registry / @zigrivers/scaffold / 3.40.0

@zigrivers/scaffold@3.40.0

AI-powered software project scaffolding pipeline

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 23 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 543 file(s), 3.59 MB of source, external domains: 0.0.0.0, 0.1.2.3, 1.1.1.1, 10.0.0.1, 100.127.255.254, 100.128.0.1, 100.63.0.1, 100.64.0.1, 127.0.0.1, 169.254.169.254, 172.20.0.1, 192.0.0.1, 192.0.2.1, 192.168.1.1, 198.18.0.1, 198.19.255.254, 198.51.100.1, 203.0.113.1, 224.0.0.1, 239.255.255.255, 240.0.0.1, 255.255.255.255, 8.8.8.8, 93.184.216.34, a.example.org, api.deepseek.com, api.z.ai, attacker.example, b.example.org, bad.test, docs.owasp.org, docs.test, evil.test, example.com, example.org, flaky.example.com, github.com, good.test, hop.example.org, ietf.org, other.test, owasp.org, real.test, registry.npmjs.org, stackoverflow.com, www.apple.com, www.w3.org, x.com, x.test

Source & flagged code

15 flagged

dist/observability/renderers/terminal.test.jsView file

Lines 95-137javascript

95 expect(out).toContain('git ✓');

96 expect(out).toContain('beads —');

97 });

98 it('omits empty sections (no Active Agents header when active_agents is empty)', () => {

99 const

Source & flagged code

15 flagged · loading source

dist/observability/renderers/terminal.test.jsView file

115patternName = github_pat severity = critical line = 115 matchedText = tainted....ef';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/observability/renderers/terminal.test.jsView on unpkg · L115

115patternName = github_pat severity = critical line = 115 matchedText = tainted....ef';

Critical

Secret Pattern

GitHub personal access token in dist/observability/renderers/terminal.test.js

dist/observability/renderers/terminal.test.jsView on unpkg · L115

117patternName = github_pat severity = critical line = 117 matchedText = expect(o...f');

Critical

Secret Pattern

GitHub personal access token in dist/observability/renderers/terminal.test.js

dist/observability/renderers/terminal.test.jsView on unpkg · L117

dist/observability/checks/lens-c-standards.test.jsView file

72writeFileSync(join(dir, 'docs/coding-standards.md'), '### Rule: no-eval\n- forbidden: eval, new Function\n- match: src/**/*.ts\n'); L73: writeFileSync(join(dir, 'src/foo.ts'), 'eval(\'1 + 1\')\n'); L74: const graph = await buildDocGraph(dir);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/observability/checks/lens-c-standards.test.jsView on unpkg · L72

dist/cli/commands/dashboard.jsView file

5import { createRequire } from 'node:module'; L6: const require = createRequire(import.meta.url); L7: const pkg = require('../../../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/commands/dashboard.jsView on unpkg · L5

dist/observability/renderers/markdown.test.jsView file

78patternName = github_pat severity = critical line = 78 matchedText = tainted....ef';

Critical

Secret Pattern

GitHub personal access token in dist/observability/renderers/markdown.test.js

dist/observability/renderers/markdown.test.jsView on unpkg · L78

80patternName = github_pat severity = critical line = 80 matchedText = expect(m...f');

Critical

Secret Pattern

GitHub personal access token in dist/observability/renderers/markdown.test.js

dist/observability/renderers/markdown.test.jsView on unpkg · L80

dist/observability/engine/redact.test.jsView file

104patternName = github_pat severity = critical line = 104 matchedText = payload:...ef',

Critical

Secret Pattern

GitHub personal access token in dist/observability/engine/redact.test.js

dist/observability/engine/redact.test.jsView on unpkg · L104

209patternName = github_pat severity = critical line = 209 matchedText = title: '...ef',

Critical

Secret Pattern

GitHub personal access token in dist/observability/engine/redact.test.js

dist/observability/engine/redact.test.jsView on unpkg · L209

228patternName = github_pat severity = critical line = 228 matchedText = expect(J...f');

