Skip to content

fix(mdm): detect logged-in console user when running as root#20

Merged
ashishkurmi merged 3 commits intostep-security:mainfrom
shubham-stepsecurity:sm/feat/migrate
Apr 15, 2026
Merged

fix(mdm): detect logged-in console user when running as root#20
ashishkurmi merged 3 commits intostep-security:mainfrom
shubham-stepsecurity:sm/feat/migrate

Conversation

@shubham-stepsecurity
Copy link
Copy Markdown
Member

What does this PR do?

Type of change

  • Bug fix
  • Enhancement
  • Documentation

Testing

  • Tested on macOS (version: ___)
  • Binary runs without errors: ./stepsecurity-dev-machine-guard --verbose
  • JSON output is valid: ./stepsecurity-dev-machine-guard --json | python3 -m json.tool
  • No secrets or credentials included
  • Lint passes: make lint
  • Tests pass: make test

Related Issues

Copy link
Copy Markdown

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR improves macOS behavior when the agent runs as root (e.g., via LaunchDaemon) by detecting the logged-in console user and using that identity/home directory for scans and configuration.

Changes:

  • Add Executor.LoggedInUser() (console user detection via /dev/console on macOS when root) and use it to resolve $HOME and developer identity.
  • Update enterprise Node scanning to optionally delegate package-manager commands to the logged-in user.
  • Update launchd installation to bake HOME into the generated plist when running as root; also adds timestamps to progress/error log lines.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 7 comments.

Show a summary per file
File Description
internal/executor/executor.go Adds LoggedInUser() implementation for macOS root console-user detection.
internal/executor/mock.go Adds mock LoggedInUser() implementation.
internal/telemetry/telemetry.go Uses LoggedInUser() for $HOME resolution and passes logged-in username into Node scanner.
internal/scan/scanner.go Uses LoggedInUser() for $HOME resolution in community scans.
internal/device/device.go Uses LoggedInUser() for developer identity fallback.
internal/detector/aicli.go Uses LoggedInUser() for tilde expansion home directory.
internal/detector/nodescan.go Adds user-delegated execution path for Node package manager commands.
internal/launchd/launchd.go Injects HOME env var into LaunchDaemon plist when a user home is resolved.
internal/progress/progress.go Prepends timestamps to progress/error log lines.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread internal/detector/nodescan.go
Comment thread internal/progress/progress.go
Comment thread internal/executor/executor.go
Comment thread internal/telemetry/telemetry.go Outdated
Comment thread internal/detector/nodescan.go Outdated
Comment thread internal/detector/nodescan.go
Comment thread internal/detector/nodescan.go
@ashishkurmi ashishkurmi merged commit 7263c43 into step-security:main Apr 15, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants