registry / @bbk1ng/agent-orch / 0.2.3

@bbk1ng/agent-orch@0.2.3

Run local coding agents in a cross-audit loop on any git repo — author, cross-audit, test-gate, merge. Educational; not for production.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 161 KB of source, external domains: api.github.com, cli.github.com

Source & flagged code

1 flagged

src/resume.jsView file

Lines 3-43javascript

3// Keyed on the FULL task text (+ author) so slug collisions can't resume the

4// wrong branch. Written before runCycle, cleared after it RETURNS — a throw

5// (quota) skips the clear, so the record survives for the next run to resume.

6import { createHash } from "node:crypto";

7import { mkdirSync, readFileSync, readdirSync, writeFileSync, rmSync } from "node:fs";

8import { join } from "node:path";

10const dir = (orchDir) => join(orchDir, "resume");

11const key = (task, author) => createHash("sha1").update(`${author}\0${task}`).digest("hex");

12const taskKey = (task) => createHash("sha1").update(task).digest("hex");

13const file = (orchDir, task, author) => join(dir(orchDir), `${key(task, author)}.json`);

15export function record(orchDir, task, author, { branch, sid }) {

16 mkdirSync(dir(orchDir), { recursive: true });

17 // author + taskHash let lookupForTask find this branch regardless of which agent

18 // the rotation pool advanced to on the resuming run (#27).

19 writeFileSync(file(orchDir, task, author),

20 JSON.stringify({ branch, sid, author, taskHash: taskKey(task), ts: new Date().toISOString() }));

21}

23export function lookup(orchDir, task, author) {

24 try { return JSON.parse(readFileSync(file(orchDir, task, author), "utf8")); }

25 catch { return null; } // ENOENT / parse error → no record

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/resume.jsView on unpkg · L23

26}

28// Every record for this task text, across authors — the per-author key can't be

29// reversed from the filename, so we scan and match the stored taskHash. Lets the

30// caller pin the author of a surviving branch when rotation has moved on (#27).

31export function lookupForTask(orchDir, task) {

32 const th = taskKey(task);

33 let names;

34 try { names = readdirSync(dir(orchDir)); }

35 catch { return []; } // no resume dir yet → no records

36 const out = [];

37 for (const n of names) {

38 if (!n.endsWith(".json")) continue;

39 try {

40 const r = JSON.parse(readFileSync(join(dir(orchDir), n), "utf8"));

41 if (r.taskHash === th && r.author && r.branch) out.push(r);

42 } catch { /* skip unreadable/partial record */ }

43 }

Source & flagged code

1 flagged · loading source

src/resume.jsView file

23export function lookup(orchDir, task, author) { L24: try { return JSON.parse(readFileSync(file(orchDir, task, author), "utf8")); } L25: catch { return null; } // ENOENT / parse error → no record

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/resume.jsView on unpkg · L23

Findings

1 Medium6 Low

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/resume.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

src/resume.jsView file

Lines 3-43javascript

3// Keyed on the FULL task text (+ author) so slug collisions can't resume the

4// wrong branch. Written before runCycle, cleared after it RETURNS — a throw

5// (quota) skips the clear, so the record survives for the next run to resume.

6import { createHash } from "node:crypto";

7import { mkdirSync, readFileSync, readdirSync, writeFileSync, rmSync } from "node:fs";

8import { join } from "node:path";

10const dir = (orchDir) => join(orchDir, "resume");

11const key = (task, author) => createHash("sha1").update(`${author}\0${task}`).digest("hex");

12const taskKey = (task) => createHash("sha1").update(task).digest("hex");

13const file = (orchDir, task, author) => join(dir(orchDir), `${key(task, author)}.json`);

15export function record(orchDir, task, author, { branch, sid }) {

16 mkdirSync(dir(orchDir), { recursive: true });

17 // author + taskHash let lookupForTask find this branch regardless of which agent

18 // the rotation pool advanced to on the resuming run (#27).

19 writeFileSync(file(orchDir, task, author),

20 JSON.stringify({ branch, sid, author, taskHash: taskKey(task), ts: new Date().toISOString() }));

21}

23export function lookup(orchDir, task, author) {

24 try { return JSON.parse(readFileSync(file(orchDir, task, author), "utf8")); }

25 catch { return null; } // ENOENT / parse error → no record

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/resume.jsView on unpkg · L23

26}

28// Every record for this task text, across authors — the per-author key can't be

29// reversed from the filename, so we scan and match the stored taskHash. Lets the

30// caller pin the author of a surviving branch when rotation has moved on (#27).

31export function lookupForTask(orchDir, task) {

32 const th = taskKey(task);

33 let names;

34 try { names = readdirSync(dir(orchDir)); }

35 catch { return []; } // no resume dir yet → no records

36 const out = [];

37 for (const n of names) {

38 if (!n.endsWith(".json")) continue;

39 try {

40 const r = JSON.parse(readFileSync(join(dir(orchDir), n), "utf8"));

41 if (r.taskHash === th && r.author && r.branch) out.push(r);

42 } catch { /* skip unreadable/partial record */ }

43 }