registry / forjajs / 1.1.5

forjajs@1.1.5

Forja — framework CLI-first de orquestração multiagente, memória hierárquica e geração de projetos com IA

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 171 file(s), 434 KB of source, external domains: cdn.tailwindcss.com, github.com

Source & flagged code

6 flagged

bin/forja.mjsView file

Lines 1-36javascript

1#!/usr/bin/env node

3/**

4 * bin/forja.mjs — core executivo do Forja (ADR-0020).

5 *

6 * Ponto de entrada único dos comandos de processo:

7 * forja <comando> [args]

8 *

9 * Responsabilidades transversais:

10 * 1. Roteamento via lib/core/registry.mjs (declarativo).

11 * 2. Gates antes do alvo (workspace, ADR-0019).

Source & flagged code

6 flagged · loading source

bin/forja.mjsView file

16import path from 'node:path'; L17: import { spawnSync } from 'node:child_process'; L18: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

bin/forja.mjsView on unpkg · L16

lib/core/release.mjsView file

264status: 'fail', L265: detail: `${quebrados.length} import(s) sem destino no tarball: ${quebrados.slice(0, 3).join('; ')}`, L266: fix: 'adicione o arquivo ao files[] do package.json',

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/core/release.mjsView on unpkg · L264

scripts/hook-user-prompt.mjsView file

6* - stdin: JSON com { prompt, session_id, ... } L7: * - stdout: JSON com { hookSpecificOutput: { hookEventName, additionalContext } } ou vazio L8: * ... L29: const __filename = fileURLToPath(import.meta.url); L30: const __dirname = path.dirname(__filename); L31: const root = path.resolve(__dirname, '..'); ... L52: try { L53: const cfg = JSON.parse(fs.readFileSync(path.join(root, '.memoryrc.json'), 'utf8')); L54: return cfg.hooks || {}; ... L58: function keywordTriggered(prompt) { L59: if (process.env.FRAMEWORK_HOOK_INJECT !== '1') return false; L60: if (!prompt) return false;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/hook-user-prompt.mjsView on unpkg · L6

scripts/hook-session-start.mjsView file

47package = forjajs; repositoryIdentity = forja; dependency = better-sqlite3 L47: const { getWorkspaceDbPath } = await import('../lib/workspace.mjs'); L48: const { default: Database } = await import('better-sqlite3'); L49: const db = new Database(getWorkspaceDbPath(), { readonly: true });

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

scripts/hook-session-start.mjsView on unpkg · L47

scripts/tools-doctor.mjsView file

20L21: import { spawnSync } from 'node:child_process'; L22: ... L29: role: 'Code intelligence: chamadores, blast radius, mapa de impacto (ADR-0017).', L30: install: 'npm i -g @codegraph/cli', L31: gate: 'npm run code:check / code:impact',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/tools-doctor.mjsView on unpkg · L20

scripts/pre-commit.shView file

•path = scripts/pre-commit.sh kind = build_helper sizeBytes = 4414 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pre-commit.shView on unpkg

Findings

4 High5 Medium6 Low

HighChild Processbin/forja.mjs

HighShell

HighCopied Package Dependency Bridgescripts/hook-session-start.mjs

HighRuntime Package Installscripts/tools-doctor.mjs

MediumDynamic Requirelib/core/release.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/pre-commit.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptoscripts/hook-user-prompt.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

lib/core/release.mjsView file

Lines 244-284javascript

244const importsResolve = {

245 id: 'imports-resolve',

246 title: 'imports relativos resolvem dentro do tarball',

247 severity: 'critical',

248 dependsOn: 'install',

249 probe(env) {

250 const quebrados = [];

251

252 for (const file of publishedSources(env)) {

253 for (const spec of importsOf(env, file)) {

254 if (!spec?.startsWith('.')) continue;

255 const alvo = path.resolve(path.dirname(file), spec);

256 const existe = env.fs.existsSync(alvo)

257 || ['.js', '.mjs', '.json'].some((ext) => env.fs.existsSync(alvo + ext));

258 if (!existe) quebrados.push(`${path.relative(env.pkgDir, file)} → ${spec}`);

259 }

260 }

261

262 if (quebrados.length) {

263 return {

264 status: 'fail',

265 detail: `${quebrados.length} import(s) sem destino no tarball: ${quebrados.slice(0, 3).join('; ')}`,

266 fix: 'adicione o arquivo ao files[] do package.json',

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/core/release.mjsView on unpkg · L264

267 };

268 }

269

270 return { status: 'ok', detail: 'todo import relativo resolve', fix: null };

271 },

272};

273

274/** O bug do ADR-0021 §2: importado por script publicado, mas declarado como devDependency. */

275const depsDeclared = {

276 id: 'deps-declared',

277 title: 'todo import externo está em dependencies',

278 severity: 'critical',

279 dependsOn: 'install',

280 probe(env) {

281 const pkg = JSON.parse(env.fs.readFileSync(path.join(env.pkgDir, 'package.json'), 'utf8'));

282 const deps = new Set(Object.keys(pkg.dependencies || {}));

283 const faltando = new Map();

284

scripts/hook-user-prompt.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * Hook UserPromptSubmit — injeção opcional de smart-context.

