maiass 5.9.34 → 5.9.36

package/lib/changelog.js

@@ -1,6 +1,7 @@
 // Changelog management for MAIASS - matches bashmaiass implementation
 import { execSync } from 'child_process';
 import fs from 'fs/promises';
+import { readFileSync } from 'fs';
 import { log } from './logger.js';
 import { SYMBOLS } from './symbols.js';
 
@@ -24,7 +25,7 @@ function executeGitCommand(command) {
  */
 function getLastChangelogCommit(changelogPath) {
   try {
-    const content = execSync(`cat "${changelogPath}"`, { encoding: 'utf8' });
+    const content = readFileSync(changelogPath, 'utf8');
     const match = content.match(/^## (.+)$/m);
     if (match) {
       const lastVersion = match[1].trim();

package/lib/config-manager.js

@@ -131,7 +131,8 @@ export function writeConfig(configPath, config, options = {}) {
             lines.push(`# ${varDef.description}`);
           }
           
-          // Quote values that contain spaces or special characters
+          // Quote values that contain spaces or special characters.
+          // Written to a file only — not passed to a shell. codeql[js/incomplete-sanitization]
           const needsQuotes = /[\s#"'\\]/.test(value);
           const quotedValue = needsQuotes ? `"${value.replace(/"/g, '\\"')}"` : value;
           

package/lib/logger.js

@@ -4,6 +4,7 @@ import chalk from 'chalk';
 import fs from 'fs';
 import path from 'path';
 import os from 'os';
+import { randomBytes } from 'crypto';
 
 // Store environment variables
 let env = {};
@@ -70,7 +71,7 @@ function writeToLogFile(message) {
  * Initialize debug collection session
  */
 function initDebugSession() {
-  sessionId = `maiass-${Date.now()}-${Math.random().toString(36).substr(2, 9)}`;
+  sessionId = `maiass-${Date.now()}-${randomBytes(5).toString('hex')}`;
   debugBuffer = [];
 }
 

package/lib/maiass-command.js

@@ -37,10 +37,13 @@ export async function handleMaiassCommand(args) {
   logger.header('', 'MAIASS - Modular AI-Assisted Semantic Scribe');
   
   try {
-    // Create anonymous subscription if needed (matches bashmaiass behavior)
-    // This ensures free credits are allocated on first run
+    // Create anonymous subscription if needed (matches bashmaiass behavior).
+    // Skip in CI environments (GitHub Actions / any env with CI=true) — each runner
+    // has a different virtual MAC/disk, so every run would generate a new machine
+    // fingerprint and burn an anonymous subscription slot.
     const aiMode = process.env.MAIASS_AI_MODE || 'ask';
-    if (aiMode !== 'off') {
+    const isCI = process.env.CI === 'true' || process.env.CI === '1';
+    if (aiMode !== 'off' && !isCI) {
       await createAnonymousSubscriptionIfNeeded();
     }
     

package/lib/token-validator.js

@@ -149,7 +149,7 @@ export function displayTokenValidation() {
       const validation = tokenValue ? validateTokenValue(tokenValue, tokenConfig) : null;
       const display = getValidationDisplay(validation);
       
-      console.log(`[DEBUG]     ${display.symbol} ${tokenConfig.description} (${tokenConfig.name}): ${display.color(display.status)}`);
+      console.log(`[DEBUG]     ${display.symbol} ${tokenConfig.description} (${tokenConfig.name}): ${display.color(display.status)}`); // codeql[js/clear-text-logging]
       
       if (validation && validation.valid) {
         // Confirm token is present without logging any part of its value
@@ -165,7 +165,7 @@ export function displayTokenValidation() {
     const validation = tokenValue ? validateTokenValue(tokenValue, tokenConfig) : null;
     const display = getValidationDisplay(validation);
 
-    console.log(`[DEBUG]   ${display.symbol} ${tokenConfig.description} (${tokenConfig.name}): ${display.color(display.status)}`);
+    console.log(`[DEBUG]   ${display.symbol} ${tokenConfig.description} (${tokenConfig.name}): ${display.color(display.status)}`); // codeql[js/clear-text-logging]
 
     if (validation && validation.valid) {
       // Confirm token is present without logging any part of its value

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "maiass",
   "type": "module",
-  "version": "5.9.34",
+  "version": "5.9.36",
   "description": "MAIASS - Modular AI-Augmented Semantic Scribe - Intelligent Git workflow automation",
   "main": "maiass.mjs",
   "bin": {