@shipit-ai/cli 1.166.1 → 1.167.0

package/dist/src/presentation/web/app/actions/agent-permissions.js

@@ -0,0 +1,181 @@
+'use server';
+import { resolve } from '../../lib/server-container.js';
+import { updateSettings as updateSettingsSingleton } from '../../../../../packages/core/src/infrastructure/services/settings.service.js';
+import { revalidatePath } from 'next/cache';
+import { AgentType, ClaudeCodePermissionMode, CursorPermissionMode, GeminiPermissionMode, CodexPermissionMode, CopilotPermissionMode, RovoDevPermissionMode, } from '../../../../../packages/core/src/domain/generated/output.js';
+const VALID_MODES = {
+    [AgentType.ClaudeCode]: [
+        {
+            value: ClaudeCodePermissionMode.BypassPermissions,
+            label: 'Bypass permissions',
+            description: 'Skip all permission checks. Fastest for batch runs.',
+            batchSafe: true,
+        },
+        {
+            value: ClaudeCodePermissionMode.AcceptEdits,
+            label: 'Accept edits',
+            description: 'Auto-approve file edits; prompt for shell/network.',
+            batchSafe: false,
+        },
+        {
+            value: ClaudeCodePermissionMode.Plan,
+            label: 'Plan',
+            description: 'Read-only; proposes changes without acting.',
+            batchSafe: false,
+        },
+        {
+            value: ClaudeCodePermissionMode.Default,
+            label: 'Default',
+            description: 'Prompt for everything except reads.',
+            batchSafe: false,
+        },
+    ],
+    [AgentType.Cursor]: [
+        {
+            value: CursorPermissionMode.Yolo,
+            label: 'Yolo',
+            description: 'Write files and execute commands autonomously.',
+            batchSafe: true,
+        },
+        {
+            value: CursorPermissionMode.Propose,
+            label: 'Propose',
+            description: 'Read and analyze; output a diff without writing.',
+            batchSafe: true,
+        },
+    ],
+    [AgentType.GeminiCli]: [
+        {
+            value: GeminiPermissionMode.Yolo,
+            label: 'Yolo',
+            description: 'Auto-approve all tool calls.',
+            batchSafe: true,
+        },
+        {
+            value: GeminiPermissionMode.AutoEdit,
+            label: 'Auto-edit',
+            description: 'Auto-approve edits; prompt for shell.',
+            batchSafe: false,
+        },
+        {
+            value: GeminiPermissionMode.Default,
+            label: 'Default',
+            description: 'Prompt for every tool call.',
+            batchSafe: false,
+        },
+    ],
+    [AgentType.CodexCli]: [
+        {
+            value: CodexPermissionMode.DangerFullAccess,
+            label: 'Full access',
+            description: 'No sandbox. Unrestricted access.',
+            batchSafe: true,
+        },
+        {
+            value: CodexPermissionMode.WorkspaceWrite,
+            label: 'Workspace write',
+            description: 'Writes inside worktree, no network.',
+            batchSafe: true,
+        },
+        {
+            value: CodexPermissionMode.ReadOnly,
+            label: 'Read only',
+            description: 'Cannot modify anything.',
+            batchSafe: true,
+        },
+    ],
+    [AgentType.CopilotCli]: [
+        {
+            value: CopilotPermissionMode.Yolo,
+            label: 'Yolo',
+            description: 'Disable all permission prompts.',
+            batchSafe: true,
+        },
+        {
+            value: CopilotPermissionMode.AllowPaths,
+            label: 'Allow paths',
+            description: 'Filesystem access auto-approved; shell prompts.',
+            batchSafe: false,
+        },
+        {
+            value: CopilotPermissionMode.Prompt,
+            label: 'Prompt',
+            description: 'Built-in tool category defaults.',
+            batchSafe: false,
+        },
+    ],
+    [AgentType.RovoDev]: [
+        {
+            value: RovoDevPermissionMode.Yolo,
+            label: 'Yolo',
+            description: 'Bypass all prompts.',
+            batchSafe: true,
+        },
+        {
+            value: RovoDevPermissionMode.Shadow,
+            label: 'Shadow',
+            description: 'Temporary workspace clone. Experimental.',
+            batchSafe: false,
+        },
+        {
+            value: RovoDevPermissionMode.Config,
+            label: 'Config',
+            description: 'Respect ~/.rovodev/config.yml settings.',
+            batchSafe: false,
+        },
+    ],
+};
+/** Agent type to AgentPermissionSettings key mapping */
+const AGENT_TYPE_TO_PERMISSION_KEY = {
+    [AgentType.ClaudeCode]: 'claudeCode',
+    [AgentType.Cursor]: 'cursor',
+    [AgentType.GeminiCli]: 'geminiCli',
+    [AgentType.CodexCli]: 'codexCli',
+    [AgentType.CopilotCli]: 'copilotCli',
+    [AgentType.RovoDev]: 'rovoDev',
+};
+export async function getAgentPermissionOptions(agentType) {
+    return VALID_MODES[agentType] ?? [];
+}
+export async function getCurrentAgentPermissionMode(agentType) {
+    const loadUseCase = resolve('LoadSettingsUseCase');
+    const settings = await loadUseCase.execute();
+    const key = AGENT_TYPE_TO_PERMISSION_KEY[agentType];
+    if (!key)
+        return undefined;
+    return settings.agent?.permissions?.[key];
+}
+export async function setAgentPermissionMode(agentType, mode) {
+    try {
+        const key = AGENT_TYPE_TO_PERMISSION_KEY[agentType];
+        if (!key) {
+            return { success: false, error: `Unsupported agent type: ${agentType}` };
+        }
+        const modes = VALID_MODES[agentType];
+        if (!modes?.some((m) => m.value === mode)) {
+            return { success: false, error: `Invalid permission mode: ${mode}` };
+        }
+        const loadUseCase = resolve('LoadSettingsUseCase');
+        const current = await loadUseCase.execute();
+        const updatedSettings = {
+            ...current,
+            agent: {
+                ...current.agent,
+                permissions: {
+                    ...current.agent?.permissions,
+                    [key]: mode,
+                },
+            },
+            updatedAt: new Date(),
+        };
+        const updateUseCase = resolve('UpdateSettingsUseCase');
+        await updateUseCase.execute(updatedSettings);
+        updateSettingsSingleton(updatedSettings);
+        revalidatePath('/', 'layout');
+        return { success: true };
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : 'Failed to update permission mode';
+        return { success: false, error: message };
+    }
+}

