registry / add-coder / 0.1.7

add-coder@0.1.7

[codein2027](https://github.com/xiaomingming92/codein2027) 快速构建 ADD 编程范式的完整脚手架——AI 代码治理的落地方案。以「审计即基础设施」为核心，彻底打破编程过程黑盒与跨轮失忆，让编程范式进化为可审计、可追溯、可收敛的新时代。npx 即用，人人可体验。

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

CopyleftLicense

scanned 3 file(s), 176 KB of source

Source & flagged code

6 flagged

templates/core/scripts/mcp-server.tsView file

Lines 1-25typescript

1import dotenv from "dotenv"

2import { dirname, resolve, basename } from "path"

3import { fileURLToPath } from "url"

5const __filename = fileURLToPath(import.meta.url)

6const __dirname = dirname(__filename)

7const PROJECT_ROOT = resolve(__dirname, "..", "..")

8const MAGIC_DIR = basename(dirname(__dirname)) // ".qoder" or ".claude"

10// 环境变量加载优先级: .env.development.local > .env.development > .env.local > .env

11const ENV_CANDIDATES = [".env.development.local", ".env.development", ".env.local", ".env"];

12for (const f of ENV_CANDIDATES) {

13 const p = resolve(PROJECT_ROOT, f);

14 if (existsSync(p)) { dotenv.config({ path: p }); break; }

15}

17const DATABASE_URL = process.env.DATABASE_URL

18if (!DATABASE_URL) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

templates/core/scripts/mcp-server.tsView on unpkg · L5

19 throw new Error("DATABASE_URL 未设置，请在 .env 中配置数据库连接串")

20}

22import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"

23import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"

24import { z } from "zod"

25import { readFile, readdir, stat, mkdir, writeFile } from "fs/promises"

Lines 1092-1132typescript

1092 const beforePreview = beforeState ? beforeState.slice(0, 80) : "(未传)"

1093 const afterPreview = afterState ? afterState.slice(0, 80) : "(未传)"

1094 return errorResponse(

dist/index.jsView file

Lines 80-120javascript

80 mcpServerCommand: "tsx",

81 agentAuditImport: "@/lib/agent-audit-logger",

82 adapters: ["auto"],

83 overrides: {}

84};

86// src/cli/config-loader.ts

87async function loadConfig(

templates/shared/hooks-lib/common.shView file

•path = templates/shared/hooks-lib/common.sh kind = build_helper sizeBytes = 581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/shared/hooks-lib/common.shView on unpkg

Source & flagged code

6 flagged · loading source

templates/core/scripts/mcp-server.tsView file

1112patternName = generic_password severity = medium line = 1112 matchedText = password...al",

Medium

Secret Pattern

Package contains a possible secret pattern.

templates/core/scripts/mcp-server.tsView on unpkg · L1112

5const __filename = fileURLToPath(import.meta.url) L6: const __dirname = dirname(__filename) L7: const PROJECT_ROOT = resolve(__dirname, "..", "..") ... L16: L17: const DATABASE_URL = process.env.DATABASE_URL L18: if (!DATABASE_URL) { ... L27: import { existsSync } from "fs" L28: import { execSync } from "child_process" L29: import { PrismaClient, Prisma } from "@prisma/client" ... L128: if (scope === "all" || scope === "package") { L129: const pkg = await readFileSafe(join(PROJECT_ROOT, "package.json")) L130: if (pkg) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

templates/core/scripts/mcp-server.tsView on unpkg · L5

dist/index.jsView file

327// src/caijuehub/strategies/prisma.strategy.ts L328: import { spawnSync } from "child_process"; L329: import { copyFileSync, existsSync as existsSync4, readFileSync as readFileSync6, unlinkSync, writeFileSync as writeFileSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L327

353console.log("\u6267\u884C npx prisma init ..."); L354: spawnSync("npx", ["prisma", "init", "--datasource-provider", "postgresql"], { cwd: projectRoot, stdio: "inherit", shell: false }); L355: const envPath = resolve(projectRoot, ".env");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L353

100try { L101: const userConfig = await import(configPath); L102: config = { ...config, ...userConfig.default };

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L100

templates/shared/hooks-lib/common.shView file

•path = templates/shared/hooks-lib/common.sh kind = build_helper sizeBytes = 581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/shared/hooks-lib/common.shView on unpkg

Findings

3 High6 Medium4 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumSecret Patterntemplates/core/scripts/mcp-server.ts

MediumDynamic Requiredist/index.js

MediumEnvironment Vars

MediumInstall Persistencetemplates/core/scripts/mcp-server.ts

MediumShips Build Helpertemplates/shared/hooks-lib/common.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowCopyleft License

Source & flagged code

6 flagged

templates/core/scripts/mcp-server.tsView file

Lines 1-25typescript

1import dotenv from "dotenv"

2import { dirname, resolve, basename } from "path"

3import { fileURLToPath } from "url"

5const __filename = fileURLToPath(import.meta.url)

6const __dirname = dirname(__filename)

7const PROJECT_ROOT = resolve(__dirname, "..", "..")