Critical

Secret Pattern

GitHub personal access token in dist/observability/engine/redact.test.js

dist/observability/engine/redact.test.jsView on unpkg · L228

content/knowledge/core/multi-service-testing.mdView file

655patternName = generic_password severity = medium line = 655 matchedText = password...3!',

Medium

Secret Pattern

Hardcoded password in content/knowledge/core/multi-service-testing.md

content/knowledge/core/multi-service-testing.mdView on unpkg · L655

661patternName = generic_password severity = medium line = 661 matchedText = password...3!',

Medium

Secret Pattern

Hardcoded password in content/knowledge/core/multi-service-testing.md

content/knowledge/core/multi-service-testing.mdView on unpkg · L661

content/knowledge/core/testing-strategy.mdView file

136patternName = generic_password severity = medium line = 136 matchedText = .send({ ...' })

Medium

Secret Pattern

Hardcoded password in content/knowledge/core/testing-strategy.md

content/knowledge/core/testing-strategy.mdView on unpkg · L136

152patternName = generic_password severity = medium line = 152 matchedText = .send({ ...' })

Medium

Secret Pattern

Hardcoded password in content/knowledge/core/testing-strategy.md

content/knowledge/core/testing-strategy.mdView on unpkg · L152

348patternName = generic_password severity = medium line = 348 matchedText = password...3!',

Medium

Secret Pattern

Hardcoded password in content/knowledge/core/testing-strategy.md

content/knowledge/core/testing-strategy.mdView on unpkg · L348

Findings

8 Critical9 Medium6 Low

CriticalCritical Secretdist/observability/renderers/terminal.test.js

CriticalSecret Patterndist/observability/renderers/terminal.test.js

CriticalSecret Patterndist/observability/renderers/markdown.test.js

CriticalSecret Patterndist/observability/engine/redact.test.js

MediumDynamic Requiredist/cli/commands/dashboard.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterncontent/knowledge/core/multi-service-testing.md

MediumSecret Patterncontent/knowledge/core/testing-strategy.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/observability/checks/lens-c-standards.test.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/observability/checks/lens-c-standards.test.jsView file

Lines 52-79javascript

52 const findings = await lensCStandards(graph, { events: [] }, stubAvail, [], new Set(['C-standards']));

53 expect(findings).toHaveLength(6);

54 expect(findings.every((f) => f.severity === 'P1')).toBe(true);

55 });

56 it('honors observability.yaml rule_overrides over doc-declared severity', async () => {

57 mkdirSync(join(dir, 'docs'), { recursive: true });

58 mkdirSync(join(dir, 'src'), { recursive: true });

59 mkdirSync(join(dir, '.scaffold'), { recursive: true });

60 writeFileSync(join(dir, 'package.json'), '{}');

61 writeFileSync(join(dir, 'docs/coding-standards.md'), '### Rule: no-console\n- pattern: `console\\.log\\(`\n- match: src/**/*.ts\n- severity: P2\n');

62 writeFileSync(join(dir, 'src/foo.ts'), 'console.log(\'x\')\n');

63 writeFileSync(join(dir, '.scaffold/observability.yaml'), 'lenses:\n C-standards:\n rule_overrides:\n no-console: P0\n');

64 const graph = await buildDocGraph(dir);

65 const findings = await lensCStandards(graph, { events: [] }, stubAvail, [], new Set(['C-standards']));

66 expect(findings[0].severity).toBe('P0');

67 });

68 it('checks forbidden symbols too', async () => {

69 mkdirSync(join(dir, 'docs'), { recursive: true });

70 mkdirSync(join(dir, 'src'), { recursive: true });

71 writeFileSync(join(dir, 'package.json'), '{}');

72 writeFileSync(join(dir, 'docs/coding-standards.md'), '### Rule: no-eval\n- forbidden: eval, new Function\n- match: src/**/*.ts\n');

73 writeFileSync(join(dir, 'src/foo.ts'), 'eval(\'1 + 1\')\n');

74 const graph = await buildDocGraph(dir);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/observability/checks/lens-c-standards.test.jsView on unpkg · L72

