Skip to content

HVE Cockpit: a host-agnostic web GUI for steering agentic coding sessions - #2271

Draft
Michael Curtis (MichaelDanCurtis) wants to merge 187 commits into
microsoft:mainfrom
MichaelDanCurtis:design/rpi-cockpit
Draft

HVE Cockpit: a host-agnostic web GUI for steering agentic coding sessions#2271
Michael Curtis (MichaelDanCurtis) wants to merge 187 commits into
microsoft:mainfrom
MichaelDanCurtis:design/rpi-cockpit

Merge branch 'main' into design/rpi-cockpit

f3dfbb1
Select commit
Loading
Failed to load commit list.
GitHub Advanced Security / CodeQL failed Jul 3, 2026 in 1s

24 new alerts including 17 high severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

  • 17 high
  • 4 medium

Other Alerts:

  • 3 notes

Alerts not introduced by this pull request might have been detected because the code changes were too large.

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 206 in rpi-cockpit/src/server.ts

See this annotation in the file changed.

Code scanning / CodeQL

Insecure temporary file High

Insecure creation of file in
the os temp dir
Loading
.
Insecure creation of file in
the os temp dir
Loading
.
Insecure creation of file in
the os temp dir
Loading
.
Insecure creation of file in
the os temp dir
Loading
.

Check failure on line 107 in rpi-cockpit/src/server.ts

See this annotation in the file changed.

Code scanning / CodeQL

Uncontrolled data used in path expression High

This path depends on a
user-provided value
Loading
.

Check failure on line 78 in rpi-cockpit/src/live.ts

See this annotation in the file changed.

Code scanning / CodeQL

Insecure temporary file High

Insecure creation of file in
the os temp dir
Loading
.
Insecure creation of file in
the os temp dir
Loading
.

Check failure on line 183 in rpi-cockpit/src/init.ts

See this annotation in the file changed.

Code scanning / CodeQL

Potential file system race condition High

The file may have changed since it
was checked
Loading
.

Check failure on line 136 in rpi-cockpit/src/init.ts

See this annotation in the file changed.

Code scanning / CodeQL

Potential file system race condition High

The file may have changed since it
was checked
Loading
.

Check failure on line 1115 in rpi-cockpit/public/client.js

See this annotation in the file changed.

Code scanning / CodeQL

Remote property injection High

A property name to write to depends on a
user-provided value
Loading
.

Check failure on line 997 in rpi-cockpit/public/client.js

See this annotation in the file changed.

Code scanning / CodeQL

Remote property injection High

A property name to write to depends on a
user-provided value
Loading
.

Check failure on line 720 in rpi-cockpit/public/client.js

See this annotation in the file changed.

Code scanning / CodeQL

Client-side cross-site scripting High

Cross-site scripting vulnerability due to
user-provided value
Loading
.

Check failure on line 32 in rpi-cockpit/tests/live.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Insecure temporary file High test

Insecure creation of file in
the os temp dir
Loading
.

Check failure on line 719 in rpi-cockpit/public/client.js

See this annotation in the file changed.

Code scanning / CodeQL

Client-side cross-site scripting High

Cross-site scripting vulnerability due to
user-provided value
Loading
.

Check failure on line 48 in rpi-cockpit/tests/live.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Insecure temporary file High test

Insecure creation of file in
the os temp dir
Loading
.

Check failure on line 705 in rpi-cockpit/public/client.js

See this annotation in the file changed.

Code scanning / CodeQL

Client-side cross-site scripting High

Cross-site scripting vulnerability due to
user-provided value
Loading
.

Check failure on line 79 in rpi-cockpit/tests/live.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Insecure temporary file High test

Insecure creation of file in
the os temp dir
Loading
.

Check failure on line 625 in rpi-cockpit/public/client.js

See this annotation in the file changed.

Code scanning / CodeQL

Client-side cross-site scripting High

Cross-site scripting vulnerability due to
user-provided value
Loading
.

Check failure on line 599 in rpi-cockpit/public/client.js

See this annotation in the file changed.

Code scanning / CodeQL

Client-side cross-site scripting High

Cross-site scripting vulnerability due to
user-provided value
Loading
.

Check failure on line 84 in rpi-cockpit/public/client.js

See this annotation in the file changed.

Code scanning / CodeQL

Client-side cross-site scripting High

Cross-site scripting vulnerability due to
user-provided value
Loading
.

Check failure on line 91 in rpi-cockpit/tests/live.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Insecure temporary file High test

Insecure creation of file in
the os temp dir
Loading
.

Check warning on line 720 in rpi-cockpit/public/client.js

See this annotation in the file changed.

Code scanning / CodeQL

Client-side URL redirect Medium

Untrusted URL redirection depends on a
user-provided value
Loading
.

Check warning on line 719 in rpi-cockpit/public/client.js

See this annotation in the file changed.

Code scanning / CodeQL

Client-side URL redirect Medium

Untrusted URL redirection depends on a
user-provided value
Loading
.

Check warning on line 705 in rpi-cockpit/public/client.js

See this annotation in the file changed.

Code scanning / CodeQL

Client-side URL redirect Medium

Untrusted URL redirection depends on a
user-provided value
Loading
.

Check warning on line 84 in rpi-cockpit/public/client.js

See this annotation in the file changed.

Code scanning / CodeQL

Client-side URL redirect Medium

Untrusted URL redirection depends on a
user-provided value
Loading
.

Check notice on line 6 in rpi-cockpit/tests/decision-client.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unused variable, import, function or class Note test

Unused imports applyBeat, initialState.

Check notice on line 7 in rpi-cockpit/tests/decision-client.test.ts

See this annotation in the file changed.

Code scanning / CodeQL

Unused variable, import, function or class Note test

Unused import toViewModel.

Check notice on line 113 in rpi-cockpit/tools/agent-gallery.mjs

See this annotation in the file changed.

Code scanning / CodeQL

Unused variable, import, function or class Note

Unused function ctx.