From 84a1476a11011e22f09424f582b851df2a9a2169 Mon Sep 17 00:00:00 2001
From: "maxwell-oai[bot]" <283493003+maxwell-oai[bot]@users.noreply.github.com>
Date: Thu, 5 Nov 2026 20:38:55 +0000
Subject: [PATCH] Stabilize the unreadable-glob traversal error test (#59736)

## Why

Versions of `ignore` differ in whether parallel walks report traversal errors at the depth boundary, making the test's expectation depend on the walker implementation.

## What changed

Keep the denied directory within the bounded scan depth in `unreadable_glob_traversal_errors_fail_closed`. Require both bounded and unbounded scans to fail with the denied path and permission error, replacing the CPU-count-dependent assertion.

GitOrigin-RevId: 4ed97253247e0c032648ebc6d4be2a97c3ab261a
---
 codex-rs/linux-sandbox/src/bwrap_tests.rs | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/codex-rs/linux-sandbox/src/bwrap_tests.rs b/codex-rs/linux-sandbox/src/bwrap_tests.rs
index cfe683d146..227ad13ece 100644
--- a/codex-rs/linux-sandbox/src/bwrap_tests.rs
+++ b/codex-rs/linux-sandbox/src/bwrap_tests.rs
@@ -1505,7 +1505,9 @@ fn unreadable_glob_traversal_errors_fail_closed() {
     let denied = temp.path().join("denied");
     fs::create_dir(&denied).expect("create denied directory");
     fs::set_permissions(&denied, fs::Permissions::from_mode(0o0)).expect("deny traversal");
-    let [result, bounded] = [None, Some(1)].map(|max_depth| {
+    // Keep the denied directory within the scan depth: ignore versions differ
+    // on whether parallel walks report errors at the depth boundary.
+    let results = [None, Some(2)].map(|max_depth| {
         expand_unreadable_globs(
             &[format!("{}/**/*.env", temp.path().display())],
             temp.path(),
@@ -1513,14 +1515,11 @@ fn unreadable_glob_traversal_errors_fail_closed() {
         )
     });
     fs::set_permissions(&denied, fs::Permissions::from_mode(0o700)).expect("restore traversal");
-    let error = result.expect_err("incomplete scans must fail").to_string();
-    assert!(error.contains(&denied.display().to_string()));
-    assert!(error.contains(&io::Error::from_raw_os_error(libc::EACCES).to_string()));
-    assert_eq!(
-        bounded.is_ok(),
-        std::thread::available_parallelism().map_or(1, usize::from) == 1,
-        "rg's serial walk suppresses traversal errors beyond the depth limit",
-    );
+    for result in results {
+        let error = result.expect_err("incomplete scans must fail").to_string();
+        assert!(error.contains(&denied.display().to_string()));
+        assert!(error.contains(&io::Error::from_raw_os_error(libc::EACCES).to_string()));
+    }
 }
 
 #[test]