package/dist/src/presentation/web/app/actions/check-agent-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"check-agent-auth.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/check-agent-auth.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,EAAE,OAAO,CAAC;IACnB,8CAA8C;IAC9C,aAAa,EAAE,OAAO,CAAC;IACvB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0FAA0F;IAC1F,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,wDAAwD;IACxD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AA+ID;;;GAGG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,CA4H/D"}
+{"version":3,"file":"check-agent-auth.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/check-agent-auth.ts"],"names":[],"mappings":"AAWA,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,+CAA+C;IAC/C,SAAS,EAAE,OAAO,CAAC;IACnB,8CAA8C;IAC9C,aAAa,EAAE,OAAO,CAAC;IACvB,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0FAA0F;IAC1F,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,wDAAwD;IACxD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AA4ID;;;GAGG;AACH,wBAAsB,cAAc,IAAI,OAAO,CAAC,eAAe,CAAC,CA4H/D"}

package/dist/src/presentation/web/app/actions/check-agent-auth.js

@@ -12,9 +12,6 @@ const AGENT_LABELS = {
     cursor: 'Cursor CLI',
     'gemini-cli': 'Gemini CLI',
     'rovo-dev': 'Rovo Dev CLI',
-    aider: 'Aider',
-    continue: 'Continue',
-    dev: 'Demo',
 };
 const AGENT_TOOL_MAP = {
     'claude-code': 'claude-code',
@@ -92,7 +89,7 @@ function tier1AuthCheck(agentType) {
             return existsSync(acliDir) ? 'file' : false;
         }
         default:
-            // dev, aider, continue — assume no auth needed
+            // Unknown agents — assume no auth needed
             return 'env-var';
     }
 }
@@ -169,7 +166,7 @@ export async function checkAgentAuth() {
     const label = AGENT_LABELS[agentType] ?? agentType;
     const toolId = AGENT_TOOL_MAP[agentType] ?? null;
     const binaryName = AGENT_BINARY_MAP[agentType] ?? null;
-    // Dev/demo agents — always good
+    // Agents without a tool mapping — always good
     if (!toolId) {
         return {
             agentType,

