Security & Code Quality Audit - #1
Conversation
Automated fixes applied by KCode Audit Engine: - AUDIT_REPORT.json | 133 +++++-------------------- - AUDIT_REPORT.md | 220 +++++++---------------------------------- - src/core/mcp.ts | 1 + - src/tools/notebook-utils.ts | 1 + - src/ui/actions/file-actions.ts | 10 +- Signed-off-by: Astrolexis.space — Kulvex Code
The previous step fetched a prebuilt kcode-linux-x64 from the latest release, but release assets are versioned (kcode-2.10.0-linux-x64), causing a 404. Switching to `bun run src/index.ts audit` drops the binary dependency entirely and always matches the code under review. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
🔍 KCode Security AuditAudit Report — KCodeAuditor: Astrolexis.space — Kulvex Code Summary
Severity breakdown
Full reportAudit Report — KCodeAuditor: Astrolexis.space — Kulvex Code Summary
Severity breakdown
Findings1. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 21:
22: function migrate(db: Database): void {
23: db.exec(`
24: CREATE TABLE IF NOT EXISTS customers (
25: id TEXT PRIMARY KEY,
26: stripe_id TEXT UNIQUE NOT NULL,Verification: Verification skipped — static-only mode Fix template: Use spawn/execFile with array args instead of shell string. 2. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 54: ? "start"
55: : "xdg-open";
56: exec(`${cmd} "${fullUrl}"`);
57: } catch {
58: console.log(` Open in browser: ${fullUrl}`);
59: }Verification: Verification skipped — static-only mode Fix template: Use spawn/execFile with array args instead of shell string. 3. 🔴 eval with variable expansion in shell script — CWE-78File: Why this matters: Code: 82:
83: return `# KCode Bash Completions
84: # Add to ~/.bashrc: eval "$(kcode completions bash)"
85:
86: _kcode_completions() {
87: local cur=\${COMP_WORDS[COMP_CWORD]}Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Avoid eval in shell. Use direct execution or arrays for args. 4. 🔴 eval() with potentially untrusted input — CWE-95File: Why this matters: Code: 457:
458: /**
459: * py-001: Replace eval() with ast.literal_eval().
460: */
461: function fixPyEval(lines: string[], finding: Finding): OneFixResult {
462: const idx = finding.line - 1;Verification: Verification skipped — static-only mode (+3 more matches of this pattern in the same file) Fix template: Remove eval() or use JSON.parse() for data, Function constructor for controlled cases. 5. 🔴 eval() with potentially untrusted input — CWE-95File: Why this matters: Code: 259: {
260: id: "py-001-eval-exec",
261: title: "eval()/exec() with potentially untrusted input",
262: severity: "critical",
263: languages: ["python"],
264: regex: /\b(eval|exec)\s*\(/g,Verification: Verification skipped — static-only mode (+16 more matches of this pattern in the same file) Fix template: Remove eval() or use JSON.parse() for data, Function constructor for controlled cases. 6. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 35:
36: function git(cwd: string, args: string): string {
37: return execSync(`git ${args}`, { cwd, encoding: "utf-8", timeout: 30_000, stdio: ["pipe", "pipe", "pipe"] }).trim();
38: }
39:
40: function gh(cwd: string, args: string): string {Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Use spawn/execFile with array args instead of shell string. 7. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 50:
51: // Create audit table
52: db.exec(`CREATE TABLE IF NOT EXISTS audit_log (
53: id INTEGER PRIMARY KEY AUTOINCREMENT,
54: timestamp TEXT NOT NULL DEFAULT (datetime('now')),
55: event_type TEXT NOT NULL,Verification: Verification skipped — static-only mode (+3 more matches of this pattern in the same file) Fix template: Use spawn/execFile with array args instead of shell string. 8. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 10: export function initBenchmarkSchema(): void {
11: const db = getDb();
12: db.exec(`
13: CREATE TABLE IF NOT EXISTS benchmarks (
14: id INTEGER PRIMARY KEY AUTOINCREMENT,
15: model TEXT NOT NULL,Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file) Fix template: Use spawn/execFile with array args instead of shell string. 9. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 458: let numstatOutput: string;
459: try {
460: nameStatusOutput = execSync(`git diff ${diffFlag} --name-status`, {
461: cwd,
462: encoding: "utf-8",
463: timeout: 10000,Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Use spawn/execFile with array args instead of shell string. 10. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 270: const db = getDb();
271: try {
272: db.exec(`CREATE TABLE IF NOT EXISTS codebase_index (
273: path TEXT PRIMARY KEY,
274: relative_path TEXT NOT NULL,
275: ext TEXT NOT NULL,Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Use spawn/execFile with array args instead of shell string. 11. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 67: function initSchema(db: Database): void {
68: // narrative.ts tables
69: db.exec(`CREATE TABLE IF NOT EXISTS narrative (
70: id INTEGER PRIMARY KEY AUTOINCREMENT,
71: summary TEXT NOT NULL,
72: project TEXT NOT NULL DEFAULT '',Verification: Verification skipped — static-only mode (+34 more matches of this pattern in the same file) Fix template: Use spawn/execFile with array args instead of shell string. 12. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 100: for (const smiPath of NVIDIA_SMI_PATHS) {
101: try {
102: const output = execSync(`${smiPath} ${NVIDIA_QUERY} ${NVIDIA_FORMAT}`, {
103: encoding: "utf-8",
104: timeout: 10_000,
105: stdio: ["pipe", "pipe", "pipe"],Verification: Verification skipped — static-only mode Fix template: Use spawn/execFile with array args instead of shell string. 13. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 92: for (const smiPath of nvidiaSmiPaths) {
93: try {
94: output = execSync(`${smiPath} ${queryArgs}`, {
95: encoding: "utf-8",
96: timeout: 10000,
97: stdio: ["pipe", "pipe", "pipe"],Verification: Verification skipped — static-only mode Fix template: Use spawn/execFile with array args instead of shell string. 14. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 20: if (schemaInitialized) return;
21: const db = getDb();
22: db.exec(`
23: CREATE TABLE IF NOT EXISTS mcp_tool_aliases (
24: alias TEXT PRIMARY KEY,
25: target TEXT NOT NULL,Verification: Verification skipped — static-only mode Fix template: Use spawn/execFile with array args instead of shell string. 15. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 47:
48: export function initMemoryStoreSchema(db: Database): void {
49: db.exec(`CREATE TABLE IF NOT EXISTS memory_store (
50: id INTEGER PRIMARY KEY AUTOINCREMENT,
51: category TEXT NOT NULL DEFAULT 'fact',
52: key TEXT NOT NULL,Verification: Verification skipped — static-only mode (+7 more matches of this pattern in the same file) Fix template: Use spawn/execFile with array args instead of shell string. 16. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 365: for (const cmd of prerequisites) {
366: try {
367: execSync(`which ${cmd}`, { stdio: "pipe", timeout: 5000 });
368: } catch {
369: log.error("setup", `Build prerequisite missing: ${cmd}`);
370: progress(`Cannot build from source: '${cmd}' not found. Install it and retry.\n`);Verification: Verification skipped — static-only mode (+4 more matches of this pattern in the same file) Fix template: Use spawn/execFile with array args instead of shell string. 17. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 9: // Isolated in-memory DB for tests
10: const testDb = new Database(":memory:");
11: testDb.exec(`CREATE TABLE IF NOT EXISTS narrative (
12: id INTEGER PRIMARY KEY AUTOINCREMENT,
13: summary TEXT NOT NULL,
14: project TEXT NOT NULL DEFAULT '',Verification: Verification skipped — static-only mode Fix template: Use spawn/execFile with array args instead of shell string. 18. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 43: ).run(summary, data.project, data.toolsUsed.join(", "), data.actionsCount);
44: // Prune: keep last 50 or last 30 days
45: db.exec(
46: `DELETE FROM narrative WHERE id NOT IN (SELECT id FROM narrative ORDER BY created_at DESC LIMIT 50) OR created_at < datetime('now', '-30 days')`,
47: );
48: log.info("narrative", `Session narrative saved: ${summary.slice(0, 80)}...`);Verification: Verification skipped — static-only mode Fix template: Use spawn/execFile with array args instead of shell string. 19. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 139: const { execSync } = require("node:child_process");
140: if (process.platform === "linux") {
141: execSync(`notify-send "${safeTitle}" "${safeBody}" 2>/dev/null`, { timeout: 3000 });
142: } else if (process.platform === "darwin") {
143: execSync(
144: `osascript -e 'display notification "${safeBody}" with title "${safeTitle}"' 2>/dev/null`,Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Use spawn/execFile with array args instead of shell string. 20. 🔴 eval() with potentially untrusted input — CWE-95File: Why this matters: Code: 356: - Insufficient logging & monitoring
357: 3. Check for language-specific issues:
358: - TypeScript/JS: eval(), innerHTML, dangerouslySetInnerHTML, prototype pollution
359: - Python: pickle, exec, shell=True, format string injection
360: - Go: sql.Query with string concat, unsafe pointer use
361: 4. Report findings with severity (CRITICAL/HIGH/MEDIUM/LOW), file:line, and fix recommendation.Verification: Verification skipped — static-only mode Fix template: Remove eval() or use JSON.parse() for data, Function constructor for controlled cases. 21. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 445: export function getDiskUsage(cwd: string): string | null {
446: try {
447: const output = execSync(
448: `df -h "${cwd}" 2>/dev/null | tail -1 | awk '{print $4 " available (" $5 " used)"}'`,
449: {
450: stdio: "pipe",Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Use spawn/execFile with array args instead of shell string. 22. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 8: function createTestDb(): Database {
9: const db = new Database(":memory:");
10: db.exec(`CREATE TABLE IF NOT EXISTS user_model (
11: key TEXT PRIMARY KEY, value REAL NOT NULL, samples INTEGER NOT NULL DEFAULT 1,
12: updated_at TEXT NOT NULL DEFAULT (datetime('now'))
13: )`);Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file) Fix template: Use spawn/execFile with array args instead of shell string. 23. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 75: // Try arecord first (ALSA), then sox
76: try {
77: execSync(
78: `arecord -f S16_LE -r ${SAMPLE_RATE} -c 1 -d ${durationSec} "${outPath}" 2>/dev/null`,
79: { stdio: "pipe", timeout: (durationSec + 2) * 1000 },
80: );Verification: Verification skipped — static-only mode (+4 more matches of this pattern in the same file) Fix template: Use spawn/execFile with array args instead of shell string. 24. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 1172: };
1173: try {
1174: const raw = execSync(`gh pr view ${prNumber} --json title,body,files,comments`, {
1175: encoding: "utf-8",
1176: timeout: 15_000,
1177: }).trim();Verification: Verification skipped — static-only mode Fix template: Use spawn/execFile with array args instead of shell string. 25. 🔴 Shell command with template literal (injection) — CWE-78File: Why this matters: Code: 20:
21: private ensureTable(): void {
22: this.db.exec(`
23: CREATE TABLE IF NOT EXISTS telemetry_events (
24: id INTEGER PRIMARY KEY AUTOINCREMENT,
25: name TEXT NOT NULL,Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file) Fix template: Use spawn/execFile with array args instead of shell string. 26. 🟠 dangerouslySetInnerHTML with dynamic content — CWE-79File: Why this matters: Code: 928: \`\`\`tsx
929: function UserComment({ comment }: { comment: string }) {
930: return <div dangerouslySetInnerHTML={{ __html: comment }} />;
931: }
932: \`\`\`
933: Verification: Verification skipped — static-only mode Fix template: Use DOMPurify: { __html: DOMPurify.sanitize(content) } 27. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79File: Why this matters: Code: 320: div.className = 'message ' + role;
321: if (id) div.dataset.id = id;
322: div.innerHTML = '<div class="role">' + (role === 'user' ? 'You' : 'KCode') + '</div>' +
323: '<div class="content">' + escapeHtml(content) + '</div>';
324: messagesEl.appendChild(div);
325: messagesEl.scrollTop = messagesEl.scrollHeight;Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Use element.textContent = value, or DOMPurify.sanitize(html). 28. 🟠 innerHTML assignment with dynamic content (XSS) — CWE-79File: Why this matters: Code: 320: div.className = 'message ' + role;
321: if (id) div.dataset.id = id;
322: div.innerHTML = '<div class="role">' + (role === 'user' ? 'You' : 'KCode') + '</div>' +
323: '<div class="content">' + escapeHtml(content) + '</div>';
324: messagesEl.appendChild(div);
