From a55a7c65af4ff41d2ca9c9fd5dbd1845c35ca52e Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Tue, 16 Jun 2026 16:07:43 +0200
Subject: [PATCH] fix(agent-v2): include Win32_Process key (Handle) in WMI
 GetOwner projection
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

SELECT ProcessId omitted the key property Handle, so WMI could not construct
__PATH and InvokeMethod("GetOwner") throws under classic WMI — the entire WMI
fallback in ProcessOwnerLookup.ViaWmi would have been silently dead
(throw → catch → wmiErrored=true → null), a regression vs the old SELECT *.
SELECT Handle, ProcessId restores method-callability. Not caught by tests: the
WMI path has no direct coverage (DAD tests inject the ProcessOwnerResolver seam).

V2.Core 1467/1467 green, build 0 warnings.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .../Monitoring/Interop/ProcessOwnerLookup.cs                | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/ProcessOwnerLookup.cs b/src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/ProcessOwnerLookup.cs
index 35c6cb26..15d27edd 100644
--- a/src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/ProcessOwnerLookup.cs
+++ b/src/Agent/AutopilotMonitor.Agent.V2.Core/Monitoring/Interop/ProcessOwnerLookup.cs
@@ -69,8 +69,8 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Interop
         /// count the failure rate. A process that simply vanished between enumeration and query
         /// (zero rows) is NOT counted as an error.
         /// <para>
-        /// Projects only <c>ProcessId</c>: <c>GetOwner</c> binds through the object's <c>__PATH</c>,
-        /// which WMI always returns regardless of the SELECT list, so this avoids materializing the
+        /// Projects only <c>Handle</c> + <c>ProcessId</c>: <c>Handle</c> is the key property WMI
+        /// needs for <c>GetOwner</c> method invocation, while still avoiding materializing the
         /// ~45 unused properties that <c>SELECT *</c> would.
         /// </para>
         /// </summary>
@@ -80,7 +80,7 @@ namespace AutopilotMonitor.Agent.V2.Core.Monitoring.Interop
             try
             {
                 using (var searcher = new ManagementObjectSearcher(
-                    $"SELECT ProcessId FROM Win32_Process WHERE ProcessId = {processId}"))
+                    $"SELECT Handle, ProcessId FROM Win32_Process WHERE ProcessId = {processId}"))
                 {
                     foreach (ManagementObject obj in searcher.Get())
                     {