[PascalAI2024]

Two waves of audit-driven polish (a team of parallel read-only auditors surfaced findings; the high-confidence subset was applied). Heads-up: this environment has no Zig 0.16 toolchain and locked-down network, so changes are verified by static review against the codebase's own idioms, not compiled. This PR's CI run is the first real build/test/smoke gate — please let it go green before merging. (CI itself was broken until this PR; see below.)

Wave 1 — correctness, cross-platform, security

Fixed

• CI never ran. ci.yml triggered on master, but the default branch is main, so build/test/smoke never executed on any push or PR. Pointed at main.
• macOS background jobs were never reaped. childHasExited only handled Windows/Linux and fell through to return false elsewhere, so finished children lingered as zombies and jobs showed them Running forever. Added a libc waitpid(WNOHANG) branch that handles ECHILD without panicking.
• Pipeline stages could double-execute. tryRunNativePipeline detected an unsupported (redirected/empty) later stage only after earlier stages had already spawned, then re-ran the whole line under the system shell — running a non-idempotent first stage (e.g. the rm f in rm f | grep x > out) twice. All stages are now validated before any run.
• Desktop JSON value parser mis-read a string ending in a backslash (e.g. a Windows path "C:\dev\") as unterminated. jsonStringValue now tracks escape state.
• .gitattributes pins *.sh/*.zig to LF and *.ps1/*.bat to CRLF so a Windows checkout can't commit CRLF shebangs that break POSIX CI.

Security (agentd)

• API key no longer leaks via curl argv (was visible to any local user through ps / /proc/<pid>/cmdline). It's written to a private 0600 temp file and passed via curl -H @file, then deleted — both the request path and the health probe.
• Provider responses are now redacted like the file/search/git tool outputs, matching the documented posture; the envelope carries a redacted flag.
• An oversized JSON-lines input returns a structured read_error envelope instead of tearing down the session.

Changed

• Platform support trimmed to Windows / Linux / macOS — the BSDs were advertised in the support gates and tests but never linked (no libc was linked for them). Removed from the gates; inert BSD code paths remain.
• README metrics corrected against the tree (Zig lines 18,395 → 18,850; unit tests 198 → 213).

Wave 2 — robustness

• AgentD could emit invalid JSON. appendJsonString passed bytes ≥ 0x80 through verbatim, so a file.read/rg.search/git.diff over a binary or non-UTF-8 file produced an envelope strict parsers reject. It now validates each UTF-8 sequence and substitutes U+FFFD for malformed bytes (well-formed UTF-8 is unchanged). Adds a regression test.
• Unbounded reads when appending to the history file and >> redirect targets are now capped at max_history_file_bytes, matching every other read path.
• Dead desktop config validation — migrate()/validate() existed but were never called, so out-of-range settings loaded silently. Now wired into the config load path.

Deliberately left alone

• Line editor mangles non-ASCII/emoji input (real bug, but the fix rewrites cursor math across the interactive editor — too risky to do without a compiler).
• Two benign Windows-only threading races and a cosmetic wide-char-on-erase issue (UB in theory, harmless in practice).
• kill-without-wait zombie cleanup (depends on a custom Child.kill contract that couldn't be verified statically).

The terminal VT parser and POSIX PTY relay were audited and came back clean — no memory bugs, leaks, or UAF.

One thing to watch in review

apps/agentd/src/provider.zig creates the auth temp file with createFile(..., .{ .exclusive = true, .mode = 0o600 }). The .mode field is standard on CreateFlags, but it's the single token most worth confirming the CI build accepts (the shell's own createFile call omits .mode).

https://claude.ai/code/session_01Sx5Tzwp8fTJR1chro59dhF

---

Generated by Claude Code