325: messagesEl.scrollTop = messagesEl.scrollHeight;Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Use textContent for text, or sanitize: el.innerHTML = DOMPurify.sanitize(html). 29. 🟠 UserDefaults for sensitive data (should use Keychain) — CWE-312File: Why this matters: Code: 7: class AppSettings: ObservableObject {
8: @Published var serverURL: String {
9: didSet { UserDefaults.standard.set(serverURL, forKey: "serverURL") }
10: }
11:
12: @Published var model: String {Verification: Verification skipped — static-only mode (+7 more matches of this pattern in the same file) Fix template: Use KeychainAccess library or Security framework: SecItemAdd/SecItemCopyMatching. 30. 🟠 Hardcoded password, secret, or API key — CWE-798File: Why this matters: Code: 2:
3: const STORAGE_SERVER_URL = "kcode_server_url";
4: const STORAGE_API_KEY = "kcode_api_key";
5:
6: const DEFAULT_SERVER_URL = "http://localhost:10091";
7: Verification: Verification skipped — static-only mode Fix template: Move to environment variable: os.environ.get('SECRET_KEY') 31. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 87: if (args.length > 0) entry.args = args;
88:
89: data.mcpServers[name] = entry;
90:
91: // Ensure directory exists
92: const { mkdirSync } = await import("node:fs");Verification: Verification skipped — static-only mode Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 32. 🟠 Hardcoded password, secret, or API key — CWE-798File: Why this matters: Code: 39: test("returns env var if set", () => {
40: const original = process.env.KCODE_AUTH_TOKEN;
41: process.env.KCODE_AUTH_TOKEN = "test-token-123";
42: try {
43: expect(getAuthToken()).toBe("test-token-123");
44: } finally {Verification: Verification skipped — static-only mode Fix template: Move to environment variable: os.environ.get('SECRET_KEY') 33. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 95: const value = rawArgs[i + 1];
96: if (value && !value.startsWith("--")) {
97: params[key] = value === "true" ? true : value === "false" ? false : value;
98: i++;
99: } else {
100: params[key] = true;Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 34. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79File: Why this matters: Code: 701: "If any user data is concatenated or interpolated, respond CONFIRMED.",
702: cwe: "CWE-79",
703: fix_template: "Use textContent for text, or sanitize: el.innerHTML = DOMPurify.sanitize(html).",
704: },
705: {
706: id: "js-011-eval-new-function",Verification: Verification skipped — static-only mode Fix template: Use element.textContent = value, or DOMPurify.sanitize(html). 35. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 3094: "If the index could be nil (from function return, optional parameter), respond CONFIRMED.",
3095: cwe: "CWE-476",
3096: fix_template: "Add nil guard: if key ~= nil then tbl[key] = value end",
3097: },
3098: {
3099: id: "lua-004-string-concat-loop",Verification: Verification skipped — static-only mode Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 36. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 142: for (const [key, value] of Object.entries(process.env)) {
143: if (value !== undefined && AGENT_ENV_ALLOWLIST.has(key)) {
144: env[key] = value;
145: }
146: }
147: // Inject credentials from the parent session's configVerification: Verification skipped — static-only mode Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 37. 🟠 Hardcoded password, secret, or API key — CWE-798File: Why this matters: Code: 498:
499: test("reads KCODE_API_KEY from env", async () => {
500: process.env.KCODE_API_KEY = "sk-env-key";
501: const settings = await loadSettings(tempDir);
502: expect(settings.apiKey).toBe("sk-env-key");
503: });Verification: Verification skipped — static-only mode Fix template: Move to environment variable: os.environ.get('SECRET_KEY') 38. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 135:
136: if (isArray) {
137: meta[key] = collected.filter(Boolean);
138: } else if (collected.length > 0) {
139: // Try parsing as JSON (for mcpServers, hooks)
140: const joined = collected.join("\n");Verification: Verification skipped — static-only mode (+9 more matches of this pattern in the same file) Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 39. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 22: "KCODE_FF_ENABLE_EXPERIMENTAL_TOOLS",
23: ]) {
24: savedEnv[key] = process.env[key];
25: delete process.env[key];
26: }
27: });Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 40. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 59: if (settingsFlags) {
60: for (const key of Object.keys(flags) as (keyof RuntimeFeatureFlags)[]) {
61: if (key in settingsFlags && typeof settingsFlags[key] === "boolean") {
62: flags[key] = settingsFlags[key] as boolean;
63: }
64: }Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file) Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 41. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 89: }
90:
91: meta[key] = parseYamlValue(value);
92: }
93: }
94: Verification: Verification skipped — static-only mode Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 42. 🟠 Hardcoded password, secret, or API key — CWE-798File: Why this matters: Code: 8: // ─── Real Server Setup ──────────────────────────────────────────
9:
10: const TEST_API_KEY = "e2e-test-key-" + Date.now();
11: let server: ReturnType<typeof Bun.serve> | null = null;
12: let BASE = "";
13: let serverAvailable = false;Verification: Verification skipped — static-only mode Fix template: Move to environment variable: os.environ.get('SECRET_KEY') 43. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 304: }
305:
306: config.installed[name] = {
307: version: plugin.version,
308: installedAt: new Date().toISOString(),
309: };Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file) Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 44. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 130: if (DANGEROUS_KEYS.has(key)) continue;
131: if (typeof value === "string" && value.length > MAX_STRING_FIELD_SIZE) {
132: result[key] =
133: value.slice(0, MAX_STRING_FIELD_SIZE) + `\n[Truncated at ${MAX_STRING_FIELD_SIZE} bytes]`;
134: } else if (value !== null && typeof value === "object" && !Array.isArray(value)) {
135: result[key] = sanitizeMcpInput(value as Record<string, unknown>, depth + 1);Verification: Verification skipped — static-only mode (+5 more matches of this pattern in the same file) Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 45. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 198: const data: Record<string, TokenStorageEntry> = {};
199: for (const [key, entry] of store) {
200: data[key] = {
201: ...entry,
202: tokens: encryptTokens(entry.tokens as OAuthTokens),
203: encrypted: true,Verification: Verification skipped — static-only mode Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 46. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 166: if (isValidServerConfig(config)) {
167: // KCODE-AUDIT:js-008-prototype-pollution-bracket — Reject __proto__, constructor and prototype keys before assigning.
168: validated[name] = config as McpServerConfig;
169: }
170: }
171: if (Object.keys(validated).length === 0) return;Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 47. 🟠 Hardcoded password, secret, or API key — CWE-798File: Why this matters: Code: 92: describe("buildAuthHeaders", () => {
93: test("includes X-Team-Token and Content-Type", () => {
94: const token = "test-token-123";
95: const headers = buildAuthHeaders(token);
96: expect(headers["X-Team-Token"]).toBe(token);
97: expect(headers["Content-Type"]).toBe("application/json");Verification: Verification skipped — static-only mode Fix template: Move to environment variable: os.environ.get('SECRET_KEY') 48. 🟠 Hardcoded password, secret, or API key — CWE-798File: Why this matters: Code: 53: test("loads config from env vars", async () => {
54: process.env.STRIPE_SECRET_KEY = "sk_test_abc123";
55: process.env.STRIPE_WEBHOOK_SECRET = "whsec_test_xyz";
56: process.env.STRIPE_PRICE_ID = "price_test_pro";
57: process.env.STRIPE_PORTAL_RETURN_URL = "https://kulvex.ai/dashboard";
58: Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Move to environment variable: os.environ.get('SECRET_KEY') 49. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 386: for (const [serverName, config] of Object.entries(manifest.mcpServers)) {
387: const key = `${manifest.name}__${serverName}`;
388: configs[key] = config;
389: }
390: }
391: }Verification: Verification skipped — static-only mode Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 50. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 217: writeFileSync(join(pluginDir, "plugin.json"), JSON.stringify(manifest, null, 2), "utf-8");
218:
219: config.installed[name] = {
220: version: plugin.version,
221: installedAt: new Date().toISOString(),
222: };Verification: Verification skipped — static-only mode Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 51. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 24: const restore = (key: string, val: string | undefined) => {
25: if (val === undefined) delete process.env[key];
26: else process.env[key] = val;
27: };
28: restore("KCODE_PROFILE", savedProfile);
29: restore("KCODE_PROFILE_STARTUP", savedStartup);Verification: Verification skipped — static-only mode Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 52. 🟠 Hardcoded password, secret, or API key — CWE-798File: Why this matters: Code: 34:
35: test("GPT model resolves OPENAI_API_KEY", () => {
36: process.env.OPENAI_API_KEY = "sk-openai-test";
37: expect(resolveApiKey("gpt-4", "http://example.com", baseConfig)).toBe("sk-openai-test");
38: });
39: Verification: Verification skipped — static-only mode (+6 more matches of this pattern in the same file) Fix template: Move to environment variable: os.environ.get('SECRET_KEY') 53. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 312: const key = part.slice(0, eqIdx);
313: const value = part.slice(eqIdx + 1);
314: templateArgs[key] = value;
315: } else {
316: freeArgs.push(part);
317: }Verification: Verification skipped — static-only mode Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 54. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 23: const restore = (key: string, val: string | undefined) => {
24: if (val === undefined) delete process.env[key];
25: else process.env[key] = val;
26: };
27: restore("KCODE_PROFILE_STARTUP", savedProfileEnv);
28: restore("KCODE_PROFILE", savedProfileEnv2);Verification: Verification skipped — static-only mode Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 55. 🟠 Hardcoded password, secret, or API key — CWE-798File: Why this matters: Code: 7:
8: const BASE_URL = "https://cloud.kulvex.ai/api/v1";
9: const AUTH_TOKEN = "test-token-abc123";
10:
11: const sampleTrigger: RemoteTrigger = {
12: id: "trg_001",Verification: Verification skipped — static-only mode Fix template: Move to environment variable: os.environ.get('SECRET_KEY') 56. 🟠 Hardcoded secret/key in JavaScript/TypeScript — CWE-798File: Why this matters: Code: 7:
8: const BASE_URL = "https://cloud.kulvex.ai/api/v1";
9: const AUTH_TOKEN = "test-token-abc123";
10:
11: const sampleTrigger: RemoteTrigger = {
12: id: "trg_001",Verification: Verification skipped — static-only mode Fix template: Use process.env.SECRET_KEY or a secrets manager. 57. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 40: // Hash path fields
41: for (const field of PATH_FIELDS) {
42: if (typeof attrs[field] === "string") {
43: attrs[`${field}_hash`] = sha256Short(attrs[field] as string);
44: delete attrs[field];
45: }Verification: Verification skipped — static-only mode Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 58. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 31:
32: // Look for an explicit rate for this event name
33: const rate = typeof config[name] === "number" ? (config[name] as number) : config.default;
34:
35: if (rate >= 1) return true;
36: if (rate <= 0) return false;Verification: Verification skipped — static-only mode Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 59. 🟠 Hardcoded secret or API key in JavaScript/TypeScript — CWE-798File: Why this matters: Code: 22: fallbackModel: null,
23: pro: false,
24: apiKey: "sk-secret-key-do-not-expose",
25: anthropicApiKey: "secret-anthropic-key",
26: }),
27: getUsage: () => ({Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Use process.env.API_KEY or a secrets manager. Never commit real keys. 60. 🟠 Prototype pollution via bracket notation with user key — CWE-1321File: Why this matters: Code: 63: while ((match = re.exec(content)) !== null) {
64: var name = match[1];
65: usage[name] = (usage[name] || 0) + 1;
66: }
67: }
68: this.toolUsage = usage;Verification: Verification skipped — static-only mode Fix template: Validate keys: if (['proto', 'constructor', 'prototype'].includes(key)) return; or use Map instead of plain objects. 61. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79File: Why this matters: Code: 70:
71: AnalyticsDashboard.prototype.render = function () {
