registry / add-coder / 0.1.9

add-coder@0.1.9

[codein2027](https://github.com/xiaomingming92/codein2027) 快速构建 ADD 编程范式的完整脚手架——AI 代码治理的落地方案。以「审计即基础设施」为核心，彻底打破编程过程黑盒与跨轮失忆，让编程范式进化为可审计、可追溯、可收敛的新时代。npx 即用，人人可体验。

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

CopyleftLicense

scanned 3 file(s), 193 KB of source

Source & flagged code

6 flagged

dist/index.jsView file

Lines 80-120javascript

80 agentAuditImport: "@/lib/agent-audit-logger",

81 magicDir: "",

82 adapters: [],

83 overrides: {}

84};

86// src/cli/config-loader.ts

87async function loadConfig(projectRoot, configPath, _options) {

88 let config = { ...defaults };

89 const pkgPath = join2(projectRoot, "package.json");

90 if (existsSync2(pkgPath)) {

91 try {

92 const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));

93 if (pkg.name && !config.projectName) {

94 config.projectName = pkg.name;

95 }

96 } catch {

97 }

98 }

99 if (configPath && existsSync2(configPath)) {

100 try {

101 const userConfig = await import(configPath);

102 config = { ...config, ...userConfig.default };

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L100

103 } catch {

104 }

105 }

106 const result = AddCoderConfigSchema.safeParse(config);

107 if (!result.success) {

108 const errors = result.error.issues.map((i) => ` - ${i.path.join(".")}: ${i.message}`).join("\n");

109 throw new Error(`\u914D\u7F6E\u6821\u9A8C\u5931\u8D25:

110${errors}`);

111 }

112 return result.data;

113}

114

115// src/caijuehub/strategies/writer.strategy.ts

116import { existsSync as existsSync4, mkdirSync, writeFileSync, chmodSync } from "fs";

117import { join as join3, dirname } from "path";

118

119// src/lib/utils.ts

120import { createInterface } from "readline";

Lines 320-360javascript

320 walk(full, join7(base, name));

321 } else {

322 const content = readFileSync5(full, "utf-8");

323 const rendered = render(content, config);

324 const targetRel = join7(TARGET_MAGIC_PATH3

Lines 599-639javascript

599 } catch {

600 }

601 return spawnSync2("which", ["pg_isready"], { timeout: 2e3 }).status === 0;

602}

603function testPostgresConnection(port, user, password, dbName) {

604 if (!

templates/core/scripts/mcp-server.tsView file

Lines 1-25typescript

1import dotenv from "dotenv"

2import { dirname, resolve, basename } from "path"

3import { fileURLToPath } from "url"

5const __filename = fileURLToPath(import.meta.url)

6const

templates/core/scripts/db-ensure.shView file

•path = templates/core/scripts/db-ensure.sh kind = build_helper sizeBytes = 2567 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/core/scripts/db-ensure.shView on unpkg

Source & flagged code

6 flagged · loading source

dist/index.jsView file

340// src/caijuehub/strategies/prisma.strategy.ts L341: import { spawnSync } from "child_process"; L342: import { copyFileSync, existsSync as existsSync5, readFileSync as readFileSync6, unlinkSync, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L340

619patternName = generic_password severity = medium line = 619 matchedText = const d ..." };

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/index.jsView on unpkg · L619

100try { L101: const userConfig = await import(configPath); L102: config = { ...config, ...userConfig.default };

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L100

templates/core/scripts/mcp-server.tsView file

3290const { spawnSync } = await import("child_process") L3291: const tsc = spawnSync("npx", ["tsc", "--noEmit"], { L3292: cwd: PROJECT_ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

templates/core/scripts/mcp-server.tsView on unpkg · L3290

5const __filename = fileURLToPath(import.meta.url) L6: const __dirname = dirname(__filename) L7: const PROJECT_ROOT = resolve(__dirname, "..", "..") ... L16: L17: const DATABASE_URL = process.env.DATABASE_URL L18: if (!DATABASE_URL) { ... L27: import { existsSync } from "fs" L28: import { spawnSync } from "child_process" L29: ... L80: }) L81: const guard = spawnSync("/bin/bash", [guardScript], { L82: input: guardInput,

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

templates/core/scripts/mcp-server.tsView on unpkg · L5

templates/core/scripts/db-ensure.shView file

•path = templates/core/scripts/db-ensure.sh kind = build_helper sizeBytes = 2567 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/core/scripts/db-ensure.shView on unpkg

Findings

3 High6 Medium4 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installtemplates/core/scripts/mcp-server.ts

MediumSecret Patterndist/index.js

MediumDynamic Requiredist/index.js

MediumEnvironment Vars

MediumInstall Persistencetemplates/core/scripts/mcp-server.ts

MediumShips Build Helpertemplates/core/scripts/db-ensure.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowCopyleft License

Source & flagged code

6 flagged

dist/index.jsView file

Lines 80-120javascript

80 agentAuditImport: "@/lib/agent-audit-logger",

81 magicDir: "",

82 adapters: [],

83 overrides: {}

84};

86// src/cli/config-loader.ts

87async function loadConfig(projectRoot, configPath, _options) {

88 let config = { ...defaults };

89 const pkgPath = join2(projectRoot, "package.json");

90 if (existsSync2(pkgPath)) {

91 try {

92 const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));

93 if (pkg.name && !config.projectName) {

94 config.projectName = pkg.name;

95 }

96 } catch {

97 }

98 }

99 if (configPath && existsSync2(configPath)) {

100 try {

101 const userConfig = await import(configPath);

102 config = { ...config, ...userConfig.default };

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L100

103 } catch {

104 }

105 }

106 const result = AddCoderConfigSchema.safeParse(config);

107 if (!result.success) {

108 const errors = result.error.issues.map((i) => ` - ${i.path.join(".")}: ${i.message}`).join("\n");

109 throw new Error(`\u914D\u7F6E\u6821\u9A8C\u5931\u8D25:

110${errors}`);

111 }

112 return result.data;

113}

114

115// src/caijuehub/strategies/writer.strategy.ts

116import { existsSync as existsSync4, mkdirSync, writeFileSync, chmodSync } from "fs";

117import { join as join3, dirname } from "path";

118

119// src/lib/utils.ts

120import { createInterface } from "readline";

Lines 320-360javascript

320 walk(full, join7(base, name));

321 } else {

322 const content = readFileSync5(full, "utf-8");

323 const rendered = render(content, config);

324 const targetRel = join7(TARGET_MAGIC_PATH3

Lines 599-639javascript

599 } catch {

600 }

601 return spawnSync2("which", ["pg_isready"], { timeout: 2e3 }).status === 0;

602}

603function testPostgresConnection(port, user, password, dbName) {

604 if (!

templates/core/scripts/mcp-server.tsView file

Lines 1-25typescript

1import dotenv from "dotenv"

2import { dirname, resolve, basename } from "path"

3import { fileURLToPath } from "url"

5const __filename = fileURLToPath(import.meta.url)

6const

templates/core/scripts/db-ensure.shView file

•path = templates/core/scripts/db-ensure.sh kind = build_helper sizeBytes = 2567 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/core/scripts/db-ensure.shView on unpkg

Lines 3270-3310typescript

3270 unplannedChanges.push(cf)

3271 }

3272 }

3273 parts.push("=== 维度一：范围保真度（30%）===")

3274 parts.push(` 计划文件: ${plannedSet.size} 个`)

3275 parts.push(` 实际变更: ${changedSet.size} 个`)

3276 parts.push(` 交集: ${intersectCount} 个`)

3277 parts.push(` 分数: ${scopeScore}/100`)

3278 if (unplannedChanges.length > 0) {

3279 parts.push(` ⚠️ 计划外变更: ${unplannedChanges.join(", ")}`)

3280 }

3281 } else {

3282 parts.push("=== 维度一：范围保真度（30%）===")

3283 parts.push(` 分数: ${scopeScore}/100（${plannedFiles.length === 0 ? "无计划文件" : "无 git diff"}，默认满分）`)

3284 }

3285 parts.push("")

3286

3287 // ====== 维度二：类型安全（权重 20%） ======

3288 let typeScore = 100

3289 try {

3290 const { spawnSync } = await import("child_process")

3291 const tsc = spawnSync("npx", ["tsc", "--noEmit"], {

3292 cwd: PROJECT_ROOT,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

templates/core/scripts/mcp-server.tsView on unpkg · L3290

3293 encoding: "utf-8",

3294 timeout: 30000,

3295 })

3296 const tscOut = (tsc.stdout || "") + (tsc.stderr || "")

3297 // 统计 error TS 行数

3298 const errorLines = tscOut.split("\n").filter(l => l.includes("error TS")).length

3299 typeScore = Math.max(0, 100 - errorLines * 10)

3300 parts.push("=== 维度二：类型安全（20%）===")

3301 parts.push(` tsc errors: ${errorLines}`)

3302 parts.push(` 分数: ${typeScore}/100`)

3303 } catch {

3304 parts.push("=== 维度二：类型安全（20%）===")

3305 parts.push(` 分数: ${typeScore}/100（无法执行 tsc，默认满分——请在项目环境中自行验证）`)

3306 }

3307 parts.push("")

3308

3309 // ====== 维度三：审计完整度（权重 25%） ======

3310 let auditScore = 100