Warden weekly sweep

[github-actions]

Warden Scheduled Scan Results

Run: 2026-07-06T07:35:35.389Z
Commit: db7e055

Summary

Severity	Count
High	3
Low	2

Findings

src/utils/template-manager.ts

• MK3-624 process.chdir() race condition corrupts cwd for concurrent scaffold requests (L101-L113) · high
  Using process.chdir() to set the extraction directory is process-global state; concurrent calls to downloadTemplate (e.g., two simultaneous scaffold tool invocations via the daemon) will race on process.cwd(), causing one or both to extract into the wrong directory or corrupt each other's state. Pass -d tempDir to unzip instead.

src/utils/xcodebuild-domain-results.ts

• QDW-KRS Import uses .ts extension instead of .js, breaking the build (L31) · high
  This import uses a .ts extension, which is inconsistent with all other imports in the file (which use .js) and will fail compilation under tsconfig.build.json, which sets allowImportingTsExtensions: false.
  Suggested fix: Change the import extension from .ts to .js to match the convention used by all other imports in this file and satisfy the build tsconfig.

src/utils/xcodemake.ts

• AAX-FZV Remote script downloaded and executed without integrity verification (L63-L80) · high
  The installXcodemake function fetches a shell script from a mutable GitHub raw URL (main branch) and executes it without any hash or signature check, making every build that triggers auto-install vulnerable to supply-chain compromise if the upstream repo is taken over or the branch is force-pushed.

src/mcp/tools/device/list_devices.ts

• BPP-Z9J Test sentinel '123' hardcoded into production timestamp when pathDeps.join is injected (L130-L133) · low
  In discoverDevices (src/mcp/tools/device/list_devices.ts:130), the timestamp used for the temp JSON path is set to the string '123' whenever pathDeps.join is provided, otherwise to Date.now(). This couples path-join dependency injection to a fixed test sentinel that would leak into a real filesystem path (devicectl-123.json) if any non-test caller ever injects a join. In practice all production call sites at lines 303/324 pass pathDeps through from external callers, so the risk is latent rather than active, but the branch is a code smell: the DI seam should not alter timestamp semantics. Fix by always using Date.now() and only branching on pathDeps.join for the path composition itself.
  Suggested fix: Separate the timestamp from the path-join injection so Date.now() is always used.

src/utils/logger.ts

• 523-8RW Log file receives all messages regardless of configured log level (L268-L274) · low
  The file write guard (clientLogLevel !== 'none') does not apply the severity threshold, so debug messages are written to the log file even when clientLogLevel is set to error, unlike stderr which correctly gates on shouldLog(level).
  Suggested fix: Replace the weaker file-write guard with the same shouldLog call used for stderr output.

---

Generated by Warden