Env names in reload diff; monitor shows last VRAM check result; harden control channel against floods

- diffConfig reports the env var names (from new struct tags) instead of
  Go field names, so the reload-env reply names what the user can change
- the monitor's GPU line now shows the game detector's last finding
  (external holders or none) and how long ago the check ran
- control channel: 10s per-connection watchdog (abortive force-close),
  cap of 32 concurrent connections, reload-env rate-limited; command
  read was already capped at 4 KiB

internal/control/control.go

@@ -7,6 +7,13 @@
 // triggers, so the worst a local user can cause is a cheap, throttled
 // check and a GPU-idle-gated restart onto a signed binary.
 //
+// Abuse hardening: the command read is capped (4 KiB), each connection is
+// force-closed after connTimeout so a stalled client cannot pin a goroutine
+// (or a Windows pipe instance) forever, and concurrently served connections
+// are capped at maxConns — beyond that, connections are closed on arrival.
+// On Windows the pipe's ACL additionally denies network logons, so the
+// channel cannot be reached from another machine.
+//
 // Protocol: the client writes one command line, the server answers with
 // one reply line ("OK ..." or "ERR ...") and hangs up.
 package control
@@ -17,6 +24,7 @@ import (
 	"fmt"
 	"io"
 	"strings"
+	"time"
 )
 
 // CmdUpdateNow asks the service to check for, stage and (once the GPU is
@@ -37,9 +45,50 @@ var ErrUnavailable = errors.New("control channel unavailable")
 // line. It must start with "OK " or "ERR ".
 type Handler func(cmd string) string
 
+// connTimeout bounds one connection's lifetime: a client that stops
+// mid-command or never reads the reply would otherwise pin its goroutine
+// (and on Windows one of the pipe instances) indefinitely. A var so tests
+// can shrink it.
+var connTimeout = 10 * time.Second
+
+// maxConns caps concurrently served connections; beyond it, new
+// connections are closed on arrival. Bound on the goroutines a local
+// flood can pile up.
+const maxConns = 32
+
+var connSem = make(chan struct{}, maxConns)
+
+// serve dispatches connection handling under the concurrency cap. It
+// returns false when the cap is reached — the caller must then close the
+// connection itself.
+func serve(c io.ReadWriteCloser, h Handler) bool {
+	select {
+	case connSem <- struct{}{}:
+		go func() {
+			defer func() { <-connSem }()
+			serveConn(c, h)
+		}()
+		return true
+	default:
+		return false
+	}
+}
+
+// forceCloser is implemented by connections that can be torn down
+// abortively, unblocking pending reads and writes (Windows pipe:
+// DisconnectNamedPipe; unix socket: a deadline in the past). The
+// connection watchdog uses it; normal closes still flush the reply.
+type forceCloser interface {
+	ForceClose() error
+}
+
 // serveConn runs the line protocol on one accepted connection.
 func serveConn(c io.ReadWriteCloser, h Handler) {
 	defer c.Close()
+	if fc, ok := c.(forceCloser); ok {
+		timer := time.AfterFunc(connTimeout, func() { fc.ForceClose() })
+		defer timer.Stop()
+	}
 	line, err := bufio.NewReader(io.LimitReader(c, 4096)).ReadString('\n')
 	cmd := strings.TrimSpace(line)
 	if cmd == "" {

internal/control/control_linux.go

@@ -37,12 +37,24 @@ func Serve(ctx context.Context, h Handler, log *slog.Logger) error {
 			if err != nil {
 				return // shutting down
 			}
-			go serveConn(c, h)
+			uc := unixConn{c}
+			if !serve(uc, h) {
+				uc.ForceClose()
+			}
 		}
 	}()
 	return nil
 }
 
+// unixConn adds an abortive ForceClose to net.Conn: a deadline in the
+// past fails pending and future I/O immediately.
+type unixConn struct{ net.Conn }
+
+func (c unixConn) ForceClose() error {
+	c.SetDeadline(time.Now().Add(-time.Second)) //nolint:errcheck // best effort
+	return c.Conn.Close()
+}
+
 // Ask sends one command to the running service and returns its reply.
 func Ask(cmd string) (string, error) {
 	c, err := net.DialTimeout("unix", sockPath, 2*time.Second)

internal/control/control_test.go

@@ -5,6 +5,7 @@ import (
 	"net"
 	"strings"
 	"testing"
+	"time"
 )
 
 func TestRoundTrip(t *testing.T) {
@@ -44,3 +45,59 @@ func TestEmptyReplyIsUnavailable(t *testing.T) {
 		t.Fatalf("err = %v, want ErrUnavailable", err)
 	}
 }
+
+func TestServeCap(t *testing.T) {
+	for i := 0; i < maxConns; i++ {
+		connSem <- struct{}{}
+	}
+	defer func() {
+		for i := 0; i < maxConns; i++ {
+			<-connSem
+		}
+	}()
+	server, client := net.Pipe()
+	defer server.Close()
+	defer client.Close()
+	if serve(server, func(string) string { return "OK" }) {
+		t.Fatal("serve accepted a connection beyond the cap")
+	}
+}
+
+// forcePipe records ForceClose calls for the watchdog test.
+type forcePipe struct {
+	net.Conn
+	forced chan struct{}
+}
+
+func (c forcePipe) ForceClose() error {
+	err := c.Conn.Close()
+	close(c.forced)
+	return err
+}
+
+func TestConnWatchdog(t *testing.T) {
+	old := connTimeout
+	connTimeout = 50 * time.Millisecond
+	defer func() { connTimeout = old }()
+
+	server, client := net.Pipe()
+	defer client.Close()
+	fc := forcePipe{Conn: server, forced: make(chan struct{})}
+	done := make(chan struct{})
+	go func() {
+		serveConn(fc, func(string) string { return "OK" })
+		close(done)
+	}()
+	// The client never sends anything; the watchdog must tear the
+	// connection down instead of blocking forever.
+	select {
+	case <-fc.forced:
+	case <-time.After(5 * time.Second):
+		t.Fatal("watchdog did not force-close the stalled connection")
+	}
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		t.Fatal("serveConn still blocked after the force close")
+	}
+}

internal/control/control_windows.go

@@ -86,7 +86,10 @@ func Serve(ctx context.Context, h Handler, log *slog.Logger) error {
 				windows.CloseHandle(pipe)
 				continue
 			}
-			go serveConn(&pipeConn{f: os.NewFile(uintptr(pipe), pipePath), h: pipe}, h)
+			conn := &pipeConn{f: os.NewFile(uintptr(pipe), pipePath), h: pipe}
+			if !serve(conn, h) {
+				conn.ForceClose()
+			}
 		}
 	}()
 	return nil
@@ -114,6 +117,14 @@ func (c *pipeConn) Close() error {
 	return c.f.Close()
 }
 
+// ForceClose aborts the connection without flushing: disconnecting
+// unblocks pending reads and writes at the cost of possibly discarding an
+// unread reply. Used by the connection watchdog; normal closes flush.
+func (c *pipeConn) ForceClose() error {
+	windows.DisconnectNamedPipe(c.h) //nolint:errcheck // best effort
+	return c.f.Close()
+}
+
 // Ask sends one command to the running service and returns its reply.
 func Ask(cmd string) (string, error) {
 	name, err := windows.UTF16PtrFromString(pipePath)