registry / @dforce2055/dai / 0.3.1

@dforce2055/dai@0.3.1

Metodología de desarrollo asistido por IA — CLI de acciones deterministas (trazabilidad QUÉ↔CÓMO).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 15 file(s), 87.8 KB of source, external domains: api.clickup.com, api.github.com, app.clickup.com, github.com

Source & flagged code

3 flagged

cli/dai.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// dai · CLI de acciones deterministas de la metodología (ADR-0002, capa 2).

3// Lo mecánico vive acá, no en la inteligencia del asistente: así el output es

4// idéntico con Claude, con Copilot, o sin ningún asistente.

5//

6// Uso:

7// dai ac-hash <us.md> Calcula el ac_hash de una US (ADR-0001). Sin archivo, stdin.

8// dai ls [--json] [--root <d>] Lista las US que implementa el repo (ADR-0005).

9// dai link-us <KEY> --us <md> Crea branch + implements.yaml atados al KEY (ADR-0004).

10// [--repo r] [--change c] [--title t] [--autor a] [--base b] [--dry-run]

11// dai version

12//

13// El link del tracker sale de DAI_TRACKER_URL_TEMPLATE (p. ej. "https://jira/browse/{id}").

15import { readFileSync, writeFileSync, mkdirSync, mkdtempSync, existsSync, rmSync, cpSync, readdirSync, statSync } from "node:fs";

16import { fileURLToPath } from "node:url";

17import { dirname, join, basename, relative } from "node:path";

18import { homedir, tmpdir } from "node:os";

19import { execFileSync } from "node:child_process";

20import { createInterface } from "node:readline/promises";

High

Child Process

Package source references child process execution.

cli/dai.mjsView on unpkg · L18

21import { acHash } from "./lib/ac-hash.mjs";

22import { discoverImplements, isPlaceholderId } from "./lib/implements.mjs";

23import { isValidKey, slugify, branchName, extractTitle, renderImplementsYaml } from "./lib/link-us.mjs";

24import { loadEnv } from "./lib/env.mjs";

25import { getAdapter, coverageStatus, statusLabel } from "./lib/pm-adapter.mjs";

26import { branchUrl, commitUrl, parseRemote, detectForge } from "./lib/forge-url.mjs";

27import { parsePrRef, getPR, postComment } from "./lib/forge-api.mjs";

28import { composePrBody, prTitle, forgeTool } from "./lib/pr.mjs";

29import { dirsEqual } from "./lib/fsutil.mjs";

30import { parseFlags, parseAssistants, isAssistantToken } from "./lib/args.mjs";

31import { skillToPrompt, skillToCursor, constitution, constitutionCursorRule, envFor, mergeEnv, upsertBlock, reconcileGitignore } from "./lib/bootstrap.mjs";

33const HERE = dirname(fileURLToPath(import.meta.url));

35// No crashear si la salida se pipea a algo que cierra temprano (p. ej. `| head`).

36process.stdout.on("error", (e) => { if (e.code === "EPIPE") process.exit(0); throw e; });

38function fail(msg, code = 1) { process.stderr.write("dai: " + msg + "\n"); process.exit(code); }

Lines 611-651javascript

611 }

612 if (wantCursor) {

613 const dir = join(repo, ".cursor", "skills");

614 mkdirSync(dir, { recursive: true });

615 for (const name of skills) {

616 const src

install.shView file

•path = install.sh kind = build_helper sizeBytes = 763 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Source & flagged code

3 flagged · loading source

cli/dai.mjsView file

18import { homedir, tmpdir } from "node:os"; L19: import { execFileSync } from "node:child_process"; L20: import { createInterface } from "node:readline/promises";

High

Child Process

Package source references child process execution.

cli/dai.mjsView on unpkg · L18

631process.stdout.write("\n"); L632: const openspecPresent = () => { try { execFileSync(npmBin("openspec"), ["--version"], { stdio: "ignore" }); return true; } catch { return false; } }; L633: const osTools = [want.claude && "claude", want.copilot && "github-copilot", want.cursor && "cursor"] L634: .filter(Boolean).join(",") || "claude,github-copilot,cursor"; L635: const osHint = "para sumarlo después: npm i -g @fission-ai/openspec@latest && openspec init --tools " + osTools; L636: if (hasOpenspec) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/dai.mjsView on unpkg · L631

install.shView file

•path = install.sh kind = build_helper sizeBytes = 763 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg

Findings

3 High4 Medium6 Low

HighChild Processcli/dai.mjs

HighShell

HighRuntime Package Installcli/dai.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstall.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

3 flagged

cli/dai.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// dai · CLI de acciones deterministas de la metodología (ADR-0002, capa 2).

3// Lo mecánico vive acá, no en la inteligencia del asistente: así el output es

4// idéntico con Claude, con Copilot, o sin ningún asistente.

5//

6// Uso:

7// dai ac-hash <us.md> Calcula el ac_hash de una US (ADR-0001). Sin archivo, stdin.

8// dai ls [--json] [--root <d>] Lista las US que implementa el repo (ADR-0005).

9// dai link-us <KEY> --us <md> Crea branch + implements.yaml atados al KEY (ADR-0004).

10// [--repo r] [--change c] [--title t] [--autor a] [--base b] [--dry-run]

11// dai version

12//

13// El link del tracker sale de DAI_TRACKER_URL_TEMPLATE (p. ej. "https://jira/browse/{id}").

15import { readFileSync, writeFileSync, mkdirSync, mkdtempSync, existsSync, rmSync, cpSync, readdirSync, statSync } from "node:fs";

16import { fileURLToPath } from "node:url";

17import { dirname, join, basename, relative } from "node:path";

18import { homedir, tmpdir } from "node:os";

19import { execFileSync } from "node:child_process";

20import { createInterface } from "node:readline/promises";

High

Child Process

Package source references child process execution.

cli/dai.mjsView on unpkg · L18

21import { acHash } from "./lib/ac-hash.mjs";

22import { discoverImplements, isPlaceholderId } from "./lib/implements.mjs";

23import { isValidKey, slugify, branchName, extractTitle, renderImplementsYaml } from "./lib/link-us.mjs";

24import { loadEnv } from "./lib/env.mjs";

25import { getAdapter, coverageStatus, statusLabel } from "./lib/pm-adapter.mjs";

26import { branchUrl, commitUrl, parseRemote, detectForge } from "./lib/forge-url.mjs";

27import { parsePrRef, getPR, postComment } from "./lib/forge-api.mjs";

28import { composePrBody, prTitle, forgeTool } from "./lib/pr.mjs";

29import { dirsEqual } from "./lib/fsutil.mjs";

30import { parseFlags, parseAssistants, isAssistantToken } from "./lib/args.mjs";

31import { skillToPrompt, skillToCursor, constitution, constitutionCursorRule, envFor, mergeEnv, upsertBlock, reconcileGitignore } from "./lib/bootstrap.mjs";

33const HERE = dirname(fileURLToPath(import.meta.url));

35// No crashear si la salida se pipea a algo que cierra temprano (p. ej. `| head`).

36process.stdout.on("error", (e) => { if (e.code === "EPIPE") process.exit(0); throw e; });

38function fail(msg, code = 1) { process.stderr.write("dai: " + msg + "\n"); process.exit(code); }

Lines 611-651javascript

611 }

612 if (wantCursor) {

613 const dir = join(repo, ".cursor", "skills");

614 mkdirSync(dir, { recursive: true });

615 for (const name of skills) {

616 const src

install.shView file

•path = install.sh kind = build_helper sizeBytes = 763 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

install.shView on unpkg