catalyst-core 0.3.0-beta.2 → 0.3.0-beta.3

package/dist/native/androidSetup.js

@@ -209,13 +209,15 @@ async function checkEmulator(ADB_PATH) {
 }
 async function startEmulator(EMULATOR_PATH, androidConfig) {
   progress.log(`Starting emulator: ${androidConfig.emulatorName}...`);
-  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process - EMULATOR_PATH is derived from SDK configuration and emulatorName is local native setup config.
-  // eslint-disable-next-line security/detect-child-process
-  (0, _child_process.exec)(`${EMULATOR_PATH} -avd ${androidConfig.emulatorName} -read-only > /dev/null &`, error => {
-    if (error) {
-      progress.log(`Error starting emulator: ${error}`, "error");
-    }
+  // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process - spawn with an argv array (no shell), so androidConfig.emulatorName can't be interpreted as shell syntax even though it comes from a locally-editable config file.
+  const child = (0, _child_process.spawn)(EMULATOR_PATH, ["-avd", androidConfig.emulatorName, "-read-only"], {
+    detached: true,
+    stdio: "ignore"
+  });
+  child.on("error", error => {
+    progress.log(`Error starting emulator: ${error}`, "error");
   });
+  child.unref();
 }
 async function updateLocalProperties(sdkPath) {
   progress.start("properties");

package/dist/offline/catalyst-sw.js

@@ -99,6 +99,7 @@ function isOfflineRoute(url, manifest) {
     const { pathname } = new URL(url)
     return (manifest.routes || []).some((route) => {
         try {
+            // nosemgrep: javascript.lang.security.audit.detect-non-literal-regexp.detect-non-literal-regexp - route.regex is generated at build time by generateOfflineManifest.js's routeRegex(), which escapes every regex metacharacter in literal path segments and only ever emits flat (non-nested, non-repeating) patterns for :param and * segments — it cannot produce a catastrophic-backtracking shape. The manifest itself is same-origin build output, not user-submitted at runtime.
             return new RegExp(route.regex).test(pathname)
         } catch (_) {
             return false

package/dist/scripts/build.js

@@ -4,6 +4,7 @@ import { arrayToObject } from "./scriptUtils.js"
 import { fileURLToPath } from "url"
 import { dirname } from "path"
 import { readFileSync, existsSync, rmSync } from "fs"
+import { createRequire } from "module"
 
 const __filename = fileURLToPath(import.meta.url)
 const __dirname = dirname(__filename)
@@ -11,16 +12,19 @@ const loaderPath = path.resolve(__dirname, "../../dist/vite/node-loader.mjs")
 const configPath = path.join(process.env.PWD, "config/config.json")
 const configJSON = JSON.parse(readFileSync(configPath), "utf-8")
 
+// Resolve vite's actual JS entry point rather than spawning the "vite" command name,
+// which on Windows only resolves via the npm-installed .cmd shim (i.e. requires a shell).
+// Invoking process.execPath + this path directly works cross-platform with no shell.
+const require = createRequire(import.meta.url)
+const viteBinPath = path.join(path.dirname(require.resolve("vite/package.json")), "bin", "vite.js")
+
 /**
- * @param {string} command
+ * @param {string[]} args
  * @param {import('child_process').SpawnOptions} options
  */
-function runBuildStep(command, options) {
+function runBuildStep(args, options) {
     return new Promise((resolve, reject) => {
-        const child = spawn(command, [], {
-            ...options,
-            shell: true,
-        })
+        const child = spawn(process.execPath, args, options)
         child.on("close", (code) => {
             if (code === 0) {
                 resolve()
@@ -69,8 +73,8 @@ async function build() {
         ]),
     }
 
-    const serverBuildCommand = `vite build --config ./dist/vite/vite.config.server.js --ssr`
-    const clientBuildCommand = `vite build --config ./dist/vite/vite.config.client.js`
+    const serverBuildArgs = [viteBinPath, "build", "--config", "./dist/vite/vite.config.server.js", "--ssr"]
+    const clientBuildArgs = [viteBinPath, "build", "--config", "./dist/vite/vite.config.client.js"]
     const spawnBase = {
         cwd: dirname,
         stdio: "inherit",
@@ -80,11 +84,11 @@ async function build() {
 
     try {
         await Promise.all([
-            runBuildStep(serverBuildCommand, {
+            runBuildStep(serverBuildArgs, {
                 ...spawnBase,
                 env: { ...baseEnv, CATALYST_VITE_CACHE_ID: "ssr" },
             }),
-            runBuildStep(clientBuildCommand, {
+            runBuildStep(clientBuildArgs, {
                 ...spawnBase,
                 env: { ...baseEnv, CATALYST_VITE_CACHE_ID: "client" },
             }),
@@ -96,7 +100,7 @@ async function build() {
 
     console.log("✅ Server and client builds completed!")
 
