registry / @astrosheep/keiyaku / 2.9.1

@astrosheep/keiyaku@2.9.1

CLI for running iterative keiyaku workflows with Codex subagents.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 274 file(s), 1.11 MB of source

Source & flagged code

5 flagged

build/core/projection-coordinate.jsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import * as path from "node:path";

High

Child Process

Package source references child process execution.

build/core/projection-coordinate.jsView on unpkg · L1

3import { ProjectionStateError } from "./atomic-publish.js";

4import { isGitExecutableUnavailable } from "../git/core.js";

5import { gitCommonRootPath, resolveGitCommonRootSync } from "./path-coordinate.js";

6/**

7 * Resolve projection storage root and authority from one Git probe.

8 *

9 * A non-bare repository uses the parent of its absolute common Git directory,

10 * so every linked worktree shares one coordinate. Repo-free callers retain the

11 * existing cwd-local authority until its replacement is legislated.

12 */

13export function resolveProjectionCoordinate(cwd) {

14 const result = spawnSync("git", ["rev-parse", "--is-bare-repository", "--path-format=absolute", "--git-common-dir"], {

15 cwd,

16 encoding: "utf8",

17 env: {

18 ...process.env,

19 GIT_TERMINAL_PROMPT: "0",

20 LC_ALL: "C",

21 },

build/agents/providers/pi/adapter.jsView file

Lines 1-35javascript

1import { z } from "zod";

2import { FlowError } from "../../../flow-error.js";

3import { appendDebugLog } from "../../../telemetry/debug-log.js";

4import { createProjectionDriver } from "../../harness/execution-handle.js"

build/agents/opencode-sdk.jsView file

Lines 27-67javascript

27 });

28 });

29}

30async function waitForServerReady(client, directory, timeoutMs, signal) {

31 const deadline

build/core/task-git-store.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @astrosheep/keiyaku@2.9.0 matchedIdentity = npm:QGFzdHJvc2hlZXAva2VpeWFrdQ:2.9.0 similarity = 0.758 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

build/core/task-git-store.jsView on unpkg

Source & flagged code

5 flagged · loading source

build/core/projection-coordinate.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code