registry / berserqir / 0.6.7

berserqir@0.6.7

Berserqir — the agent legion harness. SDD + hierarchical memory + agentic loop + behavioral evals, portable across GitHub Copilot, Claude Code and Cursor.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 128 KB of source

Source & flagged code

2 flagged

core/hooks/session-verify/session-verify.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2// Berserqir: session-verify (deterministic backstop — zero LLM)

3// Stop-time batch verification: the journal already records every file the

4// session touched; instead of paying typecheck/lint per edit, run the

5// PROJECT'S OWN tooling once, when the session ends (ECC pattern, adapted).

6//

7// What runs (first match per category, never invented):

8// typecheck: package.json scripts.typecheck → `npm run --silent typecheck`

9// else tsconfig.json present → `npx --no-install tsc --noEmit`

10// lint: package.json scripts.lint → `npm run --silent lint`

11//

12// Only fires when the session touched at least one JS/TS file (per journal).

13// Failures → exit 2 with bounded output (the harness Stop gate makes the agent

14// fix before finishing). Timeouts and missing tooling → exit 0, silent: a

15// verification hook must never hang a session or fail-open into noise.

16//

17// Env: BERSERQIR_MEMORY_DIR (default .berserqir/memory)

18// Opt-out: BERSERQIR_SESSION_VERIFY=0

20import { readFileSync, existsSync } from 'node:fs'

21import { spawnSync } from 'node:child_process'

22import { join } from 'node:path'

High

Child Process

Package source references child process execution.

core/hooks/session-verify/session-verify.mjsView on unpkg · L20

24if (process.env.BERSERQIR_SESSION_VERIFY === '0') process.exit(0)

26const MEMORY_DIR = process.env.BERSERQIR_MEMORY_DIR || '.berserqir/memory'

27const shortPath = join(MEMORY_DIR, 'memory-short.md')

28if (!existsSync(shortPath)) process.exit(0)

30// ---- did this session touch JS/TS? (journal lines: `- ts · agent · tool · target`)

31const raw = readFileSync(shortPath, 'utf8')

32const jIdx = raw.indexOf('## Journal')

33if (jIdx === -1) process.exit(0)

34const journal = raw.slice(jIdx, raw.indexOf('\n## ', jIdx + 1))

35const touched = new Set()

36for (const m of journal.matchAll(/^- .+? · .+? · .+? · (.+)$/gm)) {

37 const t = m[1].trim()

38 if (/\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/.test(t) && existsSync(t))

39 touched.add(t)

40}

bin/berserqir.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// Berserqir installer — detect → plan → apply. Zero dependencies (Node built-ins only).

3//

4// Usage:

5// npx berserqir install [--profiles front,back,ops,infra] [--dir <target>] [--yes] [--force] [--dry-run]

6// npx berserqir update | version | help

7//

8// Design (D8): one-shot, vendored output — npm exists only at install time.

9// The compiled harness becomes part of the target repo; commit it.

10'use strict'

12const

Source & flagged code

2 flagged · loading source

core/hooks/session-verify/session-verify.mjsView file

20import { readFileSync, existsSync } from 'node:fs' L21: import { spawnSync } from 'node:child_process' L22: import { join } from 'node:path'

High

Child Process

Package source references child process execution.

core/hooks/session-verify/session-verify.mjsView on unpkg · L20

bin/berserqir.jsView file

4// Usage: L5: // npx berserqir install [--profiles front,back,ops,infra] [--dir <target>] [--yes] [--force] [--dry-run] L6: // npx berserqir update | version | help ... L15: const crypto = require('node:crypto') L16: const { spawnSync } = require('node:child_process') L17: const readline = require('node:readline/promises')

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/berserqir.jsView on unpkg · L4

Findings

3 High2 Medium3 Low

HighChild Processcore/hooks/session-verify/session-verify.mjs

HighShell

HighRuntime Package Installbin/berserqir.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

core/hooks/session-verify/session-verify.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2// Berserqir: session-verify (deterministic backstop — zero LLM)

3// Stop-time batch verification: the journal already records every file the

4// session touched; instead of paying typecheck/lint per edit, run the

5// PROJECT'S OWN tooling once, when the session ends (ECC pattern, adapted).

6//

7// What runs (first match per category, never invented):

8// typecheck: package.json scripts.typecheck → `npm run --silent typecheck`

9// else tsconfig.json present → `npx --no-install tsc --noEmit`

10// lint: package.json scripts.lint → `npm run --silent lint`

11//

12// Only fires when the session touched at least one JS/TS file (per journal).

13// Failures → exit 2 with bounded output (the harness Stop gate makes the agent

14// fix before finishing). Timeouts and missing tooling → exit 0, silent: a

15// verification hook must never hang a session or fail-open into noise.

16//

17// Env: BERSERQIR_MEMORY_DIR (default .berserqir/memory)

18// Opt-out: BERSERQIR_SESSION_VERIFY=0

20import { readFileSync, existsSync } from 'node:fs'

21import { spawnSync } from 'node:child_process'

22import { join } from 'node:path'

High

Child Process

Package source references child process execution.

core/hooks/session-verify/session-verify.mjsView on unpkg · L20

24if (process.env.BERSERQIR_SESSION_VERIFY === '0') process.exit(0)

26const MEMORY_DIR = process.env.BERSERQIR_MEMORY_DIR || '.berserqir/memory'

27const shortPath = join(MEMORY_DIR, 'memory-short.md')

28if (!existsSync(shortPath)) process.exit(0)

30// ---- did this session touch JS/TS? (journal lines: `- ts · agent · tool · target`)

31const raw = readFileSync(shortPath, 'utf8')

32const jIdx = raw.indexOf('## Journal')

33if (jIdx === -1) process.exit(0)

34const journal = raw.slice(jIdx, raw.indexOf('\n## ', jIdx + 1))

35const touched = new Set()

36for (const m of journal.matchAll(/^- .+? · .+? · .+? · (.+)$/gm)) {

37 const t = m[1].trim()

38 if (/\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/.test(t) && existsSync(t))

39 touched.add(t)

40}

bin/berserqir.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2// Berserqir installer — detect → plan → apply. Zero dependencies (Node built-ins only).

3//

4// Usage:

5// npx berserqir install [--profiles front,back,ops,infra] [--dir <target>] [--yes] [--force] [--dry-run]

6// npx berserqir update | version | help

7//

8// Design (D8): one-shot, vendored output — npm exists only at install time.

9// The compiled harness becomes part of the target repo; commit it.

10'use strict'

12const