catalyst-core 0.3.0-beta.1 → 0.3.0-beta.3

package/dist/native/buildAndroid/assets.js

@@ -494,7 +494,7 @@ function createAssetsPhase(ctx) {
       let manifestContent = fs.readFileSync(manifestPath, "utf8");
       const metadataNames = ["default_notification_channel_id", "default_notification_icon", "default_notification_color", "com.google.firebase.messaging.default_notification_channel_id", "com.google.firebase.messaging.default_notification_icon", "com.google.firebase.messaging.default_notification_sound"];
       for (const metadataName of metadataNames) {
-        const metadataRegex = new RegExp(`\\s*<meta-data\\s+[\\s\\S]*?android:name="${metadataName}"[\\s\\S]*?\\/>`, "gi");
+        const metadataRegex = new RegExp(`\\s*<meta-data\\s+[^>]*?android:name="${metadataName}"[^>]*?\\/>`, "gi");
         manifestContent = manifestContent.replace(metadataRegex, "");
       }
       const serviceRegex = /\s*<!--\s*Push Notification Service\s*-->\s*<service[^>]*android:name="[^"]*PushNotificationUtils"[\s\S]*?<\/service>/gi;

package/dist/native/buildAndroid/index.js

@@ -1,6 +1,7 @@
 "use strict";
 
 const path = require("path");
+const fs = require("fs");
 const {
   runCommand,
   runInteractiveCommand
@@ -75,6 +76,35 @@ function createAndroidBuild(config) {
     moveApkToOutputPath,
     buildSignedAAB
   } = createBuildPhase(ctx);
+  function syncAIPackageIfEnabled(wvConfig, progress) {
+    const aiEnabled = wvConfig?.ai?.enabled === true;
+    if (!aiEnabled) return;
+    const appNodeModules = path.join(process.cwd(), "node_modules");
+    const aiPackageSrc = path.join(appNodeModules, "catalyst-ai");
+    if (!fs.existsSync(aiPackageSrc)) {
+      progress.log("ai.enabled=true but catalyst-ai not found in node_modules — skipping native AI sync", "warning");
+      return;
+    }
+    const destDir = path.join(pwd, "node_modules", "catalyst-ai");
+    fs.mkdirSync(destDir, {
+      recursive: true
+    });
+    copyDirSync(aiPackageSrc, destDir);
+    progress.log("catalyst-ai synced to dist/native/node_modules for Gradle", "success");
+  }
+  function copyDirSync(src, dest) {
+    fs.mkdirSync(dest, {
+      recursive: true
+    });
+    for (const entry of fs.readdirSync(src, {
+      withFileTypes: true
+    })) {
+      if (entry.name === "node_modules" || entry.name === ".git") continue;
+      const s = path.join(src, entry.name); // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
+      const d = path.join(dest, entry.name); // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal
+      entry.isDirectory() ? copyDirSync(s, d) : fs.copyFileSync(s, d);
+    }
+  }
   async function buildAndroidApp() {
     let androidConfig = null;
     let targetDevice = null;
@@ -133,6 +163,7 @@ function createAndroidBuild(config) {
       });
       await processNotifications(wvConfig);
       progress.log(`Build optimization: ${buildOptimisation ? "Enabled" : "Disabled"}`, "info");
+      syncAIPackageIfEnabled(wvConfig, progress);
       progress.complete("copyAssets");
       let movedApkPath = null;
       if (buildType === "release") {
@@ -352,6 +383,7 @@ function createAndroidBuild(config) {
         log: (message, status = "info") => progress.log(message, status)
       });
       await processNotifications(wvConfig);
+      syncAIPackageIfEnabled(wvConfig, progress);
       progress.log("✅ buildAndroidForTesting complete — project ready for gradlew test", "success");
       return {
         success: true

package/dist/native/buildIos/assets.js

@@ -123,7 +123,7 @@ module.exports = function createAssetsPhase(ctx) {
 
   // ─── Notification assets ─────────────────────────────────────────────────
 
-  async function validateNotificationAsset(filePath, assetType) {
+  function validateNotificationAsset(filePath, assetType) {
     const stats = fs.statSync(filePath);
     const fileSizeKB = stats.size / 1024;
     if (assetType === "icon" && fileSizeKB > 100) progress.log(`Warning: Notification icon ${path.basename(filePath)} is ${fileSizeKB.toFixed(1)}KB (recommended <100KB for optimal performance)`, "warning");else if (assetType === "sound" && fileSizeKB > 1024) progress.log(`Warning: Notification sound ${path.basename(filePath)} is ${fileSizeKB.toFixed(1)}KB (recommended <1MB)`, "warning");

package/dist/offline/catalyst-sw.js

@@ -99,6 +99,7 @@ function isOfflineRoute(url, manifest) {
     const { pathname } = new URL(url)
     return (manifest.routes || []).some((route) => {
         try {
+            // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp - route.regex is generated at build time by generateOfflineManifest.js's routeRegex(), which escapes every regex metacharacter in literal path segments and only ever emits flat (non-nested, non-repeating) patterns for :param and * segments — it cannot produce a catastrophic-backtracking shape. The manifest itself is same-origin build output, not user-submitted at runtime.
             return new RegExp(route.regex).test(pathname)
         } catch (_) {
             return false

package/dist/scripts/build.js

@@ -4,6 +4,7 @@ import { arrayToObject } from "./scriptUtils.js"
 import { fileURLToPath } from "url"
 import { dirname } from "path"
 import { readFileSync, existsSync, rmSync } from "fs"
+import { createRequire } from "module"
 
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = dirname(__filename)
@@ -11,16 +12,19 @@ const loaderPath = path.resolve(__dirname, "../../dist/vite/node-loader.mjs")
 const configPath = path.join(process.env.PWD, "config/config.json")
 const configJSON = JSON.parse(readFileSync(configPath), "utf-8")
 
+// Resolve vite's actual JS entry point rather than spawning the "vite" command name,
+// which on Windows only resolves via the npm-installed .cmd shim (i.e. requires a shell).
+// Invoking process.execPath + this path directly works cross-platform with no shell.
+const require = createRequire(import.meta.url)
+const viteBinPath = path.join(path.dirname(require.resolve("vite/package.json")), "bin", "vite.js")
+
 /**
- * @param {string} command
+ * @param {string[]} args
  * @param {import('child_process').SpawnOptions} options
  */
-function runBuildStep(command, options) {
+function runBuildStep(args, options) {
     return new Promise((resolve, reject) => {
-        const child = spawn(command, [], {
-            ...options,
-            shell: true,
-        })
+        const child = spawn(process.execPath, args, options)
         child.on("close", (code) => {
             if (code === 0) {
                 resolve()
@@ -69,8 +73,8 @@ async function build() {
         ]),
     }
 
-    const serverBuildCommand = `vite build --config ./dist/vite/vite.config.server.js --ssr`
-    const clientBuildCommand = `vite build --config ./dist/vite/vite.config.client.js`
+    const serverBuildArgs = [viteBinPath, "build", "--config", "./dist/vite/vite.config.server.js", "--ssr"]
+    const clientBuildArgs = [viteBinPath, "build", "--config", "./dist/vite/vite.config.client.js"]
     const spawnBase = {
         cwd: dirname,
         stdio: "inherit",
@@ -80,11 +84,11 @@ async function build() {
 
     try {
         await Promise.all([
-            runBuildStep(serverBuildCommand, {
+            runBuildStep(serverBuildArgs, {
                 ...spawnBase,
                 env: { ...baseEnv, CATALYST_VITE_CACHE_ID: "ssr" },
             }),
-            runBuildStep(clientBuildCommand, {
+            runBuildStep(clientBuildArgs, {
                 ...spawnBase,
                 env: { ...baseEnv, CATALYST_VITE_CACHE_ID: "client" },
             }),
@@ -96,7 +100,7 @@ async function build() {
 
     console.log("✅ Server and client builds completed!")
 
-    await runBuildStep("node ./dist/scripts/generateOfflineManifest.js", {
+    await runBuildStep(["./dist/scripts/generateOfflineManifest.js"], {
         ...spawnBase,
         env: baseEnv,
     })

package/dist/scripts/generateOfflineManifest.js

@@ -68,6 +68,7 @@ async function loadAppRoutes(appRoot) {
     })
 
     try {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - appRoot is the app's own build root and the remainder is a hardcoded literal path, not request input.
         const routesModule = await vite.ssrLoadModule(path.join(appRoot, "src/js/routes/utils.js"))
         return typeof routesModule.getRoutes === "function" ? routesModule.getRoutes() : []
     } finally {

package/dist/scripts/scriptUtils.js

@@ -23,6 +23,7 @@ export const printBundleInformation = () => {
         const files = fs.readdirSync(directoryPath)
         files.forEach((file) => {
             if (!file.includes("txt") && !file.includes("json")) {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - file comes from fs.readdirSync(directoryPath), i.e. actual filenames already on disk in the build output, not request input.
                 const filePath = path.join(directoryPath, file)
                 const fileSize = getFileSizeSync(filePath)
                 if (fileSize !== null) {

package/dist/scripts/serve.js

@@ -24,28 +24,30 @@ function startProd() {
 
     console.log("🚀 Starting production server...")
 
-    const inspectFlag = commandLineArguments.includes("--inspect") ? "--inspect" : ""
-    const command = `node ${inspectFlag} --import ${preInitPath} --loader ${loaderPath} ./dist/server/expressServer.js`
-    spawnSync(command, [], {
-        cwd: dirname,
-        stdio: "inherit",
-        shell: true,
-        env: {
-            ...process.env,
-            src_path: process.env.PWD,
-            NODE_ENV: "production",
-            IS_DEV_COMMAND: false,
-            APPLICATION: name || "catalyst_app",
-            ...argumentsObject,
-            filterKeys: JSON.stringify([
-                "src_path",
-                "NODE_ENV",
-                "IS_DEV_COMMAND",
-                "APPLICATION",
-                ...Object.keys(argumentsObject),
-            ]),
-        },
-    })
+    const inspectArgs = commandLineArguments.includes("--inspect") ? ["--inspect"] : []
+    spawnSync(
+        "node",
+        [...inspectArgs, "--import", preInitPath, "--loader", loaderPath, "./dist/server/expressServer.js"],
+        {
+            cwd: dirname,
+            stdio: "inherit",
+            env: {
+                ...process.env,
+                src_path: process.env.PWD,
+                NODE_ENV: "production",
+                IS_DEV_COMMAND: false,
+                APPLICATION: name || "catalyst_app",
+                ...argumentsObject,
+                filterKeys: JSON.stringify([
+                    "src_path",
+                    "NODE_ENV",
+                    "IS_DEV_COMMAND",
+                    "APPLICATION",
+                    ...Object.keys(argumentsObject),
+                ]),
+            },
+        }
+    )
 }
 
 startProd()

package/dist/scripts/start.js

@@ -22,11 +22,9 @@ function start() {
     const packageJson = JSON.parse(readFileSync(path.join(process.env.PWD, "package.json"), "utf-8"))
     const { name } = packageJson
 
-    const command = `node --import ${preInitPath} --loader ${loaderPath} ./dist/server/expressServer.js`
-    spawnSync(command, [], {
+    spawnSync("node", ["--import", preInitPath, "--loader", loaderPath, "./dist/server/expressServer.js"], {
         cwd: dirname,
         stdio: "inherit",
-        shell: true,
         env: {
             ...process.env,
             src_path: process.env.PWD,

package/dist/server/expressServer.js

@@ -12,8 +12,52 @@ const { cyan, yellow, green } = pc
 
 import { validateMiddleware, safeCall } from "./utils/validator.js"
 import { botDetectionMiddleware } from "./utils/botDetectionMiddleware.js"
+import { cjsRequire } from "./utils/cjsRequire.js"
 const { addMiddlewares } = await import(path.join(process.env.src_path, "server/server.js"))
 
+// Mount AI route if catalyst-ai is installed
+function mountAIRouter(app) {
+    let aiPackagePath
+    try {
+        aiPackagePath = cjsRequire.resolve("catalyst-ai/route", {
+            paths: [process.env.src_path || process.cwd()],
+        })
+    } catch (resolveErr) {
+        if (resolveErr.code !== "MODULE_NOT_FOUND") {
+            console.error("[catalyst-core/ai] Unexpected error resolving catalyst-ai:", resolveErr)
+        } else {
+            console.debug("[catalyst-core/ai] catalyst-ai not installed — AI routes unavailable")
+        }
+        return
+    }
+
+    try {
+        const aiRouter = cjsRequire(aiPackagePath)
+        let aiConfig = {}
+        try {
+            const parsedConfig = JSON.parse(process.env.AI_CONFIG || "{}")
+            if (parsedConfig && typeof parsedConfig === "object" && !Array.isArray(parsedConfig)) {
+                aiConfig = parsedConfig
+            } else {
+                console.warn("[catalyst-core/ai] AI_CONFIG must be a JSON object, ignoring it")
+            }
+        } catch (e) {
+            console.warn(`[catalyst-core/ai] Invalid AI_CONFIG JSON, ignoring: ${e.message}`)
+        }
+
+        if (aiConfig.enabled === false) {
+            console.log("[catalyst-core/ai] AI_CONFIG.enabled is false, skipping AI router")
+            return
+        }
+
+        const aiBasePath = aiConfig.basePath || "/ai"
+        console.log(`[catalyst-core/ai] mounting AI router at ${aiBasePath}`)
+        app.use(aiBasePath, aiRouter)
+    } catch (mountErr) {
+        console.error("[catalyst-core/ai] Failed to mount AI router:", mountErr)
+    }
+}
+
 // OpenTelemetry is opt-in (OTEL_ENABLE) — mirrors server/renderer/handler.jsx.
 // Passthrough no-op middleware when disabled or packages aren't installed.
 let responseFlushMiddleware = () => (_req, _res, next) => next()
@@ -82,6 +126,7 @@ const isProduction = process.env.NODE_ENV === "production"
 
 function serveBuildFile(app, buildPath, urlPath, fileName, headers = {}) {
     app.get(urlPath, (_req, res, next) => {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - fileName is always a hardcoded literal passed at each serveBuildFile call site, never derived from the request.
         const filePath = path.join(buildPath, fileName)
         if (!fs.existsSync(filePath)) return next()
         res.set(headers)
@@ -106,6 +151,8 @@ async function createServer() {
     // All the middlewares defined by the user will run here.
     if (validateMiddleware(addMiddlewares)) addMiddlewares(app)
 
+    mountAIRouter(app)
+
     // response.compress + response.flush spans straddle compression — they
     // attribute the time past the `handler` span (gzip/brotli, then egress).
     // MUST be mounted immediately before compression() so its outer res.end

package/dist/server/renderer/document/Head.jsx

@@ -34,9 +34,11 @@ export function Head(props) {
             {metaTags && metaTags}
 
             {/* Inline critical CSS — prevents FOUC/CLS */}
+            {/* nosemgrep: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml - inlineCss is compiled CSS read from disk (readCssFromDisk), sourced from the app's own build output, never from request/user input. */}
             {inlineCss && <style dangerouslySetInnerHTML={{ __html: inlineCss }} />}
 
             {/* Deferred CSS from prior SSRs on this route — avoids late layout from post-body <style> */}
+            {/* nosemgrep: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml - deferredRouteInlineCss is compiled CSS read from disk (readCssFromDisk), sourced from the app's own build output, never from request/user input. */}
             {deferredRouteInlineCss && <style dangerouslySetInnerHTML={{ __html: deferredRouteInlineCss }} />}
 
             {/* JS modules */}

package/dist/server/renderer/extract.js

@@ -103,6 +103,7 @@ export const readCssFromDisk = (cssPaths = [], basePath) => {
         seen.add(asset)
         if (asset.startsWith("http")) continue
 
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - asset paths come from the Vite build manifest generated at build time, never from a request, so there is no user-controlled input here.
         const filePath = path.isAbsolute(asset) ? asset : path.join(basePath, asset.replace(/^\/+/, ""))
 
         try {

package/dist/server/renderer/handler.jsx

@@ -23,6 +23,7 @@ import {
     generateModulePreloadLinkElements,
 } from "./extract.js"
 import path from "path"
+import { Transform } from "node:stream"
 
 import CustomDocument from "@catalyst/template/server/document"
 
@@ -242,13 +243,17 @@ const _renderMarkUp = async (
         res.status(status)
 
         return new Promise((resolve, reject) => {
-            const { pipe } = renderToPipeableStream(<CompleteDocument />, {
-                onShellReady() {
-                    res.setHeader("content-type", "text/html")
-                    pipe(res)
+            // Single completion path: React's pipe() auto-ends `tail`, and
+            // `flush()` appends the deferred asset tags before that end
+            // signal propagates to `res` via the plain pipe below. This
+            // avoids the onShellReady/onAllReady race where React's own
+            // stream-end and a manual res.end() compete to close `res`
+            // (see issue #320).
+            const tail = new Transform({
+                transform(chunk, _enc, cb) {
+                    cb(null, chunk)
                 },
-
-                onAllReady() {
+                flush(cb) {
                     // Deferred assets — injected after body (non-blocking)
                     const deferredAssets = chunkExtractor
                         ? chunkExtractor.getDeferredAssets()
@@ -256,10 +261,11 @@ const _renderMarkUp = async (
 
                     // Tell client which components were SSR'd so split() can
                     // eagerly import them (prevents Suspense fallback flash)
-                    res.write(`<script>window.__CATALYST_IS_BOT__=${isBot ? "true" : "false"};</script>`)
+                    this.push(`<script>window.__CATALYST_IS_BOT__=${isBot ? "true" : "false"};</script>`)
                     if (chunkExtractor) {
                         const renderedKeys = chunkExtractor.getRenderedComponentKeys()
-                        res.write(
+                        this.push(
+                            // nosemgrep: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag - renderedKeys are internal bundler component-module keys tracked by ChunkExtractor, never request/user input, and are JSON.stringify-escaped before embedding.
                             `<script>window.__SSR_RENDERED_COMPONENTS__=new Set(${JSON.stringify(renderedKeys)})</script>`
                         )
                     }
@@ -270,13 +276,24 @@ const _renderMarkUp = async (
                         isBot
                     )
                     if (newCssPaths.length) {
-                        res.write(`<style>${readCssFromDisk(newCssPaths, buildDir)}</style>`)
+                        this.push(`<style>${readCssFromDisk(newCssPaths, buildDir)}</style>`)
                     }
                     if (!isBot) {
-                        res.write(generateScriptStrings(deferredAssets.js))
+                        this.push(generateScriptStrings(deferredAssets.js))
                     }
 
-                    res.end()
+                    cb()
+                },
+            })
+            tail.pipe(res)
+
+            const { pipe } = renderToPipeableStream(<CompleteDocument />, {
+                onShellReady() {
+                    res.setHeader("content-type", "text/html")
+                    pipe(tail)
+                },
+
+                onAllReady() {
                     cleanupSafeArea()
                     resolve()
                 },
@@ -285,6 +302,7 @@ const _renderMarkUp = async (
                     console.error("Error in renderToPipeableStream:", error)
                     safeCall(onRenderError, { req, res, store, error })
                     cleanupSafeArea()
+                    tail.destroy(error)
                     reject(error)
                 },
             })

package/dist/vite/inject-cache-key-plugin.js

@@ -45,9 +45,11 @@ function loadAliases() {
     for (const [alias, aliasPath] of Object.entries(allAliases)) {
         if (aliasPath && typeof aliasPath === "string") {
             try {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - appRoot is the app's own build root and aliasPath comes from the developer's package.json config, not request/user input.
                 const resolvedPath = path.resolve(appRoot, ...aliasPath.split("/"))
                 aliasCache[alias] = resolvedPath
             } catch (error) {
+                // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - alias is a key from the developer's own package.json config, not attacker-controlled; console.warn here does no printf-style substitution.
                 console.warn(`Failed to resolve alias ${alias}:`, error.message)
             }
         }
@@ -87,6 +89,7 @@ function resolveWithExtensions(basePath) {
     }
 
     for (const ext of extensions) {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - basePath is derived from module import specifiers resolved by this plugin's own alias/relative-import logic, never from a request.
         const candidate = path.join(basePath, `index${ext}`)
         if (existsSync(candidate)) {
             return candidate
@@ -107,9 +110,11 @@ function resolveToAbsolutePath(importPath, importerId) {
     for (const [alias, aliasPath] of Object.entries(aliases)) {
         if (importPath === alias || importPath.startsWith(alias + "/")) {
             const remainingPath = importPath === alias ? "" : importPath.slice(alias.length + 1)
+            // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - importPath comes from the app's own module import graph and aliasPath from the developer's package.json config, never from a request.
             const rawResolved = path.join(aliasPath, remainingPath)
             const finalResolved = resolveWithExtensions(rawResolved)
             if (finalResolved) {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - finalResolved is derived from the same alias/import resolution above, not request input.
                 return path.resolve(finalResolved)
             }
         }
@@ -118,6 +123,7 @@ function resolveToAbsolutePath(importPath, importerId) {
     // 2. Relative imports — resolve from the importer's directory
     if (importPath.startsWith("./") || importPath.startsWith("../")) {
         const importerDir = path.dirname(importerId)
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - importPath comes from the app's own module import graph and importerId from Vite's module resolution, never from a request.
         const absolutePath = path.resolve(importerDir, importPath)
         const resolved = resolveWithExtensions(absolutePath)
         if (resolved) {
@@ -149,6 +155,7 @@ function resolveImportPath(importPath, importerId) {
         // Fallback: strip leading ./ and return as-is
         return importPath.replace(/^\.\//, "")
     } catch (error) {
+        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - importPath comes from the app's own module import graph resolved by Vite at build time, not attacker-controlled; console.warn here does no printf-style substitution.
         console.warn(`Error resolving import path ${importPath}:`, error.message)
         return importPath.replace(/^\.\//, "")
     }

package/dist/vite/loadCustomViteConfig.js

@@ -10,6 +10,7 @@ const emptyConfig = {
 export async function loadCustomViteConfig() {
     const configNames = ["buildConfig.js", "webpackConfig.js"]
     const configPath = configNames
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - configName is one of two hardcoded literals above, and process.env.src_path is the app root set by the framework's own build tooling, not request/user input.
         .map((configName) => path.join(process.env.src_path, configName))
         .find((candidatePath) => existsSync(candidatePath))
 

package/dist/vite/manifest-categorization-plugin.js

@@ -293,6 +293,7 @@ export function manifestCategorizationPlugin(options = {}) {
     // branch of the import graph, the affected CSS would vanish from server responses
     // with no runtime error — this check surfaces that as a build-time warning.
     function validateCssCoverage(categorizedManifest, buildDir) {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - buildDir is the build tool's own output directory and the remaining segments are hardcoded literals, not request input.
         const cssDir = path.join(buildDir, "client", "assets", "css")
         if (!fs.existsSync(cssDir)) return
 
@@ -403,6 +404,7 @@ export function manifestCategorizationPlugin(options = {}) {
                             })
                         }
                     } catch (err) {
+                        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - importPath comes from the app's own module import graph resolved by Vite at build time, not attacker-controlled; console.log here does no printf-style substitution.
                         console.log(`❌ Error resolving ${importPath}:`, err.message)
                     }
                 })

package/dist/vite/node-loader.mjs

@@ -56,6 +56,7 @@ function loadAliases() {
                 const resolvedPath = resolvePath(appRoot, ...aliasPath.split("/"))
                 aliasCache[alias] = resolvedPath
             } catch (error) {
+                // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - alias is a key from the developer's own package.json _moduleAliases config, not attacker-controlled; console.warn here does no printf-style substitution.
                 console.warn(`Failed to resolve alias ${alias}:`, error.message)
             }
         }
@@ -100,6 +101,7 @@ function resolveWithExtensions(basePath) {
 
     // Try index files inside a directory
     for (const ext of extensions) {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - basePath is derived from module import specifiers resolved by the Node loader itself, never from a request.
         const candidate = join(basePath, `index${ext}`)
         if (existsSync(candidate)) {
             return candidate
@@ -119,10 +121,12 @@ function resolveAlias(specifier, parentURL) {
     for (const [alias, aliasPath] of Object.entries(aliases)) {
         if (specifier.startsWith(alias + "/") || specifier === alias) {
             const remainingPath = specifier === alias ? "" : specifier.slice(alias.length + 1)
+            // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - specifier comes from an ES module import statement in the app's own source code, and aliasPath from the developer's package.json config, never from a request.
             const rawResolvedPath = join(aliasPath, remainingPath)
             const finalResolvedPath = resolveWithExtensions(rawResolvedPath)
 
             if (finalResolvedPath) {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - finalResolvedPath is derived from the same alias/import resolution above, not request input.
                 return resolvePath(finalResolvedPath)
             }
         }
@@ -140,6 +144,7 @@ function resolveRelative(specifier, parentURL) {
     try {
         const parentPath = fileURLToPath(parentURL)
         const parentDir = dirname(parentPath)
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - specifier comes from an ES module import statement in the app's own source code, parentURL from the module loader itself, never from a request.
         const absolutePath = resolvePath(parentDir, specifier)
         return resolveWithExtensions(absolutePath)
     } catch {
@@ -225,6 +230,7 @@ export async function resolve(specifier, context, defaultResolve) {
  */
 function findNearestPackageType(dir) {
     while (dir !== dirname(dir)) {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - dir is walked up from the module's own filesystem location via dirname(), never from a request; "package.json" is a hardcoded literal.
         const pkgPath = join(dir, "package.json")
         if (existsSync(pkgPath)) {
             try {