registry / @productbrain/cli / 0.1.0-beta.2071

@productbrain/cli@0.1.0-beta.2071

⚠ Under review

Product Brain — Chain knowledge and write-back CLI

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 186 file(s), 1.39 MB of source, external domains: 127.0.0.1, api.productbrain.io, eu.i.posthog.com, example.test, gateway.productbrain.io, my-dev.convex.site, other-team-abc.convex.site, other-team-xyz.convex.site, other.convex.site, registry.npmjs.org, terrific-penguin-60.convex.site, test.convex.site, trustworthy-kangaroo-277.convex.site, unknown.convex.site, work.productbrain.io, x.convex.site, y.convex.site

Source & flagged code

2 flagged

dist/commands/orient.jsView file

Lines 12-52javascript

12/**

13 * WP-376 α.3: fire-and-forget orient byte report from the CLI surface.

14 *

15 * Inlined raw fetch (vs `kernelCall`) for three reasons:

16 * 1. No spinner — observability must not show user-visible progress

17 * indicators after the orient render completes.

18 * 2. Truly fire-and-forget — never block returning to the shell on a

19 * slow gateway, never propagate errors to the user.

20 * 3. Avoids the post-write session-touch heartbeat (kernelCallWithSession)

21 * — orient byte report is itself a heartbeat-equivalent observability

22 * write, so a follow-up agent.touchSession is redundant (parallel to

23 * MCP's TOUCH_EXCLUDED exemption in client.ts).

24 *

25 * The gateway's `injectSessionAuth` (BR-18) resolves workspaceId / apiKeyId /

26 * clerkUserId from the bearer token, so the surface only sends payload bytes

27 * + truncation flag. Auth and identity stay server-side.

28 */

29// PREDICATE-MIRROR: convex/agentKnowledge/orientBudget.ts → NON_MEANINGFUL_TASK_RE +

30// taskIsMeaningful. Mirrored here because packages/* has no documented import path

31// into convex/. Keep in sync; drift risk captured as a residual TEN (DEC-NEW).

32const NON_MEANINGFUL_TASK_RE = /^[\s‌‍⁠]*$/u;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/commands/orient.jsView on unpkg · L32

33function taskIsMeaningful(task) {

34 if (typeof task !== 'string')

35 return false;

36 return !NON_MEANINGFUL_TASK_RE.test(task);

37}

38// DEC-NEW: reports the resolved tier + task-presence alongside bytes + truncated.

39function reportOrientCliBytes(bytes, truncated, tier, taskProvided) {

40 let apiKey;

41 let siteUrl;

42 try {

43 ({ apiKey, siteUrl } = getConfig());

44 }

45 catch {

46 // No config — best-effort observability never fails the command.

47 return;

48 }

49 // Thread the active session context (Codex re-review): without it, the server's N-per-key

50 // ambiguity guard skips the rendered-byte update when a key has >1 active conversation — the whole

51 // point of this public report route is the surface-rendered metric.

52 const active = readSession();

•Trigger-reachable chain: manifest.bin -> dist/index.js -> dist/commands/orient.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands/orient.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/commands/orient.jsView file

32contains invisible/control Unicode U+200B (zero width space) const NON_MEANINGFUL_TASK_RE = /^[\s<U+200B><U+200C><U+200D><U+2060><U+FEFF>]*$/u;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/commands/orient.jsView on unpkg · L32

•Trigger-reachable chain: manifest.bin -> dist/index.js -> dist/commands/orient.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands/orient.jsView on unpkg

Findings

2 Critical3 Medium6 Low

CriticalTrojan Source Unicodedist/commands/orient.js

CriticalTrigger Reachable Dangerous Capabilitydist/commands/orient.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/commands/orient.jsView file

Lines 12-52javascript

12/**

13 * WP-376 α.3: fire-and-forget orient byte report from the CLI surface.

14 *

15 * Inlined raw fetch (vs `kernelCall`) for three reasons:

16 * 1. No spinner — observability must not show user-visible progress

17 * indicators after the orient render completes.

18 * 2. Truly fire-and-forget — never block returning to the shell on a

19 * slow gateway, never propagate errors to the user.

20 * 3. Avoids the post-write session-touch heartbeat (kernelCallWithSession)

21 * — orient byte report is itself a heartbeat-equivalent observability

22 * write, so a follow-up agent.touchSession is redundant (parallel to

23 * MCP's TOUCH_EXCLUDED exemption in client.ts).

24 *

25 * The gateway's `injectSessionAuth` (BR-18) resolves workspaceId / apiKeyId /

26 * clerkUserId from the bearer token, so the surface only sends payload bytes

27 * + truncation flag. Auth and identity stay server-side.

28 */

29// PREDICATE-MIRROR: convex/agentKnowledge/orientBudget.ts → NON_MEANINGFUL_TASK_RE +

30// taskIsMeaningful. Mirrored here because packages/* has no documented import path

31// into convex/. Keep in sync; drift risk captured as a residual TEN (DEC-NEW).

32const NON_MEANINGFUL_TASK_RE = /^[\s‌‍⁠]*$/u;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/commands/orient.jsView on unpkg · L32

33function taskIsMeaningful(task) {

34 if (typeof task !== 'string')

35 return false;

36 return !NON_MEANINGFUL_TASK_RE.test(task);

37}

38// DEC-NEW: reports the resolved tier + task-presence alongside bytes + truncated.

39function reportOrientCliBytes(bytes, truncated, tier, taskProvided) {

40 let apiKey;

41 let siteUrl;

42 try {

43 ({ apiKey, siteUrl } = getConfig());

44 }

45 catch {

46 // No config — best-effort observability never fails the command.

47 return;

48 }

49 // Thread the active session context (Codex re-review): without it, the server's N-per-key

50 // ambiguity guard skips the rendered-byte update when a key has >1 active conversation — the whole

51 // point of this public report route is the surface-rendered metric.

52 const active = readSession();

•Trigger-reachable chain: manifest.bin -> dist/index.js -> dist/commands/orient.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/commands/orient.jsView on unpkg