75 const findings = await lensCStandards(graph, { events: [] }, stubAvail, [], new Set(['C-standards']));

76 expect(findings[0].lens_id).toBe('C-standards');

77 });

78});

79//# sourceMappingURL=lens-c-standards.test.js.map

dist/cli/commands/dashboard.jsView file

Lines 1-25javascript

1import fs from 'node:fs';

2import os from 'node:os';

3import path from 'node:path';

4import { execFileSync } from 'node:child_process';

5import { createRequire } from 'node:module';

6const require = createRequire(import.meta.url);

7const pkg = require('../../../package.json');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/commands/dashboard.jsView on unpkg · L5

8import { findProjectRoot } from '../middleware/project-root.js';

9import { resolveOutputMode } from '../middleware/output-mode.js';

10import { createOutputContext } from '../output/context.js';

11import { StateManager } from '../../state/state-manager.js';

12import { readDecisions } from '../../state/decision-logger.js';

13import { loadConfig } from '../../config/loader.js';

14import { guardSteplessCommand } from '../guards.js';

15import { StatePathResolver } from '../../state/state-path-resolver.js';

16import { ensureV3Migration } from '../../state/ensure-v3-migration.js';

17import { generateDashboardData, generateHtml, generateMultiServiceDashboardData, generateMultiServiceHtml, } from '../../dashboard/generator.js';

18import { discoverMetaPrompts } from '../../core/assembly/meta-prompt-loader.js';

19import { getPackagePipelineDir, atomicWriteFile } from '../../utils/fs.js';

20import { loadPipelineContext } from '../../core/pipeline/context.js';

21import { resolvePipeline } from '../../core/pipeline/resolver.js';

22import { buildDependencyGraph } from '../../dashboard/dependency-graph.js';

23/**

24 * Write HTML to the requested path (or a tmpfile), then optionally open it in

25 * the system browser. Shared between single-service and multi-service modes.

dist/observability/renderers/markdown.test.jsView file

Lines 58-100javascript

58 expect(md).toContain('## Completed in Window');

59 expect(md).toContain('PR #40');

60 expect(md).toContain('## Recent Decisions');

61 expect(md).toContain('## Availability');

62 expect(md).toMatch(/\| git \|/);

63 expect(md).toMatch(/\| gh \| .*unavailable/);

64 });

65 it('omits empty sections', () => {

66 const empty = {

67 ...fixture,

68 snapshot: {

69 ...fixture.snapshot, active_agents: [], in_flight: [], completed_in_window: [], recent_decisions: [],

70 },

71 };

72 const md = renderProgressMarkdown(empty);

73 expect(md).not.toContain('## Active Agents');

74 expect(md).not.toContain('## Completed in Window');

75 });

76 it('redacts secrets in narrative content', () => {

77 const tainted = JSON.parse(JSON.stringify(fixture));

78 tainted.snapshot.recent_decisions[0].summary = 'token=ghp_1234567890abcdefABCDEF1234567890abcdef';

Critical

Secret Pattern

GitHub personal access token in dist/observability/renderers/markdown.test.js

dist/observability/renderers/markdown.test.jsView on unpkg · L78

79 const md = renderProgressMarkdown(tainted);

80 expect(md).not.toContain('ghp_1234567890abcdefABCDEF1234567890abcdef');

Critical

Secret Pattern

GitHub personal access token in dist/observability/renderers/markdown.test.js

dist/observability/renderers/markdown.test.jsView on unpkg · L80

81 expect(md).toContain('[REDACTED:');

82 });

83});

84describe('renderAuditMarkdown', () => {

85 const auditFixture = {

86 ...fixture,

87 invocation: { ...fixture.invocation, command: 'audit', args: { profile: 'fast', scope: 'all' } },

88 snapshot: null,

89 findings: [

90 { id: '3a8c1f0211223344', lens_id: 'B-ac-coverage', severity: 'P0',

91 title: 'AC has failing test', description: 'src/auth/test.spec.ts is failing.',

92 source_doc: 'docs/user-stories.md#user-auth-1',

93 evidence: { kind: 'rule_violation', rule_id: 'ac-test-failing', file: 'file:src/auth/test.spec.ts' },

