registry / @devflow-tools/cli / 0.8.3

@devflow-tools/cli@0.8.3

⚠ Under review

DevFlow CLI — one command to initialize and manage DevFlow in any project.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 33 file(s), 93.7 KB of source, external domains: github.com

Source & flagged code

4 flagged

bin/devflow.cjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2'use strict';

3//

4// DevFlow CLI launcher — runs on the user's Node, locates the vendored Node 24

5// runtime from @colbymchenry/codegraph (which bundles node:sqlite), and execs

6// the real CLI with it. The user's Node is only ever a launcher.

7//

9var childProcess = require('child_process');

10var path = require('path');

High

Child Process

Package source references child process execution.

bin/devflow.cjsView on unpkg · L8

12var target = process.platform + '-' + process.arch;

13var pkg = '@colbymchenry/codegraph-' + target;

14var isWindows = process.platform === 'win32';

16main();

18function main() {

19 var nodeExe, entry;

21 if (isWindows) {

22 nodeExe = resolveSilent(pkg + '/node.exe');

23 entry = resolveSilent(pkg + '/lib/dist/bin/codegraph.js');

24 if (!nodeExe || !entry) fail();

25 // --liftoff-only keeps WASM grammars off V8's turboshaft tier (avoids Zone OOM on Node >= 22)

26 var args = ['--liftoff-only', entry, resolveEntry()].concat(process.argv.slice(2));

27 var res = childProcess.spawnSync(nodeExe, args, { stdio: 'inherit' });

28 process.exit(res.status === null ? 1 : res.status);

dist/commands/start.jsView file

Lines 57-97javascript

57 if (!ready) {

58 console.log(chalk.yellow(" Server started but health check timed out"));

59 }

60 else {

61 console.log(chalk.green(" Server ready"));

62 }

63 // 3. Start dashboard (unless --no-dashboard)

64 if (!opts.noDashboard) {

65 console.log(chalk.blue("Preparing Dashboard..."));

66 let dashboardInstalled = isDashboardInstalled();

67 if (!dashboardInstalled) {

68 // Download synchronously with progress — avoids binding the dashboard port

69 // with a fallback server, which caused EADDRINUSE on restart (C2/I1/M4).

70 console.log(chalk.blue(" Dashboard not found, downloading..."));

71 try {

72 await ensureDashboardInstalled();

73 console.log(chalk.green(" Dashboard download complete"));

74 dashboardInstalled = isDashboardInstalled();

75 }

76 catch {

77 console.log(chalk.red(" Dashboard download failed"));

78 console.log(chalk.yellow(` You can still use the API at http://localhost:${opts.port}`));

79 console.log(chalk.yellow(" To manually download the dashboard, visit: https://github.com/devflow-tools/devflow"));

80 }

81 }

82 if (dashboardInstalled) {

83 try {

84 const dashboardPath = await ensureDashboardInstalled();

85 const serverPath = join(dashboardPath, "server.js");

86 if (existsSync(serverPath)) {

87 const child = spawn("node", [serverPath], {

88 env: { ...process.env, PORT: String(opts.dashboardPort) },

89 cwd: dashboardPath,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/start.jsView on unpkg · L77

90 stdio: "ignore",

91 detached: true,

92 });

93 if (child.pid) {

94 const dashPidFile = getDashboardPidFile();

95 const dotdev = join(process.cwd(), ".devflow");

96 if (!existsSync(dotdev))

97 mkdirSync(dotdev, { recursive: true });

dist/commands/plugin-guide.jsView file

Lines 30-70javascript

30 // ignore — package.json may not exist

31 }

32 return detected;

33}

34/**

35 * Resolve a user-supplied plugin name to a fully-qualified package name.

36 */

37export function resolvePluginName(name) {

38 const trimmed = name.trim();

39 return trimmed.startsWith("@devflow-tools/") ? trimmed : `@devflow-tools/${trimmed}`;

40}

41/**

42 * Non-interactive plugin installation from a comma-separated list.

43 */

44export async function installPluginsFromList(names) {

45 const plugins = names.split(",").map(resolvePluginName).filter(Boolean);

46 if (plugins.length === 0)

47 return;

48 for (const plugin of plugins) {

49 console.log(`Installing ${plugin}...`);

50 try {

51 execSync(`npm install -g ${plugin}`, { stdio: "inherit" });

52 console.log(`✓ ${plugin}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/plugin-guide.jsView on unpkg · L50

53 }

54 catch {

55 console.error(`✗ Failed to install ${plugin}`);

56 }

57 }

58}

59/**

60 * Interactive plugin installation guide.

61 * Detects project tech stack, recommends compatible plugins, and lets the user

62 * select which ones to install via a checkbox prompt.

63 */

64export async function guidePluginInstallation(projectRoot) {

65 const registry = loadPluginRegistry();

66 if (registry.plugins.length === 0) {

67 console.log("\nNo plugins available. You can install plugins later with:");

68 console.log(" devflow plugin list");

69 console.log(" devflow plugin install <name>\n");

70 return [];

dist/commands/server.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @devflow-tools/cli@0.6.1 matchedIdentity = npm:QGRldmZsb3ctdG9vbHMvY2xp:0.6.1 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/server.jsView on unpkg

Source & flagged code

4 flagged · loading source

bin/devflow.cjsView file

8L9: var childProcess = require('child_process'); L10: var path = require('path');

High

Child Process

Package source references child process execution.

