registry / deltawright / 0.7.5

deltawright@0.7.5

A delta-and-actionability layer for Playwright agents: it tells the agent what changed after an action and whether it can act on it.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 174 KB of source, external domains: github.com

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 10-67javascript

10 (e.g. deltawright checksum --update -- npx playwright test)

11 deltawright aggregate [--report|--html] <dir>

12 Read-only: rank flaky tests from triage side-cars (#55) \u2014

13 JSONL by default, --report for a ranked summary, --html for

14 a self-contained dashboard (redirect: > flakes.html)

15 deltawright --version, -v Print the installed version

16 deltawright --help, -h Show this help

18Docs: https://github.com/mstomar698/deltawright`;

19async function version() {

20 try {

21 const pkg = JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8"));

22 return pkg.version ?? "0.0.0";

23 } catch {

24 return "0.0.0";

25 }

26}

27async function main(argv) {

28 const cmd = argv[0];

29 switch (cmd) {

30 case "mcp": {

31 const { startServer } = await import(new URL("./mcp/server.js", import.meta.url).href);

32 await startServer();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L30

33 return 0;

34 }

35 case "checksum": {

36 const rest = argv.slice(1);

37 if (rest[0] !== "--update") {

38 console.error("deltawright checksum: expected --update\n\n" + USAGE);

39 return 1;

40 }

41 const sep = rest.indexOf("--");

42 const cmd2 = sep >= 0 ? rest.slice(sep + 1) : rest.slice(1);

43 if (cmd2.length === 0) {

44 console.error("usage: deltawright checksum --update -- <test command>\n");

45 console.error("e.g. deltawright checksum --update -- npx playwright test");

46 return 1;

47 }

48 const { spawnSync } = await import('child_process');

49 const res = spawnSync(cmd2[0], cmd2.slice(1), {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L44

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L47

50 stdio: "inherit",

51 env: { ...process.env, DW_UPDATE_CHECKSUMS: "1" },

52 // Windows launches npm/npx via .cmd shims, which need a shell to resolve.

53 shell: process.platform === "win32"

54 });

55 if (res.error) {

56 console.error(

57 `deltawright checksum: failed to run "${cmd2.join(" ")}": ${res.error.message}`

58 );

59 return 1;

60 }

61 return res.status ?? 1;

62 }

63 case "aggregate": {

64 const rest = argv.slice(1);

65 const html = rest.includes("--html");

66 const report = rest.includes("--report");

67 const dirs = rest.filter((a) => !a.startsWith("--"));

dist/reporter/index.jsView file

Lines 399-439javascript

399 // source diagnose() treats as authoritative from a trial probe — pass it through verbatim.

400 playwright: { actionable: false, error: errorMessage },

401 agreed: true

402 }

403 };

404 return {

405 action: "failed action",

406 nodes: [node],

Source & flagged code

4 flagged · loading source

dist/cli.jsView file

47} L48: const { spawnSync } = await import('child_process'); L49: const res = spawnSync(cmd2[0], cmd2.slice(1), {

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L47

44console.error("usage: deltawright checksum --update -- <test command>\n"); L45: console.error("e.g. deltawright checksum --update -- npx playwright test"); L46: return 1; L47: } L48: const { spawnSync } = await import('child_process'); L49: const res = spawnSync(cmd2[0], cmd2.slice(1), {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L44

30case "mcp": { L31: const { startServer } = await import(new URL("./mcp/server.js", import.meta.url).href); L32: await startServer();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L30

dist/reporter/index.jsView file

419try { L420: const text = typeof hit.body === "string" ? hit.body : hit.body.toString("utf8"); L421: const parsed = JSON.parse(text); ... L523: await testInfo.attach(DELTA_ATTACHMENT_NAME, { L524: body: JSON.stringify(delta), L525: contentType: "application/json"

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/reporter/index.jsView on unpkg · L419

Findings

2 High3 Medium6 Low

HighChild Processdist/cli.js

HighRuntime Package Installdist/cli.js

MediumDynamic Requiredist/cli.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/reporter/index.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

dist/cli.jsView file

Lines 10-67javascript

10 (e.g. deltawright checksum --update -- npx playwright test)

11 deltawright aggregate [--report|--html] <dir>

12 Read-only: rank flaky tests from triage side-cars (#55) \u2014

13 JSONL by default, --report for a ranked summary, --html for

14 a self-contained dashboard (redirect: > flakes.html)

15 deltawright --version, -v Print the installed version

16 deltawright --help, -h Show this help

18Docs: https://github.com/mstomar698/deltawright`;

19async function version() {

20 try {

21 const pkg = JSON.parse(await readFile(new URL("../package.json", import.meta.url), "utf8"));

22 return pkg.version ?? "0.0.0";

23 } catch {

24 return "0.0.0";

25 }

26}

27async function main(argv) {

28 const cmd = argv[0];

29 switch (cmd) {

30 case "mcp": {

31 const { startServer } = await import(new URL("./mcp/server.js", import.meta.url).href);

32 await startServer();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L30

33 return 0;

34 }

35 case "checksum": {

36 const rest = argv.slice(1);

37 if (rest[0] !== "--update") {

38 console.error("deltawright checksum: expected --update\n\n" + USAGE);

39 return 1;

40 }

41 const sep = rest.indexOf("--");

42 const cmd2 = sep >= 0 ? rest.slice(sep + 1) : rest.slice(1);

43 if (cmd2.length === 0) {

44 console.error("usage: deltawright checksum --update -- <test command>\n");

45 console.error("e.g. deltawright checksum --update -- npx playwright test");

46 return 1;

47 }

48 const { spawnSync } = await import('child_process');

49 const res = spawnSync(cmd2[0], cmd2.slice(1), {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L44

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L47

50 stdio: "inherit",

51 env: { ...process.env, DW_UPDATE_CHECKSUMS: "1" },

52 // Windows launches npm/npx via .cmd shims, which need a shell to resolve.

53 shell: process.platform === "win32"

54 });

55 if (res.error) {

56 console.error(

57 `deltawright checksum: failed to run "${cmd2.join(" ")}": ${res.error.message}`

58 );

59 return 1;

60 }

61 return res.status ?? 1;

62 }

63 case "aggregate": {

64 const rest = argv.slice(1);

65 const html = rest.includes("--html");

66 const report = rest.includes("--report");

67 const dirs = rest.filter((a) => !a.startsWith("--"));

dist/reporter/index.jsView file

Lines 399-439javascript

399 // source diagnose() treats as authoritative from a trial probe — pass it through verbatim.

400 playwright: { actionable: false, error: errorMessage },

401 agreed: true

402 }

403 };

404 return {

405 action: "failed action",

406 nodes: [node],