registry / @coralai/sps-cli / 0.57.13

@coralai/sps-cli@0.57.13

SPS CLI — AI-driven development pipeline orchestrator

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 172 file(s), 2.35 MB of source, external domains: 127.0.0.1, api.example.com, auth.openai.com, chatgpt.com, github.com, gitlab.com, react.dev, reactflow.dev, www.npmjs.com, www.w3.org

Source & flagged code

7 flagged

dist/infra/spawn.jsView file

Lines 1-30javascript

1/**

2 * @module infra/spawn

3 * @description ProcessSpawner port —— 只用于启动 supervisor（长跑 sps tick 进程）

4 *

5 * @layer infra

6 *

7 * 注意：Console 层禁止用 spawn 执行同步 CLI 操作（如 card add / worker launch）。

8 * 这些都应走 Service 层直接调 Domain。只有 pipeline supervisor 这种长跑 + detach

9 * 的进程才合法用 spawn。

10 */

11import { spawn } from 'node:child_process';

12import { existsSync, mkdirSync, openSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/infra/spawn.jsView on unpkg · L10

13import { basename, dirname, resolve } from 'node:path';

14import { fileURLToPath } from 'node:url';

15/**

16 * 定位 CLI 主入口。优先用运行时的 process.argv[1]（作为 sps CLI 运行时就是 sps 可执行文件）；

17 * 但当 SPS 被当作库嵌入到别的进程时（如 game-platform，process.argv[1] 是宿主入口），

18 * 决不能 self-re-exec 宿主 —— 此时回退到由本模块位置算出的 sps 自身入口。

19 */

20function cliEntry() {

21 const node = process.argv[0] ?? 'node';

22 const argvEntry = process.argv[1];

23 if (argvEntry && looksLikeSpsEntry(argvEntry))

24 return { node, entry: argvEntry };

25 return { node, entry: defaultEntry() };

26}

27function looksLikeSpsEntry(p) {

28 const base = basename(p);

29 return (base === 'main.js' ||

30 base === 'main.ts' ||

dist/core/shellEnv.jsView file

Lines 24-64javascript

24 try {

25 const content = readFileSync(filePath, 'utf-8');

26 for (const line of content.split('\n')) {

27 const trimmed =

dist/commands/setup.jsView file

Lines 1-40javascript

1/**

2 * @module setup

3 * @description 全局环境初始化向导，配置 SPS 运行所需的目录、密钥和全局设置

4 *

5 * @author eddy

6 * @organization wykj

7 * @ownership wykj/eddy

8 *

9 * @created 2026-03-19

profiles/fullstack.mdView file

Lines 146-180markdown

146 {error && <p role="alert" className="text-red-600">{error}</p>}

147 <button type="submit" disabled={loading}>{loading ? 'Creating...' : 'Create'}</button>

148 </form>

149 );

150}

151```

152

153# Testing

154

155- Unit tests: services, validators (Vitest/Jest)

156- Integration tests: API endpoints with Supertest

157- Component tests: React Testing Library

158

profiles/backend.mdView file

Lines 121-164markdown

121 deleted_at TIMESTAMPTZ NULL

122);

123

124CREATE INDEX idx_users_email ON users(email) WHERE deleted_at IS NULL;

125```

126

127# Testing

128

129- Default test runner: Vitest or Jest

130- HTTP integration tests with Supertest

131- Test against real database when possible (test containers or in-memory)

132- Test error paths and auth rejection, not just happy paths

133- Coverage target: 80%+

Source & flagged code

7 flagged · loading source

dist/infra/spawn.jsView file

10*/ L11: import { spawn } from 'node:child_process'; L12: import { existsSync, mkdirSync, openSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/infra/spawn.jsView on unpkg · L10

dist/core/shellEnv.jsView file

44try { L45: const output = execSync(`bash -c 'set -a; source "${filePath}" 2>/dev/null; env'`, { encoding: 'utf-8', timeout: 5000 }); L46: return parseEnvOutput(output);

High

Shell

Package source references shell execution.

dist/core/shellEnv.jsView on unpkg · L44

dist/commands/setup.jsView file

201try { L202: execSync(`npm install -g ${adapter.pkg}`, { stdio: ['ignore', 'pipe', 'pipe'], timeout: 120_000 }); L203: log.ok(`Installed ${adapter.name}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/setup.jsView on unpkg · L201

20*/ L21: import { execSync } from 'node:child_process'; L22: import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, readlinkSync, unlinkSync, writeFileSync } from 'node:fs'; ... L26: import { Logger } from '../core/logger.js'; L27: const HOME = process.env.HOME || '/home/coral'; L28: const ENV_PATH = resolve(HOME, '.coral', 'env'); ... L31: function createPrompt() { L32: const rl = createInterface({ input: process.stdin, output: process.stdout }); L33: return { ... L59: console.log(' Supports Markdown PM backend, GitLab/GitHub, Claude (via ACP), Matrix.'); L60: console.log(' https://www.npmjs.com/package/@coralai/sps-cli'); L61: console.log('');

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/setup.jsView on unpkg · L20

profiles/fullstack.mdView file

166patternName = generic_password severity = medium line = 166 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in profiles/fullstack.md

profiles/fullstack.mdView on unpkg · L166

profiles/backend.mdView file

141patternName = generic_password severity = medium line = 141 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in profiles/backend.md

profiles/backend.mdView on unpkg · L141

150patternName = generic_password severity = medium line = 150 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in profiles/backend.md

profiles/backend.mdView on unpkg · L150

Findings

3 High7 Medium6 Low

HighChild Processdist/infra/spawn.js

HighShelldist/core/shellEnv.js

HighRuntime Package Installdist/commands/setup.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/commands/setup.js

