fix(OSQUERY-008): 3 review findings across 3 files

[flamingo]

Closes 3 review findings across 3 files.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🟢 95 high	windowsSearchTableName constant does not follow kPascalCase naming convention	osquery/tables/system/windows/windows_search.cpp:37
2	🔴 55 low — review closely	SeccompEventSubscriber static maps use snake_case instead of the required kPascalCase constant naming	osquery/tables/events/linux/seccomp_events.h:43
3	🟡 85 medium	kInitialBufferSize and kEnvironmentExpansionMax declared with auto instead of explicit constexpr type but otherwise fine; MAX_BUFFER_SIZE macro violates k-prefix constant convention	osquery/utils/system/windows/errno.cpp:12

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 01e7aadc-0204-47ef-b373-fc5dbadf3ab5

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

[flamingo]

🦩 What this fix changed, finding by finding

3 finding(s) fixed in this draft — 3 explained inline on the diff; 1 low-confidence hunk(s) need close review before merging.

[flamingo]

🦩 🟠 windowsSearchTableName constant does not follow kPascalCase naming convention

Renamed the file-scope constant windowsSearchTableName to kWindowsSearchTableName at its declaration, and updated every use site throughout the file (in dateToUnixTime, writePropVariant, executeWindowsSearchQuery, generateSqlFromUserQuery, and genWindowsSearch) to reference the new name, satisfying the kPascalCase naming convention (OSQUERY-008) with no other behavioral changes.

🤖 Prompt for AI agents

In osquery/tables/system/windows/windows_search.cpp around line 37, review and complete this code-review fix: windowsSearchTableName constant does not follow kPascalCase naming convention.
What the draft fix changed: Renamed the file-scope constant `windowsSearchTableName` to `kWindowsSearchTableName` at its declaration, and updated every use site throughout the file (in `dateToUnixTime`, `writePropVariant`, `executeWindowsSearchQuery`, `generateSqlFromUserQuery`, and `genWindowsSearch`) to reference the new name, satisfying the kPascalCase naming convention (OSQUERY-008) with no other behavioral changes.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟢 95 high — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 SeccompEventSubscriber static maps use snake_case instead of the required kPascalCase constant naming

Renamed the three static const class members in SeccompEventSubscriber (declared in osquery/tables/events/linux/seccomp_events.h) from snake_case to kPascalCase: seccomp_actions_map -> kSeccompActionsMap, arch_codes_map -> kArchCodesMap, syscall_x86_64_map -> kSyscallX8664Map. This is a header-only change; the corresponding definitions in seccomp_events.cpp (not visible here) must be updated to match these new names or the build will fail to link/compile, so this fix is incomplete without a corresponding change to the .cpp file.

🤖 Prompt for AI agents

In osquery/tables/events/linux/seccomp_events.h around line 43, review and complete this code-review fix: SeccompEventSubscriber static maps use snake_case instead of the required kPascalCase constant naming.
What the draft fix changed: Renamed the three static const class members in `SeccompEventSubscriber` (declared in `osquery/tables/events/linux/seccomp_events.h`) from snake_case to kPascalCase: `seccomp_actions_map` -> `kSeccompActionsMap`, `arch_codes_map` -> `kArchCodesMap`, `syscall_x86_64_map` -> `kSyscallX8664Map`. This is a header-only change; the corresponding definitions in `seccomp_events.cpp` (not visible here) must be updated to match these new names or the build will fail to link/compile, so this fix is incomplete without a corresponding change to the .cpp file.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 55 low — review closely — react 👍/👎 to teach the reviewer

[flamingo]

🦩 🟠 kInitialBufferSize and kEnvironmentExpansionMax declared with auto instead of explicit constexpr type but otherwise fine; MAX_BUFFER_SIZE macro violates k-prefix constant convention

Replaced #define MAX_BUFFER_SIZE 256 with constexpr std::size_t kMaxBufferSize = 256; at file scope (outside the osquery namespace, matching the macro's prior placement) in osquery/utils/system/windows/errno.cpp, added #include <cstddef> for std::size_t, and updated the sole usage site in platformStrerr() (buffer.assign(MAX_BUFFER_SIZE, '\0') → buffer.assign(kMaxBufferSize, '\0')) to reference the new constant.

🤖 Prompt for AI agents

In osquery/utils/system/windows/errno.cpp around line 12, review and complete this code-review fix: kInitialBufferSize and kEnvironmentExpansionMax declared with `auto` instead of explicit constexpr type but otherwise fine; MAX_BUFFER_SIZE macro violates k-prefix constant convention.
What the draft fix changed: Replaced `#define MAX_BUFFER_SIZE 256` with `constexpr std::size_t kMaxBufferSize = 256;` at file scope (outside the `osquery` namespace, matching the macro's prior placement) in `osquery/utils/system/windows/errno.cpp`, added `#include <cstddef>` for `std::size_t`, and updated the sole usage site in `platformStrerr()` (`buffer.assign(MAX_BUFFER_SIZE, '\0')` → `buffer.assign(kMaxBufferSize, '\0')`) to reference the new constant.
Verify the change is correct and complete; do not refactor unrelated code.

fix confidence: 🟡 85 medium — react 👍/👎 to teach the reviewer