registry / @hachej/boring-agent / 0.1.63

@hachej/boring-agent@0.1.63

Pane-embeddable coding agent. Ships direct/local/vercel-sandbox execution modes behind one interface.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 951 KB of source, external domains: api.infomaniak.com, astral.sh, github.com

Source & flagged code

1 flagged

dist/server/index.jsView file

Lines 3599-3639javascript

3599 };

3600 return { emit, watcher };

3601}

3602function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {

3603 const statCache = createTimedLruCache(CACHE_TTL_MS, CACHE_MAX_ENTRIES);

3604 const readdirCache = createTimedLruCache(

3605 CACHE_TTL_MS,

3606 CACHE_MAX_ENTRIES

3607 );

3608 let metadataVersion = 0;

3609 function invalidateMetadataCache() {

3610 metadataVersion += 1;

3611 statCache.clear();

3612 readdirCache.clear();

3613 }

3614 registerMetadataInvalidator(sandbox, invalidateMetadataCache);

3615 const { emit: emitChange, watcher } = createSandboxBroadcaster();

3616 const remote = sandbox;

3617 async function assertRealPathWithinSandboxRoot(sandboxPath) {

3618 const isWithinRoot = await runJson(

3619 remote,

3620 `node -e ${shellQuote3(`const fs=require('fs'); const path=require('path'); const root=fs.realpathSync(process.argv[1]); const target=fs.realpathSync(process.argv[2]); const rel=path.relative(root,target); process.stdout.write(JSON.stringify(rel===''||(!rel.startsWith('..')&&!path.isAbsolute(rel))))`)} ${shellQuote3(VERCEL_SANDBOX_REMOTE_ROOT)} ${shellQuote3(sandboxPath)}`

3621 );

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/index.jsView on unpkg · L3619

3622 if (!isWithinRoot) {

3623 throw Object.assign(new Error("resolved path escapes workspace root"), { code: EPERM_CODE2 });

3624 }

3625 }

3626 async function isSandboxSymlink(sandboxPath) {

3627 return await runJson(

3628 remote,

3629 `node -e ${shellQuote3(`const fs=require('fs'); process.stdout.write(JSON.stringify(fs.lstatSync(process.argv[1]).isSymbolicLink()))`)} ${shellQuote3(sandboxPath)}`

3630 );

3631 }

3632 async function listDescendantPaths(relPath, sandboxPath) {

3633 if (remote.fs?.stat && remote.fs.readdir) {

3634 const fileStat = await remote.fs.stat(sandboxPath);

3635 if (!fileStat.isDirectory()) return [];

3636 const entries = await remote.fs.readdir(sandboxPath, { withFileTypes: true });

3637 const descendants = [];

3638 for (const entry of entries) {

3639 const childRelPath = relPath === "." ? entry.name : `${relPath}/${entry.name}`;

Source & flagged code

1 flagged · loading source

dist/server/index.jsView file

3619remote, L3620: `node -e ${shellQuote3(`const fs=require('fs'); const path=require('path'); const root=fs.realpathSync(process.argv[1]); const target=fs.realpathSync(process.argv[2]); const rel=pa... L3621: );

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/index.jsView on unpkg · L3619

Findings

3 Medium4 Low

MediumDynamic Requiredist/server/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/server/index.jsView file

Lines 3599-3639javascript

3599 };

3600 return { emit, watcher };

3601}

3602function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {

3603 const statCache = createTimedLruCache(CACHE_TTL_MS, CACHE_MAX_ENTRIES);

3604 const readdirCache = createTimedLruCache(

3605 CACHE_TTL_MS,

3606 CACHE_MAX_ENTRIES

3607 );

3608 let metadataVersion = 0;

3609 function invalidateMetadataCache() {

3610 metadataVersion += 1;

3611 statCache.clear();

3612 readdirCache.clear();

3613 }

3614 registerMetadataInvalidator(sandbox, invalidateMetadataCache);

3615 const { emit: emitChange, watcher } = createSandboxBroadcaster();

3616 const remote = sandbox;

3617 async function assertRealPathWithinSandboxRoot(sandboxPath) {

3618 const isWithinRoot = await runJson(

3619 remote,

3621 );

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/server/index.jsView on unpkg · L3619

3622 if (!isWithinRoot) {

3623 throw Object.assign(new Error("resolved path escapes workspace root"), { code: EPERM_CODE2 });

3624 }

3625 }

3626 async function isSandboxSymlink(sandboxPath) {

3627 return await runJson(

3628 remote,

3629 `node -e ${shellQuote3(`const fs=require('fs'); process.stdout.write(JSON.stringify(fs.lstatSync(process.argv[1]).isSymbolicLink()))`)} ${shellQuote3(sandboxPath)}`

3630 );

3631 }

3632 async function listDescendantPaths(relPath, sandboxPath) {

3633 if (remote.fs?.stat && remote.fs.readdir) {

3634 const fileStat = await remote.fs.stat(sandboxPath);

3635 if (!fileStat.isDirectory()) return [];

3636 const entries = await remote.fs.readdir(sandboxPath, { withFileTypes: true });

3637 const descendants = [];

3638 for (const entry of entries) {

3639 const childRelPath = relPath === "." ? entry.name : `${relPath}/${entry.name}`;