Follow-up from the Codex review of #5469 (round 5, thread PRRT_kwDOPxxmWM6oZwl_).
Gap. copyPlanFileAcrossRuntimes (fork) reads the source plan from each path in planReadPaths and treats any non-transport read error as absence. For an older SSH row whose installation-scoped plan exists but cannot be read (for example EACCES or an I/O error), the fork moves on to the legacy-by-id path and then to the shared legacy path. That shared file can hold another installation's plan, so the fork can copy the wrong plan.
Why it was deferred. It needs this workspace's own plan file to be unreadable for a reason other than absence or a non-regular file, and the PR was in its blockers-only review rounds. The same "any read error counts as missing" rule predates #5469 for the legacy-by-id path.
Possible fix. Advance to a fallback only on confirmed absence (ENOENT) or an explicitly rejected non-regular path; abort the fork on any other read error of the plan path. Apply the same rule in readPlanFile before it reaches the shared legacy fallback.
Refs #5469, #5174
Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $20.61
Follow-up from the Codex review of #5469 (round 5, thread PRRT_kwDOPxxmWM6oZwl_).
Gap.
copyPlanFileAcrossRuntimes(fork) reads the source plan from each path inplanReadPathsand treats any non-transport read error as absence. For an older SSH row whose installation-scoped plan exists but cannot be read (for exampleEACCESor an I/O error), the fork moves on to the legacy-by-id path and then to the shared legacy path. That shared file can hold another installation's plan, so the fork can copy the wrong plan.Why it was deferred. It needs this workspace's own plan file to be unreadable for a reason other than absence or a non-regular file, and the PR was in its blockers-only review rounds. The same "any read error counts as missing" rule predates #5469 for the legacy-by-id path.
Possible fix. Advance to a fallback only on confirmed absence (ENOENT) or an explicitly rejected non-regular path; abort the fork on any other read error of the plan path. Apply the same rule in
readPlanFilebefore it reaches the shared legacy fallback.Refs #5469, #5174
Generated with
xum• Model:anthropic:claude-opus-5-5• Thinking:high• Cost:$20.61