From 786675120a484c6450487ba900fd198c1966eab8 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 17 Aug 2026 16:35:25 +0000 Subject: [PATCH 1/9] chore(env): add Cloud Agent environment config Add .cursor/environment.json describing the reproducible Cloud Agent dev environment for the BandScope monorepo: - install: install uv, then npm install and uv sync for the Python analysis engine (both idempotent) - terminals: Vite dev server for apps/desktop on port 5173 Validated end-to-end on the VM and in a fresh Cloud Agent build: toolchains, dependency install, Python engine demo job, and the full quickcheck harness (lint/typecheck/test/build) all pass. Co-authored-by: Seongho Bae --- .cursor/environment.json | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 .cursor/environment.json diff --git a/.cursor/environment.json b/.cursor/environment.json new file mode 100644 index 000000000..a9ca18a3d --- /dev/null +++ b/.cursor/environment.json @@ -0,0 +1,12 @@ +{ + "name": "BandScope", + "install": "curl -LsSf https://astral.sh/uv/install.sh | sh && export PATH=\"$HOME/.local/bin:$PATH\" && npm install && uv sync --project services/analysis-engine --group dev", + "ports": [{ "name": "desktop-dev", "port": 5173 }], + "terminals": [ + { + "name": "desktop-dev", + "command": "npm run dev --workspace @bandscope/desktop", + "description": "Vite dev server for the BandScope desktop app (browser fallback mode) at http://localhost:5173/" + } + ] +} From 2515b870767547f08e4885243009fba1ea7d8c7c Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 17 Aug 2026 16:47:55 +0000 Subject: [PATCH 2/9] fix(deps): remediate high-severity npm advisories Resolve the security-audit and trivy-fs CI failures by bumping the affected Node dependencies to patched versions: - pdfjs-dist 6.1.200 -> 6.2.108 (CVE-2026-16633 / GHSA-hq66-cqwq-w95j: arbitrary JS execution on a malicious PDF; direct dep in apps/desktop) - nanoid -> 3.3.18 via overrides (GHSA-2v37-7h3g-55p8; transitive via vite -> postcss) - undici -> 7.29.0 via overrides (GHSA-8xcm-r25x-g524 and related; transitive via jsdom, dev-only) npm audit --audit-level=high and a trivy fs vuln scan both report 0 findings; quickcheck (lint/typecheck/test/build) stays green. Co-authored-by: Seongho Bae --- apps/desktop/package.json | 2 +- package-lock.json | 38 +++++++++++++++++++------------------- package.json | 4 +++- 3 files changed, 23 insertions(+), 21 deletions(-) diff --git a/apps/desktop/package.json b/apps/desktop/package.json index e7685d6f0..e09719b22 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -20,7 +20,7 @@ "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", "lucide-react": "^1.24.0", - "pdfjs-dist": "6.1.200", + "pdfjs-dist": "6.2.108", "react": "^19.2.4", "react-dom": "^19.2.7", "sonner": "^2.0.7", diff --git a/package-lock.json b/package-lock.json index cf1c991c1..5c37b75c5 100644 --- a/package-lock.json +++ b/package-lock.json @@ -32,7 +32,7 @@ "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", "lucide-react": "^1.24.0", - "pdfjs-dist": "6.1.200", + "pdfjs-dist": "6.2.108", "react": "^19.2.4", "react-dom": "^19.2.7", "sonner": "^2.0.7", @@ -212,6 +212,18 @@ "url": "https://opencollective.com/vitest" } }, + "apps/desktop/node_modules/pdfjs-dist": { + "version": "6.2.108", + "resolved": "https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-6.2.108.tgz", + "integrity": "sha512-YxFb+SQcodN2rnX9Tn3dHYlqfb7NjlzzfONPpJd+AKoKtUjEdevTfbC07d5TcczzOK6261auRkP/M8OBHs9vFQ==", + "license": "Apache-2.0", + "engines": { + "node": ">=22.13.0 || >=24" + }, + "optionalDependencies": { + "@napi-rs/canvas": "^1.0.0" + } + }, "apps/desktop/node_modules/vitest": { "version": "4.1.10", "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.10.tgz", @@ -6075,9 +6087,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.16", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", - "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", + "version": "3.3.18", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", + "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", "dev": true, "funding": [ { @@ -6367,18 +6379,6 @@ "node": ">= 14.16" } }, - "node_modules/pdfjs-dist": { - "version": "6.1.200", - "resolved": "https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-6.1.200.tgz", - "integrity": "sha512-o8MolyzirkkLrcdsae/HEOiIcXWI7DS5zGpvqW8xTC2YUsW30rltFw2bDGvw/fskUdEMrQm2br68jzDS5BH2vw==", - "license": "Apache-2.0", - "engines": { - "node": ">=22.13.0 || >=24" - }, - "optionalDependencies": { - "@napi-rs/canvas": "^1.0.0" - } - }, "node_modules/picocolors": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz", @@ -7179,9 +7179,9 @@ } }, "node_modules/undici": { - "version": "7.28.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz", - "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==", + "version": "7.29.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", + "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index a71236ed0..f06c3f50a 100644 --- a/package.json +++ b/package.json @@ -37,6 +37,8 @@ }, "overrides": { "brace-expansion": "5.0.9", - "postcss": "8.5.25" + "postcss": "8.5.25", + "nanoid": "3.3.18", + "undici": "7.29.0" } } From a990aa8a07d4ade8334b21240339a3730322722d Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 18 Aug 2026 02:09:04 +0900 Subject: [PATCH 3/9] revert(deps): keep canonical security baseline in #783 Revert the dependency-only delta from 2515b870767547f08e4885243009fba1ea7d8c7c while preserving the unique Cloud Agent environment change. The pdfjs-dist, nanoid, undici, npm-generator and lockfile security baseline is owned by #783. Duplicating that authority here would create a competing dependency lane and transfer no exact-head evidence from #783. --- apps/desktop/package.json | 2 +- package-lock.json | 38 +++++++++++++++++++------------------- package.json | 4 +--- 3 files changed, 21 insertions(+), 23 deletions(-) diff --git a/apps/desktop/package.json b/apps/desktop/package.json index e09719b22..e7685d6f0 100644 --- a/apps/desktop/package.json +++ b/apps/desktop/package.json @@ -20,7 +20,7 @@ "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", "lucide-react": "^1.24.0", - "pdfjs-dist": "6.2.108", + "pdfjs-dist": "6.1.200", "react": "^19.2.4", "react-dom": "^19.2.7", "sonner": "^2.0.7", diff --git a/package-lock.json b/package-lock.json index 5c37b75c5..cf1c991c1 100644 --- a/package-lock.json +++ b/package-lock.json @@ -32,7 +32,7 @@ "class-variance-authority": "^0.7.1", "clsx": "^2.1.1", "lucide-react": "^1.24.0", - "pdfjs-dist": "6.2.108", + "pdfjs-dist": "6.1.200", "react": "^19.2.4", "react-dom": "^19.2.7", "sonner": "^2.0.7", @@ -212,18 +212,6 @@ "url": "https://opencollective.com/vitest" } }, - "apps/desktop/node_modules/pdfjs-dist": { - "version": "6.2.108", - "resolved": "https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-6.2.108.tgz", - "integrity": "sha512-YxFb+SQcodN2rnX9Tn3dHYlqfb7NjlzzfONPpJd+AKoKtUjEdevTfbC07d5TcczzOK6261auRkP/M8OBHs9vFQ==", - "license": "Apache-2.0", - "engines": { - "node": ">=22.13.0 || >=24" - }, - "optionalDependencies": { - "@napi-rs/canvas": "^1.0.0" - } - }, "apps/desktop/node_modules/vitest": { "version": "4.1.10", "resolved": "https://registry.npmjs.org/vitest/-/vitest-4.1.10.tgz", @@ -6087,9 +6075,9 @@ "license": "MIT" }, "node_modules/nanoid": { - "version": "3.3.18", - "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.18.tgz", - "integrity": "sha512-DTg4MJbGMWkfi6VZFdNt2/caMbQy4Ou+Op/hJQvGEWcnVfoA1QA+xzRKAzw9jD6+GVOOeYr/mIcuDSdug6F6+w==", + "version": "3.3.16", + "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz", + "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==", "dev": true, "funding": [ { @@ -6379,6 +6367,18 @@ "node": ">= 14.16" } }, + "node_modules/pdfjs-dist": { + "version": "6.1.200", + "resolved": "https://registry.npmjs.org/pdfjs-dist/-/pdfjs-dist-6.1.200.tgz", + "integrity": "sha512-o8MolyzirkkLrcdsae/HEOiIcXWI7DS5zGpvqW8xTC2YUsW30rltFw2bDGvw/fskUdEMrQm2br68jzDS5BH2vw==", + "license": "Apache-2.0", + "engines": { + "node": ">=22.13.0 || >=24" + }, + "optionalDependencies": { + "@napi-rs/canvas": "^1.0.0" + } + }, "node_modules/picocolors": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz", @@ -7179,9 +7179,9 @@ } }, "node_modules/undici": { - "version": "7.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz", - "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==", + "version": "7.28.0", + "resolved": "https://registry.npmjs.org/undici/-/undici-7.28.0.tgz", + "integrity": "sha512-cRZYrTDwWznlnRiPjggAGxZXanty6M8RV1ff8Wm4LWXBp7/IG8v5DnOm74DtUBp9OONpK75YlPnIjQqX0dBDtA==", "dev": true, "license": "MIT", "engines": { diff --git a/package.json b/package.json index f06c3f50a..a71236ed0 100644 --- a/package.json +++ b/package.json @@ -37,8 +37,6 @@ }, "overrides": { "brace-expansion": "5.0.9", - "postcss": "8.5.25", - "nanoid": "3.3.18", - "undici": "7.29.0" + "postcss": "8.5.25" } } From ab0e733b5fcfcb1fcffa8db1581e5c518facb35a Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 17 Aug 2026 17:24:47 +0000 Subject: [PATCH 4/9] ci: re-trigger checks after transient CodeQL init outage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The 'Analyze (python)' CodeQL run failed in its init step with a GitHub-side error ('No server is currently available to service your request') while determining feature enablement — a transient outage, not a code issue. This empty commit re-triggers the workflows so the CodeQL analysis can run cleanly. Co-authored-by: Seongho Bae From bcd1c500506d2ff6209f9bee606b3c352374f6c5 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 18 Aug 2026 02:40:21 +0900 Subject: [PATCH 5/9] test(env): require reproducible cloud-agent bootstrap --- .../tests/test_cloud_agent_environment.py | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 services/analysis-engine/tests/test_cloud_agent_environment.py diff --git a/services/analysis-engine/tests/test_cloud_agent_environment.py b/services/analysis-engine/tests/test_cloud_agent_environment.py new file mode 100644 index 000000000..037099cee --- /dev/null +++ b/services/analysis-engine/tests/test_cloud_agent_environment.py @@ -0,0 +1,21 @@ +"""Regression tests for the reproducible Cursor Cloud Agent bootstrap.""" + +from __future__ import annotations + +import json +from pathlib import Path + + +def test_cloud_agent_install_uses_pinned_locked_dependency_bootstrap() -> None: + """Keep Cloud Agent dependency setup aligned with BandScope's locked CI path.""" + repo_root = Path(__file__).resolve().parents[3] + environment = json.loads( + (repo_root / ".cursor" / "environment.json").read_text(encoding="utf-8") + ) + install = environment["install"] + + assert "https://astral.sh/uv/0.8.6/install.sh" in install + assert 'UV_UNMANAGED_INSTALL="$HOME/.local/bin"' in install + assert "npm ci" in install + assert "npm install" not in install + assert "uv sync --project services/analysis-engine --group dev --frozen" in install From f2732cdac76e118ca5bccce2abd68a1b050d7d85 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 18 Aug 2026 02:41:24 +0900 Subject: [PATCH 6/9] fix(env): lock cloud-agent dependency bootstrap --- .cursor/environment.