From 9afa2a68dc3c9340024e57c64bc58b302bd14ec2 Mon Sep 17 00:00:00 2001
From: coreybutler <770982+coreybutler@users.noreply.github.com>
Date: Sat, 24 Oct 2026 12:57:18 -0500
Subject: [PATCH] fix(cli): refuse sign-script argv paths

Read the launcher path from the proxy pipe only. Firewall trust module still signs in-process.

Signed-off-by: Corey Butler <770982+coreybutler@users.noreply.github.com>
---
 src/cmd/main.go | 22 ++++++++++++++++++----
 1 file changed, 18 insertions(+), 4 deletions(-)

diff --git a/src/cmd/main.go b/src/cmd/main.go
index 7fc6671..069b750 100644
--- a/src/cmd/main.go
+++ b/src/cmd/main.go
@@ -205,13 +205,27 @@ func main() {
 		}
 		return
 	case "--sign-script":
-		// Force-resign one launcher after trust prompt (bypass TrustedModules gate).
-		if len(os.Args) < 3 {
-			fmt.Fprint(os.Stderr, "missing script path for --sign-script\n")
+		// Proxy-only helper after a trust prompt. Path arrives on stdin (anonymous
+		// pipe from proxy.exe). argv is ignored so a shell cannot stamp VerifyCache.
+		if len(os.Args) != 2 {
+			fmt.Fprint(os.Stderr, "sign-script refused: path must arrive on the proxy pipe\n")
 			os.Exit(1)
 		}
 		settings.Load()
-		if err := verifycache.SignScript(os.Args[2]); err != nil {
+		if err := verifycache.AuthorizeSignScriptFromParent(); err != nil {
+			fmt.Fprintln(os.Stderr, err.Error())
+			os.Exit(1)
+		}
+		scriptPath, err := verifycache.ReadSignScriptPath(os.Stdin)
+		if err != nil {
+			fmt.Fprintln(os.Stderr, err.Error())
+			os.Exit(1)
+		}
+		if !verifycache.IsDelegatedLauncherPath(scriptPath) {
+			fmt.Fprint(os.Stderr, "sign-script refused: path is not a delegated launcher\n")
+			os.Exit(1)
+		}
+		if err := verifycache.SignScript(scriptPath); err != nil {
 			fmt.Fprintln(os.Stderr, err.Error())
 			os.Exit(1)
 		}