registry / @glissade/cli / 0.67.0

@glissade/cli@0.67.0

glissade CLI: headless rendering via backend-skia (+ FFmpeg mux).

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsTelemetry

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 397 KB of source

Source & flagged code

2 flagged

dist/describeLint.jsView file

Lines 283-321javascript

283* (`@glissade/backend-canvas2d/snapshot`, `@glissade/element`) are NOT CLI deps —

284* importing them throws, so those specifiers are collected into `unreachable` and

285* the caller exempts the helpers they'd have provided. (The `check:describe` CI

286* gate injects the built `@glissade/browser` bundle instead, so it verifies those

287* too.)

288*/

289async function collectRuntimeSurface(manifest) {

290 const modules = new Set([

291 "@glissade/core",

292 "@glissade/core/clips",

293 "@glissade/scene",

294 "@glissade/scene/describe",

295 "@glissade/scene/diagnostics",

296 "@glissade/scene/recipes",

297 "@glissade/scene/layout-ctors",

298 "@glissade/scene/path"

299 ]);

300 for (const h of manifest.helpers) modules.add(h.import);

301 const surface = {};

302 const unreachable = /* @__PURE__ */ new Set();

303 for (const spec of modules) try {

304 Object.assign(surface, await import(spec));

305 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/describeLint.jsView on unpkg · L303

306 unreachable.add(spec);

307 }

308 return {

309 surface,

310 unreachable

311 };

312}

313/** The exempt name-set for a headless lint: helper names whose import module was unreachable. */

314function exemptFromUnreachable(manifest, unreachable) {

315 const exempt = /* @__PURE__ */ new Set();

316 for (const h of manifest.helpers) if (unreachable.has(h.import)) exempt.add(h.name);

317 return exempt;

318}

319//#endregion

320export { collectRuntimeSurface, describeLint, exemptFromUnreachable };

321

dist/critique.jsView file

Lines 1-39javascript

1import { o as loadSceneModule } from "./render.js";

2import { critique } from "@glissade/scene/diagnostics";

3//#region src/critique.ts

4/**

5* `gs critique <scene-module>` (0.60): machine-readable RENDERED diagnostics from

6* the DisplayList — the rendered-geometric half of `gs describe --lint` /

7* validateScene. Loads the scene, injects the Skia measurer (so TEXT_OVERFLOW

8* measures with the same metrics `gs render` lays out with), runs `critique`, and

Source & flagged code

2 flagged · loading source

dist/describeLint.jsView file

303for (const spec of modules) try { L304: Object.assign(surface, await import(spec)); L305: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/describeLint.jsView on unpkg · L303

dist/critique.jsView file

19package = @glissade/cli; repositoryIdentity = glissade; dependency = @glissade/backend-skia L19: const scene = mod.createScene(); L20: const { SkiaBackend } = await import("@glissade/backend-skia"); L21: scene.setTextMeasurer(new SkiaBackend(scene.size.w, scene.size.h));

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/critique.jsView on unpkg · L19

Findings

1 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/critique.js

MediumDynamic Requiredist/describeLint.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

Source & flagged code

2 flagged

dist/describeLint.jsView file

Lines 283-321javascript

283* (`@glissade/backend-canvas2d/snapshot`, `@glissade/element`) are NOT CLI deps —

284* importing them throws, so those specifiers are collected into `unreachable` and

285* the caller exempts the helpers they'd have provided. (The `check:describe` CI

286* gate injects the built `@glissade/browser` bundle instead, so it verifies those

287* too.)

288*/

289async function collectRuntimeSurface(manifest) {

290 const modules = new Set([

291 "@glissade/core",

292 "@glissade/core/clips",

293 "@glissade/scene",

294 "@glissade/scene/describe",

295 "@glissade/scene/diagnostics",

296 "@glissade/scene/recipes",

297 "@glissade/scene/layout-ctors",

298 "@glissade/scene/path"

299 ]);

300 for (const h of manifest.helpers) modules.add(h.import);

301 const surface = {};

302 const unreachable = /* @__PURE__ */ new Set();

303 for (const spec of modules) try {

304 Object.assign(surface, await import(spec));

305 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/describeLint.jsView on unpkg · L303

306 unreachable.add(spec);

307 }

308 return {

309 surface,

310 unreachable

311 };

312}

313/** The exempt name-set for a headless lint: helper names whose import module was unreachable. */

314function exemptFromUnreachable(manifest, unreachable) {

315 const exempt = /* @__PURE__ */ new Set();

316 for (const h of manifest.helpers) if (unreachable.has(h.import)) exempt.add(h.name);

317 return exempt;

318}

319//#endregion

320export { collectRuntimeSurface, describeLint, exemptFromUnreachable };

321

dist/critique.jsView file

Lines 1-39javascript

1import { o as loadSceneModule } from "./render.js";

2import { critique } from "@glissade/scene/diagnostics";

3//#region src/critique.ts

4/**

5* `gs critique <scene-module>` (0.60): machine-readable RENDERED diagnostics from

6* the DisplayList — the rendered-geometric half of `gs describe --lint` /

7* validateScene. Loads the scene, injects the Skia measurer (so TEXT_OVERFLOW

8* measures with the same metrics `gs render` lays out with), runs `critique`, and