merge(dev): sync tip Windows budgets and management-auth fixtures

Author: Wibias

.github/workflows/ci.yml

@@ -47,20 +47,31 @@ concurrency:
 jobs:
   # Which Windows runner this run is allowed to use.
   #
-  # The self-hosted Windows box is a maintainer's PERSONAL machine on a home
-  # network, reachable over Tailscale. Anything that runs on it runs as a local
-  # user with that user's filesystem and LAN in reach, so the only question that
-  # matters is whether the commit is trusted BEFORE a runner ever sees it.
+  # READ THIS BEFORE TREATING IT AS A SECURITY BOUNDARY: it is not one.
   #
-  # `push` on dev/main/preview is trusted: reaching those branches requires the
-  # push permission, which only the maintainers in MAINTAINERS.md hold.
-  # `pull_request` is NOT trusted, and no author check can make it so — the
-  # workflow file itself comes from the PR head, so any `if:` guard written here
-  # is deleted by the same patch it is meant to stop. Fork PRs therefore stay on
-  # GitHub-hosted runners, unconditionally.
+  # On `pull_request` this workflow is loaded from the PR head, so the `case`
+  # below is owned by the proposed patch exactly like an `if:` guard would be.
+  # A hostile PR can delete the branch and hardcode the self-hosted labels into
+  # `$GITHUB_OUTPUT`, and `runs-on` will honour it. That this job runs on
+  # `ubuntu-latest` changes nothing — the untrusted part is its OUTPUT, not its
+  # host. `.github/workflows/ci.yml` is in this workflow's `pull_request.paths`,
+  # so such an edit triggers its own run.
   #
-  # `workflow_dispatch` is the maintainer escape hatch: dispatch requires write
-  # access, so a maintainer can deliberately aim a branch at the home box.
+  # What actually keeps untrusted code off a self-hosted runner lives OUTSIDE
+  # this file, where a PR cannot reach it: the fork-PR approval policy
+  # (`all_external_contributors`) and the judgement of whoever clicks approve.
+  # Runner groups would be the other lever, but they are an organisation
+  # feature and this repository is user-owned, so the approval policy is the
+  # only one available here. GitHub's own guidance is to avoid self-hosted
+  # runners on public repositories for this reason.
+  #
+  # So read the routing below as a COST control that keeps honest pull requests
+  # on GitHub-hosted runners, not as a guarantee about hostile ones.
+  #
+  # `push` on dev/main/preview requires the push permission, and
+  # `workflow_dispatch` requires write access, so both carry a trusted author.
+  # A trusted author is not audited code: merging a contributor PR into `dev`
+  # fires `push`, and its dependencies and postinstall hooks then run here.
   select-windows-runner:
     name: select windows runner
     runs-on: ubuntu-latest
@@ -85,10 +96,12 @@ jobs:
             push|workflow_dispatch) trusted=yes ;;
           esac
 
-          # Repository variable OCX_SELF_HOSTED_WINDOWS acts as a kill switch. When
-          # it is anything other than `1` — including unset, which is the state
-          # before the runner exists — every job falls back to windows-latest and
-          # CI keeps working with the box powered off.
+          # Repository variable OCX_SELF_HOSTED_WINDOWS is an OPERATIONAL switch,
+          # not a security control: a PR that rewrites this script ignores it for
+          # the same reason it ignores the event check above. Its job is to keep CI
+          # working when the box is off or busy. Anything other than `1` —
+          # including unset, the state before a runner exists — falls back to
+          # windows-latest.
           if [ "$trusted" = "yes" ] && [ "${USE_SELF_HOSTED:-}" = "1" ]; then
             echo 'runner=["self-hosted","Windows","X64","ocx-home"]' >> "$GITHUB_OUTPUT"
             echo 'label=self-hosted (ocx-home)' >> "$GITHUB_OUTPUT"

tests/server-management-auth.test.ts

@@ -1,4 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { SERVER_BUDGET_MS } from "./helpers/test-budget";
 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -446,7 +447,7 @@ describe("management and data-plane credential separation", () => {
     } finally {
       await server.stop(true);
     }
-  });
+  }, SERVER_BUDGET_MS); // binds a real server + live fetches; windows runner measured ~5.04s against Bun's 5s default.
 
