registry / decispher / 0.3.2

decispher@0.3.2

Decispher CLI — turn every branch into a flight recorder for AI coding sessions. One command: npx decispher init.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 19 file(s), 115 KB of source, external domains: api.decispher.com, decispher.com

Source & flagged code

1 flagged

templates/decispher-hook.mjsView file

Lines 2-42javascript

2/**

3 * Decispher Session Recorder — hook handler (installed by `npx decispher init`).

4 *

5 * One self-contained script, zero dependencies, Node >= 18. Subcommands map to

6 * Claude Code hooks + the git post-checkout hook + the statusline:

7 *

8 * session-start | user-prompt | post-tool | stop | session-end

9 * cursor-after-edit | cursor-before-shell | cursor-stop (Cursor hooks.json)

10 * codex-session-start | codex-user-prompt | codex-post-tool | codex-stop (.codex/hooks.json)

11 * post-checkout <prev> <next> <flag>

12 * statusline

13 *

14 * Invariants (ADR-052/053):

15 * - Capture NEVER blocks the agent: every network call has a hard timeout,

16 * every failure buffers locally (.decispher/.session/) and exits 0.

17 * - Redaction happens at source before anything leaves the machine; content

18 * from never-capture paths (.env, keys, credentials) is never read at all.

19 * - Branch is resolved PER EVENT from the event's cwd — mid-session branch

20 * switches land in the right store.

21 */

23import { spawnSync } from 'node:child_process';

24import { createHash } from 'node:crypto';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

templates/decispher-hook.mjsView on unpkg · L22

25import fs from 'node:fs';

26import os from 'node:os';

27import path from 'node:path';

28import { fileURLToPath } from 'node:url';

30const POST_TIMEOUT_MS = 3000;

31const BRIEFING_TIMEOUT_MS = 2500;

32const EDIT_CHECK_TIMEOUT_MS = 2000;

33const STATUS_TIMEOUT_MS = 1500;

34const GIT_TIMEOUT_MS = 1500;

35const STATUS_CACHE_TTL_MS = 60_000;

36const MAX_BUFFERED_EVENTS = 500;

37const MAX_TERMINAL_OUTPUT_CHARS = 16_000;

38const MAX_DIFF_CHARS = 60_000;

39const MAX_PROMPT_CHARS = 16_000;

40const MAX_REASONING_SNIPPETS = 5;

41const MAX_EDIT_HISTORY_PER_FILE = 50;

Source & flagged code

1 flagged · loading source

templates/decispher-hook.mjsView file

22L23: import { spawnSync } from 'node:child_process'; L24: import { createHash } from 'node:crypto'; ... L47: const SECRET_PATTERNS = [ L48: { name: 'pem_block', regex: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g }, L49: { name: 'aws_access_key', regex: /\b(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}\b/g }, ... L97: const res = spawnSync('git', args, { cwd, encoding: 'utf8', timeout: GIT_TIMEOUT_MS }); L98: if (res.status !== 0 || typeof res.stdout !== 'string') return null; L99: return res.stdout.trim() || null; ... L116: function loadApiKey(apiUrl) { L117: if (process.env.DECISPHER_API_KEY) return process.env.DECISPHER_API_KEY; L118: try {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

templates/decispher-hook.mjsView on unpkg · L22

Findings

1 Medium7 Low

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptotemplates/decispher-hook.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

templates/decispher-hook.mjsView file

Lines 2-42javascript

2/**

3 * Decispher Session Recorder — hook handler (installed by `npx decispher init`).

4 *

5 * One self-contained script, zero dependencies, Node >= 18. Subcommands map to

6 * Claude Code hooks + the git post-checkout hook + the statusline:

7 *

8 * session-start | user-prompt | post-tool | stop | session-end

9 * cursor-after-edit | cursor-before-shell | cursor-stop (Cursor hooks.json)

10 * codex-session-start | codex-user-prompt | codex-post-tool | codex-stop (.codex/hooks.json)

11 * post-checkout <prev> <next> <flag>

12 * statusline

13 *

14 * Invariants (ADR-052/053):

15 * - Capture NEVER blocks the agent: every network call has a hard timeout,

16 * every failure buffers locally (.decispher/.session/) and exits 0.

17 * - Redaction happens at source before anything leaves the machine; content

18 * from never-capture paths (.env, keys, credentials) is never read at all.

19 * - Branch is resolved PER EVENT from the event's cwd — mid-session branch

20 * switches land in the right store.

21 */

23import { spawnSync } from 'node:child_process';

24import { createHash } from 'node:crypto';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

templates/decispher-hook.mjsView on unpkg · L22

25import fs from 'node:fs';

26import os from 'node:os';

27import path from 'node:path';

28import { fileURLToPath } from 'node:url';

30const POST_TIMEOUT_MS = 3000;

31const BRIEFING_TIMEOUT_MS = 2500;

32const EDIT_CHECK_TIMEOUT_MS = 2000;

33const STATUS_TIMEOUT_MS = 1500;

34const GIT_TIMEOUT_MS = 1500;

35const STATUS_CACHE_TTL_MS = 60_000;

36const MAX_BUFFERED_EVENTS = 500;

37const MAX_TERMINAL_OUTPUT_CHARS = 16_000;

38const MAX_DIFF_CHARS = 60_000;

39const MAX_PROMPT_CHARS = 16_000;

40const MAX_REASONING_SNIPPETS = 5;

41const MAX_EDIT_HISTORY_PER_FILE = 50;