registry / continuous-improvement / 3.21.0

continuous-improvement@3.21.0

Claude Code that gets sharper every session: the persistent-memory and runtime-discipline layer built on the 7 Laws of AI Agent Discipline. It grounds every edit in real facts before it lands and, through the Mulahazah engine, turns each fix into a reusab

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 94 file(s), 794 KB of source, external domains: github.com, registry.npmjs.org

Source & flagged code

4 flagged

bin/check-test-imports-only.mjsView file

Lines 85-125javascript

85function toPosix(relPath) {

86 return relPath.split(sep).join(posix.sep);

87}

88function main() {

89 const repoRoot = argv[2] ?? cwd();

90 const files = discoverTestFiles(repoRoot);

91 const violations = [];

92 let productionImports = 0;

93 for (const relPath of files) {

94 const content = readFileSync(join(repoRoot, relPath), "utf8");

95 const imports = extractImports(content);

96 for (const { line, specifier } of imports) {

97 if (!isAllowedSpecifier(specifier)) {

98 violations.push({ file: toPosix(relPath), line, specifier });

99 }

100 else if (!specifier.startsWith("node:")) {

101 productionImports += 1;

102 }

103 }

104 }

105 if (violations.length === 0) {

106 console.log(`OK test-imports-only: ${files.length} test file(s), ${productionImports} production import(s), all within node:* or ../bin/*.mjs or ../lib/*.mjs.`);

107 exit(0);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/check-test-imports-only.mjsView on unpkg · L105

108 }

109 console.error(`FAIL test-imports-only: ${violations.length} non-node import(s) outside the allow-list.`);

110 console.error("");

111 for (const v of violations) {

112 console.error(` ${v.file}:${v.line} — imports "${v.specifier}"`);

113 }

114 console.error("");

115 console.error("Allow-list: node:* builtins, ../bin/<name>.mjs, ../lib/<name>.mjs.");

116 console.error("Fix: replace the offending import with a node:* equivalent, an allowed");

117 console.error("production import, or a `spawnSync` of the compiled `.mjs`.");

118 exit(1);

119}

120const scriptPathFromArgv = argv[1];

121const isMainModule = scriptPathFromArgv !== undefined &&

122 (import.meta.url.endsWith(scriptPathFromArgv.replace(/\\/g, "/")) ||

123 scriptPathFromArgv.endsWith("check-test-imports-only.mjs"));

124if (isMainModule) {

125 main();

bin/harvest-friction.mjsView file

Lines 150-190javascript

150 first_seen: first.evidence_ts,

151 last_seen: last.evidence_ts,

152 });

153 }

154 return instincts.sort((a, b) => b.confidence - a.confidence);

bin/analyze.shView file

•path = bin/analyze.sh kind = build_helper sizeBytes = 5808 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/analyze.shView on unpkg

bin/install.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = continuous-improvement@3.20.4 matchedIdentity = npm:Y29udGludW91cy1pbXByb3ZlbWVudA:3.20.4 similarity = 0.967 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/install.mjsView on unpkg

Source & flagged code

4 flagged · loading source

bin/check-test-imports-only.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code