registry / @tokenoftrust/cli / 1.2.3

@tokenoftrust/cli@1.2.3

Token of Trust developer CLI — check out a tenant store, run it locally with save→reload, and submit it for preview. Installs the `tot` command.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 203 KB of source, external domains: 127.0.0.1, docs.docker.com, git-scm.com, mcp.tokenoftrust.com, registry.npmjs.org

Source & flagged code

4 flagged

src/update-check.mjsView file

Lines 9-49javascript

9 * Two layers, both baked in here:

10 * • Layer 1 — client compare: fetch our own `latest` dist-tag from the npm registry

11 * and compare to the running version. Answers "is there something newer?"

12 * • Layer 2 — server policy: an authed command that talks to the MCP can hand us a

13 * `{ minSupported, recommended, message }` policy (via recordServerPolicy). Answers

14 * "is this version still SUPPORTED?" — a decision only the server can make. Because

15 * the client just renders whatever policy it was last handed, we can raise a hard

16 * floor years from now and even today's build will honor it. That render-what-the-

17 * server-says hook is the part that must exist now; the policy stays editable forever.

18 *

19 * Contract (like activity-log / token-store):

20 * • NEVER throws and NEVER blocks a command. The nudge is drawn from the LAST cached

21 * result (instant, no network on the hot path); the registry refresh happens in a

22 * DETACHED, unref'd child so it can't add latency or hold the process open.

23 * • Cached in `~/.tot/update-check.json`; refreshed at most once per CHECK_INTERVAL_MS.

24 * • Suppressed when stderr isn't a TTY, in CI, or when TOT_NO_UPDATE_CHECK /

25 * NO_UPDATE_NOTIFIER is set. `TOT_HOME` overrides the home dir (tests).

26 */

27import { readFileSync, writeFileSync, mkdirSync, renameSync, chmodSync } from "node:fs";

28import { homedir } from "node:os";

29import { join, dirname } from "node:path";

30import { spawn } from "node:child_process";

31import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

src/update-check.mjsView on unpkg · L29

33/** Refresh the registry check at most this often. */

34export const CHECK_INTERVAL_MS = 24 * 60 * 60 * 1000; // 24h

36const PKG = "@tokenoftrust/cli";

37const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org";

38const FETCH_TIMEOUT_MS = 3000;

40/** Absolute path to the update-check cache for this environment. */

41export function updateCachePath(env = process.env) {

42 const home = env.TOT_HOME || homedir();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/update-check.mjsView on unpkg · L29

43 return join(home, ".tot", "update-check.json");

44}

46function readCache(env) {

47 try {

48 return JSON.parse(readFileSync(updateCachePath(env), "utf8"));

49 } catch {

src/commands/dev.mjsView file

Lines 1-36javascript

1/**

2 * `tot dev` — run your store locally with save→reload.

3 *

4 * The runtime splits by context:

5 *

6 * monorepo — the storefront runner IS present in the tree, so `tot dev`

7 * delegates to the proven scripts/tot-dev.mjs (astro dev + Vite HMR,

8 * monorepo or --workspace graft mode). Fast host loop for platform devs.

9 *

10 * checkout — a standalone tenant checkout has no runner. `tot dev` DOWNLOADS the

11 * published, RUNNER ARTIFACT (a plain tarball — the exact

Source & flagged code

4 flagged · loading source

src/update-check.mjsView file

29import { join, dirname } from "node:path"; L30: import { spawn } from "node:child_process"; L31: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

src/update-check.mjsView on unpkg · L29

29import { join, dirname } from "node:path"; L30: import { spawn } from "node:child_process"; L31: import { fileURLToPath } from "node:url"; ... L36: const PKG = "@tokenoftrust/cli"; L37: const DEFAULT_NPM_REGISTRY = "https://registry.npmjs.org"; L38: const FETCH_TIMEOUT_MS = 3000; ... L40: /** Absolute path to the update-check cache for this environment. */ L41: export function updateCachePath(env = process.env) { L42: const home = env.TOT_HOME || homedir();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/update-check.mjsView on unpkg · L29

src/commands/dev.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tokenoftrust/cli@1.2.2 matchedIdentity = npm:QHRva2Vub2Z0cnVzdC9jbGk:1.2.2 similarity = 0.880 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/commands/dev.mjsView on unpkg

16* scripts/tot-dev.mjs grafts the checkout in and boots astro dev L17: * --host at http://localhost:<port>/<appDomain>/, with real (not L18: * polled) file-watch HMR. Nothing is published; product data renders ... L33: */ L34: import { spawn, spawnSync, execFileSync } from "node:child_process"; L35: import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, rmSync, createWriteStream } from "node:fs"; ... L55: /** Where downloaded+installed renderer-artifact versions are cached, one dir per version. */ L56: const RENDERER_CACHE_ROOT = join(homedir(), ".tot", "cache", "renderer"); L57: /** The PUBLIC, un-entitled runner published to npm (sample / zero-login mode). */ ... L94: L95: Edit content/*.html or the theme + save → the browser reloads. Private local L96: preview — nothing is published. Prerequisites: Node.js and an invite (or just

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/commands/dev.mjsView on unpkg · L16

Findings

4 High2 Medium5 Low

HighChild Processsrc/update-check.mjs

HighShell

HighSame File Env Network Executionsrc/update-check.mjs

HighPrevious Version Dangerous Deltasrc/commands/dev.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptosrc/commands/dev.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings