registry / @telora/daemon / 0.19.26

@telora/daemon@0.19.26

Agent orchestration daemon for Telora - spawns and manages Claude Code instances

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 319 file(s), 2.48 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, api.osv.dev, api.syntelyos.com

Source & flagged code

3 flagged

dist/unified-shell.jsView file

Lines 7-47javascript

7 * unified config and passes them here.

8 *

9 * Lifecycle sequence:

10 * 1. Load unified config via loadUnifiedConfig()

11 * 2. Apply engine filter (--engine flag) if provided

12 * 3. Acquire PID lock at .telora/daemon.pid

13 * 4. Register uncaughtException / unhandledRejection handlers

14 * 5. Set up signal handlers (SIGTERM, SIGINT)

15 * 6. For each enabled engine: build config, create instance, init, recover, start

16 * 7. Register SIGUSR1 (status) and SIGUSR2 (circuit breaker reset) handlers

17 * 8. Keep the process running indefinitely

18 *

19 * On shutdown (SIGTERM/SIGINT):

20 * 1. Stop all engines (stop accepting new work)

21 * 2. Shut down all engines in parallel (graceful cleanup)

22 * 3. Release PID lock

23 * 4. Exit

24 */

25import { openSync, closeSync, existsSync } from 'node:fs';

26import { dirname, resolve } from 'node:path';

27import { fileURLToPath } from 'node:url';

28import { spawn, execFileSync } from 'node:child_process';

29import { loadUnifiedConfig, loadEnvConfig, acquirePidLock, releasePidLock, setupSignalHandlers, PidLockError, } from '@telora/daemon-core';

High

Child Process

Package source references child process execution.

dist/unified-shell.jsView on unpkg · L27

30import { startAutoUpdateLoop } from './auto-update.js';

31import { createDebouncedIdleGate, isBatchSafeIdle } from './auto-update-idle.js';

32import { getActiveTeamCount } from './focus-team-state.js';

33import { getReadyFocusQueueDepth } from './listener.js';

34import { isIntakeDraining } from './intake-control.js';

35import { startVersionCacheRefreshLoop, readFreshVersionCache } from './staleness.js';

36import { detectInstallMode, getCurrentVersion, isNpxRunMode, npxRunRefusalMessage } from './self-update.js';

37import { setDaemonShuttingDown } from './shutdown-state.js';

38import { startOtlpReceiver, stopOtlpReceiver } from './otlp-receiver.js';

39import { initTelemetryWriter, stopTelemetryWriter } from './telemetry-writer.js';

40import { startCircuitWedgeWatcher, stopCircuitWedgeWatcher } from './circuit-wedge-watcher.js';

41import { reapWorkerFleet } from './spawner/index.js';

42import { startLacunaSidecarIfEnabled, stopLacunaSidecar } from './backends/lacuna/index.js';

43import { rotateDaemonLog, setupCanonicalLogTee, writeDaemonMeta, removeDaemonMeta, resolveDaemonLogPath, resolvePidFilePath, ensureGlobalStateDir, STOP_DRAIN_BUDGET_MS } from './daemon-process.js';

44import { printUnifiedConfigSummary } from './unified-shell-status.js';

45import { resolveAutoUpdateEnabled, resolveAutoUpdateIntervalMs, resolveAutoUpdateIdleDebounceMs, resolveTelemetryConfig, telemetryFieldsFromFocus, resolveLacunaConfig, lacunaFieldsFromFocus, } from './unified-shell-config.js';

46import { createEnginesAndGovernor, initializeAndStartEngines, claimProducts, registerDiagnosticSignals, registerHotReloadSignal, } from './unified-engine-lifecycle.js';

47import { resolveMcpServerPath, writeMcpConfigFile } from './mcp-resolution.js';

dist/self-update.jsView file

Lines 1-32javascript

1/**

2 * Self-update mechanism for the Telora daemon.

3 *

4 * Handles the full update lifecycle:

5 * 1. Detect installation mode (npm global, npx cache, or git source)

6 * 2. Dependency-ordered rebuild chain for git source mode

7 * 3. Pre-update snapshot for rollback

8 * 4. Update orchestration (stop engines, update, restart)

9 * 5. Version check and up-to-date detection

10 * 6. Migration auto-apply after update

11 *

12 * Three installation modes:

scripts/telora-daemon-wrapper.shView file

•path = scripts/telora-daemon-wrapper.sh kind = build_helper sizeBytes = 774 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/telora-daemon-wrapper.shView on unpkg

Source & flagged code

3 flagged · loading source

dist/unified-shell.jsView file

27import { fileURLToPath } from 'node:url'; L28: import { spawn, execFileSync } from 'node:child_process'; L29: import { loadUnifiedConfig, loadEnvConfig, acquirePidLock, releasePidLock, setupSignalHandlers, PidLockError, } from '@telora/daemon-core';

High

Child Process

Package source references child process execution.

dist/unified-shell.jsView on unpkg · L27

dist/self-update.jsView file

12* Three installation modes: L13: * - **npm**: Installed globally via `npm install -g @telora/daemon`. L14: * Updates via `npm install -g @telora/daemon@latest`. ... L21: */ L22: import { execFileSync, execFile } from 'node:child_process'; L23: import { existsSync, readFileSync, writeFileSync, mkdirSync, rmSync } from 'node:fs';

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/self-update.jsView on unpkg · L12

scripts/telora-daemon-wrapper.shView file

•path = scripts/telora-daemon-wrapper.sh kind = build_helper sizeBytes = 774 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/telora-daemon-wrapper.shView on unpkg

Findings

3 High4 Medium5 Low

HighChild Processdist/unified-shell.js

HighShell

HighRuntime Package Installdist/self-update.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/telora-daemon-wrapper.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/unified-shell.jsView file

Lines 7-47javascript

7 * unified config and passes them here.

8 *

9 * Lifecycle sequence:

10 * 1. Load unified config via loadUnifiedConfig()

11 * 2. Apply engine filter (--engine flag) if provided

12 * 3. Acquire PID lock at .telora/daemon.pid

13 * 4. Register uncaughtException / unhandledRejection handlers

14 * 5. Set up signal handlers (SIGTERM, SIGINT)

15 * 6. For each enabled engine: build config, create instance, init, recover, start

16 * 7. Register SIGUSR1 (status) and SIGUSR2 (circuit breaker reset) handlers

17 * 8. Keep the process running indefinitely

18 *

19 * On shutdown (SIGTERM/SIGINT):

20 * 1. Stop all engines (stop accepting new work)

21 * 2. Shut down all engines in parallel (graceful cleanup)

22 * 3. Release PID lock

23 * 4. Exit

24 */

25import { openSync, closeSync, existsSync } from 'node:fs';

26import { dirname, resolve } from 'node:path';

27import { fileURLToPath } from 'node:url';

28import { spawn, execFileSync } from 'node:child_process';

29import { loadUnifiedConfig, loadEnvConfig, acquirePidLock, releasePidLock, setupSignalHandlers, PidLockError, } from '@telora/daemon-core';

High

Child Process

Package source references child process execution.

dist/unified-shell.jsView on unpkg · L27

30import { startAutoUpdateLoop } from './auto-update.js';

31import { createDebouncedIdleGate, isBatchSafeIdle } from './auto-update-idle.js';

32import { getActiveTeamCount } from './focus-team-state.js';

33import { getReadyFocusQueueDepth } from './listener.js';

34import { isIntakeDraining } from './intake-control.js';

35import { startVersionCacheRefreshLoop, readFreshVersionCache } from './staleness.js';

36import { detectInstallMode, getCurrentVersion, isNpxRunMode, npxRunRefusalMessage } from './self-update.js';

37import { setDaemonShuttingDown } from './shutdown-state.js';

38import { startOtlpReceiver, stopOtlpReceiver } from './otlp-receiver.js';

39import { initTelemetryWriter, stopTelemetryWriter } from './telemetry-writer.js';

40import { startCircuitWedgeWatcher, stopCircuitWedgeWatcher } from './circuit-wedge-watcher.js';

41import { reapWorkerFleet } from './spawner/index.js';

42import { startLacunaSidecarIfEnabled, stopLacunaSidecar } from './backends/lacuna/index.js';

43import { rotateDaemonLog, setupCanonicalLogTee, writeDaemonMeta, removeDaemonMeta, resolveDaemonLogPath, resolvePidFilePath, ensureGlobalStateDir, STOP_DRAIN_BUDGET_MS } from './daemon-process.js';

44import { printUnifiedConfigSummary } from './unified-shell-status.js';

46import { createEnginesAndGovernor, initializeAndStartEngines, claimProducts, registerDiagnosticSignals, registerHotReloadSignal, } from './unified-engine-lifecycle.js';

47import { resolveMcpServerPath, writeMcpConfigFile } from './mcp-resolution.js';

dist/self-update.jsView file

Lines 1-32javascript

1/**

2 * Self-update mechanism for the Telora daemon.

3 *

4 * Handles the full update lifecycle:

5 * 1. Detect installation mode (npm global, npx cache, or git source)

6 * 2. Dependency-ordered rebuild chain for git source mode

7 * 3. Pre-update snapshot for rollback

8 * 4. Update orchestration (stop engines, update, restart)

9 * 5. Version check and up-to-date detection

10 * 6. Migration auto-apply after update

11 *

12 * Three installation modes:

scripts/telora-daemon-wrapper.shView file

•path = scripts/telora-daemon-wrapper.sh kind = build_helper sizeBytes = 774 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/telora-daemon-wrapper.shView on unpkg