[lumatic2]

Summary

Part of #2064. The Windows ancestor check looks at every ancestor but reported the nearest one that failed. If that folder only inherits the bad ACE, moving outside it doesn't help. On my machine the default state directory reported ...\.codex\state\plugins\codex-security, and a state directory under Documents reported Documents. Both now report C:\Users\<user>, where the ACE is set.

Changes

• inspectWindowsCredentialAclSnapshot() in sdk/typescript/src/runtime.ts keeps the last ancestor failure instead of throwing at the first. It throws once the ancestors are done (before the credential home is inspected, or when the stream ends). Ancestors come nearest first, so that's the outermost one. Same ancestors are rejected, same message text.
• New test in sdk/typescript/tests-ts/runtime.test.ts: parent has an inherited Modify ACE, grandparent has the explicit one, message should name the grandparent.

Testing

• New test passes, and fails on main (names the parent).
• bun test --timeout 30000 ./tests-ts/runtime.test.ts on Windows 11: 107 pass / 74 fail, main 106 / 74. The 74 are tests that create real credential homes under %TEMP% and hit Windows: default state directory fails credential-home validation once Codex's elevated sandbox has a Modify ACE on the user profile #2064 on this machine.
• pnpm run build:ci, prettier --check on both files, git diff --check: clean.
• bun src/cli.ts login status on the affected machine reports C:\Users\<user> for both the default and the Documents state directory.

Risk and rollout

Changes which ancestor the error names when more than one is rejected. Nothing else. No CLI, SDK, or schema changes.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.