registry / @workflow-cannon/workspace-kit / 1.0.3

@workflow-cannon/workspace-kit@1.0.3

AI agents: read **`./.ai/`** first (see repo-root [`AGENTS.md`](AGENTS.md), [`.ai/agent-source-of-truth-order.md`](.ai/agent-source-of-truth-order.md), [`.cursor/rules/agent-doc-routing.mdc`](.cursor/rules/agent-doc-routing.mdc)).

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 573 file(s), 3.66 MB of source, external domains: 127.0.0.1, example.com, json-schema.org, workflow-cannon.dev

Source & flagged code

3 flagged

package.jsonView file

Lines 25-65json

25 "./contracts/agent-phase-journal-read-contract": "./dist/contracts/agent-phase-journal-read-contract.js",

26 "./contracts/agent-phase-focus-dashboard-contract": "./dist/contracts/agent-phase-focus-dashboard-contract.js",

27 "./contracts/dashboard-summary-run": "./dist/contracts/dashboard-summary-run.js",

28 "./modules/task-engine/dashboard/enrich-dashboard-agent-activity-summary": "./dist/modules/task-engine/dashboard/enrich-dashboard-agent-activity-summary.js",

29 "./contracts/dashboard-snapshot": "./dist/contracts/dashboard-snapshot.js",

30 "./contracts/dashboard-events": "./dist/contracts/dashboard-events.js",

31 "./mcp": "./dist/mcp/index.js",

32 "./mcp/server": "./dist/mcp/server.js",

33 "./services/dashboard-service/resolve-data-source-config": "./dist/services/dashboard-service/resolve-data-source-config.js",

34 "./services/dashboard-service/server": "./dist/services/dashboard-service/server.js",

35 "./contracts/agent-session-snapshot-run": "./dist/contracts/agent-session-snapshot-run.js",

36 "./contracts/next-actions-run": "./dist/contracts/next-actions-run.js",

37 "./package.json": "./package.json"

38 },

39 "bin": {

40 "workspace-kit": "dist/cli.js",

41 "wk": "dist/cli.js",

42 "wk-mcp": "dist/mcp/cli.js"

43 },

44 "scripts": {

45 "postinstall": "node scripts/check-native-binding-arch.mjs && node scripts/ensure-native-sqlite.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "setup:dev": "node scripts/setup-dev.mjs",

47 "wk": "node dist/cli.js",

48 "build": "tsc -p tsconfig.json",

49 "rebuild-sqlite": "pnpm rebuild better-sqlite3",

50 "check-native-binding-arch": "node scripts/check-native-binding-arch.mjs",

51 "_comment_check_gates": "maintainer-gates = metadata/consistency checks; pre-merge-gates = maintainer-gates + test.",

52 "check": "node scripts/run-check-stages.mjs",

53 "clean": "rm -rf dist",

54 "test": "pnpm run ui:prepare && pnpm run test:run",

55 "test:run": "find test -name '*.test.mjs' -print0 | xargs -0 node --test",

56 "test:plan-artifact-fixtures": "node scripts/check-plan-artifact-fixtures.mjs && node --test test/plan-artifact-review-fixtures.integration.test.mjs test/plan-artifact-e2e-cli.test.mjs",

57 "pack:dry-run": "pnpm run build && pnpm pack --pack-destination ./artifacts/workspace-kit-pack",

58 "prepare-release-artifacts": "node scripts/prepare-release-artifacts.mjs",

59 "check-release-metadata": "node scripts/check-release-metadata.mjs",

60 "parity": "node scripts/run-parity.mjs",

61 "check-compatibility": "pnpm run build && node scripts/check-compatibility.mjs",

62 "check-planning-consistency": "node scripts/check-planning-doc-consistency.mjs",

63 "check-init-first-run-docs": "node scripts/check-init-first-run-doc-strings.mjs",

64 "check-release-channel": "node scripts/check-release-channel.mjs",

65 "generate-runtime-diagnostics": "node scripts/generate-runtime-diagnostics.mjs",

dist/core/kit-lifecycle-hooks.jsView file

Lines 78-118javascript

78 const dir = path.dirname(file);

79 await fs.mkdir(dir, { recursive: true });

