catalyst-core 0.3.0-beta.1 → 0.3.0-beta.3

package/dist/vite/vite.config.js

@@ -1,7 +1,7 @@
 import { defineConfig, transformWithEsbuild } from "vite"
 import react from "@vitejs/plugin-react"
 import svgr from "vite-plugin-svgr"
-import { builtinModules } from "node:module"
+import { builtinModules, createRequire } from "node:module"
 
 /**
  * Treat all .scss imports as CSS modules (webpack compat).
@@ -113,6 +113,7 @@ try {
     const packageJson = JSON.parse(packageJsonContent)
     _moduleAliases = packageJson._moduleAliases || {}
 } catch (error) {
+    // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - packageJsonConfig is a build-time-resolved local path, not attacker-controlled; console.warn here does no printf-style substitution.
     console.warn(`Failed to read or parse package.json from ${packageJsonConfig}:`, error.message)
 }
 
@@ -122,6 +123,7 @@ try {
     catalyst_moduleAliases = catalystPackageJson._moduleAliases || {}
 } catch (error) {
     console.warn(
+        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - catalystPackageJsonConfig is a build-time-resolved local path, not attacker-controlled; console.warn here does no printf-style substitution.
         `Failed to read or parse catalyst package.json from ${catalystPackageJsonConfig}:`,
         error.message
     )
@@ -131,6 +133,52 @@ const allAliases = { ..._moduleAliases, ...catalyst_moduleAliases }
 
 import { imageUrl, fontUrl } from "./scssParams.js"
 
+// Tailwind v4's zero-config scanner (`@tailwindcss/postcss`) walks up from
+// `dirname(from)` — the directory of the file PostCSS is currently compiling —
+// unless given an explicit `base`. Vite passes each CSS file's own resolved
+// path as `from`, so for catalyst-core's conventional layout (global
+// stylesheet under `src/static/css`, components under `src/js`, no shared
+// parent short of the app root) the scanner never reaches component files and
+// silently drops every class actually used in JSX. Webpack's postcss-loader
+// doesn't populate `from` the same way, which is why this only regresses
+// under Vite. We resolve the app's own postcss.config.js ourselves and patch
+// in `base: process.env.src_path` so the scan root covers the whole app.
+// Only the `{ pluginName: options }` shorthand can be patched this way —
+// array-form configs (`[require(...)()]`) have already closed over their
+// options — so anything else is left alone and Vite falls back to its normal
+// auto-loaded postcss.config.js resolution.
+const resolvePostcssPlugins = () => {
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - process.env.src_path is the app root set by the framework's own build tooling, not request/user input.
+    const configPath = path.join(process.env.src_path, "postcss.config.js")
+    if (!fs.existsSync(configPath)) return null
+
+    const appRequire = createRequire(configPath)
+
+    try {
+        const userConfig = appRequire(configPath)
+        const pluginsConfig = userConfig?.plugins
+
+        if (!pluginsConfig || Array.isArray(pluginsConfig) || typeof pluginsConfig !== "object") {
+            return null
+        }
+
+        return Object.entries(pluginsConfig).map(([name, options]) => {
+            const plugin = appRequire(name)
+            const finalOptions =
+                name === "@tailwindcss/postcss" && (!options || options.base === undefined)
+                    ? { ...options, base: process.env.src_path }
+                    : options
+            return plugin(finalOptions)
+        })
+    } catch (error) {
+        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - configPath is a build-time-resolved local path, not attacker-controlled; console.warn here does no printf-style substitution.
+        console.warn(`Failed to patch postcss config at ${configPath}:`, error.message)
+        return null
+    }
+}
+
+const postcssPlugins = resolvePostcssPlugins()
+
 const alias = () => {
     if (!allAliases || typeof allAliases !== "object") {
         return {}
@@ -139,9 +187,11 @@ const alias = () => {
     return Object.keys(allAliases).reduce((moduleEnvMap, alias) => {
         if (allAliases[alias] && typeof allAliases[alias] === "string") {
             try {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - process.env.src_path is the app root and allAliases comes from the developer's own package.json _moduleAliases config, not request/user input.
                 const aliasPath = path.join(process.env.src_path, ...allAliases[alias].split("/"))
                 moduleEnvMap[alias] = aliasPath
             } catch (error) {
+                // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - alias is a key from the developer's own package.json _moduleAliases config, not attacker-controlled; console.warn here does no printf-style substitution.
                 console.warn(`Failed to configure alias ${alias}:`, error.message)
             }
         }
@@ -177,6 +227,37 @@ export const getClientEnvVariables = () => {
         process.env["PUBLIC_STATIC_ASSET_URL"]
     )
 