-    await runBuildStep("node ./dist/scripts/generateOfflineManifest.js", {
+    await runBuildStep(["./dist/scripts/generateOfflineManifest.js"], {
         ...spawnBase,
         env: baseEnv,
     })

package/dist/scripts/generateOfflineManifest.js

@@ -68,6 +68,7 @@ async function loadAppRoutes(appRoot) {
     })
 
     try {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - appRoot is the app's own build root and the remainder is a hardcoded literal path, not request input.
         const routesModule = await vite.ssrLoadModule(path.join(appRoot, "src/js/routes/utils.js"))
         return typeof routesModule.getRoutes === "function" ? routesModule.getRoutes() : []
     } finally {

package/dist/scripts/scriptUtils.js

@@ -23,6 +23,7 @@ export const printBundleInformation = () => {
         const files = fs.readdirSync(directoryPath)
         files.forEach((file) => {
             if (!file.includes("txt") && !file.includes("json")) {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - file comes from fs.readdirSync(directoryPath), i.e. actual filenames already on disk in the build output, not request input.
                 const filePath = path.join(directoryPath, file)
                 const fileSize = getFileSizeSync(filePath)
                 if (fileSize !== null) {

package/dist/scripts/serve.js

@@ -24,28 +24,30 @@ function startProd() {
 
     console.log("🚀 Starting production server...")
 
-    const inspectFlag = commandLineArguments.includes("--inspect") ? "--inspect" : ""
-    const command = `node ${inspectFlag} --import ${preInitPath} --loader ${loaderPath} ./dist/server/expressServer.js`
-    spawnSync(command, [], {
-        cwd: dirname,
-        stdio: "inherit",
-        shell: true,
-        env: {
-            ...process.env,
-            src_path: process.env.PWD,
-            NODE_ENV: "production",
-            IS_DEV_COMMAND: false,
-            APPLICATION: name || "catalyst_app",
-            ...argumentsObject,
-            filterKeys: JSON.stringify([
-                "src_path",
-                "NODE_ENV",
-                "IS_DEV_COMMAND",
-                "APPLICATION",
-                ...Object.keys(argumentsObject),
-            ]),
-        },
-    })
+    const inspectArgs = commandLineArguments.includes("--inspect") ? ["--inspect"] : []
+    spawnSync(
+        "node",
+        [...inspectArgs, "--import", preInitPath, "--loader", loaderPath, "./dist/server/expressServer.js"],
+        {
+            cwd: dirname,
+            stdio: "inherit",
+            env: {
+                ...process.env,
+                src_path: process.env.PWD,
+                NODE_ENV: "production",
+                IS_DEV_COMMAND: false,
+                APPLICATION: name || "catalyst_app",
+                ...argumentsObject,
+                filterKeys: JSON.stringify([
+                    "src_path",
+                    "NODE_ENV",
+                    "IS_DEV_COMMAND",
+                    "APPLICATION",
+                    ...Object.keys(argumentsObject),
+                ]),
+            },
+        }
+    )
 }
 
 startProd()

package/dist/scripts/start.js

@@ -22,11 +22,9 @@ function start() {
     const packageJson = JSON.parse(readFileSync(path.join(process.env.PWD, "package.json"), "utf-8"))
     const { name } = packageJson
 
