registry / @humanbased/crosscheck / 1.0.0

@humanbased/crosscheck@1.0.0

AI code review pipeline that turns agent-written PRs into merge-ready patches

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 67 file(s), 686 KB of source, external domains: api.github.com, claude.ai, github.com, openai.com, smee.io

Source & flagged code

3 flagged

dist/config/loader.jsView file

Lines 1-21javascript

1import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';

2import { execSync } from 'child_process';

3import { createInterface } from 'readline';

High

Child Process

Package source references child process execution.

dist/config/loader.jsView on unpkg · L1

4import { resolve, join, dirname } from 'path';

5import { homedir } from 'os';

6import { randomBytes } from 'crypto';

7import yaml from 'js-yaml';

8import { ConfigSchema } from './schema.js';

9import { listUserOrgs } from '../github/client.js';

10const CONFIG_FILENAME = 'crosscheck.config.yml';

11function findConfigFile() {

12 // Home is searched first: crosscheck is a user-level tool (it reviews PRs across

13 // all the user's repos/orgs), so ~/.crosscheck/config.yml is the natural source of

14 // truth. A cwd file is treated as a deliberate per-project override.

15 const candidates = [

16 join(homedir(), '.crosscheck', 'config.yml'),

17 resolve(process.cwd(), CONFIG_FILENAME),

18 resolve(process.cwd(), '.crosscheck.yml'),

19 ];

20 return candidates.find(existsSync) ?? null;

21}

dist/reviewers/conflict-resolve.jsView file

Lines 1-23javascript

1import { execSync } from 'child_process';

2import { readFileSync } from 'fs';

3import { join } from 'path';

4import { execa } from 'execa';

5import { applyEdit } from './fix.js';

High

Shell

Package source references shell execution.

dist/reviewers/conflict-resolve.jsView on unpkg · L3

6// Exported so tests can verify the prompt's side-preference guidance stays in

7// sync with the merge direction in runner.ts (origin/<base> is merged into HEAD,

8// so HEAD is the PR side and the `>>>>>>>` side is the base branch).

9export const PROMPT_TEMPLATE = `This pull request has merge conflicts. Resolve all conflict markers in the files listed below.

11PR title: {PR_TITLE}

13Conflicted files:

14{CONFLICTED_FILES}

16{EXTRA_INSTRUCTIONS}

18Context: the PR's branch is checked out as HEAD, and the base branch was merged into it. That means the \`<<<<<<< HEAD\` side is the PR author's intended changes and the \`>>>>>>>\` side is the base branch. Default to preserving the PR author's intent.

20Rules for resolving each conflict:

21- Keep ALL meaningful changes from both sides if they are not directly contradictory

22- When both sides modify the same line, prefer the PR author's changes (the \`<<<<<<< HEAD\` side) over the base branch (the \`>>>>>>>\` side), unless the PR side clearly breaks existing logic on the base

23- Remove ALL conflict markers: <<<<<<<, =======, >>>>>>>

dist/commands/init.jsView file

Lines 153-183javascript

153 // author_routes is intentionally not auto-patched: `crosscheck onboard` writes it

154 // only when the user picks a single authorVendor, since cross-vendor + both

155 // enabled bypasses the route (see detector.ts).

156 const existing = loadConfig(resolveConfigPath(configPath) ?? dest);

157 const login = detectGitHubLogin();

158 let patched = false;

159 if (login) {

160 if (existing.routing.allowed_authors.length === 0) {

161 patched = patchAllowedAuthors(dest, login) || patched;

162 }

163 }

164 if (patched) {

165 console.log(chalk.green(` ✓ routing updated for ${chalk.cyan(login ?? 'unknown')} in ${dest}\n`));

166 }

167 else {

168 console.log(chalk.dim(`Config already exists at ${dest}\n`));

169 }

170 }

171 // Smee-client is optional but improves watch mode reliability.

172 // Check if it's installed and show a one-line tip if not.

173 try {

174 execSync('smee --version', { stdio: 'ignore' });

175 }

176 catch {

177 console.log(chalk.dim('Tip: install smee-client for reliable webhook delivery (events queued while offline):'));

178 console.log(chalk.dim(' npm install -g smee-client'));

179 console.log(chalk.dim(' Then set tunnel: backend: smee in your config.\n'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L173

180 }

181 console.log(chalk.dim(' Run crosscheck onboard to configure scope and persona.\n'));

182}

183//# sourceMappingURL=init.js.map

Source & flagged code

3 flagged · loading source

dist/config/loader.jsView file

1import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs'; L2: import { execSync } from 'child_process'; L3: import { createInterface } from 'readline';

High

Child Process

Package source references child process execution.

dist/config/loader.jsView on unpkg · L1

dist/reviewers/conflict-resolve.jsView file

3import { join } from 'path'; L4: import { execa } from 'execa'; L5: import { applyEdit } from './fix.js';

High

Shell

Package source references shell execution.

dist/reviewers/conflict-resolve.jsView on unpkg · L3

dist/commands/init.jsView file

173try { L174: execSync('smee --version', { stdio: 'ignore' }); L175: } ... L177: console.log(chalk.dim('Tip: install smee-client for reliable webhook delivery (events queued while offline):')); L178: console.log(chalk.dim(' npm install -g smee-client')); L179: console.log(chalk.dim(' Then set tunnel: backend: smee in your config.\n'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L173

Findings

3 High3 Medium5 Low

HighChild Processdist/config/loader.js

HighShelldist/reviewers/conflict-resolve.js

HighRuntime Package Installdist/commands/init.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/config/loader.jsView file

Lines 1-21javascript

1import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'fs';

2import { execSync } from 'child_process';

3import { createInterface } from 'readline';

High

Child Process

Package source references child process execution.

dist/config/loader.jsView on unpkg · L1

4import { resolve, join, dirname } from 'path';

5import { homedir } from 'os';

6import { randomBytes } from 'crypto';

7import yaml from 'js-yaml';

8import { ConfigSchema } from './schema.js';

9import { listUserOrgs } from '../github/client.js';

10const CONFIG_FILENAME = 'crosscheck.config.yml';

11function findConfigFile() {

12 // Home is searched first: crosscheck is a user-level tool (it reviews PRs across

13 // all the user's repos/orgs), so ~/.crosscheck/config.yml is the natural source of

14 // truth. A cwd file is treated as a deliberate per-project override.

15 const candidates = [

16 join(homedir(), '.crosscheck', 'config.yml'),

17 resolve(process.cwd(), CONFIG_FILENAME),

18 resolve(process.cwd(), '.crosscheck.yml'),

19 ];

20 return candidates.find(existsSync) ?? null;

21}

dist/reviewers/conflict-resolve.jsView file

Lines 1-23javascript

1import { execSync } from 'child_process';

2import { readFileSync } from 'fs';

3import { join } from 'path';

4import { execa } from 'execa';

5import { applyEdit } from './fix.js';

High

Shell

Package source references shell execution.

dist/reviewers/conflict-resolve.jsView on unpkg · L3

6// Exported so tests can verify the prompt's side-preference guidance stays in

7// sync with the merge direction in runner.ts (origin/<base> is merged into HEAD,

8// so HEAD is the PR side and the `>>>>>>>` side is the base branch).

9export const PROMPT_TEMPLATE = `This pull request has merge conflicts. Resolve all conflict markers in the files listed below.

11PR title: {PR_TITLE}

13Conflicted files:

14{CONFLICTED_FILES}

16{EXTRA_INSTRUCTIONS}

20Rules for resolving each conflict:

21- Keep ALL meaningful changes from both sides if they are not directly contradictory

23- Remove ALL conflict markers: <<<<<<<, =======, >>>>>>>

dist/commands/init.jsView file

Lines 153-183javascript

153 // author_routes is intentionally not auto-patched: `crosscheck onboard` writes it

154 // only when the user picks a single authorVendor, since cross-vendor + both

155 // enabled bypasses the route (see detector.ts).

156 const existing = loadConfig(resolveConfigPath(configPath) ?? dest);

157 const login = detectGitHubLogin();

158 let patched = false;

159 if (login) {

160 if (existing.routing.allowed_authors.length === 0) {

161 patched = patchAllowedAuthors(dest, login) || patched;

162 }

163 }

164 if (patched) {

165 console.log(chalk.green(` ✓ routing updated for ${chalk.cyan(login ?? 'unknown')} in ${dest}\n`));

166 }

167 else {

168 console.log(chalk.dim(`Config already exists at ${dest}\n`));

169 }

170 }

171 // Smee-client is optional but improves watch mode reliability.

172 // Check if it's installed and show a one-line tip if not.

173 try {

174 execSync('smee --version', { stdio: 'ignore' });

175 }

176 catch {

177 console.log(chalk.dim('Tip: install smee-client for reliable webhook delivery (events queued while offline):'));

178 console.log(chalk.dim(' npm install -g smee-client'));

179 console.log(chalk.dim(' Then set tunnel: backend: smee in your config.\n'));

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/init.jsView on unpkg · L173

180 }

181 console.log(chalk.dim(' Run crosscheck onboard to configure scope and persona.\n'));

182}

183//# sourceMappingURL=init.js.map