fix: CodeQL batch — secure temps, unbiased IDs, loopback inspect URLs

Use mkdtemp for doctor/config/reload/tower fixtures. Unbiased task-id
alphabet sampling. Strict Vertex host parse. Cache-dir originals with
O_EXCL write. Config domain allowlist. Inspect joinApiUrl + loopback-only
base/WS. CodeQL paths-ignore for committed dist-web vendor bundles.

Author: elkaix

.github/workflows/codeql.yml

@@ -26,6 +26,11 @@ jobs:
           build-mode: none
           languages: javascript-typescript
           queries: security-extended
+          config: |
+            paths-ignore:
+              - apps/pythinker-code/dist-web/**
+              - '**/dist-web/**'
+              - '**/*.min.js'
       - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
         with:
           category: /language:javascript-typescript

apps/pythinker-code/scripts/native/exec.mjs

@@ -6,15 +6,16 @@ import { appRoot } from './paths.mjs';
 
 const execFileAsync = promisify(execFile);
 
-export function commandForExecFile(command, args, platform = process.platform, env = process.env) {
+export function commandForExecFile(command, args, platform = process.platform, _env = process.env) {
   if (platform !== 'win32' || !/\.(?:bat|cmd)$/i.test(command)) {
     return { command, args };
   }
+  // Fixed shell binary — never take ComSpec from the environment (CodeQL).
   const shellCommand = [command, ...args]
     .map((arg) => `"${String(arg).replaceAll('"', '""')}"`)
     .join(' ');
   return {
-    command: env.ComSpec ?? 'cmd.exe',
+    command: 'cmd.exe',
     args: ['/d', '/s', '/c', `"${shellCommand}"`],
     options: { windowsVerbatimArguments: true },
   };

apps/pythinker-code/src/tui/utils/image-placeholder.ts

@@ -41,7 +41,6 @@
 
 import { createHash, randomUUID } from 'node:crypto';
 import { copyFileSync, mkdirSync, readdirSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
-import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
 import type { PromptPart, Session } from '@pymodel/pythinker-code-sdk';
@@ -664,15 +663,19 @@ export function persistOriginalImageSync(
     const hash = createHash('sha256').update(bytes).digest('hex').slice(0, 32);
     const target = join(targetDir, `${hash}.${imageExtensionForMime(mime)}`);
     mkdirSync(targetDir, { recursive: true });
-    const existing = statSync(target, { throwIfNoEntry: false });
-    // Content-addressed: an existing entry with the right size IS this image.
-    if (existing === undefined || existing.size !== bytes.length) {
-      writeFileSync(target, bytes);
+    try {
+      writeFileSync(target, bytes, { flag: 'wx' });
+    } catch (error) {
+      const code = error instanceof Error && 'code' in error ? (error as NodeJS.ErrnoException).code : undefined;
+      if (code !== 'EEXIST') throw error;
     }
     sweepCacheSync(targetDir, maxTotalBytes);
-    // The just-written file may itself have been evicted by the sweep when a
-    // single original exceeds the cap; report persistence honestly.
-    return statSync(target, { throwIfNoEntry: false }) === undefined ? null : target;
+    try {
+      const existing = statSync(target);
+      return existing.isFile() && existing.size === bytes.length ? target : null;
+    } catch {
+      return null;
+    }
   } catch {
     return null;
   }
@@ -706,7 +709,7 @@ function sweepCacheSync(dir: string, maxTotalBytes: number): void {
 
 /** Mirrors agent-core-v2's `originalImageCacheDir` (not re-exported through the SDK). */
 function originalImageTempDir(): string {
-  return join(tmpdir(), 'pythinker-code-original-images');
+  return join(getCacheDir(), 'original-images');
 }
 
 /**

apps/pythinker-code/src/utils/clipboard/clipboard-image.ts

@@ -172,14 +172,6 @@ function splitClipboardPathLines(text: string): string[] {
 }
 
 function readImagePath(path: string): ClipboardImage | null {
-  let stat: ReturnType<typeof statSync>;
-  try {
-    stat = statSync(path);
-  } catch {
-    return null;
-  }
-  if (!stat.isFile()) return null;
-
   let bytes: Buffer;
   try {
     bytes = readFileSync(path);

apps/pythinker-code/test/cli/doctor.test.ts

@@ -1,4 +1,4 @@
-import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 
@@ -14,8 +14,7 @@ import {
 let dir: string;
 
 beforeEach(async () => {
-  dir = join(tmpdir(), `pythinker-doctor-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  await mkdir(dir, { recursive: true });
+  dir = await mkdtemp(join(tmpdir(), 'pythinker-doctor-'));
 });
 
 afterEach(async () => {

apps/pythinker-code/test/cli/login.test.ts

@@ -117,7 +117,7 @@ describe('pythinker login', () => {
 
     const writtenChunks = stderrSpy.mock.calls.map((call: unknown[]) => String(call[0]));
     expect(writtenChunks.some((chunk: string) => chunk.includes('ABCD-EFGH'))).toBe(true);
-    expect(writtenChunks.some((chunk: string) => chunk.includes('https://example.com/v'))).toBe(
+    expect(writtenChunks.some((chunk: string) => chunk.includes('https://example.com/v?code=ABCD-EFGH') || /https:\/\/example\.com\/v(?:\s|$)/.test(chunk))).toBe(
       true,
     );
     expect(openUrl).toHaveBeenCalledWith('https://example.com/v?code=ABCD-EFGH');
@@ -157,7 +157,7 @@ describe('pythinker login', () => {
 
     const writtenChunks = stderrSpy.mock.calls.map((call: unknown[]) => String(call[0]));
     expect(writtenChunks.some((chunk: string) => chunk.includes('ABCD-EFGH'))).toBe(true);
-    expect(writtenChunks.some((chunk: string) => chunk.includes('https://example.com/v'))).toBe(
+    expect(writtenChunks.some((chunk: string) => chunk.includes('https://example.com/v?code=ABCD-EFGH') || /https:\/\/example\.com\/v(?:\s|$)/.test(chunk))).toBe(
       true,
     );
     expect(openUrl).toHaveBeenCalledWith('https://example.com/v?code=ABCD-EFGH');

apps/pythinker-code/test/tui/commands/reload.test.ts

@@ -1,4 +1,4 @@
-import { mkdir, rm, writeFile } from 'node:fs/promises';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
@@ -195,9 +195,8 @@ auto_install = false
 });
 
 async function writeTuiConfig(text: string): Promise<void> {
-  const dir = join(tmpdir(), `pythinker-tui-reload-${Date.now()}-${Math.random().toString(36).slice(2)}`);
+  const dir = await mkdtemp(join(tmpdir(), 'pythinker-tui-reload-'));
   tempDirs.push(dir);
-  await mkdir(dir, { recursive: true });
   process.env['PYTHINKER_CODE_HOME'] = dir;
   await writeFile(join(dir, 'tui.toml'), text, 'utf-8');
 }

apps/pythinker-code/test/tui/config.test.ts

@@ -1,4 +1,4 @@
-import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 
@@ -17,8 +17,7 @@ let dir: string;
 let filePath: string;
 
 beforeEach(() => {
-  dir = join(tmpdir(), `pythinker-tui-config-${Date.now()}-${Math.random().toString(36).slice(2)}`);
-  mkdirSync(dir, { recursive: true });
+  dir = mkdtempSync(join(tmpdir(), 'pythinker-tui-config-'));
   filePath = join(dir, 'tui.toml');
 });
 

apps/pythinker-inspect/src/activity/store.ts

@@ -16,6 +16,7 @@
 
 import type { WsLikeCtor } from '../channel/wsLike';
 import { GlobalEventsWs, type SessionWorkFacts } from './ws';
+import { joinApiUrl } from '../httpUrl';
 
 export type { SessionWorkFacts };
 
@@ -126,7 +127,7 @@ export class SessionActivityHub {
       headers['authorization'] = `Bearer ${this.token}`;
     }
     try {
-      const res = await this.fetchImpl(`${this.baseUrl}/api/v1/sessions`, { headers });
+      const res = await this.fetchImpl(joinApiUrl(this.baseUrl, '/api/v1/sessions'), { headers });
       const envelope = (await res.json()) as {
         code: number;
         data?: { items?: Record<string, unknown>[] };

apps/pythinker-inspect/src/activity/ws.ts

@@ -299,6 +299,10 @@ function toWsUrl(base: string): string {
   if (url.protocol !== 'ws:' && url.protocol !== 'wss:') {
     throw new Error(`unsupported URL scheme for WS transport: ${base}`);
   }
+  const host = url.hostname.replaceAll(/^\[|\]$/g, '').toLowerCase();
+  if (host !== 'localhost' && host !== '127.0.0.1' && host !== '::1') {
+    throw new Error(`WS transport must target loopback: ${base}`);
+  }
   if (!url.pathname.endsWith('/api/v1/ws')) {
     url.pathname = `${url.pathname.replace(/\/$/, '')}/api/v1/ws`;
   }