package/dist/src/presentation/web/app/actions/check-agent-tool.js

@@ -22,7 +22,7 @@ const AGENT_BINARY_MAP = {
 export async function checkAgentTool(agentType) {
     const toolId = AGENT_TOOL_MAP[agentType] ?? null;
     const binaryName = AGENT_BINARY_MAP[agentType] ?? null;
-    // Dev agent and unknown agents don't need a tool
+    // Agents without a tool mapping don't need a tool check
     if (!toolId) {
         return { agentType, toolId: null, tool: null, installed: true, binaryName: null };
     }

package/dist/src/presentation/web/app/actions/deploy-repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-repository.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/deploy-repository.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAK1E,wBAAsB,gBAAgB,CACpC,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,eAAe,CAAA;CAAE,CAAC,CAiCxE"}
+{"version":3,"file":"deploy-repository.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/deploy-repository.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAK1E,wBAAsB,gBAAgB,CACpC,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,eAAe,CAAA;CAAE,CAAC,CAuCxE"}

package/dist/src/presentation/web/app/actions/deploy-repository.js

@@ -1,5 +1,5 @@
 'use server';
-import { existsSync } from 'node:fs';
+import { realpathSync } from 'node:fs';
 import { isAbsolute } from 'node:path';
 import { resolve } from '../../lib/server-container.js';
 import { createDeploymentLogger } from '../../lib/core-utils.js';
@@ -12,12 +12,19 @@ export async function deployRepository(repositoryPath) {
         log.warn('rejected — not an absolute path');
         return { success: false, error: 'repositoryPath must be an absolute path' };
     }
+    // Resolve through realpath() up-front. Every subsequent use references
+    // the symlink-resolved absolute path, not the raw user input. This is the
+    // sanitizer CodeQL's js/path-injection analysis recognizes.
+    let resolvedPath;
     try {
-        if (!existsSync(repositoryPath)) {
-            log.warn(`directory does not exist: "${repositoryPath}"`);
-            return { success: false, error: `Directory does not exist: ${repositoryPath}` };
-        }
-        if (isSameShipitAiInstance(repositoryPath)) {
+        resolvedPath = realpathSync(repositoryPath);
+    }
+    catch {
+        log.warn(`directory does not exist: "${repositoryPath}"`);
+        return { success: false, error: 'Directory does not exist' };
+    }
+    try {
+        if (isSameShipitAiInstance(resolvedPath)) {
             log.warn('rejected — target is the running ShipIT instance');
             return {
                 success: false,
@@ -26,7 +33,7 @@ export async function deployRepository(repositoryPath) {
         }
         log.info('directory exists, calling deploymentService.start()');
         const deploymentService = resolve('IDeploymentService');
-        deploymentService.start(repositoryPath, repositoryPath, 'repository');
+        deploymentService.start(resolvedPath, resolvedPath, 'repository');
         log.info('start() returned successfully — state=Booting');
         return { success: true, state: DeploymentState.Booting };
     }

package/dist/src/presentation/web/app/actions/get-all-agent-models.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-all-agent-models.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/get-all-agent-models.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACpB;AAoCD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAmDpE"}
+{"version":3,"file":"get-all-agent-models.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/get-all-agent-models.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,SAAS,EAAE,CAAC;IACpB,SAAS,EAAE,OAAO,CAAC;CACpB;AAkCD,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAsCpE"}

package/dist/src/presentation/web/app/actions/get-all-agent-models.js

@@ -8,9 +8,8 @@ const AGENT_LABELS = {
     cursor: 'Cursor CLI',
     'gemini-cli': 'Gemini CLI',
     'rovo-dev': 'Rovo Dev CLI',
-    dev: 'Demo',
 };
-/** Sort weight — higher = further down. Demo always last. */
+/** Sort weight — lower = further up in the list. */
 const AGENT_ORDER = {
     'claude-code': 0,
     'codex-cli': 1,
@@ -18,7 +17,6 @@ const AGENT_ORDER = {
     cursor: 3,
     'gemini-cli': 4,
     'rovo-dev': 5,
-    dev: 99,
 };
 /**
  * Maps agent types to their corresponding tool IDs for availability checks.
@@ -45,25 +43,12 @@ export async function getAllAgentModels() {
                 ...getModelMeta(id),
             })),
         }))
-            .map((g) => {
-            // Dev agent gets fun demo models
-            if (g.agentType === 'dev' && g.models.length === 0) {
-                return {
-                    ...g,
-                    models: [
-                        { id: 'gpt-8', ...getModelMeta('gpt-8') },
-                        { id: 'opus-7', ...getModelMeta('opus-7') },
-                    ],
-                };
-            }
-            return g;
-        })
             .filter((g) => g.models.length > 0);
         // Check which agents are actually installed
         const toolService = resolve('IToolInstallerService');
         const groupsWithStatus = await Promise.all(groups.map(async (group) => {
             const toolId = AGENT_TOOL_IDS[group.agentType];
-            if (!toolId || group.agentType === 'dev') {
+            if (!toolId) {
                 return { ...group, installed: true };
             }
             try {

package/dist/src/presentation/web/app/actions/get-merge-review-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-merge-review-data.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/get-merge-review-data.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,sDAAsD,CAAC;AAI9D,KAAK,wBAAwB,GAAG,eAAe,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAqCpE,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA4G7F"}
+{"version":3,"file":"get-merge-review-data.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/get-merge-review-data.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,sDAAsD,CAAC;AAI9D,KAAK,wBAAwB,GAAG,eAAe,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAwDpE,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAwI7F"}

package/dist/src/presentation/web/app/actions/get-merge-review-data.js

@@ -1,12 +1,17 @@
 'use server';
 import { createHash } from 'node:crypto';
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { basename, join, dirname } from 'node:path';
 import { resolve } from '../../lib/server-container.js';
+import { realpathOrNull, isWithinRoot } from '../../lib/path-sanitizers.js';
 import { computeWorktreePath, getShipitAiHomeDir } from '../../lib/core-utils.js';
 /**
  * Compute the ShipIT evidence directory for a given repository and feature.
  * Path: ~/.shipit-ai/repos/<sha256-hash-prefix>/evidence/<featureId>/
+ *
+ * The sha256 hash of the repository path makes the resulting directory name
+ * deterministic and hex-only, neutralizing any path-injection risk from the
+ * repositoryPath input. The featureId is a UUID from the DB lookup.
  */
 function computeEvidenceDir(repositoryPath, featureId) {
     const repoHash = createHash('sha256').update(repositoryPath).digest('hex').slice(0, 16);
@@ -19,21 +24,34 @@ function computeEvidenceDir(repositoryPath, featureId) {
  * deleted so those paths no longer resolve. The evidence files were also saved
  * to the ShipIT evidence dir with the same filename, so we map relative paths
  * to absolute paths there.
+ *
+ * IMPORTANT: the returned paths must remain in the SAME form as the
+ * `/api/evidence` route expects (it uses `path.resolve` + `.startsWith`
+ * against the unresolved `SHIPIT_AI_HOME/repos` root). Do not pass
+ * realpath-resolved paths here, because on macOS `SHIPIT_AI_HOME=/tmp/...`
+ * resolves to `/private/tmp/...` and the evidence route's prefix check
+ * would reject the realpath'd form. Basename-only containment (strip any
+ * directory traversal via `basename()` then `join()` with the known-safe
+ * `evidenceDir`) is sufficient sanitization for this taint source because
+ * `basename()` cannot return a path-traversal string.
  */
 function normalizeEvidencePaths(evidence, evidenceDir) {
     return evidence.map((e) => {
+        // If the manifest path is absolute and already present on disk, keep
+        // it verbatim — this preserves the original reference and matches the
+        // pre-fix behavior for already-migrated evidence. We do NOT realpath
+        // the result because the evidence route does not realpath its input,
+        // and mismatching normalization forms would cause 404s.
         if (e.relativePath.startsWith('/')) {
-            // Already absolute — check if the file exists; if not, try the evidence dir
-            if (existsSync(e.relativePath))
-                return e;
-            const fallback = join(evidenceDir, basename(e.relativePath)).replace(/\\/g, '/');
-            if (existsSync(fallback))
-                return { ...e, relativePath: fallback };
             return e;
         }
-        // Relative path — resolve to evidence dir using the filename
-        const absolutePath = join(evidenceDir, basename(e.relativePath)).replace(/\\/g, '/');
-        return { ...e, relativePath: absolutePath };
+        // Relative path — map to evidenceDir using basename() only. `basename`
+        // strips any directory components including `..` sequences, so the
+        // joined result is guaranteed to live directly inside evidenceDir
+        // regardless of what the manifest file contained.
+        const safeName = basename(e.relativePath);
+        const target = join(evidenceDir, safeName).replace(/\\/g, '/');
+        return { ...e, relativePath: target };
     });
 }
 export async function getMergeReviewData(featureId) {
@@ -88,19 +106,45 @@ export async function getMergeReviewData(featureId) {
                 : null;
         if (evidenceDir) {
             try {
-                const manifestPath = join(evidenceDir, 'manifest.json');
-                if (existsSync(manifestPath)) {
-                    const raw = JSON.parse(readFileSync(manifestPath, 'utf-8'));
-                    const normalized = normalizeEvidencePaths(raw, evidenceDir);
-                    // Deduplicate: same type + relativePath means the same evidence entry
-                    const seen = new Set();
-                    evidence = normalized.filter((e) => {
-                        const key = `${e.type}:${e.relativePath}`;
-                        if (seen.has(key))
-                            return false;
-                        seen.add(key);
-                        return true;
-                    });
+                // SECURITY: validate the manifest we're about to read lives inside
+                // SHIPIT_AI_HOME. computeEvidenceDir() already hashes repositoryPath
+                // to a hex directory name, but we still run a realpath containment
+                // check because CodeQL's js/path-injection analysis recognizes the
+                // realpathOrNull + isWithinRoot pair as a sanitizer chain.
+                //
+                // Resolve-once semantics: realpath the shipit home dir and the
+                // evidence dir exactly once each, then reuse those resolved values
+                // for every subsequent containment check. This avoids both the
+                // extra syscalls and the TOCTOU window that a recursive resolve-
+                // and-check helper would introduce.
+                //
+                // IMPORTANT: the resolved paths are used ONLY for the read-time
+                // security check. The unresolved `evidenceDir` is what we pass to
+                // normalizeEvidencePaths so the paths returned to the client match
+                // what the /api/evidence route expects — see the comment on
+                // normalizeEvidencePaths for the full rationale.
+                const resolvedHome = realpathOrNull(getShipitAiHomeDir());
+                const resolvedEvidenceDir = realpathOrNull(evidenceDir);
+                if (resolvedHome &&
+                    resolvedEvidenceDir &&
+                    isWithinRoot(resolvedEvidenceDir, resolvedHome)) {
+                    const resolvedManifest = realpathOrNull(join(resolvedEvidenceDir, 'manifest.json'));
+                    if (resolvedManifest && isWithinRoot(resolvedManifest, resolvedEvidenceDir)) {
+                        // codeql[js/path-injection] -- resolvedManifest validated by realpathOrNull + isWithinRoot(resolvedManifest, resolvedEvidenceDir) on line 159; featureId flows through SHA-256 hash in computeEvidenceDir
+                        const raw = JSON.parse(readFileSync(resolvedManifest, 'utf-8'));
+                        // Pass the UNRESOLVED evidenceDir so returned paths share the
+                        // same root form the evidence route's prefix check expects.
+                        const normalized = normalizeEvidencePaths(raw, evidenceDir);
+                        // Deduplicate: same type + relativePath means the same evidence entry
+                        const seen = new Set();
+                        evidence = normalized.filter((e) => {
+                            const key = `${e.type}:${e.relativePath}`;
+                            if (seen.has(key))
+                                return false;
+                            seen.add(key);
+                            return true;
+                        });
+                    }
                 }
             }
             catch {

package/dist/src/presentation/web/app/actions/open-folder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open-folder.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/open-folder.ts"],"names":[],"mappings":"AAiBA,wBAAsB,UAAU,CAC9B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAkC9D"}
+{"version":3,"file":"open-folder.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/open-folder.ts"],"names":[],"mappings":"AAiBA,wBAAsB,UAAU,CAC9B,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAyC9D"}

package/dist/src/presentation/web/app/actions/open-folder.js

@@ -1,5 +1,5 @@
 'use server';
-import { existsSync } from 'node:fs';
+import { realpathSync } from 'node:fs';
 import { platform } from 'node:os';
 import { isAbsolute, normalize } from 'node:path';
 import { spawn } from 'node:child_process';
@@ -17,7 +17,15 @@ export async function openFolder(repositoryPath) {
         return { success: false, error: 'repositoryPath must be an absolute path' };
     }
     try {
-        if (!existsSync(repositoryPath)) {
+        // Resolve through realpath() up-front. All subsequent uses of the path
+        // reference this symlink-resolved absolute value, not the raw user input.
+        // This eliminates path-injection via symlinks and is the sanitizer that
+        // CodeQL's js/path-injection analysis recognizes.
+        let resolvedPath;
+        try {
+            resolvedPath = realpathSync(repositoryPath);
+        }
+        catch {
             return { success: false, error: 'Directory not found' };
         }
         const entry = FOLDER_COMMANDS[platform()];
@@ -29,14 +37,14 @@ export async function openFolder(repositoryPath) {
         }
         // Normalize to platform-native separators — explorer.exe on Windows
         // does not understand forward-slash paths and falls back to Documents.
-        const nativePath = normalize(repositoryPath);
+        const nativePath = normalize(resolvedPath);
         const child = spawn(entry.cmd, entry.args(nativePath), {
             detached: true,
             stdio: 'ignore',
         });
         child.on('error', () => undefined); // Prevent uncaught exception on spawn failure
         child.unref();
-        return { success: true, path: repositoryPath };
+        return { success: true, path: resolvedPath };
     }
     catch (error) {
         const message = error instanceof Error ? error.message : 'Failed to open folder';

package/dist/src/presentation/web/app/actions/open-shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open-shell.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/open-shell.ts"],"names":[],"mappings":"AA0BA,UAAU,cAAc;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,SAAS,CAC7B,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA6E9E"}
+{"version":3,"file":"open-shell.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/open-shell.ts"],"names":[],"mappings":"AAmDA,UAAU,cAAc;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,SAAS,CAC7B,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA4F9E"}

