registry / @calibrate-ds/cli / 0.1.79

@calibrate-ds/cli@0.1.79

⚠ Under review

Calibrate — local-first design system compiler. Reads Figma files, normalizes them into a typed DesignSystemModel, and generates React components, design tokens, and AI-ready implementation prompts via MCP.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 63 file(s), 622 KB of source, external domains: us.i.posthog.com, www.figma.com

Source & flagged code

5 flagged

dist/utils/storybook-setup.jsView file

Lines 1-23javascript

1import { resolveDSPaths, setupStorybook, patchStorybookStories, patchStorybookPreview, detectPackageManager, checkStorybookReadiness, detectBundler } from "@calibrate-ds/core";

2import { createInterface } from "node:readline/promises";

3import { stdin as input, stdout as output } from "node:process";

4import { spawnSync } from

Source & flagged code

5 flagged · loading source

dist/utils/storybook-setup.jsView file

3import { stdin as input, stdout as output } from "node:process"; L4: import { spawnSync } from "node:child_process"; L5: import * as path from "node:path";

High

Child Process

Package source references child process execution.

dist/utils/storybook-setup.jsView on unpkg · L3

116stdio: "inherit", L117: shell: true, L118: });

High

Shell

Package source references shell execution.

dist/utils/storybook-setup.jsView on unpkg · L116

dist/mcp/tools/action-tools.jsView file

21try { L22: return JSON.parse(await fs.readFile(path.join(workspaceRoot, "ptb.lock"), "utf-8")); L23: } ... L93: type: "text", L94: text: `${tokenEnv} is not set.\n\nThe easiest fix — run this once in any terminal:\n\n ptb token set <your-figma-token>\n\nThis stores the token in ~/.config/calibrate-ds/credenti... L95: }], ... L516: ...(modelComponent.tokenBindings ? { tokenBindings: modelComponent.tokenBindings } : {}), L517: ...(modelComponent.styleMetadata ? { styleMetadata: modelComponent.styleMetadata } : {}), L518: ...(modelComponent.layout ? { layout: modelComponent.layout } : {}),

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/mcp/tools/action-tools.jsView on unpkg · L21

dist/commands/init.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @calibrate-ds/cli@0.1.70 matchedIdentity = npm:QGNhbGlicmF0ZS1kcy9jbGk:0.1.70 similarity = 0.825 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/init.jsView on unpkg

456console.log(`\n Initializing Storybook...`); L457: const sbInit = spawnSync("npx storybook@latest init --no-dev", { L458: cwd: uiPackageRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L456

Findings

1 Critical3 High4 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/commands/init.js

HighChild Processdist/utils/storybook-setup.js

HighShelldist/utils/storybook-setup.js

HighRuntime Package Installdist/commands/init.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/mcp/tools/action-tools.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Lines 96-136javascript

96 steps.forEach((step, i) => {

97 console.log(` ${C.dim}${i + 1}.${C.reset} ${step.label}`);

98 console.log(` ${C.cyan}${cdCmd ? `${cdCmd} && ` : ""}${step.cmd}${C.reset}`);

99 if (step.isStorybookInit) {

100 console.log(` ${C.dim}PTB will update the stories glob in .storybook/main.ts after init.${C.reset}`);

101 }

102 console.log();

103 });

104 if (!process.stdout.isTTY)

105 return;

106 const rl = createInterface({ input, output });

107 const answer = await rl.question(` Run these steps now? (Y/n) `).finally(() => rl.close());

108 if (answer.trim().toLowerCase() === "n") {

109 logger.dim(" Skipped. You can run 'ptb document component <name>' later to trigger setup again.");

110 return;

111 }

112 for (const step of steps) {

113 console.log(`\n ${C.dim}▶ ${step.cmd}${C.reset}\n`);

114 const result = spawnSync(step.cmd, {

115 cwd: packageRoot,

116 stdio: "inherit",

117 shell: true,

118 });

High

Shell

Package source references shell execution.

dist/utils/storybook-setup.jsView on unpkg · L116

119 if (result.status !== 0) {

120 logger.warn(` Step failed — fix the error above then re-run 'ptb document component <name>'.`);

121 return;

122 }

123 if (step.isStorybookInit) {

124 // Remove Storybook's example stories scaffold — PTB manages its own stories

125 const exampleDirs = ["src/stories", "stories"].map(d => path.join(packageRoot, d));

126 for (const dir of exampleDirs) {

127 await fs.rm(dir, { recursive: true, force: true }).catch(() => { });

128 }

129 // Patch only the stories glob — don't overwrite Storybook's auto-detected framework/builder

130 logger.dim("\n Updating stories glob in .storybook/main.ts...");

131 const patched = await patchStorybookStories(packageRoot, componentsDir);

132 if (patched) {

133 logger.success(" .storybook/main.ts updated with correct stories glob.");

134 }

135 // Ensure npm scripts exist — storybook@latest init adds them but only when it detects

136 // an interactive terminal; they can be missing in CI or when init was run non-interactively.

dist/mcp/tools/action-tools.jsView file

Lines 1-41javascript

1import * as fs from "node:fs/promises";

2import * as path from "node:path";

3import { z } from "zod";

4import { getDesignToolAdapter, saveSnapshot, exportAllComponentContexts, loadManifest, updateComponentArtifacts, loadConfig, getGenerator, syncManifestWithReport, createNamingStrategy, resolveDSPaths, isIconComponent, normalizeIconDisplayName, getComponentContext, generateComponentStories, generateComponentPrompt, generateComponentDoc, buildReverseDepsMap, formatMetadataHeader, pruneStaleComponents, resolveTokenSource, enrichIconsWithSvg, enrichBitmapAssets, enrichComponentThumbnails, resolveToken, } from "@calibrate-ds/core";

5import { computeVerifyVerdict } from "@calibrate-ds/core";

6import { invalidateCache, resolveCwd } from "../server.js";

7import { getManagedSnapshot } from "../../utils/managed-components.js";

8import { getGitIdentity } from "../../utils/team-roster.js";

9function toSlug(name) {

10 return name.toLowerCase().trim().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");

11}

12function buildDocsPayload(context, codeName, ctx) {

13 const tool = ctx.config.docs?.tool ?? "none";

14 const fileKey = ctx.config.designTool?.fileKey ?? "";

15 const storyTemplate = tool === "storybook"

16 ? generateComponentStories(context, codeName, fileKey)

17 : null;

18 return { tool, shouldGenerate: tool !== "none", storyTemplate };

19}

20async function loadLock(workspaceRoot) {

21 try {

22 return JSON.parse(await fs.readFile(path.join(workspaceRoot, "ptb.lock"), "utf-8"));

23 }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/mcp/tools/action-tools.jsView on unpkg · L21

24 catch {

25 return null;

26 }

27}

28async function saveLock(workspaceRoot, lock) {

29 const p = path.join(workspaceRoot, "ptb.lock");

30 const tmp = `${p}.tmp.${process.pid}`;

31 await fs.writeFile(tmp, JSON.stringify(lock, null, 2) + "\n", "utf-8");

32 await fs.rename(tmp, p);

33}

34/**

35 * GAP-003: reconcile the persisted context's dependency statuses with the same

36 * lock-stamp readiness that drives `blockedBy`, so the two never contradict

37 * (a dep implemented-but-not-stamped used to read "ready" in the context while

38 * appearing in blockedBy as "unbuilt"). Strict semantics: a dependency is only

39 * "ready" when it is lock-stamped to the current design. Each dependency also

40 * gains a `lockStatus` (ready | stale | unbuilt) mirroring the blockedBy vocab.

41 * Deps with no lock entry (external/unmanaged) keep their existing status.

dist/commands/init.jsView file

Lines 436-476javascript

436 // ── Install deps (fresh repos) ────────────────────────────────────

437 if (isFresh && uiPackageRoot) {

438 // pm is interpolated into a shell command (shell:true is required on

439 // Windows where package managers are .cmd shims) — never let anything

440 // outside this whitelist through.

441 if (!["pnpm", "npm", "yarn"].includes(pm)) {

442 throw new Error(`Unsupported package manager: ${pm}`);

443 }

444 console.log(`\n Installing dependencies with ${pm}...`);

445 const install = spawnSync(pm === "pnpm" ? "pnpm install" : `${pm} install`, {

446 cwd,

447 stdio: "inherit",

448 shell: true,

449 });

450 if (install.status !== 0) {

451 logger.warn("Dependency install failed. Run it manually, then re-run 'ptb init'.");

452 }

453 else if (docsTool === "storybook") {

454 // Fresh project + Storybook chosen: run init automatically (no prompt needed).

455 // --no-dev prevents Storybook from launching its dev server after init.

456 console.log(`\n Initializing Storybook...`);

457 const sbInit = spawnSync("npx storybook@latest init --no-dev", {

458 cwd: uiPackageRoot,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L456

459 stdio: "inherit",

460 shell: true,

461 });

462 // NEW-1: `storybook init` can exit 0 while its interactive builder

463 // picker silently no-ops in a non-interactive/agentic context — the

464 // exit code alone is not proof it did anything. Confirm the config

465 // it is supposed to create actually exists before claiming success.

466 const sbConfigExists = await (async () => {

467 for (const f of ["main.ts", "main.js", "main.mjs", "main.cjs"]) {

468 try {

469 await fs.access(path.join(uiPackageRoot, ".storybook", f));

470 return true;

471 }

472 catch { /* try next */ }

473 }

474 return false;

475 })();

476 if (sbInit.status !== 0 || !sbConfigExists) {

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/init.jsView on unpkg