registry / forge-harness / 0.1.0-rc17

forge-harness@0.1.0-rc17

Spec-Driven Development harness: single source of truth in .forge/, multi-agent adapters (Claude/Codex/Cursor/Gemini/…), native code graph and deterministic validators. Zero runtime deps.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 31.4 KB of source

Source & flagged code

3 flagged

bin/forge.mjsView file

Lines 168-208javascript

168 const walk = (d) => {

169 let es; try { es = readdirSync(d, { withFileTypes: true }); } catch { return; }

170 for (const e of es) {

171 const p = join(d, e.name);

172 if (e.isDirectory()) walk(p);

173 else if (e.name.endsWith('.md') && !except.includes(e.name)) n++;

174 }

175 };

176 walk(dir);

177 return n;

178 };

179 const specsActive = subdirs(join(forge, 'specs', 'active'));

180 const specsArchived = subdirs(join(forge, 'specs', 'archived'));

181 const productDocs = countMdExcept(join(forge, 'product'), ['CHANGELOG.md']); // template ships only CHANGELOG.md

182 return { specsActive, specsArchived, productDocs, total: specsActive + specsArchived + productDocs };

183}

184

185// Materializa o plugin Claude Code "forge" a partir dos comandos canônicos do pacote

186// (template/.forge/commands), via a MESMA lib que o harness usa (plugin-build.mjs). Global.

187async function installPlugin(out) {

188 const lib = join(TEMPLATE_FORGE, 'scripts', 'lib', 'plugin-build.mjs');

189 const { collectCommands, planForgePlugin, writePlugin } = await import(pathToFileURL(lib).href);

190 const dest = out || join(homedir(), '.claude', 'skills', 'forge');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/forge.mjsView on unpkg · L188

191 const version = pkgVersion();

192 const files = planForgePlugin({ commands: collectCommands(join(TEMPLATE_FORGE, 'commands')), version });

193 writePlugin(dest, files);

194 return { dest, version, count: files.length - 1 };

195}

196

197// Diretórios de MAQUINARIA — substituíveis pelo template novo (overlay aditivo). Nenhum carrega

198// placeholder <PROJECT_*> (verificado). Fora desta lista, tudo é dado do projeto e é preservado:

199// specs/ product/ custom/ evals/ graph/ worktrees/ runners.yaml FORGE.md constitution.md context.md.

200const MACHINERY_DIRS = ['agents', 'commands', 'contracts', 'hooks', 'schemas', 'scripts', 'skills', 'templates', 'rules'];

201

202// Recolhe os arquivos que o overlay tocaria (maquinaria), como pares [rel, srcAbs].

203function machineryFiles(src) {

204 const out = [];

205 for (const d of MACHINERY_DIRS) {

206 const base = join(src, d);

207 if (!existsSync(base)) continue;

208 for (const f of walk(base)) {

template/.forge/hooks/pre-tool-use/check-language-policy.shView file

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = payload_in_excluded_dir sizeBytes = 2120 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = build_helper sizeBytes = 2120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

Source & flagged code

3 flagged · loading source

bin/forge.mjsView file

188const lib = join(TEMPLATE_FORGE, 'scripts', 'lib', 'plugin-build.mjs'); L189: const { collectCommands, planForgePlugin, writePlugin } = await import(pathToFileURL(lib).href); L190: const dest = out || join(homedir(), '.claude', 'skills', 'forge');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/forge.mjsView on unpkg · L188

template/.forge/hooks/pre-tool-use/check-language-policy.shView file

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = payload_in_excluded_dir sizeBytes = 2120 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = build_helper sizeBytes = 2120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

Findings

1 High3 Medium3 Low

HighPayload In Excluded Dirtemplate/.forge/hooks/pre-tool-use/check-language-policy.sh

MediumDynamic Requirebin/forge.mjs

MediumShips Build Helpertemplate/.forge/hooks/pre-tool-use/check-language-policy.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

bin/forge.mjsView file

Lines 168-208javascript

168 const walk = (d) => {

169 let es; try { es = readdirSync(d, { withFileTypes: true }); } catch { return; }

170 for (const e of es) {

171 const p = join(d, e.name);

172 if (e.isDirectory()) walk(p);

173 else if (e.name.endsWith('.md') && !except.includes(e.name)) n++;

174 }

175 };

176 walk(dir);

177 return n;

178 };

179 const specsActive = subdirs(join(forge, 'specs', 'active'));

180 const specsArchived = subdirs(join(forge, 'specs', 'archived'));

181 const productDocs = countMdExcept(join(forge, 'product'), ['CHANGELOG.md']); // template ships only CHANGELOG.md

182 return { specsActive, specsArchived, productDocs, total: specsActive + specsArchived + productDocs };

183}

184

185// Materializa o plugin Claude Code "forge" a partir dos comandos canônicos do pacote

186// (template/.forge/commands), via a MESMA lib que o harness usa (plugin-build.mjs). Global.

187async function installPlugin(out) {

188 const lib = join(TEMPLATE_FORGE, 'scripts', 'lib', 'plugin-build.mjs');

189 const { collectCommands, planForgePlugin, writePlugin } = await import(pathToFileURL(lib).href);

190 const dest = out || join(homedir(), '.claude', 'skills', 'forge');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/forge.mjsView on unpkg · L188

191 const version = pkgVersion();

192 const files = planForgePlugin({ commands: collectCommands(join(TEMPLATE_FORGE, 'commands')), version });

193 writePlugin(dest, files);

194 return { dest, version, count: files.length - 1 };

195}

196

197// Diretórios de MAQUINARIA — substituíveis pelo template novo (overlay aditivo). Nenhum carrega

198// placeholder <PROJECT_*> (verificado). Fora desta lista, tudo é dado do projeto e é preservado:

199// specs/ product/ custom/ evals/ graph/ worktrees/ runners.yaml FORGE.md constitution.md context.md.

200const MACHINERY_DIRS = ['agents', 'commands', 'contracts', 'hooks', 'schemas', 'scripts', 'skills', 'templates', 'rules'];

201

202// Recolhe os arquivos que o overlay tocaria (maquinaria), como pares [rel, srcAbs].

203function machineryFiles(src) {

204 const out = [];

205 for (const d of MACHINERY_DIRS) {

206 const base = join(src, d);

207 if (!existsSync(base)) continue;

208 for (const f of walk(base)) {

template/.forge/hooks/pre-tool-use/check-language-policy.shView file

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = payload_in_excluded_dir sizeBytes = 2120 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = build_helper sizeBytes = 2120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg