registry / @hotmeshio/long-tail / 0.7.5

@hotmeshio/long-tail@0.7.5

Long Tail Workflows — Durable AI workflows with human-in-the-loop escalation. Powered by PostgreSQL.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

Manifest

NoLicense

scanned 603 file(s), 3.65 MB of source, external domains: api.anthropic.com, api.github.com, api.honeycomb.io, console.anthropic.com, github.com, graph.microsoft.com, mcp-server.example.com, react.dev, ui.honeycomb.io, www.googleapis.com, www.w3.org

Source & flagged code

7 flagged

build/index.jsView file

Lines 143-183javascript

143Object.defineProperty(exports, "LTExpressAdapter", { enumerable: true, get: function () { return express_1.LTExpressAdapter; } });

144// ─── Server ──────────────────────────────────────────────────────────────────

145async function main() {

146 const honeycombKey = process.env.HONEYCOMB_API_KEY;

147 await (0, start_1.start)({

148 database: {

149 host: config_1.config.POSTGRES_HOST,

150 port: config_1.config.POSTGRES_PORT,

151 user: config_1.config.POSTGRES_USER,

152 password: config_1.config.POSTGRES_PASSWORD,

153 database: config_1.config.POSTGRES_DB,

154 },

155 server: {

156 port: config_1.config.PORT,

157 },

158 seed: {

159 admin: {

160 externalId: 'superadmin',

161 displayName: 'Super Admin',

162 email: 'admin@longtail.local',

163 password: 'l0ngt@1l',

Medium

Secret Pattern

Package contains a possible secret pattern.

build/index.jsView on unpkg · L163

164 },

165 },

166 examples: true,

167 mcp: {

168 server: { enabled: true },

169 },

170 escalation: {

171 strategy: 'mcp',

172 },

173 telemetry: honeycombKey ? { honeycomb: { apiKey: honeycombKey } } : undefined,

174 events: config_1.config.EVENT_TRANSPORT === 'nats'

175 ? { nats: { url: config_1.config.NATS_URL, wsUrl: config_1.config.NATS_WS_URL || undefined, token: config_1.config.NATS_TOKEN || undefined } }

176 : undefined,

177 });

178}

179// Run server when executed directly

180if (require.main === module) {

181 require('dotenv').config();

182 main().catch((err) => {

183 logger_1.loggerRegistry.error(`[long-tail] fatal: ${err}`);

dashboard/dist/assets/index-BoZydcaW.jsView file

35L36: ${this.ctx.stack}`),this.deferred.reject(s)):this.deferred.resolve(a),this.cancel()}cancel(s){this.timer&&this.timer.cancel(),this.mux.cancel(this),this.deferred.reject(s||ue.error... L37: `,qo=Or.fromAscii(Eo),Gv=new Uint8Array(qo)[0],Vv=new Uint8Array(qo)[1];function Fv(r){for(let n=0;n<r.length;n++){const s=n+1;if(r.byteLength>s&&r[n]===Gv&&r[s]===Vv)return s+1}re...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dashboard/dist/assets/index-BoZydcaW.jsView on unpkg · L35

docs/mcp.mdView file

Lines 875-915markdown

875| `long-tail-playwright` | browser-automation, testing, screenshots |

876| `long-tail-playwright-cli` | browser-automation, screenshots, scraping, forms |

877| `long-tail-docs` | documentation, help, reference |

878| `long-tail-file-storage` | storage, files, io |

879| `long-tail-http-fetch` | http, api, fetch, network |

880| `long-tail-oauth` | authentication, oauth, credentials |

881| `long-tail-claude-code` | development, coding, ai-agent, terminal, code-generation |

README.mdView file

Lines 45-85markdown

46Two surfaces, one model. A `proxyActivity` targets a machine: call it, get a result. `condition()` targets the external world — a reviewer, an operator, a factory cell. It suspends the workflow and writes a single escalation row carrying everything needed to route the work: the `role` that should act, its `type` and `priority`, and any `metadata` to display or filter on. People work that row through an RBAC-scoped surface — find it, claim it, resolve it — from the dashboard, the API, or MCP, and resolving it resumes the workflow exactly where it paused.

48Activities are plain functions:

50```typescript

51export async function

build/start/index.jsView file

Lines 13-53javascript

13const adapters_1 = require("./adapters");

14const workers_1 = require("./workers");

15const server_1 = require("./server");

16const socketio_1 =

build/start/index.d.tsView file

Lines 1-35typescript

1import type { LTStartConfig, LTInstance } from '../types/startup';

2/**

3 * Start Long Tail with a declarative configuration.

4 *

5 * Handles database connection, migrations, adapter registration,

6 * worker startup, and the embedded API server. Returns a client

7 * for starting workflows and a shutdown function.

8 *

9 * @example Standard worker

build/scripts/ortho-populate.jsView file

Lines 117-157javascript

117 const base = esc.role === 'ordering' ? TRANSIT_S : HOLD_S;

118 return spread(base, jitter(esc.id, 'hold'));

119}

120// ── HTTP helper (mirrors boilerplate 07-shared) ───────────────────────────────

121

Source & flagged code

7 flagged · loading source

build/index.jsView file

163patternName = generic_password severity = medium line = 163 matchedText = password...1l',

Medium

Secret Pattern

Package contains a possible secret pattern.

build/index.jsView on unpkg · L163

dashboard/dist/assets/index-BoZydcaW.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dashboard/dist/assets/index-BoZydcaW.jsView on unpkg · L35

docs/mcp.mdView file

895patternName = generic_password severity = medium line = 895 matchedText = password...es',

Medium

Secret Pattern

Hardcoded password in docs/mcp.md

docs/mcp.mdView on unpkg · L895

README.mdView file

65patternName = generic_password severity = medium line = 65 matchedText = database...' },

Medium

Secret Pattern

Hardcoded password in README.md

README.mdView on unpkg · L65

build/start/index.jsView file

33patternName = generic_password severity = medium line = 33 matchedText = * data...' },

Medium

Secret Pattern

Hardcoded password in build/start/index.js

build/start/index.jsView on unpkg · L33

build/start/index.d.tsView file

15patternName = generic_password severity = medium line = 15 matchedText = * data...' },

Medium

Secret Pattern

Hardcoded password in build/start/index.d.ts

build/start/index.d.tsView on unpkg · L15

build/scripts/ortho-populate.jsView file

137patternName = generic_password severity = medium line = 137 matchedText = const au... });

Medium

Secret Pattern

Hardcoded password in build/scripts/ortho-populate.js

build/scripts/ortho-populate.jsView on unpkg · L137

Findings

10 Medium6 Low

MediumSecret Patternbuild/index.js

MediumDynamic Requiredashboard/dist/assets/index-BoZydcaW.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndocs/mcp.md

MediumSecret PatternREADME.md

MediumSecret Patternbuild/start/index.js

MediumSecret Patternbuild/start/index.d.ts

MediumSecret Patternbuild/scripts/ortho-populate.js

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

build/index.jsView file

Lines 143-183javascript

143Object.defineProperty(exports, "LTExpressAdapter", { enumerable: true, get: function () { return express_1.LTExpressAdapter; } });

145async function main() {

146 const honeycombKey = process.env.HONEYCOMB_API_KEY;

147 await (0, start_1.start)({

148 database: {

149 host: config_1.config.POSTGRES_HOST,

150 port: config_1.config.POSTGRES_PORT,

151 user: config_1.config.POSTGRES_USER,

152 password: config_1.config.POSTGRES_PASSWORD,

153 database: config_1.config.POSTGRES_DB,

154 },

155 server: {

156 port: config_1.config.PORT,

157 },

158 seed: {

159 admin: {

160 externalId: 'superadmin',

161 displayName: 'Super Admin',

162 email: 'admin@longtail.local',

163 password: 'l0ngt@1l',

Medium

Secret Pattern

Package contains a possible secret pattern.

build/index.jsView on unpkg · L163

164 },

165 },

166 examples: true,

167 mcp: {

168 server: { enabled: true },

169 },

170 escalation: {

171 strategy: 'mcp',

172 },

173 telemetry: honeycombKey ? { honeycomb: { apiKey: honeycombKey } } : undefined,

174 events: config_1.config.EVENT_TRANSPORT === 'nats'

175 ? { nats: { url: config_1.config.NATS_URL, wsUrl: config_1.config.NATS_WS_URL || undefined, token: config_1.config.NATS_TOKEN || undefined } }

176 : undefined,

177 });

178}

179// Run server when executed directly

180if (require.main === module) {

181 require('dotenv').config();

182 main().catch((err) => {

183 logger_1.loggerRegistry.error(`[long-tail] fatal: ${err}`);

dashboard/dist/assets/index-BoZydcaW.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dashboard/dist/assets/index-BoZydcaW.jsView on unpkg · L35

docs/mcp.mdView file

Lines 875-915markdown

875| `long-tail-playwright` | browser-automation, testing, screenshots |

876| `long-tail-playwright-cli` | browser-automation, screenshots, scraping, forms |

877| `long-tail-docs` | documentation, help, reference |

878| `long-tail-file-storage` | storage, files, io |

879| `long-tail-http-fetch` | http, api, fetch, network |

880| `long-tail-oauth` | authentication, oauth, credentials |

881| `long-tail-claude-code` | development, coding, ai-agent, terminal, code-generation |

README.mdView file

Lines 45-85markdown

48Activities are plain functions:

50```typescript

51export async function

build/start/index.jsView file

Lines 13-53javascript

13const adapters_1 = require("./adapters");

14const workers_1 = require("./workers");

15const server_1 = require("./server");

16const socketio_1 =

build/start/index.d.tsView file

Lines 1-35typescript

1import type { LTStartConfig, LTInstance } from '../types/startup';

2/**

3 * Start Long Tail with a declarative configuration.

4 *

5 * Handles database connection, migrations, adapter registration,

6 * worker startup, and the embedded API server. Returns a client

7 * for starting workflows and a shutdown function.

8 *

9 * @example Standard worker

build/scripts/ortho-populate.jsView file

Lines 117-157javascript

117 const base = esc.role === 'ordering' ? TRANSIT_S : HOLD_S;

118 return spread(base, jitter(esc.id, 'hold'));

119}

120// ── HTTP helper (mirrors boilerplate 07-shared) ───────────────────────────────

121