Harden fixture publication to prevent symlink clobbering

[luvs01]

Motivation

• Tests were publishing marker files via a predictable temporary pathname and non-exclusive writeFileSync, which allowed a same-UID attacker to pre-position a symlink and have the test overwrite an arbitrary target.
• The goal is to preserve the atomic reader-visible rename contract while preventing symlink-following writes to the temporary file.
• Add a focused regression that demonstrates and guards against the symlink pre-positioning attack.

Description

• Add tests/helpers/fixture-file-publisher.ts providing publishFixtureFile(path, content) that creates the temp file with openSync(..., "wx", 0o600), verifies descriptor vs directory-entry identity via fstatSync/lstatSync, writes through the verified descriptor, closes it, and then renameSyncs into place.
• Replace the previous non-exclusive temp-write in tests/helpers/native-profile-startup-child.ts with an import and uses of publishFixtureFile for both the port and settled marker publications.
• Add a regression test tests/codex-integration/native-profile-startup-publication.test.ts that pre-creates a PID-derived .tmp symlink and asserts publishFixtureFile throws and does not clobber the symlink target.
• Register the new test in scripts/test-layout/layout.json and tests/fixtures/test-layout-expected.json so it participates in tooling and layout checks.

Testing

• Ran the focused test set with bun test tests/codex-integration/native-profile-startup-publication.test.ts tests/codex-integration/native-profile-startup.test.ts tests/test-layout.test.ts tests/test-layout-tooling.test.ts and observed the changed/focused tests pass (66 passed, 0 failed).
• Ran type checking and privacy scan with bun run typecheck and bun run privacy:scan, both reported success.
• Attempted the repository-wide bun run test; the new focused tests passed, but the full parallel suite produced unrelated timing/contention failures in preexisting tests (unrelated to these changes).

---

Codex Task

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 9fd17bd4-aaa2-43ca-8184-98418516a9c6

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	🔄 Running since 2026-09-21T00:54:34.076363Z	67a5bda	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.