked.
Recovery integration tests `tests/codex-integration/codex-cli-update-windows-pending.test.ts`, `scripts/test-layout/layout-codex-collision.json`, `tests/fixtures/test-layout-expected.json`	Windows-gated integration tests cover successful reconciliation, invalid records and evidence, publication failures, and live child or Job states. The test is added to the integration layout mappings.

Priority: Normal

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant WindowsAdmission
  participant inspectRecoveryFiles
  participant NativeEvidence
  participant WindowsCliRecoveryIo
  WindowsAdmission->>inspectRecoveryFiles: inspect recovery files with publishChild callback
  inspectRecoveryFiles->>NativeEvidence: check parent, child lifetime, guardian proof, and Job state
  NativeEvidence-->>inspectRecoveryFiles: return evidence
  inspectRecoveryFiles->>WindowsCliRecoveryIo: publish validated child record
  WindowsCliRecoveryIo-->>inspectRecoveryFiles: return publication result
  inspectRecoveryFiles-->>WindowsAdmission: return reconciled or blocked status

Possibly related issues

Issue 2811: This PR adds Windows restart recovery for interrupted CLI update child-record publication, which is part of the requested update apply workflow. It does not implement the full workflow.

Suggested reviewers: ingwannu, luvs01

Merge Risk: Minimal · up to e7191

No actionable regression was established. The reported Windows launcher failure still needs a native rerun.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the primary change: Windows recovery for interrupted Codex CLI child publication. It matches the documented implementation and PR objective.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 4 functions across 3 files. (4 skipped: 4 unsupported.)

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches: 💡 1

📝 Generate docstrings: 💡

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-28T14:04:40Z

✅ Deterministic PR hygiene checks passed.

chatgpt-codex-connector · 2026-10-28T14:29:42Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T14:31:11.226460Z	`e719164`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

lidge-jun added 2 commits October 28, 2026 22:59

fix(windows): reconcile proven pending CLI update children

c9750e8

fix(windows): bound adopted child identities to native widths

e719164

lidge-jun added the ci:full Run the four full Ubuntu test shards on this pull request label Oct 28, 2026

github-actions Bot added the bug Something isn't working label Oct 28, 2026

lidge-jun marked this pull request as ready for review October 28, 2026 14:29

lidge-jun requested a review from Ingwannu as a code owner October 28, 2026 14:29

lidge-jun merged commit 7eab243 into dev Oct 28, 2026
46 of 47 checks passed

lidge-jun deleted the fix/windows-cli-pending-recovery branch October 28, 2026 14:41

This was referenced Oct 28, 2026

fix(codex): address Windows updater release and observation reviews #7875

Merged

[WRONG BRANCH] release: promote frozen tip 9c33e4658 to main as 2.94.0 #7933

Closed

[WRONG BRANCH] release: promote frozen tip dc75a3e51 to main as 2.94.0 #7940

Merged

coderabbitai Bot mentioned this pull request Oct 29, 2026

test(windows): use a never-allocated PID for the pending-child recovery fixture #7949

Merged

3 tasks done

Navigation Menu

Repository navigation

fix(windows): recover interrupted Codex CLI child publication - #7909

fix(windows): recover interrupted Codex CLI child publication#7909
lidge-jun merged 2 commits into
devfrom
fix/windows-cli-pending-recovery

lidge-jun commented Oct 28, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Oct 28, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 28, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

lidge-jun commented Oct 28, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Checklist

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Oct 28, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

lidge-jun commented Oct 28, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Oct 28, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 28, 2026 •

edited

Loading