fix(security): address review findings in build_run and monitor_helper

- build_run.py: subtract 1s tolerance from build_start before comparing
  mtime to prevent false-positive rejection on filesystems with 1-second
  mtime granularity when the build completes in under one second
- monitor_helper.py: use wmic to verify process CommandLine on Windows
  instead of unconditionally returning True; use os.path.realpath on both
  sides of the log-path confinement check to block symlink-based escapes

Author: shiliu-yang

skills/tuyaopen/debug-helper/scripts/monitor_helper.py

@@ -118,7 +118,12 @@ def _is_running(pid):
 def _is_monitor_process(pid):
     """Verify PID belongs to a tos.py monitor process to avoid killing unrelated processes."""
     if sys.platform == "win32":
-        return True  # tasklist presence check in _is_running is sufficient on Windows
+        result = subprocess.run(
+            ["wmic", "process", "where", f"ProcessId={pid}", "get", "CommandLine"],
+            capture_output=True, text=True,
+        )
+        cmdline = result.stdout
+        return "tos.py" in cmdline and "monitor" in cmdline
     try:
         with open(f"/proc/{pid}/cmdline", "rb") as f:
             cmdline = f.read().replace(b"\x00", b" ").decode("utf-8", errors="replace")
@@ -154,8 +159,8 @@ def cmd_start(port, log_file, as_json):
         ts = datetime.datetime.now().strftime("%Y%m%d_%H%M%S")
         log_file = os.path.join(SESSION_DIR, f"{ts}.log")
     else:
-        abs_log = os.path.abspath(log_file)
-        abs_session = os.path.abspath(SESSION_DIR)
+        abs_log = os.path.realpath(os.path.abspath(log_file))
+        abs_session = os.path.realpath(os.path.abspath(SESSION_DIR))
         if not abs_log.startswith(abs_session + os.sep):
             _out({"ok": False, "error": "Log file must be within .target_logging/ directory"}, as_json)
             sys.exit(1)

skills/tuyaopen/dev-loop/scripts/build_run.py

@@ -70,7 +70,7 @@ def main():
         print("[ERROR] No executable found in dist/ or .build/bin/")
         sys.exit(1)
 
-    if os.path.getmtime(binary) < build_start:
+    if os.path.getmtime(binary) < build_start - 1.0:
         print(f"[ERROR] Binary '{binary}' predates this build — possible stale or injected file.")
         sys.exit(1)