registry / @kodax-ai/kodax / 0.7.58

@kodax-ai/kodax@0.7.58

⚠ Under review

KodaX lightweight coding agent - TypeScript implementation with 15 built-in LLM provider aliases, published as a Node-free single-file CLI and SDK

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 55 file(s), 2.82 MB of source, external domains: 127.0.0.1, api.example.com, evil.com, github.com, www.bing.com

Oversized source lightweight scan

dist/kodax_cli.js2.16 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsDynamicRequireHighEntropyStringsMinified

Source & flagged code

9 flagged

dist/semantic-worker.jsView file

Lines 1-12javascript

1// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.

2var Yn=Object.defineProperty;var a=(O,e)=>Yn(O,"name",{value:e,configurable:!0});var Z=(O,e)=>()=>(O&&(e=O(O=0)),e);var Vn=(O,e)=>{for(var t in e)Yn(O,t,{get:e[t],enumerable:!0})};import Jr from"path";function Zn(O){return Jr.resolve(O?.executionCwd??O?.gitRoot??process.cwd())}var Un=Z(()=>{"use strict";a(Zn,"resolveExecutionCwd")});import{AsyncLocalStorage as Hr}from"node:async_hooks";import be from"fs/promises";import wt from"path";async function D(O,e){try{let t=await be.readFile(O,"utf8"),n=JSON.parse(t);return e&&!e(n)?null:n}catch{return null}}function te(O,e){if(process.env.KODAX_DEBUG_ ...

3`,"utf8"),await is(n,O)}catch(i){throw await be.rm(n,{force:!0}).catch(()=>{}),i}await rs(t,wt.basename(O)).catch(()=>{})}async function rs(O,e){let t=`${e}.`,n=Date.now(),i=await be.readdir(O);await Promise.all(i.filter(r=>r.startsWith(t)&&Os.test(r.slice(t.length))).map(async r=>{let s=wt.join(O,r);try{let o=await be.stat(s);n-o.mtimeMs>=es&&await be.rm(s,{force:!0})}catch{}}))}var Kr,es,Os,Tt,ns,YO=Z(()=>{"use strict";Kr=new Hr;a(D,"safeReadJson");a(te,"debugLogRepoIntelligence");a(fO,"resolveRepoIntelligenceStorageDir");es=3600*1e3,Os=/^\d+\.\d+(?:\.\d+)?\.tmp$/,Tt=0;a(ts,"nextAtomicTempPa ...

4`)}let o=0,l=!1,Q=r;for(let c=r;c<O.length;c+=1){let d=O[c]??"";if(o+=oe(d),d.includes("{")&&(l=!0),Q=c,l&&

5`)}function pl(O){let e=new Set,t=[/\b([A-Za-z_][A-Za-z0-9_]*)\s*\(/g,/\.([A-Za-z_][A-Za-z0-9_]*)\s*\(/g];for(let n of t){let i=null;for(;(i=

6`,t);return O.text.slice(t,n===-1?void 0:n).trim()||e.getText(O).split(/\r?\n/,1)[0]?.trim()||"<unknown>"}function un(O,e){return w.canHaveModifiers(O)?!!w.getModifiers(O)?.some(t=>t.kind===e):!1}function Ee(O){return un(O,w.SyntaxKind.ExportKeyword)||un(O,w.SyntaxKind.DefaultKeyword)?!0:w.isVariableDeclaration(O)&&w.isVariableDeclarationList(O.parent)&&w.isVariableStatement(O.parent.parent)?Ee(O.parent.parent):!1}function pt(O){return O&&(w.isIdentifier(O)||w.isPrivateIdentifier(O)||w.isStringLiteral(O)||w.isNumericLiteral(O))?O.text:null}function Sr(O){return w.isIdentifier(O)?O.text:w.isPro ...

7`)}function jl(O){let{symbol:e}=O;return[`Symbol context for ${e.name}`,`Definition: ${e.filePath}:${e.line}`,`Module: ${e.moduleId} | Kind: ${e.kind} | Exported: ${e.exported?"yes":"no"}`,`Language: ${

8`)}function Gl(O){let{process:e}=O;return[`Process context for ${e.label}`,`Module: ${e.moduleId}`,`Entry: ${e.entryFile}${e.entrySymbol?` -> ${e.entrySymbol}`:""}`,`Freshness: ${O.freshness}`,`Confidence: ${yt(O.confidence)} (${O.confidence.toFixed(2)})`,`Summary: ${e.summary}`,"Steps:",...e.steps.map(t=>`- ${t.kind} ${t.symbolName} @ ${t.filePath}${t.line?`:${t.line}`:""} | ${t.note}`),O.alternatives.length>0?`Alternatives: ${O.alternatives.map(t=>t.label).join(" | ")}

9`)}function El(O){return[`Impact estimate for ${O.target.label}`,`Target: ${O.target.kind}${O.target.moduleId?` | module=${O.target.moduleId}`:""}${O.target.filePath?` | file=${O.target.filePath}`:""}`,`Freshness: ${O.freshness}`,`Confidence: ${yt(O.confidence)} (${O.confidence.toFixed(2)})`,`Summary: ${O.summary}`,`Impacted modules: ${O.impactedModules.map(e=>`${e.label}(${e.moduleId})`).