+    // Derive AI_PUBLIC_CONFIG: only the browser block from AI_CONFIG, no API keys
+    let aiConfig = {}
+    try {
+        const parsedConfig = JSON.parse(process.env.AI_CONFIG || "{}")
+        if (parsedConfig && typeof parsedConfig === "object" && !Array.isArray(parsedConfig)) {
+            aiConfig = parsedConfig
+        } else {
+            console.warn("[catalyst-core] AI_CONFIG must be a JSON object, ignoring it")
+        }
+    } catch (e) {
+        console.warn(`[catalyst-core] Invalid AI_CONFIG JSON, ignoring: ${e.message}`)
+    }
+    const aiPublicConfig = aiConfig.browser ? { browser: aiConfig.browser } : {}
+    envVarDefinitions[`process.env.AI_PUBLIC_CONFIG`] = JSON.stringify(JSON.stringify(aiPublicConfig))
+
+    // Detect which catalyst-* AI packages are installed for the app, including
+    // hoisted/workspace installs — not just a direct app-local node_modules copy.
+    // Results are injected as __CATALYST_PACKAGES__.* literals so dead code
+    // referencing missing packages can be branched around at runtime.
+    const appRequire = createRequire(path.join(process.env.src_path || process.cwd(), "package.json"))
+    let aiPackageInstalled = false
+    try {
+        appRequire.resolve("catalyst-ai")
+        aiPackageInstalled = true
+    } catch {
+        aiPackageInstalled = false
+    }
+    envVarDefinitions["__CATALYST_PACKAGES__"] = JSON.stringify({
+        ai: aiPackageInstalled,
+    })
+
     return envVarDefinitions
 }
 
@@ -377,6 +458,7 @@ export default defineConfig({
             localsConvention: "camelCase",
             generateScopedName: "[name]__[local]___[hash:base64:5]",
         },
+        ...(postcssPlugins ? { postcss: { plugins: postcssPlugins } } : {}),
         preprocessorOptions: {
             scss: {
                 additionalData: (content) =>

package/mcp_v2/knowledge-base.json

@@ -170,15 +170,63 @@
     {
         "section": "build_system",
         "title": "iOS Build Pipeline",
-        "content": "1) Generate ConfigConstants.swift from WEBVIEW_CONFIG 2) Launch simulator 3) Clean Xcode project 4) Compile with Xcode 5) Install app + launch. Located in: src/native/iosnativeWebView/",
+        "content": "npm run buildApp:ios generates ConfigConstants.swift and plugin metadata from WEBVIEW_CONFIG, syncs selected public/ios assets into the package-owned Xcode project, detects a physical device or launches a simulator, cleans Xcode artifacts, compiles with the Debug configuration, and installs and launches the .app. It does not bundle the full Catalyst web client and does not create an App Store archive. The generated project is located under the resolved catalyst-core package at dist/native/iosnativeWebView/iosnativeWebView.xcodeproj.",
         "layer": "Build",
         "source": "static",
-        "tags": ["ios", "build"]
+        "tags": ["ios", "build", "buildApp:ios", "debug", "xcode"],
+        "github_files": [
+            "packages/catalyst-core/src/native/buildAppIos.js",
+            "packages/catalyst-core/src/native/buildIos/build.js"
+        ]
+    },
+    {
+        "section": "build_system",
+        "title": "Catalyst iOS Production Release Flow (0.2.x and 0.3.x)",
+        "content": "Catalyst 0.2.x and 0.3.x use the same iOS production-release flow: (1) deploy the production web application and verify its HTTPS URL, (2) finalize WEBVIEW_CONFIG, bundle ID, app version/build, plugins, permissions, capabilities, icons, splash assets, access-control rules, and privacy declarations, (3) run npm run buildApp:ios from the consuming app root to prepare the package-owned native project and perform its Debug build, (4) open the resolved catalyst-core package's dist/native/iosnativeWebView/iosnativeWebView.xcodeproj, (5) confirm the iosnativeWebView scheme's Archive action uses Release, configure Release signing and capabilities, choose a generic iOS device destination, and run Product -> Archive, (6) Validate App and upload with Distribute App -> TestFlight & App Store, then (7) finish TestFlight testing, App Store Connect metadata, build selection, and App Review submission. buildApp:ios does not create the final App Store artifact.",
+        "layer": "Build",
+        "source": "static",
+        "tags": [
+            "ios",
+            "release",
+            "production",
+            "0.2.x",
+            "0.3.x",
+            "buildApp:ios",
+            "xcode",
+            "archive",
+            "app-store",
+            "testflight"
+        ],
+        "github_files": [
+            "docs/content/08-Deployment/03-iOS-Production-Release.md",
+            "packages/catalyst-core/src/native/iosnativeWebView/iosnativeWebView.xcodeproj/xcshareddata/xcschemes/iosnativeWebView.xcscheme"
+        ]
+    },
+    {
+        "section": "build_system",
+        "title": "Generated iOS Project Signing and Persistence",
+        "content": "The generated Xcode project is package-owned state. Its shared xcconfig is regenerated with development-oriented code-signing defaults, and the bundled push entitlement can use aps-environment=development. Before an App Store archive, review the Release team, distribution signing, provisioning, capabilities, and entitlements in Xcode. Run the final npm run buildApp:ios before release-only Xcode changes: later Catalyst generation, package upgrades, or dependency installation can replace or regenerate native config constants, shared Xcode configuration, plist and entitlement content, generated plugin code/resources, selected project-file entries, and assets. Do not treat manual edits inside the generated project as durable app configuration.",
+        "layer": "Build",
+        "source": "static",
+        "tags": [
+            "ios",
+            "release",
+            "signing",
+            "provisioning",
+            "entitlements",
+            "push-notifications",
+            "generated-project",
+            "regeneration"
+        ],
+        "github_files": [
+            "packages/catalyst-core/src/native/buildIos/config.js",
+            "packages/catalyst-core/src/native/iosnativeWebView/iosnativeWebView/iosnativeWebView.entitlements"
+        ]
     },
     {
         "section": "build_system",
         "title": "Legacy 0.2.x Build NPM Scripts",
-        "content": "All catalyst npm scripts to add to package.json scripts block (each maps to: catalyst <scriptName>): devBuild \u2014 dev web build. devServe \u2014 dev server. buildApp \u2014 builds native app (both platforms). buildApp:android \u2014 Android native app build. buildApp:ios \u2014 iOS native app build. buildApp:android:release \u2014 Android release build. buildApp:ios:release \u2014 iOS release build. setupEmulator \u2014 sets up both emulators. setupEmulator:android \u2014 sets up Android AVD. setupEmulator:ios \u2014 sets up iOS simulator. NOTE: build:android / build:android:release / build:ios do NOT exist in catalyst \u2014 common mistake. The correct commands are buildApp:android and buildApp:ios. Missing any script = that npm run command fails.",
+        "content": "All catalyst npm scripts to add to package.json scripts block (each maps to: catalyst <scriptName>): devBuild \u2014 dev web build. devServe \u2014 dev server. buildApp \u2014 builds native apps. buildApp:android \u2014 Android native app build. buildApp:ios \u2014 iOS native project preparation and Debug build. buildApp:android:release \u2014 Android release build. setupEmulator \u2014 sets up both emulators. setupEmulator:android \u2014 sets up Android AVD. setupEmulator:ios \u2014 sets up iOS simulator. There is no separate buildApp:ios:release flow: run buildApp:ios, then create the production archive from the generated Xcode project's Release Archive action. NOTE: build:android / build:android:release / build:ios do NOT exist in catalyst \u2014 common mistake. Missing any script = that npm run command fails.",
         "layer": "Build",
         "source": "static",
         "tags": ["build", "scripts", "package.json", "native"]
@@ -434,7 +482,7 @@
     {
         "section": "config_structure",
         "title": "WEBVIEW_CONFIG Required Fields",
-        "content": "WEBVIEW_CONFIG field reference (from buildAppAndroid.js + buildAppIos.js source):\n\nTOP-LEVEL (both platforms):\n- port (string, required) \u2014 web server port e.g. \"3005\"\n- LOCAL_IP (string, required) \u2014 machine LAN IP e.g. \"192.168.0.11\". NOT localhost \u2014 emulator cannot resolve it\n- appInfo (string, required) \u2014 build identifier e.g. \"android-5Feb2026-v2.1.0\". Missing = iOS build breaks\n- useHttps (boolean, optional) \u2014 default false\n- cachePattern (string, optional) \u2014 comma-separated globs e.g. \"*.css\"\n- accessControl.enabled (boolean, optional) \u2014 default false\n- accessControl.allowedUrls (array, required if enabled) \u2014 URL patterns\n\nANDROID (WEBVIEW_CONFIG.android):\n- sdkPath (string, REQUIRED) \u2014 abs path to Android SDK. Build exits immediately without it\n- emulatorName (string, REQUIRED for debug) \u2014 AVD name. Run: emulator -list-avds\n- appName (string, optional) \u2014 default \"Catalyst Application\"\n- packageName (string, optional) \u2014 e.g. com.company.app. Derived from appName if missing\n- buildType (string, optional) \u2014 \"debug\" or \"release\". Default \"debug\"\n- keystore or keystoreConfig (required for release buildType only)\n- buildOptimisation (boolean, optional) \u2014 default false\n- cachePattern (string, optional)\n\nIOS (WEBVIEW_CONFIG.ios):\n- appBundleId (string, optional) \u2014 default \"com.debug.webview\". Must set for distribution\n- appName (string, optional) \u2014 default \"Catalyst Application\"\n- simulatorName (string, optional) \u2014 auto-detected if missing. e.g. \"iPhone 17 Pro\"\n- buildType (string, optional, CASE-SENSITIVE) \u2014 \"Debug\" or \"Release\". NOT lowercase \u2014 common mistake\n- deviceUDID (string, optional) \u2014 physical device builds only\n- developmentTeam (string, required if deviceUDID set) \u2014 Apple Developer Team ID\n- cachePattern (string, optional)",
+        "content": "WEBVIEW_CONFIG field reference (from buildAppAndroid.js + buildAppIos.js source):\n\nTOP-LEVEL (both platforms):\n- port (string, required) \u2014 web server port e.g. \"3005\"\n- LOCAL_IP (string, required) \u2014 machine LAN IP e.g. \"192.168.0.11\". NOT localhost \u2014 emulator cannot resolve it\n- appInfo (string, required) \u2014 build identifier e.g. \"android-5Feb2026-v2.1.0\". Missing = iOS build breaks\n- useHttps (boolean, optional) \u2014 default false\n- cachePattern (string, optional) \u2014 comma-separated globs e.g. \"*.css\"\n- accessControl.enabled (boolean, optional) \u2014 default false\n- accessControl.allowedUrls (array, required if enabled) \u2014 URL patterns\n\nANDROID (WEBVIEW_CONFIG.android):\n- sdkPath (string, REQUIRED) \u2014 abs path to Android SDK. Build exits immediately without it\n- emulatorName (string, REQUIRED for debug) \u2014 AVD name. Run: emulator -list-avds\n- appName (string, optional) \u2014 default \"Catalyst Application\"\n- packageName (string, optional) \u2014 e.g. com.company.app. Derived from appName if missing\n- buildType (string, optional) \u2014 \"debug\" or \"release\". Default \"debug\"\n- keystore or keystoreConfig (required for release buildType only)\n- buildOptimisation (boolean, optional) \u2014 default false\n- cachePattern (string, optional)\n\nIOS (WEBVIEW_CONFIG.ios):\n- appBundleId (string, optional) \u2014 default \"com.debug.webview\". Must set for distribution\n- appName (string, optional) \u2014 default \"Catalyst Application\"\n- simulatorName (string, optional) \u2014 auto-detected if missing. e.g. \"iPhone 17 Pro\"\n- buildType (string, optional) \u2014 may label copied Debug output but does not select the Xcode build configuration or create an App Store archive\n- deviceUDID (string, optional) \u2014 physical device builds only\n- developmentTeam (string, required if deviceUDID set) \u2014 Apple Developer Team ID\n- cachePattern (string, optional)\n\nFor iOS production, run buildApp:ios to prepare the generated project, then archive the iosnativeWebView scheme using its Release Archive action in Xcode.",
         "layer": "Config",
         "source": "static",
         "tags": ["config", "WEBVIEW_CONFIG", "android", "ios", "required", "fields"]

package/mcp_v2/mcp.js

@@ -62,21 +62,53 @@ if (projectInfo.notInstalled) {
     process.exit(1)
 }
 
-if (!fs.existsSync(DB_PATH)) {
+const dbMissing = !fs.existsSync(DB_PATH)
+const dbEmpty = !dbMissing && fs.statSync(DB_PATH).size === 0
+
+if (dbMissing || dbEmpty) {
+    try {
+        require("./setup")
+    } catch (setupErr) {
+        process.stderr.write(
+            JSON.stringify({
+                jsonrpc: "2.0",
+                error: {
+                    code: -32000,
+                    message: `context.db ${dbEmpty ? "is empty" : "not found"} at ${DB_PATH}. Auto-setup failed: ${setupErr.message}. Run manually: node ${path.join(MCP_DIR, "setup.js")}`,
+                },
+                id: null,
+            }) + "\n"
+        )
+        // process.exit(1) instead of exitCode+return: this is top-level script code
+        // (not inside a function), and ESLint here rejects top-level return even
+        // though Node's CommonJS wrapper allows it. Matches the exit pattern used
+        // by the other startup-validation failures above (L49, L62).
+        process.exit(1)
+    }
+}
+
+let db
+try {
+    db = new Database(DB_PATH, { readonly: false })
+} catch (e) {
+    const isVersionMismatch =
+        e.code === "ERR_DLOPEN_FAILED" ||
+        e.message.includes("compiled against a different Node.js version") ||
+        e.message.includes("NODE_MODULE_VERSION")
     process.stderr.write(
         JSON.stringify({
             jsonrpc: "2.0",
             error: {
                 code: -32000,
-                message: `context.db not found at ${DB_PATH}. Run setup first: node ${path.join(MCP_DIR, "setup.js")}`,
+                message: isVersionMismatch
+                    ? `Native module mismatch for Node ${process.version}. Run: npm rebuild better-sqlite3`
+                    : `Failed to open context.db: ${e.message}`,
             },
             id: null,
         }) + "\n"
     )
     process.exit(1)
 }
-
-const db = new Database(DB_PATH, { readonly: false })
 const CONVERSION_TASKS = JSON.parse(fs.readFileSync(TASKS_PATH, "utf8"))
 
 // ── Module init ───────────────────────────────────────────────────────────────

package/mcp_v2/tools/build.js

@@ -149,19 +149,19 @@ const MASTER_FLOWS = {
             step: 1,
             cmd: null,
             label: "Pre-check: config",
-            detail: 'Reads WEBVIEW_CONFIG.ios. Requires: appBundleId, simulatorName, buildType (default "debug").',
+            detail: "Reads WEBVIEW_CONFIG and WEBVIEW_CONFIG.ios. Confirm the development URL, appBundleId, simulatorName, plugins, and selected public/ios assets.",
         },
         {
             step: 2,
-            cmd: "catalyst build",
-            label: "Build web assets",
-            detail: "Compiles web app. iOS build embeds these.",
+            cmd: "npm run buildApp:ios",
+            label: "iOS simulator build",
+            detail: "Generates native configuration and plugin code in the package-owned Xcode project, syncs selected assets, compiles with Xcode's Debug configuration, installs the .app, and launches it.",
         },
         {
             step: 3,
-            cmd: "npm run buildApp:ios",
-            label: "iOS simulator build",
-            detail: "Runs buildAppIos.js: generates ConfigConstants.swift from config (bundleId, URL, port, protocol), launches simulator (simulatorName), cleans Xcode artifacts, compiles with xcodebuild, installs .app, launches.",
+            cmd: null,
+            label: "Remote web application",
+            detail: "The iOS shell loads the configured remote URL. buildApp:ios does not bundle the full Catalyst web client, so the target web application must be reachable.",
         },
         {
             step: 4,
@@ -175,27 +175,44 @@ const MASTER_FLOWS = {
         {
             step: 1,
             cmd: null,
+            label: "Deploy the production web application",
+            detail: "Deploy the web application first and confirm its production URL is reachable over HTTPS. The iOS shell loads this remote URL; it does not embed the full web client bundle.",
+        },
+        {
+            step: 2,
+            cmd: null,
             label: "Pre-check: config",
-            detail: 'buildType must be "Release" (capital R — case-sensitive). appBundleId required. If googleSignIn enabled, GoogleService-Info.plist must be present.',
+            detail: "Finalize WEBVIEW_CONFIG, appBundleId, app name, version, incremented build number, access-control rules, plugins, permissions, capabilities, icons, splash assets, and privacy declarations.",
         },
-        { step: 2, cmd: "catalyst build", label: "Build web assets", detail: "Production build." },
         {
             step: 3,
             cmd: "npm run buildApp:ios",
-            label: "iOS release build",
-            detail: "Same script — build type is driven by WEBVIEW_CONFIG.ios.buildType. Generates ConfigConstants.swift with production URL and bundleId. Xcode compiles Release scheme.",
+            label: "Prepare the native project",
+            detail: "Run from the consuming Catalyst app root. This generates native configuration and plugin code, syncs selected assets, and performs a Debug native build. It does not create an App Store archive.",
         },
         {
             step: 4,
             cmd: null,
-            label: "Archive + export IPA",
-            detail: "Post-build: archive via Xcode Organizer or xcodebuild -exportArchive. Requires Apple distribution certificate + provisioning profile configured in Xcode.",
+            label: "Open the generated Xcode project",
+            detail: "Open node_modules/catalyst-core/dist/native/iosnativeWebView/iosnativeWebView.xcodeproj (or the resolved package equivalent). Confirm the iosnativeWebView scheme's Archive action uses Release.",
         },
         {
             step: 5,
             cmd: null,
-            label: "App Store submission",
-            detail: "Upload IPA via Transporter or Xcode Organizer. TestFlight for beta before release.",
+            label: "Configure signing and archive",
+            detail: "Select the correct Apple Developer team, distribution signing, capabilities, entitlements, bundle ID, version, and build. Choose a generic iOS device destination, then Product → Archive.",
+        },
+        {
+            step: 6,
+            cmd: null,
+            label: "Validate and upload",
+            detail: "In Xcode Organizer, run Validate App, then Distribute App → TestFlight & App Store and upload the build.",
+        },
+        {
+            step: 7,
+            cmd: null,
+            label: "Complete the release",
+            detail: "Wait for App Store Connect processing, test through TestFlight, complete store metadata and privacy disclosures, select the processed build, and submit it for App Review.",
         },
     ],
 }
@@ -495,6 +512,7 @@ function getProjectContext(root) {
         iosBuildType: (wv.ios?.buildType || "debug").toLowerCase(),
         hasKeystore: !!wv.android?.keystoreConfig,
         hasGoogleSignIn: !!wv.googleSignIn?.enabled,
+        hasNotifications: !!wv.notifications?.enabled,
         hasEcosystem: fileExists("ecosystem.config.js"),
         port: wv.port,
         useHttps: !!wv.useHttps,
@@ -618,7 +636,7 @@ function handle_get_build_flow({ platform, mode, symptom } = {}) {
             )
         }
 
-        const isRelease = m === "release" || ctx.iosBuildType === "release"
+        const isRelease = m === "release"
         flow_key = isRelease ? "ios_release" : "ios_debug"
 
         if (!ctx.wv.ios?.appBundleId) {
@@ -634,13 +652,23 @@ function handle_get_build_flow({ platform, mode, symptom } = {}) {
                 "googleSignIn.enabled=true but iosClientId may be missing — check WEBVIEW_CONFIG.googleSignIn.iosClientId."
             )
         }
-        if (isRelease && ctx.iosBuildType !== "release") {
+        if (isRelease && !ctx.useHttps) {
             warnings.push(
-                'ios.buildType is not "Release" (case-sensitive). Release builds require exactly "Release" — not "release".'
+                "WEBVIEW_CONFIG.useHttps is not enabled — the App Store flow requires a reachable HTTPS production web application."
+            )
+        }
+        if (isRelease && ctx.hasNotifications) {
+            warnings.push(
+                "Push notifications are enabled — review the generated aps-environment entitlement and Release provisioning before archiving."
             )
         }
 
         notes.push(`buildType detected: ${ctx.wv.ios?.buildType || "not set (defaults to debug)"}`)
+        if (isRelease) {
+            notes.push(
+                "ios.buildType does not select the App Store build configuration; buildApp:ios still performs a Debug build. Archive the generated project with the scheme's Release action."
+            )
+        }
         if (ctx.wv.ios?.appBundleId) notes.push(`appBundleId: ${ctx.wv.ios.appBundleId}`)
         if (ctx.wv.ios?.simulatorName) notes.push(`simulatorName: ${ctx.wv.ios.simulatorName}`)
         if (ctx.hasGoogleSignIn) notes.push("googleSignIn: enabled")

package/mcp_v2/tools/github.js

@@ -161,6 +161,7 @@ function safeReadText(filePath, maxBytes = 8000) {
 
 function runGit(root, command) {
     try {
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process - command is always one of the fixed git/node/npm strings hardcoded at call sites, never external input.
         return execSync(command, {
             cwd: root,
             encoding: "utf8",
@@ -183,6 +184,7 @@ function slugify(input) {
 }
 
 function ensureFallbackDir(root) {
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - root is the project_path MCP tool argument, an intentional/documented parameter letting a local developer's coding agent point this tool at any project directory it already has filesystem access to (see mcp.js inputSchema). Not a network-facing input; the caller already has direct fs access via other tools. FALLBACK_DIR is a hardcoded literal.
     const dir = path.join(root, FALLBACK_DIR)
     fs.mkdirSync(dir, { recursive: true })
     return dir
@@ -406,7 +408,9 @@ function appendSection(sections, heading, content) {
 }
 
 function isPathInside(root, candidate) {
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - this is the containment-check helper itself (used by callers below to reject paths outside root); root/candidate here are the values being validated, not yet trusted for file access.
     const resolvedRoot = path.resolve(root)
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - this is the containment-check helper itself; candidate is the value being validated, not yet trusted for file access.
     const resolvedCandidate = path.resolve(candidate)
     const relative = path.relative(resolvedRoot, resolvedCandidate)
     return relative === "" || (relative && !relative.startsWith("..") && !path.isAbsolute(relative))
@@ -543,6 +547,7 @@ function normalizeImages(images, root) {
             continue
         }
 
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - raw is an MCP tool argument (attachment path) and root the project_path argument; the isPathInside() check on the next line rejects anything that resolves outside root before it is ever read.
         const absolutePath = path.isAbsolute(raw) ? path.resolve(raw) : path.resolve(root, raw)
         if (!isPathInside(root, absolutePath)) {
             localFiles.push({ path: raw, exists: false, rejected: true, reason: "outside_project_root" })
@@ -789,6 +794,7 @@ function collectRelatedFiles(root, query, explicitFiles) {
     const candidates = Array.isArray(explicitFiles) ? explicitFiles : []
     for (const file of candidates) {
         if (typeof file !== "string") continue
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - file is an MCP tool argument (explicit related-files list) and root the project_path argument; the isPathInside() check on the next line rejects anything that resolves outside root before it is ever read.
         const absolute = path.isAbsolute(file) ? path.resolve(file) : path.resolve(root, file)
         if (!isPathInside(root, absolute)) continue
         const content = safeReadText(absolute, 12000)
@@ -802,6 +808,7 @@ function collectRelatedFiles(root, query, explicitFiles) {
     const words = normalizeSearchText(query).split(/\s+/).filter(Boolean).slice(0, 5)
     if (words.length === 0) return files
 
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - root is the project_path MCP tool argument, an intentional/documented parameter (see mcp.js inputSchema); "src" is a hardcoded literal.
     const srcDir = path.join(root, "src")
     const matches = []
     function walk(dir) {
@@ -813,6 +820,7 @@ function collectRelatedFiles(root, query, explicitFiles) {
         }
         for (const entry of entries) {
             if (entry.name === "node_modules" || entry.name === ".git") continue
+            // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - entry.name comes from fs.readdirSync(dir) above, i.e. actual filenames already on disk under srcDir, not request input.
             const full = path.join(dir, entry.name)
             if (entry.isDirectory()) {
                 walk(full)
@@ -831,7 +839,9 @@ function collectRelatedFiles(root, query, explicitFiles) {
 
 function gatherGithubIssueContext(args = {}) {
     const root = getProjectRoot(args)
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - root is the project_path MCP tool argument, an intentional/documented parameter (see mcp.js inputSchema); "package.json" is a hardcoded literal.
     const pkg = safeReadJson(path.join(root, "package.json"))
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - root is the project_path MCP tool argument, an intentional/documented parameter (see mcp.js inputSchema); "config/config.json" is a hardcoded literal.
     const configJson = safeReadJson(path.join(root, "config", "config.json"))
     const branch = runGit(root, "git rev-parse --abbrev-ref HEAD")
     const commit = runGit(root, "git rev-parse --short HEAD")
@@ -874,6 +884,7 @@ function generateIssueMarkdown(args = {}) {
     const built = buildIssueBody(args, { enrich: true })
     const labels = resolveIssueLabels(args, built.body)
     const dir = ensureFallbackDir(root)
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - dir is the FALLBACK_DIR under the project_path MCP argument; the filename is a generated ISO timestamp plus slugify(title), which strips to [a-z0-9-] only, so it cannot contain path separators.
     const filePath = path.join(dir, `${new Date().toISOString().replace(/[:.]/g, "-")}-${slugify(title)}.md`)
 
     const markdown = [

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "catalyst-core",
-    "version": "0.3.0-beta.1",
+    "version": "0.3.0-beta.3",
     "type": "module",
     "main": "./dist/index.jsx",
     "description": "Web framework that provides great performance out of the box",
@@ -31,7 +31,7 @@
         "lint": "eslint .",
         "lint-staged": "lint-staged",
         "prettify": "prettier . --write",
-        "prepare": "rm -rf ./dist && cp -r ./src ./dist && babel src/native --out-dir dist/native --config-file ./babel.native.config.cjs --ignore '**/.build/**' && babel src/sentry.js --out-file dist/sentry.cjs --config-file ./babel.native.config.cjs",
+        "prepare": "node ../../scripts/safe-rimraf.js ./dist && cp -r ./src ./dist && babel src/native --out-dir dist/native --config-file ./babel.native.config.cjs --ignore '**/.build/**' && babel src/sentry.js --out-file dist/sentry.cjs --config-file ./babel.native.config.cjs",
         "prepublishOnly": "npm run prepare",
         "test:fixture": "sh ../../scripts/test-catalyst-core.sh"
     },
@@ -51,7 +51,7 @@
         "react-refresh": "^0.14.0",
         "react-router-dom": "^6.16.0",
         "redux": "^4.2.1",
-        "sanitize-html": "^2.13.1",
+        "sanitize-html": "^2.17.6",
         "sass": "^1.89.2",
         "ua-parser-js": "^1.0.37",
         "vite": "^6.4.3",