[WRONG BRANCH] config: fail-closed on OpenAI-tier migration backup ACL hardening

[luvs01]

Motivation

• The OpenAI-tier startup migration created a .pre-openai-tiers-v2.bak snapshot but soft-failed Windows NTFS ACL hardening, which could publish a backup containing API keys and other secrets with inherited broad ACLs.

Description

• Require successful Windows ACL hardening for migration backups by calling hardenSecretPath(..., { required: true }) in the backupConfigBeforeOpenAiTierMigration default IO harden callback in src/config.ts so the snapshot is not published when hardening fails.
• Add a regression test in tests/openai-provider-option-startup.test.ts that simulates an icacls access-denied failure and verifies backupConfigBeforeOpenAiTierMigration throws, no .pre-openai-tiers-v2.bak is created, and no temp residuals leak.
• Files changed: src/config.ts and tests/openai-provider-option-startup.test.ts.

Testing

• Ran bun test tests/openai-provider-option-startup.test.ts and the targeted test file passed (including the new failure-case test).
• Ran bun run typecheck (bun x tsc --noEmit) and it passed.
• Ran bun run privacy:scan and it passed.
• Ran broader bun run test during verification where unrelated long-suite timeouts and environment-specific failures appeared in other tests (these failures are pre-existing / environment-bound and are unrelated to the backup ACL change).

---

Codex Task

Summary by CodeRabbit

• Bug Fixes

  • OpenAI tier backup snapshots now publish only after Windows ACL hardening succeeds.
  • Backup creation fails safely when ACL hardening is denied, preventing unsecured snapshots from being published.
  • Failed backup attempts leave no backup or temporary files behind.

• Tests

  • Added coverage for Windows access-denial scenarios during default backup creation.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 72730224-4fd2-48f5-b2bd-0568a64ae19d

📥 Commits

Reviewing files that changed from the base of the PR and between 2468502 and cc47877.

📒 Files selected for processing (2)

• src/config.ts
• tests/openai-provider-option-startup.test.ts

---

📝 Walkthrough

Walkthrough

OpenAI backup snapshots now require successful Windows ACL hardening before publication. An integration test verifies that ACL failures abort creation and leave no backup or temporary files.

Changes

OpenAI backup hardening

Layer / File(s)	Summary
Mandatory ACL hardening and failure validation src/config.ts, tests/openai-provider-option-startup.test.ts	src/config.ts:415-417 changes ACL hardening from optional to required. The Windows-specific test simulates icacls denial, verifies the operation throws, checks artifact cleanup, and restores test state.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• luvs01/opencodex#53: Both changes make Windows ACL hardening fail closed and verify that no files remain after failure.
• luvs01/opencodex#55: Both changes propagate Windows ACL hardening errors, but target different paths.

Suggested labels: bug

Suggested reviewers: lidge-jun, wibias, ingwannu

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: fail-closed ACL hardening for OpenAI-tier migration backups.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/propose-fix-for-acl-hardening-vulnerability

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.