fix(claude): reject unverified picker metadata snapshots

[luvs01]

Summary

• Reject public picker CA metadata when the opened file reports a zero inode or its ctimeNs differs from the pre-open path snapshot.
• Add two fault-injection regressions that assert refusal occurs before credential access and leaves public state unchanged. Update the owning architecture contract.
• Keep the existing BigInt device/inode comparisons; those are already in dev and are not introduced by this change. Timestamp comparison narrows the accepted snapshot; it does not claim to eliminate every filesystem race.

Verification

The feature branch uses an earlier upstream ancestor. Validated after a clean integration with dev at 7af092ca4f78828238b425bf351d5989e237f89f; the integration tree exactly matches the independently prepared current-dev candidate.

• Pinned Bun 1.4.0: isolated tests/claude-integration/claude-picker-ca-store.test.ts — 25 passed, 0 failed, including both new refusal cases.
• Root typecheck, privacy:scan, structure:check and git diff --check: passed.
• Exact-head Cross-platform CI passed all four server test shards, all nine Windows test shards, the full GUI suite, typecheck and privacy scan. See run 38188952561. These CI checks were not duplicated locally; macOS test shards and live OS credential-store access were not exercised.
• Full local suites and live OS credential-store execution were not run. Independent credential-boundary review remains required before merge. CodeRabbit's initial green status reflected Draft review skipping, not a completed review.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults. Independent boundary review remains required before merge; this box stays unchecked until that review is completed.

Summary by CodeRabbit

• Bug Fixes
  • Improved safety checks for saved picker certificate data. The app now rejects metadata files with a zero file identity or changes detected between checking the file path and opening it, preventing unsafe credential updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c12633b2-5b86-4a9e-80ec-ae9f8a4fdf81

---

📥 Commits

Reviewing files that changed from the base of the PR and between 7af092c and ca691b6.

---

📒 Files selected for processing (3)

• src/claude/intercept/picker-ca-persistence.ts
• structure/clients/claude-desktop.md
• tests/claude-integration/claude-picker-ca-store.test.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

---

📝 Walkthrough

Walkthrough

Picker CA persistence now rejects a zero inode and a change in ctimeNs between the path snapshot and opened descriptor. Integration tests verify these cases are rejected before credential-store access, and the client documentation describes the checks.

Changes

Picker CA metadata identity

Layer / File(s)	Summary
Metadata identity validation and coverage src/claude/intercept/picker-ca-persistence.ts, tests/claude-integration/claude-picker-ca-store.test.ts, structure/clients/claude-desktop.md	readState rejects zero inode identities and changed ctimeNs values in addition to existing device and inode mismatches. Tests verify the unsafe metadata error, no credential-store access or additional credential writes, and unchanged metadata contents. The client documentation describes the checks.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

---

Merge Risk: ⚪ Minimal · up to ca691

No actionable merge-blocking issue remains in the supplied evidence. The independent credential-boundary review noted by the author remains outstanding.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title accurately and concisely describes the main change: rejecting picker metadata snapshots that cannot be verified. It is specific, clear, and related to the changes in the implementation, cont…
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files. (1 skipped: 1 …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.