registry / cool-workflow / 0.1.97

cool-workflow@0.1.97

A workflow control plane and run-time you are able to check: it sends out jobs in TypeScript, makes certain of work against facts before it goes through, puts state into fixed records, orders jobs by time, runs jobs again and again, gets a group of agents

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 210 file(s), 2.12 MB of source, external domains: github.com, nodejs.org, raw.githubusercontent.com, www.npmjs.com

Source & flagged code

5 flagged

dist/commit.jsView file

Lines 1-29javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.CommitGateError = void 0;

7exports.commitState = commitState;

8const node_fs_1 = __importDefault(require("node:fs"));

9const node_path_1 = __importDefault(require("node:path"));

10const node_child_process_1 = require("node:child_process");

11const state_1 = require("./state");

High

Child Process

Package source references child process execution.

dist/commit.jsView on unpkg · L9

12const pipeline_contract_1 = require("./pipeline-contract");

13const state_node_1 = require("./state-node");

14const pipeline_runner_1 = require("./pipeline-runner");

15const error_feedback_1 = require("./error-feedback");

16const trust_audit_1 = require("./trust-audit");

17const collaboration_1 = require("./collaboration");

18const evidence_grounding_1 = require("./evidence-grounding");

19const verifier_1 = require("./verifier");

20const compare_1 = require("./compare");

21const gates_1 = require("./gates");

22class CommitGateError extends Error {

23 structured;

24 feedbackId;

25 stateNodeId;

26 constructor(error, options = {}) {

27 super(error.message);

28 this.name = "CommitGateError";

29 this.structured = error;

dist/reporter.jsView file

Lines 1-35javascript

1"use strict";

2// src/reporter.ts — the cw-side run reporter.

3//

4// Rendering lives behind a small interface so the drive/command-surface stay logic-only: the

5// orchestrator emits events (progress lines, the end-of-run summary) and the Reporter decides how

6// to draw them. The live AGENT view (spinner / streamed tokens / folding tool lines) is rendered

7// by the async agent wrapper — cw is blocked in spawnSync during a run, so cw only renders the

8// calm orchestration BETWEEN agents plus the final summary. Everything here goes to STDERR; the

9// MACHINE payloads on stdout (the cw:result fence + cw's --json via printJson) carry NO term

10// styling, so they stay byte-exact under any color env. Color is TTY-gated and honors

dist/remote-source.js#virtual:normalized:round1View file

269} L270: const child = "const fs=require('fs');const [url,out,cap]=[process.argv[1],process.argv[2],Number(process.argv[3])];const priv=(h)=>{h=String(h).replace(/^\\[|\\]$/g,'').toLowerCas... L271: const result = (0, child_process.spawnSync)(process.execPath, ["-e", child, rawUrl, dest, String(MAX_ARCHIVE_BYTES)], { L272: encoding: "utf8", L273: timeout: opts.timeoutMs || 120000, L274: env: opts.env || process.env, L275: stdio: ["ignore", "ignore", "pipe"]

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/remote-source.js#virtual:normalized:round1View on unpkg · L269

dist/remote-source.jsView file

Lines 260-300javascript

260 * redirect us into an internal service. The operator's ORIGINAL host is their own choice. */

261function fetchArchiveBytes(rawUrl, sanitizedUrl, dest, opts) {

262 if (rawUrl.startsWith("file://")) {

263 const src = (0, node_url_1.fileURLToPath)(rawUrl);

scripts/release-gate.shView file

•path = scripts/release-gate.sh kind = build_helper sizeBytes = 4456 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-gate.shView on unpkg

Source & flagged code

5 flagged · loading source

dist/commit.jsView file

9const node_path_1 = __importDefault(require("node:path")); L10: const node_child_process_1 = require("node:child_process"); L11: const state_1 = require("./state");

High

Child Process

Package source references child process execution.

dist/commit.jsView on unpkg · L9

dist/reporter.jsView file

15exports.createReporter = createReporter; L16: const term_1 = require("./term"); L17: function isTTY(stream) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/reporter.jsView on unpkg · L15

dist/remote-source.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/remote-source.js#virtual:normalized:round1View on unpkg · L269

dist/remote-source.jsView file

280"for(let i=0;i<6;i++){", L281: "const r=await fetch(u,{redirect:'manual'});", L282: "if(r.status>=300&&r.status<400&&r.headers.get('location')){", L283: "const nx=new URL(r.headers.get('location'),u);", L284: "if(!/^https?:$/.test(nx.protocol)){process.stderr.write('redirect to disallowed scheme '+nx.protocol);process.exit(5);}", L285: "if(priv(nx.hostname)){process.stderr.write('redirect to a private/internal host was blocked');process.exit(5);}", ... L295: ].join(""); L296: const result = (0, node_child_process_1.spawnSync)(process.execPath, ["-e", child, rawUrl, dest, String(MAX_ARCHIVE_BYTES)], { L297: encoding: "utf8",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/remote-source.jsView on unpkg · L280

scripts/release-gate.shView file

•path = scripts/release-gate.sh kind = build_helper sizeBytes = 4456 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-gate.shView on unpkg

Findings

3 High5 Medium4 Low

HighChild Processdist/commit.js

HighSame File Env Network Executiondist/remote-source.js#virtual:normalized:round1

HighCommand Output Exfiltrationdist/remote-source.js

MediumDynamic Requiredist/reporter.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/release-gate.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/commit.jsView file

Lines 1-29javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.CommitGateError = void 0;

7exports.commitState = commitState;

8const node_fs_1 = __importDefault(require("node:fs"));

9const node_path_1 = __importDefault(require("node:path"));

10const node_child_process_1 = require("node:child_process");

11const state_1 = require("./state");

High

Child Process

Package source references child process execution.

dist/commit.jsView on unpkg · L9

12const pipeline_contract_1 = require("./pipeline-contract");

13const state_node_1 = require("./state-node");

14const pipeline_runner_1 = require("./pipeline-runner");

15const error_feedback_1 = require("./error-feedback");

16const trust_audit_1 = require("./trust-audit");

17const collaboration_1 = require("./collaboration");

18const evidence_grounding_1 = require("./evidence-grounding");

19const verifier_1 = require("./verifier");

20const compare_1 = require("./compare");

21const gates_1 = require("./gates");

22class CommitGateError extends Error {

23 structured;

24 feedbackId;

25 stateNodeId;

26 constructor(error, options = {}) {

27 super(error.message);

28 this.name = "CommitGateError";

29 this.structured = error;

dist/reporter.jsView file

Lines 1-35javascript

1"use strict";

2// src/reporter.ts — the cw-side run reporter.

3//

4// Rendering lives behind a small interface so the drive/command-surface stay logic-only: the

5// orchestrator emits events (progress lines, the end-of-run summary) and the Reporter decides how

6// to draw them. The live AGENT view (spinner / streamed tokens / folding tool lines) is rendered

7// by the async agent wrapper — cw is blocked in spawnSync during a run, so cw only renders the

8// calm orchestration BETWEEN agents plus the final summary. Everything here goes to STDERR; the

9// MACHINE payloads on stdout (the cw:result fence + cw's --json via printJson) carry NO term

10// styling, so they stay byte-exact under any color env. Color is TTY-gated and honors

dist/remote-source.js#virtual:normalized:round1View file

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/remote-source.js#virtual:normalized:round1View on unpkg · L269

dist/remote-source.jsView file

Lines 260-300javascript

260 * redirect us into an internal service. The operator's ORIGINAL host is their own choice. */

261function fetchArchiveBytes(rawUrl, sanitizedUrl, dest, opts) {

262 if (rawUrl.startsWith("file://")) {

263 const src = (0, node_url_1.fileURLToPath)(rawUrl);

scripts/release-gate.shView file

•path = scripts/release-gate.sh kind = build_helper sizeBytes = 4456 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/release-gate.shView on unpkg