registry / @itsshadowai/refinery / 0.1.0

@itsshadowai/refinery@0.1.0

Refinery — Codex-first memory review CLI.

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 220 KB of source, external domains: openrouter.ai

Source & flagged code

4 flagged

dist/coral/review-conductor.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/coral/review-conductor.jsView on unpkg · L1

3import os from "node:os";

4import path from "node:path";

5import { setTimeout as sleep } from "node:timers/promises";

6import { fileURLToPath } from "node:url";

7import { allMessages, buildCoralSessionRequest, classifyAgentReadiness, closeSession, createSession, getExtended, getLocalAgent, puppetCreateThread, puppetSendMessage, waitForAgentsReady, } from "./client.js";

8import { refineryCoralAgentNames, refineryCoralAuthKey, refineryCoralConfigPath, refineryCoralModelDefaults, refineryCoralPort, } from "./definitions.js";

9import { defaultReviewTopology } from "./topology.js";

10import { memoryMaintenanceActions, refineryReviewSchemaVersion, } from "../core/adapter.js";

11import { loadLocalEnv, parseModelMaxTokens } from "../env.js";

12import { applyErrorContext, asRefineryError, RefineryError, } from "../core/errors.js";

13import { writeReviewArtifactManifest, reviewStepOrder } from "../core/artifacts.js";

14import { buildDeliberationArtifacts, claimCardsForCritique, } from "../core/deliberation.js";

15import { deliverReviewSink, writeReviewFailureStatus, } from "../core/review.js";

16import { defaultReviewIntent, describeReviewIntent } from "../core/intents.js";

17const DEFAULT_SOURCE_LIMIT = 3;

18const DEFAULT_SOURCE_CHAR_LIMIT = 6000;

19const DEFAULT_PIPELINE_WAIT_TIMEOUT_MS = 180_000;

20const DEFAULT_DEBATE_CRITIQUE_WAIT_TIMEOUT_MS = 600_000;

21const DEFAULT_WAIT_INTERVAL_MS = 1_500;

Lines 356-396javascript

356 }

357}

358async function waitForServer(apiUrl, authKey, timeoutMs) {

359 const deadline = Date.now() + timeoutMs;

360 while

dist/cli.jsView file

Lines 56-96javascript

56}

57function copyDirectory(src, dest) {

58 fs.mkdirSync(dest, { recursive: true });

59 for (const entry of fs.readdirSync(src, { withFileTypes:

coral/agents/run-worker.shView file

•path = coral/agents/run-worker.sh kind = build_helper sizeBytes = 541 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

coral/agents/run-worker.shView on unpkg

Source & flagged code

4 flagged · loading source

dist/coral/review-conductor.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code