Merge pull request #58 from doublegate/copilot/sub-pr-57

Apply PR review feedback and fix fuzz workflow errors

Author: doublegate

Cargo.toml

@@ -32,10 +32,11 @@ members = [
 
 # Excluded: wraith-xdp requires eBPF toolchain; spectre-implant is no_std with
 # custom #[panic_handler] and #[global_allocator] incompatible with workspace
-# feature unification (std linked through shared deps)
+# feature unification (std linked through shared deps); fuzz/ is cargo-fuzz managed
 exclude = [
     "crates/wraith-xdp",
     "clients/wraith-redops/spectre-implant",
+    "fuzz",
 ]
 
 [workspace.package]

clients/wraith-redops/spectre-implant/src/modules/shell.rs

@@ -92,7 +92,7 @@ impl Shell {
                 let envp = [core::ptr::null()];
 
                 sys_execve(sh.as_ptr(), argv.as_ptr(), envp.as_ptr());
-                // Zeroize in all cases (only reached if execve fails, but ensures cleanup)
+                // Zeroize if execve returns (on failure); on success the process image is replaced and cmd_c is discarded.
                 cmd_c.zeroize();
                 sys_exit(1);
             } else {

crates/wraith-ffi/src/session.rs

@@ -42,7 +42,7 @@ pub unsafe extern "C" fn wraith_session_establish(
         return WraithErrorCode::InvalidArgument as c_int;
     }
 
-    // SAFETY: peer_id null check performed above (line 31).
+    // SAFETY: peer_id was checked for null earlier in this function.
     // Caller must ensure peer_id points to valid, properly aligned WraithNodeId.
     // This is documented in the function's safety contract.
     let peer_id_bytes = (*peer_id).bytes;

crates/wraith-ffi/src/transfer.rs

@@ -50,7 +50,7 @@ pub unsafe extern "C" fn wraith_transfer_send_file(
         error_out
     );
 
-    // SAFETY: peer_id null check performed above (line 34).
+    // SAFETY: peer_id was checked for null in the argument validation above.
     // Caller must ensure peer_id points to valid, properly aligned WraithNodeId.
     // This is documented in the function's safety contract.
     let peer_id_bytes = (*peer_id).bytes;