fix(sandbox): reject special files in shared UnixLocal file I/O

[jbeckwith-oai]

Summary

This pull request fixes UnixLocal reads and writes hanging on peerless FIFOs. The shared file-operation layer rejects stable special files before opening them, opens nonblocking to handle FIFO replacement races, and validates the opened descriptor before truncating or writing. Regular writes preserve inode identity, ownership, permissions, and creation umask.

Conflicting Linux file leases now fail promptly through the existing workspace error types instead of waiting. This narrower behavior was explicitly approved: the SDK does not retry lease failures or introduce a timeout policy. Direct writes reject before consuming the input stream; requested-user writes retain their existing parent-side buffering and reject before the worker copies data into the target.

Thanks to @coderdailyone for discovering and demonstrating the issue in #4891. This replacement uses the shared file-operation layer introduced by #4931.

Test plan

• Added watchdog-protected public read, write, requested-user worker, and patch-deletion regressions; controlled FIFO replacement races; descriptor cleanup checks; and regular-file compatibility coverage.
• Confirmed the baseline FIFO read hits an external watchdog while the replacement passes.
• Added native Linux read/write tests that retain a conflicting lease until the public operation returns an error. Portable regressions verify a single failed open, unchanged file contents, and unconsumed direct-write input.
• Two fresh independent implementation reviews passed on the final diff.
• Full local verification passed: formatting, lint, mypy, pyright, and 10,830 tests (62 skipped).
• Native macOS sandbox tests were skipped under the Codex sandbox. The requested-user regression executes the actual worker as the current identity, without exercising sudo identity switching. The two native Linux lease tests run in Linux CI and are skipped locally on macOS.

Issue number

Replaces #4891; credit to @coderdailyone for finding the issue.

Checks

• I've added new tests, if relevant
• I've run .agents/skills/code-change-verification/scripts/run.sh
• I've confirmed all local verification steps pass
• I've completed independent implementation review with two reviewers before submitting this PR

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T20:30:37.003103Z	df7d003	New commits
🔒 Security Review	✅ Completed 2026-09-25T20:30:40.651683Z	df7d003	New commits

Security findings

Advisory findings (1)

• 🟡 Bound lease retries to stop workspace I/O starvation · Medium · From earlier review · 114c393

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b2d9d5b6ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[markstuart-oai]

Reviewed the complete UnixLocal file-I/O change and the subsequent lease fix. Stable FIFOs and other special files are rejected before leaf open, each retry rechecks the pinned parent entry, and all opens remain nonblocking and no-follow. Descriptor validation still precedes truncation and payload writes. Requested-user and patch-deletion paths use the same checked opener; grants and stream ownership are preserved. The test-held rejected_fd belongs to the production opener, which closes it on rejection, so adding the suggested unconditional close would be incorrect.

The new revision addresses the Linux lease question: it retries EWOULDBLOCK while still revalidating the entry, rather than falling back to an unsafe blocking open. I reviewed both the real lease subprocess tests and the FIFO-replacement cases. No blocking correctness or structural findings.

Verified on this head: native-macos-sandbox, lint, containers, build-docs, prospective-release-contract, mypy-win32, mcp-v1-compat and CodeQL succeeded. The Linux/Windows test matrices, packaged contracts, typecheck and one analysis check were still running when checked. The older head had 22 passing checks; that does not verify this revision. I did not run local tests.

[chatgpt-codex-connector]

🛡️ Codex Security Review · Automatically triggered

Here are some automated security review suggestions for this pull request.

Reviewed commit: 114c393b50

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

• You comment "@codex security review"
• A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

[dpiet-oai]

One compatibility decision needs documented owner confirmation before this can be treated as safe to ship.