[lidge-jun]

Summary

• Fix the Remote Workspace macOS bundle-alias fixture introduced by fix(codex): validate macOS app trust at execution boundaries #7758 (c0014da53): copy Bun into the fake ChatGPT.app instead of hardlinking the installed executable. The bundle copy has its own filesystem identity, so the expected canonical path no longer depends on which hardlink name macOS/Bun resolves.
• Preserve the real symlink, real filesystem canonicalization, fake app-server handshake, single-spawn assertion, exact canonical-path equality, and rejection of the alias as argv[0]. No production code, trust policy, or assertions change; no new test file needs layout registration.
• Original evidence: dev run 40679924613, macos 1/3, head 508349e5166bc2ed3e8da63f855ceb8bbefea9e6, failed at the old test line 280: expected /Users/runner/.bun/bin/bun, received the fake bundle's Contents/Resources/codex-cli/bin/codex path. The old line 247 hardlinked those two names; line 248 saved one resolution before the later alias resolution. This is a fixture pathname-oracle artifact, not evidence that an unchecked alias was executed.
• Production trace at this PR's base: src/codex/exec-boundary.ts:125-132 canonicalizes the binary and enforces bundle containment; :173-178 passes target.binary into async bundle trust validation and returns that same value as the executable only after acceptance. src/remote-control/workspace-codex-runtime.ts:391-408 awaits the gate, assigns its result to command[0] on macOS, and spawns the resulting invocation. src/lib/win-exec.ts:85 preserves that command on Unix. Thus the observed bundle path is consistent with the checked target. The fixture's trust callback is a stub; this test proves canonical-path propagation and alias replacement, not native code-signing acceptance.

Verification

• Started with bun install --frozen-lockfile in the worktree: exit 0, 106 packages installed, including zod 4.6.6. GUI dependencies are unnecessary for the requested files and root typecheck.
• Fetched origin/dev and created this branch directly from 508349e5166bc2ed3e8da63f855ceb8bbefea9e6, excluding the pre-existing branch's unrelated CI commit.
• Windows host, Bun 1.4.4; test commands ran sequentially with OCX_TEST_NO_QUEUE=1:
  • bun test tests/clients/remote-workspace-codex-runtime.test.ts: exit 0; 7 pass, 1 skip, 0 fail, 35 assertions. Only a macOS bundle alias is replaced by the canonical checked binary skips on Windows under its existing platform guard.
  • bun test tests/ci-workflows/file-size-ratchet.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts: exit 0; 38 pass, 0 fail, 664 assertions, including the repository file-size scan and independent layout membership oracle.
• bun run typecheck: exit 0; no type errors in 2,227 files.
• bun run privacy:scan: exit 0; privacy scan passed.
• git diff --check: exit 0.
• Full-suite local validation is disproportionate for this fixture-only change; the requested runtime file and both layout guards plus the ratchet were run explicitly. The changed case requires a Unix filesystem and remains unverified locally, so this PR opens in draft pending native macOS validation. Windows success is not a macOS red-to-green claim.
• NOT RUN: native macOS execution/red-to-green, full suite, test:changed, GUI checks, and new manual cross-platform CI. Existing CI was only read; no CI was rerun or dispatched, and nothing was merged. Other failures in the dev batch are outside this PR's scope.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. No user-facing behavior changes; fixture rationale is documented inline and here.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. Source tracing confirms the checked-target propagation above; production trust logic is unchanged, and privacy scan passes. Native signing acceptance is not claimed.

Summary by CodeRabbit

• Tests
  • Updated the macOS bundle-alias test to use a distinct copy of the executable, making the test setup more consistent when checking binary canonicalization. This change affects test behavior only; no user-facing functionality or application behavior has changed.

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: lidge-jun/opencodex
• Branch: fix/remote-workspace-macos-binary-copy
• File: .coderabbit.yaml
• Commit: e8e4613
• Layers: Repository YAML
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d956132d-6172-42bf-8f81-fbebb7aea0b7

Commits

Reviewing files that changed from the base of the PR and between 508349e and e8e4613.

Files selected for processing: 1

• tests/clients/remote-workspace-codex-runtime.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 6 remain after this review.

Walkthrough

The macOS bundle-alias test now copies the current executable to create the bundle binary. Its comments describe the copied file as having a distinct identity for canonicalization.

Changes: Bundle-alias test

Layer / File(s)	Summary
Create a distinct bundle binary tests/clients/remote-workspace-codex-runtime.test.ts	The test copies the current executable instead of creating a hard link and falling back to a copy. The comments describe the copied binary’s distinct identity for canonicalization.

Priority: Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: luvs01

Merge Risk: Minimal · up to e8e46

This test-only change introduces no established merge-blocking risk. Native macOS execution may still be useful follow-up validation.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: copying the macOS bundle binary in the remote workspace test fixture.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files.

Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T12:14:29.019039Z	e8e4613	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.