@bitkyc08/opencodex 2.80.0 → 2.82.0

package/src/codex/prompt-lock-claim.ts

@@ -0,0 +1,134 @@
+import { linkSync, mkdirSync, readdirSync, readFileSync, renameSync, rmdirSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { ownEvidence, ownerState, safeNamespace, type OwnerDeps, type OwnerEvidence } from "./prompt-lock-owner";
+import { ChangedLock as ChangedClaim, checkEntry, checkIdentity, guarded, type Entry, type Namespace } from "./prompt-lock-evidence";
+import { LockFileBusy, lockFileOperation } from "./prompt-lock-io";
+
+export interface ClaimRecord extends OwnerEvidence { ticket: number; token?: string }
+export class UnsafeLockNamespace extends Error {
+  constructor(readonly path: string) { super(`Unsafe lock state at ${path}; deliberate removal is required.`); }
+}
+interface AbandonedClaim { token: string; parents: Namespace[]; entry: Entry }
+// Only a completed invocation may enter this map; live/reentrant reservations never do.
+const abandoned = new Map<string, AbandonedClaim>();
+function recoverAbandoned(directory: string, deps: OwnerDeps): void {
+  for (const [path, claim] of abandoned) {
+    if (dirname(path) !== directory) continue;
+    // The token is bound to the captured bytes and unique name, never to PID alone.
+    const record = JSON.parse(claim.entry.body) as ClaimRecord;
+    if (record.pid !== process.pid || record.token !== claim.token) throw new ChangedClaim("Unknown local claim");
+    try { guarded(claim.parents, [claim.entry], deps, () => unlinkSync(path)); }
+    catch (error) {
+      if (!(error instanceof ChangedClaim) && (error as NodeJS.ErrnoException).code !== "ENOENT") throw error;
+      // A replacement is not ours; forget custody without deleting it.
+    }
+    abandoned.delete(path);
+  }
+}
+/** Publish owner evidence together with choosing=0; an empty reservation is never published. */
+export function withLockClaim<T>(
+  path: string, token: string, deps: OwnerDeps, run: () => T,
+  initialized?: () => void,
+): { ok: true; value: T } | { ok: false } {
+  const io = <R>(operation: () => R): R => lockFileOperation(operation, deps.platform);
+  const directory = `${path}.claims`;
+  try { recoverAbandoned(directory, deps); }
+  catch (error) { if (error instanceof LockFileBusy) return { ok: false }; throw error; }
+  if (!safeNamespace(dirname(path), "directory", deps)) throw new UnsafeLockNamespace(dirname(path));
+  const root: Namespace = { path: dirname(path), stat: io(() => deps.lstat(dirname(path))) };
+  try { guarded([root], [], deps, () => mkdirSync(directory, { mode: 0o700 })); }
+  catch (error) {
+    if (error instanceof LockFileBusy) return { ok: false };
+    if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
+  }
+  if (!safeNamespace(directory, "directory", deps)) throw new UnsafeLockNamespace(directory);
+  const parents = [root, { path: directory, stat: io(() => deps.lstat(directory)) }];
+  const claimDirectoryGone = (): boolean => {
+    try { const now = deps.lstat(directory); return now.dev !== parents[1].stat.dev || now.ino !== parents[1].stat.ino; }
+    catch { return true; }
+  };
+  const ownName = `${process.pid}-${token}.claim`, ownPath = join(directory, ownName);
+  const temporary = `${path}.claim-init-${token}`;
+  let ownEntry: Entry | undefined, temporaryEntry: Entry | undefined;
+  const evidence = { ...ownEvidence(deps), token };
+  const capture = (entryPath: string, expectedBody?: string): Entry => guarded(parents, [], deps, () => {
+    if (!safeNamespace(entryPath, "file", deps, true)) throw new UnsafeLockNamespace(entryPath);
+    const entry = { path: entryPath, stat: deps.lstat(entryPath), body: readFileSync(entryPath, "utf8") };
+    checkEntry(entry, deps);
+    if (expectedBody !== undefined && entry.body !== expectedBody) throw new ChangedClaim("Local claim evidence changed");
+    return entry;
+  });
+  const peers = (): Array<{ name: string; ticket: number }> => {
+    const result: Array<{ name: string; ticket: number }> = [];
+    for (const name of guarded(parents, [], deps, () => readdirSync(directory))) {
+      if (name === ownName) continue;
+      const peerPath = join(directory, name);
+      if (!/^([1-9][0-9]*)-[0-9a-f]{16}\.claim$/.test(name)
+        || !safeNamespace(peerPath, "file", deps, true)) throw new UnsafeLockNamespace(peerPath);
+      let entry: Entry, peer: ClaimRecord | null;
+      try { entry = capture(peerPath); peer = JSON.parse(entry.body); }
+      catch (error) {
+        if (error instanceof LockFileBusy || error instanceof UnsafeLockNamespace) throw error;
+        if ((error as NodeJS.ErrnoException).code === "ENOENT") continue;
+        throw new UnsafeLockNamespace(peerPath);
+      }
+      const state = ownerState(peer, deps);
+      if (state === "unsafe") throw new UnsafeLockNamespace(peerPath);
+      if (state === "dead") {
+        try { guarded(parents, [entry], deps, () => {
+          if (ownerState(peer, deps) !== "dead") throw new ChangedClaim("Peer is no longer dead");
+          checkEntry(entry, deps);
+          for (const parent of parents) checkIdentity(parent, deps);
+          unlinkSync(peerPath);
+        }); }
+        catch (error) { if ((error as NodeJS.ErrnoException).code !== "ENOENT") throw error; }
+        continue;
+      }
+      const ticket = peer?.ticket;
+      if (typeof ticket !== "number" || !Number.isSafeInteger(ticket) || ticket < 0) throw new UnsafeLockNamespace(peerPath);
+      result.push({ name, ticket });
+    }
+    return result;
+  };
+  try {
+    const choosingBody = JSON.stringify({ ...evidence, ticket: 0 });
+    guarded(parents, [], deps, () => writeFileSync(temporary, choosingBody, { mode: 0o600, flag: "wx" }));
+    temporaryEntry = capture(temporary, choosingBody);
+    guarded(parents, [temporaryEntry], deps, () => linkSync(temporary, ownPath));
+    ownEntry = { ...temporaryEntry, path: ownPath };
+    guarded(parents, [temporaryEntry], deps, () => unlinkSync(temporary)); temporaryEntry = undefined;
+    initialized?.();
+    let ticket = 1;
+    for (const peer of peers()) ticket = Math.max(ticket, peer.ticket + 1);
+    if (!Number.isSafeInteger(ticket)) return { ok: false };
+    const ticketBody = JSON.stringify({ ...evidence, ticket });
+    guarded(parents, [], deps, () => writeFileSync(temporary, ticketBody, { mode: 0o600, flag: "wx" }));
+    temporaryEntry = capture(temporary, ticketBody);
+    guarded(parents, [temporaryEntry, ownEntry], deps, () => renameSync(temporary, ownPath));
+    ownEntry = { ...temporaryEntry, path: ownPath }; temporaryEntry = undefined;
+    for (const peer of peers()) {
+      if (peer.ticket === 0 || peer.ticket < ticket || (peer.ticket === ticket && peer.name < ownName)) return { ok: false };
+    }
+    if (!safeNamespace(path, "file", deps, true)) throw new UnsafeLockNamespace(path);
+    return { ok: true, value: run() };
+  } catch (error) {
+    const code = (error as NodeJS.ErrnoException).code;
+    // A peer's final rmdir can remove the claims directory between our identity check and the
+    // link/rename into it; platforms report that as ENOENT or (macOS link) EINVAL. Either is contention.
+    if (error instanceof LockFileBusy || code === "ENOENT" || (code === "EINVAL" && claimDirectoryGone())) return { ok: false };
+    throw error;
+  } finally {
+    if (temporaryEntry) {
+      try { guarded(parents, [temporaryEntry], deps, () => unlinkSync(temporary)); } catch { /* Preserve changed or busy entries. */ }
+    }
+    if (ownEntry) {
+      try { guarded(parents, [ownEntry], deps, () => unlinkSync(ownPath)); }
+      catch (error) {
+        if (!(error instanceof ChangedClaim) && (error as NodeJS.ErrnoException).code !== "ENOENT") {
+          abandoned.set(ownPath, { token, parents, entry: ownEntry });
+        }
+      }
+      try { guarded(parents, [], deps, () => rmdirSync(directory)); } catch { /* A peer or replacement still owns the directory. */ }
+    }
+  }
+}

package/src/codex/prompt-lock-evidence.ts

@@ -0,0 +1,26 @@
+import { readFileSync, type Stats } from "node:fs";
+import { type OwnerDeps } from "./prompt-lock-owner";
+import { LockFileBusy, lockFileOperation } from "./prompt-lock-io";
+
+export class ChangedLock extends LockFileBusy {}
+export interface Namespace { path: string; stat: Stats }
+export interface Entry extends Namespace { body: string }
+export function checkIdentity(saved: Namespace, deps: OwnerDeps): void {
+  const current = deps.lstat(saved.path);
+  if (current.isSymbolicLink() || current.dev !== saved.stat.dev || current.ino !== saved.stat.ino
+    || current.uid !== saved.stat.uid || current.isDirectory() !== saved.stat.isDirectory()
+    || current.isFile() !== saved.stat.isFile()) throw new ChangedLock("Lock namespace changed");
+}
+export function checkEntry(saved: Entry, deps: OwnerDeps): void {
+  checkIdentity(saved, deps);
+  if (readFileSync(saved.path, "utf8") !== saved.body) throw new ChangedLock("Claim evidence changed");
+  checkIdentity(saved, deps);
+}
+export function guarded<T>(parents: Namespace[], entries: Entry[], deps: OwnerDeps, operation: () => T): T {
+  return lockFileOperation(() => {
+    for (const parent of parents) checkIdentity(parent, deps);
+    for (const entry of entries) checkEntry(entry, deps);
+    for (const parent of parents) checkIdentity(parent, deps);
+    return operation();
+  }, deps.platform);
+}

package/src/codex/prompt-lock-io.ts

@@ -0,0 +1,16 @@
+import { retryWindowsFileOperation, transientWindowsReplaceCode } from "../lib/windows-atomic-replace";
+
+/** A held Windows handle is contention, never owner-death evidence. */
+export class LockFileBusy extends Error {}
+
+export function lockFileOperation<T>(operation: () => T, platform: NodeJS.Platform): T {
+  let contended = false;
+  try {
+    return retryWindowsFileOperation({ run: operation, onRetry: () => { contended = true; } }, { platform, sleep: Bun.sleepSync });
+  }
+  catch (error) {
+    if (transientWindowsReplaceCode(platform, error)
+      || (contended && (error as NodeJS.ErrnoException).code === "EEXIST")) throw new LockFileBusy("Lock filesystem operation is busy");
+    throw error;
+  }
+}

package/src/codex/prompt-lock-owner.ts

@@ -0,0 +1,130 @@
+import { lstatSync, readFileSync, type Stats } from "node:fs";
+import { resolveTrustedWindowsPowerShellExe, resolveTrustedWindowsRegExe } from "../lib/windows-elevation";
+import { hostname } from "node:os";
+
+import { LockFileBusy, lockFileOperation } from "./prompt-lock-io";
+
+export interface HostIdentity { hostname: string; machine: string }
+export interface OwnerEvidence { pid: number; host?: HostIdentity; processStart?: string }
+export interface OwnerDeps {
+  isProcessAlive: (pid: number) => boolean | undefined;
+  hostIdentity: () => HostIdentity | undefined;
+  processStart: (pid: number) => string | undefined;
+  lstat: (path: string) => Stats;
+  uid: () => number | undefined;
+  platform: NodeJS.Platform;
+}
+
+function command(args: string[], timeoutMs: number): string | undefined {
+  try {
+    const result = Bun.spawnSync(args, { stdout: "pipe", stderr: "pipe", timeout: timeoutMs });
+    const value = result.stdout.toString().trim();
+    return result.exitCode === 0 && value ? value : undefined;
+  } catch { return undefined; }
+}
+const MACHINE_GUID_KEY = "HKLM\\SOFTWARE\\Microsoft\\Cryptography";
+function parseMachineGuid(output: string | undefined): string | undefined {
+  const lines = output?.trim().split(/\r?\n/);
+  if (lines?.length !== 2 || lines[0]!.trim().toLowerCase() !== "hkey_local_machine\\software\\microsoft\\cryptography") return undefined;
+  return /^[ \t]+MachineGuid[ \t]+REG_SZ[ \t]+([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})[ \t]*$/i.exec(lines[1]!)?.[1]?.toLowerCase();
+}
+/** One lazy identity cache per process; unavailable results are cached too. */
+export function createOwnerIdentity({
+  platform = process.platform, runCommand = command,
+  powerShellExe = resolveTrustedWindowsPowerShellExe,
+  regExe = resolveTrustedWindowsRegExe,
+  readFile = (path: string) => readFileSync(path, "utf8"),
+}: {
+  platform?: NodeJS.Platform;
+  runCommand?: (args: string[], timeoutMs: number) => string | undefined;
+  powerShellExe?: () => string;
+  regExe?: () => string;
+  readFile?: (path: string) => string;
+} = {}): Pick<OwnerDeps, "hostIdentity" | "processStart"> {
+  let cachedHost: HostIdentity | undefined;
+  let hostRead = false;
+  function hostIdentity(): HostIdentity | undefined {
+    if (hostRead) return cachedHost;
+    hostRead = true;
+    let machine: string | undefined;
+    try {
+      if (platform === "linux") {
+        for (const path of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+          try {
+            const value = readFile(path).trim();
+            if (/^[0-9a-f]{32}$/i.test(value)) { machine = value.toLowerCase(); break; }
+          } catch { /* Try the fallback machine-id file. */ }
+        }
+      }
+      else if (platform === "darwin") machine = runCommand(["/usr/sbin/sysctl", "-n", "kern.bootsessionuuid"], 1_000);
+      else if (platform === "win32") machine = parseMachineGuid(runCommand([regExe(), "query", MACHINE_GUID_KEY, "/v", "MachineGuid"], 3_000));
+      if (machine) cachedHost = { hostname: hostname(), machine };
+    } catch { /* Missing identity means no automatic takeover. */ }
+    return cachedHost;
+  }
+  function probeProcessStart(pid: number): string | undefined {
+    try {
+      if (platform === "linux") {
+        const stat = readFileSync(`/proc/${pid}/stat`, "utf8");
+        return stat.slice(stat.lastIndexOf(")") + 2).split(" ")[19];
+      }
+      if (platform === "darwin") return runCommand(["/bin/ps", "-p", String(pid), "-o", "lstart="], 1_000);
+      if (platform === "win32") return runCommand([powerShellExe(), "-NoProfile", "-NonInteractive", "-Command", `(Get-Process -Id ${pid} -ErrorAction Stop).StartTime.ToUniversalTime().Ticks`], 1_000);
+    } catch { /* Unknown start identity never proves death. */ }
+    return undefined;
+  }
+  let ownStartRead = false;
+  let cachedOwnStart: string | undefined;
+  function processStart(pid: number): string | undefined {
+    // No spawn-free Windows start-time source is available here. Missing start
+    // evidence disables only the PID-reuse check, never the live-PID veto.
+    if (platform === "win32" && pid === process.pid) return undefined;
+    if (pid !== process.pid) return probeProcessStart(pid);
+    if (!ownStartRead) { ownStartRead = true; cachedOwnStart = probeProcessStart(pid); }
+    return cachedOwnStart;
+  }
+  return { hostIdentity, processStart };
+}
+const identity = createOwnerIdentity();
+export const ownerDefaults: OwnerDeps = {
+  isProcessAlive(pid) {
+    try { process.kill(pid, 0); return true; }
+    catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      return code === "ESRCH" ? false : code === "EPERM" ? true : undefined;
+    }
+  },
+  ...identity, lstat: lstatSync,
+  uid: () => process.getuid?.(), platform: process.platform,
+};
+export function ownEvidence(deps: OwnerDeps): OwnerEvidence {
+  let host: HostIdentity | undefined, start: string | undefined;
+  try { host = deps.hostIdentity(); } catch { /* hostless */ }
+  try { start = deps.processStart(process.pid); } catch { /* unknown */ }
+  return { pid: process.pid, ...(host ? { host } : {}), ...(start ? { processStart: start } : {}) };
+}
+export function ownerState(record: OwnerEvidence | null, deps: OwnerDeps): "dead" | "live" | "unsafe" {
+  let host: HostIdentity | undefined;
+  try { host = deps.hostIdentity(); } catch { return "unsafe"; }
+  if (!host || !record?.host || (record.processStart !== undefined && (typeof record.processStart !== "string" || !record.processStart))
+    || !Number.isSafeInteger(record.pid) || record.pid <= 0
+    || host.hostname !== record.host.hostname || host.machine !== record.host.machine) return "unsafe";
+  try {
+    // Probe another PID's start only when liveness permits a takeover decision.
+    if (deps.isProcessAlive(record.pid) !== false) return "live";
+    const start = record.processStart === undefined ? undefined : deps.processStart(record.pid);
+    // A reused PID is not permission to remove another process's record.
+    if (start !== undefined && start !== record.processStart) return "live";
+    return deps.isProcessAlive(record.pid) === false ? "dead" : "live";
+  } catch { return "live"; }
+}
+export function safeNamespace(path: string, kind: "file" | "directory", deps: OwnerDeps, missing = false): boolean {
+  try {
+    const stat = lockFileOperation(() => deps.lstat(path), deps.platform), uid = deps.uid();
+    return !stat.isSymbolicLink() && (kind === "file" ? stat.isFile() : stat.isDirectory())
+      && (deps.platform === "win32" || (uid !== undefined && stat.uid === uid));
+  } catch (error) {
+    if (error instanceof LockFileBusy) throw error;
+    return missing && (error as NodeJS.ErrnoException).code === "ENOENT";
+  }
+}

package/src/codex/prompt-lock.ts

@@ -9,8 +9,9 @@
  * the lock stale, B removes it and acquires its own, then A unlinks *B's live
  * lock* and both proceed. Unlinking a path you did not verify is the bug. Here
  * the contender renames the observed stale lock to a token-quarantined name —
- * an atomic operation exactly one contender can win — and only the winner
- * creates the real lock.
+ * a serialized operation under a short, unique per-process reservation. The
+ * reservation covers observation through creation: rename alone cannot stop
+ * an old observation from moving a successor's live lock.
  *
  * RELEASE ONLY DELETES A LOCK WHOSE TOKEN IS STILL OURS. A mismatch means we
  * were superseded, and deleting it would hand the critical section to two
@@ -20,15 +21,22 @@
  * is handled by the per-target byte checks in the write path, and the rename
  * window itself is documented as irreducible from user space.
  */
-import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { checkEntry, guarded, type Entry } from "./prompt-lock-evidence";
 import { randomBytes } from "node:crypto";
+import { UnsafeLockNamespace, withLockClaim } from "./prompt-lock-claim";
+
+import { ownerDefaults, ownEvidence, ownerState, safeNamespace, type OwnerDeps, type OwnerEvidence } from "./prompt-lock-owner";
+
+import { LockFileBusy, lockFileOperation } from "./prompt-lock-io";
 
 const FILE_MODE = 0o600;
 
 /** A lock younger than this is respected even if its pid looks gone. */
 export const STALE_AFTER_MS = 10_000;
 
-export interface LockRecord {
+export interface LockRecord extends OwnerEvidence {
   token: string;
   pid: number;
   acquiredAt: number;
@@ -41,83 +49,100 @@ export interface LockHandle {
 
 export type AcquireResult =
   | { ok: true; handle: LockHandle }
-  | { ok: false; error: "locked" };
+  | { ok: false; error: "locked" }
+  | { ok: false; error: "unsafe"; detail: string };
 
-export interface LockDeps {
-  /** Injectable so tests can simulate a live or dead owner. */
-  isProcessAlive: (pid: number) => boolean;
+export interface LockDeps extends Partial<OwnerDeps> {
+  isProcessAlive: (pid: number) => boolean | undefined;
   now: () => number;
+  onClaimInitialized?: () => void;
 }
+const defaultDeps: LockDeps = { ...ownerDefaults, now: () => Date.now() };
 
-const defaultDeps: LockDeps = {
-  isProcessAlive: pid => {
-    try {
-      process.kill(pid, 0);
-      return true;
-    } catch (error) {
-      // EPERM means it exists but belongs to another user.
-      return (error as NodeJS.ErrnoException).code === "EPERM";
-    }
-  },
-  now: () => Date.now(),
-};
-
-function readRecord(path: string): LockRecord | null {
+function readRecord(path: string, platform: NodeJS.Platform): LockRecord | null {
   try {
-    const parsed = JSON.parse(readFileSync(path, "utf8")) as LockRecord;
+    const parsed = JSON.parse(lockFileOperation(() => readFileSync(path, "utf8"), platform)) as LockRecord;
     if (typeof parsed?.token !== "string" || typeof parsed?.pid !== "number") return null;
     return parsed;
-  } catch {
+  } catch (error) {
+    if (error instanceof LockFileBusy) throw error;
     return null;
   }
 }
 
-/** True when the holder is gone AND the lock is older than the grace window. */
-function isStale(record: LockRecord | null, deps: LockDeps): boolean {
-  if (record === null) return true; // unparseable: treat as debris
-  if (deps.isProcessAlive(record.pid)) return false;
-  return deps.now() - record.acquiredAt > STALE_AFTER_MS;
-}
-
-/**
- * One attempt. The caller decides whether to retry — a loser must go back to
- * re-reading the lock rather than assuming its quarantine still applies.
- */
+/** One attempt, including namespace validation and serialized stale observation. */
 export function tryAcquire(path: string, deps: LockDeps = defaultDeps): AcquireResult {
+  const resolved = { ...ownerDefaults, ...deps };
   const token = randomBytes(8).toString("hex");
-  const record: LockRecord = { token, pid: process.pid, acquiredAt: deps.now() };
+  try {
+    if (!safeNamespace(path, "file", resolved, true)) throw new UnsafeLockNamespace(path);
+    const reserved = withLockClaim(path, token, resolved,
+      () => acquireReserved(path, token, resolved), deps.onClaimInitialized);
+    return reserved.ok ? reserved.value : { ok: false, error: "locked" };
+  } catch (error) {
+    if (error instanceof LockFileBusy) return { ok: false, error: "locked" };
+    if (error instanceof UnsafeLockNamespace) return { ok: false, error: "unsafe", detail: error.path };
+    throw error;
+  }
+}
+
+function acquireReserved(path: string, token: string, deps: OwnerDeps & LockDeps): AcquireResult {
+  const parentPath = dirname(path);
+  if (!safeNamespace(parentPath, "directory", deps)) throw new UnsafeLockNamespace(parentPath);
+  const parents = [{ path: parentPath, stat: lockFileOperation(() => deps.lstat(parentPath), deps.platform) }];
+  const io = <R>(operation: () => R): R => guarded(parents, [], deps, operation);
+  const record: LockRecord = { token, ...ownEvidence(deps), acquiredAt: deps.now() };
   const body = JSON.stringify(record);
 
   try {
-    writeFileSync(path, body, { encoding: "utf8", mode: FILE_MODE, flag: "wx" });
+    io(() => writeFileSync(path, body, { encoding: "utf8", mode: FILE_MODE, flag: "wx" }));
     return { ok: true, handle: { path, token } };
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code !== "EEXIST") throw error;
   }
 
-  if (!isStale(readRecord(path), deps)) return { ok: false, error: "locked" };
-
-  // Quarantine by rename: atomic, and exactly one contender wins it.
+  const observed = io(() => {
+    const entry: Entry = { path, stat: deps.lstat(path), body: readFileSync(path, "utf8") };
+    checkEntry(entry, deps);
+    return entry;
+  });
+  let previous: LockRecord | null;
+  // Same shape gate as readRecord: a malformed record is evidence, never a takeover target.
+  try {
+    const parsed = JSON.parse(observed.body) as LockRecord;
+    previous = typeof parsed?.token === "string" && typeof parsed?.pid === "number" ? parsed : null;
+  } catch { previous = null; }
+  const state = ownerState(previous, deps);
+  if (state === "unsafe") return { ok: false, error: "unsafe", detail: path };
+  if (state !== "dead" || !previous || !Number.isFinite(previous.acquiredAt)
+    || deps.now() - previous.acquiredAt <= STALE_AFTER_MS) return { ok: false, error: "locked" };
+
+  // The reservation excludes cooperating writers; fence external replacements
+  // and parent retargets again on every sharing-error retry.
   const quarantine = `${path}.stale-${token}`;
   try {
-    renameSync(path, quarantine);
+    guarded(parents, [observed], deps, () => renameSync(path, quarantine));
   } catch {
     // Someone else won the rename, or the owner released between our checks.
     // Either way we do NOT touch the path — retry from the top.
     return { ok: false, error: "locked" };
   }
 
