fix(exec): fix seccomp build on armv7 with i32-to-i64 syscall cast

[jdx]

Summary

• Fix compile error on armv7 targets where libc::SYS_* constants are i32 but the BTreeMap<i64, ...> key expects i64
• Adds as i64 cast which is a no-op on 64-bit and a widening conversion on 32-bit

Test plan

• Compiles locally on x86_64
• Verify armv7 and armv7-musl release builds pass in CI

🤖 Generated with Claude Code

---

Note

Low Risk
Low risk compile-time fix that only widens syscall IDs when inserting seccomp rules, primarily affecting 32-bit (e.g., armv7) builds.

Overview
Fixes a type mismatch in the seccomp network filter by casting libc::SYS_socket/libc::SYS_socketpair to i64 when inserting into the BTreeMap<i64, ...> rule map.

This restores builds on 32-bit targets where libc::SYS_* constants are i32, without changing the intended seccomp behavior on 64-bit platforms.

^{Written by Cursor Bugbot for commit 6ecd24c. This will update automatically on new commits. Configure here.}

[greptile-apps]

Greptile Summary

This PR fixes a compile error on armv7 targets by casting libc::SYS_socket and libc::SYS_socketpair to i64 before inserting them into the BTreeMap<i64, Vec<SeccompRule>>. On 64-bit targets the cast is a no-op; on 32-bit (armv7) it is a widening sign-extension, which is correct since syscall numbers are always non-negative. The change is minimal and does not affect runtime behaviour on supported architectures.

Confidence Score: 5/5

Safe to merge — single-line widening cast is correct and does not affect runtime behaviour on any currently supported architecture.

The change is a minimal, correct fix: as i64 is a no-op on 64-bit and a safe widening sign-extension on 32-bit. Syscall numbers are always non-negative so sign extension preserves their value. No logic, control flow, or data is altered. There are no P0 or P1 findings.

No files require special attention.

Important Files Changed

Filename	Overview
src/sandbox/seccomp.rs	Adds as i64 cast when inserting syscall numbers into the BTreeMap<i64, ...> to fix a type mismatch compile error on armv7 where libc::SYS_* constants are i32.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[apply_seccomp_net_filter] --> B[prctl: PR_SET_NO_NEW_PRIVS]
    B --> C{arch?}
    C -->|x86_64| D[TargetArch::x86_64]
    C -->|aarch64| E[TargetArch::aarch64]
    C -->|other e.g. armv7| F[Return Error: unsupported arch]
    D --> G[Build SeccompRules for AF_INET / AF_INET6]
    E --> G
    G --> H[Insert syscall as i64 into BTreeMap]
    H --> I[SeccompFilter::new]
    I --> J[BpfProgram::try_into]
    J --> K[seccompiler::apply_filter]
    K --> L[Filter active: SYS_socket / SYS_socketpair blocked for inet families]

Loading

_{Reviews (1): Last reviewed commit: "fix(exec): fix seccomp build on armv7 wi..." | Re-trigger Greptile}

[gemini-code-assist]

Code Review

This pull request updates the seccomp network filter in src/sandbox/seccomp.rs by casting syscall constants to i64 to ensure type compatibility. While this change addresses compilation issues on 32-bit architectures, feedback suggests that additional configuration is required in the architecture matching logic to prevent runtime errors on ARM platforms.

[gemini-code-assist]

While this cast fixes the compilation error on 32-bit ARM architectures, the apply_seccomp_net_filter function will still return an error at runtime on armv7 because the architecture is not handled in the match block at line 24. To fully support armv7, you should also add "arm" => TargetArch::arm to that match block.

[github-actions]

Hyperfine Performance

mise x -- echo

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.4.1 x -- echo	24.4 ± 1.5	22.6	47.2	1.04 ± 0.08
mise x -- echo	23.5 ± 0.8	21.9	28.1	1.00

mise env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.4.1 env	21.8 ± 0.6	21.0	27.7	1.00
mise env	22.6 ± 0.7	21.4	29.2	1.04 ± 0.05

mise hook-env

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.4.1 hook-env	23.2 ± 2.7	21.6	54.6	1.00
mise hook-env	26.8 ± 5.4	23.5	59.0	1.15 ± 0.27
⚠️ Warning: Performance variance for hook-env is 15%

mise ls

Command	Mean [ms]	Min [ms]	Max [ms]	Relative
mise-2026.4.1 ls	23.1 ± 4.8	20.5	51.9	1.00
mise ls	24.2 ± 4.5	21.6	52.3	1.05 ± 0.29

xtasks/test/perf

Command	mise-2026.4.1	mise	Variance
install (cached)	166ms	162ms	+2%
ls (cached)	89ms	83ms	+7%
bin-paths (cached)	93ms	90ms	+3%
task-ls (cached)	831ms	864ms	-3%