80 const line = JSON.stringify({ ...row, timestamp: new Date().toISOString() })

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/check-native-binding-arch.mjs && node scripts/ensure-native-sqlite.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/check-native-binding-arch.mjs && node scripts/ensure-native-sqlite.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/core/kit-lifecycle-hooks.jsView file

98try { L99: const mod = await import(pathToFileURL(abs).href); L100: const fn = mod.handle;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/core/kit-lifecycle-hooks.jsView on unpkg · L98

Findings

1 High5 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/core/kit-lifecycle-hooks.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 25-65json

25 "./contracts/agent-phase-journal-read-contract": "./dist/contracts/agent-phase-journal-read-contract.js",

26 "./contracts/agent-phase-focus-dashboard-contract": "./dist/contracts/agent-phase-focus-dashboard-contract.js",

27 "./contracts/dashboard-summary-run": "./dist/contracts/dashboard-summary-run.js",

28 "./modules/task-engine/dashboard/enrich-dashboard-agent-activity-summary": "./dist/modules/task-engine/dashboard/enrich-dashboard-agent-activity-summary.js",

29 "./contracts/dashboard-snapshot": "./dist/contracts/dashboard-snapshot.js",

30 "./contracts/dashboard-events": "./dist/contracts/dashboard-events.js",

31 "./mcp": "./dist/mcp/index.js",

32 "./mcp/server": "./dist/mcp/server.js",

33 "./services/dashboard-service/resolve-data-source-config": "./dist/services/dashboard-service/resolve-data-source-config.js",

34 "./services/dashboard-service/server": "./dist/services/dashboard-service/server.js",

35 "./contracts/agent-session-snapshot-run": "./dist/contracts/agent-session-snapshot-run.js",

36 "./contracts/next-actions-run": "./dist/contracts/next-actions-run.js",

37 "./package.json": "./package.json"

38 },

39 "bin": {

40 "workspace-kit": "dist/cli.js",

41 "wk": "dist/cli.js",

42 "wk-mcp": "dist/mcp/cli.js"

43 },

44 "scripts": {

45 "postinstall": "node scripts/check-native-binding-arch.mjs && node scripts/ensure-native-sqlite.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "setup:dev": "node scripts/setup-dev.mjs",

47 "wk": "node dist/cli.js",

48 "build": "tsc -p tsconfig.json",

49 "rebuild-sqlite": "pnpm rebuild better-sqlite3",

50 "check-native-binding-arch": "node scripts/check-native-binding-arch.mjs",

51 "_comment_check_gates": "maintainer-gates = metadata/consistency checks; pre-merge-gates = maintainer-gates + test.",

52 "check": "node scripts/run-check-stages.mjs",

53 "clean": "rm -rf dist",

54 "test": "pnpm run ui:prepare && pnpm run test:run",

55 "test:run": "find test -name '*.test.mjs' -print0 | xargs -0 node --test",

56 "test:plan-artifact-fixtures": "node scripts/check-plan-artifact-fixtures.mjs && node --test test/plan-artifact-review-fixtures.integration.test.mjs test/plan-artifact-e2e-cli.test.mjs",

57 "pack:dry-run": "pnpm run build && pnpm pack --pack-destination ./artifacts/workspace-kit-pack",

58 "prepare-release-artifacts": "node scripts/prepare-release-artifacts.mjs",

59 "check-release-metadata": "node scripts/check-release-metadata.mjs",

60 "parity": "node scripts/run-parity.mjs",

61 "check-compatibility": "pnpm run build && node scripts/check-compatibility.mjs",

62 "check-planning-consistency": "node scripts/check-planning-doc-consistency.mjs",

63 "check-init-first-run-docs": "node scripts/check-init-first-run-doc-strings.mjs",

64 "check-release-channel": "node scripts/check-release-channel.mjs",

65 "generate-runtime-diagnostics": "node scripts/generate-runtime-diagnostics.mjs",

dist/core/kit-lifecycle-hooks.jsView file

Lines 78-118javascript

78 const dir = path.dirname(file);

79 await fs.mkdir(dir, { recursive: true });

80 const line = JSON.stringify({ ...row, timestamp: new Date().toISOString() })