merge(dev): sync base for isolate hang fixes and Windows runner select

Pick up kill-grace keep-ref and OAuth queue CI fixes from tip; keep this
PR's 30m Windows test ceiling and job-scoped timeout asserts with the new
select-windows-runner job.

Author: Wibias

.github/workflows/ci.yml

@@ -45,9 +45,62 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Which Windows runner this run is allowed to use.
+  #
+  # The self-hosted Windows box is a maintainer's PERSONAL machine on a home
+  # network, reachable over Tailscale. Anything that runs on it runs as a local
+  # user with that user's filesystem and LAN in reach, so the only question that
+  # matters is whether the commit is trusted BEFORE a runner ever sees it.
+  #
+  # `push` on dev/main/preview is trusted: reaching those branches requires the
+  # push permission, which only the maintainers in MAINTAINERS.md hold.
+  # `pull_request` is NOT trusted, and no author check can make it so — the
+  # workflow file itself comes from the PR head, so any `if:` guard written here
+  # is deleted by the same patch it is meant to stop. Fork PRs therefore stay on
+  # GitHub-hosted runners, unconditionally.
+  #
+  # `workflow_dispatch` is the maintainer escape hatch: dispatch requires write
+  # access, so a maintainer can deliberately aim a branch at the home box.
+  select-windows-runner:
+    name: select windows runner
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    outputs:
+      runner: ${{ steps.pick.outputs.runner }}
+      label: ${{ steps.pick.outputs.label }}
+    steps:
+      - name: Pick runner
+        id: pick
+        env:
+          # Read through env rather than interpolating directly into the script:
+          # `github.event_name` is a fixed vocabulary, but keeping the habit means
+          # no future edit here can grow a script-injection sink.
+          EVENT_NAME: ${{ github.event_name }}
+          USE_SELF_HOSTED: ${{ vars.OCX_SELF_HOSTED_WINDOWS }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          trusted=no
+          case "$EVENT_NAME" in
+            push|workflow_dispatch) trusted=yes ;;
+          esac
+
+          # Repository variable OCX_SELF_HOSTED_WINDOWS acts as a kill switch. When
+          # it is anything other than `1` — including unset, which is the state
+          # before the runner exists — every job falls back to windows-latest and
+          # CI keeps working with the box powered off.
+          if [ "$trusted" = "yes" ] && [ "${USE_SELF_HOSTED:-}" = "1" ]; then
+            echo 'runner=["self-hosted","Windows","X64","ocx-home"]' >> "$GITHUB_OUTPUT"
+            echo 'label=self-hosted (ocx-home)' >> "$GITHUB_OUTPUT"
+          else
+            echo 'runner="windows-latest"' >> "$GITHUB_OUTPUT"
+            echo 'label=windows-latest' >> "$GITHUB_OUTPUT"
+          fi
+
   test:
-    name: ${{ matrix.os }}
-    runs-on: ${{ matrix.os }}
+    name: ${{ matrix.name }}
+    needs: select-windows-runner
+    runs-on: ${{ matrix.runner }}
     # Windows dominates this matrix: on run 30459554635 the same suite took
     # ubuntu 4.6min / macos 5.6min / windows 11.8min. Against the previous
     # 12-minute ceiling that left ~12s of headroom, so runner variance decided
@@ -64,8 +117,34 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        # `name` is spelled out rather than derived from `runner`: a runner given
+        # as a label array renders as "self-hosted Windows X64 ocx-home", so the
+        # check name would change with the routing and break any branch
+        # protection rule that names it. Keeping `windows` fixed means the
+        # required check stays the same whichever machine served it.
+        include:
+          - name: ubuntu
+            runner: ubuntu-latest
+          - name: windows
+            runner: ${{ fromJSON(needs.select-windows-runner.outputs.runner) }}
+          - name: macos
+            runner: macos-latest
     steps:
+      - name: Show selected runner
+        if: matrix.name == 'windows'
+        shell: bash
+        run: echo "windows leg on ${{ needs.select-windows-runner.outputs.label }}"
+
+      # A self-hosted runner keeps its working directory between jobs. Without an
+      # explicit wipe, a file deleted in the commit under test survives on disk
+      # and the suite passes against a tree that no longer exists in git.
+      # `--ephemeral` registration de-registers the runner after each job but does
+      # not clean the workspace, so this step is what makes the checkout honest.
+      - name: Clean workspace (self-hosted only)
+        if: runner.environment == 'self-hosted'
+        shell: bash
+        run: git clean -xffd . || true
+
       - name: Checkout
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
 
@@ -115,6 +194,10 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        # Deliberately NOT routed to the self-hosted box. This job runs
+        # `npm install -g`, which writes into the machine's global prefix and
+        # would leave an `ocx` on a maintainer's personal PATH. It is an
+        # 8-minute job, so there is nothing to win by moving it.
         os: [ubuntu-latest, windows-latest, macos-latest]
     steps:
       - name: Checkout

src/adapters/cursor/native-exec-shell.ts

@@ -340,7 +340,12 @@ function waitForBackgroundShellClose(entry: BackgroundShellEntry): Promise<boole
       settled = true;
       resolveWait(false);
     }, CURSOR_BACKGROUND_SHELL_TERM_GRACE_MS);
-    unrefTimer(timer);
+    // Deliberately REF'D: this is the bounded kill-grace wait that shutdown
+    // drain awaits. Bun on Windows can starve unref'd timers when a pending
+    // promise is the only other work, which would leave drainAndShutdown
+    // waiting on this resolution forever. The timer self-clears within the
+    // 2-second grace window (or earlier on close), so a ref cannot keep the
+    // process alive beyond that bound.
     void entry.closePromise.then(() => {
       if (settled) return;
       settled = true;

src/config.ts

@@ -18,6 +18,7 @@ import {
   hardenSecretDir,
   hardenSecretPath,
   hardenSecretPathAsync,
+  windowsSecretAclApplies,
 } from "./lib/windows-secret-acl";
 import { recordOwnedConfigPath } from "./lib/config-ownership";
 import { assertNotRealHomeUnderTest } from "./lib/test-home-guard";
@@ -1506,6 +1507,7 @@ export function readConfigDiagnostics(): ConfigDiagnostics {
 
 const CONFIG_MUTATION_DB_FILENAME = "config-mutation.sqlite";
 const CONFIG_MUTATION_DB_SIDECARS = ["-journal", "-wal", "-shm"] as const;
+let warnedConfigMutationDirectoryAcl = false;
 
 export class ConfigMutationLockError extends Error {
   readonly code = "CONFIG_MUTATION_LOCK_UNAVAILABLE";
@@ -1526,8 +1528,18 @@ function configMutationDatabasePath(): string {
   } else {
     try { chmodSync(dir, 0o700); } catch { /* best-effort on existing dir */ }
   }
-  if (process.platform === "win32") {
-    hardenSecretDir(dir, { required: true });
+  if (windowsSecretAclApplies()) {
+    try {
+      hardenSecretDir(dir, { required: true });
+    } catch (error) {
+      if (!warnedConfigMutationDirectoryAcl) {
+        warnedConfigMutationDirectoryAcl = true;
+        const diagnostics = error instanceof Error ? error.message : "ACL hardening failed";
+        console.warn(
+          `[opencodex] Config mutation coordination directory ACL hardening did not complete; continuing without it. ${diagnostics}`,
+        );
+      }
+    }
   }
   const path = join(dir, CONFIG_MUTATION_DB_FILENAME);
   recordOwnedConfigPath(dir, path);

src/lib/windows-secret-acl.ts

@@ -182,6 +182,11 @@ function effectivePlatform(): string {
   return platformOverride ?? platform;
 }
 
+/** Test-aware platform predicate for callers that must avoid even a no-op ACL call. */
+export function windowsSecretAclApplies(): boolean {
+  return (platformOverride ?? process.platform) === "win32";
+}
+
 /** Error carrying an honest code: ETIMEDOUT only for real timeouts, EICACLS otherwise. */
 function icaclsError(step: string, result: IcaclsResult): NodeJS.ErrnoException {
   const err = new Error(

src/responses/spill-store.ts

@@ -82,11 +82,13 @@ function record(event: "write" | "fsync" | "close" | "harden" | "publish" | "dir
 
 function fsyncDirectoryBestEffort(dir: string): void {
   let fd: number | null = null;
+  // Record the durability attempt before opening the directory: Windows cannot
+  // open/fsync directory handles this way, but callers still cross this seam.
+  record("dir-fsync");
   try {
     fd = openSync(dir, "r");
     if (spillIoForTest?.fsync) spillIoForTest.fsync(fd);
     else fsyncSync(fd);
-    record("dir-fsync");
   } catch {
     // Windows and some filesystems do not support fsync on directory handles.
   } finally {

tests/ci-workflows.test.ts

@@ -34,14 +34,15 @@ describe("GitHub Actions hardening", () => {
       jobs?: Record<string, { "timeout-minutes"?: number } | undefined>;
     };
 
-    // Job-scoped: a global count of "30" and "8" still passes if the values are
-    // swapped between `test` and `npm-global-smoke`. Pin ownership explicitly.
-    // Do not raise `test` again — hung tests (e.g. unref'd oauth waitMs) must
-    // be fixed, not absorbed by a larger ceiling.
+    // Job-scoped: a global count still passes if values are swapped between jobs.
+    // Pin ownership explicitly. `test` is 30m for Windows isolate margin on #827
+    // after state-store admission — do not raise again; fix hung tests instead
+    // (unref'd oauth waitMs / shell kill-grace). Selector stays at 2; smoke at 8.
+    expect(ci.jobs?.["select-windows-runner"]?.["timeout-minutes"]).toBe(2);
     expect(ci.jobs?.test?.["timeout-minutes"]).toBe(30);
     expect(ci.jobs?.["npm-global-smoke"]?.["timeout-minutes"]).toBe(8);
-    // Both jobs must stay bounded — an unbounded job can hang a queue for hours.
-    expect(count(workflow, "timeout-minutes:")).toBe(2);
+    // Every job must stay bounded — an unbounded job can hang a queue for hours.
+    expect(count(workflow, "timeout-minutes:")).toBe(3);
     expect(workflow).toContain("actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0");
     expect(workflow).toContain("oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6");
     expect(workflow).toContain("actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e");

tests/config.test.ts

@@ -1619,15 +1619,16 @@ describe("config.ts – Windows ACL hardening integration", () => {
     }
   });
 
-  test("saveConfig throws when hardenSecretDir fails in required mode on win32", () => {
+  test("saveConfig degrades when config-mutation directory hardening fails on win32", () => {
     const origPlatform = process.platform;
     Object.defineProperty(process, "platform", { value: "win32", configurable: true });
     try {
       const spy = spyOn(windowsAcl, "hardenSecretDir").mockImplementation((_path, opts) => {
         if (opts?.required) throw new Error("ACL hardening failed: access denied");
         return { ok: true };
       });
-      expect(() => saveConfig(getDefaultConfig())).toThrow(/ACL/i);
+      expect(() => saveConfig(getDefaultConfig())).not.toThrow();
+      expect(existsSync(getConfigPath())).toBe(true);
       spy.mockRestore();
     } finally {
       Object.defineProperty(process, "platform", { value: origPlatform, configurable: true });

tests/shutdown-drain.test.ts

@@ -119,9 +119,13 @@ describe("background shell shutdown drain", () => {
     const unresolvedChild = installShutdownShell();
     setBackgroundShellRuntimeForTests({
       setTimer(callback) {
-        const timer = setTimeout(callback, 0);
-        timer.unref?.();
-        return timer;
+        // Keep this fixture timer REF'D: Bun on Windows can stop servicing
+        // unref'd timers while the test's only pending work is a promise,
+        // which left drainAndShutdown waiting forever and hung the isolate
+        // process until the 20-minute CI job timeout (same starvation the
+        // OAuth queue tests hit). A ref'd 0ms timer fires immediately and
+        // cannot keep the process alive.
+        return setTimeout(callback, 0);
       },
     });
     const unresolvedServer = fakeServer();