From 8f6a9b160bc036afe81fa3dc34bf3f7e383e84b1 Mon Sep 17 00:00:00 2001
From: StillKnotKnown <stillknotknown@users.noreply.github.com>
Date: Sun, 8 Feb 2026 17:20:40 +0200
Subject: [PATCH] fix: restore test_llm_connection and fix additional CodeQL
 issues

- Restore client creation in test_llm_connection and test_embedder_connection
  that was incorrectly removed during CodeQL fixes
- Fix CodeQL incomplete string escaping in test-backend.js (escape backslashes on Windows)
- Fix CodeQL useless conditional in changelog-service.ts (use ?? instead of ||)
- Fix CodeQL shell command from environment in bump-version.js (use execFileSync)

Related: #1721
---
 .../integrations/graphiti/providers_pkg/validators.py    | 6 ++++--
 apps/frontend/src/main/changelog/changelog-service.ts    | 2 +-
 scripts/bump-version.js                                  | 9 +++++----
 scripts/test-backend.js                                  | 4 ++--
 4 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/apps/backend/integrations/graphiti/providers_pkg/validators.py b/apps/backend/integrations/graphiti/providers_pkg/validators.py
index 72995237..58cac205 100644
--- a/apps/backend/integrations/graphiti/providers_pkg/validators.py
+++ b/apps/backend/integrations/graphiti/providers_pkg/validators.py
@@ -77,9 +77,10 @@ async def test_llm_connection(config: "GraphitiConfig") -> tuple[bool, str]:
     Returns:
         Tuple of (success, message)
     """
+    from .factory import create_llm_client
 
     try:
-        # llm_client = ...  # TODO: unused variable
+        llm_client = create_llm_client(config)
         # Most clients don't have a ping method, so just verify creation succeeded
         return (
             True,
@@ -103,6 +104,7 @@ async def test_embedder_connection(config: "GraphitiConfig") -> tuple[bool, str]
     Returns:
         Tuple of (success, message)
     """
+    from .factory import create_embedder
 
     # First validate config
     valid, msg = validate_embedding_config(config)
@@ -110,7 +112,7 @@ async def test_embedder_connection(config: "GraphitiConfig") -> tuple[bool, str]
         return False, msg
 
     try:
-        # embedder = ...  # TODO: unused variable
+        embedder = create_embedder(config)
         return (
             True,
             f"Embedder created successfully for provider: {config.embedder_provider}",
diff --git a/apps/frontend/src/main/changelog/changelog-service.ts b/apps/frontend/src/main/changelog/changelog-service.ts
index 7412c0b5..2c101d80 100644
--- a/apps/frontend/src/main/changelog/changelog-service.ts
+++ b/apps/frontend/src/main/changelog/changelog-service.ts
@@ -517,7 +517,7 @@ export class ChangelogService extends EventEmitter {
     } catch (error) {
       this.debug('Error in AI version suggestion, falling back to patch bump', error);
       // Fallback to patch bump if AI fails
-      const version = currentVersion || '1.0.0';
+      const version = currentVersion ?? '1.0.0';
       const [major, minor, patch] = version.split('.').map(Number);
       return {
         version: `${major}.${minor}.${patch + 1}`,
diff --git a/scripts/bump-version.js b/scripts/bump-version.js
index d22c2c56..89119a33 100644
--- a/scripts/bump-version.js
+++ b/scripts/bump-version.js
@@ -29,7 +29,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { execFileSync } = require('child_process');
+const { execSync, execFileSync } = require('child_process');
 
 // Colors for terminal output
 const colors = {
@@ -243,9 +243,10 @@ function main() {
 
   // 4. Validate release (check for branch/tag conflicts)
   info('Validating release...');
-  // Escape version for safe shell usage
-  const versionForValidation = shellescape(newVersion);
-  exec(`node ${path.join(__dirname, 'validate-release.js')} v${versionForValidation}`);
+  // Run validation script without spawning a shell to avoid shell interpretation of paths/args
+  execFileSync('node', [path.join(__dirname, 'validate-release.js'), `v${newVersion}`], {
+    stdio: 'inherit',
+  });
   success('Release validation passed');
 
   // 5. Update all version files
diff --git a/scripts/test-backend.js b/scripts/test-backend.js
index 75795b93..4ed57e88 100644
--- a/scripts/test-backend.js
+++ b/scripts/test-backend.js
@@ -45,9 +45,9 @@ const args = process.argv.slice(2);
 
 // Escape each argument for safe shell usage
 function escapeShellArg(arg) {
-  // On Windows, escape double quotes and wrap in double quotes
+  // On Windows, escape backslashes and double quotes and wrap in double quotes
   if (isWindows) {
-    return `"${arg.replace(/"/g, '\\"')}"`;
+    return `"${arg.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
   }
   // On Unix, use single quotes and escape any single quotes in the argument
   return `'${arg.replace(/'/g, "'\\''")}'`;