[WRONG BRANCH] fix(service): stop trusting PATH launchers in systemd units - #391
[WRONG BRANCH] fix(service): stop trusting PATH launchers in systemd units#391luvs01 wants to merge 1 commit into
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Pro Plus Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 41eb29ee56
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (typeof state.codexHome !== "string" || state.codexHome.length === 0) return null; | ||
| if (typeof state.opencodexHome !== "string" || state.opencodexHome.length === 0) return null; | ||
| for (const key of ["bunPath", "cliPath", "launcherPath", "winswVersion", "winswSha256"] as const) { | ||
| for (const key of ["bunPath", "cliPath", "winswVersion", "winswSha256"] as const) { |
There was a problem hiding this comment.
When upgrading an installation whose existing v2 state contains launcherPath, this parser now silently accepts but discards that marker. If the recorded Bun and CLI paths still exist—such as an in-place npm upgrade—bakedServicePathsDiagnostic() returns healthy and diagnoseService() reports the service viable even though systemd's already-loaded unit still executes the PATH-selected launcher this security fix is intended to distrust. Treat any legacy launcherPath state/unit as stale and require or perform a repair before reporting it viable.
AGENTS.md reference: AGENTS.md:L326-L332
Useful? React with 👍 / 👎.
|
✅ Deterministic PR hygiene checks passed. |
github-actions
Bot
changed the title
⏳ DRAFT
What to do
Its title has been prefixed with |
1 participant
Motivation
ocx service installand becoming the persistent systemd ExecStart target that receives service credentials.ocxfound onPATH.Description
launcherbranch from systemd installs so units run the package-derived Bun + CLI pair (cliEntry()), not a PATH-selectedocxshim. This eliminates the executable-substitution attack surface ininstallSystemd()andbuildUnit().bunPath/cliPathprovenance instead of an untrustedlauncherPath.buildServiceShellCommand(bun, cli)for systemd units and drop thebuildServiceLauncherShellCommandpath.ocxand to reflect the package-derived shape (tests/service.test.ts).ocx service repairafter version-manager upgrades (docs-site/src/content/docs/reference/cli/lifecycle.md).Testing
bun run typechecksucceeded andbun run privacy:scansucceeded.npx --yes bun@latest test tests/service.test.ts— the focused service tests passed for the added regression (security regression covered); an unrelated container-only systemd diagnostic failure was documented.Codex Task