registry / @glissade/cli / 0.46.0

@glissade/cli@0.46.0

glissade CLI: headless rendering via backend-skia (+ FFmpeg mux).

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsTelemetry

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 294 KB of source

Source & flagged code

1 flagged

dist/build.jsView file

Lines 107-147javascript

107 const d = cfg.defaults ?? {};

108 return {

109 ...d.narration !== void 0 ? { narration: d.narration } : {},

110 ...d.music !== void 0 ? { music: d.music } : {},

111 ...d.sfx !== void 0 ? { sfx: d.sfx } : {}

112 };

113}

114/** Per-step staleness salt: the engine version PLUS any config options that

115* change the step's OUTPUT. Options ride the salt (not stepInputs) because

116* they aren't files; a flipped option changes the hash exactly like an edited

117* input, so the step re-runs instead of serving a stale artifact. */

118function stepSalt(step, cfg, version) {

119 if (step === "render") return `${version}\0render:${JSON.stringify(renderDefaults(cfg))}`;

120 if (step === "measure-loudness") return `${version}\0mix:${JSON.stringify(mixDefaults(cfg))}`;

121 return version;

122}

123/** Identity helper for a typed `glissade.config.ts` default export. */

124function defineProject(config) {

125 return config;

126}

127async function loadConfig(configPath) {

128 const { createJiti } = await import("jiti");

129 const cfg = await createJiti(pathToFileURL(`${process.cwd()}/`).href, { moduleCache: false }).import(pathToFileURL(resolve(configPath)).href, { default: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/build.jsView on unpkg · L127

130 if (!cfg || !Array.isArray(cfg.scenes)) throw new Error(`${configPath}: config must default-export { scenes: string[] } — use defineProject({ scenes: [...] })`);

131 return cfg;

132}

133/** A glob → RegExp on a whole string: `**` matches any (incl. `/`), `*` matches non-slash. */

134function globToRegExp(glob) {

135 const re = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\0").replace(/\*/g, "[^/]*").replace(//g, ".*");

136 return new RegExp(`^${re}$`);

137}

138/** Is a resolved file excluded by any `ignore` glob? A `/`-less pattern matches the

139* basename at any depth (`*.test.ts`); a `/`-bearing one matches the root-relative path. */

140function isIgnoredScene(absFile, root, ignore = []) {

141 const rel = relative(root, absFile);

142 const base = basename(absFile);

143 return ignore.some((pat) => pat.includes("/") ? globToRegExp(pat).test(rel) : globToRegExp(pat).test(base));

144}

145/** Expand scene patterns (explicit paths + `dir/**\/*.ts` / `dir/*.ts` globs) to concrete files

146* under `root`, minus anything matching an `ignore` glob (colocated tests, wip dirs). */

147function resolveScenes(patterns, root, ignore = []) {

Source & flagged code

1 flagged · loading source

dist/build.jsView file

127async function loadConfig(configPath) { L128: const { createJiti } = await import("jiti"); L129: const cfg = await createJiti(pathToFileURL(`${process.cwd()}/`).href, { moduleCache: false }).import(pathToFileURL(resolve(configPath)).href, { default: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/build.jsView on unpkg · L127

Findings

2 Medium4 Low

MediumDynamic Requiredist/build.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

Source & flagged code

1 flagged

dist/build.jsView file

Lines 107-147javascript

107 const d = cfg.defaults ?? {};

108 return {

109 ...d.narration !== void 0 ? { narration: d.narration } : {},

110 ...d.music !== void 0 ? { music: d.music } : {},

111 ...d.sfx !== void 0 ? { sfx: d.sfx } : {}

112 };

113}

114/** Per-step staleness salt: the engine version PLUS any config options that

115* change the step's OUTPUT. Options ride the salt (not stepInputs) because

116* they aren't files; a flipped option changes the hash exactly like an edited

117* input, so the step re-runs instead of serving a stale artifact. */

118function stepSalt(step, cfg, version) {

119 if (step === "render") return `${version}\0render:${JSON.stringify(renderDefaults(cfg))}`;

120 if (step === "measure-loudness") return `${version}\0mix:${JSON.stringify(mixDefaults(cfg))}`;

121 return version;

122}

123/** Identity helper for a typed `glissade.config.ts` default export. */

124function defineProject(config) {

125 return config;

126}

127async function loadConfig(configPath) {

128 const { createJiti } = await import("jiti");

129 const cfg = await createJiti(pathToFileURL(`${process.cwd()}/`).href, { moduleCache: false }).import(pathToFileURL(resolve(configPath)).href, { default: true });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/build.jsView on unpkg · L127

130 if (!cfg || !Array.isArray(cfg.scenes)) throw new Error(`${configPath}: config must default-export { scenes: string[] } — use defineProject({ scenes: [...] })`);

131 return cfg;

132}

133/** A glob → RegExp on a whole string: `**` matches any (incl. `/`), `*` matches non-slash. */

134function globToRegExp(glob) {

135 const re = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*\*/g, "\0").replace(/\*/g, "[^/]*").replace(//g, ".*");

136 return new RegExp(`^${re}$`);

137}

138/** Is a resolved file excluded by any `ignore` glob? A `/`-less pattern matches the

139* basename at any depth (`*.test.ts`); a `/`-bearing one matches the root-relative path. */

140function isIgnoredScene(absFile, root, ignore = []) {

141 const rel = relative(root, absFile);

142 const base = basename(absFile);

143 return ignore.some((pat) => pat.includes("/") ? globToRegExp(pat).test(rel) : globToRegExp(pat).test(base));

144}

145/** Expand scene patterns (explicit paths + `dir/**\/*.ts` / `dir/*.ts` globs) to concrete files

146* under `root`, minus anything matching an `ignore` glob (colocated tests, wip dirs). */

147function resolveScenes(patterns, root, ignore = []) {