fix(cli): stabilize guarded-stop re-verification and report the failing guard fact by devin-ai-integration[bot] · Pull Request #6402 · lidge-jun/opencodex

devin-ai-integration · 2026-10-01T13:43:46Z

Summary

Preserve guarded-stop refusal guards while adding an optional detail to ocx-stop/1 that names the failing runtime, compatibility, ownership, or manager observation. An unknown manager retains its observation failure reason instead of being reported as a proven manager swap.
Correct Windows .CMD/.BAT version-probe quoting for paths containing spaces. Retry transient Windows CLI-version and process-command-line probes once; persistent failures remain unknown and refuse takeover. POSIX probes remain single-shot.
Process-name identity rules are unchanged. The earlier target-triple widening and Windows .vbs launcher hypothesis were removed after native/source verification.

Verification

Refreshed from dev at 06cc3815c06a10120d89ef986c46be95be37f28a without rewriting branch history, including the accepted upstream role-route and owner-registry ACL fixture corrections. Targeted verification: role routes 7 passed; owner-registry ACL 6 passed. Required CI passed at 3075274ba1d77f30ee5772166c7f36938f17e813: zero failed and zero pending checks (platform/path-inapplicable checks remain skipped).
bun run typecheck, bun run privacy:scan, bun run structure:check: passed.
Focused process-state, managing-CLI, and guarded-stop tests: 48 passed. After the manager-reason follow-up, bun test tests/cli/cli-stop-json.test.ts: 22 passed; typecheck passed.
Combined native Windows build 1c14101e5 (this PR plus the startup-budget, Scheduler-scope, and bounded-manager-command PRs): three fresh-sidecar takeovers from actual npm 2.67.0 under a spaced prefix passed in 45.948s, 67.357s, and 54.589s. Owned Quit/relaunch preserved installation identity and generation; guest decline/Quit preserved the npm PID without recording ownership.
One additional native attempt under exactly two 30-second CPU workers passed in 49.861s. Timings measure approval to healthy replacement with persisted desktop ownership.
Unresolved: An earlier combined native attempt refused manager revalidation before acting, preserving the npm runtime. That run preceded the specific unknown-manager reason. The four follow-up passes and 46 successful read-only manager observations do not identify its cause or prove it fixed; the CIM-timeout explanation remains a hypothesis.
Full test:changed exceeded the Windows 900-second cap and is inconclusive. CI remains the full-suite gate.
Native app testing did not register Scheduler/WinSW services. Separate serial Scheduler CLI E2E passed on combined d50be3427: install, supported exact approval, guarded stop (runtimeDown: true, 49.4s), repair/start, and uninstall plus explicit stop restored the initial absent-manager baseline. WinSW requires account credentials and remains untested.

Checklist

Scope stays focused and avoids unrelated cleanup.
Docs or release notes were updated when needed.
Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

Required local validation passed; commands, results, and any full-suite exception are documented.
I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
I resolved all correct Codex and CodeRabbit findings.
My PR is ready for review.

Link to Devin session: https://app.devin.ai/sessions/a8795b27d4114aa6be37a88565e404b2
Open in Devin Desktop: https://app.devin.ai/desktop/session/a8795b27d4114aa6be37a88565e404b2?variant=devin

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

Required local validation passed; commands, results, and any full-suite exception are documented.
I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
I resolved all correct Codex and CodeRabbit findings.
My PR is ready for review.

…ng guard fact Three proven defects let an unchanged approved runtime read as changed: - isOcxCommandLine/isOcxStartCommandLine rejected the bundled sidecar's `ocx-<target triple>[.exe]` binary name, so every desktop-spawned runtime failed identity verification at approval and re-resolution. - The managing-CLI `--version` probe invoked a Windows command shim as `cmd /c <shim> --version`; cmd strips the outer quotes when more than one part is quoted, truncating the command at the first space whenever the shim path itself contains one. The shim now runs through a single verbatim-quoted /c line. - Single-shot probes (the shim `--version` probe and the Windows WMIC/PowerShell command-line read) treated one transient timeout as 'unobservable', flipping the compatibility fingerprint or PID identity of an unchanged process. Both get one bounded retry; a persistent failure still answers fail-closed. The approval-changed summary also collapsed ~10 distinct re-checks into one opaque message, so a transient re-probe was indistinguishable from genuine drift. The summary now carries `detail` naming the single guard fact that failed (token fingerprint vs live PID/port/hostname/CLI vs manager verification), threaded through runGuardedManagerStep as well. Addititive on ocx-stop/1; the desktop StopSummary tolerates the field. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

devin-ai-integration · 2026-10-01T13:43:48Z

I'll fix CI failures and address comments from users with write access. I'll skip comments containing "(aside)".

Disable automatic comment, CI, and merge conflict monitoring

coderabbitai · 2026-10-01T13:43:53Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: f53e4988-f143-44f2-bd09-bd6de9029ffa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-10-01T13:52:48Z

✅ Deterministic PR hygiene checks passed.

…identity widening Review correction: real Tauri builds run the bundled CLI as ocx.exe and native baseline ownership succeeded against it, so accepting ocx-<target-triple> names in process identity was broadened on an unproven launch path — reverted with its tests. The --version probe retry is now Windows-only (the platform the flake family was verified on); POSIX probes keep exactly one attempt. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

An unprovable manager (`kind: "unknown"` with a reason) is not a proven swap, but the pre-action recheck reported both as 'the service manager changed between approval and stop', losing why revalidation could not answer. Unknown now surfaces as 'the service manager could not be re-verified (reason)'; genuine mismatches keep the changed message. Stop and signal still never run against an unknown target. Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

github-actions · 2026-10-01T15:07:44Z

⏳ DRAFT

review readiness checklist open (0/0 boxes ticked).

What to do

Tick all four boxes in the PR description once you're done (currently 0/0).

Review readiness checklist

⬜ Required local validation passed; commands, results, and any full-suite exception are documented.
⬜ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
⬜ I resolved all correct Codex and CodeRabbit findings.
⬜ My PR is ready for review.

0/0 boxes ticked.

Automatic draft conversion failed. Please convert this pull request to a draft manually until every box above is ticked.

…90862188-guarded-stop-diagnostics

# Conflicts: # structure/runtime.md

lidge-jun · 2026-10-02T00:26:47Z

Maintainer integration record (MAINTAINERS.md, dev-only)

Actor: @lidge-jun (admin). The project owner asked on 2026-10-02 to land the Devin Windows hardening series, via PABCD plan unit devlog/_plan/261002_devin_windows_hardening_landing.
Exact head: e419c711b285556d8a664e9eed388f6fa933a9bb.
PR-lane Cross-platform CI at this head: run 36944646624 success. The PR lane skips the Windows and macOS shards.
Union proof on Windows and macOS: codex/windows-hardening-2.76 (29b1c39b2b) passed full lane=all run 36938434654 on attempt 2. In the Windows shards, cli-stop-json (22), managing-cli (10) and process-state (16) executed with 0 failures. Restricted to the series' files, this head is byte-identical to the integration tree.
Independent audit PASS: the refusal guards are unchanged, and detail is optional, additive and free of paths and secrets; the .CMD/.BAT quoting is correct for spaced paths. Maintainer merge of dev resolves the structure/runtime.md prose conflict by keeping every PR's clause.
Local suites: not run, by explicit owner instruction.
Authored by Devin (app/devin-ai-integration) for the project owner.

chatgpt-codex-connector · 2026-10-02T00:26:49Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-02T00:29:44.795547Z	`e419c71`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

devin-ai-integration Bot requested review from Ingwannu and lidge-jun as code owners October 1, 2026 13:43

github-actions Bot added the bug Something isn't working label Oct 1, 2026

lidge-jun and others added 2 commits October 1, 2026 13:53

This was referenced Oct 1, 2026

fix(service): scope Windows scheduler probes to the root task and re-probe deleted registrations #6401

Merged

fix(service): bound every Windows manager command the guarded stop depends on #6403

Merged

github-actions Bot marked this pull request as draft October 1, 2026 15:07

devin-ai-integration Bot added 2 commits October 1, 2026 16:25

Merge commit '58a26f0c13e7fa7c469219d8bbd3dfca0a9e33c4' into devin/17…

0677e89

…90862188-guarded-stop-diagnostics

Merge commit '06cc3815c06a10120d89ef986c46be95be37f28a' into devin/17…

3075274

…90862188-guarded-stop-diagnostics

devin-ai-integration Bot marked this pull request as ready for review October 1, 2026 17:54

github-actions Bot marked this pull request as draft October 1, 2026 17:55

Merge remote-tracking branch 'origin/dev' into rel-devin/up-6402

e419c71

# Conflicts: # structure/runtime.md

lidge-jun marked this pull request as ready for review October 2, 2026 00:26

lidge-jun merged commit 6d84e44 into dev Oct 2, 2026
39 checks passed

lidge-jun deleted the devin/1790862188-guarded-stop-diagnostics branch October 2, 2026 00:26

Navigation Menu

Repository navigation

fix(cli): stabilize guarded-stop re-verification and report the failing guard fact - #6402

fix(cli): stabilize guarded-stop re-verification and report the failing guard fact#6402
lidge-jun merged 6 commits into
devfrom
devin/1790862188-guarded-stop-diagnostics

devin-ai-integration Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot commented Oct 1, 2026

Uh oh!

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading

Review skipped

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026 •

edited

Loading

Uh oh!

lidge-jun commented Oct 2, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 2, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

devin-ai-integration Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Checklist

Review readiness checklist

Review readiness checklist

Uh oh!

devin-ai-integration Bot commented Oct 1, 2026

Uh oh!

coderabbitai Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

github-actions Bot commented Oct 1, 2026

Uh oh!

github-actions Bot commented Oct 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⏳ DRAFT

What to do

Review readiness checklist

Uh oh!

lidge-jun commented Oct 2, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

devin-ai-integration Bot commented Oct 1, 2026 •

edited

Loading

coderabbitai Bot commented Oct 1, 2026 •

edited

Loading

github-actions Bot commented Oct 1, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 2, 2026 •

edited

Loading