[pelikhan]

Summary

• Address CodeQL js/file-system-race alerts 1032 and 1033 in the inventory symlink regression test.
• Open the output once with O_RDONLY | O_NOFOLLOW, then use fstatSync and a single descriptor-based read for all metadata/content assertions.
• Preserve file-type, 0600 permission, JSON, newline, and unchanged symlink-target coverage; close the descriptor in finally.

Validation

• node --test .github/scripts/test_lint_monster_issues.cjs .github/scripts/test_secure_write.cjs — 26 tests pass.
• Pinned Prettier check and git diff --check pass.
• PATH="/opt/homebrew/bin:$PATH" make agent-report-progress passes.

CodeQL alert closure remains subject to the next scan; no alerts or tracking issues were manually dismissed or closed.

[github-actions]

✅ Test Quality Sentinel completed test quality analysis.

Test Quality Sentinel

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Test Quality Sentinel · haiku45 · 18.5 AIC · ⌖ 10.1 AIC · ◇ 2.47 AIC · ⊞ 9.2K · ◷

🧪 Test quality analysis by Test Quality Sentinel

[github-actions]

🔎 PR Code Quality Reviewer is reviewing code quality for this pull request...

[github-actions]

🧠 Matt Pocock Skills Reviewer has completed the skills-based review. ✅

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer

[github-actions]

✅ Ponytail Reviewer completed successfully!

Ponytail Reviewer

Outcome: reported_no_action

The agent completed and reported no action. A no-op output alone does not verify that all required work was completed or that publication was possible.

Agent messages are omitted from this comment. The category uses structured run status, not interpretation of agent prose.

Generated from Ponytail Reviewer · gpt56 · 4.98 AIC · ⌖ 5.33 AIC · ⊞ 14.6K · ◷

Generated by Ponytail Reviewer for #69411

[Copilot]

🟢 Approval recommended

The focused test-only change preserves coverage and reliably closes the descriptor, with no unresolved issues.

0 open findings

What changed in this PR

Hardens gh-aw’s inventory symlink regression test against filesystem races without changing production behavior.

Changes:

• Uses one no-follow file descriptor for metadata and content assertions.
• Preserves regression coverage and closes the descriptor in finally.

No confirmed vulnerabilities found.

File	Description
.github/​scripts/​test_lint_monster_issues.cjs	Replaces repeated path lookups with descriptor-based assertions.

🧠 Review effort: Max

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Skills-Based Review 🧠

Applied /diagnosing-bugs (via pr-triage: bug_fix) — no blocking issues found.

📋 Analysis

Root cause vs. symptom

This correctly fixes the root cause of the CodeQL js/file-system-race TOCTOU alerts rather than suppressing them: all metadata/content checks (fstatSync, content read) now operate on a single already-opened file descriptor instead of re-resolving the path three times (lstatSync → readFileSync → statSync → readFileSync), which is exactly the race window CodeQL flags.

Positive Highlights

• ✅ O_RDONLY | O_NOFOLLOW correctly rejects symlinks at open time, preserving the original isSymbolicLink() === false intent via stat.isFile().
• ✅ fs.closeSync(fd) wrapped in finally avoids fd leaks on assertion failure.
• ✅ All prior coverage preserved (file type, 0600 perms, JSON parse, trailing newline).
• ✅ Scoped to test-only code; verified locally — all 13 tests in the file still pass.
• ✅ CI only runs this script on ubuntu-latest/ubuntu-slim, so O_NOFOLLOW portability isn't a concern here.

Minor (non-blocking) observation

The outside file read (fs.readFileSync(outside, "utf8")) still uses path-based access, but that target is untouched by collectIssues and isn't part of the race being fixed, so leaving it as-is is reasonable.

No actionable changes requested.

🧠 Reviewed using Matt Pocock's skills by Matt Pocock Skills Reviewer · copilot · sonnet50 · 27 AIC · ⌖ 14.8 AIC · ⊞ 10.1K
_{Comment /matt to run again}