omc CLI, 훅, MCP 서버, HUD 전반에 걸친 Windows 실행 파일 검색 강화

# Windows Bare-Name Executable Hijacking Audit

## Threat Model

On Windows, when a process spawns a command by bare name (e.g. `spawn('git', ...)`) with `cwd` set to a project directory, the OS search order includes the **current directory** by default. An attacker who can drop a file into the project (e.g. via a malicious dependency, a cloned repo, or a compromised build artifact) can plant `git.exe`, `git.cmd`, `git.bat`, or `git.com` and have it executed instead of the real binary. This is CWE-426 (Untrusted Search Path) / CWE-427 (Uncontrolled Search Path Element).

The mitigation is the `NoDefaultCurrentDirectoryInExePath` environment variable: when set to `1`, `CreateProcess` (and thus `cmd.exe` / `ShellExecute` paths used by Node's `spawn`) no longer searches the current directory for bare-name executables. Because Windows environment variables are case-insensitive but Node's `process.env` is a plain object, we must drop **all case variants** before setting the canonical name, otherwise a pre-existing `nodefaultcurrentdirectoryinexepath=0` could shadow our `1`.

## Findings

### Entry points that spawn bare-name commands with project cwd

| Location | Spawn | cwd | env | Risk |
|---|---|---|---|---|
| `src/cli/index.ts` | `git`, `node`, `npm` | project root | inherits `process.env` | **High** |
| `src/cli/commands/install.ts` | `npm`, `pnpm`, `yarn` | project root | inherits | **High** |
| `src/hooks/runner.ts` | user hook command via `shell: true` | project root | inherits | **High** |
| `src/mcp/server.ts` | `npx`, `node` for MCP stdio servers | project root | inherits | **High** |
| `src/daemon/background.ts` | `node` for worker | project root | **built without `process.env`** | **Critical** |
| `src/utils/git.ts` | `git` | project root | inherits | **High** |
| `src/utils/exec.ts` | generic `exec`/`spawn` wrapper | caller-supplied | caller-supplied | **Medium** (depends on caller) |

The daemon is the worst offender: it constructs a minimal env (`{ PATH, HOME, ... }`) and passes it to `spawn('node', ...)`, so even if the parent process had hardened `process.env`, the child would not inherit the fix.

## Fix

### `src/utils/windows-search.ts`

```ts
import { platform } from 'node:os';

const KEY = 'NoDefaultCurrentDirectoryInExePath';

/**
 * Harden the current process against Windows bare-name executable hijacking
 * by ensuring NoDefaultCurrentDirectoryInExePath=1 is present in process.env.
 *
 * Windows env vars are case-insensitive, but process.env is a plain object,
 * so we must remove every case variant before setting the canonical key.
 * No-op on non-Windows platforms.
 */
export function hardenWindowsExeSearch(): void {
  if (platform() !== 'win32') return;
  for (const k of Object.keys(process.env)) {
    if (k.toLowerCase() === KEY.toLowerCase()) {
      delete process.env[k];
    }
  }
  process.env[KEY] = '1';
}

/**
 * Return a hardened copy of the given env object (or process.env if omitted).
 * The input is not mutated. No-op on non-Windows platforms.
 */
export function childEnv(env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
  if (platform() !== 'win32') return { ...env };
  const out: NodeJS.ProcessEnv = {};
  for (const [k, v] of Object.entries(env)) {
    if (k.toLowerCase() === KEY.toLowerCase()) continue;
    out[k] = v;
  }
  out[KEY] = '1';
  return out;
}
```

### Wiring

Call `hardenWindowsExeSearch()` immediately after imports in every entry point:

- `src/cli/index.ts`
- `src/cli/commands/install.ts`
- `src/hooks/runner.ts`
- `src/mcp/server.ts`
- `src/daemon/background.ts`
- `src/utils/git.ts` (defensive; also imported by CLI)
- `src/utils/exec.ts` (defensive)

Wrap spawns whose env is built without `process.env` in `childEnv()`:

```ts
// src/daemon/background.ts
import { hardenWindowsExeSearch, childEnv } from '../utils/windows-search.js';
hardenWindowsExeSearch();

const env = childEnv({ PATH: process.env.PATH, HOME: process.env.HOME });
spawn('node', [workerPath], { cwd: projectRoot, env, stdio: 'inherit' });
```

For `shell: true` spawns in the hook runner, `childEnv()` is sufficient because `cmd.exe` honors `NoDefaultCurrentDirectoryInExePath` for the commands it resolves.