+  const moved = { ...observed, path: quarantine };
+  const cleanup = () => {
+    try { guarded(parents, [moved], deps, () => unlinkSync(quarantine)); } catch { /* Preserve changed or busy debris. */ }
+  };
   try {
-    writeFileSync(path, body, { encoding: "utf8", mode: FILE_MODE, flag: "wx" });
+    io(() => writeFileSync(path, body, { encoding: "utf8", mode: FILE_MODE, flag: "wx" }));
   } catch (error) {
     // A successor acquired the real lock between our rename and this create.
     // Its lock is live and is not ours to remove.
-    try { unlinkSync(quarantine); } catch { /* debris */ }
+    cleanup();
     if ((error as NodeJS.ErrnoException).code === "EEXIST") return { ok: false, error: "locked" };
     throw error;
   }
 
-  try { unlinkSync(quarantine); } catch { /* debris */ }
+  cleanup();
   return { ok: true, handle: { path, token } };
 }
 
@@ -126,18 +151,24 @@ export function tryAcquire(path: string, deps: LockDeps = defaultDeps): AcquireR
  * when we were superseded, which the caller surfaces as `write_superseded`.
  */
 export function release(handle: LockHandle): boolean {
-  const record = readRecord(handle.path);
-  if (record === null || record.token !== handle.token) return false;
   try {
-    unlinkSync(handle.path);
-    return true;
-  } catch {
-    return false;
-  }
+    const deps = ownerDefaults;
+    if (!safeNamespace(handle.path, "file", deps) || !safeNamespace(dirname(handle.path), "directory", deps)) return false;
+    const parents = [{ path: dirname(handle.path), stat: lockFileOperation(() => deps.lstat(dirname(handle.path)), deps.platform) }];
+    const entry = guarded(parents, [], deps, () => {
+      const saved = { path: handle.path, stat: deps.lstat(handle.path), body: readFileSync(handle.path, "utf8") };
+      checkEntry(saved, deps);
+      return saved;
+    });
+    if (JSON.parse(entry.body)?.token !== handle.token) return false;
+    return guarded(parents, [entry], deps, () => { unlinkSync(handle.path); return true; });
+  } catch { return false; }
 }
 
 /** True when the on-disk lock is still the one this handle acquired. */
 export function stillHeld(handle: LockHandle): boolean {
-  if (!existsSync(handle.path)) return false;
-  return readRecord(handle.path)?.token === handle.token;
+  try {
+    return safeNamespace(handle.path, "file", ownerDefaults)
+      && readRecord(handle.path, ownerDefaults.platform)?.token === handle.token;
+  } catch { return false; }
 }

