registry / @glissade/cli / 0.41.1

@glissade/cli@0.41.1

glissade CLI: headless rendering via backend-skia (+ FFmpeg mux).

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsTelemetry

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 264 KB of source

Source & flagged code

1 flagged

dist/build.jsView file

Lines 101-141javascript

101 const d = cfg.defaults ?? {};

102 return {

103 ...d.narration !== void 0 ? { narration: d.narration } : {},

104 ...d.music !== void 0 ? { music: d.music } : {},

105 ...d.sfx !== void 0 ? { sfx: d.sfx } : {}

106 };

107}

108/** Per-step staleness salt: the engine version PLUS any config options that

109* change the step's OUTPUT. Options ride the salt (not stepInputs) because

110* they aren't files; a flipped option changes the hash exactly like an edited

111* input, so the step re-runs instead of serving a stale artifact. */

112function stepSalt(step, cfg, version) {

113 if (step === "render") return `${version}\0render:${JSON.stringify(renderDefaults(cfg))}`;

114 if (step === "measure-loudness") return `${version}\0mix:${JSON.stringify(mixDefaults(cfg))}`;

115 return version;

116}

117/** Identity helper for a typed `glissade.config.ts` default export. */

118function defineProject(config) {

119 return config;

120}

121async function loadConfig(configPath) {

122 const { createJiti } = await import("jiti");

123 const cfg = await createJiti(pathToFileURL(`${process.cwd()}/`).href, { moduleCache: false }).import(pathToFileURL(resolve(configPath)).href, { default: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/build.jsView on unpkg · L121

124 if (!cfg || !Array.isArray(cfg.scenes)) throw new Error(`${configPath}: config must default-export { scenes: string[] } — use defineProject({ scenes: [...] })`);

125 return cfg;

126}

127/** Expand scene patterns (explicit paths + `dir/**\/*.ts` / `dir/*.ts` globs) to concrete files under `root`. */

128function resolveScenes(patterns, root) {

129 const found = /* @__PURE__ */ new Set();

130 for (const pat of patterns) {

131 if (!pat.includes("*")) {

132 found.add(resolve(root, pat));

133 continue;

134 }

135 const starAt = pat.indexOf("*");

136 const prefix = pat.slice(0, starAt);

137 const baseDir = resolve(root, prefix.includes("/") ? prefix.slice(0, prefix.lastIndexOf("/")) : ".");

138 const recursive = pat.includes("**");

139 const tail = pat.slice(pat.lastIndexOf("/") + 1);

140 const re = new RegExp(`^${tail.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*")}$`);

141 walk(baseDir, recursive, (file) => {

Source & flagged code

1 flagged · loading source

dist/build.jsView file

121async function loadConfig(configPath) { L122: const { createJiti } = await import("jiti"); L123: const cfg = await createJiti(pathToFileURL(`${process.cwd()}/`).href, { moduleCache: false }).import(pathToFileURL(resolve(configPath)).href, { default: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/build.jsView on unpkg · L121

Findings

2 Medium4 Low

MediumDynamic Requiredist/build.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

Source & flagged code

1 flagged

dist/build.jsView file

Lines 101-141javascript

101 const d = cfg.defaults ?? {};

102 return {

103 ...d.narration !== void 0 ? { narration: d.narration } : {},

104 ...d.music !== void 0 ? { music: d.music } : {},

105 ...d.sfx !== void 0 ? { sfx: d.sfx } : {}

106 };

107}

108/** Per-step staleness salt: the engine version PLUS any config options that

109* change the step's OUTPUT. Options ride the salt (not stepInputs) because

110* they aren't files; a flipped option changes the hash exactly like an edited

111* input, so the step re-runs instead of serving a stale artifact. */

112function stepSalt(step, cfg, version) {

113 if (step === "render") return `${version}\0render:${JSON.stringify(renderDefaults(cfg))}`;

114 if (step === "measure-loudness") return `${version}\0mix:${JSON.stringify(mixDefaults(cfg))}`;

115 return version;

116}

117/** Identity helper for a typed `glissade.config.ts` default export. */

118function defineProject(config) {

119 return config;

120}

121async function loadConfig(configPath) {

122 const { createJiti } = await import("jiti");

123 const cfg = await createJiti(pathToFileURL(`${process.cwd()}/`).href, { moduleCache: false }).import(pathToFileURL(resolve(configPath)).href, { default: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/build.jsView on unpkg · L121

124 if (!cfg || !Array.isArray(cfg.scenes)) throw new Error(`${configPath}: config must default-export { scenes: string[] } — use defineProject({ scenes: [...] })`);

125 return cfg;

126}

127/** Expand scene patterns (explicit paths + `dir/**\/*.ts` / `dir/*.ts` globs) to concrete files under `root`. */

128function resolveScenes(patterns, root) {

129 const found = /* @__PURE__ */ new Set();

130 for (const pat of patterns) {

131 if (!pat.includes("*")) {

132 found.add(resolve(root, pat));

133 continue;

134 }

135 const starAt = pat.indexOf("*");

136 const prefix = pat.slice(0, starAt);

137 const baseDir = resolve(root, prefix.includes("/") ? prefix.slice(0, prefix.lastIndexOf("/")) : ".");

138 const recursive = pat.includes("**");

139 const tail = pat.slice(pat.lastIndexOf("/") + 1);

140 const re = new RegExp(`^${tail.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]*")}$`);

141 walk(baseDir, recursive, (file) => {