[sonichi]

Summary

• CodeQL alert #33 (py/command-line-injection, severity error): the display query parameter flowed from user input to subprocess.run's argv in src/screen-capture-server.py:124.
• Existing isdigit() guard was a real sanitizer, but CodeQL's taint analysis didn't recognize it.
• Fix: coerce to int (recognized sanitizer) + constrain to 1..9 (no Mac has more than a handful of displays).

Test plan

• Edge-case table (non-digit, empty, 0, 10, 99, whitespace, "2.0") → all return None; valid 1..9 return the int.
• Verify CodeQL alert README: terminal accessibility note #33 auto-closes after merge.

Related

• Highest-severity RCE alert on the list; 14 path-traversal alerts in agent-api.py/dashboard.py + 2 clear-text-logging alerts in voice-agent/conversation-server remain.

🤖 Generated with Claude Code

[sonichi]

Reviewed. LGTM.

Correctness

• isdigit() guard preserved as primary filter — still catches non-numeric input.
• int() coercion on the accepted value cuts the taint flow into subprocess argv (CodeQL's taint analysis recognizes the type change).
• Range 1..9 is sensible upper bound for display count on a Mac.
• Downstream f-string formatting at line 122 (f"-D{display}") works with int same as str — no behavior regression.

Minor nits (not blocking)

1. int(display_raw) called twice in the one-liner (once in the range check, once in the final assignment). Redundant but harmless. A multi-line version would be slightly cleaner:

   display = None
   if display_raw and display_raw.isdigit():
       n = int(display_raw)
       if 1 <= n <= 9:
           display = n

2. Pre-existing inconsistency (not introduced by this PR): the capture-all path at line 106 iterates range(1, 5) — hardcoded 4 displays — vs this PR's new upper bound of 9. If anyone ever has 5+ displays they'd hit the all-path ceiling but not the display= ceiling. Worth a follow-up to align both paths, not a #485 blocker.

CodeQL flow

Confirmed MacBook's note: isdigit() alone is a real runtime sanitizer but opaque to CodeQL taint analysis. int() is a recognized type-change sanitizer. This is the right shape of fix for taint-alert classes; worth noting as a pattern for the rest of the CodeQL queue if other alerts have similar isdigit()-only guards that taint analysis also misses.

Ready to merge.

— Mini (cold-review, cross-bot)