registry / forge-harness / 0.1.0-rc11

forge-harness@0.1.0-rc11

Spec-Driven Development harness: single source of truth in .forge/, multi-agent adapters (Claude/Codex/Cursor/Gemini/…), native code graph and deterministic validators. Zero runtime deps.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 25.1 KB of source

Source & flagged code

3 flagged

bin/forge.mjsView file

Lines 144-184javascript

144 const walk = (d) => {

145 let es; try { es = readdirSync(d, { withFileTypes: true }); } catch { return; }

146 for (const e of es) {

147 const p = join(d, e.name);

148 if (e.isDirectory()) walk(p);

149 else if (e.name.endsWith('.md') && !except.includes(e.name)) n++;

150 }

151 };

152 walk(dir);

153 return n;

154 };

155 const specsActive = subdirs(join(forge, 'specs', 'active'));

156 const specsArchived = subdirs(join(forge, 'specs', 'archived'));

157 const productDocs = countMdExcept(join(forge, 'product'), ['CHANGELOG.md']); // template ships only CHANGELOG.md

158 return { specsActive, specsArchived, productDocs, total: specsActive + specsArchived + productDocs };

159}

160

161// Materializa o plugin Claude Code "forge" a partir dos comandos canônicos do pacote

162// (template/.forge/commands), via a MESMA lib que o harness usa (plugin-build.mjs). Global.

163async function installPlugin(out) {

164 const lib = join(TEMPLATE_FORGE, 'scripts', 'lib', 'plugin-build.mjs');

165 const { collectCommands, planForgePlugin, writePlugin } = await import(pathToFileURL(lib).href);

166 const dest = out || join(homedir(), '.claude', 'skills', 'forge');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/forge.mjsView on unpkg · L164

167 const version = pkgVersion();

168 const files = planForgePlugin({ commands: collectCommands(join(TEMPLATE_FORGE, 'commands')), version });

169 writePlugin(dest, files);

170 return { dest, version, count: files.length - 1 };

171}

172

173// Diretórios de MAQUINARIA — substituíveis pelo template novo (overlay aditivo). Nenhum carrega

174// placeholder <PROJECT_*> (verificado). Fora desta lista, tudo é dado do projeto e é preservado:

175// specs/ product/ custom/ evals/ graph/ worktrees/ runners.yaml FORGE.md constitution.md context.md.

176const MACHINERY_DIRS = ['agents', 'commands', 'contracts', 'hooks', 'schemas', 'scripts', 'skills', 'templates', 'rules'];

177

178// Recolhe os arquivos que o overlay tocaria (maquinaria), como pares [rel, srcAbs].

179function machineryFiles(src) {

180 const out = [];

181 for (const d of MACHINERY_DIRS) {

182 const base = join(src, d);

183 if (!existsSync(base)) continue;

184 for (const f of walk(base)) {

template/.forge/hooks/pre-tool-use/check-language-policy.shView file

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = payload_in_excluded_dir sizeBytes = 2120 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = build_helper sizeBytes = 2120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

Source & flagged code

3 flagged · loading source

bin/forge.mjsView file

164const lib = join(TEMPLATE_FORGE, 'scripts', 'lib', 'plugin-build.mjs'); L165: const { collectCommands, planForgePlugin, writePlugin } = await import(pathToFileURL(lib).href); L166: const dest = out || join(homedir(), '.claude', 'skills', 'forge');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/forge.mjsView on unpkg · L164

template/.forge/hooks/pre-tool-use/check-language-policy.shView file

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = payload_in_excluded_dir sizeBytes = 2120 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = build_helper sizeBytes = 2120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

Findings

1 High3 Medium3 Low

HighPayload In Excluded Dirtemplate/.forge/hooks/pre-tool-use/check-language-policy.sh

MediumDynamic Requirebin/forge.mjs

MediumShips Build Helpertemplate/.forge/hooks/pre-tool-use/check-language-policy.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

bin/forge.mjsView file

Lines 144-184javascript

144 const walk = (d) => {

145 let es; try { es = readdirSync(d, { withFileTypes: true }); } catch { return; }

146 for (const e of es) {

147 const p = join(d, e.name);

148 if (e.isDirectory()) walk(p);

149 else if (e.name.endsWith('.md') && !except.includes(e.name)) n++;

150 }

151 };

152 walk(dir);

153 return n;

154 };

155 const specsActive = subdirs(join(forge, 'specs', 'active'));

156 const specsArchived = subdirs(join(forge, 'specs', 'archived'));

157 const productDocs = countMdExcept(join(forge, 'product'), ['CHANGELOG.md']); // template ships only CHANGELOG.md

158 return { specsActive, specsArchived, productDocs, total: specsActive + specsArchived + productDocs };

159}

160

161// Materializa o plugin Claude Code "forge" a partir dos comandos canônicos do pacote

162// (template/.forge/commands), via a MESMA lib que o harness usa (plugin-build.mjs). Global.

163async function installPlugin(out) {

164 const lib = join(TEMPLATE_FORGE, 'scripts', 'lib', 'plugin-build.mjs');

165 const { collectCommands, planForgePlugin, writePlugin } = await import(pathToFileURL(lib).href);

166 const dest = out || join(homedir(), '.claude', 'skills', 'forge');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/forge.mjsView on unpkg · L164

167 const version = pkgVersion();

168 const files = planForgePlugin({ commands: collectCommands(join(TEMPLATE_FORGE, 'commands')), version });

169 writePlugin(dest, files);

170 return { dest, version, count: files.length - 1 };

171}

172

173// Diretórios de MAQUINARIA — substituíveis pelo template novo (overlay aditivo). Nenhum carrega

174// placeholder <PROJECT_*> (verificado). Fora desta lista, tudo é dado do projeto e é preservado:

175// specs/ product/ custom/ evals/ graph/ worktrees/ runners.yaml FORGE.md constitution.md context.md.

176const MACHINERY_DIRS = ['agents', 'commands', 'contracts', 'hooks', 'schemas', 'scripts', 'skills', 'templates', 'rules'];

177

178// Recolhe os arquivos que o overlay tocaria (maquinaria), como pares [rel, srcAbs].

179function machineryFiles(src) {

180 const out = [];

181 for (const d of MACHINERY_DIRS) {

182 const base = join(src, d);

183 if (!existsSync(base)) continue;

184 for (const f of walk(base)) {

template/.forge/hooks/pre-tool-use/check-language-policy.shView file

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = payload_in_excluded_dir sizeBytes = 2120 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg

•path = template/.forge/hooks/pre-tool-use/check-language-policy.sh kind = build_helper sizeBytes = 2120 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

template/.forge/hooks/pre-tool-use/check-language-policy.shView on unpkg