Fix cmd.exec allowlist bypass; harden exec and logs; remove exporter mode

[skeeeon]

Security fix: merge and release promptly. Anyone able to publish to cmd.exec could run arbitrary commands on the device, whatever the allowlist said, as long as one script existed in commands.scripts_directory. This PR discloses the bug, so every deployed agent with a scripts directory stays exposed until it runs a release containing the fix. The CHANGELOG's Unreleased section is written for v0.3.1.

Ten commits, each passing on its own. They're easiest to review one at a time.

1. fix(exec): the caller's string never reaches a shell. Security.

The script check reduced the request to its last path element, confirmed a script with that name existed, and then passed the whole request to bash -c (or powershell -Command). So $(anything)/deploy.sh passed the check and ran anything. Both platforms had the same bug, because each carried its own copy of the check.

• A script request must now be a bare filename. The agent builds the path itself and starts that file directly, by its shebang on unix or with powershell -File on Windows, so no shell ever parses the request.
• An allowlisted command now runs the operator's allowlist entry, not the request. The two only had to compare equal after collapsing whitespace, so a newline could split one allowed line into two commands.
• The check now lives in one place, internal/tasks/exec.go. The platform files only say how to start a process.

2. fix(exec): a failed command returns its output, and the timeout is a real limit

• Failed commands keep their output. A non-zero exit used to reply with only "command exited with code 1", so the stderr explaining the failure never left the box. The reply keeps status: "error" and now includes output and exit_code.
• exit_code is present exactly when the command ran, 0 included.
• Timeouts return what was printed before the command was killed.
• The timeout now limits how long a reply takes. When the timeout killed a shell, a child still holding the output pipe (a sleep, say) kept the reply waiting until the child finished: a 1s timeout over sleep 5 took 5s. A script that exited normally while leaving a background process behind held the reply for as long as that process lived. cmd.WaitDelay now caps the wait at one second after the command exits or is killed.

3. fix(logs): the allowlist alone decides what cmd.logs can read

• Removed a substring denylist (sam, system32, .exe, .., …). It refused nothing the allowlist admitted, but it did block /var/log/samba/*.
• Removed a second check behind the allowlist. It only understood *, so every pattern using ? or [...] matched nothing.
• The Windows path tests could never have passed. They named files that don't exist, and the check looks at real files on disk. They now share the cross-platform test, which uses real temp files.

4. refactor(metrics): remove exporter mode

source: exporter (scraping node_exporter or windows_exporter instead of using gopsutil) was unused. Removed with it:

• the collector interface and factory, which had one implementation left
• the HTTP client only the exporter used
• the ignored ScrapeMetrics(exporterURL) parameter

Old configs still load, because the keys are ignored, and they get the same payload. A test covers this.

5. chore: strip the // ADDED: / // MODIFIED: comments

Comments only. No behaviour change.

6. fix(service): check the action before touching the service manager

Found by the Windows test run. Windows connected to the Service Control Manager before checking the action, and the SCM refuses non-admin connections, so from an ordinary shell a bogus action returned "Access is denied" instead of "invalid action". Linux and FreeBSD already checked first. The allowlist and action checks now live once, in checkServiceRequest, and run first on every platform. The three copies of isServiceAllowed are merged into that one place, which also fixes the darwin test build of internal/tasks.

7. fix(build): the stub platforms compile again, and CI keeps them honest

GetOSInfo had no stub, so the agent didn't build on a Mac at all. The stub now reports "not supported", and the health command's existing fallback answers with runtime.GOOS. CI now runs GOOS=darwin go vet ./..., because the stub files compile on no platform it was already vetting, which is how they drifted. darwin is still not a release target.

8. fix(exec): allowlisted commands run through /bin/sh on FreeBSD

FreeBSD's base system has no bash, so /bin/bash -c failed with "no such file" and every allowlisted command failed on a stock install. None of the documented FreeBSD examples need bash. FreeBSD now uses its own /bin/sh, and Linux is unchanged. TestUnixShellExists checks that the shell exists on whatever platform runs the tests.

9. fix(exec): a timeout kills everything the command started

The timeout killed only the shell or powershell.exe, so its children kept running after the reply went out.

• Linux/FreeBSD: the command gets its own process group, and cancelling kills the group.
• Windows: cancelling runs taskkill /T /F.
• Faster timeouts: killing the group also closes the output pipe immediately, so the unix timeout test now returns in 0.5s instead of 1.5s.
• Only timeouts and shutdown kill. A command that exits normally and leaves a daemon running is left alone, and the test checks both cases.

10. docs: CLAUDE.md spells makefile the way the file is named

Upgrade notes

• Full-path script requests are refused. Send deploy.sh, not /opt/agent/scripts/deploy.sh.
• cmd.exec's exit_code now appears on success and on failure. Failures also carry output.
• Windows scripts report their real exit code, not just 0 or 1.
• tasks.system_metrics.source / exporter_url are ignored.
• Log allowlists are no longer second-guessed. If you relied on the old denylist to carve pieces out of a broad allowed_log_paths pattern, narrow the pattern.

Testing

• New regression tests fail on the parent commit for the reason they exist, and pass on this branch:
  • the injection runs and leaves a marker file
  • the newline splits the allowlisted command
  • the 0.5s timeout takes 5s
  • ?, [...] and samba paths are refused
• go test -race ./... passes.
• go vet is clean on linux, windows and freebsd.
• linux/amd64, linux/arm64, windows/amd64 and freebsd/amd64 all build.
• golangci-lint findings are identical to v0.3.0.
• Windows go test ./internal/tasks/ passes from a non-admin shell as of commit 6: the exec gate, -File exit codes, the injection refusal, the log path forms and service validation. The first run caught the ordering bug that commit 6 fixes.
• Windows re-run after commit 9 passes, including TestTimeoutKillsTheProcessTree: PowerShell starts a ping child, the command times out, and the child is gone.
• GOOS=darwin go vet ./... is clean.

Found along the way

Everything this work turned up is fixed on this branch: the darwin build (commit 7), FreeBSD's missing bash (commit 8) and children outliving a timeout (commit 9).

🤖 Generated with Claude Code