[Jose Alvarez (jpalvarezl)]

Motivation & Context

Windows Pyright reports six reportAttributeAccessIssue errors in
python/samples/04-hosting/foundry-hosted-agents/responses/files/file_access.py
because os.O_DIRECTORY, os.O_NOFOLLOW, and os.O_NONBLOCK are absent
from the Windows type stubs, even though the sample only ever executes its
POSIX descriptor-relative code path (it already fails closed with a
RuntimeError on platforms that lack these flags). This blocks
uv run poe pyright -S on Windows contributor/CI machines.

Description & Review Guide

• What are the major changes? Replace the three literal os.O_NOFOLLOW /
  os.O_DIRECTORY / os.O_NONBLOCK attribute references with a small
  _posix_flag(name) helper that looks the flag up via getattr(os, name, None)
  and raises the same RuntimeError as before when it is missing. The prior
  hasattr guard in _directory_flags is replaced by this helper, and the two
  other call sites (_read_file, write_local_upload) now go through it as well.
• What is the impact of these changes? Purely a static-analysis fix; runtime
  behavior is unchanged. No-follow, descriptor-relative opens, and the existing
  fail-closed guard are fully preserved — a missing flag still raises before any
  file I/O is attempted.
• What do you want reviewers to focus on? Confirming the getattr-based
  lookup doesn't weaken the POSIX security checks (no-follow / dir_fd requirements)
  and still fails closed identically to the previous hasattr guard.

Related Issue

Fixes #

Contribution Checklist

• The code builds clean without any errors or warnings
• All unit tests pass, and I have added new tests where possible
• The PR follows the Contribution Guidelines
• This PR is linked to an issue and there is no other open PR for this issue (see Related Issue above).
• This is not a breaking change. If it is a breaking change, add the breaking change label (or add "[BREAKING]" to the title prefix, before or after any language prefix) — a workflow keeps the label and title prefix in sync automatically.

[Copilot]

🟢 Approval recommended

The implementation preserves secure behavior, with only a minor diagnostic wording issue noted.

1 open finding

• Include O_NONBLOCK in missing-flag diagnostic · New

What changed in this PR

Replaces direct POSIX-only os flag access with runtime lookup to keep Windows Pyright checks clean while preserving fail-closed file access.

Changes:

• Adds _posix_flag for guarded flag lookup.
• Updates directory, read, and write flags to use the helper.

File	Description
python/​samples/​04-hosting/​foundry-hosted-agents/​responses/​files/​file_access.py	Resolves POSIX flags dynamically while retaining security checks.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MAF Automated Review — Iteration 1

Result: No findings
Scope: full PR (1 commit(s)): f12bf2fa2052
Model: gpt-5.6-sol

Overview

The PR replaces direct references to POSIX-only flags with a private dynamic lookup so Windows Pyright can analyze the sample. Missing flags still raise before file I/O, while descriptor-relative opens, no-follow behavior, non-blocking opens, file-type checks, and descriptor cleanup remain intact. No new publishable Critical, High, or Medium issue was established.

Reviewed the supplied pull-request change set across correctness, security/reliability, architecture, and failure behavior.
No publishable findings remained after source verification for this scope.