maiass 5.9.23 → 5.9.26

package/lib/account-info.js

@@ -88,7 +88,7 @@ async function createAnonymousSubscriptionIfNeeded() {
       
       if (stored) {
         log.success(SYMBOLS.CHECKMARK, 'Anonymous subscription created and stored securely');
-        log.info(SYMBOLS.INFO, `   API Key: ${apiKey.substring(0, 8)}...`);
+        log.info(SYMBOLS.INFO, `   API Key: [stored securely]`);
         log.info(SYMBOLS.INFO, `   Credits: ${credits || 'N/A'}`);
         
         if (subscriptionId) {
@@ -412,13 +412,12 @@ export async function handleAccountInfoCommand(options = {}) {
     const custEmail = data.customer_email || '-';
     const statusField = data.status || result.status;
     
-    const maskedKey = maskToken(apiKey);
     const credit = 'Nugét';
-    
+
     console.log('');
     console.log('Account Info');
     console.log('------------');
-    console.log(`API Token:        ${maskedKey}`);
+    console.log(`API Token:        [stored securely]`);
     
     const subscriptionId = process.env.MAIASS_SUBSCRIPTION_ID;
     if (subscriptionId) {

package/lib/bootstrap.js

@@ -58,6 +58,11 @@ function loadExistingValues() {
  * @returns {string} Detected project type
  */
 function detectProjectType() {
+  // Check for Swift/Xcode project — search root and one level deep
+  if (detectPbxproj() || fs.existsSync('Package.swift')) {
+    return 'swift';
+  }
+
   // Check for WordPress
   if (fs.existsSync('wp-config.php') || fs.existsSync('wp-content')) {
     if (fs.existsSync('style.css')) {
@@ -66,9 +71,7 @@ function detectProjectType() {
         return 'wordpress-theme';
       }
     }
-    // Check for plugin
-    const files = fs.readdirSync('.');
-    for (const file of files) {
+    for (const file of fs.readdirSync('.')) {
       if (file.endsWith('.php')) {
         const content = fs.readFileSync(file, 'utf8');
         if (content.includes('Plugin Name:')) {
@@ -78,40 +81,77 @@ function detectProjectType() {
     }
     return 'wordpress-site';
   }
-  
+
   // Check for Craft CMS
   if (fs.existsSync('craft') || fs.existsSync('config/general.php')) {
     return 'craft';
   }
-  
+
   // Default to bespoke
   return 'bespoke';
 }
 
+/**
+ * Find the .pbxproj file by searching the current directory and one level of subdirectories.
+ * Xcode projects are often nested: ProjectRoot/MyApp/MyApp.xcodeproj/project.pbxproj
+ * Skips hidden dirs, node_modules, and build artefact folders.
+ * @returns {string|null} Relative path to the .pbxproj, or null
+ */
+function detectPbxproj() {
+  const SKIP = new Set(['node_modules', '.git', 'build', 'dist', 'Pods', 'DerivedData']);
+
+  function findInDir(dir, depth = 0) {
+    try {
+      const entries = fs.readdirSync(dir, { withFileTypes: true });
+      // Check for .xcodeproj bundles at this level
+      for (const entry of entries) {
+        if (entry.isDirectory() && entry.name.endsWith('.xcodeproj')) {
+          const pbxproj = path.join(dir, entry.name, 'project.pbxproj');
+          if (fs.existsSync(pbxproj)) {
+            // Return relative to cwd
+            return path.relative(process.cwd(), pbxproj);
+          }
+        }
+      }
+      // Recurse one level into non-skipped subdirectories
+      if (depth < 2) {
+        for (const entry of entries) {
+          if (entry.isDirectory() && !SKIP.has(entry.name) && !entry.name.startsWith('.')) {
+            const found = findInDir(path.join(dir, entry.name), depth + 1);
+            if (found) return found;
+          }
+        }
+      }
+    } catch {}
+    return null;
+  }
+
+  return findInDir(process.cwd());
+}
+
 /**
  * Detect version source file
  * @returns {string} Detected version file
  */
 function detectVersionSource() {
-  if (fs.existsSync('package.json')) {
-    return 'package.json';
-  }
-  if (fs.existsSync('composer.json')) {
-    return 'composer.json';
-  }
-  if (fs.existsSync('VERSION')) {
-    return 'VERSION';
-  }
+  // Swift: prefer .pbxproj over anything else
+  const pbxproj = detectPbxproj();
+  if (pbxproj) return pbxproj;
+
+  if (fs.existsSync('package.json')) return 'package.json';
+  if (fs.existsSync('composer.json')) return 'composer.json';
+  if (fs.existsSync('VERSION')) return 'VERSION';
   return 'package.json'; // Default
 }
 
