registry / @limina-labs/momentum / 0.33.0

@limina-labs/momentum@0.33.0

Agent-agnostic, specs-driven development framework — single project or multi-project ecosystem

Static Scan Results

scanned 17h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 591 KB of source, external domains: antigravity.google, github.com, registry.npmjs.org

Source & flagged code

2 flagged

core/ecosystem/lib/index.jsView file

Lines 1-40javascript

1'use strict';

3/**

4 * Ecosystem helpers — pure, dependency-free.

5 *

6 * Provides four building blocks the rest of Phase 9 depends on:

7 *

8 * - findRoot(startPath) — locate the ecosystem root by walking up

9 * - loadManifest(rootPath) — read + parse ecosystem.json

10 * - listMembers(manifest) — convenience accessor

11 * - validateManifest(obj) — minimal schema check (no external deps)

12 *

13 * Schema validation is deliberately hand-rolled: momentum has a

14 * zero-dependency posture for the CLI (no ajv, no joi). The check

15 * is structural — type + required fields — and surfaces the first

16 * violation with a human-readable path. The full JSON Schema in

17 * `../schema/ecosystem.schema.json` remains the authoritative

18 * contract; this validator is its operational counterpart.

19 */

21const fs = require('fs');

22const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/ecosystem/lib/index.jsView on unpkg · L20

24// Default upper bound on parent-directory walk-up. Honored by both this

25// module's findRoot and core/ecosystem/scripts/session-append.sh. The

26// authoritative export lives in core/ecosystem/lib/state.js as of

27// Phase 10 (ENH-022); we keep MAX_WALK_DEPTH as a backward-compat alias.

28const MAX_PARENT_WALK_DEFAULT = 5;

29const MAX_WALK_DEPTH = MAX_PARENT_WALK_DEFAULT;

30const MANIFEST_FILENAME = 'ecosystem.json';

32function resolveMaxParentWalk() {

33 const raw = process.env.MOMENTUM_MAX_PARENT_WALK;

34 if (raw === undefined || raw === '') return MAX_PARENT_WALK_DEFAULT;

35 const n = Number(raw);

36 if (!Number.isFinite(n) || n < 0) return MAX_PARENT_WALK_DEFAULT;

37 return Math.floor(n);

38}

40// Per-process cache: absolute-startPath-prefix → resolved root (or null)

core/ecosystem/scripts/session-append.shView file

•path = core/ecosystem/scripts/session-append.sh kind = build_helper sizeBytes = 5436 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/ecosystem/scripts/session-append.shView on unpkg

Source & flagged code

2 flagged · loading source

core/ecosystem/lib/index.jsView file

20L21: const fs = require('fs'); L22: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/ecosystem/lib/index.jsView on unpkg · L20

core/ecosystem/scripts/session-append.shView file

•path = core/ecosystem/scripts/session-append.sh kind = build_helper sizeBytes = 5436 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/ecosystem/scripts/session-append.shView on unpkg

Findings

5 Medium5 Low

MediumDynamic Requirecore/ecosystem/lib/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpercore/ecosystem/scripts/session-append.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

core/ecosystem/lib/index.jsView file

Lines 1-40javascript

1'use strict';

3/**

4 * Ecosystem helpers — pure, dependency-free.

5 *

6 * Provides four building blocks the rest of Phase 9 depends on:

7 *

8 * - findRoot(startPath) — locate the ecosystem root by walking up

9 * - loadManifest(rootPath) — read + parse ecosystem.json

10 * - listMembers(manifest) — convenience accessor

11 * - validateManifest(obj) — minimal schema check (no external deps)

12 *

13 * Schema validation is deliberately hand-rolled: momentum has a

14 * zero-dependency posture for the CLI (no ajv, no joi). The check

15 * is structural — type + required fields — and surfaces the first

16 * violation with a human-readable path. The full JSON Schema in

17 * `../schema/ecosystem.schema.json` remains the authoritative

18 * contract; this validator is its operational counterpart.

19 */

21const fs = require('fs');

22const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/ecosystem/lib/index.jsView on unpkg · L20

24// Default upper bound on parent-directory walk-up. Honored by both this

25// module's findRoot and core/ecosystem/scripts/session-append.sh. The

26// authoritative export lives in core/ecosystem/lib/state.js as of

27// Phase 10 (ENH-022); we keep MAX_WALK_DEPTH as a backward-compat alias.

28const MAX_PARENT_WALK_DEFAULT = 5;

29const MAX_WALK_DEPTH = MAX_PARENT_WALK_DEFAULT;

30const MANIFEST_FILENAME = 'ecosystem.json';

32function resolveMaxParentWalk() {

33 const raw = process.env.MOMENTUM_MAX_PARENT_WALK;

34 if (raw === undefined || raw === '') return MAX_PARENT_WALK_DEFAULT;

35 const n = Number(raw);

36 if (!Number.isFinite(n) || n < 0) return MAX_PARENT_WALK_DEFAULT;

37 return Math.floor(n);

38}

40// Per-process cache: absolute-startPath-prefix → resolved root (or null)

core/ecosystem/scripts/session-append.shView file

•path = core/ecosystem/scripts/session-append.sh kind = build_helper sizeBytes = 5436 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/ecosystem/scripts/session-append.shView on unpkg