PR #420 #1282
cameroncookecodeql
on: dynamic
Matrix: analyze
Annotations
9 warnings
|
Analyze (actions)
Cannot retrieve the full diff because there are too many (300) changed files in the pull request.
|
|
Analyze (python)
Cannot retrieve the full diff because there are too many (300) changed files in the pull request.
|
|
Analyze (javascript-typescript)
Cannot retrieve the full diff because there are too many (300) changed files in the pull request.
|
|
JSON fixture retains volatile SDK_STAT_CACHE_PATH value not normalized by code:
src/snapshot-tests/__tests__/json-normalize.test.ts#L148
The test at lines 148–173 correctly establishes that `SDK_STAT_CACHE_PATH` normalizes to `<SDK_STAT_CACHE_PATH>`, but `src/snapshot-tests/__fixtures__/mcp/json/project-discovery/show-build-settings--success.json` still holds the volatile hash-embedded path at line 1834 — the fixture must be regenerated via the snapshot update flow to stay aligned.
|
|
Type narrowing lost on `textItem` causes TypeScript error on `.text` access:
src/utils/responses/next-steps-renderer.ts#L38
The loop sets `textItemIndex` when `type === 'text'`, but the subsequent `processedContent[textItemIndex]` retrieval is typed as `ToolResponseContent` (the full union). Because the image union member has `[key: string]: unknown`, TypeScript resolves `textItem.text` as `string | unknown = unknown`, making `textItem.text + '\n\n' + nextStepsSection` a compile error under `strict: true`; add a `textItem.type === 'text'` guard before the concatenation.
|
|
Breaking API contract change: schemaVersion bump from '1' to '2' has no migration path for existing consumers:
src/mcp/tools/debugging/debug_stack.ts#L54
Bumping `schemaVersion` to `'2'` is a breaking change — any external consumer that parses this structured output and validates against `schemaVersion: '1'` will silently receive unexpected data or fail validation. There is no backward-compatibility layer in the runtime for v1 consumers, so this warrants a senior engineer sign-off and ideally a documented migration guide or a transition period emitting both versions.
|
|
[NZC-UVC] Breaking API contract change: schemaVersion bump from '1' to '2' has no migration path for existing consumers (additional location):
src/mcp/tools/ui-automation/shared/domain-result.ts#L157
Bumping `schemaVersion` to `'2'` is a breaking change — any external consumer that parses this structured output and validates against `schemaVersion: '1'` will silently receive unexpected data or fail validation. There is no backward-compatibility layer in the runtime for v1 consumers, so this warrants a senior engineer sign-off and ideally a documented migration guide or a transition period emitting both versions.
|
|
persist:true test writes to config.yaml without cleanup, leaking state into subsequent test runs:
src/snapshot-tests/suites/session-management-suite.ts#L141
The new test calls `use-defaults-profile` with `persist: true`, which writes `activeSessionDefaultsProfile: MyCustomProfile` to `.xcodebuildmcp/config.yaml` on disk. The `beforeEach` only calls `clear-defaults { all: true }`, which resets in-memory state but never touches config.yaml, so every CLI subprocess spawned by later tests will start with the stale persisted profile. Add an `afterEach` (or an extra `use-defaults-profile { global: true, persist: true }` call at the end of the test body) to restore the persisted profile to the global default.
|
|
textItem.text is typed as unknown on ToolResponseContent union, causing a TypeScript compile error:
src/utils/responses/next-steps-renderer.ts#L39
Because `ToolResponseContent` is a union with `[key: string]: unknown` on both variants, `textItem.text` resolves to `string | unknown = unknown`, so the `+` concatenation on line 42 is a TypeScript strict-mode error; replace the `if (textItemIndex >= 0)` access with a discriminant check (`if (textItem?.type === 'text')`) to properly narrow the type.
|