github · codapult-guard609037000b5f

Evidence

recoverable: true,

      hint: 'Repair or remove the invalid Guard artifact, then run `codapult-guard doctor`.',

    });

    if (options.json || options.machine) console.log(JSON.stringify(payload, null, 2));

    else fail(`${terminalSafe(payload.message)} Run \`codapult-guard doctor\` for details.`);

    process.exitCode = 1;

    return { invalid: true };

RemediationAI

The problem is that `payload.message` is printed directly to the terminal without sanitizing ANSI escape sequences, allowing an attacker to inject cursor-control codes that rewrite output or hide commands. Replace the `console.log()` call with `console.log(terminalSafe(JSON.stringify(payload, null, 2)))` to ensure all user-controlled output is sanitized through the `terminalSafe()` function before display. This function strips or escapes ANSI sequences, preventing injection attacks. Verify the fix by passing a test payload containing ANSI codes (e.g., `\x1b[2J` to clear screen) and confirming the output displays the literal escape sequence rather than executing the control command.

Evidence

# Cursor integration

Guard runs as a host-managed local stdio process and has no application-level authentication or

network listener. Access is controlled by Cursor and the operating system; only enable this server

for a trusted workspace and grant it the filesystem access it needs. See the [Guard security

model](../guard.md#security-and-authentication) before using it in a shared environment.

This page targets Cursor Agent in a trusted local workspace. Cursor supports project MCP

configurati

RemediationAI

The problem is that the MCP manifest and documentation do not explicitly declare the authentication mechanism, making it unclear to reviewers how access is controlled. Add an `authentication` field to the MCP manifest (typically in `package.json` or a dedicated manifest file) with value `"host-level"` or `"stdio-local"` to explicitly document that Guard relies on host OS and Cursor's process isolation rather than application-level auth. This explicit declaration allows security reviewers to understand the trust model and verify it matches the deployment context. Confirm the fix by checking that the manifest field is present and that documentation references it consistently across README.md, docs/guard.md, and integration guides.

Evidence

# Codapult Guard: Architecture Guardrails for AI Coding Agents

Codapult Guard is local-first architecture guardrail software for AI coding agents and JavaScript

or TypeScript repositories. It detects architectural drift by observing the existing software

architecture, recording project memory, and checking code changes against team-approved rules and

contracts. It also provides bounded project context for AI code review and deterministic checks for

local development and CI.

Guard is not a repl

RemediationAI

The problem is that the MCP manifest and documentation do not explicitly declare the authentication mechanism, making it unclear to reviewers how access is controlled. Add an `authentication` field to the MCP manifest (typically in `package.json` or a dedicated manifest file) with value `"host-level"` or `"stdio-local"` to explicitly document that Guard relies on host OS and process isolation rather than application-level auth. This explicit declaration allows security reviewers to understand the trust model and verify it matches the deployment context. Confirm the fix by checking that the manifest field is present and that documentation references it consistently across all integration guides.

Evidence

# @codapult/guard

[![CI](https://github.com/codapult/codapult-guard/actions/workflows/ci.yml/badge.svg)](https://github.com/codapult/codapult-guard/actions/workflows/ci.yml)

[![Fixtures](https://github.com/codapult/codapult-guard/actions/workflows/guard-fixtures.yml/badge.svg)](https://github.com/codapult/codapult-guard/actions/workflows/guard-fixtures.yml)

[![npm](https://img.shields.io/npm/v/@codapult/guard?logo=npm)](https://www.npmjs.com/package/@codapult/guard)

[![License: MIT](https://img

RemediationAI

The problem is that the MCP manifest and documentation do not explicitly declare the authentication mechanism, making it unclear to reviewers how access is controlled. Add an `authentication` field to the MCP manifest (typically in `package.json` or a dedicated manifest file) with value `"host-level"` or `"stdio-local"` to explicitly document that Guard relies on host OS and process isolation rather than application-level auth. This explicit declaration allows security reviewers to understand the trust model and verify it matches the deployment context. Confirm the fix by checking that the manifest field is present and that the README references the authentication model clearly.

Evidence

# GitHub Copilot integration

Guard runs as a host-managed local stdio process and has no application-level authentication or

network listener. Access is controlled by the host and operating system; only enable this server

for a trusted workspace and grant it the filesystem access it needs. See the [Guard security

model](../guard.md#security-and-authentication) before using it in a shared environment.

GitHub Copilot has two relevant local surfaces. Use the VS Code instructions for Copilot Chat 

RemediationAI

The problem is that the MCP manifest and documentation do not explicitly declare the authentication mechanism, making it unclear to reviewers how access is controlled. Add an `authentication` field to the MCP manifest (typically in `package.json` or a dedicated manifest file) with value `"host-level"` or `"stdio-local"` to explicitly document that Guard relies on host OS and process isolation rather than application-level auth. This explicit declaration allows security reviewers to understand the trust model and verify it matches the deployment context. Confirm the fix by checking that the manifest field is present and that the GitHub Copilot integration guide references it consistently.

Evidence

import { execFileSync } from 'node:child_process';

import { createHash, randomUUID } from 'node:crypto';

import { hostname } from 'node:os';

import {

  closeSync,

  constants,

  existsSync,

  fstatSync,

  lstatSync,

  mkdirSync,

  openSync,

  readdirSync,

  readFileSync,

  realpathSync,

  renameSync,

  statSync,

  unlinkSync,

  writeFileSync,

} from 'node:fs';

import { dirname, extname, relative, resolve, sep } from 'node:path';

import { Project, SyntaxKind, type SourceFile } from 'ts-morph';

im

RemediationAI

The problem is that `existsSync()` is called to check if a file exists, then `readFileSync()` or `openSync()` is called on the same path without a lock, creating a race condition where an attacker can replace or symlink the file between the check and use. Replace the check-then-use pattern by removing the `existsSync()` call and wrapping the `openSync()` or `readFileSync()` in a try-catch block that handles the `ENOENT` error directly. This atomic approach eliminates the window where a race attack can succeed. Verify the fix by writing a test that attempts to race a symlink swap between the removed check and the file operation, confirming that the operation either succeeds on the original file or fails safely without following the symlink.