registry / create-cmp-cli / 0.4.0

create-cmp-cli@0.4.0

The AI delivery harness for Kotlin/Compose Multiplatform — a deterministic, non-interactive project generator that scaffolds a green-building app (Android + iOS) in minutes, then holds AI-driven changes to a machine-enforced verify lane with a committed e

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 31 file(s), 212 KB of source, external domains: 127.0.0.1, get.maestro.mobile.dev, nodejs.org

Source & flagged code

7 flagged

template/qa/refusal-demo.mjsView file

Lines 1-65javascript

1#!/usr/bin/env node

2// The refusal demo (C7) — proves the gates REFUSE real violations, each named

3// and blocking, rather than merely asserting it in prose.

4//

5// node qa/refusal-demo.mjs

6//

7// Operates on a throwaway scaffolded app in a temp dir (never this template,

8// never the calling repo). For each of the four canonical violations

9// (docs/M4-ENFORCEMENT-DESIGN.md §B):

10//

11// 1. inject the violation into the scaffold

12// 2. run the narrowest gate that should catch it

13// 3. assert the gate verdict is FAIL and the expected clause id appears in

14// the failure output

15// 4. assert `qa/receipt-check.mjs` goes INVALID (violation blocks "done")

16// 5. `git checkout -- .` to revert before the next violation

17//

18// Emits a summary table and exits non-zero if ANY assertion fails — i.e. if a

19// gate did NOT catch its violation. That is the actual finding this script

20// exists to surface; it must never be papered over.

22import { execFileSync, spawnSync } from "node:child_process";

23import fs from "node:fs";

High

Child Process

Package source references child process execution.

template/qa/refusal-demo.mjsView on unpkg · L21

24import os from "node:os";

25import path from "node:path";

26import { fileURLToPath } from "node:url";

28const TEMPLATE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

29const REPO_ROOT = path.resolve(TEMPLATE_ROOT, "..");

30// Scaffolding the throwaway app: inside the create-cmp dev tree the engine sits at

31// ../bin relative to the template — use it directly (fast, offline, tests the local

32// code). In a real generated repo that path doesn't exist, so fall back to the

33// published CLI via npx (needs network on first run).

34const LOCAL_ENGINE = path.join(REPO_ROOT, "bin", "create-cmp.mjs");

35const SCAFFOLD_CMD = fs.existsSync(LOCAL_ENGINE)

36 ? `node "${LOCAL_ENGINE}"`

37 : "npx --yes create-cmp-cli@latest";

38const GRADLEW = process.platform === "win32" ? "gradlew.bat" : "./gradlew";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

template/qa/refusal-demo.mjsView on unpkg · L21

40function log(msg) {

41 process.stdout.write(`${msg}\n`);

42}

44function sh(cmd, cwd, opts = {}) {

45 const res = spawnSync(cmd, {

46 shell: true,

47 cwd,

High

Shell

Package source references shell execution.

template/qa/refusal-demo.mjsView on unpkg · L45

48 encoding: "utf8",

49 maxBuffer: 64 * 1024 * 1024,

50 ...opts,

51 });

52 return { ok: res.status === 0 && !res.error, status: res.status, out: `${res.stdout ?? ""}${res.stderr ?? ""}` };

53}

55function git(cwd, args) {

56 return execFileSync("git", args, { cwd, encoding: "utf8" }).trim();

57}

59// ── Step 0: scaffold a throwaway app ────────────────────────────────────────

61function scaffold() {

62 const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), "cmp-refusal-demo-"));

63 const projectDir = path.join(tmpBase, "RefusalDemo");

64 log(`Scaffolding a throwaway app at ${projectDir} (never touching ${TEMPLATE_ROOT})…`);

template/gradlew.batView file

•path = template/gradlew.bat kind = build_helper sizeBytes = 2872 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/gradlew.batView on unpkg

template/gradle/wrapper/gradle-wrapper.jarView file

•path = template/gradle/wrapper/gradle-wrapper.jar kind = high_entropy_blob sizeBytes = 43583 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = template/gradle/wrapper/gradle-wrapper.jar kind = compressed_blob sizeBytes = 43583 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = template/gradle/wrapper/gradle-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 43583 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

Source & flagged code

7 flagged · loading source

template/qa/refusal-demo.mjsView file

21L22: import { execFileSync, spawnSync } from "node:child_process"; L23: import fs from "node:fs";

High

Child Process

Package source references child process execution.

template/qa/refusal-demo.mjsView on unpkg · L21

45const res = spawnSync(cmd, { L46: shell: true, L47: cwd,

High

Shell

Package source references shell execution.

