registry / create-cmp-cli / 0.7.1

create-cmp-cli@0.7.1

Create production mobile apps (Android + iOS, one Kotlin codebase) with AI — the delivery harness for Compose Multiplatform, the current generation of cross-platform (Google-backed KMP, iOS stable since May 2025). A deterministic, non-interactive generato

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 257 KB of source, external domains: 127.0.0.1, get.maestro.mobile.dev, nodejs.org, www.w3.org

Source & flagged code

8 flagged

template/qa/refusal-demo.mjsView file

Lines 1-65javascript

1#!/usr/bin/env node

2// The refusal demo (C7) — proves the gates REFUSE real violations, each named

3// and blocking, rather than merely asserting it in prose.

4//

5// node qa/refusal-demo.mjs

6//

7// Operates on a throwaway scaffolded app in a temp dir (never this template,

8// never the calling repo). For each of the four canonical violations

9// (docs/M4-ENFORCEMENT-DESIGN.md §B):

10//

11// 1. inject the violation into the scaffold

12// 2. run the narrowest gate that should catch it

13// 3. assert the gate verdict is FAIL and the expected clause id appears in

14// the failure output

15// 4. assert `qa/receipt-check.mjs` goes INVALID (violation blocks "done")

16// 5. `git checkout -- .` to revert before the next violation

17//

18// Emits a summary table and exits non-zero if ANY assertion fails — i.e. if a

19// gate did NOT catch its violation. That is the actual finding this script

20// exists to surface; it must never be papered over.

22import { execFileSync, spawnSync } from "node:child_process";

23import fs from "node:fs";

High

Child Process

Package source references child process execution.

template/qa/refusal-demo.mjsView on unpkg · L21

24import os from "node:os";

25import path from "node:path";

26import { fileURLToPath } from "node:url";

28const TEMPLATE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

29const REPO_ROOT = path.resolve(TEMPLATE_ROOT, "..");

30// Scaffolding the throwaway app: inside the create-cmp dev tree the engine sits at

31// ../bin relative to the template — use it directly (fast, offline, tests the local

32// code). In a real generated repo that path doesn't exist, so fall back to the

33// published CLI via npx (needs network on first run).

34const LOCAL_ENGINE = path.join(REPO_ROOT, "bin", "create-cmp.mjs");

35const SCAFFOLD_CMD = fs.existsSync(LOCAL_ENGINE)

36 ? `node "${LOCAL_ENGINE}"`

37 : "npx --yes create-cmp-cli@latest";

38const GRADLEW = process.platform === "win32" ? "gradlew.bat" : "./gradlew";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

template/qa/refusal-demo.mjsView on unpkg · L21

40function log(msg) {

41 process.stdout.write(`${msg}\n`);

42}

44function sh(cmd, cwd, opts = {}) {

45 const res = spawnSync(cmd, {

46 shell: true,

47 cwd,

High

Shell

Package source references shell execution.

template/qa/refusal-demo.mjsView on unpkg · L45

48 encoding: "utf8",

49 maxBuffer: 64 * 1024 * 1024,

50 ...opts,

51 });

52 return { ok: res.status === 0 && !res.error, status: res.status, out: `${res.stdout ?? ""}${res.stderr ?? ""}` };

53}

55function git(cwd, args) {

56 return execFileSync("git", args, { cwd, encoding: "utf8" }).trim();

57}

59// ── Step 0: scaffold a throwaway app ────────────────────────────────────────

61function scaffold() {

62 const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), "cmp-refusal-demo-"));

63 const projectDir = path.join(tmpBase, "RefusalDemo");

64 log(`Scaffolding a throwaway app at ${projectDir} (never touching ${TEMPLATE_ROOT})…`);

template/qa/preview-gallery.mjsView file

Lines 2-42javascript

2// preview-gallery.mjs — build a self-contained HTML gallery from renderScreens output.