-    const command = `node --import ${preInitPath} --loader ${loaderPath} ./dist/server/expressServer.js`
-    spawnSync(command, [], {
+    spawnSync("node", ["--import", preInitPath, "--loader", loaderPath, "./dist/server/expressServer.js"], {
         cwd: dirname,
         stdio: "inherit",
-        shell: true,
         env: {
             ...process.env,
             src_path: process.env.PWD,

package/dist/server/expressServer.js

@@ -126,6 +126,7 @@ const isProduction = process.env.NODE_ENV === "production"
 
 function serveBuildFile(app, buildPath, urlPath, fileName, headers = {}) {
     app.get(urlPath, (_req, res, next) => {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - fileName is always a hardcoded literal passed at each serveBuildFile call site, never derived from the request.
         const filePath = path.join(buildPath, fileName)
         if (!fs.existsSync(filePath)) return next()
         res.set(headers)

package/dist/server/renderer/document/Head.jsx

@@ -34,9 +34,11 @@ export function Head(props) {
             {metaTags && metaTags}
 
             {/* Inline critical CSS — prevents FOUC/CLS */}
+            {/* nosemgrep: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml - inlineCss is compiled CSS read from disk (readCssFromDisk), sourced from the app's own build output, never from request/user input. */}
             {inlineCss && <style dangerouslySetInnerHTML={{ __html: inlineCss }} />}
 
             {/* Deferred CSS from prior SSRs on this route — avoids late layout from post-body <style> */}
+            {/* nosemgrep: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml - deferredRouteInlineCss is compiled CSS read from disk (readCssFromDisk), sourced from the app's own build output, never from request/user input. */}
             {deferredRouteInlineCss && <style dangerouslySetInnerHTML={{ __html: deferredRouteInlineCss }} />}
 
             {/* JS modules */}

package/dist/server/renderer/extract.js

@@ -103,6 +103,7 @@ export const readCssFromDisk = (cssPaths = [], basePath) => {
         seen.add(asset)
         if (asset.startsWith("http")) continue
 
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - asset paths come from the Vite build manifest generated at build time, never from a request, so there is no user-controlled input here.
         const filePath = path.isAbsolute(asset) ? asset : path.join(basePath, asset.replace(/^\/+/, ""))
 
         try {

package/dist/server/renderer/handler.jsx

@@ -265,6 +265,7 @@ const _renderMarkUp = async (
                     if (chunkExtractor) {
                         const renderedKeys = chunkExtractor.getRenderedComponentKeys()
                         this.push(
+                            // nosemgrep: javascript.lang.security.audit.unknown-value-with-script-tag.unknown-value-with-script-tag - renderedKeys are internal bundler component-module keys tracked by ChunkExtractor, never request/user input, and are JSON.stringify-escaped before embedding.
                             `<script>window.__SSR_RENDERED_COMPONENTS__=new Set(${JSON.stringify(renderedKeys)})</script>`
                         )
                     }

package/dist/vite/inject-cache-key-plugin.js

@@ -45,9 +45,11 @@ function loadAliases() {
     for (const [alias, aliasPath] of Object.entries(allAliases)) {
         if (aliasPath && typeof aliasPath === "string") {
             try {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - appRoot is the app's own build root and aliasPath comes from the developer's package.json config, not request/user input.
                 const resolvedPath = path.resolve(appRoot, ...aliasPath.split("/"))
                 aliasCache[alias] = resolvedPath
             } catch (error) {
+                // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - alias is a key from the developer's own package.json config, not attacker-controlled; console.warn here does no printf-style substitution.
                 console.warn(`Failed to resolve alias ${alias}:`, error.message)
             }
         }
@@ -87,6 +89,7 @@ function resolveWithExtensions(basePath) {
     }
 
     for (const ext of extensions) {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - basePath is derived from module import specifiers resolved by this plugin's own alias/relative-import logic, never from a request.
         const candidate = path.join(basePath, `index${ext}`)
         if (existsSync(candidate)) {
             return candidate
@@ -107,9 +110,11 @@ function resolveToAbsolutePath(importPath, importerId) {
     for (const [alias, aliasPath] of Object.entries(aliases)) {
         if (importPath === alias || importPath.startsWith(alias + "/")) {
             const remainingPath = importPath === alias ? "" : importPath.slice(alias.length + 1)
+            // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - importPath comes from the app's own module import graph and aliasPath from the developer's package.json config, never from a request.
             const rawResolved = path.join(aliasPath, remainingPath)
             const finalResolved = resolveWithExtensions(rawResolved)
             if (finalResolved) {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - finalResolved is derived from the same alias/import resolution above, not request input.
                 return path.resolve(finalResolved)
             }
         }
@@ -118,6 +123,7 @@ function resolveToAbsolutePath(importPath, importerId) {
     // 2. Relative imports — resolve from the importer's directory
     if (importPath.startsWith("./") || importPath.startsWith("../")) {
         const importerDir = path.dirname(importerId)
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - importPath comes from the app's own module import graph and importerId from Vite's module resolution, never from a request.
         const absolutePath = path.resolve(importerDir, importPath)
         const resolved = resolveWithExtensions(absolutePath)
         if (resolved) {
@@ -149,6 +155,7 @@ function resolveImportPath(importPath, importerId) {
         // Fallback: strip leading ./ and return as-is
         return importPath.replace(/^\.\//, "")
     } catch (error) {
+        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - importPath comes from the app's own module import graph resolved by Vite at build time, not attacker-controlled; console.warn here does no printf-style substitution.
         console.warn(`Error resolving import path ${importPath}:`, error.message)
         return importPath.replace(/^\.\//, "")
     }

package/dist/vite/loadCustomViteConfig.js

@@ -10,6 +10,7 @@ const emptyConfig = {
 export async function loadCustomViteConfig() {
     const configNames = ["buildConfig.js", "webpackConfig.js"]
     const configPath = configNames
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - configName is one of two hardcoded literals above, and process.env.src_path is the app root set by the framework's own build tooling, not request/user input.
         .map((configName) => path.join(process.env.src_path, configName))
         .find((candidatePath) => existsSync(candidatePath))
 

package/dist/vite/manifest-categorization-plugin.js

@@ -293,6 +293,7 @@ export function manifestCategorizationPlugin(options = {}) {
     // branch of the import graph, the affected CSS would vanish from server responses
     // with no runtime error — this check surfaces that as a build-time warning.
     function validateCssCoverage(categorizedManifest, buildDir) {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - buildDir is the build tool's own output directory and the remaining segments are hardcoded literals, not request input.
         const cssDir = path.join(buildDir, "client", "assets", "css")
         if (!fs.existsSync(cssDir)) return
 
@@ -403,6 +404,7 @@ export function manifestCategorizationPlugin(options = {}) {
                             })
                         }
                     } catch (err) {
+                        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - importPath comes from the app's own module import graph resolved by Vite at build time, not attacker-controlled; console.log here does no printf-style substitution.
                         console.log(`❌ Error resolving ${importPath}:`, err.message)
                     }
                 })

package/dist/vite/node-loader.mjs

@@ -56,6 +56,7 @@ function loadAliases() {
                 const resolvedPath = resolvePath(appRoot, ...aliasPath.split("/"))
                 aliasCache[alias] = resolvedPath
             } catch (error) {
+                // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - alias is a key from the developer's own package.json _moduleAliases config, not attacker-controlled; console.warn here does no printf-style substitution.
                 console.warn(`Failed to resolve alias ${alias}:`, error.message)
             }
         }
@@ -100,6 +101,7 @@ function resolveWithExtensions(basePath) {
 
     // Try index files inside a directory
     for (const ext of extensions) {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - basePath is derived from module import specifiers resolved by the Node loader itself, never from a request.
         const candidate = join(basePath, `index${ext}`)
         if (existsSync(candidate)) {
             return candidate
@@ -119,10 +121,12 @@ function resolveAlias(specifier, parentURL) {
     for (const [alias, aliasPath] of Object.entries(aliases)) {
         if (specifier.startsWith(alias + "/") || specifier === alias) {
             const remainingPath = specifier === alias ? "" : specifier.slice(alias.length + 1)
+            // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - specifier comes from an ES module import statement in the app's own source code, and aliasPath from the developer's package.json config, never from a request.
             const rawResolvedPath = join(aliasPath, remainingPath)
             const finalResolvedPath = resolveWithExtensions(rawResolvedPath)
 
             if (finalResolvedPath) {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - finalResolvedPath is derived from the same alias/import resolution above, not request input.
                 return resolvePath(finalResolvedPath)
             }
         }
@@ -140,6 +144,7 @@ function resolveRelative(specifier, parentURL) {
     try {
         const parentPath = fileURLToPath(parentURL)
         const parentDir = dirname(parentPath)
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - specifier comes from an ES module import statement in the app's own source code, parentURL from the module loader itself, never from a request.
         const absolutePath = resolvePath(parentDir, specifier)
         return resolveWithExtensions(absolutePath)
     } catch {
@@ -225,6 +230,7 @@ export async function resolve(specifier, context, defaultResolve) {
  */
 function findNearestPackageType(dir) {
     while (dir !== dirname(dir)) {
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - dir is walked up from the module's own filesystem location via dirname(), never from a request; "package.json" is a hardcoded literal.
         const pkgPath = join(dir, "package.json")
         if (existsSync(pkgPath)) {
             try {

