registry / @treeseed/agent / 0.12.41

@treeseed/agent@0.12.41

Treeseed agent service runtime package.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 140 file(s), 1011 KB of source, external domains: 127.0.0.1, api.github.com, api.treeseed.dev, backboard.railway.com, discord.com, example.com, example.invalid, example.test, github.com, platform.openai.com, study.local

Source & flagged code

3 flagged

dist/agents/registry.jsView file

Lines 59-99javascript

59 const agentsRoot = resolve(tenantRoot, "src/agents");

60 if (!existsSync(agentsRoot)) {

61 return [...BUILTIN_HANDLER_KINDS];

62 }

63 const localKinds = readdirSync(agentsRoot, { withFileTypes: true }).filter((entry) => entry.isFile()).map((entry) => entry.name.match(/^(.+)\.(?:js|ts)$/u)?.[1] ?? null).filter((entry) => Boolean(entry && !entry.startsWith("_") && !entry.endsWith(".d")));

64 return [.../* @__PURE__ */ new Set([...BUILTIN_HANDLER_KINDS, ...localKinds])];

65}

66function findNearestTsconfig(startPath) {

67 let current = dirname(startPath);

68 while (true) {

69 const candidate = resolve(current, "tsconfig.json");

70 if (existsSync(candidate)) {

71 return candidate;

72 }

73 const parent = resolve(current, "..");

74 if (parent === current) {

75 return null;

76 }

77 current = parent;

78 }

79}

80function resolveSelfContractImport(importPath) {

81 const relativeContractPath = SELF_CONTRACT_IMPORTS[importPath];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/agents/registry.jsView on unpkg · L79

82 if (!relativeContractPath) {

83 return null;

84 }

85 const moduleDir = dirname(fileURLToPath(import.meta.url));

86 const candidates = [

87 resolve(moduleDir, `${relativeContractPath}.ts`),

88 resolve(moduleDir, `${relativeContractPath}.js`),

89 resolve(moduleDir, "..", "src", "agents", `${relativeContractPath}.ts`),

90 resolve(moduleDir, "..", "dist", "agents", `${relativeContractPath}.js`)

91 ];

92 return candidates.find((candidate) => existsSync(candidate)) ?? null;

93}

94async function importTenantAgentHandlerModule(modulePath) {

95 if (extname(modulePath) !== ".ts") {

96 return await import(

97 /* @vite-ignore */

98 pathToFileURL(modulePath).href

99 );

docker-entrypoint.shView file

•path = docker-entrypoint.sh kind = build_helper sizeBytes = 498 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker-entrypoint.shView on unpkg

dist/agents/testing/e2e-harness.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @treeseed/agent@0.12.37 matchedIdentity = npm:QHRyZWVzZWVkL2FnZW50:0.12.37 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/testing/e2e-harness.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/agents/registry.jsView file

79} L80: function resolveSelfContractImport(importPath) { L81: const relativeContractPath = SELF_CONTRACT_IMPORTS[importPath];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/agents/registry.jsView on unpkg · L79

docker-entrypoint.shView file

•path = docker-entrypoint.sh kind = build_helper sizeBytes = 498 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker-entrypoint.shView on unpkg

dist/agents/testing/e2e-harness.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/testing/e2e-harness.jsView on unpkg

Findings

1 High5 Medium6 Low

HighPrevious Version Dangerous Deltadist/agents/testing/e2e-harness.js

MediumDynamic Requiredist/agents/registry.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdocker-entrypoint.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

3 flagged

dist/agents/registry.jsView file

Lines 59-99javascript

59 const agentsRoot = resolve(tenantRoot, "src/agents");

60 if (!existsSync(agentsRoot)) {

61 return [...BUILTIN_HANDLER_KINDS];

62 }

64 return [.../* @__PURE__ */ new Set([...BUILTIN_HANDLER_KINDS, ...localKinds])];

65}

66function findNearestTsconfig(startPath) {

67 let current = dirname(startPath);

68 while (true) {

69 const candidate = resolve(current, "tsconfig.json");

70 if (existsSync(candidate)) {

71 return candidate;

72 }

73 const parent = resolve(current, "..");

74 if (parent === current) {

75 return null;

76 }

77 current = parent;

78 }

79}

80function resolveSelfContractImport(importPath) {

81 const relativeContractPath = SELF_CONTRACT_IMPORTS[importPath];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/agents/registry.jsView on unpkg · L79

82 if (!relativeContractPath) {

83 return null;

84 }

85 const moduleDir = dirname(fileURLToPath(import.meta.url));

86 const candidates = [

87 resolve(moduleDir, `${relativeContractPath}.ts`),

88 resolve(moduleDir, `${relativeContractPath}.js`),

89 resolve(moduleDir, "..", "src", "agents", `${relativeContractPath}.ts`),

90 resolve(moduleDir, "..", "dist", "agents", `${relativeContractPath}.js`)

91 ];

92 return candidates.find((candidate) => existsSync(candidate)) ?? null;

93}

94async function importTenantAgentHandlerModule(modulePath) {

95 if (extname(modulePath) !== ".ts") {

96 return await import(

97 /* @vite-ignore */

98 pathToFileURL(modulePath).href

99 );

docker-entrypoint.shView file

•path = docker-entrypoint.sh kind = build_helper sizeBytes = 498 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker-entrypoint.shView on unpkg

dist/agents/testing/e2e-harness.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agents/testing/e2e-harness.jsView on unpkg