registry / @fabric-harness/cli / 2.1.1

@fabric-harness/cli@2.1.1

Fabric Harness command-line interface (fabric-harness, fh) — run, build, deploy, inspect agents.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 305 KB of source, external domains: adb-1234567890.0.cloud.databricks.com, api.daytona.io, bigquery.googleapis.com, cli.github.com, docs.databricks.com, e2b.dev, example.com, github.com, harness.fabric.pro, hooks.slack.com, http-intake.logs, raw.githubusercontent.com, your-resource.openai.azure.com

Source & flagged code

4 flagged

dist/bin/fabric-harness.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/bin/fabric-harness.jsView on unpkg · L1

4import { promises as fs, watch } from "node:fs";

5import { createRequire } from "node:module";

6import path from "node:path";

7import { parseEnv } from "node:util";

8import { Command } from "commander";

9import { costCommand } from "../src/cost.js";

10import { runDatabricksDoctorChecks } from "../src/doctor-databricks.js";

11import { telemetryStatusCommand } from "../src/telemetry-status.js";

12import { deployCommand } from "../src/deploy.js";

13import { runRecipe } from "../src/recipes/index.js";

14import { runInteractiveInit } from "../src/init-interactive.js";

15import { renderError, FabricHarnessError, suggestSimilar } from "../src/errors.js";

16import { brand, brandRows, buildSummaryBanner, cliHeader, deploySummaryBanner, devServerBanner, error as terminalError, note, setGlobalNoColor, success, warn, } from "../src/terminal.js";

17import { findAvailablePort } from "../src/dev-server.js";

18import { applyEnvModelProvider, buildWorkspace, cancelTaskInStore, compactSessionInStore, createConfiguredSessionStore, describeAgentFile, findWorkspaceRoot, forkSessionAtStep, getMetricsFromStore, getRequiredAgentDefinition, getTaskFromStore, inspectReplayFromStore, inspectSessionFromStore, listAgentSummaries, listApprovalStatesFromStore, listApprovalsFromStore, listBuilds, listCheckpointsFromStore, listSessionSummariesFromStore, listTasksFromStore, loadAgentModule, createPersistentDispatchProcessor, loadFabricHarnessConfig, resolveAgentPath, resolveApprovalInStore, runAgent, startDevServer, ...

19import { FileSessionStore } from "@fabric-harness/node";

20import { EmptySandboxEnv, SchemaValidationError, createBuiltinTools, createFabricFs, resolveModelProvider, toolsToModelSchemas, } from "@fabric-harness/sdk";

21import { runEvalSuite } from "@fabric-harness/evals";

Long lines were clipped for display.

Lines 1126-1166javascript

1126 "",

1127 "This project uses [Fabric Harness](https://github.com/Fabric-Pro/fabric-harness) with Azure OpenAI.",

1128 "",

1129 "## Quickstart",

1130 "",

1131 "```sh",

1132 "cp .env.example .env",

1133 "# Edit .env with your Azure OpenAI credentials",

dist/src/deploy/targets.jsView file

Lines 62-102javascript

62 ctx.logger.log("[preview] Required env vars:");

63 ctx.logger.log(" DATABRICKS_HOST");

64 ctx.logger.log(" DATABRICKS_CLIENT_ID");

65 ctx.logger.log(" DATABRICKS_CLIENT_SECRET");

66 ctx.logger.log("");

67 ctx.logger.log(

dist/src/deploy/cloudflare.jsView file

Lines 1-32javascript

1import { promises as fs, existsSync } from "node:fs";

2import path from "node:path";

3import { buildWorkspace } from "@fabric-harness/node";

4export class CloudflareDriver {

5 name = "cloudflare"

Source & flagged code

4 flagged · loading source

dist/bin/fabric-harness.jsView file

1#!/usr/bin/env node L2: import { spawn } from "node:child_process"; L3: import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/bin/fabric-harness.jsView on unpkg · L1

1146async function loadCliVersion() { L1147: return (await import("../src/terminal.js")).loadCliVersion(); L1148: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/bin/fabric-harness.jsView on unpkg · L1146

dist/src/deploy/targets.jsView file

82stdio: "inherit", L83: shell: true, L84: env: process.env,

High

Shell

Package source references shell execution.

dist/src/deploy/targets.jsView on unpkg · L82

dist/src/deploy/cloudflare.jsView file

12ctx.logger.log(" npx wrangler deploy --dry-run"); L13: ctx.logger.log(" (live: npx wrangler deploy)"); L14: if (envName) { ... L27: const wranglerPath = await this.resolveWranglerPath(outDir); L28: const { spawn } = await import("node:child_process"); L29: const command = "npx wrangler deploy";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/deploy/cloudflare.jsView on unpkg · L12

Findings

3 High4 Medium4 Low

HighChild Processdist/bin/fabric-harness.js

HighShelldist/src/deploy/targets.js

HighRuntime Package Installdist/src/deploy/cloudflare.js

MediumDynamic Requiredist/bin/fabric-harness.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/bin/fabric-harness.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawn } from "node:child_process";

3import { randomUUID } from "node:crypto";

High

Child Process

Package source references child process execution.

dist/bin/fabric-harness.jsView on unpkg · L1

4import { promises as fs, watch } from "node:fs";

5import { createRequire } from "node:module";

6import path from "node:path";

7import { parseEnv } from "node:util";

8import { Command } from "commander";

9import { costCommand } from "../src/cost.js";

10import { runDatabricksDoctorChecks } from "../src/doctor-databricks.js";

11import { telemetryStatusCommand } from "../src/telemetry-status.js";

12import { deployCommand } from "../src/deploy.js";

13import { runRecipe } from "../src/recipes/index.js";

14import { runInteractiveInit } from "../src/init-interactive.js";

15import { renderError, FabricHarnessError, suggestSimilar } from "../src/errors.js";

16import { brand, brandRows, buildSummaryBanner, cliHeader, deploySummaryBanner, devServerBanner, error as terminalError, note, setGlobalNoColor, success, warn, } from "../src/terminal.js";

17import { findAvailablePort } from "../src/dev-server.js";

19import { FileSessionStore } from "@fabric-harness/node";

20import { EmptySandboxEnv, SchemaValidationError, createBuiltinTools, createFabricFs, resolveModelProvider, toolsToModelSchemas, } from "@fabric-harness/sdk";

21import { runEvalSuite } from "@fabric-harness/evals";

Long lines were clipped for display.

Lines 1126-1166javascript

1126 "",

1127 "This project uses [Fabric Harness](https://github.com/Fabric-Pro/fabric-harness) with Azure OpenAI.",

1128 "",

1129 "## Quickstart",

1130 "",

1131 "```sh",

1132 "cp .env.example .env",

1133 "# Edit .env with your Azure OpenAI credentials",

dist/src/deploy/targets.jsView file

Lines 62-102javascript

62 ctx.logger.log("[preview] Required env vars:");

63 ctx.logger.log(" DATABRICKS_HOST");

64 ctx.logger.log(" DATABRICKS_CLIENT_ID");

65 ctx.logger.log(" DATABRICKS_CLIENT_SECRET");

66 ctx.logger.log("");

67 ctx.logger.log(

dist/src/deploy/cloudflare.jsView file

Lines 1-32javascript

1import { promises as fs, existsSync } from "node:fs";

2import path from "node:path";

3import { buildWorkspace } from "@fabric-harness/node";

4export class CloudflareDriver {

5 name = "cloudflare"