registry / @happyvertical/smrt-core / 0.37.2

@happyvertical/smrt-core@0.37.2

Core AI agent framework with standardized collections, object-relational mapping, and code generators

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 131 file(s), 1.52 MB of source, external domains: github.com

Oversized source lightweight scan

dist/manifest/test-manifest-stub.js2.10 MB file, sampled 256 KB

HighEntropyStrings

Source & flagged code

3 flagged

dist/registry.jsView file

Lines 9-49javascript

9import { resolveCollectionCacheConfig } from "./registry/cache-config.js";

10import { register, registerCollection, registerFromManifest, invalidateInheritanceEntries } from "./registry/class-registration.js";

11import { recordRegistryDiagnostic, getRegistryDiagnostics, clearRegistryDiagnostics, flushRegistryDiagnostics } from "./registry/diagnostics.js";

12import { getEmbeddingConfig, hasEmbeddings, getEmbeddingClasses, getProjectEmbeddingConfig, resolveEmbeddingConfig } from "./registry/embedding-manager.js";

13import { getInheritanceChain, getAllFields, mergeFieldConfigs, getAllMethods } from "./registry/inheritance-resolver.js";

14import { manifestFieldDiffers, createFieldFromManifest, mergeManifestField } from "./registry/manifest-field-merge.js";

15import { getCanonicalClassName, hasClassCaseInsensitive, findClass, getClass, getClassByConstructor, getClassByQualifiedName, getClassInPackage, findClassesByName, resolveType, getClassesByPackage, getClassesByVisibility, getPublicClasses, getAllClasses, getClassNames, getQualifiedClassNames, hasClass } from "./registry/name-resolver.js";

16import { getDependencyGraph, getRelationshipMap } from "./registry/relationship-graph.js";

17import { getSchema, getSchemaDDL, getTableName, getAllSchemas, getAllSchemasAsDefinitions } from "./registry/schema-builder.js";

18import { getClasses, getCollections, getCollectionTableNames, getCollectionCache, getDbInstanceIds, getNextDbId, setNextDbId, getFieldDecorators, getStiSiblingsLoaded, getInheritanceCache, getDiscoveryAttemptCache, verboseLog } from "./registry/shared-state.js";

19import { compileValidators } from "./registry/validator.js";

20import "./utils.js";

21import { LRUCache } from "./utils/lru-cache.js";

22import { isQualifiedName, parseQualifiedName, createQualifiedName } from "./utils/qualified-names.js";

23import { SMRT_COLLECTION_BASE_NAMES, isSmrtCollectionExtendsName } from "./registry/collection-resolution.js";

24import { classnameToTablename, toSnakeCase } from "./utils/naming.js";

25const logger = createLogger({ level: "info" });

26function getManifestLoaderSpecifier() {

27 return import.meta.url.endsWith(".ts") ? "./manifest/index.ts" : "./manifest/index.js";

28}

29async function importManifestLoader() {

30 return await import(getManifestLoaderSpecifier());

31}

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/registry.jsView on unpkg · L29

32function getReferenceKindFromFieldOptions(fieldOptions) {

33 if (fieldOptions?.__tenancy?.isTenantIdField || fieldOptions?._meta?.__tenancy?.isTenantIdField) {

34 return "tenantId";

35 }

36 if (fieldOptions?.type === "foreignKey") {

37 return "foreignKey";

38 }

39 if (fieldOptions?.type === "crossPackageRef") {

40 return "crossPackageRef";

41 }

42 return void 0;

43}

44function applyManifestFieldColumnMetadata(columns, fieldEntries) {

45 if (!fieldEntries) {

46 return;

47 }

48 for (const [fieldName, fieldOptions] of fieldEntries) {

49 const sqlType = fieldOptions?.sqlType ?? fieldOptions?._meta?.sqlType;

dist/vite-plugin/index.jsView file

Lines 119-159javascript

119 async function resolveKnowledgeConfig(rootDir, m) {

120 if (knowledge === false) return { enabled: false };

121 const packageName = m.packageName ?? readPackageName(rootDir);

122

dist/manifest/test-manifest-stub.jsView file

•path = dist/manifest/test-manifest-stub.js kind = oversized_source_file sizeBytes = 2197715 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/manifest/test-manifest-stub.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/registry.jsView file

29async function importManifestLoader() { L30: return await import(getManifestLoaderSpecifier()); L31: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/registry.jsView on unpkg · L29

dist/vite-plugin/index.jsView file

139package = @happyvertical/smrt-core; repositoryIdentity = smrt; dependency = @happyvertical/smrt-config L139: try { L140: const { loadConfig } = await import("@happyvertical/smrt-config"); L141: const config2 = await loadConfig({ cache: false });

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/vite-plugin/index.jsView on unpkg · L139

dist/manifest/test-manifest-stub.jsView file

•path = dist/manifest/test-manifest-stub.js kind = oversized_source_file sizeBytes = 2197715 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/manifest/test-manifest-stub.jsView on unpkg

Findings

2 High4 Medium5 Low

HighCopied Package Dependency Bridgedist/vite-plugin/index.js

HighOversized Source Filedist/manifest/test-manifest-stub.js

MediumDynamic Requiredist/registry.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License