github · gemini-cliHEAD

Evidence

/**

 * @license

 * Copyright 2025 Google LLC

 * SPDX-License-Identifier: Apache-2.0

 */

import { describe, it, expect, beforeEach, afterEach } from 'vitest';

import {

  PolicyDecision,

  ApprovalMode,

  PRIORITY_SUBAGENT_TOOL,

} from './types.js';

import * as fs from 'node:fs/promises';

import * as path from 'node:path';

import * as os from 'node:os';

import { fileURLToPath } from 'node:url';

import {

  loadPoliciesFromToml,

  validateMcpPolicyToolNames,

  type PolicyLoadResult,

} from './toml-

Remediation

Missing annotation: add `{ annotations: { destructiveHint: true } }` as the 4th argument to `server.tool(...)` (TS) or pass `destructive_hint=True` to the `@mcp.tool(...)` decorator (Python). readOnly-lying: remove the `readOnlyHint: true` / `read_only_hint=True` assertion, or refactor the handler so it no longer calls the destructive sink. Do not suppress with a waiver — clients rely on these hints for user-facing confirmation.

Evidence

/**

 * @license

 * Copyright 2025 Google LLC

 * SPDX-License-Identifier: Apache-2.0

 */

import {

  McpServer,

  type ToolCallback,

} from '@modelcontextprotocol/sdk/server/mcp.js';

import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';

import express from 'express';

import { type Server as HTTPServer } from 'node:http';

import { type ZodRawShape } from 'zod';

export class TestMcpServer {

  private server: HTTPServer | undefined;

  async start(

Remediation

Apply auth middleware at the route or router level: - Express / Fastify / Koa: `passport.authenticate(...)`, `requireAuth`, `verifyToken`, or an equivalent JWT middleware applied via `router.use(authMw)` or as a per-route handler. - FastAPI: `Depends(get_current_user)`, `OAuth2PasswordBearer`, `HTTPBearer`, or `verify_jwt` dependency. - Flask: `@login_required`, `@auth_required`, `@jwt_required`, or call `verify_jwt_in_request()` in the handler. Mounting MCP behind a s

Evidence

/**

 * @license

 * Copyright 2025 Google LLC

 * SPDX-License-Identifier: Apache-2.0

 */

import * as vscode from 'vscode';

import {

  CloseDiffRequestSchema,

  IdeContextNotificationSchema,

  OpenDiffRequestSchema,

} from '@google/gemini-cli-core/src/ide/types.js';

import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js';

import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';

import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableH

Remediation

Apply auth middleware at the route or router level: - Express / Fastify / Koa: `passport.authenticate(...)`, `requireAuth`, `verifyToken`, or an equivalent JWT middleware applied via `router.use(authMw)` or as a per-route handler. - FastAPI: `Depends(get_current_user)`, `OAuth2PasswordBearer`, `HTTPBearer`, or `verify_jwt` dependency. - Flask: `@login_required`, `@auth_required`, `@jwt_required`, or call `verify_jwt_in_request()` in the handler. Mounting MCP behind a s

Evidence

// GitHub

      GITHUB_TOKEN_GHP: 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHO: 'gho_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHU: 'ghu_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHS: 'ghs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHR: 'ghr_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_PAT: 'github_pat_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

GITHUB_TOKEN_GHR: 'ghr_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_PAT: 'github_pat_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      // Google

      GOOGLE_KEY: 'AIzaSyxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      // AWS

      AWS_KEY: 'AKIAxxxxxxxxxxxxxxxx',

      // JWT

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

it('should NOT redact GEMINI_CLI_ variables even if their value looks like a secret (fully trusted)', () => {

      const env = {

        GEMINI_CLI_INTERNAL: 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      };

      const sanitized = sanitizeEnvironment(env, EMPTY_OPTIONS);

      expect(sanitized).toEqual(env);

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

// JWT

      JWT_TOKEN: 'eyJhbGciOiJIUzI1NiJ9.e30.ZRrHA157xAA_7962-a_3rA',

      // Stripe

      STRIPE_SK_LIVE: 'sk_live_xxxxxxxxxxxxxxxxxxxxxxxx',

      STRIPE_RK_LIVE: 'rk_live_xxxxxxxxxxxxxxxxxxxxxxxx',

      STRIPE_SK_TEST: 'sk_test_xxxxxxxxxxxxxxxxxxxxxxxx',

      STRIPE_RK_TEST: 'rk_test_xxxxxxxxxxxxxxxxxxxxxxxx',

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

// Stripe

      STRIPE_SK_LIVE: 'sk_live_xxxxxxxxxxxxxxxxxxxxxxxx',

      STRIPE_RK_LIVE: 'rk_live_xxxxxxxxxxxxxxxxxxxxxxxx',

      STRIPE_SK_TEST: 'sk_test_xxxxxxxxxxxxxxxxxxxxxxxx',

      STRIPE_RK_TEST: 'rk_test_xxxxxxxxxxxxxxxxxxxxxxxx',

      // Slack

      SLACK_XOXB: 'xoxb-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

const env = {

      // GitHub

      GITHUB_TOKEN_GHP: 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHO: 'gho_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHU: 'ghu_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHS: 'ghs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHR: 'ghr_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

describe('value-first security: secret values must be caught even for allowed variable names', () => {

    it('should redact ALWAYS_ALLOWED variables whose values contain a GitHub token', () => {

      const env = {

        HOME: 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

        PATH: '/usr/bin',

      };

      const sanitized = sanitizeEnvironment(env, EMPTY_OPTIONS);

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

GITHUB_TOKEN_GHP: 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHO: 'gho_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHU: 'ghu_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHS: 'ghs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHR: 'ghr_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_PAT: 'github_pat_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      // Google

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

cwd,

        env: {

          PATH: '/usr/bin',

          GITHUB_TOKEN: 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

          MY_SECRET: 'super-secret',

          SAFE_VAR: 'is-safe',

        },

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

it('returns the owner and repo for URL with classic PAT token (ghp_)', async () => {

    vi.mocked(child_process.execSync).mockReturnValueOnce(

      'https://ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx@github.com/owner/repo.git',

    );

    expect(getGitHubRepoInfo()).toEqual({ owner: 'owner', repo: 'repo' });

  });

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

API_KEY: 'should-be-redacted',

      MY_SECRET: 'super-secret',

      // Redacted by value

      GH_TOKEN: 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      JWT: 'eyJhbGciOiJIUzI1NiJ9.e30.ZRrHA157xAA_7962-a_3rA',

      // Allowed by name but redacted by value

      RANDOM_VAR: '-----BEGIN CERTIFICATE-----...',

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

it('should redact user-allowlisted variables whose values contain a secret', () => {

      const env = {

        MY_SAFE_VAR: 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

        OTHER: 'fine',

      };

      const sanitized = sanitizeEnvironment(env, {

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

it('should redact variables with values matching all token and credential patterns', () => {

    const env = {

      // GitHub

      GITHUB_TOKEN_GHP: 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHO: 'gho_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHU: 'ghu_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHS: 'ghs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

STRIPE_SK_TEST: 'sk_test_xxxxxxxxxxxxxxxxxxxxxxxx',

      STRIPE_RK_TEST: 'rk_test_xxxxxxxxxxxxxxxxxxxxxxxx',

      // Slack

      SLACK_XOXB: 'xoxb-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      SLACK_XOXA: 'xoxa-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      SLACK_XOXP: 'xoxp-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      SLACK_XOXB_2: 'xoxr-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

STRIPE_RK_TEST: 'rk_test_xxxxxxxxxxxxxxxxxxxxxxxx',

      // Slack

      SLACK_XOXB: 'xoxb-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      SLACK_XOXA: 'xoxa-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      SLACK_XOXP: 'xoxp-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      SLACK_XOXB_2: 'xoxr-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      // URL Credentials

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

AppSecret: 'secret-value',

      db_password: 'password-value',

      RSA_KEY: '-----BEGIN RSA PRIVATE KEY-----...',

      GITHUB_TOKEN_GHP: 'ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      SAFE_VAR: 'is-safe',

    };

    const options = {

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

// Slack

      SLACK_XOXB: 'xoxb-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      SLACK_XOXA: 'xoxa-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      SLACK_XOXP: 'xoxp-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      SLACK_XOXB_2: 'xoxr-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      // URL Credentials

      CREDS_IN_HTTPS_URL: 'https://user:password@example.com',

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

GITHUB_TOKEN_GHO: 'gho_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHU: 'ghu_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHS: 'ghs_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_TOKEN_GHR: 'ghr_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      GITHUB_PAT: 'github_pat_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

      // Google

      GOOGLE_KEY: 'AIzaSyxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx',

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

SLACK_XOXB: 'xoxb-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      SLACK_XOXA: 'xoxa-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      SLACK_XOXP: 'xoxp-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      SLACK_XOXB_2: 'xoxr-xxxxxxxxxxxx-xxxxxxxxxxxx-xxxxxxxx',

      // URL Credentials

      CREDS_IN_HTTPS_URL: 'https://user:password@example.com',

      CREDS_IN_HTTP_URL: 'http://user:password@example.com',

Remediation

Rotate the leaked credential immediately, then replace the hardcoded value with os.environ / process.env lookup. For deployment, inject the value through your secret manager (AWS Secrets Manager, Doppler, Vault).