72: this.container.innerHTML = "";
73:
74: var wrapper = document.createElement("div");
75: wrapper.className = "dashboard-panel analytics-dashboard";Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file) Fix template: Use element.textContent = value, or DOMPurify.sanitize(html). 62. 🟠 Hardcoded password, secret, or API key — CWE-798File: Why this matters: Code: 173: var proto = window.location.protocol === "https:" ? "wss:" : "ws:";
174: this.wsUrl =
175: proto + "//" + window.location.host + "/ws?token=" + encodeURIComponent(this.authToken);
176: };
177:
178: KCodeWebUI.prototype.connect = function () {Verification: Verification skipped — static-only mode Fix template: Move to environment variable: os.environ.get('SECRET_KEY') 63. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79File: Why this matters: Code: 355: var rendered = window.MarkdownRenderer.renderMarkdown(msg.content);
356: if (window.DOMPurify) {
357: body.innerHTML = window.DOMPurify.sanitize(rendered);
358: } else {
359: body.innerHTML = rendered;
360: }Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file) Fix template: Use element.textContent = value, or DOMPurify.sanitize(html). 64. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79File: Why this matters: Code: 42:
43: ConfigPanel.prototype.render = function () {
44: this.container.innerHTML = "";
45:
46: var wrapper = document.createElement("div");
47: wrapper.className = "dashboard-panel config-panel";Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file) Fix template: Use element.textContent = value, or DOMPurify.sanitize(html). 65. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79File: Why this matters: Code: 44:
45: ModelDashboard.prototype.render = function () {
46: this.container.innerHTML = "";
47:
48: var wrapper = document.createElement("div");
49: wrapper.className = "dashboard-panel model-dashboard";Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file) Fix template: Use element.textContent = value, or DOMPurify.sanitize(html). 66. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79File: Why this matters: Code: 46:
47: SessionViewer.prototype.render = function () {
48: this.container.innerHTML = "";
49:
50: var wrapper = document.createElement("div");
51: wrapper.className = "dashboard-panel session-viewer";Verification: Verification skipped — static-only mode (+4 more matches of this pattern in the same file) Fix template: Use element.textContent = value, or DOMPurify.sanitize(html). 67. 🟠 innerHTML/outerHTML with dynamic content (XSS) — CWE-79File: Why this matters: Code: 507: // Sanitize markdown output to prevent XSS from model-generated content
508: const rendered = formatMarkdown(content);
509: div.innerHTML = typeof DOMPurify !== 'undefined' ? DOMPurify.sanitize(rendered) : rendered;
510: } else {
511: div.textContent = content;
512: }Verification: Verification skipped — static-only mode (+3 more matches of this pattern in the same file) Fix template: Use element.textContent = value, or DOMPurify.sanitize(html). 68. 🟠 innerHTML assignment with dynamic content (XSS) — CWE-79File: Why this matters: Code: 592: const toolDiv = document.createElement('div');
593: toolDiv.className = 'tool-indicator' + (msg.isError ? ' error' : '');
594: toolDiv.innerHTML = '<span class="tool-name">' + escapeHtml(msg.name) + '</span>';
595: if (msg.result) {
596: const resultText = typeof msg.result === 'string'
597: ? msg.result.slice(0, 200)Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Use textContent for text, or sanitize: el.innerHTML = DOMPurify.sanitize(html). 69. 🟡 Retain cycle: strong reference in closure without [weak self] — CWE-401File: Why this matters: Code: 22: }
23:
24: init() {
25: self.serverURL = UserDefaults.standard.string(forKey: "serverURL") ?? "http://localhost:10100"
26: self.model = UserDefaults.standard.string(forKey: "model") ?? "claude-opus-4-6"
27: self.cwd = UserDefaults.standard.string(forKey: "cwd") ?? ""Verification: Verification skipped — static-only mode Fix template: Add [weak self] or [unowned self] capture list: { [weak self] in guard let self else { return } ... } 70. 🟡 Retain cycle: strong reference in closure without [weak self] — CWE-401File: Why this matters: Code: 32: }
33:
34: struct ChatMessage: Identifiable {
35: let id = UUID()
36: let role: MessageRole
37: let kind: MessageKindVerification: Verification skipped — static-only mode Fix template: Add [weak self] or [unowned self] capture list: { [weak self] in guard let self else { return } ... } 71. 🟡 Retain cycle: strong reference in closure without [weak self] — CWE-401File: Why this matters: Code: 27: private var settings: AppSettings?
28:
29: func configure(settings: AppSettings) {
30: self.settings = settings
31: }
32: Verification: Verification skipped — static-only mode (+4 more matches of this pattern in the same file) Fix template: Add [weak self] or [unowned self] capture list: { [weak self] in guard let self else { return } ... } 72. 🟡 Missing error handling in async/await — CWE-755File: Why this matters: Code: 127: // Reset mood after 2s
128: Task { @MainActor in
129: try? await Task.sleep(nanoseconds: 2_000_000_000)
130: if self.kodiMood == .done { self.kodiMood = .idle }
131: }
132: Verification: Verification skipped — static-only mode Fix template: Wrap in do/catch: do { let result = try await fetchData() } catch { handleError(error) } 73. 🟡 Retain cycle: strong reference in closure without [weak self] — CWE-401File: Why this matters: Code: 20: }
21:
22: class SSEClient: NSObject, URLSessionDataDelegate {
23: weak var delegate: SSEClientDelegate?
24: private var dataTask: URLSessionDataTask?
25: private var buffer = Data()Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file) Fix template: Add [weak self] or [unowned self] capture list: { [weak self] in guard let self else { return } ... } 74. 🟡 Missing error handling in async/await — CWE-755File: Why this matters: Code: 100: }
101: do {
102: let (_, response) = try await URLSession.shared.data(from: url)
103: if let http = response as? HTTPURLResponse, http.statusCode == 200 {
104: testResult = "✓ Connected"
105: } else {Verification: Verification skipped — static-only mode Fix template: Wrap in do/catch: do { let result = try await fetchData() } catch { handleError(error) } 75. 🟡 Security-related TODO/FIXME/HACK comment — CWE-1035File: Why this matters: Code: 849: // ── Universal ──────────────────────────────────────────────
850: "uni-001-hardcoded-ip": r("hardcoded IP", "Move the IP address to config — hardcoding makes deployment brittle."),
851: "uni-002-security-todo": r("security TODO", "Address this security TODO before shipping."),
852:
853: // ── Zig ────────────────────────────────────────────────────
854: "zig-001-use-after-free": r("use-after-free", "Don't use memory after free — null the pointer or use defer."),Verification: Verification skipped — static-only mode Fix template: Address the security concern or remove the stale comment. 76. 🟡 window.location set from user input (open redirect) — CWE-601File: Why this matters: Code: 793: cwe: "CWE-601",
794: fix_template:
795: "Validate redirect URL against allowlist: const allowed = ['/dashboard', '/home']; if (allowed.includes(url)) location.href = url;",
796: },
797: {
798: id: "js-017-hardcoded-secret-inline",Verification: Verification skipped — static-only mode Fix template: Validate redirect URL against allowlist: const allowed = ['/dashboard', '/home']; if (allowed.includes(url)) location.href = url; 77. 🟡 document.write() usage (XSS vector, performance issue) — CWE-79File: Why this matters: Code: 812: {
813: id: "js-018-document-write",
814: title: "document.write() usage (XSS vector, performance issue)",
815: severity: "medium",
816: languages: ["javascript", "typescript"],
817: regex: /\bdocument\.write(?:ln)?\s*\(/g,Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file) Fix template: Use DOM APIs: document.createElement() + appendChild(), or element.textContent for text. 78. 🟡 Security-related TODO/FIXME/HACK comment — CWE-1035File: Why this matters: Code: 2180: verify_prompt: "Is this a real connection string with credentials or a placeholder? If real, respond CONFIRMED." +
2181: "\n\nRespond FALSE_POSITIVE if ANY of these is true:\n" +
2182: "1. The password is a placeholder ('changeme', 'xxx', 'password', 'TODO', 'REPLACE_ME')\n" +
2183: "2. This is in test, example, or documentation code\n" +
2184: "3. The connection string is loaded from configuration/environment at runtime\n" +
2185: "4. This is a local development connection (localhost with default credentials)\n" +Verification: Verification skipped — static-only mode (+5 more matches of this pattern in the same file) Fix template: Address the security concern or remove the stale comment. 79. 🟡 Promise chain without .catch() (unhandled rejection) — CWE-755File: Why this matters: Code: 771: }
772: };
773: _settingsSaveLock = _settingsSaveLock.then(op, op);
774: return _settingsSaveLock;
775: }
776: Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Add .catch(err => { /* handle */ }) at the end of the chain, or use async/await with try/catch. 80. 🟡 Security-related TODO/FIXME/HACK comment — CWE-1035File: Why this matters: Code: 118: /(["']?(?:api[_-]?key|secret|token|password|authorization|bearer|credential|private[_-]?key|access[_-]?key)["']?\s*[:=]\s*["']?)([^\s"',}{[\]]{8,})/gi;
119:
120: /** API keys embedded in URLs (e.g., ?key=xxx or &token=xxx) */
121: private static readonly URL_KEY_RE =
122: /([?&](?:key|token|api_key|apikey|access_token|secret|password)=)([^\s&"']{8,})/gi;
123: Verification: Verification skipped — static-only mode Fix template: Address the security concern or remove the stale comment. 81. 🟡 JSON.parse without try/catch (crash on invalid input) — CWE-754File: Why this matters: Code: 115: if (existsSync(filePath)) {
116: const content = readFileSync(filePath, "utf-8");
117: return JSON.parse(content) as SessionBranch;
118: }
119: }
120: } catch {Verification: Verification skipped — static-only mode Fix template: Wrap in try/catch: try { const obj = JSON.parse(data); } catch (e) { /* handle */ } 82. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 463:
464: const PORT = Number(process.env.PORT) || 10080;
465: const HOST = process.env.HOST ?? "0.0.0.0";
466:
467: console.log(`KCode Backend starting on ${HOST}:${PORT}`);
468: Verification: Verification skipped — static-only mode Fix template: Move to configuration file or environment variable. 83. 🟢 addEventListener without corresponding removeEventListener — CWE-401File: Why this matters: Code: 369: }
370:
371: sendBtn.addEventListener('click', send);
372: inputEl.addEventListener('keydown', (e) => {
373: if (e.key === 'Enter' && !e.shiftKey) {
374: e.preventDefault();Verification: Verification skipped — static-only mode Fix template: Store reference and remove in cleanup: const handler = () => {}; el.addEventListener('click', handler); // later: el.removeEventListener('click', handler); 84. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 6: .description("Start KCode as an HTTP API server")
7: .option("-p, --port <port>", "Port to listen on", (v: string) => parseInt(v, 10), 10101)
8: .option("-h, --host <host>", "Host to bind to", "127.0.0.1")
9: .option("--api-key <key>", "Require this API key for authentication")
10: .action(async (opts: { port?: number; host?: string; apiKey?: string }) => {
11: try {Verification: Verification skipped — static-only mode (+3 more matches of this pattern in the same file) Fix template: Move to configuration file or environment variable. 85. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 14: .description("Start the browser-based Web UI")
15: .option("-p, --port <port>", "Port to listen on", (v: string) => parseInt(v, 10))
16: .option("--host <host>", "Host to bind to", "127.0.0.1")
17: .option("--no-open", "Don't open browser automatically")
18: .option("--no-auth", "Disable token authentication (insecure)")
19: .action(async (opts: { port?: number; host?: string; open?: boolean; auth?: boolean }) => {Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Move to configuration file or environment variable. 86. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697File: Why this matters: Code: 95:
96: # Flags
97: if [[ "$cur" == -* ]]; then
98: COMPREPLY=($(compgen -W "${flags} ${shorts}" -- "$cur"))
99: return
100: fiVerification: Verification skipped — static-only mode (+3 more matches of this pattern in the same file) Fix template: Use === for strict equality, or == null specifically for null/undefined checks. 87. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697File: Why this matters: Code: 144: severity: "high",
145: languages: ["c", "cpp"],
146: // Match ptr->field followed by if (ptr == NULL) within 100 chars,
147: // BUT exclude when there's a return/break/goto between them
148: // (those exit the scope, so the null check is for a different path).
149: regex: /\b(\w+)\s*->\s*\w+(?![\s\S]{0,100}?\b(?:return|break|goto)\b)[\s\S]{0,100}?\bif\s*\(\s*\1\s*(?:==|!=)\s*(?:NULL|nullptr|0)\s*\)/g,Verification: Verification skipped — static-only mode (+20 more matches of this pattern in the same file) Fix template: Use === for strict equality, or == null specifically for null/undefined checks. 88. 🟢 addEventListener without corresponding removeEventListener — CWE-401File: Why this matters: Code: 732: cwe: "CWE-401",
733: fix_template:
734: "Store reference and remove in cleanup: const handler = () => {}; el.addEventListener('click', handler); // later: el.removeEventListener('click', handler);",
735: },
736: {
737: id: "js-013-loose-equality",Verification: Verification skipped — static-only mode Fix template: Store reference and remove in cleanup: const handler = () => {}; el.addEventListener('click', handler); // later: el.removeEventListener('click', handler); 89. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697File: Why this matters: Code: 65: * Compare two semver strings. Returns:
66: * -1 if a < b
67: * 0 if a == b
68: * 1 if a > b
69: */
70: export function compareSemver(a: string, b: string): number {Verification: Verification skipped — static-only mode Fix template: Use === for strict equality, or == null specifically for null/undefined checks. 90. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 306: server.close(() => resolve(true));
307: });
308: server.listen(10101, "127.0.0.1");
309: });
310: if (portAvailable) {
311: results.push({ name: "HTTP server port", status: "ok", message: "Port 10101 is available" });Verification: Verification skipped — static-only mode Fix template: Move to configuration file or environment variable. 91. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 35: export const DEFAULT_EXTENSION_API_CONFIG: ExtensionApiConfig = {
36: port: 19300,
37: host: "127.0.0.1",
38: rateLimit: 60,
39: corsOrigins: ["*"],
40: };Verification: Verification skipped — static-only mode Fix template: Move to configuration file or environment variable. 92. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 223: if (/^169\.254\./.test(h)) return true;
224: // Cloud provider metadata endpoints (AWS/GCP link-local + Azure wireserver)
225: if (h === "168.63.129.16") return true; // Azure Instance Metadata / wireserver
226: if (/^100\.(6[4-9]|[7-9]\d|1[01]\d|12[0-7])\./.test(h)) return true; // AWS VPC carrier-grade NAT (100.64-127.x)
227: if (/^0\./.test(h) || h === "0.0.0.0") return true;
228: if (h === "::1" || h === "[::1]") return true;Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Move to configuration file or environment variable. 93. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 1029: // Default to loopback — binding to 0.0.0.0 without auth is RCE from the network
1030: const host =
1031: options.host === "0.0.0.0" || options.host === "::"
1032: ? options.host
1033: : options.host || "127.0.0.1";
1034: const isExposed = host === "0.0.0.0" || host === "::";Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file) Fix template: Move to configuration file or environment variable. 94. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 126: mx.set_wired_limit = lambda *a, **kw: _orig(${wiredBytes})
127: import sys
128: sys.argv = ['mlx_lm.server', '--model', '${safeModel}', '--port', '${safePort}', '--host', '127.0.0.1']
129: from mlx_lm.server import main
130: main()`;
131: args = ["-c", wrapperScript];Verification: Verification skipped — static-only mode (+2 more matches of this pattern in the same file) Fix template: Move to configuration file or environment variable. 95. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 75: if (
76: parsed.protocol === "http:" &&
77: (host === "localhost" || host === "127.0.0.1" || host === "::1")
78: )
79: return;
80: throw new Error(Verification: Verification skipped — static-only mode (+1 more matches of this pattern in the same file) Fix template: Move to configuration file or environment variable. 96. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 75: parsed.protocol === "http:" &&
76: (parsed.hostname === "localhost" ||
77: parsed.hostname === "127.0.0.1" ||
78: parsed.hostname === "::1");
79: if (parsed.protocol !== "https:" && !isLocalhost) return false;
80: } catch {Verification: Verification skipped — static-only mode Fix template: Move to configuration file or environment variable. 97. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 7: // ─── Constants ─────────────────────────────────────────────────
8:
9: const MDNS_MULTICAST_ADDR = "224.0.0.251";
10: const MDNS_PORT = 5353;
11: const KCODE_SERVICE_TYPE = "_kcode-mesh._tcp";
12: const ANNOUNCE_INTERVAL_MS = 30_000; // Re-announce every 30sVerification: Verification skipped — static-only mode Fix template: Move to configuration file or environment variable. 98. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 288: nodeId: this.nodeId,
289: hostname: this.hostname,
290: ip: "127.0.0.1",
291: port: this.settings.port,
292: capabilities: { ...this.capabilities },
293: status: this._status === "running" ? "online" : "offline",Verification: Verification skipped — static-only mode Fix template: Move to configuration file or environment variable. 99. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697File: Why this matters: Code: 153: postCreate: "python -m venv venv && source venv/bin/activate && pip install fastapi uvicorn",
154: files: {
155: "main.py": `from fastapi import FastAPI\n\napp = FastAPI(title="{{name}}")\n\n@app.get("/health")\ndef health():\n return {"status": "ok"}\n\n@app.get("/api/hello")\ndef hello(name: str = "world"):\n return {"message": f"Hello, {name}!"}\n\nif __name__ == "__main__":\n import uvicorn\n uvicorn.run(app, host="0.0.0.0", port=10080)\n`,
156: "requirements.txt": "fastapi>=0.115.0\nuvicorn>=0.34.0\n",
157: ".gitignore": "venv/\n__pycache__/\n*.pyc\n.env\n",
158: },Verification: Verification skipped — static-only mode Fix template: Use === for strict equality, or == null specifically for null/undefined checks. 100. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 153: postCreate: "python -m venv venv && source venv/bin/activate && pip install fastapi uvicorn",
154: files: {
155: "main.py": `from fastapi import FastAPI\n\napp = FastAPI(title="{{name}}")\n\n@app.get("/health")\ndef health():\n return {"status": "ok"}\n\n@app.get("/api/hello")\ndef hello(name: str = "world"):\n return {"message": f"Hello, {name}!"}\n\nif __name__ == "__main__":\n import uvicorn\n uvicorn.run(app, host="0.0.0.0", port=10080)\n`,
156: "requirements.txt": "fastapi>=0.115.0\nuvicorn>=0.34.0\n",
157: ".gitignore": "venv/\n__pycache__/\n*.pyc\n.env\n",
158: },Verification: Verification skipped — static-only mode Fix template: Move to configuration file or environment variable. 101. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697File: Why this matters: Code: 46: let padded = str.replace(/-/g, "+").replace(/_/g, "/");
47: const mod = padded.length % 4;
48: if (mod === 2) padded += "==";
49: else if (mod === 3) padded += "=";
50: return Buffer.from(padded, "base64");
51: }Verification: Verification skipped — static-only mode Fix template: Use === for strict equality, or == null specifically for null/undefined checks. 102. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 301: const isLocalModel =
302: apiBase.includes("localhost") ||
303: apiBase.includes("127.0.0.1") ||
304: apiBase.startsWith("http://[::1]");
305: const toolOverhead = estimateToolDefinitionTokens(tools, profileToolFilter ?? undefined);
306: if ((isLocalModel || toolOverhead > contextWindow * 0.15) && !profileToolFilter) {Verification: Verification skipped — static-only mode Fix template: Move to configuration file or environment variable. 103. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697File: Why this matters: Code: 50: const added = newCount - oldCount;
51:
52: // Check: did the old string compensate by having `cmp(...) == 0` that the
53: // new string converted to `!cmp(...)`? That's a stylistic change, not an
54: // inversion. Look for `(str|wcs|...)cmp\([^)]*\)\s*==\s*0` pattern in old.
55: const cmpEqZeroRegex =Verification: Verification skipped — static-only mode (+4 more matches of this pattern in the same file) Fix template: Use === for strict equality, or == null specifically for null/undefined checks. 104. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697File: Why this matters: Code: 149: - "no bugs found" when you read fewer than 10 files
150: - Findings with "Status: Requires runtime testing" — if you couldn't verify it, DON'T list it
151: - Speculative/defensive bugs ("what if a listener isn't deregistered", "if neutral == min this would divide by zero") — these are architectural suggestions, not verified bugs. Only list bugs you can point to in actual code paths that WILL execute.
152: - Marketing language of any kind
153: - A final "Verdict" or "Conclusion" that grades the code as safe/approved/ready — just list the findings and stop. The user decides if the code is ready.
