registry / @vectorplane/ctrl-cli / 0.9.14

@vectorplane/ctrl-cli@0.9.14

Continuity CLI for teams that operate with AI every day.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 82 file(s), 841 KB of source, external domains: 127.0.0.1, absolute-urls-only.invalid, api.github.com, api.ipify.org, app.vectorplane.ai, bitbucket.org, github.com, gitlab.com, proxy-pn.vectorplane.ai

Source & flagged code

2 flagged

dist/commands/runner.jsView file

Lines 157-197javascript

157}

158const runnerStdoutLogger = {

159 debug: (_message, _ctx) => undefined,

160 info: (message, ctx) => {

161 process.stdout.write(`[runner] ${message}${ctx ? ` ${JSON.stringify(ctx)}` : ""}\n`);

162 },

163 warn: (message, ctx) => {

164 process.stderr.write(`[runner] AVISO ${message}${ctx ? ` ${JSON.stringify(ctx)}` : ""}\n`);

165 },

166 error: (message, ctx) => {

167 process.stderr.write(`[runner] ERRO ${message}${ctx ? ` ${JSON.stringify(ctx)}` : ""}\n`);

168 },

169};

170/**

171 * Canal de wake por push (plano 1c): WS autenticado em

172 * /workspace/{id}/stream via `ws` (o WebSocket padrão não aceita headers).

173 * Sem `ws` disponível ou com --no-wake, o runner vive só do poll (1b).

174 */

175async function buildWakeChannel(options) {

176 let WsCtor;

177 try {

178 WsCtor = (await import("ws")).WebSocket;

179 }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/runner.jsView on unpkg · L177

180 catch {

181 process.stderr.write("[runner] wake por push indisponível (pacote ws ausente); seguindo em poll\n");

182 return undefined;

183 }

184 const wsUrl = `${options.gatewayBaseUrl.replace(/^http/, "ws")}/workspace/${encodeURIComponent(options.workspaceId)}/stream`;

185 return new WakeChannel({

186 connect: async () => new WsCtor(wsUrl, {

187 headers: { Authorization: `Bearer ${await options.getToken()}` },

188 }),

189 capability: options.capability,

190 wakeTypes: options.wakeTypes,

191 });

192}

193function requirePlaneOption(parsed, flag, envName) {

194 const value = getStringOption(parsed, flag) ?? process.env[envName]?.trim();

195 if (!value) {

196 throw new ValidationError(`Configuração obrigatória ausente: --${flag} ou env ${envName}.`);

197 }

dist/core/git-auth-fix.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vectorplane/ctrl-cli@0.9.0 matchedIdentity = npm:QHZlY3RvcnBsYW5lL2N0cmwtY2xp:0.9.0 similarity = 0.855 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/git-auth-fix.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/commands/runner.jsView file

177package = @vectorplane/ctrl-cli; repositoryIdentity = vectorplane-ctrl-cli; dependency = ws L177: try { L178: WsCtor = (await import("ws")).WebSocket; L179: }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/runner.jsView on unpkg · L177

dist/core/git-auth-fix.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/git-auth-fix.jsView on unpkg

Findings

2 High3 Medium5 Low

HighCopied Package Dependency Bridgedist/commands/runner.js

HighPrevious Version Dangerous Deltadist/core/git-auth-fix.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/commands/runner.jsView file

Lines 157-197javascript

157}

158const runnerStdoutLogger = {

159 debug: (_message, _ctx) => undefined,

160 info: (message, ctx) => {

161 process.stdout.write(`[runner] ${message}${ctx ? ` ${JSON.stringify(ctx)}` : ""}\n`);

162 },

163 warn: (message, ctx) => {

164 process.stderr.write(`[runner] AVISO ${message}${ctx ? ` ${JSON.stringify(ctx)}` : ""}\n`);

165 },

166 error: (message, ctx) => {

167 process.stderr.write(`[runner] ERRO ${message}${ctx ? ` ${JSON.stringify(ctx)}` : ""}\n`);

168 },

169};

170/**

171 * Canal de wake por push (plano 1c): WS autenticado em

172 * /workspace/{id}/stream via `ws` (o WebSocket padrão não aceita headers).

173 * Sem `ws` disponível ou com --no-wake, o runner vive só do poll (1b).

174 */

175async function buildWakeChannel(options) {

176 let WsCtor;

177 try {

178 WsCtor = (await import("ws")).WebSocket;

179 }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/runner.jsView on unpkg · L177

180 catch {

181 process.stderr.write("[runner] wake por push indisponível (pacote ws ausente); seguindo em poll\n");

182 return undefined;

183 }

184 const wsUrl = `${options.gatewayBaseUrl.replace(/^http/, "ws")}/workspace/${encodeURIComponent(options.workspaceId)}/stream`;

185 return new WakeChannel({

186 connect: async () => new WsCtor(wsUrl, {

187 headers: { Authorization: `Bearer ${await options.getToken()}` },

188 }),

189 capability: options.capability,

190 wakeTypes: options.wakeTypes,

191 });

192}

193function requirePlaneOption(parsed, flag, envName) {

194 const value = getStringOption(parsed, flag) ?? process.env[envName]?.trim();

195 if (!value) {

196 throw new ValidationError(`Configuração obrigatória ausente: --${flag} ou env ${envName}.`);

197 }

dist/core/git-auth-fix.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/core/git-auth-fix.jsView on unpkg