Evidence

const minimized = review.isMinimized

        ? ` (Minimized: ${review.minimizedReason})`

        : '';

      console.log(

        `\n${icon} ${review.state} by ${review.author.login} at ${review.createdAt}${minimized}: "${review.body}"`,

      );

    }

  });

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

`📄 Tail collector logs in another terminal: tail -f ${OTEL_LOG_FILE}`,

  );

  console.log(`\n📊 View your telemetry data in Google Cloud Console:`);

  console.log(

    `   - Logs: https://console.cloud.google.com/logs/query;query=logName%3D%22projects%2F${projectId}%2Flogs%2Fgemini_cli%22?project=${projectId}`,

  );

  console.log(

    `   - Metrics: https://console.cloud.google.com/monitoring/metrics-explorer?project=${projectId}`,

  );

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

? `(Line ${range}) `

        : '';

    const minimized = c.isMinimized ? ` (Minimized: ${c.minimizedReason})` : '';

    console.log(

      `\n💬 ${minimized}${c.author.login} | ${c.createdAt} ${fileInfo}\n${c.body}`,

    );

    printThread(c.id);

  });

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

const server = http.createServer((req, res) => {

  // Deny all requests other than CONNECT for HTTPS

  console.log(

    `[PROXY] Denying non-CONNECT request for: ${req.method} ${req.url}`,

  );

  res.writeHead(405, { 'Content-Type': 'text/plain' });

  res.end('Method Not Allowed');

});

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

console.log(`Processing single issue #${context.payload.issue.number}...`);

                await processSingleIssue(context.repo.owner, context.repo.repo, context.payload.issue.number);

              } else {

                console.log(`Running for event: ${context.eventName}. Processing all open issues...`);

                await processAllOpenIssues(context.repo.owner, context.repo.repo);

              }

            } catch (error) {

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

try {

        const input = fs.readFileSync(0, 'utf-8');

        console.error('DEBUG: AfterAgent hook input received');

        process.stdout.write("Received Input: " + input);

      } catch (err) {

        console.error('Hook Failed:', err);

        process.exit(1);

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

const minimized = reply.isMinimized

          ? ` (Minimized: ${reply.minimizedReason})`

          : '';

        console.log(

          `${indent}↳ [${reply.createdAt}] ${reply.author.login}${minimized}: ${reply.body}`,

        );

        printThread(reply.id, depth + 1);

      });

  };

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

// req.url will be in the format "hostname:port" for a CONNECT request.

  const { port, hostname } = new URL(`http://${req.url}`);

  console.log(`[PROXY] Intercepted CONNECT request for: ${hostname}:${port}`);

  if (

    ALLOWED_DOMAINS.some(

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

);

        const baPath = rig.createScript(

          'ba_hook.cjs',

          "console.log(JSON.stringify({decision: 'allow', hookSpecificOutput: {hookEventName: 'BeforeAgent', additionalContext: 'BeforeAgent: User request processed'}}));",

        );

        const beforeToolCommand = `node "${btPath}"`;

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

run(`git push --set-upstream origin ${hotfixBranch}`, dryRun);

  // Create the pull request.

  console.log(

    `Creating pull request from ${hotfixBranch} to ${releaseBranch}...`,

  );

  let prTitle = `fix(patch): cherry-pick ${commit.substring(0, 7)} to ${releaseBranch} to patch version ${releaseInfo.currentTag} and create version ${releaseInfo.nextVersion}`;

  let prBody = `This PR automatically cherry-picks commit ${commit} to patch version ${releaseInfo.currentTag} in the ${channel} releas

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

const fs = require('fs');

      try {

        const input = fs.readFileSync(0, 'utf-8');

        console.error('DEBUG: AfterAgent hook input received');

        process.stdout.write("Received Input: " + input);

      } catch (err) {

        console.error('Hook Failed:', err);

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

// Main execution

            try {

              if (context.eventName === 'issues') {

                console.log(`Processing single issue #${context.payload.issue.number}...`);

                await processSingleIssue(context.repo.owner, context.repo.repo, context.payload.issue.number);

              } else {

                console.log(`Running for event: ${context.eventName}. Processing all open issues...`);

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

// Create script file for hook

        const scriptPath = rig.createScript(

          'notification_hook.cjs',

          "console.log(JSON.stringify({suppressOutput: false, systemMessage: 'Permission request logged by security hook'}));",

        );

        const hookCommand = `node "${scriptPath}"`;

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

),

        });

        const hookScript = `const fs = require('fs');

console.log(JSON.stringify({

  decision: "allow",

  hookSpecificOutput: {

    hookEventName: "BeforeModel",

    llm_request: {

      messages: [

        {

          role: "user",

          content: "Please respond with exactly: The security hook modified this request successfully."

        }

      ]

    }

  }

}));`;

        const scriptPath = rig.createScript(

          'before_model_hook.cjs',

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

script: |

            // Parse the comment body directly to extract channel(s)

            const commentBody = process.env.COMMENT_BODY;

            console.log('Comment body:', commentBody);

            let channels = ['stable', 'preview'];  // default to both

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

* @param event - The stream event to emit

   */

  emitEvent(event: JsonStreamEvent): void {

    process.stdout.write(this.formatEvent(event));

  }

  /**

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

const minimized = c.isMinimized

        ? ` (Minimized: ${c.minimizedReason})`

        : '';

      console.log(

        `[${c.createdAt}] [${c.author.login}]${minimized}: ${c.body}\n`,

      );

    });

  }

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

describe('polling', () => {

    it('should poll and emit changes', async () => {

      // Initial fetch

      (mockServer.fetchAdminControls as Mock).mockResolvedValue({

        strictModeDisabled: true,

        adminControlsApplicable: true,

      });

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

}

    this.a2aFetch = (input, init) =>

      fetch(input, { ...init, dispatcher: this.a2aDispatcher } as RequestInit);

  }

  /**

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

```javascript

// Sequential operations are slower

const data1 = await fetch(url1).then((r) => r.json());

const data2 = await fetch(url2).then((r) => r.json());

// Prefer parallel operations for better performance

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

*/

  prompt?: string;

  /**

   * Direct URL to fetch (experimental mode).

   */

  url?: string;

}

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

```javascript

// Sequential operations are slower

const data1 = await fetch(url1).then((r) => r.json());

const data2 = await fetch(url2).then((r) => r.json());

// Prefer parallel operations for better performance

// Start requests concurrently

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

// Prefer parallel operations for better performance

// Start requests concurrently

const p1 = fetch(url1).then((r) => r.json());

const p2 = fetch(url2).then((r) => r.json());

// Wait for all results

const [data1, data2] = await Promise.all([p1, p2]);

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

fs.unlinkSync(tmpPath);

  }

  const response = await fetch(url, { redirect: 'follow' });

  if (!response.ok) {

    throw new Error(

      `Download failed: HTTP ${response.status} ${response.statusText}`,

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

}

    console.log(`[Download] ${url} -> ${archivePath}`);

    const response = await fetch(url);

    if (!response.ok) {

      throw new Error(`Failed to fetch ${url}: ${response.statusText}`);

    }

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

// Prefer parallel operations for better performance

// Start requests concurrently

const p1 = fetch(url1).then((r) => r.json());

const p2 = fetch(url2).then((r) => r.json());

// Wait for all results

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

}

console.log(`Auditing ${url}...`);

fetch(url, { method: 'HEAD' })

  .then((r) => console.log(`Result: Success (Status ${r.status})`))

  .catch((e) => console.error(`Result: Failed (${e.message})`));

```

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

const refToFetch = installMetadata.ref || 'HEAD';

    await git.fetch(remotes[0].name, refToFetch);

    // After fetching, checkout FETCH_HEAD to get the content of the fetched ref.

    // This results in a detached HEAD state, which is fine for this purpose.

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

`[WhisperModelManager] Downloading ${modelName} from ${url}`,

    );

    const response = await fetch(url);

    if (!response.ok) {

      throw new Error(`Failed to download model: ${response.statusText}`);

    }

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

method: 'POST',

      });

      await global.fetch(request);

      expect(mockFetch).toHaveBeenCalled();

      const [, calledInit] = mockFetch.mock.calls[0];

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

authServerMetadataUrl: string,

  ): Promise<OAuthAuthorizationServerMetadata | null> {

    try {

      const response = await fetch(authServerMetadataUrl);

      if (!response.ok) {

        return null;

      }

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

resourceMetadataUrl: string,

  ): Promise<OAuthProtectedResourceMetadata | null> {

    try {

      const response = await fetch(resourceMetadataUrl);

      if (!response.ok) {

        return null;

      }

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

expect(result.failed).toBeGreaterThan(0);

        } finally {

          // Restore permissions so cleanup can proceed in afterEach

          await fs.chmod(chatsDir, 0o777);

          await fs.chmod(targetFile, 0o666);

        }

      },

Remediation

File modes: use 0600 for secrets, 0644 for read-only data, 0755 for directories. IAM: scope Action to the specific service+verb (s3:GetObject) and Resource to exact ARNs. Never use * for both.

Evidence

} finally {

          // Restore permissions so cleanup can proceed in afterEach

          await fs.chmod(chatsDir, 0o777);

          await fs.chmod(targetFile, 0o666);

        }

      },

    );

Remediation

File modes: use 0600 for secrets, 0644 for read-only data, 0755 for directories. IAM: scope Action to the specific service+verb (s3:GetObject) and Resource to exact ARNs. Never use * for both.

Evidence

expect.stringContaining('Session cleanup failed'),

          );

        } finally {

          await fs.chmod(chatsDir, 0o777);

        }

      },

    );

Remediation

File modes: use 0600 for secrets, 0644 for read-only data, 0755 for directories. IAM: scope Action to the specific service+verb (s3:GetObject) and Resource to exact ARNs. Never use * for both.

Evidence

/**

   * The absolute path to the file.

   */

  path: z.string(),

  /**

   * The unix timestamp of when the file was last focused.

   */

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"type": "string",

                  "description": "Type of hook (currently only \"command\" supported)."

                },

                "command": {

                  "type": "string",

                  "description": "Shell command to execute. Receives JSON input via stdin and returns JSON output via stdout."

                },

                "description": {

                  "type": "string",

                  "description": "A description of the hook."

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

});

const McpServerConfigSchema = z.object({

  url: z.string().optional(),

  type: z.enum(['sse', 'http']).optional(),

  trust: z.boolean().optional(),

  includeTools: z.array(z.string()).optional(),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"description": "Admin-required MCP server configuration (remote transports only).",

      "additionalProperties": false,

      "properties": {

        "url": {

          "type": "string",

          "description": "URL for the required MCP server."

        },

        "type": {

          "type": "string",

          "description": "Transport type for the required server.",

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"description": "Configuration for the bug report helper command.",

      "additionalProperties": false,

      "properties": {

        "urlTemplate": {

          "type": "string",

          "description": "Template used to open a bug report URL. Variables in the template are populated at runtime."

        }

      },

      "required": ["urlTemplate"]

    },

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"type": "string",

          "description": "Working directory for the server process."

        },

        "url": {

          "type": "string",

          "description": "URL for SSE or HTTP transport. Use with \"type\" field to specify transport type."

        },

        "httpUrl": {

          "type": "string",

          "description": "Streaming HTTP transport URL."

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"description": "Definition of a Model Context Protocol (MCP) server configuration.",

      "additionalProperties": false,

      "properties": {

        "command": {

          "type": "string",

          "description": "Executable invoked for stdio transport."

        },

        "args": {

          "type": "array",

          "description": "Command-line arguments for the stdio transport command.",

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

export const RequiredMcpServerConfigSchema = z.object({

  // Connection (required for forced servers)

  url: z.string(),

  type: z.enum(['sse', 'http']),

  // Auth

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

