[WRONG BRANCH] fix(security): harden sidebar gh resolution

[luvs01]

Motivation

• Prevent path/PATHEXT hijacking where opening the GUI could execute a malicious gh planted in the project or caller PATH.

Description

• Replace the unsafe bare gh spawn with a resolver that only accepts gh from fixed, absolute install roots and returns null when none are found, implemented in src/github/star-state.ts.
• Launch the resolved gh from the user's home directory with a sanitized PATH so automated sidebar polls cannot search the project or caller-controlled PATH.
• Reuse the existing commandInvocation logic for cross-platform .cmd/.exe handling and preserve existing timeouts and output-suppression behavior.
• Add regression coverage in tests/sidebar-star-state.test.ts proving untrusted POSIX and relative Windows search locations are ignored.

Testing

• Ran bun test tests/sidebar-star-state.test.ts and the new POSIX/Windows resolution tests passed (14 passes, 0 fails).
• Ran bun run typecheck which completed successfully.
• Ran the full test suite with bun run test; the sidebar-focused changes did not cause regressions but a pre-existing unrelated service diagnostics expectation failed during a full run (investigation outside this patch).
• Committed the change as fix(security): harden sidebar gh resolution after the focused tests and typecheck passed.

---

Codex Task

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev. UI screenshot required.

What to do

• Retarget this PR to dev — all contributions go to dev.
• Add a screenshot of the UI change to the PR description.

Its title has been prefixed with [WRONG BRANCH].
This pull request is being kept as a draft automatically. Once every issue above is resolved, it will be marked ready for review again.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: c67f8915-6a85-43bb-aa3c-9eafddb855b6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}