Warden: code-review

[github-actions]

Warden Scheduled Scan Results

Run: 2026-09-07T07:15:56.069Z
Commit: e6ef59b

Summary

Severity	Count
Medium	12

Findings

src/benchmarks/claude-ui/harness.ts

• 3PD-BGN Unhandled WriteStream errors cause fatal unhandled exceptions (L298-L299) · medium
  createWriteStream for stdout and stderr has no 'error' event listener. File-system failures (disk full, permission denied) during writes become uncaught exceptions instead of rejecting the command promise.

src/benchmarks/claude-ui/preflight-commands.ts

• 33X-SNX Unbounded stdout/stderr buffering in runShellCommand can exhaust memory (L90-L103) · medium
  runShellCommand accumulates every stdout and stderr chunk in memory without a size limit, so a preflight command that produces large output can OOM before the timeout fires.

src/benchmarks/claude-ui/run-directory.ts

• DWH-XB3 directoryExists returns true for files, causing readdir to throw ENOTDIR (L6-L18) · medium
  directoryExists uses access() which returns true for any existing path, including files. When a file path is passed, suitePaths calls readdir and throws an unhandled ENOTDIR. Consider using stat and checking isDirectory() instead.

src/benchmarks/claude-ui/simulator-frontend.ts

• 6WD-W5R New retry logic module lacks dedicated tests (L1-L90) · medium
  The new simulator-frontend.ts contains retry loops, error-code -1712 detection, and killall cleanup, but has no dedicated test file. Existing integration tests only cover the happy path.

src/cli/commands/daemon.ts

• V7S-VAK Invalid --tail input bypasses default and dumps entire log file (L114) · medium
  The ?? 200 fallback does not catch NaN from invalid yargs input, causing the handleLogs slice to return the whole file instead of the default 200 lines.
• K8B-PLV logs command loads entire log file into memory for tail output (L267) · medium
  readFileSync reads the complete log file synchronously to emit only the tail, which can exhaust memory or block the event loop on large files.

src/cli/commands/init.ts

• T2B-FCT TTY ensureAgentsGuidance call crashes on filesystem errors without graceful handling (L645-L648) · medium
  The interactive (TTY) branch calls ensureAgentsGuidance without any try/catch, so fs.readFileSync / fs.writeFileSync failures produce an unhandled crash after clack.outro('Done.') is already printed. The non-TTY branch wraps the same call and reports the error gracefully in JSON output.

src/cli/commands/purge-interactive-model.ts

• F7D-9PN O(n²) workspace matching triggered by all-keys workspaces scope (L76-L85) · medium
  Passing every workspace key via a workspaces scope to planPurgeStorage triggers an O(n²) lookup in selectedWorkspacesForScope that grows with the number of workspaces.

src/cli/commands/purge-interactive.ts

• 83G-TXA Exit message falsely claims no storage was deleted (L377) · medium
  After items are deleted in nested menus and the user returns to the root, selecting 'cancel' or interrupting a prompt prints 'No storage deleted' even though prior deletions succeeded.

src/cli/daemon-client.ts

• 9NP-TJ3 invokeTool may reject after terminal result is received (L186) · medium
  The socket.on('close') handler rejects the promise when !settled, but settled doesn't become true until a queued microtask runs after receiving the terminal result. If the socket closes before that microtask executes, the client rejects with a spurious transport error even though the result was successfully received.

src/cli/daemon-control.ts

• XYH-3F2 startDaemonBackground unhandled spawn error crashes process (L136-L152) · medium
  spawn failures emit an error event asynchronously with no listener, causing an unhandled exception that the caller's try-catch cannot catch.

General

• 3QH-3SB runPreflightCommands and runShellCommand have no test coverage · medium
  The new file adds subprocess execution, timeout escalation, and process group signalling logic, but none of it is exercised in the test suite.

---

Generated by Warden