Repository navigation
fix(jsonl): make write_private_atomic work on Windows - #8
Open
enricodetoma wants to merge 2 commits into
Open
enricodetoma wants to merge 2 commits into
enricodetoma wants to merge 2 commits into
Conversation
On Windows every write failed. os.fchmod() is Unix-only, so on Python
<= 3.12 it raised AttributeError just after mkstemp() left the
descriptor open; the cleanup unlink() then hit WinError 32 ("the file
is being used by another process") and that secondary error replaced
the real one, so users saw "cannot write target session ...: <winerror
32>" pointing at a target file that never existed. On Python 3.13,
where os.fchmod exists, writes instead died in _fsync_directory():
Windows cannot os.open() a directory.
- skip os.fchmod() where it is unavailable; Windows keeps the creating
user's ACLs
- skip the directory fsync on Windows; NTFS journaling keeps directory
entries durable without it
- make the temporary-file unlink in the error path best-effort so a
cleanup failure cannot mask the original error being reported
Add regression tests for both failure modes. Verified on Windows with
Python 3.11 and 3.13: a 371-record Codex-to-Claude transfer now
completes, and write, collision refusal, and rollback behave as on
POSIX.
Note: some existing tests remain POSIX-specific (permission-bit
assertions, pty imports, CRLF-sensitive fixture bytes) and cannot pass
on Windows regardless of this change; the Ubuntu CI matrix is
unaffected.
xhluca
requested changes
Oct 9, 2026
Owner
There was a problem hiding this comment.
Reviewed head 8ee41da7433374803373ba7f66d6740a89757b0f. This is a focused and useful portability fix. The isolated Linux Python 3.11 suite passes (1,521 passed, 55 skipped), including the new unavailable-fchmod and cleanup-error tests. I have not run a Windows host and do not count the contributor's Windows runtime report as my own validation.
Two narrow changes are needed before merge:
- [P2] Correct the privacy/durability guarantees (
jsonl.py, lines 164 and 213–214;CHANGELOG.md). Skipping Unix permission enforcement does not guarantee an owner-only Windows ACL: default file ACLs inherit from the parent directory (Microsoft file security documentation). Likewise, NTFS journaling is not proof that a newly published directory entry is durable after a crash; Windows caches filesystem metadata (Microsoft file caching documentation). State the actual boundary: file data is flushed, directory crash durability remains platform-dependent, and Windows confidentiality depends on the destination ACL unless explicit enforcement is added. Do not claim POSIX mode-0600 equivalence. - [P2] Cover the new Windows
fsyncbranch directly. The two added tests both execute the POSIX directory-flush path. Add a test that selects thentbranch and asserts directoryos.open/os.fsyncare not called, alongside the existing POSIX durability tests. This can be mechanical and credential-free; an entire Windows CI conversion matrix is not required for this small PR.
A related pre-existing cleanup issue remains: if fchmod or fdopen raises before stream ownership is established, the raw descriptor stays open. The new suppression avoids masking the original error but does not close that descriptor. A focused follow-up should close owned descriptors before unlinking and test both setup failures; PR #10 contains an approach to this. I am distinguishing that inherited bug from the changes introduced here.
— Codex (OpenAI coding agent, GPT-6.1-sol)
|
🟢 Contributor eligibility requirements met for @enricodetoma.
|
…nc branch Correct the docstring, comments, and changelog: skipping os.fchmod does not make the file owner-only on Windows (it inherits the destination directory ACL), and directory-entry crash durability is left to the platform rather than guaranteed by NTFS journaling. Add a test that selects the nt branch and asserts directory os.open and os.fsync are not called.
tudstudent
added a commit
to tudstudent/session-migrate
that referenced
this pull request
Oct 12, 2026
…tests Follow up on xhluca's review of PR xhluca#8: Windows confidentiality depends on destination ACLs rather than POSIX-mode equivalence, and directory crash durability remains platform-dependent. Assert that the Windows directory-flush branch calls neither open nor fsync. Cover owned descriptor closure for both fchmod and fdopen setup failures. Preserve Enrico's original patch authorship and existing native manifest guard behavior. Validation: Linux Python 3.12.3; Windows/jsonl/conversion/target integration gate 116 passed. Ruff, formatting, contributor-policy tests and whitespace checks pass. These mechanical Windows branches do not establish Windows-host native acceptance.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On Windows every write failed. os.fchmod() is Unix-only, so on Python <= 3.12 it raised AttributeError just after mkstemp() left the descriptor open; the cleanup unlink() then hit WinError 32 ("the file is being used by another process") and that secondary error replaced the real one, so users saw "cannot write target session ...: <winerror 32>" pointing at a target file that never existed. On Python 3.13, where os.fchmod exists, writes instead died in _fsync_directory(): Windows cannot os.open() a directory.
Add regression tests for both failure modes. Verified on Windows with Python 3.11 and 3.13: a 371-record Codex-to-Claude transfer now completes, and write, collision refusal, and rollback behave as on POSIX.
Note: some existing tests remain POSIX-specific (permission-bit assertions, pty imports, CRLF-sensitive fixture bytes) and cannot pass on Windows regardless of this change; the Ubuntu CI matrix is unaffected.