registry / @wular/coder / 0.2.6

@wular/coder@0.2.6

Delegating coding-agent runtime

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 3 file(s), 395 KB of source, external domains: 127.0.0.1, json-schema.org, openrouter.ai, registry.npmjs.org

Source & flagged code

5 flagged

dist/lib/broker.jsView file

Lines 1-17javascript

1#!/usr/bin/env node

2var E$=Object.defineProperty;var U1=($,W)=>{for(var q in W)E$($,q,{get:W[q],enumerable:!0,configurable:!0,set:(Z)=>W[q]=()=>Z})};import u from"node:fs";import X1 from"node:net";import W$ from"node:path";import T from"node:process";function K$($,W={}){let q=new Set(W.valueOptions??[]),Z=new Set(W.booleanOptions??[]),K=W.aliasMap??{},Q={},X=[],G=!1;for(let H=0;H<$.length;H+=1){let M=$[H];if(G){X.push(M);continue}if(M==="--"){G=!0;continue}if(!M.startsWith("-")||M==="-"){X.push(M);continue}if(M.startsWith("--")){let[x,_]=M.slice(2).split("=",2),J=K[x]??x;if(Z.has(J)){Q[J]=_===void 0?!0:_!=="false ...

3`,"utf8"),X}function N$($){if(!$.engine&&($.agent==="codex"||$.agent==="claude"))$.engine=$.agent;return $}function F$($,W){let q=N.join(B($,W),"job.json");if(!V.existsSync(q))return null;try{return N$(JSON.parse(V.readFileSync(q,"utf8")))}catch{return null}}function E1($,W){let q=B($,W);if(!V.existsSync(q))return!1;return V.rmSync(q,{recursive:!0,force:!0}),!0}function h$($){if(!$)return!1;try{return process.kill($,0),!0}catch(W){return W.code==="EPERM"}}function D$($){try{let W=z$("ps",["-o","lstart=","-p",String($)],{encoding:"utf8",stdio:["ignore","pipe","ignore"]}).trim(),q=W?Date.parse(W ...

High

Child Process

Package source references child process execution.

dist/lib/broker.jsView on unpkg · L1

4`,"utf8")}function S1($,W,q=40){let Z=N.join(B($,W),"log.jsonl");if(!V.existsSync(

5`,"utf8")}function s$($){let W=d($);if(O.existsSync(W))O.unlinkSync(W)}async function o$($){if(!$)return!1;try{return await R$($,150)}catch{return!1}}async function x$($,W={}){let q=W.scriptPath??d$(),Z=V$(),K=r($),Q=K?.version===Z&&K?.scriptPath===q;if(K&&Q&&await o$(K.endpoint))return K;if(K)O$({endpoint:K.endpoint??null,pidFile:K.pidFile??null,logFile:K.logFile??null,sessionDir:K.sessionDir??null,pid:K.pid??null,killProcess:W.killProcess??null}),s$($);let X=a$(),H=(W.createBrokerEndpoint??Y$)(X,W.platform),M=E.join(X,"broker.pid"),R=E.join(X,"broker.log"),y=i$({scriptPath:q,cwd:$,endpoint:H ...

6${X.stdout}`.trim();if(!X.error&&$1(G))return{attempted:!0,delivered:!1,method:"taskkill",result:X};if(X.error?.code==="ENOENT")try{return Q

7`);while(W!==-1){let q=this.lineBuffer.slice(0,W);this.lineBuffer=this.lineBuffer.slice(W+1),this.handleLine(q),W=this.lineBuffer.indexOf

8`)}}handleLine($){if(!$.trim())return;let W;try{W=JSON.parse($)}catch(q){this.handleExit(o(`Failed to parse codex app-server JSONL: ${q instanceof Error?q.message:String(q)}`,{line:$}));return}if(W.id!==void 0&&W.method){this.handleServerRequest(W);return}if(W.id!==void 0){let q=this.pending.get(W.id);if(!q)return;if(this.pending.delete(W.id),W.error)q.reject(o(W.error.message??`codex app-server ${q.method} failed.`,W.error));else q.resolve(W.result??{});return}if(W.method&&this.notificationHandler)this.notificationHandler(W)}defaultHandleServerRequest($){let W=this.serverRequestHandler;if(!W) ...

9${K}`:""}`);this.handleExit(Q)}),this.readline=K1.createInterface({input:$}),this.readline.on("line",(q)=>{this.handleLine(q)}),await this.request("initialize",{clientInfo:this.options.clientInfo??_$(),capabilities:this.options.capabilities??

10`,q=this.proc?.stdin;if(!q)throw Error("codex app-server stdin is not available.");q.write(W)}}class A$ extends e{endpoint;socket;constructor($,W={}){

11`,q=this.socket;if(!q)throw Error("codex app-server broker connection is not connected.");q.write(W)}}class $${static async connect($,W={}){let q=null;if(!W.disableBroker){if(q=W.brokerEndpoint??W.env?.[

12`)}function H1($){return $?.method==="turn/interrupt"}function G1($){if(!$)return;u.mkdirSync(W$.dirname($),{recursive:!0}),u.writeFileSync($,

13`,"utf8")}async function M1(){let[$,...W]=T.argv.slice(2);if($!=="serve")throw Error("Usage: node src/lib/broker.mjs serve --endpoint <value> [--cwd <path>] [--pid-file <path>]");let{options

14`);while(v!==-1){let q$=U.slice(0,v);if(U=U.slice(v+1),v=U.indexOf(`

15`),!q$.trim())continue;let z;try{z=JSON.parse(q$)}catch(L){P(Y,{id:null,error:C(-32700,`Invalid JSON: ${L instanceof Error?L.message:String(L)}`)});continue}if(z.id!==void 0&&!z.method&&x.has(z.id)){x.delete(z.id),G.sendMessage(z);continue}if(z.id!==void 0&&z.method==="initialize"){P(Y,{id:z.id,result:{userAgent:"coder-broker"}});continue}if(z.method==="initialized"&&z.id===void 0)continue;if(z.id!==void 0&&z.method==="broker/shutdown")P(Y,{id:z.id,result:{}}),await m(D),T.exit(0);if(z.id===void 0||!z.method)continue;let Z$=H1(z)&&M&&M!==Y&&!H;if((H&&H!==Y||M&&M!==Y)&&!Z$){P(Y,{id:z.id,error:C ...

16`),T.exit(1)});

Long lines were clipped for display.

dist/cli.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2var Tz=Object.defineProperty;var Tr=(r,$)=>{for(var v in $)Tz(r,v,{get:$[v],enumerable:!0,configurable:!

Source & flagged code

5 flagged · loading source

dist/lib/broker.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code