fix(codex): retry native-main ACL timeout once

[luvs01]

Summary

• Preserve bounded ACL error codes so the native-main owner can identify a real ETIMEDOUT from permanent permission failures or untrusted message text.
• Let the native-main lock owner consume exactly one fresh-budget recovery after a process-memoized ACL timeout, then remain fail-closed with EACLRETRYEXHAUSTED instead of restalling indefinitely.
• Keep ordinary ACL callers on the existing anti-restall behavior; only the owner with its own single-flight retry policy can consume the recovery.
• This is a focused follow-up to [Bug]: Windows NTFS에서 ACL hardening이 5초 후 ETIMEDOUT으로 실패하며 파일시스템 미지원으로 오인 표시됨 #160, [Bug]: synchronous Windows ACL hardening stalls the proxy on response-state writes #612, and Dashboard shows no data when ACL hardening cannot be verified (management API fails closed), plus a permanent false startup-protection warning and a 10s first paint #766. It is adjacent to, but independent from, the empty stage-sweep fix in Native-profile lock deadlock: all native requests 503 with zero profiles registered, and account main recover cannot clear it #1120 / fix(codex): skip empty native-profile stage sweeps #1124.

Verification

• Final head, Bun 1.4.0-canary.1: 6 targeted recovery regressions passed, 160 filtered, 0 failed.
• Final head, Bun 1.3.14: the same 6 targeted recovery regressions passed, 160 filtered, 0 failed.
• Before the final unrelated dev refresh, both full affected files passed on both runtimes: 166 passed, 0 failed.
• bun run typecheck — passed.
• bun run privacy:scan — passed.
• git diff origin/dev...HEAD --check — passed.
• Live Windows validation on two OpenCodex 2.10.2 hosts recovered native-main ownership and restored a visible, usable main account while preserving fail-closed behavior.
• A combined pre-split full-suite run was attempted on Windows Canary: 8,863 passed, 9 skipped, 275 failed, and 12 errors. The failures were dominated by existing environment/platform cases (Windows account lookup, symlink privilege, EBUSY cleanup, missing dashboard dependencies, and child bun PATH), so this PR does not claim a green full local suite; public CI remains required.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

No reusable credential, ACL bypass, or weaker default is introduced. Maintainer review is still required before merge.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes

  • Improved Windows lock-file permission handling by retrying once after a temporary timeout.
  • Prevented repeated retries after timeout recovery is exhausted.
  • Ensured pending retries are canceled when ownership is released.
  • Preserved clearer failure reporting for unrecoverable permission errors.

• Tests

  • Added coverage for timeout recovery, retry exhaustion, cancellation, and platform-specific permission behavior.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 08a789ad-cf5b-446b-a7ac-ebd3f0f1998d

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Windows ACL hardening now supports one bounded timeout retry. Native-main ownership tracks retry state, defers one ETIMEDOUT failure, and stops after exhaustion. Tests cover recovery, terminal failure, release cancellation, structured errors, and Windows-specific behavior.

Changes

ACL timeout recovery

Layer / File(s)	Summary
ACL hardening timeout state src/lib/windows-secret-acl.ts	timedOutPaths records retry consumption. Synchronous and asynchronous hardening support one explicit retry, preserve approved error codes, sanitize failures, and clear timeout state after success.
Native-main owner retry integration src/codex/native-main-lock-file.ts, src/codex/native-main-owner.ts	Native-main owner entries track retry state. Default lock-file hardening receives retryTimedOutOnce. One coded ETIMEDOUT failure is deferred for retry; exhausted or unavailable owners do not restart acquisition.
Timeout recovery validation tests/native-main-owner-lifetime.test.ts, tests/windows-secret-acl.test.ts	Tests cover one-time recovery, retry exhaustion, release cancellation, permanent message-only failures, structured error codes, injected ACL results, and Windows-specific assertions.

Estimated code review effort: 4 (Complex) | ~45 minutes

Sequence Diagram(s)

sequenceDiagram
  participant NativeMainOwner
  participant LockFileHardener
  participant WindowsACL
  NativeMainOwner->>LockFileHardener: request lock-file hardening
  LockFileHardener->>WindowsACL: apply required ACL with retry budget
  WindowsACL-->>NativeMainOwner: success or coded ETIMEDOUT
  NativeMainOwner->>NativeMainOwner: schedule one retry or mark unavailable

Loading

Possibly related PRs

• lidge-jun/opencodex#782: Both changes modify Windows ACL timeout memoization and required/optional retry behavior.

Suggested reviewers: lidge-jun, wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: retrying native-main ACL timeouts once.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/lib/windows-secret-acl.ts.

[github-actions]

⏳ DRAFT

• review readiness checklist open (0/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ⬜ I pushed my PR to the latest dev commit.
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[luvs01]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[luvs01]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: 004a6c12c4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[lidge-jun]

Thank you — this is landing as #1135 in the stacked campaign, cherry-picked with your authorship intact.

The coded-error taxonomy is what makes this adoptable: it separates "the ACL call timed out" from "the ACL was refused" instead of widening the catch, so the single retry applies only to the recoverable class and a denial still denies. On a path that guards a physical credential that distinction is the whole safety argument, and your permanent-error / timeout / retry-exhaustion cases pin it.

Verified on the stack head: tests/windows-secret-acl.test.ts + tests/native-main-owner-lifetime.test.ts — 166 pass / 0 fail; typecheck clean; privacy scan green; full suite passed the prepush gate.

One honest limitation I noted in the PR rather than glossing over: my verification ran on macOS, so the Windows ACL boundary is exercised through injection, not natively. The Windows CI leg is what would prove the real behavior.

Leaving this PR open for you.