10`)}var Ir=Z(()=>{"use strict";a(yt,"confidenceLabel");a(xt,"capabilityLines");a(Ul,"renderModuleContext");a(jl,"renderSymbolContext");a(Gl,"renderProcessContext");a(El,"renderImpactEstimate")});function Fl(O){let e=0,t=new Map,n=new Map,i=new Set,r=[],s=[],o=a(l=>{t.set(l,e),n.set(l,e),e++,r.push(l),i.add(l);for(let Q of O.get(l)??[])t.has(Q)?i.has(Q)&&n.set(l,Math.min(n.get(l)??0,t.get(Q)??0)):(o(Q),n.set(l,Math.min(n.get(l)??0,n.get(Q)??0)));if((n.get(l)??0)===(t.get(l)??0)){let Q=[],h="";do h=r.pop()??"",i.delete(h),Q.push(h);while(h!==l&&r.length>=0&&h!=="");s.push(Q)}},"strongconnect");fo ...

11`)}var Nr=Z(()=>{"use strict";a(Fl,"tarjanScc");a(Al,"severityFor");a(Cl,"findCyclicDependencies");a(Il,"renderCycleAnalysis")});var Dr={};Vn(Dr,{buildCompleteInputsFromSourceStates:()=>Xn,buildFreshnessLabel:()=>QO,buildIncrementalAnalysisEntries:()=>xn,buildRepoIntelligenceIndex:()=>bl,buildRepoIntelligenceIndexFromInputs:()=>$n,canDirectReuseCleanCachedQueryIndex:()=>kr,canDirectReuseDirtyCachedQueryIndex:()=>_r,classifyChangedOrNewSourceFiles:()=>yn,collectCallers:()=>

Long lines were clipped for display.

dist/chunks/chunk-7QB55SYG.jsView file

Lines 153-193javascript

153`)}i(ll,"renderRetrievalResult");async function B(e,t){let n=ll(e);return(await kn(e.tool,n,t)).content}i(B,"finalizeRetrievalResult");var Wh=5,Hh=10,zh=12e3,Kh=256*1024,Gh="KODAX_WEB_SEARCH_ENDPOINT",Xh="https://www.bing.com/search";function Vh(e){let t=typeof e=="number"&&Number.isFinite(e)?Math.floor(e):Wh;return Math.max(1,Math.min(Hh,t))}i(Vh,"clampLimit");function Jh(e){let t=new AbortController;return setTimeout(()=>t.abort(),e).unref?.(),t.signal}i(Jh,"createFetchTimeoutSignal");function Yh(e){let t=process.env[Gh]||Xh;if(t.includes("{query}"))return new URL(t.replace("{query}",encodeU ...

154`);for(let m=0;m<h.length&&d.length<a;m++){let g=h[m]??"";(s?g

dist/chunks/chunk-NKHXRN7G.jsView file

Lines 190-230javascript

190 - Allow (no) if the action is consistent with the user's stated intent and project rules, even if it mutates state inside the project.

191 - When uncertain, err toward block \u2014 false positives are recoverable (the agent can adapt), false negatives may not be.

192

193About <signals> (when present):

194 - Signals are mechanical pattern matches over the action

dist/chunks/chunk-OBPB5BQ6.jsView file

1Cross-file remote execution chain: dist/chunks/chunk-OBPB5BQ6.js spawns dist/chunks/chunk-7QB55SYG.js; helper contains network access plus dynamic code execution. L1: // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024. L2: import{$ as cc,A as RS,B as ps,Ba as rm,C as Eu,Ca as Du,D as ES,Da as XS,E as ic,Ea as qS,F as Xp,G as AS,H as qp,I as ni,J as Jp,K as sc,L as Qp,M as Zp,N as _S,O as LS,P as ms,Q... L3: `).length,i={width:n,height:r};return lw.set(e,i),i},"measureText"),pm=vE;import kE from"wrap-ansi";import RE from"cli-truncate";var uw={},EE=o((e,t,n)=>{let r=e+String(t)+String(n... ... L12: `).repeat(N);g&&(O=qu.dim(O));let G=(tr(a.right,f,"foreground")+` L13: `).repeat(N);S&&(G=qu.dim(G));let Y=b?tr((T?a.bottomLeft:"")+a.bottom.repeat(A)+(v?a.bottomRight:""),l,"foreground"):void 0;b&&m&&(Y=qu.dim(Y));let re=w?1:0;D&&r.write(e,t,D,{trans... L14: `.repeat(i)+oM(t,r)}return t},"applyPaddingToText"),Qu=o((e,t={})=>{if(t.sk[redacted]&&e.internal_static||e.yogaNode?.getDisplay()===xo.DISPLAY_NONE)return"";let n="";if(e.no... ... L20: `:"",frame:void 0}}let r=new Es({width:e.yogaNode.getComputedWidth(),height:e.yogaNode.getComputedHeight()});Ew(),Tm(e,r,{…

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-OBPB5BQ6.jsView on unpkg · L1

dist/kodax_cli.jsView file

•path = dist/kodax_cli.js kind = oversized_source_file sizeBytes = 2265379 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/kodax_cli.jsView on unpkg

•path = dist/kodax_cli.js kind = oversized_cli_entrypoint sizeBytes = 2265379 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/kodax_cli.jsView on unpkg

Source & flagged code

9 flagged · loading source

dist/semantic-worker.jsView file

2var Yn=Object.defineProperty;var a=(O,e)=>Yn(O,"name",{value:e,configurable:!0});var Z=(O,e)=>()=>(O&&(e=O(O=0)),e);var Vn=(O,e)=>{for(var t in e)Yn(O,t,{get:e[t],enumerable:!0})};... L3: `,"utf8"),await is(n,O)}catch(i){throw await be.rm(n,{force:!0}).catch(()=>{}),i}await rs(t,wt.basename(O)).catch(()=>{})}async function rs(O,e){let t=`${e}.`,n=Date.now(),i=await ... L4: `)}let o=0,l=!1,Q=r;for(let c=r;c<O.length;c+=1){let d=O[c]??"";if(o+=oe(d),d.includes("{")&&(l=!0),Q=c,l&&o<=0&&c>r||!l&&c+1>=s)break}let h=l?Q+1:s;return O.slice(r,h).join(`

High

Child Process

Package source references child process execution.

dist/semantic-worker.jsView on unpkg · L2

dist/chunks/chunk-7QB55SYG.jsView file

223${o}`}i(Cw,"tailToBytes");function Ye(e){return e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">")}i(Ye,"escapeXmlContent");function Dd(){let e="[Tool Error] /goal f... L224: `)}i(qd,"toolGetGoal");async function Bd(e,t){let n=ji(t),r=typeof e.objective=="string"?e.objective.trim():"";if(!r)return"[Tool Error] create_goal: missing required parameter `ob... L225: Artifact: ${e.artifactRef}

High

Eval

Package source references dynamic code evaluation.

dist/chunks/chunk-7QB55SYG.jsView on unpkg · L223

298`)}catch(n){return`[Tool Error] activate_agent: ${n.message}`}}i(Au,"toolActivateAgent");var jr=Object.freeze({web_search:'Discover web content when no specific URL is known \u2014... L299: `)}i(rk,"buildResult");var ok=i(async(e,t)=>{let n=e,r=typeof n.query=="string"?n.query:"";if(r.length===0)return"tool_search: `query` is required. Forms: `select:NAME[,NAME...]` f... L300:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/chunk-7QB55SYG.jsView on unpkg · L298

173`)}i(Jl,"[redacted]");function Yl(e,t){return["Your previous response did not produce a valid result object for the workflow.","Problems:",...e.map(n=>`- ${n}... L174: `)}i(Yl,"[redacted]");var Ai,Tr;async function rd(){if(Ai)return Ai;if(!Tr){let e="./agent.js";Tr=import("./agent-YJNC2755.js").then(t=>{let n=t.runKodaX;if(... L175: `),_y=["Create a short user-facing digest of your previous report for the parent workflow.","Return only 2-4 bullet lines.","Each bullet must be concrete: a finding, decision, risk...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunks/chunk-7QB55SYG.jsView on unpkg · L173

dist/chunks/chunk-NKHXRN7G.jsView file

210`;)d+=1;continue}if(l==="/"&&f==="*"){for(d+=2;d<e.length&&!(e[d]==="*"&&e[d+1]==="/");)d+=1;d+=2;continue}break}if(e[d]==="]"||e[d]==="}"){r+=1;continue}}t+=c,r+=1}return t}o(Wf,"... L211: \u2026[truncated]\u2026`;function qf(e,t={}){let r=t.maxToolResultBytes??2048,n=t.maxTranscriptBytes??8192,i=[];for(let s of e){let c=Kf(s,r);c!==null&&i.push(c)}return zf(i,n)}o(q... L212: # Claude Code Code Bash command prefix detection

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

dist/chunks/chunk-NKHXRN7G.jsView on unpkg · L210

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/chunks/chunk-NKHXRN7G.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/chunks/chunk-NKHXRN7G.jsView on unpkg

dist/chunks/chunk-OBPB5BQ6.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-OBPB5BQ6.jsView on unpkg · L1

dist/kodax_cli.jsView file

•path = dist/kodax_cli.js kind = oversized_source_file sizeBytes = 2265379 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/kodax_cli.jsView on unpkg

•path = dist/kodax_cli.js kind = oversized_cli_entrypoint sizeBytes = 2265379 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/kodax_cli.jsView on unpkg

Findings

2 Critical5 High5 Medium4 Low

CriticalSame File Env Network Executiondist/chunks/chunk-NKHXRN7G.js

CriticalTrigger Reachable Dangerous Capabilitydist/chunks/chunk-NKHXRN7G.js

HighChild Processdist/semantic-worker.js

HighEvaldist/chunks/chunk-7QB55SYG.js

HighCommand Output Exfiltrationdist/chunks/chunk-7QB55SYG.js

HighCross File Remote Execution Contextdist/chunks/chunk-OBPB5BQ6.js

HighOversized Source Filedist/kodax_cli.js

MediumDynamic Requiredist/chunks/chunk-7QB55SYG.js

MediumNetwork

MediumEnvironment Vars

MediumOversized Cli Entrypointdist/kodax_cli.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

9 flagged

dist/semantic-worker.jsView file

Lines 1-12javascript

1// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.

4`)}let o=0,l=!1,Q=r;for(let c=r;c<O.length;c+=1){let d=O[c]??"";if(o+=oe(d),d.includes("{")&&(l=!0),Q=c,l&&

5`)}function pl(O){let e=new Set,t=[/\b([A-Za-z_][A-Za-z0-9_]*)\s*\(/g,/\.([A-Za-z_][A-Za-z0-9_]*)\s*\(/g];for(let n of t){let i=null;for(;(i=

Long lines were clipped for display.

dist/chunks/chunk-7QB55SYG.jsView file

Lines 153-193javascript

154`);for(let m=0;m<h.length&&d.length<a;m++){let g=h[m]??"";(s?g

dist/chunks/chunk-NKHXRN7G.jsView file

Lines 190-230javascript

190 - Allow (no) if the action is consistent with the user's stated intent and project rules, even if it mutates state inside the project.

191 - When uncertain, err toward block \u2014 false positives are recoverable (the agent can adapt), false negatives may not be.

192

193About <signals> (when present):

194 - Signals are mechanical pattern matches over the action

dist/chunks/chunk-OBPB5BQ6.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunks/chunk-OBPB5BQ6.jsView on unpkg · L1

dist/kodax_cli.jsView file

•path = dist/kodax_cli.js kind = oversized_source_file sizeBytes = 2265379 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/kodax_cli.jsView on unpkg

•path = dist/kodax_cli.js kind = oversized_cli_entrypoint sizeBytes = 2265379 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/kodax_cli.jsView on unpkg

Lines 203-243javascript

203`)??"",_e=j?.summary??"",pe,on=!1;H==="completed"?fe.trim().length>0?pe=fe:_e.trim().length>0?pe=_e:(pe=$d({childId:o,status:H,iterations:j?.actualIterations,interrupted:j?.interrupted===!0,evidenceRefsCount:j?.evidenceRefs.length??0,mergedFindingsCount:R.mergedFindings.length,resultsCount:R.results.length,provider:k?.provider,model:k?.model}),on=!0):_e.trim().length>0?pe=`failed: ${_e}`:(pe=Rd({childId:o,status:H,iterations:j?.actualIterations,interrupted:j?.interrupted===!0,resultsCount:R.results.length,mergedFindingsCount:R.mergedFindings.length,readOnly:v.readOnly,parentRole:s,provider:k?. ...

204Child task "${o}" is running in the background. Do whatever interleaved work is useful (more dispatches, side-reads, drafting). When you have nothing else useful to do, end your turn with one short status sentence and NO tool calls \u2014 the runner will resume you when this child finishes (you will see a <task-completed task_id="${o}">\u2026</task-completed> block in your next user message).`}try{let T=await $i([v],t,C),x=T.results[0],$=x?.status??"failed";if(l=$,yield{stage:"done",message:`Child "${o}" \u2192 ${$}`},!x||x.status==="failed"){let L=x?.summary&&x.summary.trim().length>0,U,R=!1; ...

205`):"",P=x.summary,K,E=!1;D.trim().length>0?K=D:P.trim().length>0?K=P:(K=$d({childId:o,status:$,iterations:x.actualIterations,interrupted:x.interrupted===!0,evidenceRefsCount:x.evidenceRefs.length,mergedFindingsCount:T.mergedFindings.length,resultsCount:T.results.length,provider:k?.provider,model:k?.model}),E=!0);let S=await $r("child_task_summary",K,t);return await Rr({childId:o,bundle:v,result:T,rawSummary:K,bannerContent:S,fallbackApplied:E,provider:k?.provider,model:k?.model,durationMs:Date.now()-c,branch:"sync"}),S}finally{d()}}i(Od,"toolDispatchChildTask");var fw={results:[],mergedFinding ...

206

207`:"";return n&&n.length>0?`${o}${n}`:`${o}Workflow ${e.runId} completed (no displayable result text was returned).`}let t=e.error??e.resultText??"";return`[Tool Error] Workflow ${e.runId??""} ${e.status??"did not complete"}${t?

208Workflow "${pw(o)}" started (run ${d}) and is now running in the background. Do NOT wait for it inline \u2014 its synthesized result will arrive on its own as a <task-completed task_id="${d}"> block in a later message. Idle-yield now (end your turn with no tool calls) if you have nothing else to do, or continue with other useful work; you will be resumed automatically when it finishes. To check how far it has gotten

209${Je(t)}

210</child-notification>`;return r.enqueue({priority:"background",mode:"task-notification",agentId:n,content:l}),`Message sent to ${n??Qt}. It will surface as a <child-notification from="${e}"> block when the parent next yields.`}i(ww,"sendToWorker");function bw(e,t,n,r,o){let s=n.childTaskRegistry;if(!s)return`[Tool Error] ${ne}: Broadcast requires a sibling registry, but none is bound to this context

211${Je(t)}

212</peer-broadcast>`;for(let w of d)r.enqueue({priority:"background",mode:"prompt",agentId:w,content:g});return f&&r.enqueue({priority:"background",mode:"task-notification",agentId:n.parentAgentId,content:g}),`Broadcast sent from ${m} to ${p} target(s) (${d.length} sibling(s)${f?" + parent":""}). Recipients will see the <peer-broadcast> block when they next yield.`}i(bw,"broadcast");async function

213${Je(r)}

214</coordinator-instruction>`:`<peer-message from="${Je(s)}"${Pi(l)}>

215${Je(r)}

216</peer-message>`,m=Ni(t,1);if(m)return m;let g=Hn({to:n,priority:p,mode:"prompt",content:h,registry:d,queue:xe()});return g.ok?f?`Message sent to ${n}. It will be processed at the child's next LLM turn boundary as a <coordinator-instruction> block.`:`Peer message sent to ${n} from ${s}. It will be processed when the peer next yields as a <peer-message from="${s}"> block.`:`[Tool Error] ${ne}: Unknown task_id "${g.to}". Verify the task_id matches one returned by dispatch_child_task and that the target has not already completed (completed children are auto-cleaned from the registry).`

217Reason: ${r}

218Finish your current tool call gracefully and emit a final summary.

219</coordinator-stop-request>`;Hn({to:n,priority:"user",mode:"system-reminder",content:c,registry:a,queue:xe()})}return`task_stop signal sent to ${n}. Child will exit at its next abort check (currently-executing tool completes atomically first).`}i(Fi,"toolTaskStop");var Pd="task_output",kw=3e4,vw=12e4,_w=8192;async function Nd(e,t){let n=typeof e.task_id=="string"?e.task_id.trim():"";if(!n)return`[Tool Error] ${Pd}: Missing required parameter: task_id (child task_id from dispatch_child_task)`;let r=e.block,o=typeof r=="boolean"?r:typeof r=="string"?r==="true":!1,s=e.timeout_ms,a=kw;typeof s=="n ...

220`)}i(Ew,"renderWorkflowRunProgress");function Sw(e){return["<retrieval_status>not_found</retrieval_status>",`<task_id>${Ye(e)}</task_id>`,`<error>No snapshot for task_id "${Ye(e)}". The task may never have been dispatched, or it settled long enough ago that its snapshot was evicted under the per-runner cap (see CHILD_PROGRESS_SNAPSHOT_CAP).</error>`].join(`

221`)}i(Sw,"renderNotFound");function Tw(e,t){let n=Date.now(),r=e.endedAt??n,o=Math.max(0,r-e.startedAt),s=[`<retrieval_status>${t}</retrieval_status>`,`<task_id>${Ye(e.childId)}</task_id>`,`<status>${e

222`)}i(Tw,"renderSnapshot");function Aw(e){let t=e.inputHint?` ${e.inputHint}`:"";return`[iter ${e.iteration}] ${e.toolName}${t}`}i(Aw,"formatBreadcrumb");function Cw(e,t){let n=Buffer.from(e,"utf8");if(n.byteLength<=t)return e;let r=n.byteLength-t;for(;r<n.byteLength&&(n[r]&192)===128;)r++;let o=n.subarray(r).toString("utf8");return`[...truncated to last ${t} bytes...]

223${o}`}i(Cw,"tailToBytes");function Ye(e){return e.replace(/&/g,"&").replace(/</g,"<").replace(/>/g,">")}i(Ye,"escapeXmlContent");function Dd(){let e="[Tool Error] /goal feature is not wired in this session (no host adapter \u2014 likely an isolated test harness or sync-dispatch context). Goal tools require a REPL session with lineage persistence.";return{readGoal:i(async()=>null,"readGoal"),createGoal:i(async()=>{throw new Error(e)},"createGoal"),requestComplete:i(async()=>({ok:!1,reason:e}),"requestComplete"),requestBlocked:i(async()=>({ok:!1,statusMessage:e,counter:{current:0,requi ...

224`)}i(qd,"toolGetGoal");async function Bd(e,t){let n=ji(t),r=typeof e.objective=="string"?e.objective.trim():"";if(!r)return"[Tool Error] create_goal: missing required parameter `objective` (a non-empty string describing the long-running goal).";let o=e.token_budget??null,s=o

225Artifact: ${e.artifactRef}

High

Eval

Package source references dynamic code evaluation.

dist/chunks/chunk-7QB55SYG.jsView on unpkg · L223

226`:""}

227Declared capabilities (the only builtin tools the handler may invoke through ctx.tools.<name>):

228 ${t}

229

230Look for any of these patterns and their obfuscated variants:

231 - Any form of require / dynamic import / Function constructor (including string-concat aliases like ['req','uire'].join(''))

232 - Access to process.* / globalThis.* / Buffer / __dirname / __filename

233 - Global fetch / XMLHttpRequest / WebSocket

234 - Top-level side effects (top-level await, writes to global object during module load)

235 - ctx access beyond ctx.tools.<declared> \u2014 for example reading ctx.executionCwd to mutate the filesystem out-of-band, or pulling capabilities not in the whitelist

236 - Hard-coded credentials, secret-looking strings, or network endpoints

237

238Output STRICTLY a single JSON object on one line, no prose, no code fences:

239{"verdict":"safe"|"suspicious"|"dangerous","concerns":["..."],"suggested_capabilities":["..."]}

240

241Field semantics:

242 - verdict: 'safe' = no detected risk, ready to stage. 'suspicious' = at least one pattern that warrants user confirmation. 'dangerous' = clear policy violation; should be rejected without prompting.

243 - concerns: short bullet phrases describing what you found. Empty when verdict='safe'.

Long lines were clipped for display.

Lines 278-318javascript

278${n}

279\`\`\`

280`}i(Jw,"buildSelfModifyDiffPrompt");function Yw(e){let t={summary:"LLM summary unavailable \u2014 review the raw manifest diff carefully before approving.",severity:"major",flaggedConcerns:["LLM reviewer did not return a parseable summary."],raw:e},n=Zw(e);if(!n)return t;let r;try{r=JSON.parse(n)}catch{return t}let o=typeof r.summary=="string"?r.summary:void 0,s=Qw(r.severity)?r.severity:void 0,a=Array.isArray(r.flaggedConcerns)?r.flaggedConcerns.filter(c=>typeof c=="string"):void 0;return!o||!s||!a?t:{summary:o,severity:s,flaggedConcerns:a,raw:e}}i(Yw,"parseSelfModifyDiffSummary");function Qw ...

281`),tools:vb(du),maxBudget:kb}}i(uu,"buildRepoExplorerAgentContent");function fu(e=Date.now()){return{kind:"agent",name:Fr,version:"0.7.57-builtin",content:uu(),status:"active",createdAt:e,testedAt:e,activatedAt:e}}i(fu,"buildRepoExplorerAgentArtifact");async function _b(){if($e(Fr))

282`)}i(ls,"renderTestResult");var $b=`export async function handler(input, ctx) {

283 // TODO: implement using only declared capabilities (ctx.tools.<name>).

284 // Return a string. Throw on unrecoverable input. The runtime applies

285 // a timeout (default 30s) and rejects calls to undeclared tools.

286 return JSON.stringify({ note: 'scaffold \u2014 replace this body', input });

287}

288`;async function ds(e,t){try{let n=xt(e,"name"),r=_(e,"version")??"0.1.0",o=_(e,"description")??"TODO: short tool description.",s=e.capabilities,a=(()=>{if(!s)return{tools:[]};if(typeof s!="object")throw new Error("capabilities must be an object with a tools[] array.");let l=s.tools;if(l===void 0)return{tools:[]};if(!Array.isArray(l)||l.some(d=>typeof d!="string"))throw new Error("capabilities.tools must be an array of builtin tool names (strings).");return{tools:l}})(),c={kind:"tool",name:n,version:r,status:"staged",createdAt:Date.now(),content:{description:o,inputSchema:{type:"object",proper ...

289`)}catch(n){return`[Tool Error] scaffold_tool: ${n.message}`}}i(ds,"toolScaffoldTool");async function us(e,t){try{let n=xt(e,"artifact_json"),r=_(e,"provider")??"anthropic",o;try{o=gu(hu(n))}catch

290`)}catch(n){return`[Tool Error] stage_construction: ${n.message}`}}i(fs,"toolStageConstruction");async function ps(e,t){try{let n=xt(e,"name"),r=xt(e,"version"),o=_(e,"provider"),s=await vt(n,r);if(!s)return`[Tool Error] test_tool: no staged artifact found for ${n}@${r}.`;if(s.status==="revoked")return`[Tool Error] test_tool: artifact ${n}@${r} is revoked. Bump the version and re-stage.`;let a={artifact:s,stagedAt:Date.now()},c=await On(a,o?{provider:o}:void 0);return ls(c)}catch(n){return`[Tool Error] test_tool: ${n.message}`}}i(ps,"toolTestTool");async function ms(e,t){try{let n=xt(e,"name") ...

291`)}catch(n){return`[Tool Error] activate_tool: ${n.message}`}}i(ms,"toolActivateTool");var yu={quick:0,balanced:1,deep:2};function wu(e){if(e.prevKind!=="agent"||e.nextKind!=="agent")return{ok:!1,rule:"kind-invalid",reason:`Self-modify only supports kind='agent' (prev='${

292`)}catch(n){return`[Tool Error] ${Ie}: ${n.message}`}}i(bu,"toolStageSelfModify");var gs=["scaffold_agent","validate_agent","stage_agent_construction","test_agent","activate_agent"],tI=new Set(gs),Nb=new Set([...gs,Ie]);function Db(e,t){return t?[...e]:e.filter(n=>!Nb.has(n))}i(Db,"filterAgentConstructionToolNames");function Et(e,t){let n=e[t];if(typeof n!="string"||n.trim().length===0)throw new Error(`'${t}' is required and must be a non-empty string.`);return n.trim()}i(Et,"readRequiredString");function ku(e){try{return JSON.parse(e)}catch(t){throw new Error(`artifact_json failed to parse as ...

293`)}i(_u,"renderTestResult");async function xu(e,t){try{let n=Et(e,"name"),r=_(e,"version")??"0.1.0",o=_(e,"description")??"TODO: short summary of what this agent does and when to invoke it.",s={kind:"agent",name:n,version:r,status:"staged",createdAt:Date.now(),content:{instructions:`${o}

294

295TODO: replace with the agent's full operating instructions.`,tools:[],reasoning:{default:"balanced",max:"deep",escalateOnRevise:!1}}};return["Scaffolded agent manifest (fill TODO sections, then call validate_agent):","","Manifest schema notes:"," - instructions: string (required) \u2014 the agent's system-prompt body.",' - tools: ToolRef[] \u2014 refs like { ref: "builtin:read" } or { ref: "constructed:foo@1.0.0" }.',' - handoffs: AgentHandoffRef[] \u2014 { target: { ref }, kind: "continuation"|"as-tool" }.'," - reasoning: { default, max?, escalateOnRevise? } \u2014 same shape as Layer A A ...

296`)}catch(n){return`[Tool Error] scaffold_agent: ${n.message}`}}i(xu,"toolScaffoldAgent");async function Eu(e,t){try{let n=Et(e,"artifact_json"),r;try{r=vu(ku(n))}catch(l){return`[Tool Error] validate_agent: ${l.message}`}if(qs().length===0)return["[Tool Error] validate_agent: invariant registry is empty.","Call registerCodingInvariants() (from @kodax-ai/coding) before invoking validate_agent \u2014","the REPL surface bootstraps this at startup; non-REPL contexts must register explicitly."].join(" ");let o=Q({name:r.name,content:r.content}),s=await J.admit(o),a=[],c=[];if(!s.ok)a.push(`[admissi ...

297`)}catch(n){return`[Tool Error] stage_agent_construction: ${n.message}`}}i(Su,"toolStageAgentConstruction");async function Tu(e,t){try{let n=Et(e,"name"),r=Et(e,"version"),o=await vt(n,r);if(!o)return`[Tool Error] test_agent: no staged artifact found for ${n}@${r}.`;if(o.kind!=="agent")return`[Tool Error] test_agent: ${n}@${r} has kind='${o.kind}', expected 'agent'. Use test_tool for tool artifacts.`;if(o.status==="revoked")return`[Tool Error] test_agent: ${n}@${r} is revoked. Bump the version and re-stage.`;let s={artifact:o,stagedAt:Date.now()},a=await On(s);return _u(a)}catch(n){return`[Too ...

298`)}catch(n){return`[Tool Error] activate_agent: ${n.message}`}}i(Au,"toolActivateAgent");var jr=Object.freeze({web_search:'Discover web content when no specific URL is known \u2014 call `tool_search("web_search")` for full schema.',web_fetch:'Fetch a specific remote URL (HTML\u2192markdown, cached) \u2014 call `tool_search("web_fetch")` for full schema (includes GitHub-URL gh-CLI guidance).',code_search:'Ranked text search across the repo with noise filtering \u2014 call `tool_search("code_search")` for selection heuristics vs grep / symbol_context.',semantic_lookup:'Symbol-/module-/process-aw ...

299`)}i(rk,"buildResult");var ok=i(async(e,t)=>{let n=e,r=typeof n.query=="string"?n.query:"";if(r.length===0)return"tool_search: `query` is required. Forms: `select:NAME[,NAME...]` for exact lookup, or keyword search (`+required loose terms`).";let o=typeof n.max_results=="number"&&n.max_results>

300

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/chunks/chunk-7QB55SYG.jsView on unpkg · L298

301`)||void 0}async refreshCapabilityProviders(t){let n=!1,r;for(let o of[this.primary,this.secondary])try{await o.refreshCapabilityProviders(t),n=!0}catch(s){if(r??=s,!t||!this.shouldTryNextCapabilityRuntime(s,t))throw s}if(!n&&r)throw r}getDiagnostics(){let t=this.primary.getDiagnostics(),n=this.secondary.getDiagnostics();return{loadedExtensions:[...n.loadedExtensions,...t.loadedExtensions].sort((r,o)=>r.path.localeCompare(o.path)),capabilityProviders:[...n.capabilityProviders,...t.capabilityProviders].sort((r,o)=>r.id.localeCompare(o.id)),commands:[...n.commands,...t.commands].sort((r,o)=>r.na ...

302`),input_schema:{type:"object",properties:{path:{type:"string",description:"The absolute path to the file"},offset:{type:"number",description:"Line number to start from (text files only)"},limit:{type:"number",description:"Number of lines to read (text files only)"}},required:["path"]},handler:oo,sideEffect:"readonly",toClassifierInput:i(()=>"","toClassifierInput")},{name:"kodax_manual",description:co(),input_schema:{type:"object",properties:{topic:{type:"string",description:'A manual topic id (e.g. "providers", "config", "agents", "extensions", "doctor"). Unknown topics return the index.'},qu ...

303`),input_schema:{type:"object",properties:{skill:{type:"string",description:'The skill name (e.g. "commit", "review-pr"). Leading slash is tolerated.'},args:{type:"string",description:"Optional arguments forwarded to the skill resolver."}},required:["skill"]},handler:yl,sideEffect:"mutates-state",toClassifierInput:i(()=>"","toClassifierInput")},{name:"write",description:'Write content to a file on the local filesystem. Large diffs may be summarized in the tool result.\n\n## When to Use This Tool\n\n- Creating a NEW file the user explicitly asked for.\n- Performing a complete rewrite of an exis ...

304

305Set status to complete only when the objective is achieved and no required work remains. Completion triggers a runtime verifier; if the verifier does not confirm, the call is rejected and you must keep working.

306

307Set status to blocked only when the goal cannot proceed without external unblock, and the same blocking condition has persisted across recent goal turns. The runtime counter rejects blocked status until the same blocker_kind has repeated for 3 consecutive turns.

308

309Pause, resume, and budget-limited transitions are controlled by the user, not this tool. Do not call to stop work \u2014 only call when the objective is truly achieved or truly blocked.`,input_schema:{type:"object",properties:{status:{type:"string",enum:["complete","blocked"],description:'New status. "complete" requires verifier confirmation; "blocked" requires the same blocker_kind across 3 consecutive turns.'},blocker_kind:{type:"string",description:'Required when status=blocked. A short identifier for the persistent obstacle (e.g. "awaiting-user-permission", "missing-dependency"). The runti ...

310... and ${o} more`:"";return`<diagnostics file="${e}">

311${r.map(Xk).join(`

312`)}${s}

313</diagnostics>`}i(Qu,"report");import{existsSync as Zu,readFileSync as Jk,statSync as Yk}from"fs";import ve from"path";import{createRequire as ef}from"module";var Vk=process.platform==="win32";function ue(e){let t=e.replace(/\\/g,"/");return Vk?t.toLowerCase():t}i(ue,"normalizeFsPath");var Qk=process.platform==="win32",Zk=Qk?(process.env.PATHEXT??".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean):[""];function tf(e){try{return Zu(e)&&Yk(e).isFile()}catch{return!1}}i(tf,"isFile");function nf(e){let t=(process.env.PATH??"").split(ve.delimiter).filter(Boolean);for(let n of t)for(let r of Zk){let o ...

314`)}i(zr,"formatLocations");function df(e){return typeof e=="string"?e:e.value}i(df,"markedToString");function uf(e){if(!e)return"No hover information.";let t=e.contents;return typeof t=="string"?t.trim()||"No hover information.":Array.isArray(t)?t.map(df).join

315`).trim()||"No hover information.":"kind"in t?t.value.trim()||"No hover information.":df(t).trim()||"No hover information."}i(uf,"formatHover");var pv=Object.freeze({[V.File]:"File",[V.Module]:"Module",[V.Namespace]:"Namespace",[V.Package]:"Package",[V

316`)}i(ff,"formatSymbols");function pf(e,t){return e.length===0?t:e.map(n=>{let r=n.containerName?` in ${n.containerName}`:"";return`${Hr(n.kind)} ${n.name}${r} ${mv(n.location)}`}).join(`

317`)}i(pf,"formatWorkspaceSymbols");function Ls(e){let t=e.detail?` - ${e.detail}`:"";return`${Hr(e.kind)} ${e.name} ${Os(e.uri)}:${Is(e.selectionRange)}${t}`}i(Ls,"formatCallHierarchyItem");function mf(e){return e.length===0?"unknown call site":e.map(Is).join(", ")}i(mf,"formatRanges");function hf(e,t){return e.length===0?t:e.map(Ls).join(`

318`)}i(hf,"formatCallHierarchyItems");function gf(e,t){return e.length===0?t:e.map(n=>`${Ls(n.from)} calls at ${mf(n.fromRanges)}`).join(`

Long lines were clipped for display.