Warden weekly sweep

[github-actions]

Warden Scheduled Scan Results

Run: 2026-07-27T07:48:00.382Z
Commit: c79f4eb

Summary

Severity	Count
Medium	8
Low	2

Findings

src/benchmarks/claude-ui/harness.ts

• GV4-H6M Missing timeout on spawned benchmark commands allows indefinite hangs (L219) · medium
  Spawned child processes have no execution timeout, so a hung benchmark will stall the harness forever.
• 525-7A4 Missing error handling on file write streams crashes benchmark on I/O errors (L298-L402) · medium
  runCommand pipes child output to createWriteStream sinks without attaching error listeners. If disk writes fail (e.g., full disk, permission denied, broken pipe), the unhandled stream error event is thrown as an uncaught exception, crashing the benchmark harness.
• Y6J-S8X normalizeStoredResult crashes on non-object JSON values (L487) · medium
  Accessing result.sequence without a null guard throws a TypeError when result.json contains a primitive value like null, instead of a meaningful validation error.
• HND-NCD Empty completion string incorrectly rejected (L500) · medium
  The !result.completion truthiness check rejects empty strings and other falsy values that may be valid completion outputs.

src/benchmarks/claude-ui/run-directory.ts

• 4FQ-ZWE directoryExists does not verify the path is a directory, causing readdir to throw (L16) · medium
  directoryExists uses access without directory validation, so it returns true for files and symlinks to files. When a file path is passed in, readdir throws ENOTDIR and the error propagates out of runDirectory instead of returning an exit code.

src/benchmarks/claude-ui/simulator-lifecycle.ts

• XD3-53M Spawn error handler leaves unhandled promise rejection when log append fails (L282-L284) · medium
  .finally() does not suppress rejections from appendLifecycleLog; if logging fails while handling a spawn error, the resulting promise rejection is unhandled.
• DMC-D77 resolveSimulatorIdFromList does not guard JSON.parse against invalid command output (L153) · low
  Parsing external command output with JSON.parse without error handling causes an unhandled SyntaxError or TypeError on malformed output instead of a meaningful failure message.

src/benchmarks/claude-ui/transcript.ts

• EKK-6XL Unvalidated regex patterns enable local ReDoS during transcript analysis (L145) · medium
  createPatternMatchers compiles externally-provided strings into RegExp without checking for catastrophic backtracking patterns. When these regexes are tested against transcript text in functions like matchesAnyPattern and appendPatternFailures, a maliciously crafted pattern can block the event loop.

src/cli/daemon-control.ts

• LQK-6KS startDaemonBackground leaves spawn errors unhandled (L143-L176) · medium
  Missing 'error' handler on the detached child process means spawn failures emit unhandled 'error' events that can crash the parent process.

scripts/probe-xcode-mcpbridge.ts

• DYY-CDG MCP client close skipped on error paths, missing transport cleanup (L78) · low
  Any thrown error before client.close() causes main() to reject into the .catch() handler, which calls process.exit(1). Because client.close() is not wrapped in a try/finally, the transport never gets to perform its own cleanup (e.g., sending shutdown messages or gracefully terminating the child process).

---

Generated by Warden