registry / bmad-production-grade-dev / 0.1.0

bmad-production-grade-dev@0.1.0

Hardens bmm's story cycle: adversarial multi-reviewer + human-verified customer-experience gate at commit — ship production-grade at AI-native pace.

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 214 KB of source

Source & flagged code

3 flagged

assets/scripts/adaptable/validate-journey-wiring.mjsView file

Lines 121-161javascript

121 // screen's "back to parent" edge can be declared in the journey

122 // without forcing the implementer to inline a raw router.replace.

123 new RegExp(`safeBack\\s*\\(\\s*router\\s*,\\s*${quoteClass}${pattern}${quoteClass}`),

124 ];

125 return patterns.some((re) => re.test(source));

126}

127

128/**

129 * Normalise screen.next to an array of edge objects. Supports:

130 * - Single edge object: { when, route, skip_via?, optional? }

131 * - Array of edge objects: [{ ... }, { ... }]

132 *

133 * Returns [] when next is missing (terminal screen).

134 */

135function normaliseEdges(next) {

136 if (!next) return [];

137 if (Array.isArray(next)) return next;

138 return [next];

139}

140

141async function main() {

142 const { USER_JOURNEYS } = await import(pathToFileURL(journeysFile).href);

143 const failures = [];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

assets/scripts/adaptable/validate-journey-wiring.mjsView on unpkg · L141

144 let checks = 0;

145

146 for (const [journeyName, journey] of Object.entries(USER_JOURNEYS)) {

147 for (const screen of journey.screens ?? []) {

148 const edges = normaliseEdges(screen.next);

149 for (const edge of edges) {

150 const target = edge.skip_via ?? edge.route;

151 if (!target) continue;

152 checks++;

153 try {

154 const { path: srcPath, content } = await findScreenSource(screen.app, screen.route);

155 if (!containsRouterRef(content, target)) {

156 failures.push({

157 journey: journeyName,

158 from: screen.route,

159 to: target,

160 when: edge.when,

161 srcPath,

pgd-setup/scripts/merge-help-csv.pyView file

•path = pgd-setup/scripts/merge-help-csv.py kind = build_helper sizeBytes = 7760 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

pgd-setup/scripts/merge-help-csv.pyView on unpkg

assets/scripts/core/verify-before-push.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = bmad-production-grade-dev@0.1.11 matchedIdentity = npm:[redacted]:0.1.11 similarity = 0.583 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

assets/scripts/core/verify-before-push.mjsView on unpkg

Source & flagged code

3 flagged · loading source

assets/scripts/adaptable/validate-journey-wiring.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code