[lidge-jun]

Summary

Follow-up to #7852 for a CodeRabbit finding on that PR. refuses() in tests/ci-workflows/fixture-windows-runtime-preload.test.ts accepted any stderr matching /refus|requires/i. Every gate in tests/helpers/fixture-windows-runtime-preload.ts throws a message that matches, so a case could pass because an earlier, unrelated gate refused it.

Each case now names the gate that must stop the child, following the preload's check order: armed guard and absolute home, owner root and nonce presence, protected-tree overlap, owned-root containment, owner marker, nonce match. The two direct-assertion cases (missing/blank/relative home, protected local-appdata target) use the same named gates. No production code changes.

Verification

• bun test tests/ci-workflows/fixture-windows-runtime-preload.test.ts on Windows 11, Bun 1.4.4: 31 pass / 0 fail.

NOT RUN: full bun run test (test-only change to one file; PR CI covers it).

Checklist

• Targets dev
• Focused tests pass locally
• No GUI change

Summary by CodeRabbit

• Tests
  • Automated checks now verify that preload refusals report the specific rejection reason, including cases involving protected paths, ownership boundaries, symlink aliases, and nonce validation. This improves confidence that refusal messages remain accurate across these scenarios.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T02:42:28.641334Z	c2e52cb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: fix/test-preload-refusal-gates
• File: .coderabbit.yaml
• Commit: c2e52cb
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5d5f14a4-8eb2-4373-af88-6059dcaf938a

Commits

Reviewing files that changed from the base of the PR and between fb22d05 and c2e52cb.

Files selected for processing: 1

• tests/ci-workflows/fixture-windows-runtime-preload.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

Walkthrough

The Windows runtime preload tests now check that each refusal case reports its expected rejection reason in stderr, rather than accepting generic refusal text.

Changes: Windows preload refusal assertions

Layer / File(s)	Summary
Specific refusal reason assertions tests/ci-workflows/fixture-windows-runtime-preload.test.ts	The shared refuses helper checks a case-specific expected pattern in stderr. Refusal cases specify patterns for guard, owner-root, protected-tree, boundary, owner-marker, and nonce rejection paths. These include symlink-alias and protected-target cases.

Priority: Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Possibly related PRs

• lidge-jun/opencodex#7852: Adds the preload fixture and refusal cases that this PR updates.

Suggested reviewers: ingwannu

Merge Risk: Minimal · up to c2e52

This test-only change strengthens refusal assertions without introducing a current-head production or mergeability risk.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title "test: assert the specific refusal gate in the fixture preload tests" matches the main change. The raw summary and PR objectives both say the preload refusal tests now assert specific refusa…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "test: assert the specific refusal gate in the fixture preload tests" matches the main change. The raw summary and PR objectives both say the preload refusal tests now assert specific refusal reasons instead of the broad /refus|requires/i match. The title is short, specific, and free of file lists or vague terms. No production code changes are reported, which the "test:" prefix reflects.

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 1 functions across 1 files.

Resolution

Write docstrings for the functions missing them to satisfy the coverage threshold.

Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Maintainer integration into dev: all required checks passed on exact head c2e52cb, which merges into current origin/dev without conflict. Test-only change.