fix(gui): expire single-use GUI intent tokens after 30s (#54612)

### What does this PR do?

Gives the single-use GUI "intent token" (used by `agent launch-gui` and the systray Configure action to bootstrap a GUI session) a 30 second TTL instead of letting it stay valid indefinitely until first use.

### Motivation

Security finding [VULN-92705](https://datadoghq.atlassian.net/browse/VULN-92705): `launch-gui` (and the Windows systray Configure path) pass the intent token to the OS URL-opener (`xdg-open`/`open`/`rundll32`) as part of a URL query string. That URL lands in the opener's argv, and via the browser process it spawns can remain visible there for a much longer time — readable by any co-resident local user via `/proc/<pid>/cmdline` on hosts where `hidepid` isn't set. `/auth?intent=` performs no caller-identity check, so whoever presents a valid intent token first is granted the (by default never-expiring) `accessToken` session cookie.

Intent tokens previously had no expiration and remained valid in memory until first use, leaving an unbounded window for this argv-leak race. This change bounds that window to 30 seconds, which is generous for normal browser-launch latency while meaningfully limiting the exploitable exposure. (The token remains single-use regardless of outcome — an expired token is still consumed on presentation, closing any residual re-use race.)

### Describe how you validated your changes

- Added unit tests in `comp/core/gui/impl/gui_test.go` covering: valid unexpired token grants access, expired token is rejected *and* consumed, a token cannot be redeemed twice, and expired entries are purged from the map when a new token is issued.
- `dda inv test --targets=./comp/core/gui/impl/...` and `bazel test //comp/core/gui/impl:impl_test` pass.
- `dda inv linter.go --targets=./comp/core/gui/impl/...` passes.
- Built the agent locally (`dda inv agent.build`) to confirm `launch-gui` still compiles end-to-end.

### Additional Notes

No release note: this is an internal hardening change with no user-facing behavior change (the GUI login flow is unaffected under normal use; only the far edge case of a stale, un-redeemed launch attempt now expires after 30s instead of forever).

[VULN-92705]: https://datadoghq.atlassian.net/browse/VULN-92705?atlOrigin=eyJpIjoiNWRkNTljNzYxNjVmNDY3MDlhMDU5Y2ZhYzA5YTRkZjUiLCJwIjoiZ2l0aHViLWNvbS1KU1cifQ

Co-authored-by: louis.coquerelle <louis.coquerelle@datadoghq.com>

Author: louis-cqrl

comp/core/gui/impl/BUILD.bazel

@@ -71,6 +71,7 @@ dd_agent_go_test(
         "agent_test.go",
         "auth_test.go",
         "checks_test.go",
+        "gui_test.go",
         "platform_darwin_test.go",
         "platform_nix_test.go",
         "platform_windows_test.go",

comp/core/gui/impl/gui.go

@@ -41,6 +41,12 @@ import (
 	"github.com/DataDog/datadog-agent/pkg/util/system"
 )
 
+// intentTokenTTL bounds how long a single-use intent token stays valid. Intent
+// tokens are handed to the OS URL-opener as part of a query string and can end
+// up exposed in a child process's argv (e.g. /proc/<pid>/cmdline); a short TTL
+// limits how long that exposure is exploitable.
+const intentTokenTTL = 30 * time.Second
+
 type gui struct {
 	logger log.Component
 
@@ -49,7 +55,7 @@ type gui struct {
 	router   *http.ServeMux
 
 	auth         authenticator
-	intentTokens map[string]bool
+	intentTokens map[string]time.Time // token -> expiration time
 	intentMu     sync.Mutex
 
 	sysprobeConfig sysprobeconfig.Component
@@ -112,7 +118,7 @@ func NewComponent(deps Requires) Provides {
 	g := gui{
 		address:        net.JoinHostPort(guiHost, guiPort),
 		logger:         deps.Log,
-		intentTokens:   make(map[string]bool),
+		intentTokens:   make(map[string]time.Time),
 		sysprobeConfig: deps.SysprobeConfig,
 	}
 
@@ -195,10 +201,21 @@ func (g *gui) getIntentToken(w http.ResponseWriter, _ *http.Request) {
 	token := base64.RawURLEncoding.EncodeToString(key)
 	g.intentMu.Lock()
 	defer g.intentMu.Unlock()
-	g.intentTokens[token] = true
+	g.purgeExpiredIntentTokensLocked()
+	g.intentTokens[token] = time.Now().Add(intentTokenTTL)
 	w.Write([]byte(token))
 }
 
