chore(security): track remaining CodeQL findings

[cv]

Summary

Successor tracker to #3654 for the CodeQL findings that remain open on main. Use this issue to prioritize production risk first, record fixes or explicit dismissal rationale, and reconcile the inventory after each cleanup merge.

This is a maintainer prioritization tracker. Keep exploit or reproducer details out of the public issue; individual code-scanning alerts require repository access.

Source

• Follow-up commitment: chore(security): triage code scanning backlog by risk/reward #3654 (comment)
• Previous tracker: chore(security): triage code scanning backlog by risk/reward #3654
• July 4 baseline: 96 open CodeQL alerts at 3f89cd0
• Prior cleanup baseline: fix(security): harden P0 code scanning boundaries #4878, fix(security): close P1 code scanning findings #4880, fix(security): clean P2 tooling scan findings #4884, and refactor(security): extract curl probe policy #4885

Current snapshot — July 9, 2026 UTC

• main at 2b2c9f6
• Latest completed Security / Code Scanning run 28996569204: success; JavaScript/TypeScript CodeQL, Python CodeQL, and ShellCheck SARIF all passed
• Authenticated code-scanning API inventory: 116 open CodeQL alerts
• Separate inventory: 3 open ShellCheck alerts, intentionally out of scope for this CodeQL tracker

Counts are a point-in-time snapshot, not a fixed cap. Add or link newly introduced CodeQL findings when they are in scope.

What changed since the July 4 baseline

• CodeQL moved from 96 to 116 open alerts. At the alert-ID level, 25 IDs entered the current inventory and 5 baseline IDs closed. One pair is a renumbering (1086 → 1295) of the same unused variable, leaving 24 genuinely new underlying findings and 4 genuinely resolved findings.
• No baseline alert was dismissed. Two transient post-baseline alerts (1210 from feat(agents): add progressive tool disclosure #6251 and 1354 from feat(ci): add deterministic PR risk plans #6446) were dismissed with explicit rationale; neither is part of the baseline-to-current open-count delta.
• The 56 security-severity findings are unchanged: the production transition-lock race plus 55 test, tooling, and docs-source security-pattern findings remain open.
• Static/correctness inventory grew from 40 to 60. The net rule deltas are:
  • js/unused-local-variable: 21 → 32 (net +11, including the 1086 → 1295 renumbering)
  • js/template-syntax-in-string-literal: 2 → 6
  • js/trivial-conditional: 3 → 4
  • py/catch-base-exception: 0 → 3
  • py/uninitialized-local-variable: 0 → 2
  • js/useless-assignment-to-local: 1 → 0
• Baseline resolutions: perf(test): reduce sandbox lifecycle subprocess isolation #6280 fixed 1143; refactor(e2e): centralize live-test gating and repository paths #6358 fixed 964 and 1146; perf(test): retire rebuild CommonJS loader seams #6388 fixed 1160. refactor(e2e): add a typed target evidence API #6359 closed 1086, but the same finding reopened as 1295.
• ci(codeql): repair and guard action version sync #6526 repaired and guarded the mixed CodeQL Action versions; the current main scan is healthy again.

Current CodeQL inventory

Rule	Count	Security / diagnostic severity	Primary scope	Alert IDs
js/file-system-race	50	high / warning	49 test-path findings plus src/lib/shields/transition-lock.ts	205, 1094–1142
js/unused-local-variable	32	— / note	8 CLI source findings plus 24 test/live-E2E findings	812–815, 822, 831, 934, 949–950, 1063, 1144–1145, 1174–1175, 1177–1178, 1182, 1214, 1295–1296, 1298–1306, 1345–1346, 1358
py/unsafe-cyclic-import	9	— / error	type-only import graph in docs/_ext/json_output/core/*	107–115
js/template-syntax-in-string-literal	6	— / warning	messaging and live-E2E tests	948, 1189, 1196–1199
js/trivial-conditional	4	— / warning	blueprint sandbox safety-net helper plus lifecycle test	308–310, 1286
js/bad-code-sanitization	3	medium / error	boundary and messaging E2E tests	947, 1092–1093
py/catch-base-exception	3	— / note	intentional cancellation/base-exception observability test fixture	1318–1319, 1328
py/uninitialized-local-variable	2	— / error	Hermes runtime config guard	1218–1219
js/duplicate-property	1	— / warning	plugin migration-state test	312
js/file-access-to-http	1	medium / warning	advisor tooling	596
js/shell-command-injection-from-environment	1	medium / warning	live-E2E gateway-auth helper	1083
js/tainted-format-string	1	high / warning	checked-in docs search source asset, bundled at build	154
py/empty-except	1	— / note	Hermes runtime config guard	1066
py/unreachable-statement	1	— / warning	OpenClaw config guard	1065
py/unused-global-variable	1	— / note	Hermes runtime config guard	1067
Total	116

Prioritized work

Priority	Bucket	Count	Next action
P0	Production runtime boundary	1	Disposition js/file-system-race in src/lib/shields/transition-lock.ts. The implementation already uses no-follow descriptor open plus inode verification and has focused replacement-race coverage; confirm that mitigation, then refactor if needed or dismiss narrowly with rationale and regression evidence.
P1	Production runtime-guard initialization	2	Validate Hermes py/uninitialized-local-variable alerts 1218–1219. The transition branches appear to assign the value before both writes; make the proof explicit in code or dismiss with documented control-flow rationale.
P2	Test, tooling, and docs security-pattern findings	55	Reconcile the 49 test-path races and the remaining medium/high patterns. Forty-eight races are adversarial guard-integrity tests; separate them from ordinary dev-shim alert 205, and preserve intentional test behavior.
P3	Remaining correctness and static-quality findings	58	Batch by rule and subsystem. Distinguish intentional type-only imports and exception-propagation fixtures from actionable dead or unused code.

Proposed PR sequence

1. Confirm the existing transition-lock mitigation and close or explicitly dismiss the production race finding.
2. Validate and resolve the Hermes runtime-config-guard initialization diagnostics 1218–1219.
3. Reconcile the 49 test-path race findings, grouping intentional adversarial patterns separately from actionable helper races.
4. Address the remaining security-pattern findings in tests, advisor tooling, and docs search source.
5. Batch correctness/static-quality findings by rule and subsystem, starting with production source and blueprint helpers before test/docs cleanup.
6. After each merge, wait for the next successful main scan and record the rule and count deltas here.

Out of scope

ShellCheck remains a separate inventory. The current open alerts are:

• SC2119: alerts 929 and 952 in scripts/nemoclaw-start.sh and agents/hermes/start.sh
• SC2317: alert 971 in test/e2e/lib/redact-openclaw-gateway-log.sh

Expanding scanner configuration or enabling additional query suites is separate work unless a change is required to validate a fix here.

Definition of done

• Every current CodeQL finding is fixed, dismissed with explicit rationale, or moved to a linked targeted follow-up with an ownerable scope.
• No production security finding or runtime-guard error remains without a documented disposition.
• Security-sensitive production fixes include focused regression coverage.
• Intentional test patterns retain their adversarial behavior; suppressions or dismissals are narrow and justified.
• A successful final main code-scanning run and authenticated API refresh confirm the expected closures and remaining intentional inventory.
• The closing update records the delta from both the 96-alert July 4 baseline and this 116-alert refresh.