registry / @heart-it/react-brain / 0.9.0

@heart-it/react-brain@0.9.0

Engineering decisions for React & React Native, with receipts — a continuously verified corpus with doctor (repo analysis), migrate (upgrade plans), review (CI gate), and an MCP server for agents.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 313 KB of source, external domains: api.anthropic.com, api.npmjs.org, api.openai.com, archive.org, github.com, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

3 flagged

tools/react-brain-bench.mjsView file

Lines 89-129javascript

89async function askOpenAI(model, system, user) {

90 const res = await fetch('https://api.openai.com/v1/chat/completions', {

91 method: 'POST',

92 headers: { 'content-type': 'application/json', authorization: `Bearer ${process.env.OPENAI_API_KEY}` },

93 body: JSON.stringify({ model, temperature: 0, max_tokens: 500,

94 messages: [{ role: 'system', content: system }, { role: 'user', content: user }] }),

95 signal: AbortSignal.timeout(60000),

96 });

97 if (!res.ok) throw new Error(`openai ${res.status}: ${(await res.text()).slice(0, 300)}`);

98 const j = await res.json();

99 return j.choices?.[0]?.message?.content || '';

100}

101

102const SYSTEM = 'You are a senior React / React Native advisor. Answer the question directly and concisely (a few sentences). It is currently 2026.';

103

104// ── subscription fallback: ask via the Claude Code CLI (`claude -p`) ────────────

105// NON-REFERENCE conditions, labeled as such in the results: no temperature control,

106// answers ride the Claude Code wrapper (system prompt REPLACED to strip the coding-CLI

107// framing), and it consumes the operator's subscription quota. Isolation: runs in an

108// EMPTY scratch cwd with MCP + tools locked out so the model cannot read the corpus

109// it is being benchmarked against.

110import { execFileSync } from 'node:child_process';

111import { mkdtempSync } from 'node:fs';

High

Child Process

Package source references child process execution.

tools/react-brain-bench.mjsView on unpkg · L109

112import { tmpdir } from 'node:os';

113let _cliScratch = null;

114function askClaudeCli(model, system, user) {

115 if (!_cliScratch) _cliScratch = mkdtempSync(join(tmpdir(), 'rb-bench-'));

116 return execFileSync('claude', [

117 '-p', user,

118 '--model', model,

119 '--system-prompt', system,

120 '--max-turns', '3', // room to recover from a DENIED tool attempt into a text answer

121 '--strict-mcp-config', // no MCP servers — the corpus MCP must not leak in

122 '--disallowedTools', 'Bash', 'Read', 'Write', 'Edit', 'Glob', 'Grep', 'WebFetch', 'WebSearch', 'Agent', 'Task',

123 ], { encoding: 'utf8', cwd: _cliScratch, timeout: 180000, maxBuffer: 4 * 1024 * 1024 }).trim();

124}

125

126async function run({ model, withCorpus, limit, today, viaCli = false }) {

127 const provider = viaCli ? 'claude-code-cli' : /^claude|^anthropic/i.test(model) ? 'anthropic' : 'openai';

128 if (!viaCli) {

129 const key = provider === 'anthropic' ? process.env.ANTHROPIC_API_KEY : process.env.OPENAI_API_KEY;

tools/react-brain-triage-bench.mjsView file

Lines 89-129javascript

89 const l = fix.links.find((x) => normalize(x.url) === (r.key ?? normalize(r.url)));

90 return `${i + 1}. ${r.url}\n text: ${l

tools/local-harvest.shView file

•path = tools/local-harvest.sh kind = build_helper sizeBytes = 3595 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/local-harvest.shView on unpkg

Source & flagged code

3 flagged · loading source

tools/react-brain-bench.mjsView file

109// it is being benchmarked against. L110: import { execFileSync } from 'node:child_process'; L111: import { mkdtempSync } from 'node:fs';

High

Child Process

Package source references child process execution.

tools/react-brain-bench.mjsView on unpkg · L109

tools/react-brain-triage-bench.mjsView file

109async function askAnthropic(prompt) { L110: if (!process.env.ANTHROPIC_API_KEY) { console.error('no ANTHROPIC_API_KEY in env — use --provider=claude-cli (Claude Code subscription) or --candidate=<file> (offline scoring)'); p... L111: const res = await fetch('https://api.anthropic.com/v1/messages', { L112: method: 'POST', ... L121: const scratch = mkdtempSync(join(tmpdir(), 'rb-triage-')); L122: return execFileSync('claude', [ L123: '-p', prompt, '--model', MODEL, '--max-turns', '4', '--strict-mcp-config', // room to recover from a DENIED tool attempt into a text answer

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

tools/react-brain-triage-bench.mjsView on unpkg · L109

tools/local-harvest.shView file

•path = tools/local-harvest.sh kind = build_helper sizeBytes = 3595 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/local-harvest.shView on unpkg

Findings

3 High4 Medium4 Low

HighChild Processtools/react-brain-bench.mjs

HighShell

HighSame File Env Network Executiontools/react-brain-triage-bench.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertools/local-harvest.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

tools/react-brain-bench.mjsView file

Lines 89-129javascript

89async function askOpenAI(model, system, user) {

90 const res = await fetch('https://api.openai.com/v1/chat/completions', {

91 method: 'POST',

92 headers: { 'content-type': 'application/json', authorization: `Bearer ${process.env.OPENAI_API_KEY}` },

93 body: JSON.stringify({ model, temperature: 0, max_tokens: 500,

94 messages: [{ role: 'system', content: system }, { role: 'user', content: user }] }),

95 signal: AbortSignal.timeout(60000),

96 });

97 if (!res.ok) throw new Error(`openai ${res.status}: ${(await res.text()).slice(0, 300)}`);

98 const j = await res.json();

99 return j.choices?.[0]?.message?.content || '';

100}

101

102const SYSTEM = 'You are a senior React / React Native advisor. Answer the question directly and concisely (a few sentences). It is currently 2026.';

103

104// ── subscription fallback: ask via the Claude Code CLI (`claude -p`) ────────────

105// NON-REFERENCE conditions, labeled as such in the results: no temperature control,

106// answers ride the Claude Code wrapper (system prompt REPLACED to strip the coding-CLI

107// framing), and it consumes the operator's subscription quota. Isolation: runs in an

108// EMPTY scratch cwd with MCP + tools locked out so the model cannot read the corpus

109// it is being benchmarked against.

110import { execFileSync } from 'node:child_process';

111import { mkdtempSync } from 'node:fs';

High

Child Process

Package source references child process execution.

tools/react-brain-bench.mjsView on unpkg · L109

112import { tmpdir } from 'node:os';

113let _cliScratch = null;

114function askClaudeCli(model, system, user) {

115 if (!_cliScratch) _cliScratch = mkdtempSync(join(tmpdir(), 'rb-bench-'));

116 return execFileSync('claude', [

117 '-p', user,

118 '--model', model,

119 '--system-prompt', system,

120 '--max-turns', '3', // room to recover from a DENIED tool attempt into a text answer

121 '--strict-mcp-config', // no MCP servers — the corpus MCP must not leak in

122 '--disallowedTools', 'Bash', 'Read', 'Write', 'Edit', 'Glob', 'Grep', 'WebFetch', 'WebSearch', 'Agent', 'Task',

123 ], { encoding: 'utf8', cwd: _cliScratch, timeout: 180000, maxBuffer: 4 * 1024 * 1024 }).trim();

124}

125

126async function run({ model, withCorpus, limit, today, viaCli = false }) {

127 const provider = viaCli ? 'claude-code-cli' : /^claude|^anthropic/i.test(model) ? 'anthropic' : 'openai';

128 if (!viaCli) {

129 const key = provider === 'anthropic' ? process.env.ANTHROPIC_API_KEY : process.env.OPENAI_API_KEY;

tools/react-brain-triage-bench.mjsView file

Lines 89-129javascript

89 const l = fix.links.find((x) => normalize(x.url) === (r.key ?? normalize(r.url)));

90 return `${i + 1}. ${r.url}\n text: ${l

tools/local-harvest.shView file

•path = tools/local-harvest.sh kind = build_helper sizeBytes = 3595 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/local-harvest.shView on unpkg