+// purgeExpiredIntentTokensLocked removes expired intent tokens. Callers must hold intentMu.
+func (g *gui) purgeExpiredIntentTokensLocked() {
+	now := time.Now()
+	for token, expiresAt := range g.intentTokens {
+		if now.After(expiresAt) {
+			delete(g.intentTokens, token)
+		}
+	}
+}
+
 func (g *gui) renderIndexPage(w http.ResponseWriter, _ *http.Request) {
 	data, err := templatesFS.ReadFile("views/templates/index.tmpl")
 	if err != nil {
@@ -270,15 +287,14 @@ func (g *gui) getAccessToken(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	g.intentMu.Lock()
-	_, ok := g.intentTokens[intentToken]
-	if !ok {
-		g.intentMu.Unlock()
+	expiresAt, ok := g.intentTokens[intentToken]
+	// Remove single use token from map (atomic with validation), whether or not it's expired
+	delete(g.intentTokens, intentToken)
+	g.intentMu.Unlock()
+	if !ok || time.Now().After(expiresAt) {
 		http.Error(w, "invalid intentToken", http.StatusUnauthorized)
 		return
 	}
-	// Remove single use token from map (atomic with validation)
-	delete(g.intentTokens, intentToken)
-	g.intentMu.Unlock()
 
 	// generate accessToken
 	accessToken := g.auth.GenerateAccessToken()

comp/core/gui/impl/gui_test.go

@@ -0,0 +1,88 @@
+// Unless explicitly stated otherwise all files in this repository are licensed
+// under the Apache License Version 2.0.
+// This product includes software developed at Datadog (https://www.datadoghq.com/).
+// Copyright 2026-present Datadog, Inc.
+
+package guiimpl
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_getAccessToken_intentTokenExpiry(t *testing.T) {
+	g := &gui{
+		auth:         newAuthenticator("test-auth-token", time.Hour),
+		intentTokens: make(map[string]time.Time),
+	}
+
+	t.Run("valid unexpired token grants access", func(t *testing.T) {
+		g.intentMu.Lock()
+		g.intentTokens["valid"] = time.Now().Add(time.Minute)
+		g.intentMu.Unlock()
+
+		req := httptest.NewRequest(http.MethodGet, "/auth?intent=valid", nil)
+		rr := httptest.NewRecorder()
+		g.getAccessToken(rr, req)
+
+		assert.Equal(t, http.StatusFound, rr.Code)
+	})
+
+	t.Run("expired token is rejected and consumed", func(t *testing.T) {
+		g.intentMu.Lock()
+		g.intentTokens["expired"] = time.Now().Add(-time.Second)
+		g.intentMu.Unlock()
+
+		req := httptest.NewRequest(http.MethodGet, "/auth?intent=expired", nil)
+		rr := httptest.NewRecorder()
+		g.getAccessToken(rr, req)
+
+		assert.Equal(t, http.StatusUnauthorized, rr.Code)
+
+		g.intentMu.Lock()
+		_, stillPresent := g.intentTokens["expired"]
+		g.intentMu.Unlock()
+		assert.False(t, stillPresent, "an expired token must still be consumed on use, closing any reuse race")
+	})
+
+	t.Run("token cannot be redeemed twice", func(t *testing.T) {
+		g.intentMu.Lock()
+		g.intentTokens["single-use"] = time.Now().Add(time.Minute)
+		g.intentMu.Unlock()
+
+		g.getAccessToken(httptest.NewRecorder(), httptest.NewRequest(http.MethodGet, "/auth?intent=single-use", nil))
+
+		rr := httptest.NewRecorder()
+		g.getAccessToken(rr, httptest.NewRequest(http.MethodGet, "/auth?intent=single-use", nil))
+		assert.Equal(t, http.StatusUnauthorized, rr.Code)
+	})
+}
+
+func Test_getIntentToken_setsExpiryAndPurgesStale(t *testing.T) {
+	g := &gui{
+		intentTokens: make(map[string]time.Time),
+	}
+	g.intentTokens["stale"] = time.Now().Add(-time.Minute)
+
+	rr := httptest.NewRecorder()
+	g.getIntentToken(rr, httptest.NewRequest(http.MethodGet, "/gui/intent", nil))
+
+	require.Equal(t, http.StatusOK, rr.Code)
+	token := rr.Body.String()
+	require.NotEmpty(t, token)
+
+	g.intentMu.Lock()
+	defer g.intentMu.Unlock()
+
+	_, staleStillPresent := g.intentTokens["stale"]
+	assert.False(t, staleStillPresent, "expired intent tokens should be purged whenever a new one is issued")
+
+	expiresAt, ok := g.intentTokens[token]
+	require.True(t, ok)
+	assert.WithinDuration(t, time.Now().Add(intentTokenTTL), expiresAt, 2*time.Second)
+}