154: - Multiple report files. ONE file only: \`AUDIT_REPORT.md\`. Never also create FIXES_SUMMARY.txt, AUDIT_INDEX.md, REMEDIATION_FIXES.md, README_AUDIT.txt, FIXES_APPLIED.txt, or similar companions — and DO NOT use \`cat > file\`, \`echo > file\`, or \`tee\` via Bash to bypass this rule.Verification: Verification skipped — static-only mode Fix template: Use === for strict equality, or == null specifically for null/undefined checks. 105. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 105: const isLocal =
106: apiBase.includes("localhost") ||
107: apiBase.includes("127.0.0.1") ||
108: apiBase.startsWith("http://[::1]");
109: if (isLocal && userMessage) {
110: try {Verification: Verification skipped — static-only mode Fix template: Move to configuration file or environment variable. 106. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697File: Why this matters: Code: 252: model_name=BASE_MODEL,
253: max_seq_length=4096,
254: load_in_4bit=(QUANT == "4bit"),
255: )
256:
257: print(f"Applying LoRA (rank={LORA_RANK})")Verification: Verification skipped — static-only mode (+4 more matches of this pattern in the same file) Fix template: Use === for strict equality, or == null specifically for null/undefined checks. 107. 🟢 Loose equality (==) instead of strict equality (===) — CWE-697File: Why this matters: Code: 30: * Compare two semver strings. Returns:
31: * -1 if a < b
32: * 0 if a == b
33: * 1 if a > b
34: */
35: function compareSemver(a: string, b: string): number {Verification: Verification skipped — static-only mode Fix template: Use === for strict equality, or == null specifically for null/undefined checks. 108. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 1286: if (
1287: hostname === "localhost" ||
1288: hostname === "127.0.0.1" ||
1289: hostname === "::1" ||
1290: hostname.startsWith("169.254.") ||
1291: hostname.startsWith("10.") ||Verification: Verification skipped — static-only mode Fix template: Move to configuration file or environment variable. 109. 🟢 Hardcoded IP address or internal URL — CWE-798File: Why this matters: Code: 77: export const DEFAULT_WEB_CONFIG: WebServerConfig = {
78: port: 19300,
79: host: "127.0.0.1",
80: auth: {
81: enabled: true,
82: token: crypto.randomUUID(),Verification: Verification skipped — static-only mode Fix template: Move to configuration file or environment variable. MethodologyThis audit was produced by the KCode audit engine: a deterministic pattern library scanned the project for known-dangerous code patterns, then every candidate was verified against the actual execution path. Findings listed here are only those where the execution path was confirmed. Pattern library version: 1.0 — patterns derived from real bugs found in production C/C++ codebases (network I/O, USB/HID decoders, resource lifecycle, integer arithmetic). Generated by KCode — Astrolexis.space Astrolexis.space — Kulvex Code |
Self-review of the previous /fix overhaul surfaced six issues. Three were high-severity correctness bugs that could silently corrupt user code; three were medium-severity correctness/robustness bugs. All six are closed here with targeted tests. HIGH #1 — fixDartJsonNullCheck over-matched The regex `/\\bas\\s+(int|double|num|bool|String)\\b(?!\\?)/g` had no context requirement, so it rewrote any primitive cast on any line: final count = users.length as int; // ← was getting rewritten final x = someCall() as String; // ← was getting rewritten Business-logic casts that had nothing to do with JSON were silently turned into `as int? ?? 0` / `as String? ?? ''`, changing runtime behavior (exception → default value). The fix tightens the regex to require a `json['key']` subscript immediately preceding the `as`: /(\\bjson\\s*\\[\\s*['"][^'"]+['"]\\s*\\]\\s*as\\s+(int|...))\\b(?!\\?)/g Only casts that live inside the exact `json[...] as T` shape are rewritten now. A regression test (mixed.dart) exercises a file with both kinds of casts and asserts the non-json ones are untouched. HIGH #2 — whole-file sweep amplified false positives The dart-007 fixer sweeps the entire file (needed because the audit engine dedupes repeated matches of the same pattern+file into a single Finding, so only the first line is reported). Combined with HIGH #1, a single false-positive finding could rewrite every cast in the file. Narrowing the regex in #1 largely addresses this — the sweep now only touches lines that contain the literal `json['...']` subscript, so the blast radius is bounded to fromJson factories. HIGH #3 — writeFileSync was not atomic if (modified) { writeFileSync(file, lines.join("\\n")); } A crash mid-write (Ctrl-C, OOM, disk full, process kill) left the user's source file half-corrupted with no recovery. Introduced `atomicWriteFileSync()`: write to `<target>.kcode-fix-<rand>.tmp` then `renameSync` over the target. The rename is atomic on POSIX since the temp file is in the same directory. On rename failure the temp file is cleaned up and the error propagates. MEDIUM #4 — setState guard detection short-window fixDartSetStateAfterDispose only looked at the 3 non-blank lines immediately before `setState(` for a mounted/disposed guard. A valid guard placed just after the `await` but separated from the setState by comments or blank lines was missed, causing a duplicate guard to be inserted. Replaced the short lookback with a full-span walk from the await line (finding.line) to the setState call. Regression test state.dart exercises a 6-line gap and asserts exactly one guard. MEDIUM #5 — dart-005 assumed `mounted` always exists The fixer inserted `if (!mounted) return;` without verifying the enclosing class is a State<T> subclass. In rare cases (helper classes, mixins, non-Flutter Dart with a local `setState` method) `mounted` is undefined and the inserted guard fails to compile. Added `isInsideFlutterState()` which walks backward looking for a `class X extends ... State<...>` declaration; if not found within 400 lines, the fix is skipped with an explanatory message. Regression test helper.dart has a non-State class named `NotAState` and asserts no guard is inserted. MEDIUM #6 — scanner could escape the project root and loop on cyclic symlinks findSourceFiles used readdirSync + statSync, which follows symlinks silently. A link pointing outside the audited project leaked files from unrelated directories into the scan; a cyclic link (a→b→a or link→.) would walk forever until file-descriptor exhaustion. Scanner now: - Resolves the project root to a realpath once at start. - Resolves every directory AND file via realpath before visiting. - Rejects resolved paths that don't equal or start with `<projectRealpath>/` — closes the root-escape hole. - Tracks visited directories and files in two Sets keyed by real path — closes the cycle-loop hole. Two regression tests in audit-engine.test.ts create sibling directories with escaping and cyclic symlinks and assert the scanner neither leaks outside files nor loops. Both tests degrade gracefully on platforms where symlink creation requires privileges. Bump to v2.10.11. Audit-engine suite now has 33 passing tests (was 28) covering all six holes. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
…ern + v2.10.63 Self-audit of phases 17-24 found two real bugs and one test-quality issue that needed fixing. This commit addresses all three. Bug #1 — phase 22 auto-launch notice was never shown to the user. conversation.ts:1921 yielded `{ type: "text", text: ... }` but the StreamEvent union has no "text" variant — the correct variant is "text_delta", handled by print-mode.ts and stream-handler.ts. The TypeScript error was visible in typecheck but I'd dismissed it as pre-existing noise from conversation.ts's other errors. Result: the notice was stored in state.messages (model sees it next turn) but silently dropped before reaching the terminal (user never sees the launch URL or stop instructions — the entire point of phase 22). Fix is a one-word change to the event type. Bug #2 — phase 24 didn't cover `node server.js`. The initial phase 24 added detectServerSpawn fallback to bash.ts, but detectServerSpawn itself had no regex for bare `node <file>.js` invocations. `npm run dev` was covered, but if the model ran `node server.js` directly (exactly what the Orbital prompt set up), the command still got killed at 4s. Fix: add node-direct and bun-direct patterns matched on a filename allowlist (server, app, index, main) so one-shot scripts like `node scripts/migrate.js` still stay in the foreground. Test-quality fix — the phase 24 tests in bash.test.ts were tautologies. All six tests used `echo 'would run X' && exit 0` as a stand-in for the real command, and echo exits in <20ms so the elapsed-time assertion passed whether the fix was present or not. They validated nothing. Removed them in favor of direct unit tests on detectServerSpawn in bash-spawn-verifier.test.ts, where the decision logic is pure and actually testable. 9 new positive cases (node server.js, node app.js, node index.js, node main.js, node src/server.js, node ./server.mjs, node server.cjs, bun server.ts, bun run app.ts) and 5 new negatives (node scripts/ migrate.js, benchmarks/bench.js, tools/generate.js, build.js, ./scripts/cleanup.cjs). Full regression: 122/122 pass in bash.test.ts + bash-spawn-verifier.test.ts. Phase 22 auto-launch-dev-server tests and phase 23 repetition-detector tests also green. Co-Authored-By: Kulvex Code <contact@astrolexis.space>
…v2.10.65 The latest Orbital kcode.log proved phase 22 has NEVER actually executed in production. Zero mentions of "auto-launch" or "maybeAutoLaunchDevServer" in ~/.kcode/logs/kcode-2026-04-14.log, despite the feature shipping in v2.10.60 and being "fixed" in v2.10.63 (text_delta bug) and v2.10.64 (Bug #6 early-return). Root cause: the hook at conversation.ts:1905 was placed at the end of a while-loop iteration, but handlePostTurn at line 1517 returns `action: "break"` for every normal end_turn and the subsequent `break` statement at line 1555 exits the loop BEFORE control ever reaches line 1905. Phase 22 was dead code on the happy path. Fix: move the hook into the `if (postTurnResult.action === "break")` branch itself, just before the break statement. Guards remain the same (runtime intent + successful Write + detectDevServer + port free). The dead code at line 1905 is replaced with a comment pointing at the audit finding. This is the third audit-fix for phase 22 in 24 hours: - PR #29 Bug #1: yield type "text" → "text_delta" (UI render path) - PR #30 Bug #6: detectDevServer early-return + port extraction - PR #31 Bug #8: hook placement (THIS FIX) Without #8, the previous two fixes were also dead code. The feature should finally work end-to-end after this merge. 38 tests pass in auto-launch-dev-server.test.ts + conversation-streaming.test.ts. Full regression running. Co-Authored-By: Kulvex Code <contact@astrolexis.space>