   test("an existing management token ACL hardening failure keeps management unavailable", async () => {
     delete process.env.OPENCODEX_ADMIN_AUTH_TOKEN;
@@ -482,14 +483,7 @@ describe("management and data-plane credential separation", () => {
     setPlatformForTests("win32");
     setIcaclsRunnerForTests(args => {
       const target = args[0] ?? "";
-      if (target.endsWith("admin-api-token")) {
-        return { success: true, exitCode: 0, timedOut: false, stdout: "" };
-      }
-      // Directory ACE carries (OI)(CI). Timeout only directories so management auth
-      // fails closed while secret file hardens (config.json.tmp) can still
-      // succeed — startServer must persist config on real Windows.
-      const grant = args.find(arg => typeof arg === "string" && arg.includes("(F)")) ?? "";
-      if (grant.includes("(OI)(CI)")) {
+      if (target === testHome) {
         return { success: false, exitCode: null, timedOut: true, stdout: "" };
       }
       return { success: true, exitCode: 0, timedOut: false, stdout: "" };
@@ -556,11 +550,9 @@ describe("management and data-plane credential separation", () => {
     saveConfig(remoteConfig());
     process.env.USERNAME ??= "tester";
     setPlatformForTests("win32");
-    // Stall directory ACL only. Env admin bypasses the file-backed token path;
-    // secret file hardens for config persistence must still succeed on win32.
     setIcaclsRunnerForTests(args => {
-      const grant = args.find(arg => typeof arg === "string" && arg.includes("(F)")) ?? "";
-      if (grant.includes("(OI)(CI)")) {
+      const target = args[0] ?? "";
+      if (target === testHome || target.endsWith("admin-api-token")) {
         return { success: false, exitCode: null, timedOut: true, stdout: "" };
       }
       return { success: true, exitCode: 0, timedOut: false, stdout: "" };

tests/translator-budget.test.ts

@@ -10,6 +10,7 @@ import {
   translatorObservedBufferSnapshot,
 } from "../src/lib/translator-budget";
 import type { AdapterEvent } from "../src/types";
+import { SPAWN_BUDGET_MS } from "./helpers/test-budget";
 
 async function textWithin(stream: ReadableStream<Uint8Array>, timeoutMs = 2_000): Promise<string> {
   return await Promise.race([
@@ -253,5 +254,4 @@ test("production adapter contract rejects omitted translator budgets at typechec
   expect(invalid.stdout.toString() + invalid.stderr.toString()).toContain("TS2554");
   const valid = Bun.spawnSync(["bun", ...base, "tests/fixtures/translator-budget-required.valid.ts"]);
   expect(valid.exitCode).toBe(0);
-  // Two bun x tsc --noEmit spawns exceed Bun's 5s default under windows-latest contention.
-}, 60_000);
+}, SPAWN_BUDGET_MS); // two real tsc child processes ARE the assertion; windows runner measured ~5.5s against Bun's 5s default.

tests/usage-log.test.ts

@@ -84,7 +84,7 @@ describe("usage log", () => {
     const snapshot = await readUsageSnapshotForManagement();
     expect(snapshot.truncatedPrefixBytes).toBeGreaterThan(0);
     expect(snapshot.entries.map(entry => entry.requestId)).toEqual(["tail"]);
-  });
+  }, STORE_BUDGET_MS); // sparse >64 MiB fixture IO is intrinsic; Windows self-hosted measured 7.193s against Bun's 5s default.
 
   test("usage tail exact row boundary keeps the complete newest row", async () => {
     const newest = Buffer.from(`${persistedLine("newest")}\n`);