[WRONG BRANCH] fix(win): fail-closed on config directory ACL hardening errors

[luvs01]

Motivation

• Prevent plaintext secret files from being created in an unhardened config directory on Windows by restoring fail-closed behavior for required ACL hardening.

Description

• Stop swallowing hardenSecretDir(..., { required: true }) failures in configMutationDatabasePath() so hardening errors abort before the mutation DB or secret files are created.
• Remove the degrade/continue path that logged a warning and allowed writes to proceed under an unprotected OPENCODEX_HOME.
• Update the Windows-focused regression test in tests/config.test.ts to assert that saveConfig() throws and does not create config.json when required directory hardening fails.

Testing

• Ran bun test tests/config.test.ts -t "saveConfig fails closed when config directory hardening fails on win32" which passed.
• Ran bun x tsc --noEmit (via bun run typecheck) which passed.
• Ran bun run privacy:scan which passed.
• Attempted a full bun run test; the long-running suite encountered an unrelated cross-process test timeout and was stopped, so please re-run CI for full-suite verification.

---

Codex Task

Summary by CodeRabbit

• Bug Fixes
  • Configuration directory security failures on Windows are now surfaced instead of being silently ignored.
  • Configuration files are no longer created when required security hardening fails.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 76bceeff-dfb5-44ba-b53d-f19115ca8823

📥 Commits

Reviewing files that changed from the base of the PR and between 2468502 and e43115e.

📒 Files selected for processing (2)

• src/config.ts
• tests/config.test.ts

---

📝 Walkthrough

Walkthrough

Windows configuration-directory ACL hardening now fails closed. saveConfig propagates ACL application errors and does not create the configuration file. The test now verifies this behavior.

Changes

Configuration ACL hardening

Layer / File(s)	Summary
Propagate ACL failures during config save src/config.ts, tests/config.test.ts	saveConfig now propagates required Windows ACL application errors instead of logging and continuing. The test verifies that the error is thrown and no configuration file is created.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• luvs01/opencodex#53: Implements the same Windows ACL fail-closed behavior and corresponding saveConfig test updates.

Suggested reviewers: lidge-j, wibias, ingwannu

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the Windows ACL hardening change and matches the pull request objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/propose-fix-for-windows-config-dir-acl-issue

---

_{Comment @coderabbitai help to get the list of available commands.}