registry / @deftai/directive-core / 0.69.0

@deftai/directive-core@0.69.0

TypeScript engine core for the Directive framework.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 517 file(s), 2.71 MB of source, external domains: api.github.com, cli.github.com, docs.astral.sh, example.com, git-scm.com, github.com, taskfile.dev, www.python.org

Source & flagged code

2 flagged

dist/vbrief-validation/validation.jsView file

Lines 68-108javascript

68 return [[`${vbriefDir}: expected vbrief directory does not exist`], []];

69 }

70 const [errors, warnings] = validateAllMigration(vbriefDir);

71 return [[...errors], [...warnings]];

72}

73/** Move the emitted ``vbrief/`` tree to ``vbrief.invalid/`` on failure. */

74export function isolateInvalidOutput(projectRoot, vbriefDir) {

75 if (!existsSync(vbriefDir)) {

76 return null;

77 }

78 let target = join(projectRoot, "vbrief.invalid");

79 let idx = 1;

80 while (existsSync(target)) {

81 idx += 1;

82 target = join(projectRoot, `vbrief.invalid.${idx}`);

83 }

84 renameSync(vbriefDir, target);

85 return target;

86}

87/** Run validation + isolation as the migrator's terminal gate (#498). */

88export function finalizeMigration(projectRoot, vbriefDir, actions, options = {}) {

89 const stderrWriter = options.stderrWriter ?? ((chunk) => process.stderr.write(chunk));

90 const isolateFn = options.isolateInvalid ?? isolateInvalidOutput;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/vbrief-validation/validation.jsView on unpkg · L88

91 const [errors, warnings] = validateMigrationOutput(vbriefDir);

92 if (errors.length === 0) {

93 for (const w of warnings) {

94 stderrWriter(`WARNING: ${w}\n`);

95 }

96 return [true, actions];

97 }

98 stderrWriter(`ERROR: Migration produced invalid output (${errors.length} file-level error(s)):\n`);

99 for (const err of errors) {

100 stderrWriter(` ${err}\n`);

101 }

102 const invalidDir = isolateFn(projectRoot, vbriefDir);

103 const failureActions = [...actions];

104 failureActions.push(`FAIL migration produced ${errors.length} schema validation error(s)`);

105 for (const err of errors) {

106 failureActions.push(` ${err}`);

107 }

108 if (invalidDir !== null) {

dist/scm/binary.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { BINARY_PREFERENCE } from "./constants.js";

3import { ScmStubError } from "./errors.js";

4/** Default PATH lookup mirroring Python `shutil.which`. Uses the

5 * platform-native resolver (`where` on Windows, `which` elsewhere) so

6 * executable resolution works cross-platform. */

7export function

Source & flagged code

2 flagged · loading source

dist/vbrief-validation/validation.jsView file

88export function finalizeMigration(projectRoot, vbriefDir, actions, options = {}) { L89: const stderrWriter = options.stderrWriter ?? ((chunk) => process.stderr.write(chunk)); L90: const isolateFn = options.isolateInvalid ?? isolateInvalidOutput;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/vbrief-validation/validation.jsView on unpkg · L88

dist/scm/binary.jsView file

1import { execFileSync } from "node:child_process"; L2: import { BINARY_PREFERENCE } from "./constants.js"; ... L7: export function defaultWhich(name) { L8: const locator = process.platform === "win32" ? "where" : "which"; L9: try { ... L32: throw new ScmStubError("neither 'ghx' nor 'gh' found on PATH; install GitHub CLI " + L33: "(https://cli.github.com/) or the ghx proxy (#884)"); L34: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/scm/binary.jsView on unpkg · L1

Findings

1 High3 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/scm/binary.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/vbrief-validation/validation.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/vbrief-validation/validation.jsView file

Lines 68-108javascript

68 return [[`${vbriefDir}: expected vbrief directory does not exist`], []];

69 }

70 const [errors, warnings] = validateAllMigration(vbriefDir);

71 return [[...errors], [...warnings]];

72}

73/** Move the emitted ``vbrief/`` tree to ``vbrief.invalid/`` on failure. */

74export function isolateInvalidOutput(projectRoot, vbriefDir) {

75 if (!existsSync(vbriefDir)) {

76 return null;

77 }

78 let target = join(projectRoot, "vbrief.invalid");

79 let idx = 1;

80 while (existsSync(target)) {

81 idx += 1;

82 target = join(projectRoot, `vbrief.invalid.${idx}`);

83 }

84 renameSync(vbriefDir, target);

85 return target;

86}

87/** Run validation + isolation as the migrator's terminal gate (#498). */

88export function finalizeMigration(projectRoot, vbriefDir, actions, options = {}) {

89 const stderrWriter = options.stderrWriter ?? ((chunk) => process.stderr.write(chunk));

90 const isolateFn = options.isolateInvalid ?? isolateInvalidOutput;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/vbrief-validation/validation.jsView on unpkg · L88

91 const [errors, warnings] = validateMigrationOutput(vbriefDir);

92 if (errors.length === 0) {

93 for (const w of warnings) {

94 stderrWriter(`WARNING: ${w}\n`);

95 }

96 return [true, actions];

97 }

98 stderrWriter(`ERROR: Migration produced invalid output (${errors.length} file-level error(s)):\n`);

99 for (const err of errors) {

100 stderrWriter(` ${err}\n`);

101 }

102 const invalidDir = isolateFn(projectRoot, vbriefDir);

103 const failureActions = [...actions];

104 failureActions.push(`FAIL migration produced ${errors.length} schema validation error(s)`);

105 for (const err of errors) {

106 failureActions.push(` ${err}`);

107 }

108 if (invalidDir !== null) {

dist/scm/binary.jsView file

Lines 1-21javascript

1import { execFileSync } from "node:child_process";

2import { BINARY_PREFERENCE } from "./constants.js";

3import { ScmStubError } from "./errors.js";

4/** Default PATH lookup mirroring Python `shutil.which`. Uses the

5 * platform-native resolver (`where` on Windows, `which` elsewhere) so

6 * executable resolution works cross-platform. */

7export function