MediumStructural Risk Force Deep Review

MediumSecret Patternprofiles/fullstack.md

MediumSecret Patternprofiles/backend.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/infra/spawn.jsView file

Lines 1-30javascript

1/**

2 * @module infra/spawn

3 * @description ProcessSpawner port —— 只用于启动 supervisor（长跑 sps tick 进程）

4 *

5 * @layer infra

6 *

7 * 注意：Console 层禁止用 spawn 执行同步 CLI 操作（如 card add / worker launch）。

8 * 这些都应走 Service 层直接调 Domain。只有 pipeline supervisor 这种长跑 + detach

9 * 的进程才合法用 spawn。

10 */

11import { spawn } from 'node:child_process';

12import { existsSync, mkdirSync, openSync } from 'node:fs';

High

Child Process

Package source references child process execution.

dist/infra/spawn.jsView on unpkg · L10

13import { basename, dirname, resolve } from 'node:path';

14import { fileURLToPath } from 'node:url';

15/**

16 * 定位 CLI 主入口。优先用运行时的 process.argv[1]（作为 sps CLI 运行时就是 sps 可执行文件）；

17 * 但当 SPS 被当作库嵌入到别的进程时（如 game-platform，process.argv[1] 是宿主入口），

18 * 决不能 self-re-exec 宿主 —— 此时回退到由本模块位置算出的 sps 自身入口。

19 */

20function cliEntry() {

21 const node = process.argv[0] ?? 'node';

22 const argvEntry = process.argv[1];

23 if (argvEntry && looksLikeSpsEntry(argvEntry))

24 return { node, entry: argvEntry };

25 return { node, entry: defaultEntry() };

26}

27function looksLikeSpsEntry(p) {

28 const base = basename(p);

29 return (base === 'main.js' ||

30 base === 'main.ts' ||

dist/core/shellEnv.jsView file

Lines 24-64javascript

24 try {

25 const content = readFileSync(filePath, 'utf-8');

26 for (const line of content.split('\n')) {

27 const trimmed =

dist/commands/setup.jsView file

Lines 1-40javascript

1/**

2 * @module setup

3 * @description 全局环境初始化向导，配置 SPS 运行所需的目录、密钥和全局设置

4 *

5 * @author eddy

6 * @organization wykj

7 * @ownership wykj/eddy

8 *

9 * @created 2026-03-19

profiles/fullstack.mdView file

Lines 146-180markdown

146 {error && <p role="alert" className="text-red-600">{error}</p>}

147 <button type="submit" disabled={loading}>{loading ? 'Creating...' : 'Create'}</button>

148 </form>

149 );

150}

151```

152

153# Testing

154

155- Unit tests: services, validators (Vitest/Jest)

156- Integration tests: API endpoints with Supertest

157- Component tests: React Testing Library

158

profiles/backend.mdView file

Lines 121-164markdown

121 deleted_at TIMESTAMPTZ NULL

122);

123

124CREATE INDEX idx_users_email ON users(email) WHERE deleted_at IS NULL;

125```

126

127# Testing

128

129- Default test runner: Vitest or Jest

130- HTTP integration tests with Supertest

131- Test against real database when possible (test containers or in-memory)

132- Test error paths and auth rejection, not just happy paths

133- Coverage target: 80%+

Lines 181-221javascript

181 } // closes: if (!existsSync(ENV_PATH) || flags.force)

182 } // closes: Step 2 block

183 // ─── Step 3: 收全局 skill 污染(P0.5)——清理早前灌进 ~/.claude/skills 的 sps 全量软链 ──

184 // sps 不再做全局全量投影;skills 经 HQ + 项目级 gated 投影生效(见 pruneGlobalSkillLinks)。

185 {

186 const pruned = pruneGlobalSkillLinks(log);

187 if (pruned > 0)

188 log.ok(`Cleaned ${pruned} legacy global skill link(s) from ~/.claude/skills`);

189 else

190 log.info('No legacy global skill links to clean');

191 }

192 // ─── Step 4: Install claude-agent-acp adapter globally ──────────

193 {

194 const adapter = { name: 'claude-agent-acp', pkg: '@agentclientprotocol/claude-agent-acp' };

195 try {

196 execSync(`which ${adapter.name}`, { stdio: 'ignore' });

197 log.ok(`${adapter.name} already installed`);

198 }

199 catch {

200 log.info(`Installing ${adapter.name}...`);

201 try {

202 execSync(`npm install -g ${adapter.pkg}`, { stdio: ['ignore', 'pipe', 'pipe'], timeout: 120_000 });

203 log.ok(`Installed ${adapter.name}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/setup.jsView on unpkg · L201

204 }

205 catch (err) {

206 const msg = err instanceof Error ? err.message : String(err);

207 log.warn(`Failed to install ${adapter.name}: ${msg}`);

208 log.info(` You can install manually: npm install -g ${adapter.pkg}`);

209 }

210 }

211 }

212 // ─── Summary ───────────────────────────────────────────────────

213 console.log('\n Setup complete! Next steps:\n');

214 console.log(' 1. Source the env file:');

215 console.log(` source ${ENV_PATH}`);

216 console.log('');

217 console.log(' 2. (Optional) Auto-load on shell startup:');

218 console.log(` echo 'source ${ENV_PATH}' >> ~/.bashrc`);

219 console.log('');

220 console.log(' 3. Initialize your first project:');

221 console.log(' sps project init <project-name>');