package/src/codex/routing/failure-window.ts

@@ -0,0 +1,146 @@
+import { pinnedCodexAccountId } from "../account-priority";
+import type { OcxConfig } from "../../types";
+import {
+  deleteAccountHealth,
+  setAccountHealth,
+  type CodexUpstreamHealth,
+} from "./health-store";
+
+/** Sliding window for transient upstream faults. Distinct from the 5-minute consecutive-streak gap. */
+export const CODEX_SLIDING_FAILURE_WINDOW_MS = 60_000;
+export const CODEX_SLIDING_FAILURE_MIN_SAMPLES = 20;
+export const CODEX_SLIDING_FAILURE_DEGRADE_RATIO = 0.25;
+export const CODEX_SLIDING_FAILURE_RECOVER_RATIO = 0.1;
+export const CODEX_SLIDING_FAILURE_RECOVER_SUSTAIN_MS = 30_000;
+const MAX_SAMPLES = 512;
+
+type Sample = { at: number; failed: boolean };
+type WindowState = { samples: Sample[]; degraded: boolean; healthySince?: number };
+
+const windows = new Map<string, WindowState>();
+const pinnedDegradeWarned = new Set<string>();
+
+export function codexFailureWindowEnabled(config: OcxConfig): boolean {
+  return config.codexFailureWindow !== false;
+}
+
+function stateFor(accountId: string): WindowState {
+  let state = windows.get(accountId);
+  if (!state) {
+    state = { samples: [], degraded: false };
+    windows.set(accountId, state);
+  }
+  return state;
+}
+
+function recompute(state: WindowState, now: number): void {
+  const cutoff = now - CODEX_SLIDING_FAILURE_WINDOW_MS;
+  if (state.samples.length > 0 && state.samples[0]!.at <= cutoff) {
+    state.samples = state.samples.filter(sample => sample.at > cutoff);
+  }
+  const samples = state.samples.length;
+  const failed = state.samples.reduce((count, sample) => count + (sample.failed ? 1 : 0), 0);
+  const degraded = samples >= CODEX_SLIDING_FAILURE_MIN_SAMPLES
+    && failed * 4 >= samples;
+  const recovering = state.degraded
+    && samples >= CODEX_SLIDING_FAILURE_MIN_SAMPLES
+    && failed * 10 <= samples;
+  if (degraded) {
+    state.degraded = true;
+    state.healthySince = undefined;
+    return;
+  }
+  if (!state.degraded) {
+    state.healthySince = undefined;
+    return;
+  }
+  if (!recovering) {
+    state.healthySince = undefined;
+    return;
+  }
+  state.healthySince ??= now;
+  if (now - state.healthySince >= CODEX_SLIDING_FAILURE_RECOVER_SUSTAIN_MS) {
+    state.degraded = false;
+    state.healthySince = undefined;
+  }
+}
+
+/** Record one terminal success or transient fault. Quota and caller errors are not samples. */
+export function noteCodexFailureWindowSample(
+  config: OcxConfig,
+  accountId: string,
+  failed: boolean,
+  now: number,
+): void {
+  if (!codexFailureWindowEnabled(config)) return;
+  const state = stateFor(accountId);
+  state.samples.push({ at: now, failed });
+  if (state.samples.length > MAX_SAMPLES) state.samples.splice(0, state.samples.length - MAX_SAMPLES);
+  recompute(state, now);
+  if (!state.degraded) pinnedDegradeWarned.delete(accountId);
+}
+
+export function isCodexFailureWindowDegraded(accountId: string, now = Date.now()): boolean {
+  const state = windows.get(accountId);
+  if (!state) return false;
+  recompute(state, now);
+  if (!state.degraded) pinnedDegradeWarned.delete(accountId);
+  return state.degraded;
+}
+
+/**
+ * Unbound placement may leave a degraded account. A manual pin stays unless the operator
+ * opts into detouring new threads. Bound threads never consult this predicate.
+ */
+export function failureWindowSteersNewThreads(
+  config: OcxConfig,
+  accountId: string,
+  now: number,
+): boolean {
+  if (!codexFailureWindowEnabled(config)) return false;
+  if (!isCodexFailureWindowDegraded(accountId, now)) return false;
+  if (pinnedCodexAccountId(config) !== accountId) return true;
+  if (config.codexPinnedTransientPolicy === "detour-new-threads") return true;
+  if (!pinnedDegradeWarned.has(accountId)) {
+    pinnedDegradeWarned.add(accountId);
+    console.warn("[opencodex] pinned Codex account is degraded; new threads stay on it until it recovers");
+  }
+  return false;
+}
+
+export function forgetCodexFailureWindow(accountId: string): void {
+  windows.delete(accountId);
+  pinnedDegradeWarned.delete(accountId);
+}
+
+export function forgetCodexFailureWindows(): void {
+  windows.clear();
+  pinnedDegradeWarned.clear();
+}
+
+/** Consecutive-success bookkeeping for a healthy terminal, moved out of the routing module. */
+export function settleCodexSuccessStreak(
+  config: OcxConfig,
+  accountId: string,
+  current: CodexUpstreamHealth | undefined,
+  base: CodexUpstreamHealth | undefined,
+  preserved: Partial<CodexUpstreamHealth>,
+  cooldownUntil: number | null,
+): void {
+  const failoverEnabled = (config.upstreamFailoverThreshold ?? 3) > 0;
+  if (failoverEnabled && current && current.consecutiveFailures >= 2) {
+    const consecutiveSuccesses = (current.consecutiveSuccesses ?? 0) + 1;
+    if (consecutiveSuccesses < 2) {
+      setAccountHealth(accountId, {
+        ...base!,
+        ...preserved,
+        consecutiveSuccesses,
+      });
+      return;
+    }
+  }
+  // Level 1 clears immediately; escalated accounts need two consecutive healthy terminals.
+  // Hard quota cooldown intentionally survives either recovery path.
+  if (cooldownUntil) setAccountHealth(accountId, { consecutiveFailures: 0, ...preserved });
+  else deleteAccountHealth(accountId);
+}