This review covers repository analysis, artifact parsing, trend persistence, live refresh, Electron IPC, local tool launch, and Git/GitHub workflows. Codebase Colony is a local desktop developer tool, not a sandbox for executing untrusted repositories; its analysis path nevertheless avoids executing repository code.
- Renderer IPC accepts fixed action variants, fixed editor IDs, fixed GitHub targets, bounded strings, and repository-relative paths. It does not accept executables, commands, remotes, or external URLs.
- Files opened by editor, Explorer, and terminal actions pass both lexical containment and canonical-path containment checks. A symlink inside the repository cannot redirect these actions outside the selected root.
- Filesystem discovery skips symbolic links and generated/dependency/VCS directories and stops at 6,000 files. Text reads stop at 1.5 MiB per file and binary-looking files remain metadata-only.
- Artifact discovery uses a fixed allowlist. Files are limited to 8 MiB, symbolic-link artifacts are ignored, XML DOCTYPE/entity/stylesheet declarations are rejected, and parsed record counts are capped.
- Git commands use
execFileargument arrays, timeouts, output caps,--path separation where applicable, and a fixed 500-commit analysis window. Analysis performs read-only Git commands only. - Mutating Git operations remain explicit and serialized. Hooks and commit signing are disabled for app-initiated commits/pushes; terminal prompting is disabled. Reset, discard, checkout, rebase, stash, force push, and automatic synchronization are absent.
- GitHub URLs are derived in Electron from a recognized GitHub
origin; renderer-provided external URLs are never opened. - Trend persistence contains bounded derived numbers and mission IDs only. Writes go to Electron’s app-owned
userDatadirectory, use an opaque repository identity, and can be reset per repository. - Live refresh is opt-in, watches one validated root, filters generated/VCS/dependency/temp paths, coalesces bursts, and can only trigger the read-only analyzer.
- The renderer remains sandboxed with context isolation, no Node integration, blocked popups/navigation, and the existing Content Security Policy.
| Surface | Limit |
|---|---|
| Discovered repository files | 6,000 |
| Rendered buildings | 1,200 with deterministic priority retention |
| Source text read | 1.5 MiB per file |
| Coverage/test artifact | 8 MiB per artifact |
| Coverage/test records | Format-specific caps up to 250,000 line/assertion records |
| Git analysis | latest 500 commits, detected by reading at most 501 |
| File diff shown | 160,000 characters |
| Stored trends | 40 scans and 100 achievements per repository |
| Watch event path disclosure | first 50 coalesced paths per burst |
The automated suite covers traversal, canonical existing paths, hostile XML declarations, analyzer fallbacks, rename-aware Git history, hook suppression, isolated fetch/push, repository paths containing spaces, and watcher ignore policy. npm audit reports no known dependency vulnerabilities for the pinned lockfile at release preparation time.
- XML readers are purpose-built for bounded JUnit/Cobertura subsets rather than general XML. Unsupported structures are ignored or reported rather than interpreted.
- Explicit Git staging can invoke clean filters already configured in the user’s Git environment; this is why staging is separated from analysis and never automatic.
- Windows installer artifacts are unsigned in this project configuration. Users may see SmartScreen warnings until a publisher adds Authenticode signing.
- A repository can still consume CPU within the documented file/text limits. The reproducible profiler exists to track regressions, and UI rendering separately retains/culls high-value structures.