fix(security): harden shell arguments and workflow permissions #1381
cameroncookeAnnotations
3 errors and 11 warnings
|
build-and-test (24.x)
Process completed with exit code 1.
|
|
src/utils/__tests__/command.test.ts > defaultExecutor > treats a leading-dash shell-mode executable as a command name:
src/utils/__tests__/command.test.ts#L43
AssertionError: expected { success: false, output: '', …(3) } to match object { success: true, exitCode: +0, …(1) }
(21 matching properties omitted from actual)
- Expected
+ Received
{
- "exitCode": 0,
- "output": "literal argument
- ",
- "success": true,
+ "exitCode": 127,
+ "output": "",
+ "success": false,
}
❯ src/utils/__tests__/command.test.ts:43:22
|
|
src/utils/__tests__/command.test.ts > defaultExecutor > passes shell-mode arguments without interpreting metacharacters:
src/utils/__tests__/command.test.ts#L24
AssertionError: expected { success: false, output: '', …(3) } to match object { success: true, exitCode: +0, …(1) }
(21 matching properties omitted from actual)
- Expected
+ Received
{
- "exitCode": 0,
- "output": "$(printf injected)
- `printf injected`
- value; printf injected
- $HOME
- single'quote
- ",
- "success": true,
+ "exitCode": 127,
+ "output": "",
+ "success": false,
}
❯ src/utils/__tests__/command.test.ts:24:20
|
|
build-and-test (24.x)
Node.js 20 is deprecated. The following actions target Node.js 20 but are being forced to run on Node.js 24: actions/checkout@v3, actions/setup-node@v3. For more information see: https://github.blog/changelog/2025-09-19-deprecation-of-node-20-on-github-actions-runners/
|
|
build-and-test (24.x):
src/cli/commands/upgrade.ts#L239
There is no `cause` attached to the symptom error being thrown
|
|
build-and-test (24.x):
src/cli/commands/upgrade.ts#L236
There is no `cause` attached to the symptom error being thrown
|
|
build-and-test (24.x):
src/cli/commands/daemon.ts#L300
The value assigned to 'status' is not used in subsequent statements
|
|
build-and-test (24.x):
src/cli/commands/daemon.ts#L265
The value assigned to 'content' is not used in subsequent statements
|
|
build-and-test (24.x):
src/benchmarks/claude-ui/transcript.ts#L340
'lineText' is assigned a value but never used. Allowed unused vars must match /^_/u
|
|
build-and-test (24.x):
src/benchmarks/claude-ui/preflight-commands.ts#L73
Missing return type on function
|
|
build-and-test (24.x):
src/benchmarks/claude-ui/preflight-commands.ts#L69
Missing return type on function
|
|
build-and-test (24.x):
src/benchmarks/claude-ui/preflight-commands.ts#L67
'timeoutTimer' is never reassigned. Use 'const' instead
|
|
build-and-test (24.x):
src/benchmarks/claude-ui/harness.ts#L876
Prefer using an optional chain expression instead, as it's more concise and easier to read
|
|
build-and-test (24.x):
src/benchmarks/claude-ui/config.ts#L236
There is no `cause` attached to the symptom error being thrown
|