registry / @hupan56/wlkj / 3.3.1

@hupan56/wlkj@3.3.1

AI Product R&D Workflow - PRD/Prototype/Search/Task/Report

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 133 KB of source, external domains: 127.0.0.1, example.com, git-scm.com, mirrors.aliyun.com, mirrors.cloud.tencent.com, nodejs.org, pypi.tuna.tsinghua.edu.cn, python.org

Source & flagged code

8 flagged

templates/qoder/config.yamlView file

Lines 54-94yaml

54# 没配 environments (旧扁平结构) 时兼容：当作只有 default_env 一个环境。

55mysql:

56 default_env: test # AI 不指定 / 用户不选时的默认环境

57 environments:

58 test: # 测试环境

59 host: 10.54.6.9

60 port: 3306

61 user: fywl_ics_test

62 password: Fywl_ics_test56476

63 env_name: "QAS 测试环境" # 显示标签，会随查询结果返回提醒 AI 当前在哪个环境

64 pre: # 预生产环境 (按需填, 不用可整段删)

65 host: 10.54.6.10

66 port: 3306

67 user: fywl_ics_pre_ro

68 password: ""

69 env_name: "预生产环境"

70 prod: # 生产环境 (⚠️ 只读账号! 配了才能查, 查时 AI 会标红提醒)

71 host: fywl-mysql.rwlb.rds.aliyuncs.com

72 port: 3306

73 user: queryuser

74 password: "query2025_ics@infore"

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/qoder/config.yamlView on unpkg · L74

75 env_name: "生产环境"

77# ── 禅道 MCP (自建内网) ──

78# v3.1.4: 禅道是【每人一个账号】(非团队共享)。

79# - url (服务地址): 团队共享, 留这里。

80# - user/password (个人凭据): 不放这里 (进 git 会泄露)。

81# 每人各自填 workspace/members/{我}/.private/secrets/zentao.env:

82# ZENTAO_USER=<你的禅道账号>

83# ZENTAO_PASSWORD=<你的禅道密码>

84# - 账号名映射: member.json 的 zentao_account (进 git, 用于归属过滤)。

85zentao:

86 url: http://10.89.2.91/zentao

88# ── Platforms (知识图谱/搜索的平台映射, 换项目改这里即可) ──

89# search_index.py --platform <key或alias> 会过滤到对应 project 目录

90platforms:

91 web:

92 project: fywl-ui

93 aliases: [pc, 管理端, 后台]

94 ui_stack: "Ant Design Vue + VxeGrid (Vben Admin)"

bin/cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// wlkj - workflow toolkit

4const path = require("path");

5const fs = require("fs");

6const { execSync } = require("child_process");

bin/install-env.pyView file

•path = bin/install-env.py kind = build_helper sizeBytes = 9868 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/install-env.pyView on unpkg

templates/qoder/scripts/validation/test/autotest_data.pyView file

•path = [redacted]autotest_data.py kind = payload_in_excluded_dir sizeBytes = 27812 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/qoder/scripts/validation/test/autotest_data.pyView on unpkg

templates/qoder/scripts/domain/kg/sync_repowiki.pyView file

Lines 6-46python

7本脚本读这些 md → UPSERT 到 PG wiki 表（repo + keyword + title + description）。

8这样知识层的 wiki 搜索(graphrag_ask/rag_search)能命中 Qoder 自动生成的高质量文档。

10用法：

11 python sync_repowiki.py # 同步全部仓库

12 python sync_repowiki.py --repo fywl-ics # 只同步指定仓库

13 python sync_repowiki.py --dry-run # 只统计不写

14"""

15import os

16import sys

17import glob

Source & flagged code

8 flagged · loading source

templates/qoder/config.yamlView file

74patternName = generic_password severity = medium line = 74 matchedText = password...ore"

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/qoder/config.yamlView on unpkg · L74

bin/cli.jsView file

5const fs = require("fs"); L6: const { execSync } = require("child_process"); L7:

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L5

1294try { L1295: // 用 setx 会截断超长 PATH，改用 PowerShell 读 User PATH 追加 L1296: const ps = `powershell -NoProfile -Command "$p=[Environment]::GetEnvironmentVariable('Path','User'); if($p -notlike '*{dir}*'){[Environment]::SetEnvironmentVariable('Path',$p.TrimE...

