fix: align artifact identity checks across Windows

Author: vitry

.github/workflows/ci.yml

@@ -23,10 +23,7 @@ jobs:
           node-version: ${{ matrix.node }}
           cache: npm
       - run: npm ci
-      - name: Full check (temporary Windows Node diagnostics)
-        env:
-          ZCODE_DEBUG: '1'
-        run: npm run check
+      - run: npm run check
       - name: Clean packed production install and Node 22.13 native binding smoke
         run: node --test tests/integration/package-install.test.mjs
       - name: Production lockfile native binding smoke

scripts/lib/review.mjs

@@ -96,7 +96,12 @@ export async function readResultArtifact({ dataRoot, workspace, artifact }) {
       const pathInfo = await lstat(path); if (pathInfo.isSymbolicLink() || !pathInfo.isFile()) throw artifactError();
       if (await realpath(dirname(path)) !== root) throw artifactError();
       const handle = await open(path, constants.O_RDONLY | (constants.O_NOFOLLOW ?? 0));
-      try { const before = await handle.stat(); const contents = await handle.readFile('utf8'); const after = await lstat(path); if (after.isSymbolicLink() || before.dev !== after.dev || before.ino !== after.ino) throw artifactError(); return contents; }
+      try {
+        // Keep the before/after identity check on path stats as well. Mixing
+        // FileHandle.stat with lstat is inconsistent on Node 22.13 Windows.
+        const before = pathInfo; const contents = await handle.readFile('utf8'); const after = await lstat(path);
+        if (after.isSymbolicLink() || before.dev !== after.dev || before.ino !== after.ino) throw artifactError(); return contents;
+      }
       finally { await handle.close(); }
     });
   } catch (error) { throw new PluginError('RESULT_READ_FAILED', 'Could not safely read the result artifact.', { category: 'storage', remedy: 'Inspect the private workspace result store.', cause: error }); }

tests/windows-compat.test.mjs

@@ -65,7 +65,7 @@ test('artifact identity checks do not mix handle and path stat implementations',
     import { mkdtemp, open, readFile, rm } from 'node:fs/promises';
     import { tmpdir } from 'node:os';
     import { join } from 'node:path';
-    import { writeResultArtifact } from ${JSON.stringify(reviewModule)};
+    import { readResultArtifact, writeResultArtifact } from ${JSON.stringify(reviewModule)};
     const directory = await mkdtemp(join(tmpdir(), 'zcode-stat-'));
     const probe = await open(join(directory, 'probe'), 'a+');
     const prototype = Object.getPrototypeOf(probe);
@@ -82,6 +82,8 @@ test('artifact identity checks do not mix handle and path stat implementations',
     try {
       const artifact = await writeResultArtifact({ dataRoot: directory, workspace: directory, jobId: 'b'.repeat(64), contents: 'done' });
       if (artifact !== 'results/' + 'b'.repeat(64) + '.md') throw new Error('artifact path did not persist');
+      const contents = await readResultArtifact({ dataRoot: directory, workspace: directory, artifact });
+      if (contents !== 'done') throw new Error('artifact contents did not read');
     } finally {
       prototype.stat = originalStat;
       await rm(directory, { recursive: true, force: true });