registry / @coralai/sps-cli / 0.57.1

@coralai/sps-cli@0.57.1

SPS CLI — AI-driven development pipeline orchestrator

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 161 file(s), 2.26 MB of source, external domains: 127.0.0.1, api.example.com, auth.openai.com, chatgpt.com, github.com, gitlab.com, react.dev, reactflow.dev, www.npmjs.com, www.w3.org

Source & flagged code

9 flagged

dist/infra/spawn.jsView file

Lines 1-30javascript

1/**

2 * @module infra/spawn

3 * @description ProcessSpawner port —— 只用于启动 supervisor（长跑 sps tick 进程）

4 *

5 * @layer infra

6 *

7 * 注意：Console 层禁止用 spawn 执行同步 CLI 操作（如 card add / worker launch）。

8 * 这些都应走 Service 层直接调 Domain。只有 pipeline supervisor 这种长跑 + detach

9 * 的进程才合法用 spawn。

10 */

11import { spawn } from 'node:child_process';

12import { existsSync, mkdirSync, openSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/infra/spawn.jsView on unpkg · L10

13import { basename, dirname, resolve } from 'node:path';

14import { fileURLToPath } from 'node:url';

15/**

16 * 定位 CLI 主入口。优先用运行时的 process.argv[1]（作为 sps CLI 运行时就是 sps 可执行文件）；

17 * 但当 SPS 被当作库嵌入到别的进程时（如 game-platform，process.argv[1] 是宿主入口），

18 * 决不能 self-re-exec 宿主 —— 此时回退到由本模块位置算出的 sps 自身入口。

19 */

20function cliEntry() {

21 const node = process.argv[0] ?? 'node';

22 const argvEntry = process.argv[1];

23 if (argvEntry && looksLikeSpsEntry(argvEntry))

24 return { node, entry: argvEntry };

25 return { node, entry: defaultEntry() };

26}

27function looksLikeSpsEntry(p) {

28 const base = basename(p);

29 return (base === 'main.js' ||

30 base === 'main.ts' ||

dist/core/shellEnv.jsView file

Lines 24-64javascript

24 try {

25 const content = readFileSync(filePath, 'utf-8');

26 for (const line of content.split('\n')) {

27 const trimmed =

dist/commands/setup.jsView file

Lines 1-40javascript

1/**

2 * @module setup

3 * @description 全局环境初始化向导，配置 SPS 运行所需的目录、密钥和全局设置

4 *

5 * @author eddy

6 * @organization wykj

7 * @ownership wykj/eddy

8 *

9 * @created 2026-03-19

project-template/batch_scheduler.shView file

•path = project-template/batch_scheduler.sh kind = build_helper sizeBytes = 232 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

project-template/batch_scheduler.shView on unpkg

project-template/.claude/hooks/stop.shView file

•path = project-template/.claude/hooks/stop.sh kind = payload_in_excluded_dir sizeBytes = 2524 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

project-template/.claude/hooks/stop.shView on unpkg

profiles/fullstack.mdView file

Lines 146-180markdown

146 {error && <p role="alert" className="text-red-600">{error}</p>}

147 <button type="submit" disabled={loading}>{loading ? 'Creating...' : 'Create'}</button>

148 </form>

149 );

150}

151```

152

153# Testing

154

155- Unit tests: services, validators (Vitest/Jest)

156- Integration tests: API endpoints with Supertest

157- Component tests: React Testing Library

158

profiles/backend.mdView file

Lines 121-164markdown

121 deleted_at TIMESTAMPTZ NULL

122);

123

124CREATE INDEX idx_users_email ON users(email) WHERE deleted_at IS NULL;

125```

126

127# Testing

128

129- Default test runner: Vitest or Jest

130- HTTP integration tests with Supertest

131- Test against real database when possible (test containers or in-memory)

132- Test error paths and auth rejection, not just happy paths

133- Coverage target: 80%+

Source & flagged code

9 flagged · loading source

dist/infra/spawn.jsView file

10*/ L11: import { spawn } from 'node:child_process'; L12: import { existsSync, mkdirSync, openSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/infra/spawn.jsView on unpkg · L10

dist/core/shellEnv.jsView file

44try { L45: const output = execSync(`bash -c 'set -a; source "${filePath}" 2>/dev/null; env'`, { encoding: 'utf-8', timeout: 5000 }); L46: return parseEnvOutput(output);

High

Shell

Package source references shell execution.

dist/core/shellEnv.jsView on unpkg · L44

dist/commands/setup.jsView file

205try { L206: execSync(`npm install -g ${adapter.pkg}`, { stdio: ['ignore', 'pipe', 'pipe'], timeout: 120_000 }); L207: log.ok(`Installed ${adapter.name}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/setup.jsView on unpkg · L205

20*/ L21: import { execSync } from 'node:child_process'; L22: import { chmodSync, copyFileSync, existsSync, lstatSync, mkdirSync, readdirSync, readFileSync, readlinkSync, statSync, symlinkSync, unlinkSync, writeFileSync } from 'node:fs'; ... L26: import { Logger } from '../core/logger.js'; L27: const HOME = process.env.HOME || '/home/coral'; L28: const ENV_PATH = resolve(HOME, '.coral', 'env'); ... L31: function createPrompt() { L32: const rl = createInterface({ input: process.stdin, output: process.stdout }); L33: return { ... L59: console.log(' Supports Markdown PM backend, GitLab/GitHub, Claude (via ACP), Matrix.'); L60: console.log(' https://www.npmjs.com/package/@coralai/sps-cli'); L61: console.log('');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/setup.jsView on unpkg · L20

project-template/batch_scheduler.shView file

•path = project-template/batch_scheduler.sh kind = build_helper sizeBytes = 232 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

project-template/batch_scheduler.shView on unpkg

project-template/.claude/hooks/stop.shView file

•path = project-template/.claude/hooks/stop.sh kind = payload_in_excluded_dir sizeBytes = 2524 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

project-template/.claude/hooks/stop.shView on unpkg

profiles/fullstack.mdView file

166patternName = generic_password severity = medium line = 166 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in profiles/fullstack.md

profiles/fullstack.mdView on unpkg · L166

profiles/backend.mdView file

141patternName = generic_password severity = medium line = 141 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in profiles/backend.md

profiles/backend.mdView on unpkg · L141

150patternName = generic_password severity = medium line = 150 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in profiles/backend.md

profiles/backend.mdView on unpkg · L150

Findings

4 High8 Medium6 Low

HighChild Processdist/infra/spawn.js

HighShelldist/core/shellEnv.js

HighRuntime Package Installdist/commands/setup.js

HighPayload In Excluded Dirproject-template/.claude/hooks/stop.sh

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/commands/setup.js

MediumShips Build Helperproject-template/batch_scheduler.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternprofiles/fullstack.md

MediumSecret Patternprofiles/backend.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

dist/infra/spawn.jsView file

Lines 1-30javascript

1/**

2 * @module infra/spawn

3 * @description ProcessSpawner port —— 只用于启动 supervisor（长跑 sps tick 进程）

4 *

5 * @layer infra

6 *

7 * 注意：Console 层禁止用 spawn 执行同步 CLI 操作（如 card add / worker launch）。

8 * 这些都应走 Service 层直接调 Domain。只有 pipeline supervisor 这种长跑 + detach

9 * 的进程才合法用 spawn。

10 */

11import { spawn } from 'node:child_process';

12import { existsSync, mkdirSync, openSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/infra/spawn.jsView on unpkg · L10

13import { basename, dirname, resolve } from 'node:path';

14import { fileURLToPath } from 'node:url';

15/**

16 * 定位 CLI 主入口。优先用运行时的 process.argv[1]（作为 sps CLI 运行时就是 sps 可执行文件）；

17 * 但当 SPS 被当作库嵌入到别的进程时（如 game-platform，process.argv[1] 是宿主入口），

18 * 决不能 self-re-exec 宿主 —— 此时回退到由本模块位置算出的 sps 自身入口。

19 */

20function cliEntry() {

21 const node = process.argv[0] ?? 'node';

22 const argvEntry = process.argv[1];

