[WRONG BRANCH] fix(codex): reject profile FIFOs without blocking

[luvs01]

Motivation

• Prevent a newly-introduced regression where readBounded opens untrusted paths in blocking mode and can hang the process when a FIFO is placed at profile/config paths.
• Ensure the descriptor-based bounded-read approach still defends against replacement/growth races while refusing special files that would block on open.

Description

• On POSIX platforms, add O_NONBLOCK to the open flags used by readBounded so openSync(path, flags) does not block waiting for a FIFO partner; the change is in src/codex/native-profile-store.ts.
• Add a regression test that creates a FIFO at the vault path and asserts readNativeProfileVault rejects it without waiting for a writer, in tests/native-profile-store.test.ts.
• Import execFileSync in the test to create the FIFO; the change is minimal and focused to avoid changing existing bounded-read semantics for regular files.

Testing

• Ran bun test tests/native-profile-store.test.ts which passed (16 tests, 0 failures).
• Ran bun run typecheck which completed successfully.
• Ran bun run privacy:scan which completed successfully.
• A full bun run test was executed but encountered unrelated failures in other test suites (tests/api-key-attribution.test.ts), so the focused native-profile tests and static checks were used to validate this fix.

---

Codex Task

Summary by CodeRabbit

• Bug Fixes
  • Improved profile file reading on non-Windows systems to avoid blocking on special files such as FIFOs.
  • Vault reads now fail promptly with an appropriate error when the target is not a regular file.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

📝 Walkthrough

Walkthrough

Non-Windows bounded profile vault reads now open files with O_NONBLOCK. A regression test creates a FIFO and verifies that the read fails with NativeProfileError without waiting for a writer.

Changes

Profile vault read behavior

Layer / File(s)	Summary
Non-blocking vault reads and FIFO regression test src/codex/native-profile-store.ts, tests/native-profile-store.test.ts	At line 386, non-Windows reads add O_NONBLOCK to the existing flags. The test setup imports execFileSync and creates a FIFO with mkfifo. The test at lines 386–392 verifies rejection with NativeProfileError without a writer.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: ingwannu, lidge-jun, wibias

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: preventing profile FIFO reads from blocking.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-blocking-fifo-opens-in-reads

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/native-profile-store.test.ts`:
- Around line 386-392: Update the skipped FIFO test around
readNativeProfileVault to execute the vault read in a child process with an
OS-level timeout, preventing openSync from hanging the test runner when no
writer exists. Assert that the child exits before the deadline and reports
NativeProfileError, rather than wrapping the synchronous call in toThrow or
relying on a JavaScript timer.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 95c48458-dfca-440e-b5a6-a7b3e53cede2

📥 Commits

Reviewing files that changed from the base of the PR and between 2468502 and b47b2ff.

📒 Files selected for processing (2)

• src/codex/native-profile-store.ts
• tests/native-profile-store.test.ts

[coderabbitai]

🩺 Stability & Availability | 🟠 Major | 🏗️ Heavy lift

Run the FIFO read in a bounded subprocess.

If O_NONBLOCK regresses, readNativeProfileVault(store) can block inside openSync while waiting for a writer. The synchronous call prevents toThrow from completing, so the test process can hang instead of reporting a failure.

Execute the vault read in a child process with an OS-level timeout. Assert that the child reports the expected NativeProfileError before the deadline. Do not rely on a JavaScript timer around the current synchronous call.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/native-profile-store.test.ts` around lines 386 - 392, Update the
skipped FIFO test around readNativeProfileVault to execute the vault read in a
child process with an OS-level timeout, preventing openSync from hanging the
test runner when no writer exists. Assert that the child exits before the
deadline and reports NativeProfileError, rather than wrapping the synchronous
call in toThrow or relying on a JavaScript timer.