René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Warden weekly sweep","articleBody":"## Warden Scheduled Scan Results\n\n**Run:** 2026-07-06T07:35:35.389Z\n**Commit:** `db7e055`\n\n### Summary\n\n| Severity | Count |\n|----------|-------|\n| High | 3 |\n| Low | 2 |\n\n### Findings\n\n#### [`src/utils/template-manager.ts`](https://github.com/getsentry/XcodeBuildMCP/blob/db7e055c39d4e2c23cbd030f14ac8bc8329f61d8/src/utils/template-manager.ts)\n\n- `MK3-624` **process.chdir() race condition corrupts cwd for concurrent scaffold requests** ([L101-L113](https://github.com/getsentry/XcodeBuildMCP/blob/db7e055c39d4e2c23cbd030f14ac8bc8329f61d8/src/utils/template-manager.ts#L101-L113)) · high\n  Using `process.chdir()` to set the extraction directory is process-global state; concurrent calls to `downloadTemplate` (e.g., two simultaneous scaffold tool invocations via the daemon) will race on `process.cwd()`, causing one or both to extract into the wrong directory or corrupt each other's state. Pass `-d tempDir` to `unzip` instead.\n\n#### [`src/utils/xcodebuild-domain-results.ts`](https://github.com/getsentry/XcodeBuildMCP/blob/db7e055c39d4e2c23cbd030f14ac8bc8329f61d8/src/utils/xcodebuild-domain-results.ts)\n\n- `QDW-KRS` **Import uses `.ts` extension instead of `.js`, breaking the build** ([L31](https://github.com/getsentry/XcodeBuildMCP/blob/db7e055c39d4e2c23cbd030f14ac8bc8329f61d8/src/utils/xcodebuild-domain-results.ts#L31)) · high\n  This import uses a `.ts` extension, which is inconsistent with all other imports in the file (which use `.js`) and will fail compilation under `tsconfig.build.json`, which sets `allowImportingTsExtensions: false`.\n  *Suggested fix:* Change the import extension from `.ts` to `.js` to match the convention used by all other imports in this file and satisfy the build tsconfig.\n\n#### [`src/utils/xcodemake.ts`](https://github.com/getsentry/XcodeBuildMCP/blob/db7e055c39d4e2c23cbd030f14ac8bc8329f61d8/src/utils/xcodemake.ts)\n\n- `AAX-FZV` **Remote script downloaded and executed without integrity verification** ([L63-L80](https://github.com/getsentry/XcodeBuildMCP/blob/db7e055c39d4e2c23cbd030f14ac8bc8329f61d8/src/utils/xcodemake.ts#L63-L80)) · high\n  The `installXcodemake` function fetches a shell script from a mutable GitHub raw URL (`main` branch) and executes it without any hash or signature check, making every build that triggers auto-install vulnerable to supply-chain compromise if the upstream repo is taken over or the branch is force-pushed.\n\n#### [`src/mcp/tools/device/list_devices.ts`](https://github.com/getsentry/XcodeBuildMCP/blob/db7e055c39d4e2c23cbd030f14ac8bc8329f61d8/src/mcp/tools/device/list_devices.ts)\n\n- `BPP-Z9J` **Test sentinel '123' hardcoded into production timestamp when pathDeps.join is injected** ([L130-L133](https://github.com/getsentry/XcodeBuildMCP/blob/db7e055c39d4e2c23cbd030f14ac8bc8329f61d8/src/mcp/tools/device/list_devices.ts#L130-L133)) · low\n  In `discoverDevices` (src/mcp/tools/device/list_devices.ts:130), the timestamp used for the temp JSON path is set to the string `'123'` whenever `pathDeps.join` is provided, otherwise to `Date.now()`. This couples path-join dependency injection to a fixed test sentinel that would leak into a real filesystem path (`devicectl-123.json`) if any non-test caller ever injects a `join`. In practice all production call sites at lines 303/324 pass `pathDeps` through from external callers, so the risk is latent rather than active, but the branch is a code smell: the DI seam should not alter timestamp semantics. Fix by always using `Date.now()` and only branching on `pathDeps.join` for the path composition itself.\n  *Suggested fix:* Separate the timestamp from the path-join injection so `Date.now()` is always used.\n\n#### [`src/utils/logger.ts`](https://github.com/getsentry/XcodeBuildMCP/blob/db7e055c39d4e2c23cbd030f14ac8bc8329f61d8/src/utils/logger.ts)\n\n- `523-8RW` **Log file receives all messages regardless of configured log level** ([L268-L274](https://github.com/getsentry/XcodeBuildMCP/blob/db7e055c39d4e2c23cbd030f14ac8bc8329f61d8/src/utils/logger.ts#L268-L274)) · low\n  The file write guard (`clientLogLevel !== 'none'`) does not apply the severity threshold, so debug messages are written to the log file even when `clientLogLevel` is set to `error`, unlike stderr which correctly gates on `shouldLog(level)`.\n  *Suggested fix:* Replace the weaker file-write guard with the same `shouldLog` call used for stderr output.\n\n---\n*Generated by [Warden](https://github.com/getsentry/warden)*","author":{"url":"https://github.com/github-actions[bot]","@type":"Person","name":"github-actions[bot]"},"datePublished":"2026-06-01T07:50:41.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/436/XcodeBuildMCP/issues/436"}