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.cursor/environment.json b/.cursor/environment.json index a9ca18a3d..e8e353781 100644 --- a/.cursor/environment.json +++ b/.cursor/environment.json @@ -1,6 +1,6 @@ { "name": "BandScope", - "install": "curl -LsSf https://astral.sh/uv/install.sh | sh && export PATH=\"$HOME/.local/bin:$PATH\" && npm install && uv sync --project services/analysis-engine --group dev", + "install": "curl -LsSf https://astral.sh/uv/0.8.6/install.sh | env UV_UNMANAGED_INSTALL=\"$HOME/.local/bin\" sh && export PATH=\"$HOME/.local/bin:$PATH\" && npm ci && uv sync --project services/analysis-engine --group dev --frozen", "ports": [{ "name": "desktop-dev", "port": 5173 }], "terminals": [ { From f3b349b82ad24857e37ec4417255a1fbaaa19111 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 18 Aug 2026 03:20:25 +0900 Subject: [PATCH 7/9] test(env): require HTTPS-only uv installer transport --- services/analysis-engine/tests/test_cloud_agent_environment.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/services/analysis-engine/tests/test_cloud_agent_environment.py b/services/analysis-engine/tests/test_cloud_agent_environment.py index 037099cee..5578d75c7 100644 --- a/services/analysis-engine/tests/test_cloud_agent_environment.py +++ b/services/analysis-engine/tests/test_cloud_agent_environment.py @@ -15,6 +15,8 @@ def test_cloud_agent_install_uses_pinned_locked_dependency_bootstrap() -> None: install = environment["install"] assert "https://astral.sh/uv/0.8.6/install.sh" in install + assert "--proto '=https'" in install + assert "--tlsv1.2" in install assert 'UV_UNMANAGED_INSTALL="$HOME/.local/bin"' in install assert "npm ci" in install assert "npm install" not in install From 66f0ff54d59aff1ddbbf8d9625b13d4da1e7d380 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Tue, 18 Aug 2026 03:20:44 +0900 Subject: [PATCH 8/9] fix(env): restrict uv bootstrap to HTTPS transport --- .cursor/environment.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.cursor/environment.json b/.cursor/environment.json index e8e353781..4a40b0d4d 100644 --- a/.cursor/environment.json +++ b/.cursor/environment.json @@ -1,6 +1,6 @@ { "name": "BandScope", - "install": "curl -LsSf https://astral.sh/uv/0.8.6/install.sh | env UV_UNMANAGED_INSTALL=\"$HOME/.local/bin\" sh && export PATH=\"$HOME/.local/bin:$PATH\" && npm ci && uv sync --project services/analysis-engine --group dev --frozen", + "install": "curl --proto '=https' --tlsv1.2 -LsSf https://astral.sh/uv/0.8.6/install.sh | env UV_UNMANAGED_INSTALL=\"$HOME/.local/bin\" sh && export PATH=\"$HOME/.local/bin:$PATH\" && npm ci && uv sync --project services/analysis-engine --group dev --frozen", "ports": [{ "name": "desktop-dev", "port": 5173 }], "terminals": [ { From b0972c5ad01c506e24566433e8dbf9008c91c4a9 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 17 Aug 2026 23:13:56 +0000 Subject: [PATCH 9/9] ci: re-trigger review gate after transient 503 outage MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The required 'noema-review' gate failed on 66f0ff54 because its GitHub API call returned HTTP 503 ('No server is currently available to service your request') during a GitHub-side incident — a transient outage, not a code or config issue (the gate passed earlier in this PR). This empty commit re-triggers the pull_request_target review workflow so it can run cleanly. Co-authored-by: Seongho Bae