registry / @castlemilk/omega / 0.6.5

@castlemilk/omega@0.6.5

Omega Harness CLI - installable via npx

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 561 KB of source, external domains: reactjs.org, www.w3.org

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 421-461javascript

421 title: opts.title,

422 description: opts.description,

423 complexity: opts.complexity,

424 tags: opts.tags ? opts.tags.split(",").map((t) => t.trim()) : []

425 })

426 });

427 console.log(JSON.stringify(task, null, 2));

428});

429taskCmd.command("list").description("List tasks").option("--project <id>", "filter by project id").action(async (opts) => {

430 const query = opts.project ? `?projectId=${opts.project}` : "";

431 const tasks = await apiFetch(`/tasks${query}`);

432 console.log(JSON.stringify(tasks, null, 2));

433});

434taskCmd.command("run").description("Run a task through the router").argument("<id>", "task id").action(async (id) => {

435 const result = await apiFetch(`/tasks/${id}/run`, { method: "POST" });

436 console.log(JSON.stringify(result, null, 2));

437});

438taskCmd.addCommand(taskFeedCmd);

439

440// ../../apps/cli/src/commands/ui.ts

441import { Command as Command4 } from "commander";

442import { spawn } from "child_process";

443import { existsSync as existsSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L441

444import net from "net";

445import path2 from "path";

446import { fileURLToPath as fileURLToPath2 } from "url";

447import open from "open";

448import { render } from "ink";

449import React2 from "react";

450var __filename2 = fileURLToPath2(import.meta.url);

451var __dirname2 = path2.dirname(__filename2);

452var DEFAULT_PORT = 4e3;

453var MAX_PORT = 4010;

454var DEFAULT_GRPC_PORT = 50051;

455var MAX_GRPC_PORT = 50061;

456function findAvailablePort(preferred = DEFAULT_PORT, max = MAX_PORT) {

457 return new Promise((resolve, reject) => {

458 if (preferred > max) {

459 reject(new Error(`No available ports between ${DEFAULT_PORT.toString()} and ${max.toString()}`));

460 return;

461 }

Lines 520-570javascript

520 headers: { "Content-Type": "application/json" },

521 body: JSON.stringify({ name, path: cwd })

522 });

523 if (createRes.ok) {

524 console.log(`Added project: ${name}`);

525 } else {

526 console.warn("Could not auto-add project:"

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

441import { Command as Command4 } from "commander"; L442: import { spawn } from "child_process"; L443: import { existsSync as existsSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L441

550stdio: "inherit", L551: shell: true, L552: env

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L550

540const grpcPort = await findAvailablePort(DEFAULT_GRPC_PORT, MAX_GRPC_PORT); L541: apiUrl = `http://localhost:${port.toString()}`; L542: process.env.HARNESS_API_URL = apiUrl; L543: const env = { ... L548: }; L549: server = startBundledServer(env) ?? spawn("pnpm", ["--filter", "@omega/server", "dev"], { L550: stdio: "inherit",

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L540

Findings

3 High2 Medium4 Low

HighChild Processdist/cli.js

HighShelldist/cli.js

HighSame File Env Network Executiondist/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 421-461javascript

421 title: opts.title,

422 description: opts.description,

423 complexity: opts.complexity,

424 tags: opts.tags ? opts.tags.split(",").map((t) => t.trim()) : []

425 })

426 });

427 console.log(JSON.stringify(task, null, 2));

428});

429taskCmd.command("list").description("List tasks").option("--project <id>", "filter by project id").action(async (opts) => {

430 const query = opts.project ? `?projectId=${opts.project}` : "";

431 const tasks = await apiFetch(`/tasks${query}`);

432 console.log(JSON.stringify(tasks, null, 2));

433});

434taskCmd.command("run").description("Run a task through the router").argument("<id>", "task id").action(async (id) => {

435 const result = await apiFetch(`/tasks/${id}/run`, { method: "POST" });

436 console.log(JSON.stringify(result, null, 2));

437});

438taskCmd.addCommand(taskFeedCmd);

439

440// ../../apps/cli/src/commands/ui.ts

441import { Command as Command4 } from "commander";

442import { spawn } from "child_process";

443import { existsSync as existsSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L441

444import net from "net";

445import path2 from "path";

446import { fileURLToPath as fileURLToPath2 } from "url";

447import open from "open";

448import { render } from "ink";

449import React2 from "react";

450var __filename2 = fileURLToPath2(import.meta.url);

451var __dirname2 = path2.dirname(__filename2);

452var DEFAULT_PORT = 4e3;

453var MAX_PORT = 4010;

454var DEFAULT_GRPC_PORT = 50051;

455var MAX_GRPC_PORT = 50061;

456function findAvailablePort(preferred = DEFAULT_PORT, max = MAX_PORT) {

457 return new Promise((resolve, reject) => {

458 if (preferred > max) {

459 reject(new Error(`No available ports between ${DEFAULT_PORT.toString()} and ${max.toString()}`));

460 return;

461 }

Lines 520-570javascript

520 headers: { "Content-Type": "application/json" },

521 body: JSON.stringify({ name, path: cwd })

522 });

523 if (createRes.ok) {

524 console.log(`Added project: ${name}`);

525 } else {

526 console.warn("Could not auto-add project:"