registry / @kky42/pi-flow / 2.0.0

@kky42/pi-flow@2.0.0

Multi-backend subagents and dynamic workflow orchestration for pi.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 45 file(s), 370 KB of source, external domains: api.deepseek.com, github.com

Source & flagged code

1 flagged

scripts/smoke-runtime.mjsView file

Lines 1-28javascript

1// Plain-node smoke test for the compiled runtime entry (dist/runtime.js).

2//

3// Run via `npm run smoke:runtime` (which builds dist first). No TypeScript

4// loader is involved: this exercises exactly what an external plain-JS

5// consumer gets from `@kky42/pi-flow/runtime`, including the worker-thread

6// script host, parallel/pipeline/phase/log globals, and the shared limiter.

7import assert from "node:assert/strict";

9const direct = await import(new URL("../dist/runtime.js", import.meta.url));

10const { ConcurrencyLimiter, runWorkflow, parseWorkflowScript, isWorkflowAbortError, WorkflowAbortError } = direct;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/smoke-runtime.mjsView on unpkg · L8

12// The package export map must resolve the same compiled module (node package

13// self-reference exercises the "./runtime" exports entry).

14const viaExports = await import("@kky42/pi-flow/runtime");

15assert.equal(viaExports.runWorkflow, runWorkflow, "exports map must resolve dist/runtime.js");

17assert.equal(typeof runWorkflow, "function");

18assert.equal(typeof parseWorkflowScript, "function");

19assert.equal(typeof isWorkflowAbortError, "function");

20assert.equal(typeof WorkflowAbortError, "function");

21assert.ok(isWorkflowAbortError(new WorkflowAbortError("smoke")), "exported class must satisfy its own guard");

23const script = `export const meta = { name: "smoke-runtime", description: "compiled runtime smoke test" };

24phase("fan-out");

25const [alpha] = await parallel([() => agent("Return the word alpha.", { label: "alpha" })]);

26phase("pipe");

27const piped = await pipeline(["beta"], (item) => agent("Return the word " + item + ".", { label: item }));

28log("alpha=" + alpha + " beta=" + piped[0]);

Source & flagged code

1 flagged · loading source

scripts/smoke-runtime.mjsView file

8L9: const direct = await import(new URL("../dist/runtime.js", import.meta.url)); L10: const { ConcurrencyLimiter, runWorkflow, parseWorkflowScript, isWorkflowAbortError, WorkflowAbortError } = direct;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/smoke-runtime.mjsView on unpkg · L8

Findings

3 Medium5 Low

MediumDynamic Requirescripts/smoke-runtime.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

scripts/smoke-runtime.mjsView file

Lines 1-28javascript

1// Plain-node smoke test for the compiled runtime entry (dist/runtime.js).

2//

3// Run via `npm run smoke:runtime` (which builds dist first). No TypeScript

4// loader is involved: this exercises exactly what an external plain-JS

5// consumer gets from `@kky42/pi-flow/runtime`, including the worker-thread

6// script host, parallel/pipeline/phase/log globals, and the shared limiter.

7import assert from "node:assert/strict";

9const direct = await import(new URL("../dist/runtime.js", import.meta.url));

10const { ConcurrencyLimiter, runWorkflow, parseWorkflowScript, isWorkflowAbortError, WorkflowAbortError } = direct;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/smoke-runtime.mjsView on unpkg · L8

12// The package export map must resolve the same compiled module (node package

13// self-reference exercises the "./runtime" exports entry).

14const viaExports = await import("@kky42/pi-flow/runtime");

15assert.equal(viaExports.runWorkflow, runWorkflow, "exports map must resolve dist/runtime.js");

17assert.equal(typeof runWorkflow, "function");

18assert.equal(typeof parseWorkflowScript, "function");

19assert.equal(typeof isWorkflowAbortError, "function");

20assert.equal(typeof WorkflowAbortError, "function");

21assert.ok(isWorkflowAbortError(new WorkflowAbortError("smoke")), "exported class must satisfy its own guard");

23const script = `export const meta = { name: "smoke-runtime", description: "compiled runtime smoke test" };

24phase("fan-out");

25const [alpha] = await parallel([() => agent("Return the word alpha.", { label: "alpha" })]);

26phase("pipe");

27const piped = await pipeline(["beta"], (item) => agent("Return the word " + item + ".", { label: item }));

28log("alpha=" + alpha + " beta=" + piped[0]);