argusqa-os 9.8.0 → 9.8.1

package/README.md

@@ -62,7 +62,7 @@ Argus scans your app and either posts findings to Slack or opens a local `report
 
 ## What Argus Catches
 
-32 analysis engines, 140 distinct issue types, zero test-file maintenance:
+32 analysis engines, 149 distinct issue types, zero test-file maintenance:
 
 | Category | What it detects |
 |---|---|

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "argusqa-os",
-  "version": "9.8.0",
+  "version": "9.8.1",
   "mcpName": "io.github.ironclawdevs27/argus",
   "description": "Argus — AI-powered automated dev-testing platform using Chrome DevTools MCP and Claude Code",
   "keywords": [
@@ -76,10 +76,10 @@
     "zod": "^4.4.3"
   },
   "devDependencies": {
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.9",
     "c8": "^11.0.0",
     "fast-check": "^4.8.0",
     "istanbul-lib-coverage": "^3.2.2",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.9"
   }
 }

package/src/cli/init.js

@@ -288,7 +288,9 @@ async function main() {
     const targetsContent = generateTargetsJs(finalRoutes, { framework, sourceDir, envFile: envFilePath });
 
     try {
-      fs.writeFileSync('.env', envContent, { flag: 'wx', encoding: 'utf8' });
+      // .env holds Slack / GitHub / Figma tokens + the auth password — create it owner-only
+      // (0600) so credentials are never world-readable on shared / POSIX / CI hosts.
+      fs.writeFileSync('.env', envContent, { flag: 'wx', encoding: 'utf8', mode: 0o600 });
       tick('Wrote .env');
     } catch (err) {
       if (err.code === 'EEXIST') {

package/src/utils/import-graph.js

@@ -31,7 +31,6 @@ const logger = childLogger('import-graph');
 
 // Source extensions we parse + resolve, in resolution-preference order.
 export const SOURCE_EXTS = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'];
-const SOURCE_EXT_SET     = new Set(SOURCE_EXTS);
 const INDEX_BASENAMES    = SOURCE_EXTS.map(e => `index${e}`);
 
 // Stylesheet (asset) extensions tracked as LEAF nodes in the graph (PR_VALIDATOR C3): a changed
@@ -243,8 +242,15 @@ export function buildImportGraph(rootDir) {
 
     let src;
     try {
-      if (fs.statSync(file).size > MAX_FILE_BYTES) continue; // skip giant files
-      src = fs.readFileSync(file, 'utf8');
+      // Open once and stat/read the SAME descriptor — avoids a stat→read TOCTOU on `file`
+      // (CodeQL js/file-system-race). The size guard still skips pathologically large files.
+      const fd = fs.openSync(file, 'r');
+      try {
+        if (fs.fstatSync(fd).size > MAX_FILE_BYTES) continue; // skip giant files
+        src = fs.readFileSync(fd, 'utf8');
+      } finally {
+        fs.closeSync(fd);
+      }
     } catch { continue; }
 
     for (const spec of parseImports(src)) {

package/src/utils/pr-diff-analyzer.js

@@ -366,8 +366,6 @@ export function mapFilesToRoutesDeep(changedFiles, routes, { sourceDir } = {}) {
       if (!routeFileToPaths.has(file)) routeFileToPaths.set(file, new Set());
       routeFileToPaths.get(file).add(rp);
     }
-    const routeFileSet = new Set(routeFileToPaths.keys());
-
     // Resolve every changed app file to the route paths it can affect.
     const resolvedPaths = new Set();
     for (const f of appFiles) {

package/src/utils/session-persistence.js

@@ -112,8 +112,13 @@ export async function saveSession(browser, sessionFile) {
 
   const tmpFile = `${sessionFile}.tmp`;
   try {
-    fs.writeFileSync(tmpFile, JSON.stringify(state, null, 2), 'utf8');
+    // Session state holds cookies + Web Storage (auth material), so write it owner-only
+    // (0600) — never world-readable on shared / POSIX / CI hosts. Hardening for the Socket
+    // supply-chain note on this module. chmod after rename is best-effort (no-op on Windows,
+    // where file access is ACL-based rather than POSIX mode bits).
+    fs.writeFileSync(tmpFile, JSON.stringify(state, null, 2), { encoding: 'utf8', mode: 0o600 });
     fs.renameSync(tmpFile, sessionFile);
+    try { fs.chmodSync(sessionFile, 0o600); } catch { /* mode bits unsupported on this platform */ }
   } catch (err) {
     throw new Error(`[ARGUS] saveSession: failed to write session file "${sessionFile}": ${err.message}`);
   }