8const MAGIC_DIR = basename(dirname(__dirname)) // ".qoder" or ".claude"

10// 环境变量加载优先级: .env.development.local > .env.development > .env.local > .env

11const ENV_CANDIDATES = [".env.development.local", ".env.development", ".env.local", ".env"];

12for (const f of ENV_CANDIDATES) {

13 const p = resolve(PROJECT_ROOT, f);

14 if (existsSync(p)) { dotenv.config({ path: p }); break; }

15}

17const DATABASE_URL = process.env.DATABASE_URL

18if (!DATABASE_URL) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

templates/core/scripts/mcp-server.tsView on unpkg · L5

19 throw new Error("DATABASE_URL 未设置，请在 .env 中配置数据库连接串")

20}

22import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js"

23import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"

24import { z } from "zod"

25import { readFile, readdir, stat, mkdir, writeFile } from "fs/promises"

Lines 1092-1132typescript

1092 const beforePreview = beforeState ? beforeState.slice(0, 80) : "(未传)"

1093 const afterPreview = afterState ? afterState.slice(0, 80) : "(未传)"

1094 return errorResponse(

dist/index.jsView file

Lines 80-120javascript

80 mcpServerCommand: "tsx",

81 agentAuditImport: "@/lib/agent-audit-logger",

82 adapters: ["auto"],

83 overrides: {}

84};

86// src/cli/config-loader.ts

87async function loadConfig(

templates/shared/hooks-lib/common.shView file

•path = templates/shared/hooks-lib/common.sh kind = build_helper sizeBytes = 581 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/shared/hooks-lib/common.shView on unpkg

Lines 307-373javascript

307 walk(full, join7(base, name));

308 } else {

309 const content = readFileSync5(full, "utf-8");

310 const rendered = render(content, config);

311 const targetRel = join7(TARGET_MAGIC_PATH3, relative4(ADAPTER_DIR3, full));

312 files.set(targetRel, rendered);

313 }

314 }

315 }

316 walk(ADAPTER_DIR3, "");

317 if (dryRun) {

318 console.log(`[dry-run] VS Code adapter: ${files.size} files`);

319 }

320 return files;

321}

322

323// src/cli/prisma-injector.ts

324import { resolve as resolve2, dirname as dirname6 } from "path";

325import { fileURLToPath as fileURLToPath5 } from "url";

326

327// src/caijuehub/strategies/prisma.strategy.ts

328import { spawnSync } from "child_process";

329import { copyFileSync, existsSync as existsSync4, readFileSync as readFileSync6, unlinkSync, writeFileSync as writeFileSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L327

330import { resolve } from "path";

331var PRISMA_CONFIG = {

332 onMissing: "ask",

333 onExistingAddPrisma: "ask",

334 onMigrateFail: "rollback",

335 autoGenerate: true,

336 migrationName: "add_workflow_init",

337 schemaArg: "--schema=prisma/",

338 requiresUserModel: true

339};

340async function injectPrisma(projectRoot, addPrismaTemplate, options = {}) {

341 const C = PRISMA_CONFIG;

342 const prismaDir = resolve(projectRoot, "prisma");

343 const schemaPath = resolve(prismaDir, "schema.prisma");

344 const destPath = resolve(prismaDir, "add.prisma");

345 if (!existsSync4(prismaDir) || !existsSync4(schemaPath)) {

346 if (C.onMissing === "skip") {

347 console.log("\u8DF3\u8FC7\uFF1A\u7F3A\u5C11 Prisma");

348 return true;

349 }

350 if (C.onMissing === "ask" && !options.force && !options.yes) {

351 const a = await ask("\u9879\u76EE\u7F3A\u5C11 Prisma\uFF0C\u662F\u5426\u6267\u884C prisma init\uFF1F[Y/n] ");

352 if (a !== "n" && a !== "no") {

353 console.log("\u6267\u884C npx prisma init ...");

354 spawnSync("npx", ["prisma", "init", "--datasource-provider", "postgresql"], { cwd: projectRoot, stdio: "inherit", shell: false });

355 const envPath = resolve(projectRoot, ".env");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L353

356 const devEnvPath = resolve(projectRoot, ".env.development");

357 if (existsSync4(envPath)) {

358 const envContent = readFileSync6(envPath, "utf-8");

359 const dbUrl = envContent.match(/DATABASE_URL=.*/);

360 if (dbUrl) {

361 const existing = existsSync4(devEnvPath) ? readFileSync6(devEnvPath, "utf-8") : "";

362 if (!existing.includes("DATABASE_URL=")) {

363 writeFileSync2(devEnvPath, `${existing}${existing ? "\n" : ""}${dbUrl[0]}

364`, "utf-8");

365 }

366 if (existsSync4(envPath)) unlinkSync(envPath);

367 console.log("\u5DF2\u5C06 DATABASE_URL \u8FC1\u79FB\u5230 .env.development");

368 }

369 }

370 console.log("\u8BF7\u7F16\u8F91 .env.development \u914D\u7F6E DATABASE_URL\uFF0C\u7136\u540E\u91CD\u65B0\u8FD0\u884C add-coder init \u5B8C\u6210\u8FC1\u79FB");

371 console.log(" \u53EF\u9009\u6587\u4EF6\u4F18\u5148\u7EA7: .env.development.local > .env.development > .env.local > .env");

372 const schemaContent = readFileSync6(schemaPath, "utf-8");

373 if (!/model\s+User\s*\{/.test(schemaContent)) {