fix(service): pin elevated scheduler staging paths

[luvs01]

Motivation

• Fix a TOCTOU introduced when staging Task Scheduler XML to files for UAC elevation whereby a same-user process could replace a staged pathname with a reparse/pipe/UNC target that the elevated process would open before integrity verification.
• Preserve the earlier change that removed oversized inline command payloads while restoring a safe pre-elevation design that prevents privileged pathname-following side effects.

Description

• Added an explicit byteLength field to StagedWindowsTaskXml and compute it in stageElevatedSchedulerRegistration so the elevated side receives a bounded length alongside the SHA-256 digest.
• Validate staging metadata pre-elevation and require both payloads share the same staging directory before launching elevation via runWindowsElevatedScheduledTaskRegistration.
• Pin the staging namespace pre-UAC by opening every ancestor directory and each payload with CreateFile (via a small injected Add-Type helper) with flags that deny write/delete sharing and by checking GetFileInformationByHandleEx to detect reparse targets; keep those handles until the elevated child exits.
• Replace the elevated helper's unbounded ReadAllBytes with a bounded open/read into a preallocated buffer (File.Open + length check + looped read), then compute the SHA-256 over those same bytes before decoding and registering; dispose the stream in a finally block.
• Kept existing protections and behaviors: ACL hardening, exclusive wx creation, pre-elevation lstat checks, digest verification, staged cleanup, the replacement precondition (re-query-before-Force), and bounded command-line length behavior.

Testing

• Ran bun test tests/windows/windows-elevation-spawn.test.ts and all 58 tests passed.
• Ran bun test tests/service/service.test.ts --test-name-pattern 'elevated staging|fresh registration elevates only|fresh registration UAC denial' and the focused cases passed (2 tests).
• Ran bun x tsc --noEmit, bun run structure:check, and bun run privacy:scan, all of which passed; also ran git diff --check with no reported issues.
• Attempting the repository-wide bun run test exposed unrelated, environment-sensitive failures across the full parallel suite; the focused tests and typecheck for the changed subsystem are green.

---

Codex Task

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 17fc3066-138b-4f85-9b7a-512d29d1dff1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-21T00:28:35.046784Z	946df59	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[devin-ai-integration]

Fixed in 42911c0. The shared-staging-directory guard now rejects .. segments on either separator for both staged payloads before comparing path prefixes, so a predecessor like <stageDir>\..\elsewhere\expected.xml can no longer pass startsWith while resolving outside the pinned directory. Added a regression test covering .. escapes on both payloads and both separators.