@coro-ai/runner@0.1.34: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@coro-ai/runner@0.1.34: Suspicious npm security report (Warn) | LPM Firewall

dist/cli/commands/plugin.jsView file

Lines 34-74javascript

34 var ownKeys = function(o) {

35 ownKeys = Object.getOwnPropertyNames || function (o) {

36 var ar = [];

37 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

38 return ar;

39 };

40 return ownKeys(o);

41 };

42 return function (mod) {

43 if (mod && mod.__esModule) return mod;

44 var result = {};

45 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

46 __setModuleDefault(result, mod);

47 return result;

48 };

49})();

50Object.defineProperty(exports, "__esModule", { value: true });

51exports.pluginCommand = void 0;

52const fs = __importStar(require("node:fs"));

53const path = __importStar(require("node:path"));

54const os = __importStar(require("node:os"));

55const node_child_process_1 = require("node:child_process");

56const commander_1 = require("commander");

High

Child Process

Package source references child process execution.

dist/cli/commands/plugin.jsView on unpkg · L54

57const http_1 = require("../http");

58const SDK_VERSION = '^0.1.0';

59const HOST_VERSION_RANGE = '^1.0.0';

60function dropinRoot() {

61 return path.join(os.homedir(), '.coro', 'plugins');

62}

63// ── coro plugin init ────────────────────────────────────────────────────────

64const initCmd = new commander_1.Command('init')

65 .description('Scaffold a new Coro plugin under ~/.coro/plugins/<id>/')

66 .argument('<id>', 'Plugin id (e.g. "gitlab"). Lowercase, kebab-case recommended.')

67 .option('--kind <kind>', 'Plugin kind: scm or tracker', 'scm')

68 .action(async (id, opts) => {

69 if (!/^[a-z0-9][a-z0-9-]*$/i.test(id)) {

70 (0, http_1.die)(`Plugin id "${id}" should be lowercase, kebab-case, and start with [a-z0-9].`);

71 }

72 if (opts.kind !== 'scm' && opts.kind !== 'tracker') {

73 (0, http_1.die)(`--kind must be "scm" or "tracker" (got "${opts.kind}").`);

74 }

dist/cli/browser-open.jsView file

Lines 2-42javascript

2// ── CLI → Browser auto-open ──────────────────────────────────────────────────

3//

4// Helper that opens the Coro dashboard in the user's default browser once

5// the runner's local HTTP server is actually accepting connections.

6//

7// Two reasons this isn't a one-line `child_process.exec('open …')`:

8//

9// 1. We have to wait until the server is listening, otherwise the browser

10// lands on `ERR_CONNECTION_REFUSED`. We poll `/health` and only open

11// after a successful 200.

12//

13// 2. We must not open a browser in headless contexts (CI runners, SSH

14// sessions on a server, Docker containers, Linux desktops with no

15// $DISPLAY). The `--no-open` flag lets users opt out unconditionally;

16// the heuristics below let us auto-skip in obvious headless cases.

17var __importDefault = (this && this.__importDefault) || function (mod) {

18 return (mod && mod.__esModule) ? mod : { "default": mod };

19};

20Object.defineProperty(exports, "__esModule", { value: true });

21exports.__test = void 0;

22exports.maybeOpenBrowser = maybeOpenBrowser;

23const child_process_1 = require("child_process");

24const http_1 = __importDefault(require("http"));

25/**

26 * Heuristic: are we in an environment where opening a browser would either

27 * fail silently or surprise the user?

28 *

29 * We bias toward "open it" — false positives waste a browser tab, false

30 * negatives leave the user staring at a terminal wondering what to do.

31 */

32function looksHeadless(env = process.env) {

33 if (env.CORO_NO_OPEN === '1' || env.CORO_NO_OPEN === 'true')

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/browser-open.jsView on unpkg · L22

34 return true;

35 if (env.CI === 'true' || env.CI === '1')

36 return true;

37 if (env.SSH_CONNECTION || env.SSH_CLIENT || env.SSH_TTY)

38 return true;

39 // Linux desktop typically sets DISPLAY (X11) or WAYLAND_DISPLAY.

40 if (process.platform === 'linux' && !env.DISPLAY && !env.WAYLAND_DISPLAY)

41 return true;

42 return false;