fix(codex): retry the native-main ACL timeout once, fail closed otherwise

[lidge-jun]

Summary

Separates "the Windows ACL call timed out" from "the ACL was refused" on the native-main owner path, and retries once for the former.

Previously a transient ACL stall was indistinguishable from a permanent denial, so a slow call could permanently fence the native-main owner. src/lib/windows-secret-acl.ts now returns a coded error taxonomy, src/codex/native-main-owner.ts retries exactly once on the timeout class, and src/codex/native-main-lock-file.ts propagates the coded failure.

The fail-closed property is preserved. A refused ACL still denies — the retry applies only to the timeout class. That distinction is load-bearing because this path guards a physical credential: a retry that swallowed a denial would be a security regression, and the tests pin that it does not.

Attribution

This is @luvs01's work from #1130, cherry-picked with their authorship intact. #1130 stays open for them. The coded-error approach is the right shape for this — it makes the recoverable case explicit rather than widening the catch.

Stack 3 of the 260806 attribution campaign, stacked on #1134. Planning unit: devlog/_plan/260806_stacked_bug_campaign/.

Verification

• bun test tests/windows-secret-acl.test.ts tests/native-main-owner-lifetime.test.ts — 166 pass, 0 fail
• bun run typecheck — exit 0
• bun run privacy:scan — passed
• Full bun run test via the repository prepush gate — passed

Platform limitation stated honestly: verification ran on macOS, so the Windows ACL boundary is exercised through injection rather than natively. The tests cover the permanent-error, timeout, and retry-exhaustion classes; they do not prove real Windows ACL behavior. A Windows CI leg is the check that would.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• ^dev$
• ^preview$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 0bb57730-2269-48a5-848b-63b02d9bd56b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.