 /**
  * Infer version file type from filename/extension
  * @param {string} filename - Version file name or path
- * @returns {string} File type: 'json', 'php', or 'txt'
+ * @returns {string} File type: 'json', 'php', 'txt', or 'xcodeproj'
  */
 function inferVersionFileType(filename) {
   if (!filename) return 'txt';
+  if (filename.endsWith('.pbxproj')) return 'xcodeproj';
   if (filename.endsWith('.json')) return 'json';
   if (filename.endsWith('.php')) return 'php';
   if (filename.endsWith('.css')) return 'php'; // CSS version headers use same pattern as PHP
@@ -155,7 +195,7 @@ export async function bootstrapProject() {
   config.projectType = await configureProjectType(existing);
   
   // Step 3: Version source
-  config.versionSource = await configureVersionSource(existing);
+  config.versionSource = await configureVersionSource(existing, config.projectType);
   
   // Step 4: Features selection
   config.features = await chooseFeatures(existing);
@@ -236,14 +276,15 @@ async function configureProjectType(existing) {
   console.log(`  ${colors.BCyan('3)')} wordpress-plugin - WordPress plugin with main PHP file versioning`);
   console.log(`  ${colors.BCyan('4)')} wordpress-site   - Full WordPress installation`);
   console.log(`  ${colors.BCyan('5)')} craft            - Craft CMS project`);
+  console.log(`  ${colors.BCyan('6)')} swift            - Swift/Xcode app (.pbxproj versioning)`);
   console.log('');
-  
-  const defaultChoice = ['bespoke', 'wordpress-theme', 'wordpress-plugin', 'wordpress-site', 'craft'].indexOf(current) + 1;
-  const choice = await getLineInput(`Select project type [1-5, Enter for ${defaultChoice}=${current}]: `);
-  
+
+  const types = ['bespoke', 'wordpress-theme', 'wordpress-plugin', 'wordpress-site', 'craft', 'swift'];
+  const defaultChoice = types.indexOf(current) + 1 || 1;
+  const choice = await getLineInput(`Select project type [1-6, Enter for ${defaultChoice}=${current}]: `);
+
   if (!choice) return current;
-  
-  const types = ['bespoke', 'wordpress-theme', 'wordpress-plugin', 'wordpress-site', 'craft'];
+
   const index = parseInt(choice) - 1;
   
   if (index >= 0 && index < types.length) {
@@ -258,27 +299,53 @@ async function configureProjectType(existing) {
 /**
  * Step 3: Configure version source
  */
-async function configureVersionSource(existing) {
+async function configureVersionSource(existing, projectType = 'bespoke') {
   console.log('');
   console.log(colors.BCyan('📦 Version Source Configuration'));
   console.log('');
-  
-  const detected = detectVersionSource();
-  const current = existing.MAIASS_VERSION_PRIMARY_FILE || detected;
-  
+
+  const isSwift = projectType === 'swift';
+  const pbxproj = detectPbxproj();
+
+  // For Swift, use the found .pbxproj as default; fall back to non-Swift detection otherwise
+  const detected = isSwift ? (pbxproj || null) : detectVersionSource();
+  // When project type is swift and a pbxproj was found, only keep the existing setting
+  // if it's also a .pbxproj (i.e. don't let a stale 'VERSION' or 'package.json' override it)
+  const existingIsCompatible = !isSwift || !pbxproj || (existing.MAIASS_VERSION_PRIMARY_FILE || '').endsWith('.pbxproj');
+  const current = (existingIsCompatible ? existing.MAIASS_VERSION_PRIMARY_FILE : null) || detected || '';
+
   console.log('MAIASS needs to know where your project version is stored.');
   console.log('This file will be updated automatically when you bump versions.');
   console.log('');
-  
-  console.log(`${SYMBOLS.INFO} Detected version file: ${colors.BGreen(detected)}`);
-  if (existing.MAIASS_VERSION_PRIMARY_FILE) {
-    console.log(`${SYMBOLS.INFO} Current setting: ${colors.BGreen(existing.MAIASS_VERSION_PRIMARY_FILE)}`);
+
+  if (isSwift) {
+    console.log(colors.BCyan('🍎 Swift/Xcode versioning'));
+    console.log(colors.Gray('   MAIASS manages MARKETING_VERSION (e.g. 1.2.3) in your .pbxproj.'));
+    console.log(colors.Gray('   CURRENT_PROJECT_VERSION (build number) is auto-incremented on each bump.'));
+    console.log(colors.Gray('   Both are read by Xcode directly — no Info.plist edits needed.'));
+    console.log('');
+    if (pbxproj) {
+      console.log(`${SYMBOLS.CHECKMARK} Found: ${colors.BGreen(pbxproj)}`);
+    } else {
+      console.log(`${SYMBOLS.WARNING} ${colors.BYellow('No .xcodeproj found in this directory.')}`);
+      console.log(colors.Gray('   Enter the path manually, e.g. MyApp.xcodeproj/project.pbxproj'));
+    }
+  } else {
+    if (detected) {
+      console.log(`${SYMBOLS.INFO} Detected version file: ${colors.BGreen(detected)}`);
+    }
+    if (existing.MAIASS_VERSION_PRIMARY_FILE) {
+      console.log(`${SYMBOLS.INFO} Current setting: ${colors.BGreen(existing.MAIASS_VERSION_PRIMARY_FILE)}`);
+    }
+    console.log(colors.Gray('Common options: package.json, composer.json, VERSION, style.css'));
   }
   console.log('');
-  
-  console.log(colors.Gray('Common options: package.json, composer.json, VERSION, style.css'));
-  const file = await getLineInput(`Version source file [Enter for ${current}]: `);
-  
+
+  const prompt = current
+    ? `Version source file [Enter for ${current}]: `
+    : `Version source file: `;
+  const file = await getLineInput(prompt);
+
   const result = file || current;
   if (file) {
     console.log(`${SYMBOLS.CHECKMARK} Version source set to: ${colors.BGreen(result)}`);

package/lib/commit.js

@@ -1,5 +1,8 @@
 // Commit functionality for MAIASS - port of maiass.sh commit behavior
 import { execSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
 import { log, redact } from './logger.js';
 import { SYMBOLS } from './symbols.js';
 import { getGitInfo, getGitStatus } from './git-info.js';
@@ -229,7 +232,7 @@ async function createAnonymousSubscriptionIfNeeded() {
       
       if (stored) {
         log.success(SYMBOLS.CHECKMARK, 'Anonymous subscription created and stored securely');
-        log.info(SYMBOLS.INFO, `   API Key: ${apiKey.substring(0, 8)}...`);
+        log.info(SYMBOLS.INFO, `   API Key: [stored securely]`);
         log.info(SYMBOLS.INFO, `   Credits: ${credits || 'N/A'}`);
         
