registry / @heart-it/react-brain / 0.9.0

@heart-it/react-brain@0.9.0

Engineering decisions for React & React Native, with receipts — a continuously verified corpus with doctor (repo analysis), migrate (upgrade plans), review (CI gate), and an MCP server for agents.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 313 KB of source, external domains: api.anthropic.com, api.npmjs.org, api.openai.com, archive.org, github.com, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

3 flagged

tools/react-brain-bench.mjsView file

Lines 89-129javascript

89async function askOpenAI(model, system, user) {

90 const res = await fetch('https://api.openai.com/v1/chat/completions', {

91 method: 'POST',

Source & flagged code

3 flagged · loading source

tools/react-brain-bench.mjsView file

109// it is being benchmarked against. L110: import { execFileSync } from 'node:child_process'; L111: import { mkdtempSync } from 'node:fs';

High

Child Process

Package source references child process execution.

tools/react-brain-bench.mjsView on unpkg · L109

tools/react-brain-triage-bench.mjsView file

109async function askAnthropic(prompt) { L110: if (!process.env.ANTHROPIC_API_KEY) { console.error('no ANTHROPIC_API_KEY in env — use --provider=claude-cli (Claude Code subscription) or --candidate=<file> (offline scoring)'); p... L111: const res = await fetch('https://api.anthropic.com/v1/messages', { L112: method: 'POST', ... L121: const scratch = mkdtempSync(join(tmpdir(), 'rb-triage-')); L122: return execFileSync('claude', [ L123: '-p', prompt, '--model', MODEL, '--max-turns', '4', '--strict-mcp-config', // room to recover from a DENIED tool attempt into a text answer

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

tools/react-brain-triage-bench.mjsView on unpkg · L109

tools/local-harvest.shView file

•path = tools/local-harvest.sh kind = build_helper sizeBytes = 3595 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/local-harvest.shView on unpkg

Findings

3 High4 Medium4 Low

HighChild Processtools/react-brain-bench.mjs

HighShell

HighSame File Env Network Executiontools/react-brain-triage-bench.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertools/local-harvest.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

tools/react-brain-triage-bench.mjsView file

Lines 89-129javascript

89 const l = fix.links.find((x) => normalize(x.url) === (r.key ?? normalize(r.url)));

90 return `${i + 1}. ${r.url}\n text: ${l?.text || '(none)'}\n first-pass skip reason: ${r.reason || '(none given)'}`;

91 }).join('\n');

92 return `You are the ADVOCATE FOR THE DROPPED in react-brain, a verified React/React-Native selection corpus. A first-pass triage skipped every item below. This pipeline's MEASURED failure mode is FALSE SKIPS — durable facts silently dropped — while over-keeping is cheap (a human reviews all keeps). Your only job: attack each skip reason and argue back in anything the corpus would regret losing.

94Flip an item to kept ONLY if it is: a durable status change (release line, deprecation, stewardship/acquisition, governance), a genuine domain GAP no entry covers, or a canonical deep-dive covering a facet the entry's readings lack. Leave skipped: corroboration of held facts, implementation how-tos, routine point releases, pre-ship RFCs/betas, sponsors/testimonials.

96THE CORPUS INDEX:

97${index}

99URLS THE CORPUS ALREADY HOLDS (do not flip these — they are held):

100${held}

101

102THE SKIPS (${skips.length}):

103${list}

104

105Reply with ONLY a JSON array containing ONLY the items you flip to kept, url copied EXACTLY — [] if every skip survives your attack:

106[{"url": "...", "entry": "RB-E-... or NEW", "why": "one line"}]`;

107}

108

109async function askAnthropic(prompt) {

110 if (!process.env.ANTHROPIC_API_KEY) { console.error('no ANTHROPIC_API_KEY in env — use --provider=claude-cli (Claude Code subscription) or --candidate=<file> (offline scoring)'); process.exit(1); }

111 const res = await fetch('https://api.anthropic.com/v1/messages', {

112 method: 'POST',

113 headers: { 'content-type': 'application/json', 'x-api-key': process.env.ANTHROPIC_API_KEY, 'anthropic-version': '2023-06-01' },

114 body: JSON.stringify({ model: MODEL, max_tokens: 8000, temperature: 0, messages: [{ role: 'user', content: prompt }] }),

115 });

116 if (!res.ok) { console.error(`API ${res.status}: ${(await res.text()).slice(0, 300)}`); process.exit(1); }

117 return (await res.json()).content?.map((c) => c.text || '').join('') || '';

118}

119

120function askClaudeCli(prompt) {

121 const scratch = mkdtempSync(join(tmpdir(), 'rb-triage-'));

122 return execFileSync('claude', [

123 '-p', prompt, '--model', MODEL, '--max-turns', '4', '--strict-mcp-config', // room to recover from a DENIED tool attempt into a text answer

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

tools/react-brain-triage-bench.mjsView on unpkg · L109

124 '--disallowedTools', 'Bash', 'Read', 'Write', 'Edit', 'Glob', 'Grep', 'WebFetch', 'WebSearch', 'Agent', 'Task',

125 ], { encoding: 'utf8', cwd: scratch, timeout: 600000, maxBuffer: 16 * 1024 * 1024 }).trim();

126}

127

128const ask = (prompt) => PROVIDER === 'claude-cli' ? askClaudeCli(prompt) : askAnthropic(prompt);

129const parseArray = (raw, label) => {