registry / @telora/daemon / 0.19.74

@telora/daemon@0.19.74

⚠ Under review

Agent orchestration daemon for Telora - spawns and manages Claude Code instances

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 366 file(s), 2.67 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, api.osv.dev, api.syntelyos.com

Source & flagged code

4 flagged

dist/unified-shell.jsView file

Lines 7-47javascript

7 * the unified config and passes them here.

8 *

9 * Lifecycle sequence:

10 * 1. Load unified config via loadUnifiedConfig()

11 * 2. Apply engine filter (--engine flag) if provided

12 * 3. Acquire PID lock at .telora/daemon.pid

13 * 4. Register uncaughtException / unhandledRejection handlers

14 * 5. Set up signal handlers (SIGTERM, SIGINT)

15 * 6. For each enabled engine: build config, create instance, init, recover, start

16 * 7. Register SIGUSR1 (status) and SIGUSR2 (circuit breaker reset) handlers

17 * 8. Keep the process running indefinitely

18 *

19 * On shutdown (SIGTERM/SIGINT):

20 * 1. Stop all engines (stop accepting new work)

21 * 2. Shut down all engines in parallel (graceful cleanup)

22 * 3. Release PID lock

23 * 4. Exit

24 */

25import { openSync, closeSync, existsSync } from 'node:fs';

26import { dirname, resolve } from 'node:path';

27import { fileURLToPath } from 'node:url';

28import { spawn, execFileSync } from 'node:child_process';

29import { loadUnifiedConfig, loadEnvConfig, acquirePidLock, releasePidLock, PidLockError, } from '@telora/daemon-core';

High

Child Process

Package source references child process execution.

dist/unified-shell.jsView on unpkg · L27

30import { startAutoUpdateLoop } from './auto-update.js';

31import { createDebouncedIdleGate, isBatchSafeIdle } from './auto-update-idle.js';

32import { getActiveTeamCount } from './focus-team-state.js';

33import { getReadyFocusQueueDepth } from './listener.js';

34import { isIntakeDraining, armDrainForUpdate } from './intake-control.js';

35import { runDrainToIdleTeardown } from './drain-teardown.js';

36import { readStopRequest, clearStopRequest, decideStopAction } from './stop-request.js';

37import { startVersionCacheRefreshLoop, readFreshVersionCache } from './staleness.js';

38import { detectInstallMode, getCurrentVersion, isNpxRunMode, npxRunRefusalMessage } from './self-update.js';

39import { setDaemonShuttingDown } from './shutdown-state.js';

40import { startOtlpReceiver, stopOtlpReceiver } from './otlp/index.js';

41import { initTelemetryWriter, stopTelemetryWriter } from './telemetry-writer.js';

42import { startCircuitWedgeWatcher, stopCircuitWedgeWatcher } from './circuit-wedge-watcher.js';

43import { reapWorkerFleet } from './spawner/index.js';

44import { clearWorkerPidfile, reapAndClearWorkerPidfile } from './worker-pidfile.js';

45import { startLacunaSidecarIfEnabled, stopLacunaSidecar } from './backends/lacuna/index.js';

46import { rotateDaemonLog, setupCanonicalLogTee, writeDaemonMeta, removeDaemonMeta, resolveDaemonLogPath, resolvePidFilePath, ensureGlobalStateDir, STOP_DRAIN_BUDGET_MS } from './daemon-process.js';

47import { printUnifiedConfigSummary } from './unified-shell-status.js';

dist/self-update.jsView file

Lines 1-32javascript

1/**

2 * Self-update mechanism for the Telora daemon.

3 *

4 * Handles the full update lifecycle:

5 * 1. Detect installation mode (npm global, npx cache, or git source)

6 * 2. Dependency-ordered rebuild chain for git source mode

7 * 3. Pre-update snapshot for rollback

8 * 4. Update orchestration (stop engines, update, restart)

9 * 5. Version check and up-to-date detection

10 * 6. Migration auto-apply after update

11 *

12 * Three installation modes:

scripts/telora-daemon-wrapper.shView file

•path = scripts/telora-daemon-wrapper.sh kind = build_helper sizeBytes = 774 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/telora-daemon-wrapper.shView on unpkg

dist/cli/connect.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @telora/daemon@0.19.26 matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.19.26 similarity = 0.717 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/connect.jsView on unpkg

Source & flagged code

4 flagged · loading source

dist/unified-shell.jsView file

27import { fileURLToPath } from 'node:url'; L28: import { spawn, execFileSync } from 'node:child_process'; L29: import { loadUnifiedConfig, loadEnvConfig, acquirePidLock, releasePidLock, PidLockError, } from '@telora/daemon-core';

High

Child Process

Package source references child process execution.

dist/unified-shell.jsView on unpkg · L27

dist/self-update.jsView file

12* Three installation modes: L13: * - **npm**: Installed globally via `npm install -g @telora/daemon`. L14: * Updates via `npm install -g @telora/daemon@latest`. ... L21: */ L22: import { execFileSync, execFile } from 'node:child_process'; L23: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/self-update.jsView on unpkg · L12

scripts/telora-daemon-wrapper.shView file

•path = scripts/telora-daemon-wrapper.sh kind = build_helper sizeBytes = 774 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/telora-daemon-wrapper.shView on unpkg

dist/cli/connect.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/connect.jsView on unpkg

Findings

1 Critical3 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli/connect.js

HighChild Processdist/unified-shell.js

HighShell

HighRuntime Package Installdist/self-update.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/telora-daemon-wrapper.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings