fix(windows): resolve test-lock runtime known folder in process

[lidge-jun]

Summary

Windows x64 now resolves the effective user's LocalAppData in-process with SHGetKnownFolderPath, removing a fresh PowerShell startup and Add-Type compilation from runtime namespace resolution. This fixes the avoidable helper deadline on the nested Bun lock controller's cold path while preserving SID scoping, canonicalization/reparse refusal, required ACL hardening, and the existing live-lock assertions.

Evidence and diagnosis:

• Run 38715597795, Windows 5/9, head 27d095b4f9731e366fc191e4655bb17bb2d0a45d, failed the nested controller case after 30302.87 ms, reporting the Windows effective-user runtime is unavailable.
• That error is emitted only around resolveEffectiveUserRuntimeRoot, after the SID has resolved and before lock-directory ACL hardening or acquisition. The controller copies its parent's environment and removes only the queue opt-out. The runtime resolver deliberately ignores USERPROFILE and LOCALAPPDATA; propagating those values cannot fix this path. The known-folder helper has a 30000 ms child timeout and compiles a P/Invoke type with Add-Type in each fresh process. The duration and failure boundary strongly support helper timeout. The receipt omits the underlying cause, so the historical log cannot distinguish PowerShell startup from compilation/scheduling time or completely exclude a filesystem refusal inside the same wrapper. No particular antivirus or scheduler cause is claimed.
• Three comparison dispatches passed this same case: dev 38697651428 2675.87 ms; fix/windows-ci-root-causes 38591638991 2712.72 ms; fix/windows-history-stale-ledger 38698612476 3828.00 ms. This bounded four-observation sample contains one failure; it does not establish a repository-wide failure rate. Case outcomes are separate from overall workflow outcomes.
• Checked open PRs and branch history for fix(codex): protect the desktop authority key in-process on Windows x64 #7181 (fix/dpapi-helper-latency), test(codex): use shared Windows attest spawn budgets #7151 (fix/windows-attest-zero-effect-timeout), and fix(usage): keep usage-ledger file ids exact so Windows NTFS ids stop colliding #7089 (fix/windows-history-stale-ledger): none changes this resolver or test-lock path. test(ci): give the Windows nested live-lock case its own lock owner #5078 supplied the independent controller owner; that coverage remains intact. Refs [Bug][CI]: Windows batch leg skips its nested live-lock regression under OCX_TEST_NO_QUEUE=1 #4991.

The native path uses the same LocalAppData GUID, KF_FLAG_DEFAULT_PATH, and null token as the existing helper. Shell32/Ole32 load from the OS-resolved system directory. UTF-16 decoding is bounded and CoTaskMemFree runs even for a failed HRESULT or decoding error, as required by the Windows API contract. Unsupported FFI retains the existing bounded trusted helper; native API failures refuse without an environment fallback. The SID helper and its existing timeout are unchanged.

Verification

• bun install --frozen-lockfile — passed.
• bun test tests/codex-integration/codex-user-identity.test.ts tests/windows/windows-popup-fix.test.ts tests/ci-workflows/test-runner.test.ts — 85 pass, 4 platform skips, 0 fail, 475 assertions, macOS/Bun 1.4.3. Includes the unchanged Windows live-lock case (platform-skipped locally) and a new Windows x64 test requiring the real in-process lookup even when the helper callback throws.
• bun test tests/codex-integration/codex-coordinator-doctor.test.ts tests/codex-integration/codex-write-lock.test.ts tests/clients/client-lifecycle-lock.test.ts tests/ci-workflows/file-size-ratchet.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts — 79 pass, 0 fail, 848 assertions.
• Deterministic red/green: forcing the selector back to the helper makes bun test tests/codex-integration/codex-user-identity.test.ts --test-name-pattern 'native known-folder resolution avoids' fail (0 pass / 1 fail). Restoring native selection passes (1 pass / 0 fail). The fixture models a timed-out probe without sleeping. Additional portable tests cover GUID/flags/null token, Unicode including surrogate pairs, HRESULT failure, null output, decoding failure, bounded unterminated output, allocation cleanup, and refusal without fallback.
• bun run typecheck, bun run structure:check, bun run privacy:scan, git diff --check — passed. Structure documentation stays within the existing 600-line codex-home budget; no ratchet caps or test-layout registrations changed (coverage extends an existing registered file).
• Full suite / broad import-connected selection not run locally under the shared-worktree resource exception: this resolver is imported throughout the runtime, and concurrent implementation lanes share the host. Focused lock/namespace/doctor suites and gates passed; full Linux/macOS coverage and real Windows ABI/controller execution remain with CI. This PR stays draft pending that evidence and explicit security review. No new skip of an existing test, retry, rerun bypass, timeout widening, or workflow-trigger change.
• Dispatched gh workflow run ci.yml --repo lidge-jun/opencodex --ref fix/windows-nested-test-lock-identity -f lane=all exactly once: run 38757309924, event workflow_dispatch, head a1d50db6378db59a7245a2afb031e26feef3b842, currently queued. The normal pull-request run 38757292102 is also queued at that head. Neither is passing evidence; Windows execution and required checks remain pending.

Security review scope: effective-user namespace identity and native memory/DLL handling. Author inspection checked the 16-byte GUID layout, x64 pointer output, 32-bit HRESULT/flags, null current-user token, trusted absolute DLL paths, matching allocator/free routine, and fail-closed API errors. Maintainer security sign-off remains required under MAINTAINERS.md; no claim of independent approval is made.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. Author boundary review is documented above; explicit maintainer security review is pending.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.