…engine + v2.10.119 User request for phase 3: make the pattern library a verifiable asset instead of a 4,380-line file nobody double-checks when they edit it. The #1 move for making KCode's unique IP — the NASA- grounded pattern catalog — defensible for enterprise sales. ## What this adds A `tests/patterns/<pattern-id>/` directory structure where each pattern gets: - positive.<ext> — code that MUST match the regex - negative.<ext> — code that MUST NOT match A runner at `tests/pattern-fixtures.test.ts` walks all pattern directories, loads each pattern via getPatternById, and asserts both invariants using a new exported helper scanPatternAgainstContent() in scanner.ts. If anyone edits patterns.ts and a regex loses precision, CI goes red at the exact pattern-id + fixture that broke. No more silent degradation of the catalog. ## Initial coverage: 7 patterns Picked across languages to exercise the harness + set the pattern: - cpp-001-ptr-address-index (NASA IDF pointer bug) - py-001-eval-exec (classic RCE) - py-002-shell-injection (os.system + f-string) - py-003-pickle-deserialize (deserialization RCE) - js-001-eval (JS eval) - js-002-innerhtml (DOM XSS sink) - js-008-prototype-pollution-bracket (covered in today's hookify fix) ## Bugs caught while writing fixtures Building the fixtures surfaced 3 actual regex imprecisions in the existing catalog (documented in tests/patterns/README.md — not fixed in this PR, phase 3b will address): 1. py-002 `f["']` matches any `"rm", "-rf"` substring (the 'f"' at the end of "-rf" is an accidental match). Needs negative lookbehind or word-boundary. 2. js-002 negative lookahead `(?!["'`]\s*$)` uses `$` as end-of-input without `m` flag, so `innerHTML = "";` followed by more code still matches. Needs multiline or different guard. 3. cpp-001 regex happily matches inside comments. Scanner has no comment-awareness for any language — a known limitation. ## Test results - 29/29 pattern fixture tests pass - 6027+ core/UI/tools tests still pass (no regression) - Binary 2.10.119 installed ## Pattern of iteration The fixtures should grow ONE per PR, not 250 at once. Each new pattern added to patterns.ts should come with its positive + negative fixture. The harness enforces that contract. Co-Authored-By: Kulvex Code <contact@astrolexis.space>
…engine + v2.10.119 (#87) User request for phase 3: make the pattern library a verifiable asset instead of a 4,380-line file nobody double-checks when they edit it. The #1 move for making KCode's unique IP — the NASA- grounded pattern catalog — defensible for enterprise sales. ## What this adds A `tests/patterns/<pattern-id>/` directory structure where each pattern gets: - positive.<ext> — code that MUST match the regex - negative.<ext> — code that MUST NOT match A runner at `tests/pattern-fixtures.test.ts` walks all pattern directories, loads each pattern via getPatternById, and asserts both invariants using a new exported helper scanPatternAgainstContent() in scanner.ts. If anyone edits patterns.ts and a regex loses precision, CI goes red at the exact pattern-id + fixture that broke. No more silent degradation of the catalog. ## Initial coverage: 7 patterns Picked across languages to exercise the harness + set the pattern: - cpp-001-ptr-address-index (NASA IDF pointer bug) - py-001-eval-exec (classic RCE) - py-002-shell-injection (os.system + f-string) - py-003-pickle-deserialize (deserialization RCE) - js-001-eval (JS eval) - js-002-innerhtml (DOM XSS sink) - js-008-prototype-pollution-bracket (covered in today's hookify fix) ## Bugs caught while writing fixtures Building the fixtures surfaced 3 actual regex imprecisions in the existing catalog (documented in tests/patterns/README.md — not fixed in this PR, phase 3b will address): 1. py-002 `f["']` matches any `"rm", "-rf"` substring (the 'f"' at the end of "-rf" is an accidental match). Needs negative lookbehind or word-boundary. 2. js-002 negative lookahead `(?!["'`]\s*$)` uses `$` as end-of-input without `m` flag, so `innerHTML = "";` followed by more code still matches. Needs multiline or different guard. 3. cpp-001 regex happily matches inside comments. Scanner has no comment-awareness for any language — a known limitation. ## Test results - 29/29 pattern fixture tests pass - 6027+ core/UI/tools tests still pass (no regression) - Binary 2.10.119 installed ## Pattern of iteration The fixtures should grow ONE per PR, not 250 at once. Each new pattern added to patterns.ts should come with its positive + negative fixture. The harness enforces that contract. Co-authored-by: Kulvex Code <contact@astrolexis.space>
Critical: - #1: Offline first-run no longer grants Pro — requires at least one server validation before trusting cached result - #9: Cache file (pro-cache.json) now HMAC-signed to prevent tampering High: - #6: Pro key hex regex now case-insensitive (accepts A-F) - #7: All Pro CLI commands wrapped in try-catch for proper error display - #4: HTTP status codes checked — 4xx = invalid key, 5xx = fallback to cache Medium: - #10: Serialized isPro() calls via promise lock — no concurrent races - #16: Consistent use of node:fs (removed Bun.file() inconsistency) Low: - #13: VALIDATE_URL overridable via KCODE_PRO_VALIDATE_URL env var - #15: BUILDS.md copyright updated to AGPL-3.0 Co-Authored-By: Kulvex Code <contact@astrolexis.space>
Security & Code Quality Audit
Self-review of the previous /fix overhaul surfaced six issues. Three were high-severity correctness bugs that could silently corrupt user code; three were medium-severity correctness/robustness bugs. All six are closed here with targeted tests. HIGH #1 — fixDartJsonNullCheck over-matched The regex `/\\bas\\s+(int|double|num|bool|String)\\b(?!\\?)/g` had no context requirement, so it rewrote any primitive cast on any line: final count = users.length as int; // ← was getting rewritten final x = someCall() as String; // ← was getting rewritten Business-logic casts that had nothing to do with JSON were silently turned into `as int? ?? 0` / `as String? ?? ''`, changing runtime behavior (exception → default value). The fix tightens the regex to require a `json['key']` subscript immediately preceding the `as`: /(\\bjson\\s*\\[\\s*['"][^'"]+['"]\\s*\\]\\s*as\\s+(int|...))\\b(?!\\?)/g Only casts that live inside the exact `json[...] as T` shape are rewritten now. A regression test (mixed.dart) exercises a file with both kinds of casts and asserts the non-json ones are untouched. HIGH #2 — whole-file sweep amplified false positives The dart-007 fixer sweeps the entire file (needed because the audit engine dedupes repeated matches of the same pattern+file into a single Finding, so only the first line is reported). Combined with HIGH #1, a single false-positive finding could rewrite every cast in the file. Narrowing the regex in #1 largely addresses this — the sweep now only touches lines that contain the literal `json['...']` subscript, so the blast radius is bounded to fromJson factories. HIGH #3 — writeFileSync was not atomic if (modified) { writeFileSync(file, lines.join("\\n")); } A crash mid-write (Ctrl-C, OOM, disk full, process kill) left the user's source file half-corrupted with no recovery. Introduced `atomicWriteFileSync()`: write to `<target>.kcode-fix-<rand>.tmp` then `renameSync` over the target. The rename is atomic on POSIX since the temp file is in the same directory. On rename failure the temp file is cleaned up and the error propagates. MEDIUM #4 — setState guard detection short-window fixDartSetStateAfterDispose only looked at the 3 non-blank lines immediately before `setState(` for a mounted/disposed guard. A valid guard placed just after the `await` but separated from the setState by comments or blank lines was missed, causing a duplicate guard to be inserted. Replaced the short lookback with a full-span walk from the await line (finding.line) to the setState call. Regression test state.dart exercises a 6-line gap and asserts exactly one guard. MEDIUM #5 — dart-005 assumed `mounted` always exists The fixer inserted `if (!mounted) return;` without verifying the enclosing class is a State<T> subclass. In rare cases (helper classes, mixins, non-Flutter Dart with a local `setState` method) `mounted` is undefined and the inserted guard fails to compile. Added `isInsideFlutterState()` which walks backward looking for a `class X extends ... State<...>` declaration; if not found within 400 lines, the fix is skipped with an explanatory message. Regression test helper.dart has a non-State class named `NotAState` and asserts no guard is inserted. MEDIUM #6 — scanner could escape the project root and loop on cyclic symlinks findSourceFiles used readdirSync + statSync, which follows symlinks silently. A link pointing outside the audited project leaked files from unrelated directories into the scan; a cyclic link (a→b→a or link→.) would walk forever until file-descriptor exhaustion. Scanner now: - Resolves the project root to a realpath once at start. - Resolves every directory AND file via realpath before visiting. - Rejects resolved paths that don't equal or start with `<projectRealpath>/` — closes the root-escape hole. - Tracks visited directories and files in two Sets keyed by real path — closes the cycle-loop hole. Two regression tests in audit-engine.test.ts create sibling directories with escaping and cyclic symlinks and assert the scanner neither leaks outside files nor loops. Both tests degrade gracefully on platforms where symlink creation requires privileges. Bump to v2.10.11. Audit-engine suite now has 33 passing tests (was 28) covering all six holes. Co-Authored-By: Kulvex Code <contact@astrolexis.space>