23 if (argvEntry && looksLikeSpsEntry(argvEntry))

24 return { node, entry: argvEntry };

25 return { node, entry: defaultEntry() };

26}

27function looksLikeSpsEntry(p) {

28 const base = basename(p);

29 return (base === 'main.js' ||

30 base === 'main.ts' ||

dist/core/shellEnv.jsView file

Lines 24-64javascript

24 try {

25 const content = readFileSync(filePath, 'utf-8');

26 for (const line of content.split('\n')) {

27 const trimmed =

dist/commands/setup.jsView file

Lines 1-40javascript

1/**

2 * @module setup

3 * @description 全局环境初始化向导，配置 SPS 运行所需的目录、密钥和全局设置

4 *

5 * @author eddy

6 * @organization wykj

7 * @ownership wykj/eddy

8 *

9 * @created 2026-03-19

project-template/batch_scheduler.shView file

•path = project-template/batch_scheduler.sh kind = build_helper sizeBytes = 232 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

project-template/batch_scheduler.shView on unpkg

project-template/.claude/hooks/stop.shView file

•path = project-template/.claude/hooks/stop.sh kind = payload_in_excluded_dir sizeBytes = 2524 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

project-template/.claude/hooks/stop.shView on unpkg

profiles/fullstack.mdView file

Lines 146-180markdown

146 {error && <p role="alert" className="text-red-600">{error}</p>}

147 <button type="submit" disabled={loading}>{loading ? 'Creating...' : 'Create'}</button>

148 </form>

149 );

150}

151```

152

153# Testing

154

155- Unit tests: services, validators (Vitest/Jest)

156- Integration tests: API endpoints with Supertest

157- Component tests: React Testing Library

158

profiles/backend.mdView file

Lines 121-164markdown

121 deleted_at TIMESTAMPTZ NULL

122);

123

124CREATE INDEX idx_users_email ON users(email) WHERE deleted_at IS NULL;

125```

126

127# Testing

128

129- Default test runner: Vitest or Jest

130- HTTP integration tests with Supertest

131- Test against real database when possible (test containers or in-memory)

132- Test error paths and auth rejection, not just happy paths

133- Coverage target: 80%+

Lines 185-225javascript

185 const synced = syncSkills(log);

186 if (synced > 0) {

187 log.ok(`Synced ${synced} skill(s) to agent directories`);

188 }

189 else if (existsSync(SKILLS_SRC_DIR)) {

190 log.info('No skills to sync (directory empty)');

191 }

192 else {

193 log.info(`No skills directory at ${SKILLS_SRC_DIR} — skipping sync`);

194 }

195 }

196 // ─── Step 4: Install claude-agent-acp adapter globally ──────────

197 {

198 const adapter = { name: 'claude-agent-acp', pkg: '@agentclientprotocol/claude-agent-acp' };

199 try {

200 execSync(`which ${adapter.name}`, { stdio: 'ignore' });

201 log.ok(`${adapter.name} already installed`);

202 }

203 catch {

204 log.info(`Installing ${adapter.name}...`);

205 try {

206 execSync(`npm install -g ${adapter.pkg}`, { stdio: ['ignore', 'pipe', 'pipe'], timeout: 120_000 });

207 log.ok(`Installed ${adapter.name}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/setup.jsView on unpkg · L205

208 }

209 catch (err) {

210 const msg = err instanceof Error ? err.message : String(err);

211 log.warn(`Failed to install ${adapter.name}: ${msg}`);

212 log.info(` You can install manually: npm install -g ${adapter.pkg}`);

213 }

214 }

215 }

216 // ─── Summary ───────────────────────────────────────────────────

217 console.log('\n Setup complete! Next steps:\n');

218 console.log(' 1. Source the env file:');

219 console.log(` source ${ENV_PATH}`);

220 console.log('');

221 console.log(' 2. (Optional) Auto-load on shell startup:');

222 console.log(` echo 'source ${ENV_PATH}' >> ~/.bashrc`);

223 console.log('');

224 console.log(' 3. Initialize your first project:');

225 console.log(' sps project init <project-name>');