package/dist/src/presentation/web/app/actions/open-shell.js

@@ -1,10 +1,34 @@
 'use server';
-import { existsSync } from 'node:fs';
+import { realpathSync } from 'node:fs';
 import { platform } from 'node:os';
 import { isAbsolute } from 'node:path';
 import { spawn } from 'node:child_process';
 import { computeWorktreePath } from '../../lib/core-utils.js';
 import { resolve } from '../../lib/server-container.js';
+/**
+ * Resolve the target path through realpath() so that any symlink traversal
+ * happens up-front and the resulting absolute path is the authoritative
+ * value used for all subsequent spawn operations. Returns null if the path
+ * does not exist or cannot be resolved.
+ */
+function resolveTargetPath(repositoryPath, branch) {
+    try {
+        const base = branch ? computeWorktreePath(repositoryPath, branch) : repositoryPath;
+        return realpathSync(base);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * POSIX shell-escape a path for safe inclusion in a shell:true command string.
+ * Wraps in single quotes and escapes embedded single quotes using the
+ * standard '\'' pattern. All tool configurations that opt into shell:true
+ * use POSIX-style commands (`cd {dir} && exec <tool>`) and run on Unix only.
+ */
+function shellEscapePosixPath(p) {
+    return `'${p.replace(/'/g, `'\\''`)}'`;
+}
 // Fallback commands for the "system" terminal when no tool metadata entry exists.
 // Uses a record lookup instead of if/else to prevent the bundler from
 // tree-shaking platform branches at build time. Turbopack evaluates
@@ -28,9 +52,12 @@ export async function openShell(input) {
         const settings = await loadSettings.execute();
         const shell = settings.environment.shellPreference;
         const terminalPref = settings.environment.terminalPreference ?? 'system';
-        const targetPath = branch ? computeWorktreePath(repositoryPath, branch) : repositoryPath;
-        if (!existsSync(targetPath)) {
-            return { success: false, error: `Path does not exist: ${targetPath}` };
+        // Resolve the target path through realpath() up-front. From this point
+        // on, `targetPath` is the authoritative, symlink-resolved absolute path
+        // used for every spawn call — never the raw user-supplied value.
+        const targetPath = resolveTargetPath(repositoryPath, branch);
+        if (!targetPath) {
+            return { success: false, error: 'Path does not exist' };
         }
         // Try to find the terminal in tool metadata via DI container.
         // Using DI (not a direct import from tool-metadata) ensures that
@@ -42,9 +69,16 @@ export async function openShell(input) {
                 const service = resolve('IToolInstallerService');
                 const config = service.getTerminalOpenConfig(terminalPref);
                 if (config?.openDirectory.includes('{dir}')) {
-                    const resolved = config.openDirectory.replace('{dir}', targetPath);
                     if (config.shell) {
-                        const child = spawn(resolved, [], {
+                        // For shell:true tools (claude-code, codex-cli, etc.) the tool
+                        // config is a POSIX shell string like `cd {dir} && exec claude`.
+                        // Shell-escape the path to prevent command injection: a malicious
+                        // path like `/tmp; rm -rf /` becomes `'/tmp; rm -rf /'` which the
+                        // shell treats as a single literal argument to `cd`.
+                        const escapedPath = shellEscapePosixPath(targetPath);
+                        const command = config.openDirectory.replaceAll('{dir}', escapedPath);
+                        // codeql[js/command-line-injection] -- targetPath from realpathSync (must exist on disk); shell-escaped via single-quote wrapping in shellEscapePosixPath; localhost-only server action
+                        const child = spawn(command, [], {
                             detached: true,
                             stdio: 'ignore',
                             shell: true,
@@ -53,7 +87,13 @@ export async function openShell(input) {
                         child.unref();
                     }
                     else {
-                        const [command, ...args] = resolved.split(/\s+/);
+                        // For non-shell tools (alacritty, kitty, etc.) the config is a
+                        // whitespace-separated command. Split first, then substitute {dir}
+                        // INTO AN ARGV ELEMENT (never back into a concatenated string).
+                        // CodeQL recognizes the argv-form of spawn as sanitized input.
+                        const tokens = config.openDirectory.split(/\s+/).filter(Boolean);
+                        const command = tokens[0];
+                        const args = tokens.slice(1).map((t) => t.replaceAll('{dir}', targetPath));
                         const child = spawn(command, args, {
                             detached: true,
                             stdio: 'ignore',

package/dist/src/presentation/web/app/api/agent-events/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/app/api/agent-events/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,eAAO,MAAM,OAAO,kBAAkB,CAAC;AAKvC,+EAA+E;AAC/E,YAAY,EAAE,uBAAuB,EAAE,MAAM,yEAAyE,CAAC;AAEvH,wBAAgB,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CAoG9C"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/app/api/agent-events/route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAUH,eAAO,MAAM,OAAO,kBAAkB,CAAC;AAKvC,+EAA+E;AAC/E,YAAY,EAAE,uBAAuB,EAAE,MAAM,yEAAyE,CAAC;AAEvH,wBAAgB,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,QAAQ,CA+F9C"}

package/dist/src/presentation/web/app/api/agent-events/route.js

@@ -16,6 +16,7 @@
  * - Cleans up intervals on client disconnect
  */
 import { resolve } from '../../../lib/server-container.js';
+import { apiError } from '../../../lib/api-helpers.js';
 // Force dynamic — SSE streams must never be statically optimized or cached
 export const dynamic = 'force-dynamic';
 const POLL_INTERVAL_MS = 2_000;
@@ -100,11 +101,6 @@ export function GET(request) {
         });
     }
     catch (error) {
-        // eslint-disable-next-line no-console
-        console.error('[SSE route] GET handler error:', error);
-        return new Response(JSON.stringify({ error: String(error) }), {
-            status: 500,
-            headers: { 'Content-Type': 'application/json' },
-        });
+        return apiError(500, 'Failed to open agent events stream', error);
     }
 }

package/dist/src/presentation/web/app/api/attachments/upload-from-path/route.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/presentation/web/app/api/attachments/upload-from-path/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAmF3C,wBAAsB,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CA4ElE"}
+{"version":3,"file":"route.d.ts","sourceRoot":"","sources":["../../../../../../../../src/presentation/web/app/api/attachments/upload-from-path/route.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAoF3C,wBAAsB,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CA8ElE"}