template/qa/refusal-demo.mjsView on unpkg · L45

21L22: import { execFileSync, spawnSync } from "node:child_process"; L23: import fs from "node:fs"; ... L36: ? `node "${LOCAL_ENGINE}"` L37: : "npx --yes create-cmp-cli@latest"; L38: const GRADLEW = process.platform === "win32" ? "gradlew.bat" : "./gradlew";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

template/qa/refusal-demo.mjsView on unpkg · L21

template/gradlew.batView file

•path = template/gradlew.bat kind = build_helper sizeBytes = 2872 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/gradlew.batView on unpkg

template/gradle/wrapper/gradle-wrapper.jarView file

•path = template/gradle/wrapper/gradle-wrapper.jar kind = high_entropy_blob sizeBytes = 43583 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = template/gradle/wrapper/gradle-wrapper.jar kind = compressed_blob sizeBytes = 43583 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = template/gradle/wrapper/gradle-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 43583 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

Findings

4 High4 Medium6 Low

HighChild Processtemplate/qa/refusal-demo.mjs

HighShelltemplate/qa/refusal-demo.mjs

HighRuntime Package Installtemplate/qa/refusal-demo.mjs

HighShips High Entropy Blobtemplate/gradle/wrapper/gradle-wrapper.jar

MediumEnvironment Vars

MediumShips Build Helpertemplate/gradlew.bat

MediumShips Compressed Blobtemplate/gradle/wrapper/gradle-wrapper.jar

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiontemplate/gradle/wrapper/gradle-wrapper.jar

Source & flagged code

7 flagged

template/qa/refusal-demo.mjsView file

Lines 1-65javascript

1#!/usr/bin/env node

2// The refusal demo (C7) — proves the gates REFUSE real violations, each named

3// and blocking, rather than merely asserting it in prose.

4//

5// node qa/refusal-demo.mjs

6//

7// Operates on a throwaway scaffolded app in a temp dir (never this template,

8// never the calling repo). For each of the four canonical violations

9// (docs/M4-ENFORCEMENT-DESIGN.md §B):

10//

11// 1. inject the violation into the scaffold

12// 2. run the narrowest gate that should catch it

13// 3. assert the gate verdict is FAIL and the expected clause id appears in

14// the failure output

15// 4. assert `qa/receipt-check.mjs` goes INVALID (violation blocks "done")

16// 5. `git checkout -- .` to revert before the next violation

17//

18// Emits a summary table and exits non-zero if ANY assertion fails — i.e. if a

19// gate did NOT catch its violation. That is the actual finding this script

20// exists to surface; it must never be papered over.

22import { execFileSync, spawnSync } from "node:child_process";

23import fs from "node:fs";

High

Child Process

Package source references child process execution.

template/qa/refusal-demo.mjsView on unpkg · L21

24import os from "node:os";

25import path from "node:path";

26import { fileURLToPath } from "node:url";

28const TEMPLATE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

29const REPO_ROOT = path.resolve(TEMPLATE_ROOT, "..");

30// Scaffolding the throwaway app: inside the create-cmp dev tree the engine sits at

31// ../bin relative to the template — use it directly (fast, offline, tests the local

32// code). In a real generated repo that path doesn't exist, so fall back to the

33// published CLI via npx (needs network on first run).

34const LOCAL_ENGINE = path.join(REPO_ROOT, "bin", "create-cmp.mjs");

35const SCAFFOLD_CMD = fs.existsSync(LOCAL_ENGINE)

36 ? `node "${LOCAL_ENGINE}"`

37 : "npx --yes create-cmp-cli@latest";

38const GRADLEW = process.platform === "win32" ? "gradlew.bat" : "./gradlew";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

template/qa/refusal-demo.mjsView on unpkg · L21

40function log(msg) {

41 process.stdout.write(`${msg}\n`);

42}

44function sh(cmd, cwd, opts = {}) {

45 const res = spawnSync(cmd, {

46 shell: true,

47 cwd,

High

Shell

Package source references shell execution.

template/qa/refusal-demo.mjsView on unpkg · L45

48 encoding: "utf8",

49 maxBuffer: 64 * 1024 * 1024,

50 ...opts,

51 });

52 return { ok: res.status === 0 && !res.error, status: res.status, out: `${res.stdout ?? ""}${res.stderr ?? ""}` };

53}

55function git(cwd, args) {

56 return execFileSync("git", args, { cwd, encoding: "utf8" }).trim();

57}

59// ── Step 0: scaffold a throwaway app ────────────────────────────────────────

61function scaffold() {

62 const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), "cmp-refusal-demo-"));

63 const projectDir = path.join(tmpBase, "RefusalDemo");

64 log(`Scaffolding a throwaway app at ${projectDir} (never touching ${TEMPLATE_ROOT})…`);

template/gradlew.batView file

•path = template/gradlew.bat kind = build_helper sizeBytes = 2872 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/gradlew.batView on unpkg

template/gradle/wrapper/gradle-wrapper.jarView file

•path = template/gradle/wrapper/gradle-wrapper.jar kind = high_entropy_blob sizeBytes = 43583 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = template/gradle/wrapper/gradle-wrapper.jar kind = compressed_blob sizeBytes = 43583 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = template/gradle/wrapper/gradle-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 43583 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg