{"record":{"id":"a489a56d944353db","repo":"multica-ai/multica","slug":"stat-opened-codex-home-s-w","errorCode":null,"errorMessage":"stat opened codex home %s: %w","messagePattern":"stat opened codex home (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/internal/daemon/execenv/codex_home.go","lineNumber":984,"sourceCode":"\troot, err := os.OpenRoot(codexHome)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"open codex home %s: %w\", codexHome, err)\n\t}\n\tif err := verifyCodexHomeRoot(root, codexHome, key); err != nil {\n\t\troot.Close()\n\t\treturn nil, err\n\t}\n\treturn root, nil\n}\n\n// verifyCodexHomeRoot proves that root is the directory codexHome names right\n// now: not reached through a symlink, and the same directory os.Lstat sees at\n// that path. It is separate from openVerifiedCodexHomeRoot so the swap case can\n// be tested deterministically instead of by racing.\nfunc verifyCodexHomeRoot(root *os.Root, codexHome, key string) error {\n\topened, err := root.Stat(\".\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"stat opened codex home %s: %w\", codexHome, err)\n\t}\n\tcurrent, err := os.Lstat(codexHome)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"stat codex home %s: %w\", codexHome, err)\n\t}\n\tif current.Mode()&os.ModeSymlink != 0 {\n\t\treturn fmt.Errorf(\"codex home %s is a symlink; refusing to write %s through it\", codexHome, key)\n\t}\n\tif !os.SameFile(opened, current) {\n\t\treturn fmt.Errorf(\"codex home %s was replaced while opening it; refusing to write %s through it\", codexHome, key)\n\t}\n\treturn nil\n}\n\n// materialiseInCodexHome writes src to relPath inside codexHome using\n// root-scoped operations, so no symlink below the task home can redirect the\n// daemon's mkdir, remove, or write outside it.\n//","sourceCodeStart":966,"sourceCodeEnd":1002,"githubUrl":"https://github.com/multica-ai/multica/blob/2c0912b6ec764b373d44eeea1e80f0d9f11ab417/server/internal/daemon/execenv/codex_home.go#L966-L1002","documentation":"verifyCodexHomeRoot calls root.Stat(\".\") on the just-opened os.Root to capture the identity of the directory the handle refers to. Failure here means the opened handle could not be stat'ed, which is nearly impossible unless the filesystem errors after a successful open (e.g. NFS, FUSE weirdness) — it is the first half of the symlink/replacement identity check.","triggerScenarios":"Underlying filesystem returns an error for fstat on an open directory handle (network filesystem, failing disk, FUSE mount); handle already closed by another goroutine.","commonSituations":"Task home on NFS or a container overlay that fails fstat; flaky cloud volume during task start.","solutions":["Retry the task prepare once — transient FS errors usually clear","Move the task home off the network/exotic filesystem to local disk","Check dmesg / volume health if the error persists"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := prepareCodexHome(...); err != nil {\n\tif strings.Contains(err.Error(), \"stat opened codex home\") {\n\t\t// transient fstat failure; one retry on local disk is safe\n\t\terr = prepareCodexHome(...)\n\t}\n}","preventionTips":["Prefer local disk over NFS/FUSE for task homes","Monitor volume health in the daemon's host"],"tags":["filesystem","codex-home","verification"],"backgroundTag":null,"analyzedSha":"2c0912b6ec764b373d44eeea1e80f0d9f11ab417","analyzedAt":"2026-08-15T13:25:18.241Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}