Warden: code-review

Bắt đầu bằng cách xem xét các tệp được liệt kê và các phạm vi dòng được tham chiếu, đặc biệt là các đường dẫn CLI daemon, purge và subprocess. Chạy bộ kiểm thử hiện có và các kiểm thử tích hợp để xác định mức độ bao phủ hiện tại. Công việc được xem là hoàn tất khi đã xử lý các phát hiện phù hợp và thêm các kiểm thử chuyên biệt cho việc xử lý lỗi, giới hạn tài nguyên, hành vi retry và các hồi quy CLI đã được báo cáo.

Warden Scheduled Scan Results

Run: 2026-09-07T07:15:56.069Z
Commit: e6ef59b

Summary

Severity	Count
Medium	12

Findings

src/benchmarks/claude-ui/harness.ts

• 3PD-BGN Unhandled WriteStream errors cause fatal unhandled exceptions (L298-L299) · medium
  createWriteStream for stdout and stderr has no 'error' event listener. File-system failures (disk full, permission denied) during writes become uncaught exceptions instead of rejecting the command promise.

src/benchmarks/claude-ui/preflight-commands.ts

• 33X-SNX Unbounded stdout/stderr buffering in runShellCommand can exhaust memory (L90-L103) · medium
  runShellCommand accumulates every stdout and stderr chunk in memory without a size limit, so a preflight command that produces large output can OOM before the timeout fires.

src/benchmarks/claude-ui/run-directory.ts

• DWH-XB3 directoryExists returns true for files, causing readdir to throw ENOTDIR (L6-L18) · medium
  directoryExists uses access() which returns true for any existing path, including files. When a file path is passed, suitePaths calls readdir and throws an unhandled ENOTDIR. Consider using stat and checking isDirectory() instead.

src/benchmarks/claude-ui/simulator-frontend.ts

• 6WD-W5R New retry logic module lacks dedicated tests (L1-L90) · medium
  The new simulator-frontend.ts contains retry loops, error-code -1712 detection, and killall cleanup, but has no dedicated test file. Existing integration tests only cover the happy path.

src/cli/commands/daemon.ts

• V7S-VAK Invalid --tail input bypasses default and dumps entire log file (L114) · medium
  The ?? 200 fallback does not catch NaN from invalid yargs input, causing the handleLogs slice to return the whole file instead of the default 200 lines.
• K8B-PLV logs command loads entire log file into memory for tail output (L267) · medium
  readFileSync reads the complete log file synchronously to emit only the tail, which can exhaust memory or block the event loop on large files.

src/cli/commands/init.ts

• T2B-FCT TTY ensureAgentsGuidance call crashes on filesystem errors without graceful handling (L645-L648) · medium
  The interactive (TTY) branch calls ensureAgentsGuidance without any try/catch, so fs.readFileSync / fs.writeFileSync failures produce an unhandled crash after clack.outro('Done.') is already printed. The non-TTY branch wraps the same call and reports the error gracefully in JSON output.

src/cli/commands/purge-interactive-model.ts

• F7D-9PN O(n²) workspace matching triggered by all-keys workspaces scope (L76-L85) · medium
  Passing every workspace key via a workspaces scope to planPurgeStorage triggers an O(n²) lookup in selectedWorkspacesForScope that grows with the number of workspaces.

src/cli/commands/purge-interactive.ts

• 83G-TXA Exit message falsely claims no storage was deleted (L377) · medium
  After items are deleted in nested menus and the user returns to the root, selecting 'cancel' or interrupting a prompt prints 'No storage deleted' even though prior deletions succeeded.

src/cli/daemon-client.ts

• 9NP-TJ3 invokeTool may reject after terminal result is received (L186) · medium
  The socket.on('close') handler rejects the promise when !settled, but settled doesn't become true until a queued microtask runs after receiving the terminal result. If the socket closes before that microtask executes, the client rejects with a spurious transport error even though the result was successfully received.

src/cli/daemon-control.ts

• XYH-3F2 startDaemonBackground unhandled spawn error crashes process (L136-L152) · medium
  spawn failures emit an error event asynchronously with no listener, causing an unhandled exception that the caller's try-catch cannot catch.

General

• 3QH-3SB runPreflightCommands and runShellCommand have no test coverage · medium
  The new file adds subprocess execution, timeout escalation, and process group signalling logic, but none of it is exercised in the test suite.

---

Generated by Warden