@telora/daemon@0.19.96

⚠ Under review

Agent orchestration daemon for Telora - spawns and manages Claude Code instances

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 378 file(s), 2.78 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, api.openai.com, api.osv.dev, api.syntelyos.com

Source & flagged code

5 flagged

dist/unified-shell.jsView file

Lines 7-47javascript

7 * the unified config and passes them here.

8 *

9 * Lifecycle sequence:

10 * 1. Load unified config via loadUnifiedConfig()

11 * 2. Apply engine filter (--engine flag) if provided

12 * 3. Acquire PID lock at .telora/daemon.pid

13 * 4. Register uncaughtException / unhandledRejection handlers

14 * 5. Set up signal handlers (SIGTERM, SIGINT)

15 * 6. For each enabled engine: build config, create instance, init, recover, start

16 * 7. Register SIGUSR1 (status) and SIGUSR2 (circuit breaker reset) handlers

17 * 8. Keep the process running indefinitely

18 *

19 * On shutdown (SIGTERM/SIGINT):

20 * 1. Stop all engines (stop accepting new work)

21 * 2. Shut down all engines in parallel (graceful cleanup)

22 * 3. Release PID lock

23 * 4. Exit

24 */

25import { openSync, closeSync, existsSync } from 'node:fs';

26import { dirname, resolve } from 'node:path';

27import { fileURLToPath } from 'node:url';

28import { spawn, execFileSync } from 'node:child_process';

29import { loadUnifiedConfig, loadEnvConfig, acquirePidLock, releasePidLock, PidLockError, } from '@telora/daemon-core';

High

Child Process

Package source references child process execution.

dist/unified-shell.jsView on unpkg · L27

30import { startAutoUpdateLoop } from './auto-update.js';

31import { createDebouncedIdleGate, isBatchSafeIdle } from './auto-update-idle.js';

32import { getActiveTeamCount } from './focus-team-state.js';

33import { getReadyFocusQueueDepth } from './listener.js';

34import { isIntakeDraining, armDrainForUpdate } from './intake-control.js';

35import { runDrainToIdleTeardown } from './drain-teardown.js';

36import { readStopRequest, clearStopRequest, decideStopAction } from './stop-request.js';

37import { startVersionCacheRefreshLoop, readFreshVersionCache } from './staleness.js';

38import { detectInstallMode, getCurrentVersion, isNpxRunMode, npxRunRefusalMessage } from './self-update.js';

39import { setDaemonShuttingDown } from './shutdown-state.js';

40import { startOtlpReceiver, stopOtlpReceiver } from './otlp/index.js';

41import { initTelemetryWriter, stopTelemetryWriter } from './telemetry-writer.js';

42import { startCircuitWedgeWatcher, stopCircuitWedgeWatcher } from './circuit-wedge-watcher.js';

43import { reapWorkerFleet } from './spawner/index.js';

44import { clearWorkerPidfile, reapAndClearWorkerPidfile } from './worker-pidfile.js';

45import { startLacunaSidecarIfEnabled, stopLacunaSidecar } from './backends/lacuna/index.js';

46import { rotateDaemonLog, setupCanonicalLogTee, writeDaemonMeta, removeDaemonMeta, resolveDaemonLogPath, resolvePidFilePath, ensureGlobalStateDir, STOP_DRAIN_BUDGET_MS } from './daemon-process.js';

47import { printUnifiedConfigSummary, formatVerificationPostureLines } from './unified-shell-status.js';

dist/cli/verify-setup.jsView file

Lines 117-157javascript

117 * Walk every product through the guided setup. Returns the per-product outcomes

118 * in order.

119 */

120export async function runVerifySetup(products, io) {

dist/self-update.jsView file

Lines 1-32javascript

1/**

2 * Self-update mechanism for the Telora daemon.

3 *

4 * Handles the full update lifecycle:

5 * 1. Detect installation mode (npm global, npx cache, or git source)

6 * 2. Dependency-ordered rebuild chain for git source mode

7 * 3. Pre-update snapshot for rollback

8 * 4. Update orchestration (stop engines, update, restart)

9 * 5. Version check and up-to-date detection

10 * 6. Migration auto-apply after update

scripts/telora-daemon-wrapper.shView file

•path = scripts/telora-daemon-wrapper.sh kind = build_helper sizeBytes = 774 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/telora-daemon-wrapper.shView on unpkg

dist/cli/connect.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @telora/daemon@0.19.26 matchedIdentity = npm:QHRlbG9yYS9kYWVtb24:0.19.26 similarity = 0.650 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli/connect.jsView on unpkg

Source & flagged code

5 flagged · loading source

dist/unified-shell.jsView file

27import { fileURLToPath } from 'node:url'; L28: import { spawn, execFileSync } from 'node:child_process'; L29: import { loadUnifiedConfig, loadEnvConfig, acquirePidLock, releasePidLock, PidLockError, } from '@telora/daemon-core';

High

Child Process

Package source references child process execution.

dist/unified-shell.jsView on unpkg · L27

dist/cli/verify-setup.jsView file

137return new Promise((res) => { L138: const child = spawn(command, { cwd: repoPath, shell: true, stdio: 'inherit' }); L139: child.on('close', (code) => res({ exitCode: code ?? 1, durationMs: Date.now() - startedAt }));

High

Shell

Package source references shell execution.

dist/cli/verify-setup.jsView on unpkg · L137

dist/self-update.jsView file

Findings

1 Critical3 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/cli/connect.js

HighChild Processdist/unified-shell.js

HighShelldist/cli/verify-setup.js

HighRuntime Package Installdist/self-update.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/telora-daemon-wrapper.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to @telora/daemon@0.19.96.

See all versions of @telora/daemon for other recorded verdicts.

Review the evidence and your use of @telora/daemon@0.19.96 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-10 13:01:28.464Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

More from @telora

Behavioral surface

Related packages

More from @telora

Source & flagged code