bin/devflow.cjsView on unpkg · L8

dist/commands/start.jsView file

77console.log(chalk.red(" Dashboard download failed")); L78: console.log(chalk.yellow(` You can still use the API at http://localhost:${opts.port}`)); L79: console.log(chalk.yellow(" To manually download the dashboard, visit: https://github.com/devflow-tools/devflow")); ... L86: if (existsSync(serverPath)) { L87: const child = spawn("node", [serverPath], { L88: env: { ...process.env, PORT: String(opts.dashboardPort) }, L89: cwd: dashboardPath,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/start.jsView on unpkg · L77

dist/commands/plugin-guide.jsView file

50try { L51: execSync(`npm install -g ${plugin}`, { stdio: "inherit" }); L52: console.log(`✓ ${plugin}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/plugin-guide.jsView on unpkg · L50

dist/commands/server.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/server.jsView on unpkg

Findings

1 Critical4 High3 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/commands/server.js

HighChild Processbin/devflow.cjs

HighShell

HighSame File Env Network Executiondist/commands/start.js

HighRuntime Package Installdist/commands/plugin-guide.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

bin/devflow.cjsView file

Lines 1-28javascript

1#!/usr/bin/env node

2'use strict';

3//

4// DevFlow CLI launcher — runs on the user's Node, locates the vendored Node 24

5// runtime from @colbymchenry/codegraph (which bundles node:sqlite), and execs

6// the real CLI with it. The user's Node is only ever a launcher.

7//

9var childProcess = require('child_process');

10var path = require('path');

High

Child Process

Package source references child process execution.

bin/devflow.cjsView on unpkg · L8

12var target = process.platform + '-' + process.arch;

13var pkg = '@colbymchenry/codegraph-' + target;

14var isWindows = process.platform === 'win32';

16main();

18function main() {

19 var nodeExe, entry;

21 if (isWindows) {

22 nodeExe = resolveSilent(pkg + '/node.exe');

23 entry = resolveSilent(pkg + '/lib/dist/bin/codegraph.js');

24 if (!nodeExe || !entry) fail();

25 // --liftoff-only keeps WASM grammars off V8's turboshaft tier (avoids Zone OOM on Node >= 22)

26 var args = ['--liftoff-only', entry, resolveEntry()].concat(process.argv.slice(2));

27 var res = childProcess.spawnSync(nodeExe, args, { stdio: 'inherit' });

28 process.exit(res.status === null ? 1 : res.status);

dist/commands/start.jsView file

Lines 57-97javascript

57 if (!ready) {

58 console.log(chalk.yellow(" Server started but health check timed out"));

59 }

60 else {

61 console.log(chalk.green(" Server ready"));

62 }

63 // 3. Start dashboard (unless --no-dashboard)

64 if (!opts.noDashboard) {

65 console.log(chalk.blue("Preparing Dashboard..."));

66 let dashboardInstalled = isDashboardInstalled();

67 if (!dashboardInstalled) {

68 // Download synchronously with progress — avoids binding the dashboard port

69 // with a fallback server, which caused EADDRINUSE on restart (C2/I1/M4).

70 console.log(chalk.blue(" Dashboard not found, downloading..."));

71 try {

72 await ensureDashboardInstalled();

73 console.log(chalk.green(" Dashboard download complete"));

74 dashboardInstalled = isDashboardInstalled();

75 }

76 catch {

77 console.log(chalk.red(" Dashboard download failed"));

78 console.log(chalk.yellow(` You can still use the API at http://localhost:${opts.port}`));

79 console.log(chalk.yellow(" To manually download the dashboard, visit: https://github.com/devflow-tools/devflow"));

80 }

81 }

82 if (dashboardInstalled) {

83 try {

84 const dashboardPath = await ensureDashboardInstalled();

85 const serverPath = join(dashboardPath, "server.js");

86 if (existsSync(serverPath)) {

87 const child = spawn("node", [serverPath], {

88 env: { ...process.env, PORT: String(opts.dashboardPort) },

89 cwd: dashboardPath,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/commands/start.jsView on unpkg · L77

90 stdio: "ignore",

91 detached: true,

92 });

93 if (child.pid) {

94 const dashPidFile = getDashboardPidFile();

95 const dotdev = join(process.cwd(), ".devflow");

96 if (!existsSync(dotdev))

97 mkdirSync(dotdev, { recursive: true });

dist/commands/plugin-guide.jsView file

Lines 30-70javascript

30 // ignore — package.json may not exist

31 }

32 return detected;

33}

34/**

35 * Resolve a user-supplied plugin name to a fully-qualified package name.

36 */

37export function resolvePluginName(name) {

38 const trimmed = name.trim();

39 return trimmed.startsWith("@devflow-tools/") ? trimmed : `@devflow-tools/${trimmed}`;

40}

41/**

42 * Non-interactive plugin installation from a comma-separated list.

43 */

44export async function installPluginsFromList(names) {

45 const plugins = names.split(",").map(resolvePluginName).filter(Boolean);

46 if (plugins.length === 0)

47 return;

48 for (const plugin of plugins) {

49 console.log(`Installing ${plugin}...`);

50 try {

51 execSync(`npm install -g ${plugin}`, { stdio: "inherit" });

52 console.log(`✓ ${plugin}`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/plugin-guide.jsView on unpkg · L50

53 }

54 catch {

55 console.error(`✗ Failed to install ${plugin}`);

56 }

57 }

58}

59/**

60 * Interactive plugin installation guide.

61 * Detects project tech stack, recommends compatible plugins, and lets the user

62 * select which ones to install via a checkbox prompt.

63 */

64export async function guidePluginInstallation(projectRoot) {

65 const registry = loadPluginRegistry();

66 if (registry.plugins.length === 0) {

67 console.log("\nNo plugins available. You can install plugins later with:");

68 console.log(" devflow plugin list");

69 console.log(" devflow plugin install <name>\n");

70 return [];

dist/commands/server.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/server.jsView on unpkg