[luvs01]

Summary

Enable explicitly confirmed Windows x64 npm-global Codex CLI updates through durable job admission and fresh plan checks. Hold prefix and toolchain authority through packing, installation and version verification. Preserve unrelated packages, shims and npm metadata; retain ownership when child lifetime or native cleanup is uncertain. Retrying result persistence never repeats installation.

Worker completion distinguishes the installation outcome from later resource cleanup. A late Worker close releases proven resources without rewriting an ambiguous result as success. The shared selection gate fences shim install, restore and removal while a Worker commits. This remains stacked on #7626 at 6577d55.

The final test follow-up at 99778ca adds bounded diagnostics to the standalone GUI-pair test after an otherwise opaque child exit in Windows CI. It reports only a fixed failure class, exit/signal and stream-observation state; credential-bearing output remains withheld. The original assertions, product code and deadlines are unchanged. Five focused tests cover the diagnostic reader's EOF, byte-window eviction, read failure and cancellation behavior.

Verification

• Exact-head full CI 40244408601 on 99778ca passed: 28 successful jobs / 6 conditional skips, including all nine Windows shards, macOS shards/control and the desktop checks.
• Published-head automatic CI 40250973916 also passed on the same commit.
• Official Windows Bun 1.4.4: the original six-file GUI batch plus diagnostic cases passed 47 tests / 371 assertions. Native processes reached terminal exit with both streams complete, no remaining direct child and verified isolated-fixture cleanup. An earlier local attempt lacked React; that input-environment failure is preserved separately.
• The previous public 56effd8 full run failed because the GUI-pair child exited 1, not because of a timeout. The original failure has not been reproduced or attributed to a confirmed cause. The passing diagnostic candidate is useful evidence, not proof of that cause.
• Earlier Windows plan assertion corrections and sparse-fixture path investigation remain recorded. The failed local sparse preparation was retained; the unchanged case passed with a short isolated TEMP. Current full CI covers the final source tree.
• Earlier controlled native apply/Worker tests covered retained authority, native exit, output completion, cleanup and Worker join inside and beyond the host grace period. These are fixture results, not actual vendor-installation evidence.

Limits

Actual vendor Codex installation, another Windows user's boundary, ARM64 and compiled Worker/FFI execution remain unverified. Shared-prefix limits and rejection of unsafe ACL, reparse and link layouts remain in force. No live application, account, certificate store or global configuration changed. Maintainer acceptance of the installation/security boundary remains required before merge.

Checklist

• Current parent and preserved transaction guards reviewed.
• Final-head full CI passed with local and hosted evidence kept distinct.
• GUI-pair diagnostics remain bounded and do not print credential-bearing output.
• Installation limits and unresolved original CI failure cause are documented.
• Final published-head automatic checks passed.
• Maintainer installation/security review before merge.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review: 2

• ^dev$
• ^preview$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: codex/windows-apply-transaction-20261023
• File: .coderabbit.yaml
• Commit: 0f02649
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 91b37a3f-7d4c-42c1-a637-d8e35fabee59

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[luvs01]

There are no GUI layout or interaction changes requiring screenshots. The only gui/ paths are package.json and bun.lock, inherited from the current dev dependency baseline. The Windows transaction changes backend execution and validation; this comment records the screenshot exemption under the repository's collaborator-comment gate.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[luvs01]

Fixed the two Windows 3/9 fixture failures from run 40052614948 in 4b87e15aa05e0cb191098699cba450f21d7992ba.

The unsafe-store test now creates an explicit junction and verifies rejection before ledger creation. The metadata test uses a private fixture, checks applicability against the observed session state, and verifies exactly three metadata queries, no candidate/installer execution, unchanged files, and child cleanup. Production code and security checks are unchanged.

The changed cases passed under official Bun 1.4.4; the final ACL preparation change passed its affected case (31 assertions). The earlier 1.4.3 run is comparison evidence only. Independent review found the assertions stronger; its remaining fixture-ACL concern is addressed in this head. Type/privacy checks passed before the final fixture-only adjustment. Fresh hosted CI remains pending; this PR stays Draft.

[lidge-jun]

Release decision for v2.93.0: DEFERRED_POST_RELEASE. This PR is part of the Codex CLI updater stack (#7586 → #7596 → #7626 → #7648, siblings #7614/#7618/#7619), which is deferred as a whole until after v2.93.0. The evidence and the suggested landing order are in #7586 (comment).