`cwd` is left unchanged everywhere — the fix is purely environmental.

## Tests

### `test/windows-search.test.ts`

```ts
import { describe, it, expect, beforeEach, afterEach } from 'vitest';
import { mkdtempSync, copyFileSync, writeFileSync, rmSync } from 'node:fs';
import { tmpdir } from 'node:os';
import { join } from 'node:path';
import { spawnSync } from 'node:child_process';
import { hardenWindowsExeSearch, childEnv } from '../src/utils/windows-search.js';

const isWin = process.platform === 'win32';

describe.skipIf(!isWin)('windows-search hardening', () => {
  let dir: string;
  beforeEach(() => {
    dir = mkdtempSync(join(tmpdir(), 'zzprobe-'));
    // Plant a hostile zzprobe.exe (copy of hostname.exe) and zzprobe.cmd
    const hostname = join(process.env.SystemRoot!, 'System32', 'hostname.exe');
    copyFileSync(hostname, join(dir, 'zzprobe.exe'));
    writeFileSync(join(dir, 'zzprobe.cmd'), '@echo HIJACKED\r\n');
  });
  afterEach(() => rmSync(dir, { recursive: true, force: true }));

  it('blocks zzprobe.exe from cwd when hardened', () => {
    hardenWindowsExeSearch();
    const r = spawnSync('zzprobe', [], { cwd: dir, env: childEnv(), encoding: 'utf8' });
    expect(r.error || r.status !== 0).toBeTruthy();
  });

  it('blocks zzprobe.cmd from cwd when hardened', () => {
    hardenWindowsExeSearch();
    const r = spawnSync('zzprobe', [], { cwd: dir, env: childEnv(), shell: true, encoding: 'utf8' });
    expect(r.stdout).not.toContain('HIJACKED');
  });

  it('childEnv strips all case variants and sets canonical key', () => {
    const env = childEnv({ nodefaultcurrentdirectoryinexepath: '0', PATH: 'x' });
    const keys = Object.keys(env).filter(k => k.toLowerCase() === 'nodefaultcurrentdirectoryinexepath');
    expect(keys).toEqual(['NoDefaultCurrentDirectoryInExePath']);
    expect(env.NoDefaultCurrentDirectoryInExePath).toBe('1');
  });
});
```

### `test/entry-points-lint.test.ts`

```ts
import { describe, it, expect } from 'vitest';
import { readFileSync } from 'node:fs';
import { join } from 'node:path';

const ENTRY_POINTS = [
  'src/cli/index.ts',
  'src/cli/commands/install.ts',
  'src/hooks/runner.ts',
  'src/mcp/server.ts',
  'src/daemon/background.ts',
  'src/utils/git.ts',
  'src/utils/exec.ts',
];

describe('entry points call hardenWindowsExeSearch()', () => {
  for (const file of ENTRY_POINTS) {
    it(file, () => {
      const src = readFileSync(join(process.cwd(), file), 'utf8');
      expect(src).toMatch(/from ['"].*windows-search(\.js)?['"]/);
      expect(src).toMatch(/hardenWindowsExeSearch\(\)/);
    });
  }
});
```

## Notes

- The `zzprobe.exe` test relies on `hostname.exe` being present in `System32`; it is on every supported Windows version. The `.cmd` test uses `shell: true` because `.cmd` files are only resolved through `cmd.exe`.
- `childEnv()` returns a fresh object even on non-Windows so callers can safely mutate it without touching `process.env`.
- The lint test is intentionally textual rather than AST-based to keep it dependency-free; it will catch a removed import or a removed call, which is the regression we care about.
- No `cwd` values were changed; the hardening is entirely via environment.