{"record":{"id":"c7809e3d7bc458f1","repo":"multica-ai/multica","slug":"stat-codex-home-s-w","errorCode":null,"errorMessage":"stat codex home %s: %w","messagePattern":"stat codex home (.+?): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/internal/daemon/execenv/codex_home.go","lineNumber":988,"sourceCode":"\tif err := verifyCodexHomeRoot(root, codexHome, key); err != nil {\n\t\troot.Close()\n\t\treturn nil, err\n\t}\n\treturn root, nil\n}\n\n// verifyCodexHomeRoot proves that root is the directory codexHome names right\n// now: not reached through a symlink, and the same directory os.Lstat sees at\n// that path. It is separate from openVerifiedCodexHomeRoot so the swap case can\n// be tested deterministically instead of by racing.\nfunc verifyCodexHomeRoot(root *os.Root, codexHome, key string) error {\n\topened, err := root.Stat(\".\")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"stat opened codex home %s: %w\", codexHome, err)\n\t}\n\tcurrent, err := os.Lstat(codexHome)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"stat codex home %s: %w\", codexHome, err)\n\t}\n\tif current.Mode()&os.ModeSymlink != 0 {\n\t\treturn fmt.Errorf(\"codex home %s is a symlink; refusing to write %s through it\", codexHome, key)\n\t}\n\tif !os.SameFile(opened, current) {\n\t\treturn fmt.Errorf(\"codex home %s was replaced while opening it; refusing to write %s through it\", codexHome, key)\n\t}\n\treturn nil\n}\n\n// materialiseInCodexHome writes src to relPath inside codexHome using\n// root-scoped operations, so no symlink below the task home can redirect the\n// daemon's mkdir, remove, or write outside it.\n//\n// This matters because a task home is reused: a prepare can run against a\n// directory a previous task already wrote to. Without the root, a task that\n// replaced an intermediate directory of its own home with a link to somewhere\n// else would have the daemon delete and overwrite the link target on the next","sourceCodeStart":970,"sourceCodeEnd":1006,"githubUrl":"https://github.com/multica-ai/multica/blob/2c0912b6ec764b373d44eeea1e80f0d9f11ab417/server/internal/daemon/execenv/codex_home.go#L970-L1006","documentation":"verifyCodexHomeRoot stats the codexHome path with os.Lstat to compare against the opened handle. Failure means the path cannot be stat'ed at all: it vanished between os.OpenRoot and the Lstat, or a parent directory became unreadable.","triggerScenarios":"The task home directory is removed concurrently right after being opened; a parent of the path is chmod'ed to deny search; the mount disappears.","commonSituations":"Workspace reaper or cleanup job racing task start; a task deleting its own home in a previous run's teardown.","solutions":["Serialize workspace cleanup with task start (don't delete a home while a prepare is in flight)","Retry prepare after the race window passes","Ensure parent directories of the home stay searchable by the daemon user"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err := prepareCodexHome(...); err != nil {\n\tif errors.Is(err, fs.ErrNotExist) && strings.Contains(err.Error(), \"stat codex home\") {\n\t\t// home vanished mid-open: recreate and retry once\n\t\t_ = os.MkdirAll(codexHome, 0o755)\n\t\terr = prepareCodexHome(...)\n\t}\n}","preventionTips":["Never run workspace reapers concurrently with task start","Log which process removes task homes when this fires"],"tags":["filesystem","race-condition","codex-home"],"backgroundTag":null,"analyzedSha":"2c0912b6ec764b373d44eeea1e80f0d9f11ab417","analyzedAt":"2026-08-15T13:25:18.241Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}