fix(config): pin PID identity probes to trusted binaries

[luvs01]

Summary

• Pin PID identity probes to trusted operating-system binaries instead of resolving ps or powershell.exe through caller-controlled PATH.
• Read Linux command lines from /proc/<pid>/cmdline first, then fall back only to /bin/ps or /usr/bin/ps.
• Resolve Windows WMIC and PowerShell from the existing trusted System32 resolver, reject unsafe PID values before command construction, and add hostile-environment regressions.

This keeps the existing PID identity and timeout behavior while removing environment-controlled executable lookup from lifecycle checks.

Verification

• bun test tests/config.test.ts -t 'pid validation' — 2 passed, 0 failed on Windows.
• bun run typecheck
• bun run privacy:scan
• git diff --check
• Independent final diff review found no P0–P3 findings.
• The full config test file reached 130 passes and 1 skip; six existing Windows symlink-creation failures reproduced on an unchanged dev control.
• A repository-wide run was stopped after unrelated existing Windows/catalog/auth failures made it non-diagnostic. Exact-head Linux, macOS, and Windows CI remains required.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were not needed for this internal process-identity hardening.
• Security-sensitive changes require explicit maintainer security review.

Review readiness checklist

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes
  • Improved process command-line detection across Linux, Windows, and other supported platforms.
  • Windows process checks now use trusted system tools and safely fall back when needed.
  • Enhanced validation prevents unsafe executables from being selected through the system path.
  • Preserved existing timeout, output, and failure-handling behavior.

[coderabbitai]

📝 Walkthrough

Walkthrough

The process command-line probe now supports injectable execution and platform selection. It validates PIDs, uses Linux /proc, trusted Windows WMIC and PowerShell paths, and fixed ps paths elsewhere. Tests cover PATH isolation and Windows fallback behavior.

Changes

Process identity probing

Layer / File(s)	Summary
Trusted process probe implementation src/config.ts	readProcessCommandLine adds test seams, validates PIDs, checks /proc on Linux, resolves trusted Windows executables, and tries fixed /bin/ps and /usr/bin/ps paths on other platforms.
Platform-specific probe tests tests/config.test.ts	Tests verify PID validation, PATH isolation, trusted WMIC and PowerShell selection, fallback behavior, and cleanup of test state and caches.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant readProcessCommandLine
  participant ProcessCommandExec
  participant TrustedExecutableResolver
  participant WMIC
  participant PowerShell
  readProcessCommandLine->>ProcessCommandExec: probe process command line
  ProcessCommandExec->>TrustedExecutableResolver: resolve trusted Windows path
  TrustedExecutableResolver-->>ProcessCommandExec: WMIC or PowerShell path
  ProcessCommandExec->>WMIC: query process command line
  WMIC-->>ProcessCommandExec: command output or failure
  ProcessCommandExec->>PowerShell: run fallback query when WMIC fails
  PowerShell-->>readProcessCommandLine: command output or undefined

Loading

Possibly related PRs

• lidge-jun/opencodex#1347: Both changes harden Windows process probing by resolving trusted executables instead of relying on PATH.
• lidge-jun/opencodex#1279: Both changes use trusted WMIC and PowerShell executables for Windows process probing.
• lidge-jun/opencodex#533: Both changes modify process command-line probing and its configuration tests.

Suggested reviewers: lidge-jun

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main security fix: pinning PID identity probes to trusted executable paths.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• review readiness checklist open (2/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 2/4).

Review readiness checklist

• ⬜ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

2/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[luvs01]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/config.test.ts`:
- Around line 1839-1862: Update the pid validation test around
setOcxStartProcessCacheForTests to force the Unix ps fallback by setting
setProcessCommandLinePlatformForTests("darwin") and injecting
setProcessCommandLineExecForTests. Record each probe and assert that only
/bin/ps and /usr/bin/ps are attempted, while preserving the existing PATH
poisoning and marker assertions. Reset both process-command-line hooks in the
finally block.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: dc36183c-e03d-47f3-aa0c-3129eb5a83f3

📥 Commits

Reviewing files that changed from the base of the PR and between 4f746d1 and 7489bb2.

📒 Files selected for processing (2)

• src/config.ts
• tests/config.test.ts

[luvs01]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/config.test.ts`:
- Around line 1841-1846: Update the fake ps script setup near markerPath and
fakePs to place the marker beside fakePs and reference it as "$0.executed"
instead of embedding markerPath in a single-quoted shell string. Keep the
script’s existing marker-writing and output behavior unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 744ebcd9-dbad-4ea5-a88f-eb5bed776b40

📥 Commits

Reviewing files that changed from the base of the PR and between 7489bb2 and f04c681.

📒 Files selected for processing (1)

• tests/config.test.ts

[luvs01]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.