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L1294

100// 镜像兜底逻辑在 JS 侧复刻同一策略 (默认源→清华→阿里→腾讯), 行为与 Python 版一致。 L101: const { spawnSync } = require("child_process"); L102: const MIRRORS = [ L103: ["清华", "https://pypi.tuna.tsinghua.edu.cn/simple"], L104: ["阿里", "https://mirrors.aliyun.com/pypi/simple/"], ... L106: ]; L107: const installEnv = { ...process.env, PYTHONIOENCODING: "utf-8", PYTHONUTF8: "1" }; L108:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L100

55const wlkj = path.join(process.cwd(), ".qoder", "scripts", "orchestration", "wlkj.py"); L56: if (!fs.existsSync(wlkj)) { console.log("请先运行: npx wlkj init"); process.exit(1); } L57: const pyCmd = detectPyCmd(); ... L61: const cmdName = script.replace(/\.py$/, "").replace(/\//g, "-"); L62: return execSync(`${pyCmd} "${wlkj}" ${cmdName} ${args.map(a => `"${a}"`).join(" ")}`, { cwd: process.cwd(), encoding: "utf-8", timeout: 15000, env: { ...process.env, PYTHONIOENCODI... L63: } catch (e) { return (e.stdout || e.message); }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L55

bin/install-env.pyView file

•path = bin/install-env.py kind = build_helper sizeBytes = 9868 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/install-env.pyView on unpkg

templates/qoder/scripts/validation/test/autotest_data.pyView file

•path = [redacted]autotest_data.py kind = payload_in_excluded_dir sizeBytes = 27812 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/qoder/scripts/validation/test/autotest_data.pyView on unpkg

templates/qoder/scripts/domain/kg/sync_repowiki.pyView file

26patternName = generic_password severity = medium line = 26 matchedText = PG = dic...kj")

Medium

Secret Pattern

Hardcoded password in templates/qoder/scripts/domain/kg/sync_repowiki.py

templates/qoder/scripts/domain/kg/sync_repowiki.pyView on unpkg · L26

Findings

5 High6 Medium3 Low

HighChild Processbin/cli.js

HighShellbin/cli.js

HighSame File Env Network Executionbin/cli.js

HighRuntime Package Installbin/cli.js

HighPayload In Excluded Dirtemplates/qoder/scripts/validation/test/autotest_data.py

MediumSecret Patterntemplates/qoder/config.yaml

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/install-env.py

MediumStructural Risk Force Deep Review

MediumSecret Patterntemplates/qoder/scripts/domain/kg/sync_repowiki.py

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

templates/qoder/config.yamlView file

Lines 54-94yaml

54# 没配 environments (旧扁平结构) 时兼容：当作只有 default_env 一个环境。

55mysql:

56 default_env: test # AI 不指定 / 用户不选时的默认环境

57 environments:

58 test: # 测试环境

59 host: 10.54.6.9

60 port: 3306

61 user: fywl_ics_test

62 password: Fywl_ics_test56476

63 env_name: "QAS 测试环境" # 显示标签，会随查询结果返回提醒 AI 当前在哪个环境

64 pre: # 预生产环境 (按需填, 不用可整段删)

65 host: 10.54.6.10

66 port: 3306

67 user: fywl_ics_pre_ro

68 password: ""

69 env_name: "预生产环境"

70 prod: # 生产环境 (⚠️ 只读账号! 配了才能查, 查时 AI 会标红提醒)

71 host: fywl-mysql.rwlb.rds.aliyuncs.com

72 port: 3306

73 user: queryuser

74 password: "query2025_ics@infore"

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/qoder/config.yamlView on unpkg · L74

75 env_name: "生产环境"

77# ── 禅道 MCP (自建内网) ──

78# v3.1.4: 禅道是【每人一个账号】(非团队共享)。

79# - url (服务地址): 团队共享, 留这里。

80# - user/password (个人凭据): 不放这里 (进 git 会泄露)。

81# 每人各自填 workspace/members/{我}/.private/secrets/zentao.env:

82# ZENTAO_USER=<你的禅道账号>

83# ZENTAO_PASSWORD=<你的禅道密码>

84# - 账号名映射: member.json 的 zentao_account (进 git, 用于归属过滤)。

85zentao:

86 url: http://10.89.2.91/zentao

88# ── Platforms (知识图谱/搜索的平台映射, 换项目改这里即可) ──

89# search_index.py --platform <key或alias> 会过滤到对应 project 目录

90platforms:

91 web:

92 project: fywl-ui

93 aliases: [pc, 管理端, 后台]

94 ui_stack: "Ant Design Vue + VxeGrid (Vben Admin)"

bin/cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2// wlkj - workflow toolkit

4const path = require("path");

5const fs = require("fs");

6const { execSync } = require("child_process");

bin/install-env.pyView file

•path = bin/install-env.py kind = build_helper sizeBytes = 9868 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/install-env.pyView on unpkg

templates/qoder/scripts/validation/test/autotest_data.pyView file

•path = [redacted]autotest_data.py kind = payload_in_excluded_dir sizeBytes = 27812 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/qoder/scripts/validation/test/autotest_data.pyView on unpkg

templates/qoder/scripts/domain/kg/sync_repowiki.pyView file

Lines 6-46python

7本脚本读这些 md → UPSERT 到 PG wiki 表（repo + keyword + title + description）。

8这样知识层的 wiki 搜索(graphrag_ask/rag_search)能命中 Qoder 自动生成的高质量文档。

10用法：

11 python sync_repowiki.py # 同步全部仓库

12 python sync_repowiki.py --repo fywl-ics # 只同步指定仓库

13 python sync_repowiki.py --dry-run # 只统计不写

14"""