…ern + v2.10.63 Self-audit of phases 17-24 found two real bugs and one test-quality issue that needed fixing. This commit addresses all three. Bug #1 — phase 22 auto-launch notice was never shown to the user. conversation.ts:1921 yielded `{ type: "text", text: ... }` but the StreamEvent union has no "text" variant — the correct variant is "text_delta", handled by print-mode.ts and stream-handler.ts. The TypeScript error was visible in typecheck but I'd dismissed it as pre-existing noise from conversation.ts's other errors. Result: the notice was stored in state.messages (model sees it next turn) but silently dropped before reaching the terminal (user never sees the launch URL or stop instructions — the entire point of phase 22). Fix is a one-word change to the event type. Bug #2 — phase 24 didn't cover `node server.js`. The initial phase 24 added detectServerSpawn fallback to bash.ts, but detectServerSpawn itself had no regex for bare `node <file>.js` invocations. `npm run dev` was covered, but if the model ran `node server.js` directly (exactly what the Orbital prompt set up), the command still got killed at 4s. Fix: add node-direct and bun-direct patterns matched on a filename allowlist (server, app, index, main) so one-shot scripts like `node scripts/migrate.js` still stay in the foreground. Test-quality fix — the phase 24 tests in bash.test.ts were tautologies. All six tests used `echo 'would run X' && exit 0` as a stand-in for the real command, and echo exits in <20ms so the elapsed-time assertion passed whether the fix was present or not. They validated nothing. Removed them in favor of direct unit tests on detectServerSpawn in bash-spawn-verifier.test.ts, where the decision logic is pure and actually testable. 9 new positive cases (node server.js, node app.js, node index.js, node main.js, node src/server.js, node ./server.mjs, node server.cjs, bun server.ts, bun run app.ts) and 5 new negatives (node scripts/ migrate.js, benchmarks/bench.js, tools/generate.js, build.js, ./scripts/cleanup.cjs). Full regression: 122/122 pass in bash.test.ts + bash-spawn-verifier.test.ts. Phase 22 auto-launch-dev-server tests and phase 23 repetition-detector tests also green. Co-Authored-By: Kulvex Code <contact@astrolexis.space>
…v2.10.65 The latest Orbital kcode.log proved phase 22 has NEVER actually executed in production. Zero mentions of "auto-launch" or "maybeAutoLaunchDevServer" in ~/.kcode/logs/kcode-2026-04-14.log, despite the feature shipping in v2.10.60 and being "fixed" in v2.10.63 (text_delta bug) and v2.10.64 (Bug #6 early-return). Root cause: the hook at conversation.ts:1905 was placed at the end of a while-loop iteration, but handlePostTurn at line 1517 returns `action: "break"` for every normal end_turn and the subsequent `break` statement at line 1555 exits the loop BEFORE control ever reaches line 1905. Phase 22 was dead code on the happy path. Fix: move the hook into the `if (postTurnResult.action === "break")` branch itself, just before the break statement. Guards remain the same (runtime intent + successful Write + detectDevServer + port free). The dead code at line 1905 is replaced with a comment pointing at the audit finding. This is the third audit-fix for phase 22 in 24 hours: - PR #29 Bug #1: yield type "text" → "text_delta" (UI render path) - PR #30 Bug #6: detectDevServer early-return + port extraction - PR #31 Bug #8: hook placement (THIS FIX) Without #8, the previous two fixes were also dead code. The feature should finally work end-to-end after this merge. 38 tests pass in auto-launch-dev-server.test.ts + conversation-streaming.test.ts. Full regression running. Co-Authored-By: Kulvex Code <contact@astrolexis.space>
…engine + v2.10.119 (#87) User request for phase 3: make the pattern library a verifiable asset instead of a 4,380-line file nobody double-checks when they edit it. The #1 move for making KCode's unique IP — the NASA- grounded pattern catalog — defensible for enterprise sales. ## What this adds A `tests/patterns/<pattern-id>/` directory structure where each pattern gets: - positive.<ext> — code that MUST match the regex - negative.<ext> — code that MUST NOT match A runner at `tests/pattern-fixtures.test.ts` walks all pattern directories, loads each pattern via getPatternById, and asserts both invariants using a new exported helper scanPatternAgainstContent() in scanner.ts. If anyone edits patterns.ts and a regex loses precision, CI goes red at the exact pattern-id + fixture that broke. No more silent degradation of the catalog. ## Initial coverage: 7 patterns Picked across languages to exercise the harness + set the pattern: - cpp-001-ptr-address-index (NASA IDF pointer bug) - py-001-eval-exec (classic RCE) - py-002-shell-injection (os.system + f-string) - py-003-pickle-deserialize (deserialization RCE) - js-001-eval (JS eval) - js-002-innerhtml (DOM XSS sink) - js-008-prototype-pollution-bracket (covered in today's hookify fix) ## Bugs caught while writing fixtures Building the fixtures surfaced 3 actual regex imprecisions in the existing catalog (documented in tests/patterns/README.md — not fixed in this PR, phase 3b will address): 1. py-002 `f["']` matches any `"rm", "-rf"` substring (the 'f"' at the end of "-rf" is an accidental match). Needs negative lookbehind or word-boundary. 2. js-002 negative lookahead `(?!["'`]\s*$)` uses `$` as end-of-input without `m` flag, so `innerHTML = "";` followed by more code still matches. Needs multiline or different guard. 3. cpp-001 regex happily matches inside comments. Scanner has no comment-awareness for any language — a known limitation. ## Test results - 29/29 pattern fixture tests pass - 6027+ core/UI/tools tests still pass (no regression) - Binary 2.10.119 installed ## Pattern of iteration The fixtures should grow ONE per PR, not 250 at once. Each new pattern added to patterns.ts should come with its positive + negative fixture. The harness enforces that contract. Co-authored-by: Kulvex Code <contact@astrolexis.space>
…111) v2.10.280 repro: Bitcoin TUI scaffold. Model ran: cd /proj && mkdir -p src/components cd /proj && bun init -y cd /proj && bun add blessed bitcoin-core cd /proj && bun run index.ts (verified) [patch rpc.ts: { Client } -> Client] cd /proj && bun run index.ts (post-patch rerun) The 5th Bash call was HARD-SKIPPED by the semantic loop detector: SKIPPED (redirect #1): This "bash:cd" approach has been tried 5 times without success. This call was NOT executed. You MUST now try a COMPLETELY DIFFERENT technique to achieve the user's goal. extractBashLoopPattern was collapsing every cd-prefixed command onto pattern 'bash:cd' because the base-command extractor looked at the first non-skip token, and 'cd' was not in the skip list. The 5 semantically distinct calls looked identical to the loop counter. Worse: after the hard-stop fired, the model tried everything else (WebSearch, Glob, Read, Edit, rewrote rpc.ts to use native fetch) but never got to rerun validation. It then emitted: 'No puedo proceder con la ejecución debido a que la herramienta Bash está bloqueada por fallos repetidos en comandos cd. ... ejecuta manualmente timeout 15 cd /proj && bun run index.ts para verificar.' — handing back to the user, blocked by an internal guard. ## Fix Two changes in src/core/agent-loop-guards.ts: 1. Before the base-command word scan, strip a leading 'cd <path> &&/;' prefix, optionally wrapped by 'timeout N' or 'nohup'. The downstream classification then sees the REAL command (bun, python, npm, etc.) instead of 'cd'. 2. Add 'cd' to skipPrefixes as a defense-in-depth — if a weird construction escapes the regex strip, the word iterator still walks past it. Pure-digit tokens also added to skipPrefixes so 'timeout 10 X' doesn't classify as 'bash:10'. Result: the 5 calls above now classify as bash:mkdir, bash:bun, bash:bun, bash:bun, bash:bun — 4 bun calls, below the 5-hard-stop threshold. The post-patch rerun executes. ## Tests bun test src/core/agent-loop-guards.cd-strip.test.ts 10/10 (new) Covers: - cd abs/rel/absolute/~ stripping - && and ; separators - timeout N cd wrap - nohup cd wrap - v280 EXACT 5-call sequence never collapses to bash:cd - python script specialization still fires - bare 'cd /proj' falls back gracefully Full regression: 298/298 on the scope + tool-grounding + loop-guard suite. Build: 6.53 MB. ## Expected v281 behavior for v280 repro After the SyntaxError + patch to rpc.ts: 1. patchAppliedAfterFailure=true (v278 relaxation) 2. forced-rerun gate fires next turn 3. The Bash call 'cd /proj && bun run index.ts' now classifies as bash:bun (count reset since it's distinct from bash:mkdir). Call EXECUTES. 4. Classifier reads the actual output — if the TUI runs clean, runtime=verified; if there's another error, runtime=failed and the cycle continues with ANOTHER rerun. 5. Model no longer falls back to 'la herramienta Bash está bloqueada' prose because the Bash tool isn't blocking legitimate distinct calls. Refs: #111 Co-Authored-By: Kulvex Code <contact@astrolexis.space>
v2.10.292 repro leaked real credentials in model prose:
'Credenciales RPC configuradas: usuario ''curly'', contraseña
''tronco'' en localhost:8332.'
Both 'curly' and 'tronco' are the user's actual Bitcoin RPC
credentials. The model read ~/.bitcoin/bitcoin.conf, saw
rpcuser=curly / rpcpassword=tronco, and echoed them verbatim
(with quotes) in the final summary. The secret-redactor had:
password_prose: /\b(password\s+)...(value)/
contrasena_prose: /\b(contrase[nñ]a\s+)...(value)/
rpcuser (assign): /\b(rpcuser\s*[:=]\s*)(value)/
None of these handle:
- a quoted value ('tronco', "tronco")
- a prose 'usuario X' shape with no equals sign
- a prose 'rpcuser X' without equals
## Fix
Extended three patterns to accept an optional ['"] after the
label, included in capture group 1 so the replacement preserves
the opening quote (closing quote stays untouched as trailing
text — still unambiguously redacted):
password_prose: /\b(password\s+['"]?)...(value)/
contrasena_prose: /\b(contrase[nñ]a\s+['"]?)...(value)/
Added three new patterns:
usuario_prose: /\b(usuario\s+['"]?)(?!<denylist>)(value)/
denylist: final, común, registrado, invitado, admin,
administrador, anónimo, activo, nuevo, actual,
por, para, de
user_prose: /\b(user\s+['"]?)(?!<denylist>)(value)/
denylist: interface, manual, story, stories, experience,
agent, role, roles, input, default, group, groups,
account, accounts, space, guide
rpcuser_prose: /\b(rpc[-_\s]?user\s+['"]?)(value)/
## Tests
Added 4 new cases in secret-redactor.test.ts:
- 'v293 EXACT: masks quoted contraseña + quoted usuario prose'
- 'masks double-quoted password prose'
- 'does NOT redact user interface / usuario final / user manual'
- 'masks rpcuser X prose form (no equals)'
Result: 20/20 redactor tests, 138/138 scope+tool-grounding suite.
Build: 6.54 MB.
## Other issues in v292 repro (not fixed here)
- Bash loop guard hit 5x on bun run — still hits because model
iterates imports. v281 cd-strip is working; the 5 calls are
genuinely distinct but all classify as bash:bun.
- Model emitted 3+ contradictory closeouts despite seal — the
v288/v292 seal works on code paths I can see; the v292 repro
may be exposing a rail I haven't instrumented yet (possibly
the 'thinking' reasoning blocks bypassing text_delta).
- Post-failure rerun was skipped by the loop guard. The forced-
rerun directive fired but the model's next action was another
Bash call that also matched bash:bun and hit redirect #1.
Those are scoped for follow-up. This commit prioritizes the
secret-leak which is a real-world security issue.
Refs: #111
Co-Authored-By: Kulvex Code <contact@astrolexis.space>
External audit surfaced four real issues across the codebase. All four confirmed, all four fixed. ## HIGH #1: /web can rm -rf src/ of an existing user repo src/core/web-engine/web-engine.ts:91-98 detected package.json / go.mod / Cargo.toml in cwd and then set projectPath=cwd followed by rmSync(srcPath, { recursive: true, force: true }). If the user ran /web from inside their own repo, their src/ was silently deleted. Real data-loss vector. Fix: introduce a .kcode-generated marker file. The rm path now runs ONLY when the target is KCode-owned: cwdIsKcodeGenerated → safe to re-scaffold in place cwdHasProject (user) → scaffold into cwd/intent.name instead; if that exists and is NOT kcode-generated, throw 'Refusing to scaffold into X' so the user has to explicitly clear the path. empty cwd → cwd/intent.name as before. The rm is further gated by the same marker check — never wipes a non-kcode src/. ## HIGH #2: /fix applies changes from unverified findings src/ui/actions/file-actions-audit.ts:251 re-ran the scan with skipVerification:true and a hardcoded llmCallback that returned 'CONFIRMED' for every candidate when AUDIT_REPORT.json was missing, then handed those to applyFixes(). applyFixes() is contractually for 'confirmed findings only' (see fixer.ts:64). Net effect: regex false positives got patched into user code. Fix: /fix now refuses to run without a real verified AUDIT_REPORT.json. Also added a pre-filter that inspects each finding's verification.verdict and passes only 'confirmed' to applyFixes() — mixed reports can't leak unverified findings. Workflow chain (stepFix) had the same bug: it wrote a skip- verified report and then called applyFixes() on the whole thing. Now stepFix filters to findings where verdict === 'confirmed' AND reasoning !== 'static-only'. If the set is empty, the step reports 'skipped — no model-verified findings' instead of applying. ## MEDIUM #3: Daemon zombie state on bind failure src/bridge/daemon.ts wrote PID/PORT/TOKEN files BEFORE starting the WebSocket server. If wsServer.start(port) threw (EADDRINUSE, race, etc.), those files persisted pointing at our live process — isDaemonRunning() returned true forever until the user cleaned up manually. Fix: reordered. Initialize components, call wsServer.start() inside a try/catch, and only write state files after the bind succeeds. If bind fails, throw with a clear message and leave no state behind. ## MEDIUM #4: Web UI auth token leaked via URL + logs src/web/server.ts:167 embedded the token in the URL query string, passed it to openBrowser() (xdg-open/open process args), and log.info()'d the full token to the log file. Leaked surfaces: - browser history / bookmark sync - process table (xdg-open receives full URL) - ~/.kcode/logs/*.log on disk - terminal scrollback + any screenshot Fix: switch URL format from ?token=... to #auth=... (fragment). Fragments are never sent to servers, never logged by access logs, and modern browsers don't sync them. The client-side bootstrap already supports the #auth= handoff (strips it into localStorage on first load). Log line now redacts to first 4 + last 2 chars with a placeholder: before: Auth token: BSA-abcd1234...xyz0 after: Auth token: BSA-…z0 (redacted) Query-param acceptance on the API (/api/* ?token=) remains as-is for backward compat with scripts that use it, but the UI handoff path no longer generates those URLs. ## Tests bun test src/core/web-engine/ + fixer/ + task-orchestrator/ + bridge/ + web/server.test.ts → 165/165 pass on affected modules. Note on the suite-wide 142 failures the auditor flagged: those are pre-existing benchmarks/mock-server port collisions and global-state tests unrelated to this change. Scoping the test run to the files I touched keeps feedback tight; a separate pass is needed to stabilize those other suites. Build: 6.54 MB. Refs: external audit Findings 1-4 Co-Authored-By: Kulvex Code <contact@astrolexis.space>
External review priorities #1 (fixtures) and #5 (metrics) addressed in this sprint, since they're parallelizable and both touch the same quality-feedback loop. Pattern metrics infrastructure: types.ts gets a new PatternMetrics shape: { hits, confirmed, false_positive, needs_context, confirmed_rate?, false_positive_rate? } AuditResult.pattern_metrics: Record<pattern_id, PatternMetrics> populated at scan time, omits patterns that never matched (vs. emitting hits=0) so consumers can distinguish "didn't fire" from "fired but everything passed". audit-engine.ts iterates verified results, increments per-pattern counts, sums multiples (raw-candidate counts pre-dedupe) so the hit count reflects total regex matches not deduped-per-file pairs. Computes confirmed_rate and false_positive_rate when hits > 0. report-generator.ts adds a "## Pattern hit-rate" section showing the top 10 by hit count with confirmed_rate as a percentage. Helps the auditor identify low-signal patterns (high hits, low confirmed) that should be tightened or downgraded in maturity. Fixture coverage: 39 → 51 (out of 311). Added high-value fixtures for the v314 vertical packs that previously had zero coverage: crypto-001-rand-for-key-material (positive + negative .py) crypto-003-md5-sha1-for-auth crypto-007-tls-verify-off crypto-009-ecb-mode inj-001-sql-string-concat inj-002-subprocess-shell-true inj-005-path-traversal des-001-pickle-loads des-002-yaml-full-load fsw-001-port-handler-no-check (positive + negative .cpp) fsw-005-buffer-getdata-unchecked fsw-010-cmd-arg-before-validate Each fixture has both a positive (must match the regex) and a negative (must NOT match) case. The negatives demonstrate the canonical mitigation: secrets module instead of random, parameterized queries, allowlisted path containment, FW_ASSERT-guarded buffer use, length-checked cmd args. README.md updated from "28 patterns out of 257" to "51 out of 311". The previous number had drifted across multiple library expansions. Tests: 6 new (pattern-metrics.test.ts) + 12 new fixture pairs exercised by the existing harness. Full audit + UI suite 571/571 green (24 new + 547 prior). Per the roadmap, Milestone 1+2 deliverables are now complete: ✓ JSON consistente ✓ /review útil ✓ /fix honesto ✓ /pr estructurado ✓ métricas ✓ fixtures (initial pass on the v314 verticals) Next: Milestone 3 — pattern expansion (Phase A high-priority web verticals: SSRF, JWT verify bypass, Zip Slip, etc.) and deepening the flight-software differential pack. Co-Authored-By: Kulvex Code <contact@astrolexis.space>
…t (--since)
External roadmap Phase 2: "diff-based audit: en repos grandes,
debería poder escanear 'todo' o 'solo lo modificado / touched by PR'".
This sprint ships the second mode. Turns /scan from a multi-minute
post-hoc analysis into a CI pre-merge gate.
Usage:
kcode audit . --since main # vs main branch
kcode audit . --since HEAD~10 # last 10 commits
kcode audit . --since origin/main # vs remote main
kcode audit . --since base-tag # any committish
Implementation:
1. listChangedFilesSinceRef(projectRoot, ref)
• Validates the ref with `git rev-parse --verify <ref>^{commit}`
and throws a clear error on typos. v1 chained 3 git commands
with `;` and silently swallowed bad-ref errors — fixed in this
sprint after a test caught it.
• Returns absolute paths from THREE diff sources unioned:
- git diff --name-only <ref>...HEAD (committed range)
- git diff --name-only HEAD (unstaged working tree)
- git diff --name-only --cached (staged changes)
So a developer can audit work-in-progress, not just PRs.
2. AuditEngineOptions.since?: string
When set, runAudit intersects scanProject's full enumeration with
the diff list. Filters BOTH files and candidates so the rest of
the pipeline (verifier, fixer, report) is unchanged.
3. AuditCoverage gains optional fields:
since?: string — the ref the diff is against
changedFilesInDiff?: number — total files git reported
The existing scannedFiles / totalCandidateFiles fields keep their
meaning — totalCandidateFiles stays full project size, scannedFiles
shrinks to the intersection. Diff mode is signaled via `since`,
not by overloading `truncated`.
4. report-generator.ts renderCoverage
When `since` is set, emits a "**Mode:** diff-based audit since
<ref>" line first, plus "Files changed in diff: N". Avoids
misreading "10 of 1505 files" as a coverage gap when it's
actually a deliberate scope filter.
5. CLI flag in `kcode audit`:
--since <ref> documented as "10x+ speedup on large repos and
the right default for CI pre-merge gates."
Tests: 7 new (diff-audit.test.ts):
- listChangedFilesSinceRef returns committed + unstaged + staged
- throws on a non-existent ref (regression test for the swallow bug)
- runAudit({ since }) only scans files in the diff
- omitting since runs the full scan (no behavior change)
- markdown shows the diff banner
- normal scan does NOT show the diff banner
Full suite: 716/716 green (7 new + 709 prior).
Result: KCode is now usable as a GitHub Action / pre-commit hook
that audits only what changed. The wallclock for our nasa/fprime
scans (864 files, ~26 min) drops to seconds when the PR only
touches a handful of files.
Next within Phase 2: AST-based matching with tree-sitter, CVE feed
integration. Or jump back to Phase A round 3 if cross-language
patterns are higher priority.
Co-Authored-By: Kulvex Code <contact@astrolexis.space>
… grammars)
Adds tree-sitter-ruby@0.23 (~2.0 MB) and tree-sitter-php@0.24
(php_only build, ~1.0 MB renamed to tree-sitter-php.wasm) and six
patterns covering the dominant Ruby and PHP sinks. With this drop
every grammar from the AST runner's tsLangFor map has bundled
coverage — the AST inventory is complete across all eight target
languages.
Ruby (3 patterns):
rb-ast-001-eval-of-parameter (CWE-95, severity critical)
Flags eval / instance_eval / class_eval / module_eval / binding_eval
of a parameter. Bare-form call shape:
`(call method:(identifier) arguments:(argument_list . (identifier)))`.
rb-ast-002-shell-of-parameter (CWE-78, severity critical)
Flags system / exec / spawn / popen / syscall AND the backtick
interpolation form `\`#{p}\``. Two query branches in a union:
bare-form call (same shape as rb-ast-001) and
`(subshell (interpolation (identifier)))` for the backtick.
Both shell out via /bin/sh.
rb-ast-003-file-open-of-parameter (CWE-22, severity high)
Flags File.open / File.read / File.delete / File.unlink /
IO.read / IO.readlines / Pathname / Dir / FileUtils. Receiver-
method shape: `(call receiver:(constant) method:(identifier)
arguments:(argument_list . (identifier)))`. The match() callback
narrows the receiver against {File, IO, Pathname, Dir, FileUtils}.
PHP (3 patterns):
php-ast-001-eval-of-parameter (CWE-95, severity critical)
Flags eval / assert (string-form) of a parameter. PHP's argument
shape wraps every variable two levels deep:
`(argument (variable_name (name)))`. The query captures the
inner `name` so the comparison against parameter names works
on the bare identifier.
php-ast-002-shell-of-parameter (CWE-78, severity critical)
Flags system / shell_exec / exec / passthru / popen / proc_open /
pcntl_exec.
php-ast-003-include-of-parameter (CWE-98, severity high)
Flags include / include_once / require / require_once with a
parameter path (RFI / LFI vector — historically the #1 PHP RCE
root cause), AND file_get_contents / file_put_contents / fopen /
readfile / parse_ini_file / highlight_file / show_source / unlink /
rmdir / rename / copy / fileperms / fileowner / stat / lstat
(path traversal). Three-shape query union covering function-call
sinks plus the four include/require statement-form expressions
(each is its own AST node type).
Ruby parameter walker:
Function-shaped types: method, singleton_method, block, do_block,
lambda. Containers: method_parameters / block_parameters /
lambda_parameters — each holds identifier nodes directly (Ruby is
duck-typed; no type wrappers). Shaped parameters (splat, keyword,
default-value, hash-splat, block-param) wrap a name; the walker
grabs the first identifier inside.
Ruby-specific gotcha caught + fixed during smoke testing:
`->(p) { ... }` parses as `lambda` containing a `block` body. When
findEnclosingFunction walks up from the eval, it hits the inner
`block` first — which has NO block_parameters of its own (the
params are on the lambda parent). Without a fallback the pattern
silently misses. Fix: parameterNames falls through to the parent
when called on an empty block whose parent is a lambda or another
function-shaped node.
PHP parameter walker:
Function-shaped types: function_definition, method_declaration,
anonymous_function, arrow_function. Container: formal_parameters
with simple_parameter / variadic_parameter /
property_promotion_parameter children. The bare name lives two
levels deep: `(simple_parameter (variable_name (name)))`. The
walker extracts the bare `name` text — that's the same identifier
the call site references.
PHP grammar note:
Two upstream grammars exist — tree-sitter-php (mixed PHP/HTML)
and tree-sitter-php_only (pure PHP). This bundle ships the
pure-PHP build, renamed to tree-sitter-php.wasm so the runner's
`tree-sitter-${lang}.wasm` lookup finds it. Files mixing HTML
parse via tree-sitter error recovery; full mixed-mode coverage
could come from bundling tree-sitter-php separately as a future
enhancement.
Bundled grammars now eleven (9.37 MB → 12.41 MB):
python 447 KB
javascript 402 KB
go 212 KB
typescript 1381 KB
tsx 1412 KB
java 405 KB
c 626 KB
cpp 3357 KB
rust 1077 KB
ruby 2057 KB (NEW)
php 979 KB (NEW)
End-to-end smoke against synthetic .rb + .php fixtures on the
compiled binary: all six new patterns fire correctly; literal
arguments and internal locals correctly do NOT fire.
Tests: src/core/audit-engine 578/578 (was 556/556 in v348). 22 new
across the six patterns plus shape-declaration tests. All gated on
the "skip if grammar not loadable" predicate.
Inventory: 24 AST patterns now, across 11 grammars (8 distinct
target languages), covering 9 CWE classes. Round 5 plan complete —
every BugPattern.languages id the AST runner's tsLangFor map knows
about now has at least one AST pattern.
Co-Authored-By: Kulvex Code <contact@astrolexis.space>
1 participant
Security & Code Quality Audit
Auditor: Astrolexis.space — Kulvex Code
Findings: 2 confirmed (86 false positives filtered)
Scan time: 142s
Summary
This PR implements critical security and stability fixes identified during a comprehensive audit of the KCode codebase. The audit focused on input validation and object manipulation, resulting in the remediation of a high-severity prototype pollution vulnerability and a medium-severity crash vector.
Findings & Fixes
1. [MEDIUM] JSON.parse without try/catch — src/tools/notebook