@danypops/papyrus@0.11.1: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

@danypops/papyrus@0.11.1: Suspicious npm security report (Warn) | LPM Firewall

src/task-service.tsView file

Lines 104-144typescript

104 rootIds: string[];

105 scope?: TaskViewSelection;

106}

107

108const TASK_TRANSITIONS: Record<TaskTransition, { from: TaskStatus[]; to: TaskStatus }> = {

109 start: { from: ["todo"], to: "in-progress" },

110 submit: { from: ["in-progress"], to: "review" },

111 reject: { from: ["review"], to: "rejected" },

112 retry: { from: ["rejected"], to: "in-progress" },

113 cancel: { from: ["todo", "in-progress", "review", "rejected"], to: "canceled" },

114};

115

116export class Tasks {

117 constructor(

118 private readonly artifacts: ArtifactStore,

119 private readonly gates: GateRunner,

120 private readonly focusStore: TaskFocusStore = new InMemoryTaskFocusStore(),

121 private readonly events: TaskEventStore = new InMemoryTaskEventStore(),

122 private readonly scopes: TaskScopeStore = new InMemoryTaskScopeStore(),

123 ) {}

124

125 private require(id: string): Artifact {

126 const artifact = this.artifacts.get(id);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/task-service.tsView on unpkg · L124

127 if (!artifact) throw new Error(`task artifact "${id}" not found`);

128 if (artifact.kind !== "task") throw new Error(`artifact "${id}" is not a task`);

129 return artifact;

130 }

131

132 create(input: CreateTaskInput, context: TaskEventContext = {}): Artifact {

133 return this.events.atomic(() => {

134 if ((input.dependsOn?.length ?? 0) > TASK_EXECUTION_MAX_DEGREE) {

135 throw new Error(`task cannot exceed ${TASK_EXECUTION_MAX_DEGREE} prerequisites`);

136 }

137 if (input.parentId) this.require(input.parentId);

138 for (const dependency of input.dependsOn ?? []) this.require(dependency);

139 const extra: Record<string, unknown> = { ...(input.extra ?? {}) };

140 if (input.gates !== undefined) extra["gates"] = input.gates;

141 if (input.checklist !== undefined) extra["checklist"] = validateChecklist(input.checklist);

142 const projectRoot = input.projectRoot === undefined ? undefined : normalizeProjectRoot(input.projectRoot);

143 if (input.parentId && this.scopes.get(input.parentId)?.projectRoot !== projectRoot) {

144 throw new Error(`parent task "${input.parentId}" is outside project scope`);

src/ops.tsView file

Lines 286-326typescript

286 try {

287 const content = readBoundedGateFile(gate.target);

288 const found = gate.expect ? content.includes(gate.expect) : content.length > 0;

289 return { gate, passed: found, output: found ? "found" : `"${gate.expect ?? ""}" not found` };

290 } catch {

291 return { gate, passed: false, output: "file not readable" };

292 }

293 }

294 case "command": {

295 const { execSync } = require_("node:child_process");

296 try {

297 const output = execSync(gate.target, { encoding: "utf-8", timeout: GATE_COMMAND_TIMEOUT_MS, stdio: ["pipe", "pipe", "pipe"] }).trim();

298 const passed = gate.expect ? output.includes(gate.expect) : true;

299 return { gate, passed, output: output.slice(0, GATE_OUTPUT_LIMIT) };

300 } catch (e) {

301 return { gate, passed: false, output: e instanceof Error ? e.message.slice(0, GATE_OUTPUT_LIMIT) : "command failed" };

302 }

303 }

304 case "test": {

305 const { execSync } = require_("node:child_process");

306 try {

307 execSync(`npx vitest run ${gate.target} --reporter=dot`, { encoding: "utf-8", timeout: GATE_TEST_TIMEOUT_MS, stdio: ["pipe", "pipe", "pipe"] });

308 return { gate, passed: true, output: "tests passed" };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/ops.tsView on unpkg · L306

309 } catch (e) {

310 return { gate, passed: false, output: e instanceof Error ? e.message.slice(0, GATE_OUTPUT_LIMIT) : "tests failed" };

311 }

312 }

313 default:

314 return { gate, passed: false, output: `unknown gate type: ${String(gate.type)}` };

315 }

316 });

317}

318

319function executeGateCommand(command: string, timeout: number): Promise<{ passed: boolean; output: string }> {

320 return new Promise((resolve) => {

321 exec(command, { encoding: "utf8", timeout, maxBuffer: GATE_MAX_BUFFER_BYTES }, (error, stdout, stderr) => {

322 const output = `${stdout}${stderr}`.trim().slice(0, GATE_OUTPUT_LIMIT);

323 resolve({

324 passed: error === null,

325 output: output || (error ? error.message.slice(0, GATE_OUTPUT_LIMIT) : "ok"),

326 });