4 *

5 * Protocolo:

6 * - stdin: JSON com { prompt, session_id, ... }

7 * - stdout: JSON com { hookSpecificOutput: { hookEventName, additionalContext } } ou vazio

8 *

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/hook-user-prompt.mjsView on unpkg · L6

9 * Dois caminhos de injeção:

10 * 1. Slug de spec detectado no prompt (specs/<slug>/ existe) → injeta pack

11 * task-mode montado do filesystem (spec + plan + tasks + runbook GSD).

12 * Ligado por padrão; desligue com FRAMEWORK_HOOK_INJECT=0. A economia não

13 * depende da IA obedecer a instrução: o contexto certo chega sozinho.

14 * 2. TRIGGER_KEYWORDS genéricos → pack global (mission/standards/ADRs).

15 * Continua opt-in via FRAMEWORK_HOOK_INJECT=1.

16 *

17 * Defaults conservadores (não bloqueia, não atrasa):

18 * - Limite duro de bytes (configurável em .memoryrc.json -> hooks.userPromptCap)

19 * - Cache por hash do prompt em /tmp/framework-hook-cache/

20 * - Sem SQLite no hot path (o Context Engineer faz FTS5 quando convocado)

21 */

23import fs from 'node:fs';

24import path from 'node:path';

25import process from 'node:process';

26import crypto from 'node:crypto';

scripts/hook-session-start.mjsView file

Lines 27-67javascript

28function safeReadDir(p) { try { return fs.readdirSync(p); } catch { return []; } }

30function listSpecs() {

31 const specsDir = path.join(root, 'specs');

32 const out = [];

33 for (const slug of safeReadDir(specsDir)) {

34 if (slug.startsWith('_') || slug.startsWith('.')) continue;

35 const specPath = path.join(specsDir, slug, 'spec.md');

36 if (!fs.existsSync(specPath)) continue;

37 const c = fs.readFileSync(specPath, 'utf8');

38 const m = c.match(/-\s*\*\*Status\*\*:\s*([a-z]+)/i);

39 out.push({ slug, status: m ? m[1] : 'unknown' });

40 }

41 return out;

42}

44/** Handoffs só fazem sentido com a memória de pé — daí o `memoriaOk` do caller. */

45async function openHandoffs() {

46 try {

47 const { getWorkspaceDbPath } = await import('../lib/workspace.mjs');

48 const { default: Database } = await import('better-sqlite3');

49 const db = new Database(getWorkspaceDbPath(), { readonly: true });

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

scripts/hook-session-start.mjsView on unpkg · L47

50 const rows = db.prepare(`SELECT id, from_agent, to_agent, intent, spec_slug FROM handoffs WHERE status='open' ORDER BY id DESC LIMIT 10`).all();

51 db.close();

52 return rows;

53 } catch { return []; }

54}

56/**

57 * Nunca lança e nunca trava a sessão: o hook reporta, o `tools:doctor` é que é gate. Se a própria

58 * lib de health não carregar, seguimos com o resto do briefing em vez de abortar (ADR-0021).

59 */

60async function coreHealth() {

61 try {

62 return await runChecks({ scope: 'runtime' });

63 } catch { return []; }

64}

66(async function main() {

67 const specs = listSpecs();

scripts/tools-doctor.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * tools-doctor — raio-x do núcleo (SPEC-009) e das ferramentas de processo (ADR-0018).

4 *

5 * Duas seções, dois contratos distintos:

6 *

7 * Núcleo O que impede o framework de trabalhar. Falha crítica → exit 1.

8 * Ferramentas Binários opcionais que potencializam o harness. Ausência nunca trava.

9 *

10 * A separação é o ponto. Este comando auditava só as ferramentas — sobre as quais ele mesmo

11 * dizia "o fluxo nunca trava por elas" — e era cego para tudo que trava. Quando o better-sqlite3

12 * ficou com ABI de outra major do Node e a memória universal morreu inteira, o doctor reportou

13 * "2/5 ferramentas disponíveis" e saiu com 0.

14 *

15 * Diagnostica e prescreve; não conserta. Rodar `npm rebuild` sem consentimento é a classe de

16 * risco oposta à que este comando existe para fechar.

17 *

18 * Uso: node scripts/tools-doctor.mjs

19 */

21import { spawnSync } from 'node:child_process';

23import { runChecks, worstStatus } from '../lib/core/health.mjs';

25const TOOLS = [

26 {

27 name: 'codegraph',

28 probe: ['codegraph', ['--version']],

29 role: 'Code intelligence: chamadores, blast radius, mapa de impacto (ADR-0017).',

30 install: 'npm i -g @codegraph/cli',

31 gate: 'npm run code:check / code:impact',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/tools-doctor.mjsView on unpkg · L20

32 },

33 {

34 name: 'gitleaks',

35 probe: ['gitleaks', ['version']],

36 role: 'Varredura de segredos antes de merge/release.',

37 install: 'https://github.com/gitleaks/gitleaks (binario) ou: brew install gitleaks',

38 gate: 'gitleaks detect --no-banner (gate de Governance)',

39 },

40 {