registry / @dreamlake/lakeshore / 0.2.0

@dreamlake/lakeshore@0.2.0

Lakeshore — compute launch and management CLI. The `lakeshore` command registers providers, dispatches smoke tests, and manages worker daemons against a Lakeshore control plane.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 155 file(s), 707 KB of source, external domains: api.dreamlake.ai, auth.vuer.ai, docs.docker.com, kubernetes.io, pub-c0109e197b4a4d1abe5884ac4dd3a023.r2.dev

Source & flagged code

6 flagged

dist/cli/docker/discover.jsView file

Lines 1-22javascript

1// `lakeshore docker discover` — list local Docker contexts.

2// Read-only: invokes `docker context ls --format json` once.

3import { spawnSync } from "node:child_process";

4import { emitJson, ok, warn } from "../helpers.js";

High

Child Process

Package source references child process execution.

dist/cli/docker/discover.jsView on unpkg · L2

5import { discoverDockerContexts } from "./parser.js";

6const ACTIVE_MARKER = "[active]";

7export async function runDockerDiscover(opts = {}) {

8 const contexts = discoverDockerContexts();

9 if (opts.json) {

10 emitJson(contexts.map(serializeForJson));

11 return 0;

12 }

13 if (contexts.length === 0) {

14 if (!dockerOnPath()) {

15 warn("docker not found on PATH — install Docker to detect contexts");

16 process.stdout.write(" (see https://docs.docker.com/get-docker/ for install steps)\n");

17 }

18 else {

19 warn("no Docker contexts returned (docker installed but daemon may be unreachable)");

20 process.stdout.write(" (try `docker context ls` directly to debug)\n");

21 }

22 return 0;

bin/lakeshore.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2// `lakeshore` CLI entry. Picks the compiled JS if present (production

3// install), else falls back to the TS source — imported directly under

4// Bun (which executes TypeScript natively), or through the tsx loader

5// under Node (workspace dev — no `pnpm build` required).

7import { existsSync } from "node:fs";

8import { fileURLToPath, pathToFileURL } from

dist/cli/dreamlake/auth.jsView file

Lines 1-31javascript

1// `lakeshore dreamlake login|logout|profile` — vuer-auth device flow

2// (RFC 8628) + token storage. Ported from dreamlake-py's

3// cli_commands/{login,logout,profile}.py and auth/device_flow.py.

4//

5// Differences from the Python CLI (deliberate):

6// * Token lands in ~/.dreamlake/auth.yml (0600) instead of the OS

7// keyring — headless-friendly, greppable, same policy as

8// `lakeshore auth`.

9// * No ASCII QR code (the URL + code print instead).

10// The device secret in ~/.dreamlake/config.json is SHARED with the

dist/cli/daemon/install.jsView file

Lines 11-51javascript

11// - detects target triple (x86_64-unknown-linux-gnu / aarch64-...)

12// - curls nymph from the R2 release bucket into ~/.local/bin/nymph

13// - drops ~/.config/dreamlake/{token,udf-daemon.toml}

14// - launches via `setsid nohup ... &; disown` (or `sbatch` under

15// --slurm).

16// 4. Optionally poll GET /v1/namespaces/:ns/workers until a worker

17// with the matching label shows up (60 s timeout, --no-wait skips).

18//

19// We deliberately don't shell out to bash locally — `child_process.spawn`

20// invokes ssh directly with argv and writes the heredoc body to stdin.

src/cli/scripts/hello.pyView file

•path = src/cli/scripts/hello.py kind = build_helper sizeBytes = 578 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

src/cli/scripts/hello.pyView on unpkg

Source & flagged code

6 flagged · loading source

dist/cli/docker/discover.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code