registry / @sovara/runner / 0.4.0

@sovara/runner@0.4.0

TypeScript runner for Sovara — wrap a script in a single function to record every LLM call, tool invocation, and log line into a structured run graph.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 33 file(s), 137 KB of source, external domains: 127.0.0.1, api.anthropic.com, docs.sovara-labs.com

Source & flagged code

2 flagged

dist/transport/nodeHttpPatch.jsView file

Lines 473-513javascript

473 if (!responseEnded && !finalized) {

474 void finalizeException(new Error("Request closed before response completed."));

475 }

476 });

477 return request;

478 };

479 return patchedRequest;

480}

481function createPatchedGet(patchedRequest) {

482 const patchedGet = function patchedGet(...args) {

483 const request = patchedRequest(...args);

484 request.end();

485 return request;

486 };

487 return patchedGet;

488}

489export function installNodeHttpPatch() {

490 const globalObject = globalThis;

491 if (globalObject[NODE_HTTP_PATCHED_SYMBOL]) {

492 return;

493 }

494 const require = createRequire(import.meta.url);

495 const httpModule = require("node:http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/transport/nodeHttpPatch.jsView on unpkg · L493

496 const httpsModule = require("node:https");

497 const originals = {

498 httpRequest: httpModule.request,

499 httpGet: httpModule.get,

500 httpsRequest: httpsModule.request,

501 httpsGet: httpsModule.get,

502 };

503 httpModule.request = createPatchedRequest("http:", originals.httpRequest, httpModule);

504 httpsModule.request = createPatchedRequest("https:", originals.httpsRequest, httpsModule);

505 httpModule.get = createPatchedGet(httpModule.request);

506 httpsModule.get = createPatchedGet(httpsModule.request);

507 syncBuiltinESMExports();

508 globalObject[NODE_HTTP_ORIGINALS_SYMBOL] = originals;

509 globalObject[NODE_HTTP_PATCHED_SYMBOL] = true;

510}

511export function uninstallNodeHttpPatchForTesting() {

512 const globalObject = globalThis;

513 const originals = globalObject[NODE_HTTP_ORIGINALS_SYMBOL];

dist/serverLifecycle.jsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { markDegraded } from "./failsafe.js";

3import { warnOnce } from "./util/logger.js";

4const CLI_UNREACHABLE_WARNING = "Sovara exec server is unreachable and could not be started. Install the " +

5 "Sovara CLI (https://docs.sovara-labs.com) so it can manage the local exec "

Source & flagged code

2 flagged · loading source

dist/transport/nodeHttpPatch.jsView file

493} L494: const require = createRequire(import.meta.url); L495: const httpModule = require("node:http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/transport/nodeHttpPatch.jsView on unpkg · L493

dist/serverLifecycle.jsView file

1import { spawnSync } from "node:child_process"; L2: import { markDegraded } from "./failsafe.js"; ... L4: const CLI_UNREACHABLE_WARNING = "Sovara exec server is unreachable and could not be started. Install the " + L5: "Sovara CLI (https://docs.sovara-labs.com) so it can manage the local exec " + L6: "server, or set SOVARA_EXEC_SERVER_URL to a reachable server. Continuing " + ... L14: function defaultWhich(name) { L15: const res = spawnSync(process.platform === "win32" ? "where" : "which", [name], { L16: encoding: "utf8", ... L19: return null; L20: return res.stdout.split(/\r?\n/)[0]?.trim() || null; L21: } ... L26: return false;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/serverLifecycle.jsView on unpkg · L1

Findings

1 High4 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/serverLifecycle.js

MediumDynamic Requiredist/transport/nodeHttpPatch.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/transport/nodeHttpPatch.jsView file

Lines 473-513javascript

473 if (!responseEnded && !finalized) {

474 void finalizeException(new Error("Request closed before response completed."));

475 }

476 });

477 return request;

478 };

479 return patchedRequest;

480}

481function createPatchedGet(patchedRequest) {

482 const patchedGet = function patchedGet(...args) {

483 const request = patchedRequest(...args);

484 request.end();

485 return request;

486 };

487 return patchedGet;

488}

489export function installNodeHttpPatch() {

490 const globalObject = globalThis;

491 if (globalObject[NODE_HTTP_PATCHED_SYMBOL]) {

492 return;

493 }

494 const require = createRequire(import.meta.url);

495 const httpModule = require("node:http");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/transport/nodeHttpPatch.jsView on unpkg · L493

496 const httpsModule = require("node:https");

497 const originals = {

498 httpRequest: httpModule.request,

499 httpGet: httpModule.get,

500 httpsRequest: httpsModule.request,

501 httpsGet: httpsModule.get,

502 };

503 httpModule.request = createPatchedRequest("http:", originals.httpRequest, httpModule);

504 httpsModule.request = createPatchedRequest("https:", originals.httpsRequest, httpsModule);

505 httpModule.get = createPatchedGet(httpModule.request);

506 httpsModule.get = createPatchedGet(httpsModule.request);

507 syncBuiltinESMExports();

508 globalObject[NODE_HTTP_ORIGINALS_SYMBOL] = originals;

509 globalObject[NODE_HTTP_PATCHED_SYMBOL] = true;

510}

511export function uninstallNodeHttpPatchForTesting() {

512 const globalObject = globalThis;

513 const originals = globalObject[NODE_HTTP_ORIGINALS_SYMBOL];

dist/serverLifecycle.jsView file

Lines 1-21javascript

1import { spawnSync } from "node:child_process";

2import { markDegraded } from "./failsafe.js";

3import { warnOnce } from "./util/logger.js";

4const CLI_UNREACHABLE_WARNING = "Sovara exec server is unreachable and could not be started. Install the " +

5 "Sovara CLI (https://docs.sovara-labs.com) so it can manage the local exec "