registry / draht-codex / 2026.7.11

draht-codex@2026.7.11

Draht GSD, multi-agent, TDD and DDD workflows as a Codex plugin. Install with `npx draht-codex install`.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 307 KB of source, external domains: developers.openai.com, draht.dev, www.w3.org

Source & flagged code

4 flagged

bin/draht-tools.cjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * Draht Tools — CLI for the Get Shit Done methodology.

6 * Manages .planning/ directory structure, state tracking, and git integration.

7 */

9const fs = require("node:fs"

Source & flagged code

4 flagged · loading source

bin/draht-tools.cjsView file

10const path = require("node:path"); L11: const { execSync, execFileSync } = require("node:child_process"); L12:

High

Child Process

Package source references child process execution.

bin/draht-tools.cjsView on unpkg · L10

8L9: const fs = require("node:fs"); L10: const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/draht-tools.cjsView on unpkg · L8

cli.mjsView file

19L20: import { execSync, spawnSync } from "node:child_process"; L21: import * as fs from "node:fs"; ... L25: L26: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L27: const PACKAGE_ROOT = __dirname; ... L34: "node_modules", L35: "package.json", L36: "cli.mjs", ... L103: L104: Docs: https://draht.dev L105: `);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.mjsView on unpkg · L19

scripts/gsd-quality-gate.cjsView file

14L15: const { execSync } = require("node:child_process"); L16: const fs = require("node:fs"); ... L21: if (fs.existsSync(path.join(cwd, "bun.lockb")) || fs.existsSync(path.join(cwd, "bun.lock"))) { L22: return { pm: "bun", testCmd: "bun test", coverageCmd: "bun test --coverage", lintCmd: "bunx biome check ." }; L23: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/gsd-quality-gate.cjsView on unpkg · L14

Findings

4 High3 Medium5 Low

HighChild Processbin/draht-tools.cjs

HighShell

HighSandbox Evasion Gated Capabilitycli.mjs

HighRuntime Package Installscripts/gsd-quality-gate.cjs

MediumDynamic Requirebin/draht-tools.cjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

cli.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2/**

3 * draht-codex CLI: installs this package as a Codex plugin via a local marketplace.

4 *

5 * Architecture:

6 * 1. Copy plugin files into ~/.draht/codex-marketplace/plugins/draht/

7 * 2. Write .agents/plugins/marketplace.json for Codex

8 * 3. Shell out to `codex plugin marketplace add` and `codex plugin add`

9 * 4. Codex tracks the plugin in its own cache and config

10 *

11 * Usage:

12 * npx draht-codex install [--path <dir>] [--force]

13 * npx draht-codex uninstall [--path <dir>]

14 * npx draht-codex update [--path <dir>]

15 * npx draht-codex status [--path <dir>]

16 * npx draht-codex draht-tools <subcommand> [...args]

17 * npx draht-codex --help

18 */

20import { execSync, spawnSync } from "node:child_process";

21import * as fs from "node:fs";

22import * as os from "node:os";

23import * as path from "node:path";

24import { fileURLToPath } from "node:url";

26const __dirname = path.dirname(fileURLToPath(import.meta.url));

27const PACKAGE_ROOT = __dirname;

29const MARKETPLACE_NAME = "draht";

30const PLUGIN_NAME = "draht";

31const DEFAULT_MARKETPLACE_DIR = path.join(os.homedir(), ".draht", "codex-marketplace");

33const IGNORE = new Set([

34 "node_modules",

35 "package.json",

36 "cli.mjs",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.mjsView on unpkg · L19

37 ".npmignore",

38 ".DS_Store",

39 "CHANGELOG.md",

scripts/gsd-quality-gate.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * Draht Quality Gate Hook

6 * Runs after task completion to enforce quality standards.

7 * Called by the build agent after each verify step.

8 *

9 * Usage: node gsd-quality-gate.js [--strict] [--no-tests]

10 * --no-tests skips the test-suite run (used by the Stop hook, where the

11 * post-task hook and /verify-work own test execution).

12 * Exit 0 = quality OK, Exit 1 = quality issues

13 */

15const { execSync } = require("node:child_process");

16const fs = require("node:fs");

17const path = require("node:path");

19// ── Toolchain detection — mirrors src/gsd/hook-utils.ts ──────────────────────

20function detectToolchain(cwd) {

21 if (fs.existsSync(path.join(cwd, "bun.lockb")) || fs.existsSync(path.join(cwd, "bun.lock"))) {

22 return { pm: "bun", testCmd: "bun test", coverageCmd: "bun test --coverage", lintCmd: "bunx biome check ." };

23 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/gsd-quality-gate.cjsView on unpkg · L14

24 if (fs.existsSync(path.join(cwd, "pnpm-lock.yaml"))) {

25 return { pm: "pnpm", testCmd: "pnpm test", coverageCmd: "pnpm run test:coverage", lintCmd: "pnpm run lint" };

26 }

27 if (fs.existsSync(path.join(cwd, "yarn.lock"))) {

28 return { pm: "yarn", testCmd: "yarn test", coverageCmd: "yarn run test:coverage", lintCmd: "yarn run lint" };

29 }

30 return { pm: "npm", testCmd: "npm test", coverageCmd: "npm run test:coverage", lintCmd: "npm run lint" };

31}

33function readHookConfig(cwd) {

34 // Strict by default: failing tests/types/lint fail the gate (exit 1).