registry / @glissade/cli / 0.62.0

@glissade/cli@0.62.0

glissade CLI: headless rendering via backend-skia (+ FFmpeg mux).

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsTelemetry

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 387 KB of source

Source & flagged code

2 flagged

dist/describeLint.jsView file

Lines 273-311javascript

273* tree-shakeable subpaths + player), merged into one record. Browser-only modules

274* (`@glissade/backend-canvas2d/snapshot`, `@glissade/element`) are NOT CLI deps —

275* importing them throws, so those specifiers are collected into `unreachable` and

276* the caller exempts the helpers they'd have provided. (The `check:describe` CI

277* gate injects the built `@glissade/browser` bundle instead, so it verifies those

278* too.)

279*/

280async function collectRuntimeSurface(manifest) {

281 const modules = new Set([

282 "@glissade/core",

283 "@glissade/core/clips",

284 "@glissade/scene",

285 "@glissade/scene/describe",

286 "@glissade/scene/diagnostics",

287 "@glissade/scene/layout-ctors",

288 "@glissade/scene/path"

289 ]);

290 for (const h of manifest.helpers) modules.add(h.import);

291 const surface = {};

292 const unreachable = /* @__PURE__ */ new Set();

293 for (const spec of modules) try {

294 Object.assign(surface, await import(spec));

295 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/describeLint.jsView on unpkg · L293

296 unreachable.add(spec);

297 }

298 return {

299 surface,

300 unreachable

301 };

302}

303/** The exempt name-set for a headless lint: helper names whose import module was unreachable. */

304function exemptFromUnreachable(manifest, unreachable) {

305 const exempt = /* @__PURE__ */ new Set();

306 for (const h of manifest.helpers) if (unreachable.has(h.import)) exempt.add(h.name);

307 return exempt;

308}

309//#endregion

310export { collectRuntimeSurface, describeLint, exemptFromUnreachable };

311

dist/critique.jsView file

Lines 1-39javascript

1import { o as loadSceneModule } from "./render.js";

2import { critique } from "@glissade/scene/diagnostics";

3//#region src/critique.ts

4/**

5* `gs critique <scene-module>` (0.60): machine-readable RENDERED diagnostics from

6* the DisplayList — the rendered-geometric half of `gs describe --lint` /

7* validateScene. Loads the scene, injects the Skia measurer (so TEXT_OVERFLOW

8* measures with the same metrics `gs render` lays out with), runs `critique`, and

Source & flagged code

2 flagged · loading source

dist/describeLint.jsView file

293for (const spec of modules) try { L294: Object.assign(surface, await import(spec)); L295: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/describeLint.jsView on unpkg · L293

dist/critique.jsView file

19package = @glissade/cli; repositoryIdentity = glissade; dependency = @glissade/backend-skia L19: const scene = mod.createScene(); L20: const { SkiaBackend } = await import("@glissade/backend-skia"); L21: scene.setTextMeasurer(new SkiaBackend(scene.size.w, scene.size.h));

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/critique.jsView on unpkg · L19

Findings

1 High3 Medium4 Low

HighCopied Package Dependency Bridgedist/critique.js

MediumDynamic Requiredist/describeLint.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

Source & flagged code

2 flagged

dist/describeLint.jsView file

Lines 273-311javascript

273* tree-shakeable subpaths + player), merged into one record. Browser-only modules

274* (`@glissade/backend-canvas2d/snapshot`, `@glissade/element`) are NOT CLI deps —

275* importing them throws, so those specifiers are collected into `unreachable` and

276* the caller exempts the helpers they'd have provided. (The `check:describe` CI

277* gate injects the built `@glissade/browser` bundle instead, so it verifies those

278* too.)

279*/

280async function collectRuntimeSurface(manifest) {

281 const modules = new Set([

282 "@glissade/core",

283 "@glissade/core/clips",

284 "@glissade/scene",

285 "@glissade/scene/describe",

286 "@glissade/scene/diagnostics",

287 "@glissade/scene/layout-ctors",

288 "@glissade/scene/path"

289 ]);

290 for (const h of manifest.helpers) modules.add(h.import);

291 const surface = {};

292 const unreachable = /* @__PURE__ */ new Set();

293 for (const spec of modules) try {

294 Object.assign(surface, await import(spec));

295 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/describeLint.jsView on unpkg · L293

296 unreachable.add(spec);

297 }

298 return {

299 surface,

300 unreachable

301 };

302}

303/** The exempt name-set for a headless lint: helper names whose import module was unreachable. */

304function exemptFromUnreachable(manifest, unreachable) {

305 const exempt = /* @__PURE__ */ new Set();

306 for (const h of manifest.helpers) if (unreachable.has(h.import)) exempt.add(h.name);

307 return exempt;

308}

309//#endregion

310export { collectRuntimeSurface, describeLint, exemptFromUnreachable };

311

dist/critique.jsView file

Lines 1-39javascript

1import { o as loadSceneModule } from "./render.js";

2import { critique } from "@glissade/scene/diagnostics";

3//#region src/critique.ts

4/**

5* `gs critique <scene-module>` (0.60): machine-readable RENDERED diagnostics from

6* the DisplayList — the rendered-geometric half of `gs describe --lint` /

7* validateScene. Loads the scene, injects the Skia measurer (so TEXT_OVERFLOW

8* measures with the same metrics `gs render` lays out with), runs `critique`, and