feat(tci): log the process behind local TCI clients. Principle VIII. - #5130

This is an important discovery tool for TCI applications, but changes the dynamics between our Microsoft Store publication (system process data) and privacy implications for the project. Jeremy will need to rule on the approach before this can merge.

Issue fit

#5087: TCI has no client-identification message and the handshake is a bare WebSocket upgrade, so a support bundle held nothing but client connected from "::ffff:127.0.0.1". For same-machine clients the OS knows the owning process, and asking it is the only way to get that answer. Three platform implementations, each going to the primary source rather than guessing.

Verified empirically on macOS/arm64: the full AetherSDR target builds clean and tci_peer_process_test passes (0.35 s).

No blockers. One thing for @ten9876 that is not this PR's defect but lands here, and some things worth recording as correct.

Principle VII holds

/proc/net/tcp6 parsing is bounds-checked at every step — col.size() < 10 before indexing col[1], loc.size() != 2 before loc[0]/loc[1], toUShort(&ok, 16) with the ok flag actually tested rather than discarded. That is the right posture for text that could be truncated or reformatted by a kernel change.

Two details that clearly came from measurement rather than documentation, and both have their evidence in the comment:

• 26d7ebfb — QFile::symLinkTarget() absolutizes a relative-looking target, so /proc/<pid>/fd/N's raw socket:[N] comes back as /proc/<pid>/fd/socket:[N] and can never match the inode tag. Comparing by raw readlink is the fix, and "measured" in the comment is doing real work there.
• b3d25350 — real Windows executables ship Translation entries that do not match the block their strings actually live in, so trying the declared pairs plus 040904b0/000004b0 is what makes the version lookup work in practice. Preferring ProductVersion over FileVersion because that is where build metadata lives (WSJT-X's reads "3.0.1 c04dd8") is the kind of thing only a bench session tells you.

The IPv4-appears-v4-mapped-in-tcp6 note is also the right level of detail for the next person, since it explains why both files are read rather than one.

Scope

Everything is explained by #5087. No CHANGELOG.md entry — correct. The NetworkDiagnosticsDialog change is the minimum consumer — endpoint plus process name inline, exe path and version in the tooltip.

For the maintainer, not a change request

This logs third-party install paths, and redactPii() has no rule for filesystem paths. (inline: TciServer.cpp:765) The qCInfo emits exe="<full path>", every log line passes through redactPii() (AsyncLogWriter.cpp:122), and that function covers IPv4, radio serials, auth tokens, first_name/last_name-style fields, GPS coordinates and MAC addresses — not paths.

I checked whether this is new exposure before writing it up, and it mostly is not: QsoRecorder, CatPort, EibiClient, ThemeManager and others already log paths that sit under the user's home, so the redactor has never covered this and the practice is established. So I am not asking you to change anything here.

What is new is the source. Until now the app logged its own paths; this logs the install path of whatever else is running on the machine, and on Windows a per-user install is routinely C:\Users\<name>\AppData\Local\…. Given redactPii() exists because of GHSA-ccrg-j8cp-qhc4 and already trims a MAC to its last octet, an OS username arriving by a new route seems worth a deliberate yes or no rather than arriving as a side effect. A homePath()-prefix rule in redactPii() would cover this and the pre-existing sites together — that is a separate issue, and I would rather it were filed than folded in here.

Nits

• resolveLoopbackPeerProcess() reads /proc/*/fd for every PID until it finds the inode. For processes owned by another user that fails with EACCES per-entry, which is correct and silent — worth one line saying so, since a reader wondering why there is no permission check deserves the answer.
• The macOS path walks proc_listpids then PROC_PIDLISTFDS per process. Same shape, same cost, and it runs once per connection rather than per message, so no concern — noting only that a machine with many processes pays it on every TCI connect.

Verified vs. read

Built and ran: the full app target and tci_peer_process_test. Traced: redactPii()'s full rule set and its application point, plus the existing path-logging sites that establish the practice. Read: the /proc parser bounds and the fd-comparison fix. Not verified: no Linux or Windows host here, so the /proc walk, the GetExtendedTcpTable path and the StringFileInfo block fallback all rest on your measurements — and those are the three that could not have been reasoned out.

Issue fit

#5087 asks for the owning local process (name, exe, best-effort version) behind each loopback TCI connection, resolved by the OS, degrading to today's line on any failure. The diff does that on all three platforms, off the accept path, with the two changes from the 2026-09-07 ruling applied (exe= out of the log, macOS sweep limited to this uid). Verified on Linux (this review's build, Arch, Qt 6.10): a v4 loopback client, a ::1 client and the in-process bridge client all resolve about 20 ms after connect, the Network Diagnostics cell reads 127.0.0.1:44268 (python3), and 45 rapid connect/close cycles plus a quit with lookups in flight produced no crash and an orderly shutdown trace.

No merge blockers by the rubric (nothing breaks users, violates canon, or fails on main). Two reproduced defects in the feature's own purpose are cheap to fix and I would want them in before merge; they are inline with suggestions.

Test-boundary preflight

The net diff adds no test and touches neither tests.cmake nor any socket-owning source. The branch's own tci_peer_process_test (self-connected QTcpServer) was added and then removed in 9476eb04 before reaching main, so nothing gated execution. Noting the removal here per AGENTS.md; reviewed normally.

Scope

All 12 commits are dated 2026-08-21 to 2026-09-08 and every message names #5087. No CHANGELOG entry (correct). Nothing removed on the - side except the dialog's plain endpoint text, which nothing else read (the alias key is UserRole on column 0). New public surface: none (no protocol verb, no settings key). The body's checklist holds.

Findings (reproduced, non-blocking, fix recommended)

1. A stale TIME_WAIT row with the same local port aborts the Linux lookup (inline: TciPeerProcess.cpp:100, same shape on Windows at :373/:392). findSocketInode() returns the first row whose local endpoint matches and resolveLinux() treats inode == 0 as terminal, but a TIME_WAIT/orphaned row for that port carries inode 0 and can precede the live row. Reproduced 6/6 on this box with a client that reused its source port for a second local connection:

port 40501 rows for local port in /proc/net/tcp (order as listed):
  local 0100007F:9E35 rem 0100007F:C3D3 st 06 inode 0
  local 0100007F:9E35 rem 0100007F:C3D2 st 01 inode 1222178

Those six connections were held 1.5 s each (the lookup takes ~20 ms) and logged client connected from but never a process= line; 39 connect lines total, 3 identity lines. Skipping zero-inode rows (continue instead of return) fixes it; on Windows the analogue is dwOwningPid == 0 for TIME_WAIT rows (reasoned from the API, not run — no Windows host here).

2. A 4-part authored version string is masked by the log sanitizer (inline: TciServer.cpp:772, comment at TciPeerProcess.cpp:310). The IPv4 rule's exemption is the literal lookbehind (?<!ver=); version=" does not satisfy it. Run against the rule at AsyncLogWriter.cpp:274:

version="3.0.1 c04dd8"  -> version="3.0.1 c04dd8"   (survives)
version="2.2.159.0"     -> version="*.*.*. 0"       (JTDX-style ProductVersion)
version="4.2.6.0"       -> version="*.*.*. 0"

So the comment's "authored strings are not [masked]" holds only for non-quad strings; any Windows client whose ProductVersion is a dotted quad (common) logs version="*.*.*. 0" in the bundle, which is the symptom the PR set out to remove. docs/log-redaction.md:54 lists "software version (including 4-part build numbers)" under Deliberately NOT redacted, so the right-depth fix is one more lookbehind in AsyncLogWriter.cpp:274 ((?<!ver=)(?<!version=")) plus a case in tests/async_log_writer_test.cpp next to the existing software_ver= one. Renaming the field will not do it: the lookbehind needs ver= immediately before the digits.

Nits (non-blocking)

• The tcp6-first comment describes the wrong row (inline TciPeerProcess.cpp:82). The client's own AF_INET socket lives in /proc/net/tcp; it is our accepted socket that appears v4-mapped in tcp6. Observed live: client 0100007F:A9D0 only in tcp, the FFFF00000100007F:C3D2 row in tcp6 is ours. The code works via the fall-through; the comment invites someone to drop the second file.
• parseProcNetAddress is little-endian-host-only (inline :62). qFromBigEndian<quint32>(w) and a memcpy of the native word say what the kernel actually printed and are correct on both endiannesses. Low practical impact.
• "Same-user only" is enforced in code on macOS only. On Linux it is a side effect of unprivileged readlink; an AetherSDR run as root or with CAP_SYS_PTRACE resolves other users' clients, and an elevated Windows process can open other sessions' processes. Worth one honest clause in the body's What is collected paragraph, or a st_uid == getuid() check before the fd walk if the guarantee is meant literally.
• docs/log-redaction.md "Deliberately NOT redacted" does not list the new process=/version= fields; one bullet citing #5087 and the ruling keeps a future redaction rule from silently eating them.
• info.name is client-controlled (/proc/<pid>/comm via prctl(PR_SET_NAME)) and is spliced into a .noquote() line; a name containing " or \n can forge a record. Same-user process, so bounded; escaping quotes/control characters closes it.
• dpkg sweep per connect. Every loopback connect re-reads all /var/lib/dpkg/info/*.list (thousands of files) on the global QtConcurrent pool. A static QHash<QString,QString> keyed by exe path (mtime-invalidated) bounds it to once per client binary.
• Main has moved under the base: origin/main now has TciServer::clientStateFor(QWebSocket*) and disconnectSnapshot(). The lambda's hand-rolled m_clients scan becomes a second copy of the helper after merge, and the disconnect snapshot will not carry processName/processVersion. Merge is conflict-free; consider folding both in.
• Squash message: the PR title is 79 characters and lacks the Principle <N>. suffix AGENTS.md asks for; the merger can trim it.

What I verified vs. read

Built and drove the PR head (9476eb04) in a scratch worktree, offscreen, isolated AETHER_SETTINGS_DIR, connected to the built-in demo DEMO-0001 ("AetherSDR Demo", family sim), TCI server on port 50130, AETHER_AUTOMATION_NO_TX=1. Clients: a bare-upgrade Python WebSocket client over 127.0.0.1 and ::1, and the bridge's in-process tci start sim (resolves to process="AetherSDR"). Read back via the file log and a grab of the Network Diagnostics TCI Clients page. Tried and held: 30 zero-hold connect/close cycles twice (guard path, no crash, no line for gone sockets); quit with 15 lookups in flight (phase=application event=complete); v6 and v4-mapped matching in sameHost; the /proc/net/tcp column layout. Read only: the macOS and Windows backends, the StringFileInfo block fallback, and the uid filter — no host here, so those rest on the author's bundles. Not testable here: the dpkg path (Arch), and the root/CAP_SYS_PTRACE case.

One observation for the maintainer rather than the author: aether.cat defaults to QtWarningMsg (LogManager.cpp:26), so on a fresh store neither the existing client connected from line nor the new identity line reaches the log until the operator enables the "TCI / CAT / rigctld" category. Pre-existing, and #5087's own bundle evidently had it on, but it bounds how often this lands in a bundle unasked.

Automated pass (/code-review, medium) ran; findings above that came from it were each re-verified here, the rest dropped.

Instance driven: my own offscreen PR build against the demo simulator only; closed at the end of the session.

— Claude Code review on behalf of @ten9876

Approved at 7ff41b5e

Second pass on the fixed head. Everything from the 2026-09-10 review landed in one commit on top of a clean merge of origin/main, and each item was re-verified on a fresh build against the built-in demo simulator (offscreen, isolated settings, TX pinned off):

• TIME_WAIT reuse: the same six source-port-reuse connections that resolved 0/6 before now resolve 6/6.
• 4-part versions: async_log_writer_test passes with the new version="…" exemption case; the quoted-IP-still-redacted case is unchanged.
• Name escaping: a client with comm set to x"\nINF forged logs as one field on one line.
• Address spelling: the ::1 client logs as 127.0.0.1:<port>, matching the Network Diagnostics cell.
• v4, ::1 and the in-process bridge client still resolve in ~20 ms; quit with lookups in flight shuts down cleanly.

All review threads are resolved with a note on what landed. The stale pending-ruling block from before the 2026-09-07 ruling is dismissed. macOS and Windows backends compile in CI; their runtime behaviour rests on the author's three-platform bundles.