diff --git a/cmd/picoclaw/internal/gateway/control.go b/cmd/picoclaw/internal/gateway/control.go index 1fd2f9481..e7d1854a3 100644 --- a/cmd/picoclaw/internal/gateway/control.go +++ b/cmd/picoclaw/internal/gateway/control.go @@ -96,9 +96,14 @@ func resolveGatewayTarget(homePath string) (*gatewayTarget, error) { return nil, fmt.Errorf("failed to find gateway process (PID: %d): %w", data.PID, err) } - err = verifyGatewayProcessIdentity(data.PID) - if err != nil { - return nil, err + // Hardening: when possible, ensure the PID file still points to a picoclaw + // gateway process before we report or signal it. Currently we only have a + // reliable, dependency-free implementation on Linux (/proc). + if runtime.GOOS == "linux" { + err = verifyGatewayProcessIdentity(data.PID) + if err != nil { + return nil, err + } } return &gatewayTarget{ diff --git a/cmd/picoclaw/internal/gateway/control_test.go b/cmd/picoclaw/internal/gateway/control_test.go index 931f39c73..ceac0f016 100644 --- a/cmd/picoclaw/internal/gateway/control_test.go +++ b/cmd/picoclaw/internal/gateway/control_test.go @@ -73,6 +73,9 @@ func TestGatewayStopCmdNotRunning(t *testing.T) { } func TestGatewayStatusCmdRejectsNonGatewayPID(t *testing.T) { + if runtime.GOOS != "linux" { + t.Skip("process identity verification is linux-only (/proc)") + } if runtime.GOOS == "windows" { t.Skip("requires POSIX signal semantics") } @@ -98,6 +101,9 @@ func TestGatewayStatusCmdRejectsNonGatewayPID(t *testing.T) { } func TestGatewayStopCmdRejectsNonGatewayPID(t *testing.T) { + if runtime.GOOS != "linux" { + t.Skip("process identity verification is linux-only (/proc)") + } if runtime.GOOS == "windows" { t.Skip("requires POSIX signal semantics") } diff --git a/cmd/picoclaw/internal/gateway/process_identity_other.go b/cmd/picoclaw/internal/gateway/process_identity_other.go index fb099ff26..099ba6569 100644 --- a/cmd/picoclaw/internal/gateway/process_identity_other.go +++ b/cmd/picoclaw/internal/gateway/process_identity_other.go @@ -2,11 +2,8 @@ package gateway -import "fmt" - func verifyGatewayProcessIdentity(processID int) error { - return fmt.Errorf( - "gateway process identity verification is not supported on this platform (PID: %d)", - processID, - ) + // Best-effort: non-Linux platforms don't have a portable, dependency-free way + // to validate /proc-style executable + argv identity. Don't block status/stop. + return nil }