registry / candor-ts / 0.14.0

candor-ts@0.14.0

candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.14)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 374 KB of source, external domains: github.com

Source & flagged code

4 flagged

Cases.tsView file

Lines 1-24typescript

1// The candor-spec conformance cases in TypeScript — paired by bare function name with the Rust and

2// Java fixtures; the expected effect sets are conformance/expected.json (the SAME oracle).

3import * as fsm from "node:fs";

4import * as netm from "node:net";

5import * as cp from "node:child_process";

6import * as cryptom from "node:crypto";

High

Child Process

Package source references child process execution.

Cases.tsView on unpkg · L4

7import { DatabaseSync } from "node:sqlite";

8import * as winstonm from "winston";

10// --- one function per std-only effect ---

11export function fs_read(): void { try { fsm.readFileSync("/tmp/x"); } catch {} }

12export function net_connect(): void { try { netm.connect(1, "h"); } catch {} }

13export function exec_spawn(): void { try { cp.spawn("x"); } catch {} }

14// Exec-cliff refinement (spec §4 ⟨0.5⟩): a known literal head adds its effect; all engines must agree.

15export function exec_curl(): void { try { cp.spawn("curl"); } catch {} }

16// Exec-refinement reads the HEAD (argv[0]) only: a dynamic program with a literal ARGUMENT keeps the

17// bare cliff — "curl" in the args array must NOT fabricate Net (spec §4 ⟨0.5⟩: the head is argv[0]).

18export function exec_dyn_head(tool: string): void { try { cp.spawn(tool, ["curl"]); } catch {} }

19export function env_read(): void { void process.env.X; }

20export function clock_now(): void { void Date.now(); }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Cases.tsView on unpkg · L3

21// Rand: node:crypto's CSPRNG. candor-ts is syntactic (AST), so the builtin need not resolve at scan time.

22export function rand_gen(): void { void cryptom.randomBytes(16); }

23// Db: node:sqlite's DatabaseSync.exec is the store round-trip (named import — candor-ts tracks the symbol).

24export function db_query(): void { void new DatabaseSync(":memory:").exec("SELECT 1"); }

watch.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * candor-ts-watch — keep a candor report FRESH as an agent edits, so candor-ts-mcp serves live ground

4 * truth (roadmap #1, the freshness half). It tracks the project's TS sources by content hash and

5 * re-scans only when a tracked source ACTUALLY changed — a no-op save, a touched node_modules file, or

6 * an unrelated write never triggers work. The MCP server reads the same `--out` prefix, so the loop is:

7 * agent edits → watcher refreshes the report → agent asks candor_impact and gets the post-edit answer.

8 *

9 * v1 re-runs a FULL scan on a real change — sound (the report always equals a clean scan), and fast

10 * enough for the edit loop on small/mid projects. The deeper optimisation — re-analysing only the

Source & flagged code

4 flagged · loading source

Cases.tsView file

4import * as netm from "node:net"; L5: import * as cp from "node:child_process"; L6: import * as cryptom from "node:crypto";

High

Child Process

Package source references child process execution.

Cases.tsView on unpkg · L4

3import * as fsm from "node:fs"; L4: import * as netm from "node:net"; L5: import * as cp from "node:child_process"; L6: import * as cryptom from "node:crypto"; ... L18: export function exec_dyn_head(tool: string): void { try { cp.spawn(tool, ["curl"]); } catch {} } L19: export function env_read(): void { void process.env.X; } L20: export function clock_now(): void { void Date.now(); }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Cases.tsView on unpkg · L3

watch.mjsView file

16Cross-file remote execution chain: watch.mjs spawns scan.mjs; helper contains network access plus dynamic code execution. L16: */ L17: import { spawnSync } from "node:child_process"; L18: import crypto from "node:crypto"; ... L63: const r = spawnSync("node", [path.join(HERE, "scan.mjs"), target, "--out", out], { encoding: "utf8" }); L64: return { ok: r.status === 0, ms: Date.now() - t0, stderr: r.stderr }; L65: }

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

watch.mjsView on unpkg · L16

16*/ L17: import { spawnSync } from "node:child_process"; L18: import crypto from "node:crypto"; ... L63: const r = spawnSync("node", [path.join(HERE, "scan.mjs"), target, "--out", out], { encoding: "utf8" }); L64: return { ok: r.status === 0, ms: Date.now() - t0, stderr: r.stderr }; L65: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

watch.mjsView on unpkg · L16

Findings

4 High1 Medium5 Low

HighChild ProcessCases.ts

HighShell

HighSame File Env Network ExecutionCases.ts

HighCross File Remote Execution Contextwatch.mjs

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptowatch.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings