[WRONG BRANCH] fix(codex): bound destroyed shim diagnostics

[luvs01]

Motivation

• Prevent destroyedShimMessage() from performing an unbounded synchronous read of the tracked launcher path which could block or exhaust memory when a low-integrity local process replaces the launcher with a FIFO or other non-regular file.

Description

• Replace the unsafe isShim(file.wrapperPath) call inside destroyedShimMessage() with a bounded, file-type-aware probe using stableShimPathProbe(file.wrapperPath) so diagnostics read only the probe prefix and avoid opening non-regular files.
• Preserve existing operator-facing wording and version-manager guidance while using the probe result to classify the wrapper as present but unusable / present but not an opencodex shim / missing.
• Add a regression test that creates a FIFO at the launcher path and verifies autoRestoreCodexShim() returns ineligible quickly without blocking.
• Changes are in src/codex/shim.ts and tests/codex-shim.test.ts.

Testing

• Ran bun test tests/codex-shim.test.ts --test-name-pattern "version-manager shim destruction" and the version-manager shim-destruction tests (including the new FIFO regression) passed.
• Ran bun test tests/codex-shim.test.ts which exercised the suite; the run showed 70 passed and 2 unrelated test failures in process-group cleanup assertions that observed a different diagnostic message (those failures are unrelated to the bounded-read change).
• Ran bun x tsc --noEmit (typecheck) and bun run privacy:scan and both completed successfully.

---

Codex Task

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Warning

Review limit reached

Next included review available in 50 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 8331b67f-247e-407d-ab1d-dc6c9cfdb28b

📥 Commits

Reviewing files that changed from the base of the PR and between ec51e42 and e499c62.

📒 Files selected for processing (2)

• src/codex/shim.ts
• tests/codex-shim.test.ts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e499c629bd

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Make the launcher probe resistant to path-swap races

When another local process can modify the launcher directory, this still permits the startup hang the change is intended to prevent: stableShimPathProbe() checks the path with lstatSync/statSync, then separately opens the pathname, so the checked regular file can be replaced with a FIFO before openSync(path, "r"), which blocks indefinitely. The new test covers only a FIFO already present before the metadata check. Open the path nonblocking first, verify the opened descriptor with fstatSync, and read from that same descriptor so the file-type check and read refer to one object.

Useful? React with 👍 / 👎.