15import os

16import sys

17import glob

Lines 35-120javascript

35 // 误选 2.7 会被缓存 → 后续所有 py()/runScript 全用 2.7 跑 → setup.py 直接失败。

36 // 检查 --version 输出以 "Python 3." 开头, 且次版本 >=8。

37 for (const c of ["python", "python3"]) {

38 try {

39 const out = execSync(`${c} --version`, { encoding: "utf-8", timeout: 5000, stdio: "pipe" });

40 const m = /Python\s+3\.(\d+)/i.exec((out || "").trim());

41 if (m && parseInt(m[1], 10) >= 8) {

42 _PY_CMD_CACHE = c;

43 return c;

44 }

45 // 是 python 但版本不够 (2.7 或 3.0-3.7) → 跳过试下一个候选

46 } catch { /* try next */ }

47 }

48 _PY_CMD_CACHE = null;

49 return null;

50}

52function py(script, args = []) {

53 // v3.x: 不再直接找扁平路径 (scripts/<script>), 改为转发 wlkj.py 单一真源调度器。

54 // 根治 "引擎分层重组后 cli.js 路径全部失效" 的载体漂移。

55 const wlkj = path.join(process.cwd(), ".qoder", "scripts", "orchestration", "wlkj.py");

56 if (!fs.existsSync(wlkj)) { console.log("请先运行: npx wlkj init"); process.exit(1); }

57 const pyCmd = detectPyCmd();

58 if (!pyCmd) { console.log("Python 未安装, 无法运行脚本。跑: npx @hupan56/wlkj install-env"); return ""; }

59 // 把脚本名当命令传给 wlkj.py (DISPATCH 命中则路由, 否则 run fallback 递归找)

60 try {

61 const cmdName = script.replace(/\.py$/, "").replace(/\//g, "-");

62 return execSync(`${pyCmd} "${wlkj}" ${cmdName} ${args.map(a => `"${a}"`).join(" ")}`, { cwd: process.cwd(), encoding: "utf-8", timeout: 15000, env: { ...process.env, PYTHONIOENCODING: "utf-8", PYTHONUTF8: "1" } });

63 } catch (e) { return (e.stdout || e.message); }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L55

64}

66// 透传执行: 直接 spawn (不捕获输出, 实时显示, 支持长超时和交互式)

67// 用于 kg_build/eval_prd/autotest 等耗时脚本, 以及需要交互的场景

68function runScript(scriptName, args = [], timeoutMs = 600000) {

69 // v3.x: 转发 wlkj.py 单一真源 (不再直接找扁平 scripts/<scriptName>)

70 const wlkj = path.join(process.cwd(), ".qoder", "scripts", "orchestration", "wlkj.py");

71 if (!fs.existsSync(wlkj)) { console.log("引擎未安装。跑: npx @hupan56/wlkj init"); process.exit(1); }

72 const pyCmd = detectPyCmd();

73 if (!pyCmd) { console.log("Python 未安装。跑: npx @hupan56/wlkj install-env"); process.exit(1); }

74 const { spawnSync } = require("child_process");

75 const env = { ...process.env, PYTHONIOENCODING: "utf-8", PYTHONUTF8: "1" };

80}

82// 带镜像兜底的 pip 安装 —— 复用 Python 的 common/pip_install.py (单一事实源)

83// 为什么不复用 Python: 上一轮给 init_doctor 做了 common/pip_install.py (失败切清华/阿里/腾讯)。

84// cli.js 的 install-env/update 是独立 JS 路径, 之前没享受镜像兜底 → 50 人里弱网用户全崩。

85// 这里调用同一个 Python 工具, 保证两路径行为一致。

86//

87// 优先: 引擎已装 → 调 foundation.utils.pip_install (有镜像兜底)

88// 回退: 引擎没装 → 裸 pip install (install-env 首次场景, 无 Python 工具可用)

