[WRONG BRANCH] fix(test): scope test-run lock to user home to avoid cross-user DO S

[luvs01]

Motivation

• The test-run lock used a fixed pathname under the OS temporary directory, which is a shared namespace on Unix and allows another local account to claim the pathname and deny other users from running tests. This change narrows the lock's scope to the current user to prevent cross-user denial-of-service.

Description

• Replace the shared /tmp-based default lock with a user-local lock path and expose resolveDefaultTestRunLockPath(home?: string): string that returns join(homedir(), ".opencodex-bun-test.lock") and use it as the default lock location in acquireTestRunLock (scripts/test-run-lock.ts).
• Update wrapper and preload diagnostics to call this a "user lock" instead of a "machine lock" (scripts/test.ts, tests/preload.ts).
• Add a regression test asserting the default lock path resolves under a supplied home directory and rename the test suite labels accordingly (tests/test-runner.test.ts).
• Keep existing behavior and options: callers can still supply lockPath to override, and the OCX_TEST_NO_QUEUE=1 escape hatch remains supported.

Testing

• Ran bun test --preload ./tests/preload.ts tests/test-runner.test.ts; the modified runner tests passed overall for the lock-related cases (16 passed, 2 skipped) while one unrelated wrapper assertion failed due to the environment's Bun binary version not emitting the expected PARALLEL marker (environment mismatch), so the lock regression assertions themselves succeeded.
• Ran repository preflight (bun run prepush) which completed typecheck and GUI lint steps; the full test suite exercised many environment-sensitive baseline failures unrelated to this change (several long-running/timeouting tests and sandbox-related Lab failures), but the lock-related unit and integration checks included here passed.
• git diff --check and local verification of modified files were performed and showed only the intended edits to scripts/test-run-lock.ts, scripts/test.ts, tests/preload.ts, and tests/test-runner.test.ts.

---

Codex Task

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 13231964-dae6-4f52-9d05-e74206ffb9bc

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 431b997c78

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep the PID-based lock on a host-local filesystem

When the same home directory is mounted on multiple hosts, as with NFS/SMB enterprise homes or CI containers sharing a home volume, this path makes those hosts operate on one lock even though processIsAlive() checks PIDs only on the local host. A second host can therefore reclaim an active lock because its local PID is absent and run a suite concurrently, or wait 45 minutes because an unrelated local process has the same PID. Use a user-owned host-local directory, or include a stable host identity in the lock namespace, so the lock's filesystem scope matches its PID-liveness scope.

AGENTS.md reference: scripts/AGENTS.md:L14-L15

Useful? React with 👍 / 👎.