registry / bmad-production-grade-dev / 0.1.11

bmad-production-grade-dev@0.1.11

Hardens bmm's story cycle: adversarial multi-reviewer + human-verified customer-experience gate at commit — ship production-grade at AI-native pace.

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 227 KB of source

Source & flagged code

2 flagged

pgd-setup/assets/scripts/adaptable/validate-journey-wiring.mjsView file

Lines 130-170javascript

130 // screen's "back to parent" edge can be declared in the journey

131 // without forcing the implementer to inline a raw router.replace.

132 new RegExp(`safeBack\\s*\\(\\s*router\\s*,\\s*${quoteClass}${pattern}${quoteClass}`),

133 ];

134 return patterns.some((re) => re.test(source));

135}

136

137/**

138 * Normalise screen.next to an array of edge objects. Supports:

139 * - Single edge object: { when, route, skip_via?, optional? }

140 * - Array of edge objects: [{ ... }, { ... }]

141 *

142 * Returns [] when next is missing (terminal screen).

143 */

144function normaliseEdges(next) {

145 if (!next) return [];

146 if (Array.isArray(next)) return next;

147 return [next];

148}

149

150async function main() {

151 const { USER_JOURNEYS } = await import(pathToFileURL(journeysFile).href);

152 const failures = [];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

pgd-setup/assets/scripts/adaptable/validate-journey-wiring.mjsView on unpkg · L150

153 let checks = 0;

154

155 for (const [journeyName, journey] of Object.entries(USER_JOURNEYS)) {

156 for (const screen of journey.screens ?? []) {

157 const edges = normaliseEdges(screen.next);

158 for (const edge of edges) {

159 const target = edge.skip_via ?? edge.route;

160 if (!target) continue;

161 checks++;

162 try {

163 const { path: srcPath, content } = await findScreenSource(screen.app, screen.route);

164 if (!containsRouterRef(content, target)) {

165 failures.push({

166 journey: journeyName,

167 from: screen.route,

168 to: target,

169 when: edge.when,

170 srcPath,

pgd-setup/assets/scripts/core/verify-before-push.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = bmad-production-grade-dev@0.1.6 matchedIdentity = npm:[redacted]:0.1.6 similarity = 0.750 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

pgd-setup/assets/scripts/core/verify-before-push.mjsView on unpkg

Source & flagged code

2 flagged · loading source

pgd-setup/assets/scripts/adaptable/validate-journey-wiring.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code