Fix security issues: integer overflow, division by zero, race conditions, input validation

[Copilot]

Deep code review identified several security and reliability issues via gosec/staticcheck analysis.

Changes

Integer Overflow Prevention (cmd/grpc.go)

• Added safeIntToInt32() helper to clamp values within int32 bounds
• Applied to all gRPC response conversions (PID, port, counts)

func safeIntToInt32(v int) int32 {
    if v > math.MaxInt32 {
        return math.MaxInt32
    }
    if v < math.MinInt32 {
        return math.MinInt32
    }
    return int32(v)
}

Division by Zero (cmd/utils.go, cmd/grpc.go)

• Added zero checks before memory percentage calculations

Race Condition Fix (cmd/watch.go)

• Added sync.RWMutex to watchState struct
• Protected goroutine access to shared process data

Input Validation (cmd/grpc.go, cmd/mcp.go)

• Port range validation (1-65535)
• Max scan range limit (10,000 ports) to prevent resource exhaustion

Verification

• gosec: 0 issues (was 6)
• CodeQL: no alerts
• All existing tests pass

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• go.googlesource.com
  • Triggering command: /update-job-proxy /update-job-proxy (dns block)
• go.opentelemetry.io
  • Triggering command: /update-job-proxy /update-job-proxy (dns block)
• google.golang.org
  • Triggering command: /update-job-proxy /update-job-proxy (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Reaview for deep issues

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.