fix(launcher): verify PATH ancestry and temporary app bundles by luvs01 · Pull Request #722 · luvs01/opencodex

luvs01 · 2026-10-12T07:29:38Z

Summary

Check original and resolved POSIX PATH ancestry, ownership, directory permissions, and symlink hops before probing Bun. Reject persistent app-bundle registration from raw or canonical OS temporary locations.

Verification

Current-head verification after dev refresh

Head: bdbf0ad32cb4ead0871c4354309fad73d41ea6f9. Preserves the previous PR commits and includes fork/upstream dev dc45bb2ca92e9a4f841a73d70177bfec04722d47 through a normal merge.

Windows local verification with pinned Bun 1.4.0:
bun run typecheck and bun run structure:check passed.
bun test tests/cli/ocx-launcher-runtime.test.ts — 73 passed, 6 POSIX-only cases skipped, 0 failed. Unix Rust and macOS execution validation remain outstanding.
The merge delta passes git diff --check.
Repeating the full repository suite and broad import-graph selection across 13 branches was disproportionate; the commands above cover the affected behavior. Broader and platform-specific coverage remains for CI.
Local-only combined validation including fix(test): isolate diagnostic servers from live Codex restart #717–[WRONG BRANCH] fix(desktop): bound library reads and preflight write sizes #730 and fix(service): require stable numeric health sentinel endpoints #731 at aa2f74051ae79cdbfa67b6fd12fd7170218d5290: typecheck, privacy scan, structure check, and 53 layout/ratchet/core-boundary tests passed. This is integration evidence, not a full combined runtime suite.
Cross-platform CI dispatch was rejected by GitHub with HTTP 422: Actions has been disabled for this repository. Queued CodeQL entries are not completed test CI.
New pushes trigger automated review, but Devin Review has been skipping full analysis because trial/credits are exhausted. A green status carrying that skip description is not review approval. No Draft was cleared based on these statuses.

Earlier verification below remains historical evidence; the current-head results above govern readiness.

Pinned Bun launcher regression: 74 passed, 2 Windows-only cases skipped, 0 failed. Existing permission mocks now exercise lstat, and real filesystem fixtures use trusted ancestry with isolated package resolution.
bun run typecheck, bun run privacy:scan, bun run structure:check, and git diff --check passed. Original strict commit identity and pre-push checks passed without policy changes.
Rust, macOS bundle execution, and Windows validation were not run: the current Linux environment has no cargo, rustc, or rustfmt. No toolchain was installed.
The full local repository suite was not run: repeating the complete suite for eight isolated candidates is disproportionate. Focused regressions and combined target-base validation were run; broader validation and exact-head CI remain pending. This PR starts in Draft.

Checklist

Scope stays focused and avoids unrelated cleanup.
Docs or release notes were updated when needed.
Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Preserve bounded runtime ownership and failure behavior, with focused regression coverage and the owning architecture contract. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

coderabbitai · 2026-10-12T07:29:46Z

Important

🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml
Review profile: ASSERTIVE
Plan: Advanced
Run ID: d86b5a28-1bdf-42ba-95c9-b8820a6ff1ef

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

devin-ai-integration

Note

Newer findings are available below. Devin Review posted a newer report on this PR, in addition to the findings presented here.

Devin Review found 4 potential issues.

… comparison Recheck realpath after validating the original ancestry so case-variant macOS spelling remains usable. Keep peer ownership and mode checks and document the complete PATH policy. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Describe ancestry and case normalization beside the npm launcher and restore the separate Windows installation-observation paragraph.

luvs01 · 2026-10-12T12:44:08Z

No description provided.

…ansience Drop the root-owned sticky-ancestor exemption from Bun PATH validation: a shared writable ancestor lets another user replace a child entry between the ancestry walk and the exec probe. Gate the environment temp root in temporary-bundle classification on canonical residence inside a recognized temporary root or a shared sticky mode, so a custom TMPDIR no longer misclassifies an installed bundle. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

luvs01 · 2026-10-12T20:54:50Z

No description provided.

github-actions · 2026-10-13T00:59:32Z

✅ Deterministic PR hygiene checks passed.

…OSIX findPathBun now rejects a candidate beneath any group/other-writable ancestor, and /tmp is 1777 — so the PATH-dir fixture in the provenance test was refused by the new trust check before the probe ever ran. Keep the PATH fixture under the checkout sibling .tmp base like ocx-launcher-runtime.test.ts already does; the HOME/dotenv half stays under tmpdir. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

luvs01 · 2026-10-13T05:41:48Z

The unique change has been preserved in a separately verified integration candidate.

Verified source HEAD 48c6928e75697ab2d10888bc69ae6b3f6370e463 against integration candidate ecbc1b1a3185a5d7beb90321dd9fc4894bc5340f, based on development revision 6da2774369aa32552e318e333902499683d053bc. The seven changed files are byte-identical to this source HEAD; unrelated merge commits were not carried. Attribution was retained.

The validation record includes the focused Windows results, successful CI-equivalent rerun of the previously timed-out cases, source-head hosted CI, and the local Rust/full-suite limitations. Integration review remains pending; no merge was performed.

Closing this fork PR as duplicate tracking after verified transfer. The source branch is retained; the verified integration candidate remains available for further review.

fix(launcher): verify PATH ancestry and reject temporary app bundles

e546c8e

Preserve bounded runtime ownership and failure behavior, with focused regression coverage and the owning architecture contract. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

devin-ai-integration Bot reviewed Oct 12, 2026

View reviewed changes

Comment thread src/lib/bun-path-runtime.mjs Outdated

Comment thread desktop/src-tauri/src/cli_command_posix.rs Outdated

Comment thread structure/desktop-terminal-command.md Outdated

Comment thread src/lib/bun-path-runtime.mjs Outdated

This comment was marked as resolved.

Sign in to view

docs(runtime): keep PATH validation in the launcher contract

96f835d

Describe ancestry and case normalization beside the npm launcher and restore the separate Windows installation-observation paragraph.

luvs01 mentioned this pull request Oct 12, 2026

security: harden filesystem, routing, and request resource boundaries #719

Closed

3 tasks done

luvs01 and others added 3 commits October 12, 2026 22:08

test(launcher): isolate Windows PATH fixtures from inherited paths

9bc1be8

Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

Merge fork dev dc45bb2 into PR #722

bdbf0ad

Merge remote-tracking branch 'fork/dev' into merge722-dev

de9f9f1

github-actions Bot added the bug Something isn't working label Oct 13, 2026

luvs01 marked this pull request as ready for review October 13, 2026 04:22

luvs01 closed this Oct 13, 2026

Navigation Menu

Repository navigation

fix(launcher): verify PATH ancestry and temporary app bundles - #722

fix(launcher): verify PATH ancestry and temporary app bundles#722
luvs01 wants to merge 8 commits into
devfrom
codex/split719-execution-path-20261012

luvs01 commented Oct 12, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

Uh oh!

devin-ai-integration Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

luvs01 commented Oct 12, 2026

Uh oh!

luvs01 commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

luvs01 commented Oct 13, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

luvs01 commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Current-head verification after dev refresh

Checklist

Uh oh!

coderabbitai Bot commented Oct 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

devin-ai-integration Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

luvs01 commented Oct 12, 2026

Uh oh!

luvs01 commented Oct 12, 2026

Uh oh!

github-actions Bot commented Oct 13, 2026

Uh oh!

luvs01 commented Oct 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

luvs01 commented Oct 12, 2026 •

edited

Loading

coderabbitai Bot commented Oct 12, 2026 •

edited

Loading

devin-ai-integration Bot left a comment •

edited

Loading

luvs01 commented Oct 13, 2026 •

edited

Loading