fix(tracker): avoid user enumeration when deriving client IDs

[amitksingh1490]

Post-publication blocker: automated scope expansion

At 2026-09-16 04:05 UTC, autofix.ci added commit 1b4d2b5bc after the verified one-file authored commit 8c193db2b. The remote PR now changes 140 files, not the intended one file. The bot commit alone changes 140 files (+1209/-837). In the intended tracker file its change is comment wrapping; the broad remaining changes are outside this issue's verified scope. Local validation below applies to 8c193db2b, not the expanded bot head.

Autofix run https://github.com/tailcallhq/forgecode/actions/runs/35053979857 concluded failure at the Autofix step; new-head CI is running. Maintainer guidance is needed to contain automated scope expansion before readiness. No bot reverts, force pushes, merges, or repository automation changes were made. Local durable worktree remains on the verified authored commit; bot changes were fetched for inspection only. Keep this PR draft and the board issue Blocked.

Summary

Related to #3863. Draft only — not PR Ready. The user authorized publication despite the external validation gaps below.

• Derive the telemetry client ID from HWIDComponent::SystemID only. Remove CPUCores, which invokes sysinfo 0.29.11's System::new_all() and enumerates users/groups, reaching the unsafe missing-group lookup.
• Keep the existing HMAC-SHA256 key, error context and anonymous fallback behavior. Add same-file regression tests for the safe component whitelist and ID/error compatibility.
• Only crates/forge_tracker/src/client_id/generic.rs is intended to change. No Cargo manifest/lock updates or automation changes.

Dependency investigation

Rechecked upstream GuillaumeGomez/sysinfo#1725: merged. The latest published sysinfo checked on 2026-09-16 is still 0.39.6, whose group lookup lacks the null-result check. The vulnerable dependency is forge_tracker -> machineid-rs 1.2.4 -> sysinfo 0.29.11. Forge's direct dependency separately resolves to 0.38.4; this is not a manifest/lock discrepancy, and bumping only that direct dependency would not repair the transitive path.

Telemetry identity migration

Telemetry client IDs change once for existing installations that successfully generated an ID using SystemID + CPUCores. Subsequent IDs are stable for the same SystemID and no longer depend on CPU count. The existing fallback for unreadable system IDs is unchanged. This does not migrate or alter provider credentials.

Fresh recovery validation

Recovered in durable /home/forge/worktrees/3863 and reran checks; prior results from the lost /tmp worktree were not used as a substitute. Rust stable 1.98.1 on Linux x86_64, debug/test profiles with debug info disabled and three build jobs:

• cargo +stable test --locked -p forge_tracker: 8 passed; doc-tests passed (0 tests).
• cargo insta test --accept --test-runner cargo-test -p forge_tracker with RUSTUP_TOOLCHAIN=stable: passed; no snapshot changes.
• cargo +stable clippy --locked -p forge_tracker --all-targets --no-deps -- -D warnings: passed.
• Reintroduced the pre-fix component set in an external test copy: regression fails. Linux synthetic machine-ID / getgrgid_r trap: pre-fix path exits 86, fixed tests pass. No host account or machine-ID files changed. This is not a native macOS crash reproduction.
• cargo +stable fmt -p forge_tracker -- --check and git diff --check: passed.
• cargo +stable clippy --locked --workspace --all-targets --no-deps -- -D warnings: passed, with isolated protoc/OpenSSL prerequisites.
• cargo +stable build --locked --bin forge: debug build passed. Rebuilt forge --help and forge provider login --help: passed.
• Safe -p in an empty isolated HOME/config/project: attempted with a prompt forbidding file access, commands and tools. Startup provider selection reported No such device or address (os error 6) without a terminal. The CLI returned 0 despite the error; this is not a successful model run. Credentials were not copied or exposed.

No release builds. Durable patch backup and evidence: /home/forge/issue-patches/3863/.

Outstanding checks and limitations

• Native macOS arm64 validation with a dangling primary GID is outstanding.
• A successful authenticated/configured-provider -p run is outstanding. No real credentials are copied or exposed; interactive login/provider setup requires user assistance if the isolated runtime has no provider.
• Verification explicitly uses Rust stable 1.98.1. The repository pins 1.97; 1.97.1 is now available, but this run does not establish pinned-toolchain coverage. The earlier broken-toolchain observation is no longer current.
• Workspace-wide stable formatting has an unrelated pre-existing whitespace failure in forge_main/src/info.rs, reproduced from the unchanged baseline. It is deliberately not included in this fix.
• Review latest-head CI and any autofix bot commits before readiness. The intended patch is one file; repository-wide automated changes must not be mistaken for verified scope. Repository automation is unchanged.

Do not merge or close the issue as part of this draft publication. Keep the project issue Blocked until the external checks and any CI/scope problems are resolved.

Co-Authored-By: ForgeCode noreply@forgecode.dev