package/dist/vite/vite.config.js

@@ -113,6 +113,7 @@ try {
     const packageJson = JSON.parse(packageJsonContent)
     _moduleAliases = packageJson._moduleAliases || {}
 } catch (error) {
+    // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - packageJsonConfig is a build-time-resolved local path, not attacker-controlled; console.warn here does no printf-style substitution.
     console.warn(`Failed to read or parse package.json from ${packageJsonConfig}:`, error.message)
 }
 
@@ -122,6 +123,7 @@ try {
     catalyst_moduleAliases = catalystPackageJson._moduleAliases || {}
 } catch (error) {
     console.warn(
+        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - catalystPackageJsonConfig is a build-time-resolved local path, not attacker-controlled; console.warn here does no printf-style substitution.
         `Failed to read or parse catalyst package.json from ${catalystPackageJsonConfig}:`,
         error.message
     )
@@ -146,6 +148,7 @@ import { imageUrl, fontUrl } from "./scssParams.js"
 // options — so anything else is left alone and Vite falls back to its normal
 // auto-loaded postcss.config.js resolution.
 const resolvePostcssPlugins = () => {
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - process.env.src_path is the app root set by the framework's own build tooling, not request/user input.
     const configPath = path.join(process.env.src_path, "postcss.config.js")
     if (!fs.existsSync(configPath)) return null
 
@@ -168,6 +171,7 @@ const resolvePostcssPlugins = () => {
             return plugin(finalOptions)
         })
     } catch (error) {
+        // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - configPath is a build-time-resolved local path, not attacker-controlled; console.warn here does no printf-style substitution.
         console.warn(`Failed to patch postcss config at ${configPath}:`, error.message)
         return null
     }
@@ -183,9 +187,11 @@ const alias = () => {
     return Object.keys(allAliases).reduce((moduleEnvMap, alias) => {
         if (allAliases[alias] && typeof allAliases[alias] === "string") {
             try {
+                // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - process.env.src_path is the app root and allAliases comes from the developer's own package.json _moduleAliases config, not request/user input.
                 const aliasPath = path.join(process.env.src_path, ...allAliases[alias].split("/"))
                 moduleEnvMap[alias] = aliasPath
             } catch (error) {
+                // nosemgrep: javascript.lang.security.audit.unsafe-formatstring.unsafe-formatstring - alias is a key from the developer's own package.json _moduleAliases config, not attacker-controlled; console.warn here does no printf-style substitution.
                 console.warn(`Failed to configure alias ${alias}:`, error.message)
             }
         }

package/mcp_v2/tools/github.js

@@ -161,6 +161,7 @@ function safeReadText(filePath, maxBytes = 8000) {
 
 function runGit(root, command) {
     try {
+        // nosemgrep: javascript.lang.security.detect-child-process.detect-child-process - command is always one of the fixed git/node/npm strings hardcoded at call sites, never external input.
         return execSync(command, {
             cwd: root,
             encoding: "utf8",
@@ -183,6 +184,7 @@ function slugify(input) {
 }
 
 function ensureFallbackDir(root) {
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - root is the project_path MCP tool argument, an intentional/documented parameter letting a local developer's coding agent point this tool at any project directory it already has filesystem access to (see mcp.js inputSchema). Not a network-facing input; the caller already has direct fs access via other tools. FALLBACK_DIR is a hardcoded literal.
     const dir = path.join(root, FALLBACK_DIR)
     fs.mkdirSync(dir, { recursive: true })
     return dir
@@ -406,7 +408,9 @@ function appendSection(sections, heading, content) {
 }
 
 function isPathInside(root, candidate) {
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - this is the containment-check helper itself (used by callers below to reject paths outside root); root/candidate here are the values being validated, not yet trusted for file access.
     const resolvedRoot = path.resolve(root)
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - this is the containment-check helper itself; candidate is the value being validated, not yet trusted for file access.
     const resolvedCandidate = path.resolve(candidate)
     const relative = path.relative(resolvedRoot, resolvedCandidate)
     return relative === "" || (relative && !relative.startsWith("..") && !path.isAbsolute(relative))
@@ -543,6 +547,7 @@ function normalizeImages(images, root) {
             continue
         }
 