3//

4// node qa/preview-gallery.mjs [previewsDir]

5//

6// Reads <previewsDir>/manifest.json (default composeApp/build/previews — the output of

7// `./gradlew :composeApp:renderScreens`), renders each screen's tree.json to a wireframe

8// SVG with the vendored inspector render lib (structure for the AI), and embeds the

9// harness PNGs (pixels for the human) into ONE index.html — no server, no device, open

10// the file. Also drops <id>/wireframe.svg next to each tree.

11//

12// Zero dependencies beyond qa/lib (vendored, pure logic) — works without the create-cmp

template/gradlew.batView file

•path = template/gradlew.bat kind = build_helper sizeBytes = 2872 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/gradlew.batView on unpkg

template/gradle/wrapper/gradle-wrapper.jarView file

•path = template/gradle/wrapper/gradle-wrapper.jar kind = high_entropy_blob sizeBytes = 43583 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = template/gradle/wrapper/gradle-wrapper.jar kind = compressed_blob sizeBytes = 43583 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = template/gradle/wrapper/gradle-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 43583 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

Source & flagged code

8 flagged · loading source

template/qa/refusal-demo.mjsView file

21L22: import { execFileSync, spawnSync } from "node:child_process"; L23: import fs from "node:fs";

High

Child Process

Package source references child process execution.

template/qa/refusal-demo.mjsView on unpkg · L21

45const res = spawnSync(cmd, { L46: shell: true, L47: cwd,

High

Shell

Package source references shell execution.

template/qa/refusal-demo.mjsView on unpkg · L45

21L22: import { execFileSync, spawnSync } from "node:child_process"; L23: import fs from "node:fs"; ... L36: ? `node "${LOCAL_ENGINE}"` L37: : "npx --yes create-cmp-cli@latest"; L38: const GRADLEW = process.platform === "win32" ? "gradlew.bat" : "./gradlew";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

template/qa/refusal-demo.mjsView on unpkg · L21

template/qa/preview-gallery.mjsView file

22L23: const { renderTreeSvg } = await import(new URL("./lib/render.mjs", import.meta.url)); L24: const { auditA11y } = await import(new URL("./lib/a11y.mjs", import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

template/qa/preview-gallery.mjsView on unpkg · L22

template/gradlew.batView file

•path = template/gradlew.bat kind = build_helper sizeBytes = 2872 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/gradlew.batView on unpkg

template/gradle/wrapper/gradle-wrapper.jarView file

•path = template/gradle/wrapper/gradle-wrapper.jar kind = high_entropy_blob sizeBytes = 43583 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = template/gradle/wrapper/gradle-wrapper.jar kind = compressed_blob sizeBytes = 43583 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = template/gradle/wrapper/gradle-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 43583 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

Findings

4 High5 Medium6 Low

HighChild Processtemplate/qa/refusal-demo.mjs

HighShelltemplate/qa/refusal-demo.mjs

HighRuntime Package Installtemplate/qa/refusal-demo.mjs

HighShips High Entropy Blobtemplate/gradle/wrapper/gradle-wrapper.jar

MediumDynamic Requiretemplate/qa/preview-gallery.mjs

MediumEnvironment Vars

MediumShips Build Helpertemplate/gradlew.bat

MediumShips Compressed Blobtemplate/gradle/wrapper/gradle-wrapper.jar

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectiontemplate/gradle/wrapper/gradle-wrapper.jar

Source & flagged code

8 flagged

template/qa/refusal-demo.mjsView file

Lines 1-65javascript

1#!/usr/bin/env node

2// The refusal demo (C7) — proves the gates REFUSE real violations, each named

3// and blocking, rather than merely asserting it in prose.

4//

5// node qa/refusal-demo.mjs

6//

7// Operates on a throwaway scaffolded app in a temp dir (never this template,

8// never the calling repo). For each of the four canonical violations

9// (docs/M4-ENFORCEMENT-DESIGN.md §B):

10//

11// 1. inject the violation into the scaffold

12// 2. run the narrowest gate that should catch it

13// 3. assert the gate verdict is FAIL and the expected clause id appears in

14// the failure output

15// 4. assert `qa/receipt-check.mjs` goes INVALID (violation blocks "done")

16// 5. `git checkout -- .` to revert before the next violation

17//

18// Emits a summary table and exits non-zero if ANY assertion fails — i.e. if a

19// gate did NOT catch its violation. That is the actual finding this script

20// exists to surface; it must never be papered over.

22import { execFileSync, spawnSync } from "node:child_process";

23import fs from "node:fs";

High

Child Process

Package source references child process execution.

template/qa/refusal-demo.mjsView on unpkg · L21

24import os from "node:os";

25import path from "node:path";

26import { fileURLToPath } from "node:url";

28const TEMPLATE_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

29const REPO_ROOT = path.resolve(TEMPLATE_ROOT, "..");

30// Scaffolding the throwaway app: inside the create-cmp dev tree the engine sits at

31// ../bin relative to the template — use it directly (fast, offline, tests the local

32// code). In a real generated repo that path doesn't exist, so fall back to the

33// published CLI via npx (needs network on first run).

34const LOCAL_ENGINE = path.join(REPO_ROOT, "bin", "create-cmp.mjs");

35const SCAFFOLD_CMD = fs.existsSync(LOCAL_ENGINE)

36 ? `node "${LOCAL_ENGINE}"`

37 : "npx --yes create-cmp-cli@latest";

38const GRADLEW = process.platform === "win32" ? "gradlew.bat" : "./gradlew";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

template/qa/refusal-demo.mjsView on unpkg · L21

40function log(msg) {

41 process.stdout.write(`${msg}\n`);

42}

44function sh(cmd, cwd, opts = {}) {

45 const res = spawnSync(cmd, {

46 shell: true,

47 cwd,

High

Shell

Package source references shell execution.

template/qa/refusal-demo.mjsView on unpkg · L45

48 encoding: "utf8",

49 maxBuffer: 64 * 1024 * 1024,

50 ...opts,

51 });

52 return { ok: res.status === 0 && !res.error, status: res.status, out: `${res.stdout ?? ""}${res.stderr ?? ""}` };

53}

55function git(cwd, args) {

56 return execFileSync("git", args, { cwd, encoding: "utf8" }).trim();

57}

59// ── Step 0: scaffold a throwaway app ────────────────────────────────────────

61function scaffold() {

62 const tmpBase = fs.mkdtempSync(path.join(os.tmpdir(), "cmp-refusal-demo-"));

63 const projectDir = path.join(tmpBase, "RefusalDemo");

64 log(`Scaffolding a throwaway app at ${projectDir} (never touching ${TEMPLATE_ROOT})…`);

template/qa/preview-gallery.mjsView file

Lines 2-42javascript

2// preview-gallery.mjs — build a self-contained HTML gallery from renderScreens output.

3//

4// node qa/preview-gallery.mjs [previewsDir]

5//

6// Reads <previewsDir>/manifest.json (default composeApp/build/previews — the output of

7// `./gradlew :composeApp:renderScreens`), renders each screen's tree.json to a wireframe

8// SVG with the vendored inspector render lib (structure for the AI), and embeds the

9// harness PNGs (pixels for the human) into ONE index.html — no server, no device, open

10// the file. Also drops <id>/wireframe.svg next to each tree.

11//

12// Zero dependencies beyond qa/lib (vendored, pure logic) — works without the create-cmp

template/gradlew.batView file

•path = template/gradlew.bat kind = build_helper sizeBytes = 2872 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/gradlew.batView on unpkg

template/gradle/wrapper/gradle-wrapper.jarView file

•path = template/gradle/wrapper/gradle-wrapper.jar kind = high_entropy_blob sizeBytes = 43583 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = template/gradle/wrapper/gradle-wrapper.jar kind = compressed_blob sizeBytes = 43583 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg

•path = template/gradle/wrapper/gradle-wrapper.jar kind = nested_archive_needs_inspection sizeBytes = 43583 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

template/gradle/wrapper/gradle-wrapper.jarView on unpkg