         if (subscriptionId) {
@@ -823,20 +826,12 @@ async function handleStagedCommit(gitInfo, options = {}) {
     if (jiraTicket && finalCommitMessage && !finalCommitMessage.startsWith(jiraTicket)) {
       finalCommitMessage = `${jiraTicket} ${finalCommitMessage}`;
     }
-    if (process.platform === 'win32') {
-      // Write commit message to a temporary file to avoid quoting/newline issues
-      const fs = (await import('fs')).default;
-      const os = (await import('os')).default;
-      const path = (await import('path')).default;
+    // Write commit message to a temp file on all platforms — avoids shell quoting and injection risks
+    {
       const tmpFile = path.join(os.tmpdir(), `maiass-commit-msg-${Date.now()}.txt`);
       fs.writeFileSync(tmpFile, finalCommitMessage, { encoding: 'utf8' });
-      commitCommand = `git commit -F "${tmpFile}"`;
-      result = executeGitCommand(commitCommand, quietMode);
+      result = executeGitCommand(`git commit -F "${tmpFile}"`, quietMode);
       fs.unlinkSync(tmpFile);
-    } else {
-      // Use echo/pipe for non-Windows
-      commitCommand = `echo ${JSON.stringify(commitMessage)} | git commit -F -`;
-      result = executeGitCommand(commitCommand, quietMode);
     }
     
     if (result === null) {

package/lib/devlog.js

@@ -1,6 +1,6 @@
 // Development logging utility for MAIASS
 // Node.js equivalent of the devlog.sh integration from maiass.sh
-import { exec, execSync } from 'child_process';
+import { execFile, execSync } from 'child_process';
 import { existsSync } from 'fs';
 import path from 'path';
 import colors from './colors.js';
@@ -89,20 +89,24 @@ export function logThis(message, options = {}) {
     return null;
   }
 
-  // Escape the message for shell execution
-  const escapedMessage = message.replace(/"/g, '\\"').replace(/\n/g, '; ');
+  // Normalise message for single-line logging (no shell escaping needed — args array is used)
+  const normalisedMessage = message.replace(/\n/g, '; ');
 
-  let command;
+  // Build args array — no shell interpolation, so no injection risk
+  let executable, args;
   if (process.platform === 'win32') {
-    command = `powershell.exe -ExecutionPolicy Bypass -NonInteractive -Command "devlog -s '${escapedMessage}' '?' '${project}' '${client}' '${jiraTicket}' '${subClient}'"`;
+    executable = 'powershell.exe';
+    args = ['-ExecutionPolicy', 'Bypass', '-NonInteractive', '-Command',
+      `devlog -s '${normalisedMessage.replace(/'/g, "''")}' '?' '${project}' '${client}' '${jiraTicket}' '${subClient}'`];
   } else {
-    command = `devlog.sh "${escapedMessage}" "?" "${project}" "${client}" "${jiraTicket}" "${subClient}"`;
+    executable = 'devlog.sh';
+    args = [normalisedMessage, '?', project, client, jiraTicket, subClient];
   }
 
-  logger.debug(`Executing devlog command: ${command}`);
-  
+  logger.debug(`Executing devlog: ${executable} ${args.join(' ')}`);
+
   // Execute asynchronously - don't block the main workflow (fire-and-forget)
-  exec(command, { encoding: 'utf8' }, (error, stdout, stderr) => {
+  execFile(executable, args, { encoding: 'utf8' }, (error, stdout, stderr) => {
     if (error) {
       
       if (process.env.MAIASS_DEBUG === 'true') {
@@ -113,7 +117,7 @@ export function logThis(message, options = {}) {
     
     // Only log success confirmation, not the verbose stdout output
 
-      logger.debug(`Logged to devlog: ${escapedMessage}`);
+      logger.debug(`Logged to devlog: ${normalisedMessage}`);
   });
   
   // Return immediately (don't wait for devlog.sh to complete)

package/lib/secure-storage.js

@@ -3,7 +3,7 @@
 // Windows uses encrypted file storage in AppData
 // Compatible with bashmaiass approach but uses NODEMAIASS service names
 
-import { execSync } from 'child_process';
+import { execFileSync, spawnSync } from 'child_process';
 import os from 'os';
 import fs from 'fs';
 import path from 'path';
@@ -98,8 +98,8 @@ export function storeSecureVariable(varName, varValue) {
   
   try {
     if (os.platform() === 'darwin') {
-      // macOS: Use keychain via security command
-      execSync(`security add-generic-password -U -s "${serviceName}" -a "${varName}" -w "${varValue}"`, {
+      // macOS: Use keychain via security command — args array avoids shell injection
+      execFileSync('security', ['add-generic-password', '-U', '-s', serviceName, '-a', varName, '-w', varValue], {
         stdio: 'pipe'
       });
     } else if (os.platform() === 'win32') {
@@ -139,12 +139,12 @@ export function storeSecureVariable(varName, varValue) {
         logger.debug(`Stored ${varName} in Windows secure storage (encrypted file)`);
       }
     } else {
-      // Linux: Use secret-tool if available
+      // Linux: Use secret-tool if available — spawnSync with input avoids shell + pipe injection
       try {
-        execSync('which secret-tool', { stdio: 'pipe' });
-        execSync(`echo -n "${varValue}" | secret-tool store --label="NODEMAIASS ${varName} (${serviceName})" service "${serviceName}" key "${varName}"`, {
-          stdio: 'pipe',
-          shell: true
+        execFileSync('which', ['secret-tool'], { stdio: 'pipe' });
+        spawnSync('secret-tool', ['store', '--label', `NODEMAIASS ${varName} (${serviceName})`, 'service', serviceName, 'key', varName], {
+          input: varValue,
+          stdio: ['pipe', 'pipe', 'pipe']
         });
       } catch (error) {
         if (debugMode) {
@@ -183,8 +183,8 @@ export function retrieveSecureVariable(varName) {
     let value = null;
     
     if (os.platform() === 'darwin') {
-      // macOS: Use keychain via security command
-      value = execSync(`security find-generic-password -s "${serviceName}" -a "${varName}" -w`, {
+      // macOS: Use keychain via security command — args array avoids shell injection
+      value = execFileSync('security', ['find-generic-password', '-s', serviceName, '-a', varName, '-w'], {
         stdio: 'pipe',
         encoding: 'utf8'
       }).trim();
@@ -216,10 +216,10 @@ export function retrieveSecureVariable(varName) {
         return null;
       }
     } else {
-      // Linux: Use secret-tool if available
+      // Linux: Use secret-tool if available — args array avoids shell injection
       try {
-        execSync('which secret-tool', { stdio: 'pipe' });
-        value = execSync(`secret-tool lookup service "${serviceName}" key "${varName}"`, {
+        execFileSync('which', ['secret-tool'], { stdio: 'pipe' });
+        value = execFileSync('secret-tool', ['lookup', 'service', serviceName, 'key', varName], {
           stdio: 'pipe',
           encoding: 'utf8'
         }).trim();
@@ -259,8 +259,8 @@ export function removeSecureVariable(varName) {
   
   try {
     if (os.platform() === 'darwin') {
-      // macOS: Use keychain via security command
-      execSync(`security delete-generic-password -s "${serviceName}" -a "${varName}"`, {
+      // macOS: Use keychain via security command — args array avoids shell injection
+      execFileSync('security', ['delete-generic-password', '-s', serviceName, '-a', varName], {
         stdio: 'pipe'
       });
     } else if (os.platform() === 'win32') {
@@ -302,13 +302,12 @@ export function removeSecureVariable(varName) {
         return false;
       }
     } else {
-      // Linux: secret-tool doesn't have direct delete, but we can try to clear it
+      // Linux: secret-tool doesn't have direct delete, so store empty value — spawnSync with input avoids shell injection
       try {
-        execSync('which secret-tool', { stdio: 'pipe' });
-        // secret-tool doesn't have a delete command, so we store an empty value
-        execSync(`echo -n "" | secret-tool store --label="NODEMAIASS ${varName} (${serviceName})" service "${serviceName}" key "${varName}"`, {
-          stdio: 'pipe',
-          shell: true
+        execFileSync('which', ['secret-tool'], { stdio: 'pipe' });
+        spawnSync('secret-tool', ['store', '--label', `NODEMAIASS ${varName} (${serviceName})`, 'service', serviceName, 'key', varName], {
+          input: '',
+          stdio: ['pipe', 'pipe', 'pipe']
         });
       } catch (error) {
         if (debugMode) {
@@ -391,14 +390,14 @@ export function loadSecureVariables() {
 export function isSecureStorageAvailable() {
   try {
     if (os.platform() === 'darwin') {
-      execSync('which security', { stdio: 'pipe' });
+      execFileSync('which', ['security'], { stdio: 'pipe' });
       return true;
     } else if (os.platform() === 'win32') {
       // Windows: Always available (uses encrypted file storage)
       return true;
     } else {
       // Linux: Check for secret-tool
-      execSync('which secret-tool', { stdio: 'pipe' });
+      execFileSync('which', ['secret-tool'], { stdio: 'pipe' });
       return true;
     }
   } catch (error) {

