fix(update): avoid PATH lookup for systemd-run

[luvs01]

Motivation

• Close a local-exec vulnerability where the update worker probe and launch used an unqualified systemd-run found via the inherited PATH, allowing a lower-integrity actor to substitute an executable that would run with the proxy's service context.

Description

• Replace the PATH-resolved probe with a trusted resolver (resolveSystemdRun) that only considers the absolute candidates /usr/bin/systemd-run, /bin/systemd-run, /usr/local/bin/systemd-run (local installs), and /run/current-system/sw/bin/systemd-run (the NixOS layout) before falling through to the plain detached spawn.
• Require each candidate to be an executable regular file that is root-owned with no group/world-write bits, inside a directory held to the same rule — mirroring isTrustedSystemPath in src/codex/desktop-app/linux.ts — so a planted or replaced systemd-run in a group-writable /usr/local/bin is skipped instead of being exec'd by the scope probe under the service account.
• Run the no-op scope probe using the same absolute executable and, when usable, return that exact absolute path for the worker launch from guiUpdateWorkerCommand (introducing resolveSystemdRun in WorkerLaunchContext); a failed probe falls through to the next trusted path.
• Preserve the existing detached process.execPath fallback when no trusted systemd-run is available, and keep launch semantics otherwise unchanged.
• Update the regression test tests/update/update-worker-launch.test.ts to assert an attacker-controlled leading PATH is ignored and the candidate order/fall-through, and document the trusted-path contract in structure/ops/service-and-sidecars.md.

Testing

• bun test tests/update/update-worker-launch.test.ts — 5 pass, 0 fail.
• The executable/trust check lives in the resolver's default hooks; unit tests inject the hook seam, so the ownership check is covered by the same code path it guards rather than a mocked assertion.

Link to Devin session: https://app.devin.ai/sessions/4a96408ffbbd4381b14d4022a1764a21
Open in Devin Desktop: https://app.devin.ai/desktop/session/4a96408ffbbd4381b14d4022a1764a21?variant=devin
Requested by: @luvs01

---

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 0938fbaa-fbdc-4553-9c9c-01ecd53a436f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[luvs01]

이관됨: lidge-jun#6037

[luvs01]

동일 수정이 상류 저장소에 제출되어 이 포크 PR의 목적은 달성됐습니다.