Summary
The searchFiles tool throws a ReferenceError when executing due to an unsafe optional chaining call on stdout?.trim() in the searchFilesImpl function.
Environment
- OS: Linux 7.0.2-7-pve
- Node.js: v25.8.1
- madz version: 1.18.0
- LLM provider: Unknown — user to confirm
Reproduction
- Call the searchFiles tool
- Observe ReferenceError on
stdout?.trim()
Expected Behavior
The tool should search files and return matches without throwing an error.
Actual Behavior
A ReferenceError is thrown on the line const output = stdout?.trim() ?? stdout;
Additional Context
The problematic code is in ./src/tools/filesystem.js at line 436:
const output = stdout?.trim() ?? stdout;
Proposed fix: Remove the .trim() call from this line and apply it to the next line where output.split(" ") is called, ensuring stdout is handled safely before any method calls.
Audit Findings
- File:
src/tools/filesystem.js:436 — The searchFilesImpl function destructures { stdout } from execFile result, then applies optional chaining stdout?.trim(). If stdout is undefined (e.g., timeout or error case), stdout?.trim() returns undefined, and undefined ?? stdout evaluates to undefined (since stdout is also undefined). This causes output to be undefined, leading to a TypeError on output.split(n) at line 442.
- File:
src/tools/filesystem.js:435-442 — The execFile call has a 10s timeout. If the timeout triggers, the promise rejects and the catch block handles it. However, if stdout is undefined for other reasons (e.g., empty output, encoding issues), the optional chaining doesn't provide a fallback value.
- Recommendation: Replace
const output = stdout?.trim() ?? stdout; with const output = (stdout ?? ).trim(); to ensure output is always a string before calling split(). This handles undefined, null, and empty string cases gracefully.
Summary
The searchFiles tool throws a ReferenceError when executing due to an unsafe optional chaining call on
stdout?.trim()in thesearchFilesImplfunction.Environment
Reproduction
stdout?.trim()Expected Behavior
The tool should search files and return matches without throwing an error.
Actual Behavior
A ReferenceError is thrown on the line
const output = stdout?.trim() ?? stdout;Additional Context
The problematic code is in
./src/tools/filesystem.jsat line 436:Proposed fix: Remove the
.trim()call from this line and apply it to the next line whereoutput.split(" ")is called, ensuringstdoutis handled safely before any method calls.Audit Findings
src/tools/filesystem.js:436— ThesearchFilesImplfunction destructures{ stdout }fromexecFileresult, then applies optional chainingstdout?.trim(). Ifstdoutisundefined(e.g., timeout or error case),stdout?.trim()returnsundefined, andundefined ?? stdoutevaluates toundefined(since stdout is also undefined). This causesoutputto be undefined, leading to a TypeError onoutput.split(n)at line 442.src/tools/filesystem.js:435-442— The execFile call has a 10s timeout. If the timeout triggers, the promise rejects and the catch block handles it. However, if stdout is undefined for other reasons (e.g., empty output, encoding issues), the optional chaining doesn't provide a fallback value.const output = stdout?.trim() ?? stdout;withconst output = (stdout ?? ).trim();to ensure output is always a string before calling split(). This handles undefined, null, and empty string cases gracefully.