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - raw is an MCP tool argument (attachment path) and root the project_path argument; the isPathInside() check on the next line rejects anything that resolves outside root before it is ever read.
         const absolutePath = path.isAbsolute(raw) ? path.resolve(raw) : path.resolve(root, raw)
         if (!isPathInside(root, absolutePath)) {
             localFiles.push({ path: raw, exists: false, rejected: true, reason: "outside_project_root" })
@@ -789,6 +794,7 @@ function collectRelatedFiles(root, query, explicitFiles) {
     const candidates = Array.isArray(explicitFiles) ? explicitFiles : []
     for (const file of candidates) {
         if (typeof file !== "string") continue
+        // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - file is an MCP tool argument (explicit related-files list) and root the project_path argument; the isPathInside() check on the next line rejects anything that resolves outside root before it is ever read.
         const absolute = path.isAbsolute(file) ? path.resolve(file) : path.resolve(root, file)
         if (!isPathInside(root, absolute)) continue
         const content = safeReadText(absolute, 12000)
@@ -802,6 +808,7 @@ function collectRelatedFiles(root, query, explicitFiles) {
     const words = normalizeSearchText(query).split(/\s+/).filter(Boolean).slice(0, 5)
     if (words.length === 0) return files
 
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - root is the project_path MCP tool argument, an intentional/documented parameter (see mcp.js inputSchema); "src" is a hardcoded literal.
     const srcDir = path.join(root, "src")
     const matches = []
     function walk(dir) {
@@ -813,6 +820,7 @@ function collectRelatedFiles(root, query, explicitFiles) {
         }
         for (const entry of entries) {
             if (entry.name === "node_modules" || entry.name === ".git") continue
+            // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - entry.name comes from fs.readdirSync(dir) above, i.e. actual filenames already on disk under srcDir, not request input.
             const full = path.join(dir, entry.name)
             if (entry.isDirectory()) {
                 walk(full)
@@ -831,7 +839,9 @@ function collectRelatedFiles(root, query, explicitFiles) {
 
 function gatherGithubIssueContext(args = {}) {
     const root = getProjectRoot(args)
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - root is the project_path MCP tool argument, an intentional/documented parameter (see mcp.js inputSchema); "package.json" is a hardcoded literal.
     const pkg = safeReadJson(path.join(root, "package.json"))
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - root is the project_path MCP tool argument, an intentional/documented parameter (see mcp.js inputSchema); "config/config.json" is a hardcoded literal.
     const configJson = safeReadJson(path.join(root, "config", "config.json"))
     const branch = runGit(root, "git rev-parse --abbrev-ref HEAD")
     const commit = runGit(root, "git rev-parse --short HEAD")
@@ -874,6 +884,7 @@ function generateIssueMarkdown(args = {}) {
     const built = buildIssueBody(args, { enrich: true })
     const labels = resolveIssueLabels(args, built.body)
     const dir = ensureFallbackDir(root)
+    // nosemgrep: javascript.lang.security.audit.path-traversal.path-join-resolve-traversal.path-join-resolve-traversal - dir is the FALLBACK_DIR under the project_path MCP argument; the filename is a generated ISO timestamp plus slugify(title), which strips to [a-z0-9-] only, so it cannot contain path separators.
     const filePath = path.join(dir, `${new Date().toISOString().replace(/[:.]/g, "-")}-${slugify(title)}.md`)
 
     const markdown = [

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "catalyst-core",
-    "version": "0.3.0-beta.2",
+    "version": "0.3.0-beta.3",
     "type": "module",
     "main": "./dist/index.jsx",
     "description": "Web framework that provides great performance out of the box",
@@ -51,7 +51,7 @@
         "react-refresh": "^0.14.0",
         "react-router-dom": "^6.16.0",
         "redux": "^4.2.1",
-        "sanitize-html": "^2.13.1",
+        "sanitize-html": "^2.17.6",
         "sass": "^1.89.2",
         "ua-parser-js": "^1.0.37",
         "vite": "^6.4.3",