registry / @holoscript/holorepo / 0.8.0

@holoscript/holorepo@0.8.0

Sovereign GitHub + DB + HoloScript knowledge store with living repository portraits for agents and humans.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 484 KB of source, external domains: 127.0.0.1, absorb.holoscript.net, github.com, pypi.org, registry.npmjs.org

Source & flagged code

6 flagged

src/absorb.mjsView file

Lines 44-84javascript

44function absorbConfig(config) {

45 return {

46 mode: 'optional-adapter',

47 role: 'graphrag-enrichment',

48 package: '@holoscript/absorb-service',

49 localMcpUrl: DEFAULT_LOCAL_MCP_URL,

Source & flagged code

6 flagged · loading source

src/absorb.mjsView file

64patternName = generic_password severity = medium line = 64 matchedText = if (url....ed';

Medium

Secret Pattern

Package contains a possible secret pattern.

src/absorb.mjsView on unpkg · L64

src/embedder.mjsView file

17try { L18: mod = await import(encoderModule); L19: } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/embedder.mjsView on unpkg · L17

src/ci.mjsView file

38patternName = generic_password severity = medium line = 38 matchedText = if (url....ed';

Medium

Secret Pattern

Hardcoded password in src/ci.mjs

src/ci.mjsView on unpkg · L38

src/git.mjsView file

37patternName = generic_password severity = medium line = 37 matchedText = if (url....ed';

Medium

Secret Pattern

Hardcoded password in src/git.mjs

src/git.mjsView on unpkg · L37

src/config.mjsView file

213patternName = generic_password severity = medium line = 213 matchedText = if (url....ed';

Medium

Secret Pattern

Hardcoded password in src/config.mjs

src/config.mjsView on unpkg · L213

254patternName = generic_password severity = medium line = 254 matchedText = redacted...d>';

Medium

Secret Pattern

Hardcoded password in src/config.mjs

src/config.mjsView on unpkg · L254

Findings

7 Medium4 Low

MediumSecret Patternsrc/absorb.mjs

MediumDynamic Requiresrc/embedder.mjs

MediumEnvironment Vars

MediumSecret Patternsrc/ci.mjs

MediumSecret Patternsrc/git.mjs

MediumSecret Patternsrc/config.mjs

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

src/embedder.mjsView file

Lines 1-37javascript

1// Optional sovereign encoder resolution for semantic KS recall.

2//

3// The package stays dependency-free (F.145): @holoscript/holoembed is an OPTIONAL

4// peer, not a hard dependency. When it is installed, resolveHoloEmbed() returns a

5// ready (text) => number[] encoder in the HoloEmbed-768 sovereign space — the same

6// space the KS embeddings live in — using the deterministic CPU path (no GPU, no

7// network, no foreign model). When it is absent, callers get a clear install hint

8// instead of a crash, so a guest without the encoder degrades to keyword search.

9//

10// The vector space IS the sovereignty boundary (W.763): a query must be encoded by

11// the SAME encoder that produced the stored vectors, or the distances are

12// meaningless. That is why this resolves the native encoder and does not silently

13// fall back to a foreign one.

15export async function resolveHoloEmbed({ enableSnn = false, encoderModule = '@holoscript/holoembed' } = {}) {

16 let mod;

17 try {

18 mod = await import(encoderModule);

19 } catch {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/embedder.mjsView on unpkg · L17

20 return {

21 ok: false,

22 err: `semantic search needs the sovereign encoder: \`npm install ${encoderModule}\` (optional peer, deterministic CPU), `

23 + 'or pass your own (text) => number[] to queryKsSemantic().',

24 };

25 }

26 const HoloEmbedEncoder = mod.HoloEmbedEncoder || mod.default?.HoloEmbedEncoder || mod.default;

27 if (typeof HoloEmbedEncoder !== 'function') {

28 return { ok: false, err: `${encoderModule} is installed but does not export HoloEmbedEncoder` };

29 }

30 const encoder = new HoloEmbedEncoder();

31 if (typeof encoder.initialize === 'function') await encoder.initialize({ enableSnn });

32 const embed = (text) => {

33 const vector = encoder.encodeText(String(text == null ? '' : text));

34 return Array.isArray(vector) ? vector : Array.from(vector);

35 };

36 return { ok: true, embed, encoder, space: 'holoembed-768' };

37}

src/ci.mjsView file

Lines 18-58javascript

18 Object.entries(value)

19 .sort(([left], [right]) => left.localeCompare(right))

20 .map(([key, child]) => [key, stableValue(child)]),

21 );

22}

24function sha256Stable(value) {

25 return `sha256:${crypto.createHash('sha256').update(JSON.stringify(stableValue(value))).digest('hex')}`;

26}

28function sha256File(file) {

29 return `sha256:${crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex')}`;

30}

32function redactUrl(value) {

33 const raw = String(value || '').trim();

34 if (!raw) return '';

35 try {

36 const url = new URL(raw);

37 if (url.username) url.username = 'redacted';

38 if (url.password) url.password = 'redacted';

Medium

Secret Pattern

Hardcoded password in src/ci.mjs

src/ci.mjsView on unpkg · L38

39 for (const key of [...url.searchParams.keys()]) url.searchParams.set(key, 'redacted');

40 return url.toString();

41 } catch {

42 return raw

43 .replace(/\/\/([^:@/\s]+):([^@/\s]+)@/u, '//redacted:redacted@')

44 .replace(/([?&][^=]*(?:token|secret|key|signature)[^=]*=)[^&\s]+/giu, '$1redacted');

45 }

46}

48function normalizeState(value) {

49 const state = String(value || 'unknown').trim().toLowerCase();

50 if (['success', 'succeeded', 'pass', 'passed', 'ok', 'green', 'completed'].includes(state)) return 'passed';

51 if (['failure', 'failed', 'error', 'cancelled', 'canceled', 'timeout', 'timed_out', 'red'].includes(state)) return 'failed';

52 if (['pending', 'queued', 'running', 'in_progress', 'started', 'unknown', 'skipped'].includes(state)) return 'pending';

53 return 'pending';

54}

56function normalizeRepo(value, fallback = 'owner/repo') {

57 return String(value || fallback).trim();

58}

src/git.mjsView file

Lines 17-57javascript

17 Object.entries(value)

18 .sort(([left], [right]) => left.localeCompare(right))

19 .map(([key, child]) => [key, stableValue(child)]),

20 );

21}

23function sha256Stable(value) {

24 return `sha256:${crypto.createHash('sha256').update(JSON.stringify(stableValue(value))).digest('hex')}`;

25}

27function sha256File(file) {

28 return `sha256:${crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex')}`;

29}

31function redactRemoteUrl(value) {

32 const raw = String(value || '');

33 if (!raw) return '';

34 try {

35 const url = new URL(raw);

36 if (url.username) url.username = 'redacted';

37 if (url.password) url.password = 'redacted';

Medium

Secret Pattern

Hardcoded password in src/git.mjs

src/git.mjsView on unpkg · L37

38 return url.toString();

39 } catch {

40 return raw.replace(/\/\/([^:@/\s]+):([^@/\s]+)@/u, '//redacted:redacted@');

41 }

42}

44function remoteHasInlineCredentials(value) {

45 const raw = String(value || '');

46 try {

47 const url = new URL(raw);

48 return Boolean(url.username || url.password);

49 } catch {

50 return /\/\/[^:@/\s]+:[^@/\s]+@/u.test(raw);

51 }

52}

54function branchRef(value) {

55 const raw = String(value || 'main').trim();

56 if (raw.startsWith('refs/')) return raw;

57 if (raw.startsWith('heads/') || raw.startsWith('tags/')) return `refs/${raw}`;

src/config.mjsView file

Lines 193-274javascript

193 if (config.$schema && !config.schema) config.schema = config.$schema;

194 const profile = env.HOLOREPO_CONFIG_PROFILE || config.activeProfile || config.profile;

195 if (profile && config.profiles?.[profile]) {

196 config = deepMerge(config, config.profiles[profile]);

197 config.activeProfile = profile;

198 }

199 if (env.HOLOREPO_STORAGE_ROOT) config.storage = { ...(config.storage || {}), root: env.HOLOREPO_STORAGE_ROOT };

200 if (env.HOLOREPO_DATABASE_URL) config.database = { ...(config.database || {}), transport: 'pg', connectionEnv: 'HOLOREPO_DATABASE_URL' };

201 if (env.DATABASE_URL && !env.HOLOREPO_DATABASE_URL) config.database = { ...(config.database || {}), transport: 'pg', connectionEnv: 'DATABASE_URL' };

202 config.__source = fs.existsSync(resolvedPath) ? resolvedPath : 'default';

203 config.__path = resolvedPath;

204 return config;

205}

206

207export function redactConnectionString(value) {

208 const raw = String(value || '');

209 if (!raw) return '';

210 try {

211 const url = new URL(raw);

212 if (url.username) url.username = 'redacted';

213 if (url.password) url.password = 'redacted';

Medium

Secret Pattern

Hardcoded password in src/config.mjs

src/config.mjsView on unpkg · L213

214 for (const key of [...url.searchParams.keys()]) {

215 if (/password|passwd|token|secret|api[_-]?key|private[_-]?key|sslkey|credential/iu.test(key)) {

216 url.searchParams.set(key, 'redacted');

217 }

218 }

219 if (url.hash) url.hash = '#redacted';

220 return url.toString();

221 } catch {

222 return raw

223 .replace(/\/\/([^:@/\s]+):([^@/\s]+)@/u, '//redacted:redacted@')

225 .replace(/#.*$/u, '#redacted');

226 }

227}

228

229function redactNestedSecrets(value, parents = []) {

230 if (Array.isArray(value)) return value.map((child) => redactNestedSecrets(child, parents));

231 if (!value || typeof value !== 'object') {

232 if (typeof value === 'string' && /-----BEGIN [A-Z ]*PRIVATE KEY-----/u.test(value)) return '<redacted>';

233 return value;

234 }

235 return Object.fromEntries(Object.entries(value).map(([key, child]) => {

236 const referenceKey = /(?:Env|Ref)$/u.test(key);

238 const transportScope = parents.some((parent) => ['ssl', 'tls', 'auth', 'credential', 'credentials', 'signing'].includes(String(parent).toLowerCase()));

239 const normalizedKey = key.replace(/([a-z])([A-Z])/gu, '$1_$2');

240 const transportKey = transportScope && /(?:^|_)(?:key|pfx|passphrase)$/iu.test(normalizedKey);

241 if ((secretKey || transportKey) && child) return [key, '<redacted>'];

242 return [key, redactNestedSecrets(child, [...parents, key])];

243 }));

244}

245

246export function redactHoloRepoConfig(config, env = process.env) {

247 const redacted = clone(config);

248 delete redacted.__source;

249 delete redacted.__path;

250 if (redacted.database?.url) {

251 redacted.database.url = redactConnectionString(redacted.database.url);

252 }

253 if (redacted.database?.conn?.password) {

254 redacted.database.conn.password = '<redacted>';

Medium

Secret Pattern

Hardcoded password in src/config.mjs

src/config.mjsView on unpkg · L254

255 }

256 const envName = config?.database?.connectionEnv;

257 if (envName && env[envName]) {

258 redacted.database = { ...(redacted.database || {}), connection: redactConnectionString(env[envName]) };

259 }

260 return redactNestedSecrets(redacted);

261}

262

263export function validateHoloRepoConfig(config) {

264 const errors = [];

265 const warnings = [];

266 if (!config || typeof config !== 'object') return { ok: false, errors: ['config must be an object'], warnings };

267 if (config.schema !== HOLOREPO_CONFIG_SCHEMA) errors.push(`schema must be ${HOLOREPO_CONFIG_SCHEMA}`);

268 if (config.productName !== 'HoloRepo') errors.push('productName must be HoloRepo');

269 if (!config.ecosystem?.id) errors.push('ecosystem.id is required');

270 if (!config.storage?.root) errors.push('storage.root is required');

271 if (!config.git?.backend) errors.push('git.backend is required');

272 if (!config.git?.root && !config.git?.remoteEnv) warnings.push('git has no root or remoteEnv');

273 if (config.database?.connectionString) errors.push('database.connectionString is not allowed; use connectionEnv');

274 if (config.database?.transport && !['pg', 'direct-pg', 'direct-psql', 'docker-psql', 'ssh-docker-psql', 'disabled'].includes(config.database.transport)) {