fix: Harden Native Scratch Cleanup

[danny-avila]

Summary

I hardened native SRT scratch cleanup against descendant symlink replacement races. Fixes #164.

• Keep the private scratch-root descriptor open for the sandbox lifetime.
• Restore descendant traversal relative to held directory descriptors using fchmodat(..., AT_SYMLINK_NOFOLLOW).
• Resolve POSIX calls from the current process so glibc, musl, and macOS hosts use the same hardened path.
• Open every inspected child with O_DIRECTORY | O_NOFOLLOW before recursively traversing it.
• Remove command-created Darwin ACLs from held root and descendant descriptors.
• Reopen descendants from the root with at most two temporary descriptors and explicit depth, entry, directory, and component-visit budgets.
• Retain trusted cleanup state after transient failures so a later close() can retry.
• Preserve fail-closed cleanup behavior when descriptor-relative operations are unavailable or fail unexpectedly.
• Add a deterministic regression that swaps an inspected directory for a symlink and verifies the outside target and its child remain unchanged.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

• Passed the focused scratch replacement-race regression on macOS.
• Passed command-created Darwin ACL cleanup, bounded deep-tree recovery, and over-limit rejection regressions.
• Passed focused scratch creation, initialization-failure cleanup, concurrent scratch, and revoked-permission cleanup tests.
• Passed the @librechat/code TypeScript build and git diff --check.
• Used source-based focused test selection because the Codegraph selector credential was unavailable; CI provides the Linux and full package matrices.

Test Configuration:

• macOS arm64
• Node.js 24.16.0

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in complex areas of my code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective
• Local unit tests pass with my changes

[danny-avila]

@codex review

Please review the current PR head 6512c20. Confirm that this exact commit is the reviewed commit and ignore findings that apply only to earlier heads.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-09T03:48:46.450366Z	2c98804	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[danny-avila]

@codex review

Please review the current PR head 170939e. Confirm that this exact commit is the reviewed commit and ignore findings that apply only to earlier heads. This follow-up replaces the hardcoded glibc filename with portable current-process POSIX symbol resolution.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 170939ecb1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[danny-avila]

@codex review

Please review the current PR head bd169ce. Confirm that this exact commit is the reviewed commit and ignore findings that apply only to earlier heads.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: bd169ce1e9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[danny-avila]

@codex review

Please review the current PR head 2c98804. Confirm that this exact commit is the reviewed commit and ignore findings that apply only to earlier heads.

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: 2c988044e9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".