[lahfir]

Desktop operations could accept insufficiently verified process and file identities, retain excessive trace or rendering input, or wait indefinitely in native Windows calls. This change strengthens those boundaries and bounds the affected operations.

The final patch covers process-owned CDP listener checks, bounded trace reads and shared recording budgets, Windows private storage and native-operation limits, macOS clipboard-helper identity, Linux clipboard-owner records and RENDER reply bounds, private test fixtures, and metadata-only Jev evidence. It incorporates the Linux cleanup from #302 and preserves its removed inspector and remote-box tooling. Relocated trace subprocess tests now select the intended tests and assert that one child test actually ran.

Validation on the cleanup integration commit:

• Native Linux: 1,515 core tests, 2,107 Linux tests and 183 FFI tests passed; 230 Linux live tests were ignored in this library run. Native all-target clippy passed.
• macOS: host library tests, complete CLI tests and all-target clippy passed. Formatting and repository source gates passed.
• The relocated subprocess regression failed with its old selector (zero tests executed), then all eight focused trace-input tests passed with the repair.
• Hosted cross-platform CI and Greptile must be verified on the current head. Earlier full desktop, Windows and performance receipts predate the cleanup integration and are not claims of final-head coverage.

Security audit limits: the original completed scan covered main. The separate Linux scan was blocked by provider access and did not complete. Targeted repairs address private temporary fixtures and group-write permission assumptions, without claiming two-account or NSS/domain validation. Label-text privacy remains unresolved. The remote-box setup script was deleted by #302; it was not independently validated as a security repair. A timed-out legacy capture may retain one worker until the OS call returns. Trace recording retains the previously measured admission overhead.

The pre-commit wrapper contains permanent deletion prohibited by repository instructions; equivalent host and native checks were run directly before bypassing it. This PR targets the Linux branch; Linux-to-main remains separate.

[greptile-apps]

Confidence Score: 5/5

[High impact] The changes since the previous review appear safe to merge.

Summary

This PR tightens process and file identity checks, shares trace recording limits across processes, and bounds native Windows operations.

Since the previous review:

• DevTools endpoints are accepted only when the launched process owns their listener.
• Trace readers and writers stop at shared size, event, and entry limits.
• Linux clipboard owner records use a checked private directory and bounded contents.
• macOS clipboard operations verify the packaged helper and its directory chain.
• Windows private state paths are checked against owner and access rules.
• Windows native calls, capture, and rendering work now use bounded paths.
• Windows launch attaches only to a running process with the expected executable identity.
• JEV requests send selected action fields without supplied text or detailed execution evidence.
• Supporting fixtures, checks, probes, and docs change alongside the desktop boundary work.

_{Reviews (8) · Last reviewed commit: "refactor: align native security types wi..." · Reviewed by Greptile}

[lahfir]

non-blocking fixes recommended for trace limits, macOS owner-only ACLs, and stale Windows overlays.

All three findings are addressed in edc30d6, with ledger overhead reduced in bb50b17. Each inline thread has its own verification details and is resolved. Native Linux, macOS, and Windows focused tests and clippy pass; the full host library suite also passes. All 44 checks passed on bb50b17; Greptile reviewed that commit at 5/5 with no new actionable findings. The PR description records the measured trace overhead and the separately blocked Linux audit; these fixes do not claim that audit is complete.