94 confidence: 'high', first_seen: '2026-05-04T00:00:00Z', last_seen: '2026-05-04T00:00:00Z', status: 'open',

95 fix_hint: { kind: 'add_test', target: 'src/auth/test.spec.ts', prompt: 'Re-enable test' } },

96 { id: '9d1e02f455667788', lens_id: 'A-tdd', severity: 'P1',

97 title: 'AC without test', description: 'AC has no test.', source_doc: 'docs/user-stories.md#story-s-1',

98 evidence: { kind: 'ac_not_covered', story_id: 'story:s-1', ac_id: 'ac:s-1.1', missing_tests: [] },

99 confidence: 'medium', first_seen: '2026-05-04T00:00:00Z', last_seen: '2026-05-04T00:00:00Z',

100 status: 'acknowledged', ack_note: 'tracked separately' },

dist/observability/engine/redact.test.jsView file

Lines 84-124javascript

84 });

85 it('rewrites macOS user paths with spaces in username to ~', () => {

86 expect(sanitizePath('/Users/John Doe/Documents/repo/file.ts'))

87 .toBe('~/Documents/repo/file.ts');

88 });

89 it('rewrites Windows backslash paths with spaces in username to ~, preserving drive letter', () => {

90 expect(sanitizePath('C:\\Users\\John Doe\\repo\\file.ts'))

91 .toBe('C:\\~\\repo\\file.ts');

92 });

93 it('does not rewrite home-like paths that are not root-level home dirs', () => {

94 expect(sanitizePath('/mnt/home/alice/file.ts')).toBe('/mnt/home/alice/file.ts');

95 expect(sanitizePath('/var/Users/shared/file.ts')).toBe('/var/Users/shared/file.ts');

96 });

97});

98describe('redactEvent (write-time)', () => {

99 it('scrubs secrets from string fields and drops paths through sanitizePath', () => {

100 const e = {

101 event_id: '01H', worktree_id: 'wid', actor_label: 'alice',

102 branch: 'feat/api_key="abc-123-def"', task_id: 'T-1',

103 type: 'decision_recorded', ts: '2026-04-30T00:00:00Z',

104 payload: { key: 'k', summary: 'token=ghp_1234567890abcdefABCDEF1234567890abcdef',

Critical

Secret Pattern

GitHub personal access token in dist/observability/engine/redact.test.js

dist/observability/engine/redact.test.jsView on unpkg · L104

105 affects: ['/Users/alice/Documents/repo/src/file.ts'] },

106 };

107 const out = redactEvent(e);

108 expect(out.payload.summary).toContain('[REDACTED:');

109 expect(out.payload.affects[0]).toBe('~/Documents/repo/src/file.ts');

110 expect(out.branch).toContain('[REDACTED:');

111 });

112 it('redacts string values whose object key matches a sensitive pattern', () => {

113 const result = redactEvent({ password: 'abc123', msg: 'hello' });

114 expect(result.password).toBe('[REDACTED:kv-secret]');

115 expect(result.msg).toBe('hello');

116 });

117 it('redacts leaf values nested under a sensitive key even when child key is not sensitive', () => {

118 const result = redactEvent({ password: { value: 'hunter2', extra: 'note' } });

119 const inner = result.password;

120 expect(inner.value).toBe('[REDACTED:kv-secret]');

121 expect(inner.extra).toBe('[REDACTED:kv-secret]');

122 });

123 it('preserves non-plain-object values (e.g. Date instances) unchanged', () => {

124 const d = new Date('2026-01-01T00:00:00Z');

209patternName = github_pat severity = critical line = 209 matchedText = title: '...ef',

Critical

Secret Pattern

GitHub personal access token in dist/observability/engine/redact.test.js

dist/observability/engine/redact.test.jsView on unpkg · L209

228patternName = github_pat severity = critical line = 228 matchedText = expect(J...f');

Critical

Secret Pattern

GitHub personal access token in dist/observability/engine/redact.test.js

dist/observability/engine/redact.test.jsView on unpkg · L228