89//

90// 实现注意 (修 2.7.0 的真 bug): 不能用字符串拼接构造 Python -c 代码 ——

91// Windows 路径含反斜杠, 拼进 Python 字符串后 \Y \n 等成了非法转义 + 引号丢失,

92// 导致 SyntaxError → 镜像兜底静默失败 → 回退裸 pip → 弱网用户全崩。

93// 改用环境变量传参 (WLKJ_REQ_PATH), Python 侧 os.environ 读, 彻底避开转义地狱。

94function installPipDeps(pyCmd, reqPath) {

95 // ⚠ v3.x 重写: 直接用 Node spawnSync 跑 pip (不嵌套 Python 子进程)。

96 // 原方案 `python -c "...install_with_fallback..."` 在 Anaconda 3.9+ Windows 下,

97 // pip 进镜像重试(长时间编译 tree-sitter/playwright)退出时会触发

98 // "PyEval_SaveThread: GIL released" 致命崩溃 → Python 死、结果丢失、回退裸 pip、

99 // 弱网新机装不上。Node 直接跑 pip 不嵌套 Python, 无此 GIL 问题。

100 // 镜像兜底逻辑在 JS 侧复刻同一策略 (默认源→清华→阿里→腾讯), 行为与 Python 版一致。

101 const { spawnSync } = require("child_process");

102 const MIRRORS = [

103 ["清华", "https://pypi.tuna.tsinghua.edu.cn/simple"],

104 ["阿里", "https://mirrors.aliyun.com/pypi/simple/"],

105 ["腾讯", "https://mirrors.cloud.tencent.com/simple"],

106 ];

107 const installEnv = { ...process.env, PYTHONIOENCODING: "utf-8", PYTHONUTF8: "1" };

108

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/cli.jsView on unpkg · L100

109 function runPip(extraArgs, timeoutMs) {

110 // stdio inherit 让用户看到进度; 不捕获输出 = 不撑管道、不触发任何崩溃

111 const r = spawnSync(pyCmd, ["-m", "pip", "install", "--no-input", "--progress-bar", "off", ...extraArgs, "-r", reqPath],

112 { stdio: "inherit", timeout: timeoutMs || 300000, encoding: "utf-8", env: installEnv });

113 return r.status === 0;

114 }

115

116 function pkgsInstalled() {

117 // 轻量 import 验证: 不跑 pip 子进程, 只 python -c "import ...", 无 GIL 风险。

118 // 核心包都 import 成功就算装好 (即使某些可选包编译失败 pip 返回非0)。

119 const coreMods = ["duckdb", "pymysql", "yaml", "requests"];

120 const mod = coreMods.map(m => "__import__('%s')".replace("%s", m)).join(";");

Lines 1274-1314javascript

1274 if (location) {

1275 console.log(` 安装位置: ${location}${isWin ? "" : " (仅 Windows winget 支持指定目录)"}`);

1276 // Windows: 预建目录

1277 if (isWin) {

1278 try { fs.mkdirSync(location, { recursive: true }); } catch { /* */ }

1279 }

1280 }

1281

1282 // 检测函数

1283 function check(cmd) {

1284 try { return execSync(`${cmd} --version`, { encoding: "utf-8", timeout: 5000, stdio: "pipe" }).trim().split("\n")[0]; }

1285 catch { return null; }

1286 }

1287 function has(cmd) {

1288 try { execSync(`where ${cmd}`, { encoding: "utf-8", timeout: 3000, stdio: "pipe" }); return true; }

1289 catch { try { execSync(`which ${cmd}`, { encoding: "utf-8", timeout: 3000, stdio: "pipe" }); return true; } catch { return false; } }

1290 }

1291 // Windows: 把目录加到用户 PATH（幂等，已存在不重复加）

1292 function addToPathWin(dir) {

1293 if (!isWin) return false;

1294 try {

1295 // 用 setx 会截断超长 PATH，改用 PowerShell 读 User PATH 追加

1296 const ps = `powershell -NoProfile -Command "$p=[Environment]::GetEnvironmentVariable('Path','User'); if($p -notlike '*{dir}*'){[Environment]::SetEnvironmentVariable('Path',$p.TrimEnd(';')+';{dir}','User')}"`.replace(/{dir}/g, dir.replace(/\\/g, "\\\\"));

High

Shell

Package source references shell execution.

bin/cli.jsView on unpkg · L1294

1297 execSync(ps, { stdio: "pipe", timeout: 15000 });

1298 return true;

1299 } catch (e) { console.log(` [WARN] 加 PATH 失败（可手动加）: ${dir}`); return false; }

1300 }

1301 function install(name, wingetId, brewPkg) {

1302 if (checkOnly) return false;

1303 try {

1304 if (isWin && has("winget")) {

1305 console.log(` 用 winget 装 ${name}...`);

1306 // winget --location 不一定被安装包尊重，但先传上

1307 let cmd = `winget install --id ${wingetId} -e --source winget --accept-source-agreements --accept-package-agreements`;

1308 if (location) cmd += ` --location "${location}"`;

1309 execSync(cmd, { stdio: "inherit", timeout: 300000 });

1310 return true;

1311 } else if (isMac && has("brew")) {

1312 console.log(` 用 brew 装 ${name}...`);

1313 execSync(`brew install ${brewPkg}`, { stdio: "inherit", timeout: 300000 });

1314 return true;