registry / candor-ts / 0.8.12

candor-ts@0.8.12

candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.8)

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 285 KB of source, external domains: github.com

Source & flagged code

3 flagged

Cases.tsView file

Lines 1-24typescript

1// The candor-spec conformance cases in TypeScript — paired by bare function name with the Rust and

2// Java fixtures; the expected effect sets are conformance/expected.json (the SAME oracle).

3import * as fsm from "node:fs";

4import * as netm from "node:net";

5import * as cp from "node:child_process";

6import * as cryptom from "node:crypto";

High

Child Process

Package source references child process execution.

Cases.tsView on unpkg · L4

7import { DatabaseSync } from "node:sqlite";

8import * as winstonm from "winston";

10// --- one function per std-only effect ---

11export function fs_read(): void { try { fsm.readFileSync("/tmp/x"); } catch {} }

12export function net_connect(): void { try { netm.connect(1, "h"); } catch {} }

13export function exec_spawn(): void { try { cp.spawn("x"); } catch {} }

14// Exec-cliff refinement (spec §4 ⟨0.5⟩): a known literal head adds its effect; all engines must agree.

15export function exec_curl(): void { try { cp.spawn("curl"); } catch {} }

16// Exec-refinement reads the HEAD (argv[0]) only: a dynamic program with a literal ARGUMENT keeps the

17// bare cliff — "curl" in the args array must NOT fabricate Net (spec §4 ⟨0.5⟩: the head is argv[0]).

18export function exec_dyn_head(tool: string): void { try { cp.spawn(tool, ["curl"]); } catch {} }

19export function env_read(): void { void process.env.X; }

20export function clock_now(): void { void Date.now(); }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Cases.tsView on unpkg · L3

21// Rand: node:crypto's CSPRNG. candor-ts is syntactic (AST), so the builtin need not resolve at scan time.

22export function rand_gen(): void { void cryptom.randomBytes(16); }

23// Db: node:sqlite's DatabaseSync.exec is the store round-trip (named import — candor-ts tracks the symbol).

24export function db_query(): void { void new DatabaseSync(":memory:").exec("SELECT 1"); }

watch.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * candor-ts-watch — keep a candor report FRESH as an agent edits, so candor-ts-mcp serves live ground

4 * truth (roadmap #1, the freshness half). It tracks the project's TS sources by content hash and

5 * re-scans only when a tracked source ACTUALLY changed — a no-op save, a touched node_modules file, or

6 * an unrelated write never triggers work. The MCP server reads the same `--out` prefix, so the loop is:

7 * agent edits → watcher refreshes the report → agent asks candor_impact and gets the post-edit answer.

8 *

9 * v1 re-runs a FULL scan on a real change — sound (the report always equals a clean scan), and fast

10 * enough for the edit loop on small/mid projects. The deeper optimisation — re-analysing only the

Source & flagged code

3 flagged · loading source

Cases.tsView file

4import * as netm from "node:net"; L5: import * as cp from "node:child_process"; L6: import * as cryptom from "node:crypto";

High

Child Process

Package source references child process execution.

Cases.tsView on unpkg · L4

3import * as fsm from "node:fs"; L4: import * as netm from "node:net"; L5: import * as cp from "node:child_process"; L6: import * as cryptom from "node:crypto"; ... L18: export function exec_dyn_head(tool: string): void { try { cp.spawn(tool, ["curl"]); } catch {} } L19: export function env_read(): void { void process.env.X; } L20: export function clock_now(): void { void Date.now(); }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

Cases.tsView on unpkg · L3

watch.mjsView file

16*/ L17: import { spawnSync } from "node:child_process"; L18: import crypto from "node:crypto"; ... L63: const r = spawnSync("node", [path.join(HERE, "scan.mjs"), target, "--out", out], { encoding: "utf8" }); L64: return { ok: r.status === 0, ms: Date.now() - t0, stderr: r.stderr }; L65: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

watch.mjsView on unpkg · L16

Findings

3 High1 Medium5 Low

HighChild ProcessCases.ts

HighShell

HighSame File Env Network ExecutionCases.ts

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptowatch.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings