registry / candor-ts / 0.8.6

candor-ts@0.8.6

candor for TypeScript — per-function side effects, transitively, with a policy gate (candor-spec 0.8)

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 251 KB of source, external domains: github.com

Source & flagged code

2 flagged

watch.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * candor-ts-watch — keep a candor report FRESH as an agent edits, so candor-ts-mcp serves live ground

4 * truth (roadmap #1, the freshness half). It tracks the project's TS sources by content hash and

5 * re-scans only when a tracked source ACTUALLY changed — a no-op save, a touched node_modules file, or

6 * an unrelated write never triggers work. The MCP server reads the same `--out` prefix, so the loop is:

7 * agent edits → watcher refreshes the report → agent asks candor_impact and gets the post-edit answer.

8 *

9 * v1 re-runs a FULL scan on a real change — sound (the report always equals a clean scan), and fast

10 * enough for the edit loop on small/mid projects. The deeper optimisation — re-analysing only the

11 * changed file's subgraph and re-propagating incrementally (the part that needs candor-ts's scanner

12 * factored for per-file extraction) — is the staged next step; the content-hash gate here is the first

13 * increment of it (don't redo work when nothing relevant changed).

14 *

15 * candor-ts-watch <dir> [--out <prefix>] [--interval <ms>]

16 */

17import { spawnSync } from "node:child_process";

18import crypto from "node:crypto";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

watch.mjsView on unpkg · L16

19import fs from "node:fs";

20import path from "node:path";

21import { fileURLToPath } from "node:url";

22import * as Q from "./query-core.mjs";

24const HERE = path.dirname(fileURLToPath(import.meta.url));

25const SRC = /\.[mc]?[jt]sx?$/; // .ts/.tsx/.mts/.cts/.js/.jsx — what candor-ts analyses

26const SKIP = new Set(["node_modules", ".git", "dist", "build", ".candor"]);

28// The tracked source set: every analysable file under `target` (a dir), or the single file itself.

29export function trackedFiles(target) {

30 const st = fs.statSync(target);

31 if (st.isFile()) return SRC.test(target) ? [path.resolve(target)] : [];

32 const out = [];

33 (function walk(dir) {

34 for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {

35 if (ent.name.startsWith(".") && ent.name !== ".") continue;

36 if (SKIP.has(ent.name)) continue;

scan.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = candor-ts@0.8.5 matchedIdentity = npm:Y2FuZG9yLXRz:0.8.5 similarity = 0.444 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scan.mjsView on unpkg

Source & flagged code

2 flagged · loading source

watch.mjsView file

16*/ L17: import { spawnSync } from "node:child_process"; L18: import crypto from "node:crypto"; ... L63: const r = spawnSync("node", [path.join(HERE, "scan.mjs"), target, "--out", out], { encoding: "utf8" }); L64: return { ok: r.status === 0, ms: Date.now() - t0, stderr: r.stderr }; L65: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

watch.mjsView on unpkg · L16

scan.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scan.mjsView on unpkg

Findings

1 High1 Medium5 Low

HighPrevious Version Dangerous Deltascan.mjs

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptowatch.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

watch.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * candor-ts-watch — keep a candor report FRESH as an agent edits, so candor-ts-mcp serves live ground

4 * truth (roadmap #1, the freshness half). It tracks the project's TS sources by content hash and

5 * re-scans only when a tracked source ACTUALLY changed — a no-op save, a touched node_modules file, or

6 * an unrelated write never triggers work. The MCP server reads the same `--out` prefix, so the loop is:

7 * agent edits → watcher refreshes the report → agent asks candor_impact and gets the post-edit answer.

8 *

9 * v1 re-runs a FULL scan on a real change — sound (the report always equals a clean scan), and fast

10 * enough for the edit loop on small/mid projects. The deeper optimisation — re-analysing only the

11 * changed file's subgraph and re-propagating incrementally (the part that needs candor-ts's scanner

12 * factored for per-file extraction) — is the staged next step; the content-hash gate here is the first

13 * increment of it (don't redo work when nothing relevant changed).

14 *

15 * candor-ts-watch <dir> [--out <prefix>] [--interval <ms>]

16 */

17import { spawnSync } from "node:child_process";

18import crypto from "node:crypto";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

watch.mjsView on unpkg · L16

19import fs from "node:fs";

20import path from "node:path";

21import { fileURLToPath } from "node:url";

22import * as Q from "./query-core.mjs";

24const HERE = path.dirname(fileURLToPath(import.meta.url));

25const SRC = /\.[mc]?[jt]sx?$/; // .ts/.tsx/.mts/.cts/.js/.jsx — what candor-ts analyses

26const SKIP = new Set(["node_modules", ".git", "dist", "build", ".candor"]);

28// The tracked source set: every analysable file under `target` (a dir), or the single file itself.

29export function trackedFiles(target) {

30 const st = fs.statSync(target);

31 if (st.isFile()) return SRC.test(target) ? [path.resolve(target)] : [];

32 const out = [];

33 (function walk(dir) {

34 for (const ent of fs.readdirSync(dir, { withFileTypes: true })) {

35 if (ent.name.startsWith(".") && ent.name !== ".") continue;

36 if (SKIP.has(ent.name)) continue;

scan.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scan.mjsView on unpkg