registry / candor-ts / 0.8.5

candor-ts@0.8.5

candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.8)

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 244 KB of source, external domains: github.com

Source & flagged code

1 flagged

watch.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * candor-ts-watch — keep a candor report FRESH as an agent edits, so candor-ts-mcp serves live ground

4 * truth (roadmap #1, the freshness half). It tracks the project's TS sources by content hash and

5 * re-scans only when a tracked source ACTUALLY changed — a no-op save, a touched node_modules file, or

6 * an unrelated write never triggers work. The MCP server reads the same `--out` prefix, so the loop is:

7 * agent edits → watcher refreshes the report → agent asks candor_impact and gets the post-edit answer.

8 *

9 * v1 re-runs a FULL scan on a real change — sound (the report always equals a clean scan), and fast

10 * enough for the edit loop on small/mid projects. The deeper optimisation — re-analysing only the

11 * changed file's subgraph and re-propagating incrementally (the part that needs candor-ts's scanner

12 * factored for per-file extraction) — is the staged next step; the content-hash gate here is the first

13 * increment of it (don't redo work when nothing relevant changed).

14 *

15 * candor-ts-watch <dir> [--out <prefix>] [--interval <ms>]

16 */

17import { spawnSync } from "node:child_process";

18import crypto from "node:crypto";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

watch.mjsView on unpkg · L16

19import fs from "node:fs";

20import path from "node:path";

21import { fileURLToPath } from "node:url";

22import * as Q from "./query-core.mjs";

24const HERE = path.dirname(fileURLToPath(import.meta.url));

25const SRC = /\.[mc]?[jt]sx?$/; // .ts/.tsx/.mts/.cts/.js/.jsx — what candor-ts analyses

26const SKIP = new Set(["node_modules", ".git", "dist", "build", ".candor"]);

28// The tracked source set: every analysable file under `target` (a dir), or the single file itself.

29export function trackedFiles(target) {

30 const st = fs.statSync(target);

31 if (st.isFile()) return SRC.test(target) ? [path.resolve(target)] : [];

32 const out = [];

33 (function walk(dir) {

34 for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {

35 if (ent.name.startsWith(".") && ent.name !== ".") continue;

36 if (SKIP.has(ent.name)) continue;

Source & flagged code

1 flagged · loading source

watch.mjsView file

16*/ L17: import { spawnSync } from "node:child_process"; L18: import crypto from "node:crypto"; ... L63: const r = spawnSync("node", [path.join(HERE, "scan.mjs"), target, "--out", out], { encoding: "utf8" }); L64: return { ok: r.status === 0, ms: Date.now() - t0, stderr: r.stderr }; L65: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

watch.mjsView on unpkg · L16

Findings

1 Medium5 Low

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptowatch.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

watch.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * candor-ts-watch — keep a candor report FRESH as an agent edits, so candor-ts-mcp serves live ground

4 * truth (roadmap #1, the freshness half). It tracks the project's TS sources by content hash and

5 * re-scans only when a tracked source ACTUALLY changed — a no-op save, a touched node_modules file, or

6 * an unrelated write never triggers work. The MCP server reads the same `--out` prefix, so the loop is:

7 * agent edits → watcher refreshes the report → agent asks candor_impact and gets the post-edit answer.

8 *

9 * v1 re-runs a FULL scan on a real change — sound (the report always equals a clean scan), and fast

10 * enough for the edit loop on small/mid projects. The deeper optimisation — re-analysing only the

11 * changed file's subgraph and re-propagating incrementally (the part that needs candor-ts's scanner

12 * factored for per-file extraction) — is the staged next step; the content-hash gate here is the first

13 * increment of it (don't redo work when nothing relevant changed).

14 *

15 * candor-ts-watch <dir> [--out <prefix>] [--interval <ms>]

16 */

17import { spawnSync } from "node:child_process";

18import crypto from "node:crypto";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

watch.mjsView on unpkg · L16

19import fs from "node:fs";

20import path from "node:path";

21import { fileURLToPath } from "node:url";

22import * as Q from "./query-core.mjs";

24const HERE = path.dirname(fileURLToPath(import.meta.url));

25const SRC = /\.[mc]?[jt]sx?$/; // .ts/.tsx/.mts/.cts/.js/.jsx — what candor-ts analyses

26const SKIP = new Set(["node_modules", ".git", "dist", "build", ".candor"]);

28// The tracked source set: every analysable file under `target` (a dir), or the single file itself.

29export function trackedFiles(target) {

30 const st = fs.statSync(target);

31 if (st.isFile()) return SRC.test(target) ? [path.resolve(target)] : [];

32 const out = [];

33 (function walk(dir) {

34 for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {

35 if (ent.name.startsWith(".") && ent.name !== ".") continue;

36 if (SKIP.has(ent.name)) continue;