Merge pull request #102 from Wibias/codex/retry-windows-atomic-rename

fix: retry transient Windows atomic renames

Author: lidge-jun

src/config.ts

@@ -8,14 +8,44 @@ import { providerDestinationConfigError } from "./lib/destination-policy";
 import type { OcxConfig } from "./types";
 
 let _atomicSeq = 0;
+
+interface AtomicRenameIO {
+  platform: NodeJS.Platform;
+  rename: (source: string, destination: string) => void;
+  sleep: (milliseconds: number) => void;
+}
+
+export function renameAtomicFile(
+  source: string,
+  destination: string,
+  io: AtomicRenameIO = {
+    platform: process.platform,
+    rename: renameSync,
+    sleep: Bun.sleepSync,
+  },
+): void {
+  for (let attempt = 0; ; attempt += 1) {
+    try {
+      io.rename(source, destination);
+      return;
+    } catch (error) {
+      const code = (error as NodeJS.ErrnoException).code;
+      const transientWindowsError = io.platform === "win32"
+        && (code === "EBUSY" || code === "EPERM" || code === "EACCES");
+      if (!transientWindowsError || attempt >= 2) throw error;
+      io.sleep(25 * (attempt + 1));
+    }
+  }
+}
+
 /**
  * Write a file atomically (temp + rename) so concurrent writers — e.g. `ocx stop` and the
  * proxy's own shutdown handler both restoring Codex — can never leave a half-written file.
  */
 export function atomicWriteFile(path: string, content: string): void {
   const tmp = `${path}.ocx.${process.pid}.${++_atomicSeq}.tmp`;
   writeFileSync(tmp, content, { encoding: "utf-8", mode: 0o600 });
-  renameSync(tmp, path);
+  renameAtomicFile(tmp, path);
 }
 
 /**

tests/config.test.ts

@@ -21,7 +21,7 @@ import {
 } from "../src/config";
 
 import * as windowsAcl from "../src/lib/windows-secret-acl";
-import { hardenConfigDir, hardenExistingSecret, saveConfig } from "../src/config";
+import { hardenConfigDir, hardenExistingSecret, renameAtomicFile, saveConfig } from "../src/config";
 let testDir = "";
 
 beforeEach(() => {
@@ -48,6 +48,34 @@ function writeConfig(content: unknown): void {
 }
 
 describe("opencodex config defaults", () => {
+  test("atomic rename retries transient Windows sharing violations", () => {
+    const sleeps: number[] = [];
+    let attempts = 0;
+    renameAtomicFile("source.tmp", "config.json", {
+      platform: "win32",
+      rename: () => {
+        attempts += 1;
+        if (attempts < 3) throw Object.assign(new Error("locked"), { code: "EPERM" });
+      },
+      sleep: ms => sleeps.push(ms),
+    });
+
+    expect(attempts).toBe(3);
+    expect(sleeps).toEqual([25, 50]);
+  });
+
+  test("atomic rename does not retry non-transient errors", () => {
+    let attempts = 0;
+    expect(() => renameAtomicFile("source.tmp", "config.json", {
+      platform: "win32",
+      rename: () => {
+        attempts += 1;
+        throw Object.assign(new Error("invalid"), { code: "EINVAL" });
+      },
+      sleep: () => {},
+    })).toThrow("invalid");
+    expect(attempts).toBe(1);
+  });
   test("Codex autostart is enabled by default", () => {
     expect(getDefaultConfig().codexAutoStart).toBe(true);
     expect(codexAutoStartEnabled({})).toBe(true);