registry / @limina-labs/momentum / 0.35.0

@limina-labs/momentum@0.35.0

Agent-agnostic, specs-driven development framework — single project or multi-project ecosystem

Static Scan Results

scanned 13h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 61 file(s), 628 KB of source, external domains: antigravity.google, github.com, registry.npmjs.org

Source & flagged code

3 flagged

core/ecosystem/lib/index.jsView file

Lines 1-40javascript

1'use strict';

3/**

4 * Ecosystem helpers — pure, dependency-free.

5 *

6 * Provides four building blocks the rest of Phase 9 depends on:

7 *

8 * - findRoot(startPath) — locate the ecosystem root by walking up

9 * - loadManifest(rootPath) — read + parse ecosystem.json

10 * - listMembers(manifest) — convenience accessor

11 * - validateManifest(obj) — minimal schema check (no external deps)

12 *

13 * Schema validation is deliberately hand-rolled: momentum has a

14 * zero-dependency posture for the CLI (no ajv, no joi). The check

15 * is structural — type + required fields — and surfaces the first

16 * violation with a human-readable path. The full JSON Schema in

17 * `../schema/ecosystem.schema.json` remains the authoritative

18 * contract; this validator is its operational counterpart.

19 */

21const fs = require('fs');

22const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/ecosystem/lib/index.jsView on unpkg · L20

24// Default upper bound on parent-directory walk-up. Honored by both this

25// module's findRoot and core/ecosystem/scripts/session-append.sh. The

26// authoritative export lives in core/ecosystem/lib/state.js as of

27// Phase 10 (ENH-022); we keep MAX_WALK_DEPTH as a backward-compat alias.

28const MAX_PARENT_WALK_DEFAULT = 5;

29const MAX_WALK_DEPTH = MAX_PARENT_WALK_DEFAULT;

30const MANIFEST_FILENAME = 'ecosystem.json';

32function resolveMaxParentWalk() {

33 const raw = process.env.MOMENTUM_MAX_PARENT_WALK;

34 if (raw === undefined || raw === '') return MAX_PARENT_WALK_DEFAULT;

35 const n = Number(raw);

36 if (!Number.isFinite(n) || n < 0) return MAX_PARENT_WALK_DEFAULT;

37 return Math.floor(n);

38}

40// Per-process cache: absolute-startPath-prefix → resolved root (or null)

core/ecosystem/scripts/session-append.shView file

•path = core/ecosystem/scripts/session-append.sh kind = build_helper sizeBytes = 5436 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/ecosystem/scripts/session-append.shView on unpkg

bin/state-commands.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @limina-labs/momentum@0.34.0 matchedIdentity = npm:QGxpbWluYS1sYWJzL21vbWVudHVt:0.34.0 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/state-commands.jsView on unpkg

Source & flagged code

3 flagged · loading source

core/ecosystem/lib/index.jsView file

20L21: const fs = require('fs'); L22: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/ecosystem/lib/index.jsView on unpkg · L20

core/ecosystem/scripts/session-append.shView file

•path = core/ecosystem/scripts/session-append.sh kind = build_helper sizeBytes = 5436 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/ecosystem/scripts/session-append.shView on unpkg

bin/state-commands.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/state-commands.jsView on unpkg

Findings

1 High5 Medium5 Low

HighPrevious Version Dangerous Deltabin/state-commands.js

MediumDynamic Requirecore/ecosystem/lib/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpercore/ecosystem/scripts/session-append.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

core/ecosystem/lib/index.jsView file

Lines 1-40javascript

1'use strict';

3/**

4 * Ecosystem helpers — pure, dependency-free.

5 *

6 * Provides four building blocks the rest of Phase 9 depends on:

7 *

8 * - findRoot(startPath) — locate the ecosystem root by walking up

9 * - loadManifest(rootPath) — read + parse ecosystem.json

10 * - listMembers(manifest) — convenience accessor

11 * - validateManifest(obj) — minimal schema check (no external deps)

12 *

13 * Schema validation is deliberately hand-rolled: momentum has a

14 * zero-dependency posture for the CLI (no ajv, no joi). The check

15 * is structural — type + required fields — and surfaces the first

16 * violation with a human-readable path. The full JSON Schema in

17 * `../schema/ecosystem.schema.json` remains the authoritative

18 * contract; this validator is its operational counterpart.

19 */

21const fs = require('fs');

22const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/ecosystem/lib/index.jsView on unpkg · L20

24// Default upper bound on parent-directory walk-up. Honored by both this

25// module's findRoot and core/ecosystem/scripts/session-append.sh. The

26// authoritative export lives in core/ecosystem/lib/state.js as of

27// Phase 10 (ENH-022); we keep MAX_WALK_DEPTH as a backward-compat alias.

28const MAX_PARENT_WALK_DEFAULT = 5;

29const MAX_WALK_DEPTH = MAX_PARENT_WALK_DEFAULT;

30const MANIFEST_FILENAME = 'ecosystem.json';

32function resolveMaxParentWalk() {

33 const raw = process.env.MOMENTUM_MAX_PARENT_WALK;

34 if (raw === undefined || raw === '') return MAX_PARENT_WALK_DEFAULT;

35 const n = Number(raw);

36 if (!Number.isFinite(n) || n < 0) return MAX_PARENT_WALK_DEFAULT;

37 return Math.floor(n);

38}

40// Per-process cache: absolute-startPath-prefix → resolved root (or null)

core/ecosystem/scripts/session-append.shView file

•path = core/ecosystem/scripts/session-append.sh kind = build_helper sizeBytes = 5436 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/ecosystem/scripts/session-append.shView on unpkg

bin/state-commands.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/state-commands.jsView on unpkg