fix: audit batch 1 — critical Android updater + security hardening + bug fixes

[appergb]

User description

Summary

Fixes for batch 1 of the multi-agent audit of 1-app: 1 critical + 9 high + 4 medium/low-severity findings (security hardening, correctness bugs, one critical Android-updater bug). All behavior-preserving except the intentional security/correctness changes. Excludes the large structural refactors (coordinator/types/LocalAsr), tracked separately.

Critical

• Android auto-update was fully broken: android/updater.rs read Build.SUPPORTED_ABIS as a method instead of a static field → device_arch() always errored. Fixed via get_static_field.

Security hardening

• coding_agent detect/run-test: validate exe against an allowlist + restrict to the main window (settings caller).
• less_computer_approve: scope to the Less Computer window (the approval surface); block the other windows.
• Android update download: validate the URL against trusted prefixes before fetching.
• Remote server: global PIN failure rate-limit; rejection-sampling for the PIN (remove modulo bias).
• Prefer the direct GitHub update endpoint over the third-party mirror.
• Sanitize the frontmost-app/window title before embedding it in the LLM system prompt.

Bug fixes

• PreferencesStore::set: hold the lock across disk write + in-memory update (no more divergence).
• QaShortcutPressed: use block_on (not spawn) to match other hotkey events and avoid a visibility race.
• run_voice_agent_transcript: clear focus_target on completion (matches the normal dictation path).

Build hygiene

• Update the stale windows-startup-lifecycle contract script and wire it into package.json.

Android (CI-verified-only)

• REPLACE_OVERLAY/REFRESH_LAYOUT use startService (not startForegroundService, blocked on Android 12+).
• 200 MB size guard on the APK download buffer.

Verification (macOS host)

• cargo test --lib: 446 passed, 0 failed; cargo check clean; npx tsc --noEmit clean; npm run build clean; all 7 contract scripts pass.
• Android- and Windows-cfg changes can't compile on macOS — relying on the Android cargo-check CI job and the Windows checks.

Notes for review

• less_computer_approve is now callable only from the Less Computer window (was: any of 5 windows).
• coding_agent exe allowlist covers macOS/Linux paths + bare claude; a Windows custom install path would need a %APPDATA%\npm prefix (bare claude still works).
• The Android updater fix compiles-verifies via CI but should be confirmed on a real device.

🤖 Generated with Claude Code

---

PR Type

Bug fix, Enhancement

---

Description

• Critical Android auto-update broken due to JNI call error

• Security hardening: exe allowlist, window restrictions, URL validation, PIN rate-limit, prompt sanitization

• Bug fixes: persistence lock race, hotkey spawn race, focus_target leak, Android startService

• Build hygiene: updated contract script and wired into package.json, preferred GitHub endpoint

---

Diagram Walkthrough

flowchart LR
    A["Audit Batch 1 PR"] --> B["Critical Android Updater Bug Fix"]
    A --> C["Security Hardening (9 high/med findings)"]
    A --> D["Bug Fixes (4 medium/low)"]
    A --> E["Build Hygiene (2 items)"]

Loading

File Walkthrough

	Relevant files
Bug fix	5 files jni.rs Use startService for overlay/layout intents                            +15/-7    updater.rs Fix device_arch JNI call and add size guard                            +17/-4    dictation.rs Clear focus_target on voice agent completion                          +5/-1      hotkey_loops.rs Use block_on for QaShortcutPressed                                              +3/-1      persistence.rs Hold lock across disk write and memory update                        +1/-1
Enhancement	5 files commands.rs Add exe validation allowlist and window scope                        +62/-9    qa.rs Restrict approve to less-computer window                                  +13/-1    settings.rs Validate update URL against trusted prefixes                          +7/-0      prompt_compose.rs Sanitize frontmost app title before prompt                              +15/-1    mod.rs Add global PIN rate-limit and rejection sampling                  +40/-4
Build configuration	1 files package.json Wire windows-startup-lifecycle script into npm                      +2/-1
Tests	1 files windows-startup-lifecycle-contract.test.mjs Update stale patterns for startup test                                      +6/-8
Configuration changes	1 files tauri.conf.json Prefer direct GitHub update endpoint                                          +2/-2

---

[github-actions]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

⏱️ Estimated effort to review: 3 🔵🔵🔵⚪⚪

🧪 No relevant tests

🔒 Security concerns Path traversal in validate_exe: The allowlist for claude executable can be bypassed by including .. in the absolute path (e.g. /usr/local/bin/../../tmp/evil). An attacker who can invoke coding_agent_detect or coding_agent_run_test from the main window could execute arbitrary executables. This is a security vulnerability. Fix by canonicalizing the path before the prefix check or by rejecting paths containing ...

⚡ Recommended focus areas for review Security Bypass validate_exe checks allowed paths via starts_with without normalizing the path first. An attacker can supply a path like /usr/local/bin/../../tmp/evil which passes the prefix check but resolves to an arbitrary executable outside the allowed directories. This undermines the allowlist intended to restrict claude to known installation paths. The function should canonicalize the path (e.g. via std::fs::canonicalize) before checking the prefix. fn validate_exe(exe: &str) -> Result<(), String> { // 纯可执行文件名，不含任何路径分隔符 — 交给 PATH 解析即可 if !exe.contains('/') && !exe.contains('\\') { if exe == "claude" { return Ok(()); } return Err(format!("不允许的可执行文件名: {exe}（只接受 'claude' 或已知安装目录下的绝对路径）")); } // 绝对路径：必须规范化到已知 claude 安装目录之一 let path = std::path::Path::new(exe); if !path.is_absolute() { return Err(format!("不允许的相对路径: {exe}")); } // 已知 claude 安装目录前缀 let known_prefixes: &[&str] = &[ "/usr/local/bin/", "/usr/bin/", "/opt/homebrew/bin/", ]; // 也允许 ~/.local/bin/claude（用户目录绝对路径，动态计算） let home_prefix = std::env::var("HOME") .ok() .map(|h| format!("{h}/.local/bin/")); let exe_norm = exe.replace('\\', "/"); let allowed = known_prefixes.iter().any(|p| exe_norm.starts_with(p)) || home_prefix.as_deref().map_or(false, |p| exe_norm.starts_with(p)); if allowed { Ok(()) } else { Err(format!("不允许的 claude 路径: {exe}（必须位于已知安装目录）"))