Skip to content

Code Quality: PR #427 #1406

Code Quality: PR #427

Code Quality: PR #427 #1406

Triggered via dynamic May 23, 2026 20:04
Status Success
Total duration 1m 33s
Artifacts

codeql

on: dynamic
Matrix: analyze
Fit to window
Zoom out
Zoom in

Annotations

5 warnings
Real filesystem I/O in first-run preflight tests due to missing logWriter injection in dismissFirstRunPrompts: src/benchmarks/claude-ui/__tests__/first-run-preflight.test.ts#L25
The tests must write and read real temp files because `dismissFirstRunPrompts` calls `appendFile` directly with no injectable `logWriter` — add a `logWriter?` parameter to `first-run-preflight.ts` matching the pattern in `simulator-lifecycle.ts`, then replace `tempLogPath()` + `readFile` with an in-memory log writer.
Unhandled EPIPE on child.stdin can crash the process: src/benchmarks/claude-ui/harness.ts#L240
The `child.stdin` stream has no `'error'` listener; if the spawned process closes its stdin end early (e.g. a crash or unexpected exit), Node.js emits an unhandled EPIPE error event on the writable stream, which terminates the process instead of rejecting the promise.
First-run prompt preflight exits immediately if any UI elements are visible before the prompt appears: src/benchmarks/claude-ui/first-run-preflight.ts#L187
On the very first poll iteration, if `describe-ui` returns elements but none of the target labels are present (e.g. the app loaded its home screen before the first-run prompt appeared), `uiSeen` is set and then immediately checked on the same iteration, causing the loop to break with `promptsDismissed = true` without ever dismissing anything — silently skipping the preflight.
`child.stdin` error event is unhandled in `runCommand`, risking uncaught exception: src/benchmarks/claude-ui/harness.ts#L209
In `runCommand`, `child.on('error', reject)` only handles process-level errors; `child.stdin` has no error listener. If the child exits (or closes its side of the pipe) before `child.stdin.end(opts.stdin)` finishes flushing, Node.js emits an `'error'` event on the writable stdin stream. With no listener, this propagates as an uncaught exception and can crash the harness process. Add `child.stdin.on('error', () => {})` to suppress EPIPE silently, since a stdin write failure is non-fatal once the child has already errored.
[5TK-E5C] `child.stdin` error event is unhandled in `runCommand`, risking uncaught exception (additional location): src/benchmarks/claude-ui/harness.ts#L229
In `runCommand`, `child.on('error', reject)` only handles process-level errors; `child.stdin` has no error listener. If the child exits (or closes its side of the pipe) before `child.stdin.end(opts.stdin)` finishes flushing, Node.js emits an `'error'` event on the writable stdin stream. With no listener, this propagates as an uncaught exception and can crash the harness process. Add `child.stdin.on('error', () => {})` to suppress EPIPE silently, since a stdin write failure is non-fatal once the child has already errored.