registry / @tangle-network/agent-interface / 0.31.0

@tangle-network/agent-interface@0.31.0

Shared TypeScript types and zod schemas that define the contract between Tangle agents, the sidecar, and provider adapters: capabilities, agent profiles, message parts, and harness descriptors. This is the canonical home for those shapes; higher-level pac

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

EnvironmentVars

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 194 KB of source, external domains: router.tangle.tools

Source & flagged code

1 flagged

dist/agent-candidate-schema-common.jsView file

Lines 1-28javascript

1import { sha256 } from "@noble/hashes/sha256";

2import { z } from "zod";

3const sha256Pattern = /^sha256:[a-f0-9]{64}$/;

4const gitObjectPattern = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;

5const environmentNamePattern = /^[A-Za-z_][A-Za-z0-9_]*$/;

6const headerNamePattern = /^[!#$%&'*+\-.^_`|~0-9A-Za-z]+$/;

7const mediaTypePattern = /^[a-z0-9][a-z0-9!#$&^_.+-]{0,126}\/[a-z0-9][a-z0-9!#$&^_.+-]{0,126}$/;

8const githubComponentPattern = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/;

10const obviousSecretValuePattern = /(?:\b(?:sk|gh[pousr]|github_pat|AKIA)[-_A-Za-z0-9]{12,}\b|-----BEGIN [A-Z ]*PRIVATE KEY-----|\bBearer\s+\S+)/;

11const controlCharacterPattern = /[\u0000-\u001f\u007f]/;

12const reservedWorkspaceRoots = new Set([".git", ".sidecar"]);

13const shellNames = new Set([

14 "sh",

15 "bash",

16 "zsh",

17 "fish",

18 "cmd",

19 "cmd.exe",

20 "powershell",

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/agent-candidate-schema-common.jsView on unpkg · L8

21 "pwsh",

22]);

23const blockedHostnames = new Set([

24 "localhost",

25 "metadata.google.internal",

26 "metadata.google",

27]);

28export const sha256DigestSchema = z

Source & flagged code

1 flagged · loading source

dist/agent-candidate-schema-common.jsView file

8const githubComponentPattern = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,99}$/; L9: const secretNamePattern = /(?:^|[_-])(?:api[_-]?key|access[_-]?key|private[_-]?key|token|secret|password|credentials?|authorization|cookie|database[_-]?url|dsn|pat)(?:[_-]|$)/i; L10: const obviousSecretValuePattern = /(?:\b(?:sk|gh[pousr]|github_pat|AKIA)[-_A-Za-z0-9]{12,}\b|-----BEGIN [A-Z ]*PRIVATE KEY-----|\bBearer\s+\S+)/; ... L18: "cmd", L19: "cmd.exe", L20: "powershell", ... L75: for (let index = 0; index < value.length; index++) { L76: const code = value.charCodeAt(index); L77: if (code >= 0xd800 && code <= 0xdbff) { ... L126: try { L127: const parsed = new URL(`http://${literal.includes(":") ? `[${literal}]` : literal}/`); L128: hostname = parsed.hostname.replace(/^\[|\]$/g, "");

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code