Feature updates

[peterjthomson]

Note

Medium Risk
Adds new main-process IPC and gh CLI execution paths plus a persistent macOS tray window, which can affect app stability and security boundaries if misconfigured. Most changes are additive but touch core app refresh/repo switching and new renderer/preload entrypoints.

Overview
Adds GitHub Issues integration end-to-end: new typed Issue models and IPC channels, main-process gh-backed issue operations (list/detail/comments/create/edit/close/reopen/comment/develop-branch), and new UI panels (IssueList, IssueDetailPanel) wired into the canvas system and app refresh flow.

Introduces a macOS menu-bar tray with a Quick Capture popover (separate renderer + preload + IPC handlers) to create issues quickly, optionally auto-capturing/retaking a screenshot, and shows an open-issue count badge via gh.

Includes small UX/refactor tweaks: centralizes repo-switch state reset/open logic in App, allows renaming custom canvas column labels in Settings, and replaces lucide-react Github icon usage with an inline GitHubIcon SVG.

^{Reviewed by Cursor Bugbot for commit 8ef0d50. Bugbot is set up for automated code reviews on this repo. Configure here.}

[peterjthomson]

@claude review

[claude]

Claude finished @peterjthomson's task in 2m 29s —— View job

---

PR Review — Feature Updates (GitHub Issues + Quick Capture Tray)

• Gather context and understand request
• Read core changed files
• Review UI components
• Review IPC wiring, types, schemas, and preload
• Security, stability, and correctness analysis
• Post final review

---

Overall this is a well-structured addition — clean service layer, proper context isolation for the tray window, good use of the conveyor/typed IPC pattern, and solid error handling throughout. A few issues need attention before merging, one of which is a real security bug.

---

🔴 Critical — Shell Injection in createQuickIssue

File: lib/services/quick-capture/quick-capture-service.ts:135

const { stdout } = await execAsync(
  `gh ${args.map((a) => `"${a.replace(/"/g, '\\"')}"`).join(' ')}`,
  { cwd: issue.repoPath }
)

This constructs a shell command string from user-controlled content (issue.description, issue.labels, issue.priority). Escaping only double-quotes leaves shell metacharacters like backticks, $(), !, and newlines exploitable. The rest of the codebase uses safeExec (which passes args as an array, bypassing the shell entirely) — this function is the only outlier.

The repoPath is also passed through from the renderer and used as cwd, not as a shell argument, so that part is fine. But the content args are not safe.

Fix: Replace execAsync with safeExec (already available in the project):

const result = await safeExec('gh', args, { cwd: issue.repoPath })
if (!result.success) throw new Error(result.stderr)
const url = result.stdout.trim()

Fix this →

---

🔴 Security — XSS via dangerouslySetInnerHTML in renderMarkdown

File: app/components/panels/editor/IssueDetailPanel.tsx:85-86

const processed = line.replace(/`([^`]+)`/g, '<code>$1</code>')
elements.push(<p key={i} dangerouslySetInnerHTML={{ __html: processed }} />)

The captured group $1 is inserted directly into HTML without escaping. A code span like `<img src=x onerror=alert(document.cookie)>` in an issue body would execute arbitrary JS. Issue bodies are user-controlled GitHub content, so this is a real XSS vector.

Fix: Escape HTML entities before substitution:

const escapeHtml = (s: string) =>
  s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;')

const processed = line.replace(/`([^`]+)`/g, (_, code) => `<code>${escapeHtml(code)}</code>`)

Fix this →

---

🟠 Bug — editIssue Label/Assignee Clearing Broken

File: lib/services/issue/issue-service.ts:413-416

args.push('--remove-label', '')  // empty string — this won't work

gh issue edit --remove-label '' is not valid; the gh CLI expects an actual label name, not an empty string. This will either error silently or do nothing, leaving existing labels in place when the intent is to clear them. Same pattern affects assignees at line 424.

The correct approach is to read the current labels first and remove them individually, or use --remove-label '*' if supported by the installed gh version. Since reading-then-removing adds latency, it may be acceptable to document this limitation and skip the clear-all logic for now.

Fix this →

---

🟠 Bug — Screenshot Not Actually Uploaded to GitHub

File: lib/services/quick-capture/quick-capture-service.ts:109

body += `\n\n### Screenshot\n![](${screenshotPath})`

screenshotPath is a local filesystem path like /tmp/ledger-screenshots/screenshot-1234.png. The gh issue create --body command does not upload local image references — this will appear in the issue as a broken image link. Additionally, the temp file is not cleaned up if execAsync throws (the outer catch at line 159 returns early without running the cleanup block).

The getQuickLabels and getPriorityLabels functions in the same file also still use raw execAsync (lines 195, 221) — these are read-only so the injection risk is lower, but they're inconsistent with the rest of the codebase.

---

🟡 Code Duplication — LabelBadge and detectPriority

LabelBadge is defined identically in both IssueDetailPanel.tsx:25 and IssueList.tsx:97. detectPriority is implemented in issue-service.ts:53 (exported) and again in IssueList.tsx:42 (local copy with a slightly different return type).

Both should live in a shared utility — e.g., app/components/panels/list/issue-utils.ts — and be imported in both places.

---

🟡 Dead Code — getRecentRepos Stub in Quick Capture Service

File: lib/services/quick-capture/quick-capture-service.ts:184-188

export async function getRecentRepos(): Promise<QuickCaptureRepo[]> {
  // For now, return an empty array - will be wired up when integrated
  return []
}

This function is exported but the actual implementation is in the handler (quick-capture-handler.ts:53-65) which calls repoManager.getRecentRepositories() directly. The stub is never called. Either implement it or remove it to avoid confusion.

---

🟡 Privacy — Auto-Screenshot Default

File: lib/services/quick-capture/quick-capture-types.ts:83

autoScreenshot: true,

Auto-capturing the entire primary display on popover open (without a delay) may surprise users, especially on machines where sensitive content is visible. Consider defaulting to false and making it opt-in, or at minimum adding a brief delay (the screenshotDelay setting exists but defaults to 0).

---

🟡 Stability — Tray Global State Guard

File: lib/main/tray.ts:14-16

let tray: Tray | null = null
let quickCaptureWindow: BrowserWindow | null = null

createTray() doesn't guard against being called twice. If app.whenReady fires more than once in some code path, you'd leak a tray instance. Add a guard:

export function createTray(): Tray | null {
  if (tray) return tray  // already created
  // ...
}

---

🟢 Positive Notes

• Correct security defaults on the Quick Capture BrowserWindow: sandbox: true, contextIsolation: true, nodeIntegration: false — good.
• safeExec is used consistently across issue-service.ts — the createQuickIssue issue is the only exception.
• Good error mapping via mapGhError — surfaces gh not installed and auth errors clearly.
• destroyTray on will-quit — correct cleanup pattern.
• Minimal preload surface for Quick Capture — only exposes what's needed, no bleed from main app's API.
• The conveyor/typed IPC approach for issue handlers is clean and consistent with the rest of the codebase.

---

Summary

Severity	Issue
🔴 Critical	Shell injection in createQuickIssue — use safeExec
🔴 Security	XSS in renderMarkdown via unescaped dangerouslySetInnerHTML
🟠 Bug	editIssue label/assignee clearing (--remove-label '') is invalid
🟠 Bug	Screenshot local path embedded in issue body won't upload; leaked temp file on error
🟡 Quality	LabelBadge + detectPriority duplicated; getRecentRepos stub; tray guard missing
🟡 Privacy	autoScreenshot: true by default captures screen on every popover open

The two 🔴 issues should be fixed before merging. The 🟠 bugs are functional regressions that affect the screenshot and label-editing features. The 🟡 items are lower priority but worth addressing.

[cursor]

Cursor Bugbot has reviewed your changes and found 4 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8ef0d50. Configure here.}

[cursor]

XSS vulnerability via dangerouslySetInnerHTML in markdown renderer

High Severity

The renderMarkdown function inserts user-controlled content (issue bodies and comments from GitHub) using dangerouslySetInnerHTML after only converting backtick-wrapped text to <code> tags. Any HTML in the line — such as <img src=x onerror=alert(1)> — is rendered as live HTML. In an Electron app this is especially dangerous as it could enable code execution via crafted issue or comment content.

 

^{Reviewed by Cursor Bugbot for commit 8ef0d50. Configure here.}

[cursor]

Shell command injection via unescaped metacharacters in execAsync

High Severity

Multiple issue functions construct shell commands via string interpolation with execAsync (which uses child_process.exec, executing through a shell). Only double quotes are escaped (.replace(/"/g, '\\"')), but shell metacharacters like $(), backticks, and \ remain active inside double-quoted strings. Input containing $(command) would trigger command execution. This affects createIssue, editIssue, closeIssue, reopenIssue, and commentOnIssue.

Additional Locations (1)

• lib/main/git-service.ts#L6083-L6087

 

^{Reviewed by Cursor Bugbot for commit 8ef0d50. Configure here.}

[cursor]

Label overflow count uses wrong array length

Low Severity

The "+N more labels" indicator uses issue.labels.length (the unfiltered total) for both the threshold check and the overflow count, but the displayed labels come from a filtered array that excludes the priority label. When a priority label exists, the overflow count is off — it may show "+N" when fewer (or zero) labels are actually hidden.

 

^{Reviewed by Cursor Bugbot for commit 8ef0d50. Configure here.}

[cursor]

Duplicate GitHubIcon component across two files

Low Severity

The GitHubIcon SVG component is defined identically in both PluginSettingsPanel.tsx and RepositoryManagerPanel.tsx (replacing the removed Github import from lucide-react). This duplicated component could be extracted into a shared icon utility to avoid maintaining two copies.

Additional Locations (1)

• app/components/plugins/example-components/RepositoryManagerPanel.tsx#L25-L28

 

^{Reviewed by Cursor Bugbot for commit 8ef0d50. Configure here.}