PR #427 #1414
cursor[bot]codeql
on: dynamic
Matrix: analyze
Annotations
1 error and 2 warnings
|
Unit test spawns real `python3` process without injection:
src/benchmarks/claude-ui/__tests__/claude-ui-benchmark.test.ts#L22
The `runParserScript` helper spawns a real `python3` process via `node:child_process` directly, bypassing the safety setup's executor overrides; this test calls an actual external binary in the unit test run.
|
|
Tests use real OS filesystem because log-writer is not injected into `dismissFirstRunPrompts`:
src/benchmarks/claude-ui/__tests__/first-run-preflight.test.ts#L24
These tests create real temp directories and read actual files from disk to verify log output; the filesystem dependency should be injected (as `logWriter`) so tests can stay fully in-memory, consistent with the pattern used in `prepareTemporarySimulator`.
|
|
Log write failure in `close` handler rejects the command promise with the wrong error:
src/benchmarks/claude-ui/simulator-lifecycle.ts#L192
If `appendLifecycleLog` rejects in the `close` handler (e.g. disk full, permission error), `.catch(reject)` propagates the log error instead of resolving with the command result, making a healthy `simctl create` or `simctl boot` appear to fail — orphaning the simulator it already created.
|