Apply plan - Subprocess process-group isolation, watchdog signal safety, and credential file staging in steipete/CodexBar
codexbar · lens architecture · 1 open finding at severity must or above · generated 2026-10-28T15:12:50.649Z
Work top to bottom. Ponder does not edit source - this plan is the handoff.
1. CodexBarClaudeWatchdog process spawner & tree killer (Sources/CodexBarClaudeWatchdog/main.swift) module.watchdog.main
Sources/CodexBarClaudeWatchdog/main.swift
f-0001 · must · score 1 · effort xs - CodexBarClaudeWatchdog post-spawn setpgid EACCES race and unguarded kill(-pgid) can send SIGTERM/SIGKILL to the parent process group
In Sources/CodexBarClaudeWatchdog/main.swift:71, posix_spawnp(&pid, childPath, nil, nil, cBuffer.baseAddress, environ) spawns the child with attrp = nil (inheriting the watchdog and parent app process group), and line 85 calls _ = setpgid(globalChildPID, globalChildPID) ignoring errors. Once posix_spawnp has exec’d the child binary, setpgid(2) from the parent fails with EACCES, leaving globalChildPID in the parent process group (pgid == getpgrp()). When killProcessTree (main.swift:17-38) runs on signal or parent death (getppid() == 1), let pgid = getpgid(childPID); if pgid > 0 { kill(-pgid, SIGTERM) } checks only pgid > 0 instead of pgid == childPID && pgid != getpgrp(), sending SIGTERM and SIGKILL to the parent process group.
Evidence: Sources/CodexBarClaudeWatchdog/main.swift:17-38, Sources/CodexBarClaudeWatchdog/main.swift:71, Sources/CodexBarClaudeWatchdog/main.swift:85, Sources/CodexBarCore/Host/Process/SpawnedProcessGroup.swift:362-367, Sources/CodexBarCore/Host/Process/ProcessOwnershipReaper.swift:38
Do: In Sources/CodexBarClaudeWatchdog/main.swift:69-72, initialize posix_spawnattr_t with POSIX_SPAWN_SETPGROUP | POSIX_SPAWN_CLOEXEC_DEFAULT and posix_spawnattr_setpgroup(&attr, 0), and in killProcessTree (lines 19, 33) check if pgid == childPID, pgid != getpgrp() before calling kill(-pgid, …).
Shape of the work
1 module · 1 finding · effort 1×xs
Generated by Ponder - AI that knows when to speak, and when to shut up.