const keybindingsSchema = z.array(

  z

    .object({

      command: z.string().transform((val, ctx) => {

        const negate = val.startsWith('-');

        const commandId = negate ? val.slice(1) : val;

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

args: z.array(z.string()).optional(),

  env: z.record(z.string()).optional(),

  cwd: z.string().optional(),

  url: z.string().optional(),

  http_url: z.string().optional(),

  headers: z.record(z.string()).optional(),

  tcp: z.string().optional(),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

mcpName: z.string().optional(),

  argsPattern: z.string().optional(),

  commandPrefix: z.union([z.string(), z.array(z.string())]).optional(),

  commandRegex: z.string().optional(),

  priority: z.number().int().default(0),

  modes: z.array(z.nativeEnum(ApprovalMode)).optional(),

  toolAnnotations: z.record(z.any()).optional(),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

mcpName: z.string().optional(),

  argsPattern: z.string().optional(),

  commandPrefix: z.union([z.string(), z.array(z.string())]).optional(),

  commandRegex: z.string().optional(),

  decision: z.nativeEnum(PolicyDecision),

  // Priority must be in range [0, 999] to prevent tier overflow.

  // With tier transformation (tier + priority/1000), this ensures:

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

.regex(/^[a-z0-9-_]+$/, 'Name must be a valid slug');

const mcpServerSchema = z.object({

  command: z.string().optional(),

  args: z.array(z.string()).optional(),

  env: z.record(z.string()).optional(),

  cwd: z.string().optional(),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"url": "https://github.com/lvce-editor/ripgrep"

  },

  "scripts": {

    "postinstall": "node ./src/postinstall.js",

    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js",

    "test:watch": "node --experimental-vm-modules node_modules/jest/bin/jest.js --watch",

    "format": "prettier --write ."

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Evidence

"format": "prettier --experimental-cli --write .",

    "typecheck": "npm run typecheck --workspaces --if-present && tsc -b evals/tsconfig.json integration-tests/tsconfig.json memory-tests/tsconfig.json",

    "preflight": "npm run clean && npm ci && npm run format && npm run build && npm run lint:ci && npm run typecheck && npm run test:ci",

    "prepare": "husky && npm run bundle",

    "prepare:package": "node scripts/prepare-package.js",

    "release:version": "node scripts/version.js",

    "tel

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Evidence

"build:dev": "node esbuild.js",

    "build:prod": "node esbuild.js --production",

    "generate:notices": "node ./scripts/generate-notices.js",

    "prepare": "npm run generate:notices",

    "check-types": "tsc --noEmit",

    "lint": "eslint src",

    "watch": "npm-run-all2 -p watch:*",

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Evidence

# Use a common base image like Debian.

# Using 'bookworm-slim' for a balance of size and compatibility.

FROM debian:bookworm-slim

# Set environment variables to prevent interactive prompts during installation

ENV DEBIAN_FRONTEND=noninteractive

ENV NODE_VERSION=20.12.2

ENV NODE_VERSION_MAJOR=20

ENV DOCKER_CLI_VERSION=26.1.3

ENV BUILDX_VERSION=v0.14.0

# Install dependencies for adding NodeSource repository, gcloud, and other tools

# - curl: for downloading files

# - gnupg: for managing GPG keys 

Remediation

Create and switch to a non-root user before the CMD / ENTRYPOINT: RUN adduser --system --uid 1000 app USER 1000 Or reuse the base image's shipped non-root account (e.g. `USER nobody`, `USER nonroot` on distroless). Multi-stage builds only need the USER directive in the final stage.

Evidence

try {

    execSync('pkill -f "jaeger"');

    console.log('✅ Stopped existing jaeger process.');

  } catch {} // eslint-disable-line no-empty

  try {

    if (fileExists(OTEL_LOG_FILE)) fs.unlinkSync(OTEL_LOG_FILE);

    console.log('✅ Deleted old collector log.');

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

{

    selector: 'CatchClause > Identifier[name=/^_/]',

    message:

      'Do not use underscored identifiers in catch blocks. If the error is unused, use "catch {}". If it is used, remove the underscore.',

  },

];

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

issue_number: issueNumber

                  });

                  linkedIssues = [{ number: issueNumber, labels: { nodes: issue.labels.map(l => ({ name: l.name })) } }];

                } catch (e) {}

              }

              // 3. Enforcement Logic

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

} else {

        try {

          fsMod.rmSync(finalRuntimeDir, { recursive: true, force: true });

        } catch {}

      }

    } else {

      try {

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

const input = JSON.parse(fs.readFileSync(0, 'utf-8'));

        const messageCount = input.llm_request?.contents?.length || 0;

        let counts = [];

        try { counts = JSON.parse(fs.readFileSync(${escapedPath}, 'utf-8')); } catch (e) {}

        counts.push(messageCount);

        fs.writeFileSync(${escapedPath}, JSON.stringify(counts));

        console.log(JSON.stringify({ decision: 'allow' }));

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

if (d > lastActivity) lastActivity = d;

                    }

                  }

                } catch (e) {}

                if (lastActivity < thirtyDaysAgo) {

                  const labels = pr.labels.map(l => l.name.toLowerCase());

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.