@shipit-ai/cli 1.167.0 → 1.167.1

package/dist/src/presentation/web/app/actions/get-merge-review-data.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-merge-review-data.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/get-merge-review-data.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,sDAAsD,CAAC;AAI9D,KAAK,wBAAwB,GAAG,eAAe,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAwDpE,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAwI7F"}
+{"version":3,"file":"get-merge-review-data.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/get-merge-review-data.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EACV,eAAe,EAEhB,MAAM,sDAAsD,CAAC;AAI9D,KAAK,wBAAwB,GAAG,eAAe,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAwDpE,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA4I7F"}

package/dist/src/presentation/web/app/actions/get-merge-review-data.js

@@ -130,7 +130,11 @@ export async function getMergeReviewData(featureId) {
                     isWithinRoot(resolvedEvidenceDir, resolvedHome)) {
                     const resolvedManifest = realpathOrNull(join(resolvedEvidenceDir, 'manifest.json'));
                     if (resolvedManifest && isWithinRoot(resolvedManifest, resolvedEvidenceDir)) {
-                        // codeql[js/path-injection] -- resolvedManifest validated by realpathOrNull + isWithinRoot(resolvedManifest, resolvedEvidenceDir) on line 159; featureId flows through SHA-256 hash in computeEvidenceDir
+                        // SECURITY: resolvedManifest validated by realpathOrNull + isWithinRoot
+                        // containment on line 159. featureId flows through SHA-256 hash in
+                        // computeEvidenceDir (hex-only output neutralizes injection). Double
+                        // containment check: home dir → evidence dir → manifest. Alert
+                        // js/path-injection #27 dismissed as false positive.
                         const raw = JSON.parse(readFileSync(resolvedManifest, 'utf-8'));
                         // Pass the UNRESOLVED evidenceDir so returned paths share the
                         // same root form the evidence route's prefix check expects.

package/dist/src/presentation/web/app/actions/open-shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open-shell.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/open-shell.ts"],"names":[],"mappings":"AAmDA,UAAU,cAAc;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,SAAS,CAC7B,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA4F9E"}
+{"version":3,"file":"open-shell.d.ts","sourceRoot":"","sources":["../../../../../../src/presentation/web/app/actions/open-shell.ts"],"names":[],"mappings":"AAmDA,UAAU,cAAc;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,SAAS,CAC7B,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgG9E"}

package/dist/src/presentation/web/app/actions/open-shell.js

@@ -77,7 +77,11 @@ export async function openShell(input) {
                         // shell treats as a single literal argument to `cd`.
                         const escapedPath = shellEscapePosixPath(targetPath);
                         const command = config.openDirectory.replaceAll('{dir}', escapedPath);
-                        // codeql[js/command-line-injection] -- targetPath from realpathSync (must exist on disk); shell-escaped via single-quote wrapping in shellEscapePosixPath; localhost-only server action
+                        // SECURITY: targetPath from realpathSync (must exist on disk); single-quote
+                        // shell-escaped via shellEscapePosixPath; localhost-only server action.
+                        // shell:true is required by tool configs using `cd {dir} && exec <tool>`.
+                        // CodeQL flags this because it does not model custom sanitizer functions —
+                        // alert js/command-line-injection #29 dismissed as false positive.
                         const child = spawn(command, [], {
                             detached: true,
                             stdio: 'ignore',

package/dist/src/presentation/web/components/common/base-drawer/base-drawer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"base-drawer.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/base-drawer/base-drawer.tsx"],"names":[],"mappings":"AAIA,OAAO,EAAO,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAiBlE,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAGpF,QAAA,MAAM,cAAc;;8EAWlB,CAAC;AAEH,MAAM,WAAW,eAAgB,SAAQ,YAAY,CAAC,OAAO,cAAc,CAAC;IAC1E,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACzB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC;AAED,wBAAgB,UAAU,CAAC,EACzB,IAAI,EACJ,OAAO,EACP,KAAa,EACb,qBAA6B,EAC7B,KAAgB,EAChB,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,MAAM,EACN,SAAS,EACT,aAAa,EAAE,MAAM,EACrB,YAAY,GACb,EAAE,eAAe,2CAgJjB"}
+{"version":3,"file":"base-drawer.d.ts","sourceRoot":"","sources":["../../../../../../../src/presentation/web/components/common/base-drawer/base-drawer.tsx"],"names":[],"mappings":"AAIA,OAAO,EAAO,KAAK,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAiBlE,OAAO,EAAmB,KAAK,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAGpF,QAAA,MAAM,cAAc;;8EAWlB,CAAC;AAEH,MAAM,WAAW,eAAgB,SAAQ,YAAY,CAAC,OAAO,cAAc,CAAC;IAC1E,IAAI,EAAE,OAAO,CAAC;IACd,OAAO,EAAE,MAAM,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,yGAAyG;IACzG,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACzB,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC;AAED,wBAAgB,UAAU,CAAC,EACzB,IAAI,EACJ,OAAO,EACP,KAAa,EACb,qBAA6B,EAC7B,KAAgB,EAChB,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,MAAM,EACN,SAAS,EACT,aAAa,EAAE,MAAM,EACrB,YAAY,GACb,EAAE,eAAe,2CAmLjB"}

package/dist/src/presentation/web/components/common/base-drawer/base-drawer.js

@@ -60,30 +60,64 @@ export function BaseDrawer({ open, onClose, modal = false, dismissOnOutsideClick
         return () => document.removeEventListener('keydown', handleKeyDown);
     }, [open, modal, onClose]);
     // Close when clicking outside the drawer panel (no overlay needed — canvas stays draggable).
-    // Uses `click` (not `pointerdown`) so canvas drags don't trigger this.
+    //
+    // Uses `click` (not `pointerdown`) as the trigger so canvas drags don't close the drawer,
+    // but tracks the `pointerdown` target separately. When the user presses the mouse on an
+    // in-drawer control that opens a portaled popover (Radix Select, DropdownMenu, Popover),
+    // Radix calls preventDefault on pointerdown and opens its portal over the trigger. By
+    // the time pointerup fires, the cursor is over the portal overlay, and Chrome computes
+    // the `click` event's target as the common ancestor of pointerdown/pointerup — which is
+    // `<body>` because the portal is detached from the drawer subtree. Without tracking the
+    // pointerdown origin we would misread this as an outside click and close the drawer.
     useEffect(() => {
         if (!open || modal)
             return;
+        // When dismissOnOutsideClick is false (default), also respect data-no-drawer-close guards.
+        const ignoreSelector = dismissOnOutsideClick
+            ? '[role="alertdialog"], [role="dialog"], [role="menu"], [role="listbox"], [data-radix-popper-content-wrapper]'
+            : '[data-no-drawer-close], [role="alertdialog"], [role="dialog"], [role="menu"], [role="listbox"], [data-radix-popper-content-wrapper]';
+        /** True when `el` is inside the drawer or an explicitly-ignored overlay. */
+        const isInsideOrIgnored = (el) => {
+            if (!el)
+                return false;
+            if (contentRef.current?.contains(el))
+                return true;
+            if (el.closest(ignoreSelector))
+                return true;
+            return false;
+        };
+        // Track the most recent pointerdown target so the click handler can check
+        // where the gesture ORIGINATED, not just where it landed.
+        let pointerDownOrigin = null;
+        const handlePointerDown = (e) => {
+            pointerDownOrigin = e.target;
+        };
         const handleClick = (e) => {
+            const origin = pointerDownOrigin;
+            // Clear for the next gesture regardless of outcome.
+            pointerDownOrigin = null;
             const target = e.target;
             // If the clicked element was unmounted by React before the event reached
             // the document (e.g. a "Next" button removed on the last step), it is no
             // longer in the DOM tree — treat it as an internal click, not an outside one.
             if (!document.body.contains(target))
                 return;
-            if (contentRef.current?.contains(target))
+            // Click landed inside the drawer or a protected overlay.
+            if (isInsideOrIgnored(target))
                 return;
-            // Don't close when clicking inside Radix overlays.
-            // When dismissOnOutsideClick is false (default), also respect data-no-drawer-close guards.
-            const ignoreSelector = dismissOnOutsideClick
-                ? '[role="alertdialog"], [role="dialog"], [role="menu"], [role="listbox"], [data-radix-popper-content-wrapper]'
-                : '[data-no-drawer-close], [role="alertdialog"], [role="dialog"], [role="menu"], [role="listbox"], [data-radix-popper-content-wrapper]';
-            if (target.closest(ignoreSelector))
+            // Click landed outside, but the gesture ORIGINATED inside the drawer or a
+            // protected overlay (e.g. a Radix Select trigger whose portal stole the
+            // pointerup target). This is not a real outside click — bail out.
+            if (isInsideOrIgnored(origin))
                 return;
             onClose();
         };
+        document.addEventListener('pointerdown', handlePointerDown, true);
         document.addEventListener('click', handleClick);
-        return () => document.removeEventListener('click', handleClick);
+        return () => {
+            document.removeEventListener('pointerdown', handlePointerDown, true);
+            document.removeEventListener('click', handleClick);
+        };
     }, [open, modal, onClose, dismissOnOutsideClick]);
     return (_jsxs(Drawer, { direction: drawerDirection, modal: modal, handleOnly: true, open: open, onOpenChange: (isOpen) => {
             if (!isOpen)

package/dist/src/presentation/web/lib/path-sanitizers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-sanitizers.d.ts","sourceRoot":"","sources":["../../../../../src/presentation/web/lib/path-sanitizers.ts"],"names":[],"mappings":"AAsCA;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAIrF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,GAAG,IAAI,CAWf;AAUD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAO3E;AAED;;;;;GAKG;AACH,wBAAsB,+BAA+B,CACnD,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcxB"}
+{"version":3,"file":"path-sanitizers.d.ts","sourceRoot":"","sources":["../../../../../src/presentation/web/lib/path-sanitizers.ts"],"names":[],"mappings":"AAsCA;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAMvD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,iBAAiB,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAIrF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,MAAM,GAAG,IAAI,CAWf;AAUD;;GAEG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAW3E;AAED;;;;;GAKG;AACH,wBAAsB,+BAA+B,CACnD,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAcxB"}

package/dist/src/presentation/web/lib/path-sanitizers.js

@@ -107,7 +107,11 @@ export function realpathWithinAllowedRoots(candidate, allowedRoots) {
  */
 export async function realpathOrNullAsync(p) {
     try {
-        // codeql[js/path-injection] -- this function IS the sanitizer: callers gate access via isWithinRoot containment checks on the resolved result
+        // SECURITY: this function IS the sanitizer — realpath() is CodeQL's recommended
+        // remediation for path injection. Callers gate access via isWithinRoot
+        // containment checks on the resolved result. Alert js/path-injection #28
+        // dismissed as false positive (CodeQL flagged the sanitizer itself due to
+        // the try/catch null-return path).
         return await realpath(p);
     }
     catch {