package/lib/token-validator.js

@@ -152,9 +152,8 @@ export function displayTokenValidation() {
       console.log(`[DEBUG]     ${display.symbol} ${tokenConfig.description} (${tokenConfig.name}): ${display.color(display.status)}`);
       
       if (validation && validation.valid) {
-        // Show partial token for confirmation (first 8 chars + ...)
-        const maskedToken = tokenValue.substring(0, 8) + '...';
-        console.log(colors.Gray(`[DEBUG]       Preview: ${maskedToken}`));
+        // Confirm token is present without logging any part of its value
+        console.log(colors.Gray(`[DEBUG]       Status: [present]`));
       }
     });
   });
@@ -165,12 +164,12 @@ export function displayTokenValidation() {
     const tokenValue = process.env[tokenConfig.name];
     const validation = tokenValue ? validateTokenValue(tokenValue, tokenConfig) : null;
     const display = getValidationDisplay(validation);
-    
+
     console.log(`[DEBUG]   ${display.symbol} ${tokenConfig.description} (${tokenConfig.name}): ${display.color(display.status)}`);
-    
+
     if (validation && validation.valid) {
-      const maskedToken = tokenValue.substring(0, 8) + '...';
-      console.log(colors.Gray(`[DEBUG]     Active: ${maskedToken}`));
+      // Confirm token is present without logging any part of its value
+      console.log(colors.Gray(`[DEBUG]     Status: [present]`));
     }
   });
   

package/lib/version-manager.js

@@ -84,6 +84,28 @@ const VERSION_FILE_TYPES = {
       return content.replace(/^\d+\.\d+\.\d+/, newVersion);
     }
   },
+  xcodeproj: {
+    extensions: ['.pbxproj'],
+    detect: (content) => /MARKETING_VERSION\s*=\s*\d+\.\d+(?:\.\d+)?\s*;/.test(content),
+    extract: (content) => {
+      // Match 1.0 or 1.0.0 style versions
+      const match = content.match(/MARKETING_VERSION\s*=\s*(\d+\.\d+(?:\.\d+)?)\s*;/);
+      return match ? match[1] : null;
+    },
+    update: (content, newVersion) => {
+      // Bump MARKETING_VERSION everywhere it appears (all targets)
+      content = content.replace(
+        /(MARKETING_VERSION\s*=\s*)\d+\.\d+(?:\.\d+)?(\s*;)/g,
+        `$1${newVersion}$2`
+      );
+      // Auto-increment CURRENT_PROJECT_VERSION (build number)
+      content = content.replace(
+        /(CURRENT_PROJECT_VERSION\s*=\s*)(\d+)(\s*;)/g,
+        (_, prefix, num, suffix) => `${prefix}${parseInt(num, 10) + 1}${suffix}`
+      );
+      return content;
+    }
+  },
   php: {
     extensions: ['.php','pattern'],
     detect: (content) => {
@@ -125,13 +147,14 @@ const VERSION_FILE_TYPES = {
 export function parseVersion(version) {
   if (!version) return null;
   
-  const match = version.match(/^(\d+)\.(\d+)\.(\d+)(?:-(.+))?$/);
+  // Accept x.y.z or x.y (treat x.y as x.y.0)
+  const match = version.match(/^(\d+)\.(\d+)(?:\.(\d+))?(?:-(.+))?$/);
   if (!match) return null;
-  
+
   return {
     major: parseInt(match[1], 10),
     minor: parseInt(match[2], 10),
-    patch: parseInt(match[3], 10),
+    patch: match[3] !== undefined ? parseInt(match[3], 10) : 0,
     prerelease: match[4] || null,
     raw: version
   };
@@ -318,7 +341,7 @@ function updateThemeStyleVersion(filePath, newVersion) {
     logger.debug(` style.css written successfully`);
     return true;
   } catch (error) {
-    console.error(colors.Red(`${SYMBOLS.CROSS} Error updating ${filePath}: ${error.message}`));
+    console.error(colors.Red(`${SYMBOLS.CROSS} Error updating ${filePath}: ${error.message}`)); // codeql[js/clear-text-logging] -- filePath and error.message are file I/O data, not credentials
     return false;
   }
 }
@@ -381,7 +404,7 @@ function updatePhpVersionConstant(filePath, constantName, newVersion) {
     if (definePattern.test(content)) {
       // Replace existing define
       content = content.replace(definePattern, newDefine);
-      console.log(colors.BGreen(`${SYMBOLS.CHECKMARK} Updated ${constantName} in ${path.basename(filePath)}`));
+      console.log(colors.BGreen(`${SYMBOLS.CHECKMARK} Updated ${constantName} in ${path.basename(filePath)}`)); // codeql[js/clear-text-logging] -- constantName and filePath are version metadata, not credentials
     } else {
       // Add new define after opening PHP tag
       const phpOpenTag = /<\?php/;
@@ -390,9 +413,9 @@ function updatePhpVersionConstant(filePath, constantName, newVersion) {
       if (phpOpenTag.test(content)) {
         logger.debug(` Found PHP opening tag, adding new define`);
         content = content.replace(phpOpenTag, `<?php\n\n${newDefine}`);
-        console.log(colors.BGreen(`${SYMBOLS.CHECKMARK} Added ${constantName} to ${path.basename(filePath)}`));
+        console.log(colors.BGreen(`${SYMBOLS.CHECKMARK} Added ${constantName} to ${path.basename(filePath)}`)); // codeql[js/clear-text-logging] -- constantName and filePath are version metadata, not credentials
       } else {
-        console.log(colors.BYellow(`${SYMBOLS.WARNING} Could not find PHP opening tag in ${path.basename(filePath)}`));
+        console.log(colors.BYellow(`${SYMBOLS.WARNING} Could not find PHP opening tag in ${path.basename(filePath)}`)); // codeql[js/clear-text-logging] -- filePath is a file path, not a credential
         return false;
       }
     }
@@ -401,7 +424,7 @@ function updatePhpVersionConstant(filePath, constantName, newVersion) {
     logger.debug(` File written successfully`);
     return true;
   } catch (error) {
-    console.error(colors.Red(`${SYMBOLS.CROSS} Error updating ${filePath}: ${error.message}`));
+    console.error(colors.Red(`${SYMBOLS.CROSS} Error updating ${filePath}: ${error.message}`)); // codeql[js/clear-text-logging] -- filePath and error.message are file I/O data, not credentials
     return false;
   }
 }
@@ -444,7 +467,7 @@ function updateWordPressVersions(newVersion, projectPath = process.cwd()) {
         success = false;
       }
     } else {
-      console.log(colors.BYellow(`${SYMBOLS.WARNING} Could not find main plugin file in ${pluginPath}`));
+      console.log(colors.BYellow(`${SYMBOLS.WARNING} Could not find main plugin file in ${pluginPath}`)); // codeql[js/clear-text-logging] -- pluginPath is a file path, not a credential
     }
   }
   
@@ -492,7 +515,7 @@ function updateWordPressVersions(newVersion, projectPath = process.cwd()) {
         success = false;
       }
     } else {
-      console.log(colors.BYellow(`${SYMBOLS.WARNING} Could not find functions.php in ${themePath}`));
+      console.log(colors.BYellow(`${SYMBOLS.WARNING} Could not find functions.php in ${themePath}`)); // codeql[js/clear-text-logging] -- themePath is a file path, not a credential
       if (functionsFile) {
         logger.debug(` Expected functions.php at: ${functionsFile}`);
       }
@@ -543,7 +566,11 @@ function extractVersionByType(content, type, lineStart) {
   if (type === 'php' || type === 'pattern') {
     return VERSION_FILE_TYPES.php.extract(content);
   }
-  
+
+  if (type === 'xcodeproj') {
+    return VERSION_FILE_TYPES.xcodeproj.extract(content);
+  }
+
   // Unknown type - try generic version extraction
   const match = content.match(/(\d+\.\d+\.\d+)/);
   return match ? match[1] : null;
@@ -564,7 +591,10 @@ export function detectVersionFiles(projectPath = process.cwd()) {
   const primaryFileRaw = process.env.MAIASS_VERSION_PRIMARY_FILE;
   const primaryFile = primaryFileRaw ? primaryFileRaw.split('\\').join('/') : primaryFileRaw;
   const primaryTypeEnv = process.env.MAIASS_VERSION_PRIMARY_TYPE;
-  const primaryType = primaryTypeEnv || (primaryFile && primaryFile.endsWith('.json') ? 'json' : 'txt');
+  const primaryType = primaryTypeEnv || (
+    primaryFile && primaryFile.endsWith('.pbxproj') ? 'xcodeproj' :
+    primaryFile && primaryFile.endsWith('.json') ? 'json' : 'txt'
+  );
   const primaryLineStart = process.env.MAIASS_VERSION_PRIMARY_LINE_START || '';
   
   if (primaryFile) {
@@ -602,9 +632,55 @@ export function detectVersionFiles(projectPath = process.cwd()) {
   }
   
   // Fallback: scan common version file patterns in project root
+  // Check for Xcode project first — .pbxproj lives inside *.xcodeproj bundle.
+  // Search root and up to 2 levels of subdirectories (nested project structures).
+  {
+    const SKIP = new Set(['node_modules', '.git', 'build', 'dist', 'Pods', 'DerivedData']);
+
+    function findPbxproj(dir, depth = 0) {
+      try {
+        const entries = fs.readdirSync(dir, { withFileTypes: true });
+        for (const entry of entries) {
+          if (entry.isDirectory() && entry.name.endsWith('.xcodeproj')) {
+            const pbxprojPath = path.join(dir, entry.name, 'project.pbxproj');
+            if (fs.existsSync(pbxprojPath)) return pbxprojPath;
+          }
+        }
+        if (depth < 2) {
+          for (const entry of entries) {
+            if (entry.isDirectory() && !SKIP.has(entry.name) && !entry.name.startsWith('.')) {
+              const found = findPbxproj(path.join(dir, entry.name), depth + 1);
+              if (found) return found;
+            }
+          }
+        }
+      } catch {}
+      return null;
+    }
+
+    const pbxprojPath = findPbxproj(projectPath);
+    if (pbxprojPath) {
+      try {
+        const content = fs.readFileSync(pbxprojPath, 'utf8');
+        const version = VERSION_FILE_TYPES.xcodeproj.extract(content);
+        if (version) {
+          versionFiles.push({
+            path: pbxprojPath,
+            filename: path.relative(projectPath, pbxprojPath),
+            type: 'xcodeproj',
+            currentVersion: version,
+            content,
+            isPrimary: true
+          });
+          return versionFiles; // .pbxproj is authoritative for Swift projects
+        }
+      } catch {}
+    }
+  }
+
   const filesToCheck = [
     'package.json',
-    'composer.json', 
+    'composer.json',
     'VERSION',
     'version.txt',
     'style.css',

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "maiass",
   "type": "module",
-  "version": "5.9.23",
+  "version": "5.9.26",
   "description": "MAIASS - Modular AI-Augmented Semantic Scribe - Intelligent Git workflow automation",
   "main": "maiass.mjs",
   "bin": {