registry / gentle-pi / 1.0.1

gentle-pi@1.0.1

Turn Pi into el Gentleman: a senior-architect development harness with SDD/OpenSpec, subagents, strict TDD evidence, review guardrails, and skill discovery.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 78 file(s), 1.10 MB of source, external domains: github.com

Source & flagged code

2 flagged

tests/review-bundle.test.tsView file

Lines 34-74typescript

34 lineageId,

35 mode: REVIEW_MODE.ORDINARY,

36 snapshot: testSnapshot({ baseTree: "1".repeat(40), completeTree: "2".repeat(40), route: REVIEW_ROUTE.STANDARD, lenses: [REVIEW_LENS.RELIABILITY] }),

37 evidenceHash: "a".repeat(64),

38 budget: { review_batches: 1, review_actors: 1, refuter_batches: 1, fix_batches: 1, validator_runs: 1, final_verifications: 1, judgment_rounds: 0, judge_runs: 0 },

39 }), "start");

40 store.runReducerOperation({ lineageId, transition: "ordinary-discovery", idempotencyKey: "freeze", input: { rows: [] } });

41}

43test("bundle export is deterministic and compatible import installs its exact graph closure atomically", (t) => {

44 const { parent, source, target } = repository(t);

45 createLineage(source);

46 const first = join(parent, "first.review-bundle");

47 const second = join(parent, "second.review-bundle");

48 const exporter = new ReviewBundleExporter(source);

49 const exported = exporter.export({ outputPath: first, operationId: "export-one" });

50 exporter.export({ outputPath: second, operationId: "export-two" });

51 assert.deepEqual(readFileSync(first), readFileSync(second));

52 assert.equal(exported.roots[0]?.lineage_id, "bundle-lineage");

54 const importer = new ReviewBundleImporter(target, { mutationLockPlatform: qualifiedReviewLockPlatform() });

55 const imported = importer.import({ inputPath: first, operationId: "import-one", acknowledgeUntrustedBundleSource: true });

56 assert.equal(imported.imported, true);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/review-bundle.test.tsView on unpkg · L54

57 assert.equal(ReviewTransactionStore.forRepository(target).read("bundle-lineage").lineage_id, "bundle-lineage");

58 assert.equal(importer.import({ inputPath: first, operationId: "import-two" }).imported, false);

59});

61// RISK2-001 (openspec/changes/bounded-review-graph-parity/reviews/post-apply-4r-round2-ledger.md):

62// repository_identity/root_commit_ids match alone cannot prove a bundle's lineage content was

63// ever produced by a legitimate export from THIS repository's own history — anyone who knows the

64// (often public) root commit can forge a structurally valid bundle claiming the same identity.

65// These tests exercise the resulting trust gate.

66test("bundle import denies adopting a brand-new lineage without an explicit untrusted-source acknowledgement", (t) => {

67 const { parent, source, target } = repository(t);

68 createLineage(source);

69 const bundle = join(parent, "transfer.review-bundle");

70 new ReviewBundleExporter(source).export({ outputPath: bundle, operationId: "export" });

71 assert.throws(

72 () => new ReviewBundleImporter(target, { mutationLockPlatform: qualifiedReviewLockPlatform() }).import({ inputPath: bundle, operationId: "no-acknowledgement" }),

73 /REVIEW_BUNDLE_UNTRUSTED_SOURCE/,

74 );

extensions/skill-registry.tsView file

Lines 34-74typescript

34interface SkillRegistryExtensionGlobal {

35 [SKILL_REGISTRY_EXTENSION_SOURCE_KEY]?: string;

36}

38async function pathExists(path: string): Promise<boolean> {

Source & flagged code

2 flagged · loading source

tests/review-bundle.test.tsView file

54const importer = new ReviewBundleImporter(target, { mutationLockPlatform: qualifiedReviewLockPlatform() }); L55: const imported = importer.import({ inputPath: first, operationId: "import-one", [redacted]: true }); L56: assert.equal(imported.imported, true);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/review-bundle.test.tsView on unpkg · L54

extensions/skill-registry.tsView file

54function userSkillDirs(): string[] { L55: const home = homedir(); L56: return [ ... L127: L128: function parseFrontmatter(source: string): { name?: string; description?: string; body: string } { L129: const normalized = source.replace(/\r\n?/g, "\n"); ... L384: try { L385: const parsed: unknown = JSON.parse(await readFile(cachePath, "utf8")); L386: cached = isCacheFile(parsed) ? parsed.fingerprint : undefined; ... L427: argv = process.argv.slice(2), L428: env = process.env, L429: ): boolean {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

extensions/skill-registry.tsView on unpkg · L54

Findings

3 Medium5 Low

MediumDynamic Requiretests/review-bundle.test.ts

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowWeak Cryptoextensions/skill-registry.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

tests/review-bundle.test.tsView file

Lines 34-74typescript

34 lineageId,

35 mode: REVIEW_MODE.ORDINARY,

36 snapshot: testSnapshot({ baseTree: "1".repeat(40), completeTree: "2".repeat(40), route: REVIEW_ROUTE.STANDARD, lenses: [REVIEW_LENS.RELIABILITY] }),

37 evidenceHash: "a".repeat(64),

38 budget: { review_batches: 1, review_actors: 1, refuter_batches: 1, fix_batches: 1, validator_runs: 1, final_verifications: 1, judgment_rounds: 0, judge_runs: 0 },

39 }), "start");

40 store.runReducerOperation({ lineageId, transition: "ordinary-discovery", idempotencyKey: "freeze", input: { rows: [] } });

41}

43test("bundle export is deterministic and compatible import installs its exact graph closure atomically", (t) => {

44 const { parent, source, target } = repository(t);

45 createLineage(source);

46 const first = join(parent, "first.review-bundle");

47 const second = join(parent, "second.review-bundle");

48 const exporter = new ReviewBundleExporter(source);

49 const exported = exporter.export({ outputPath: first, operationId: "export-one" });

50 exporter.export({ outputPath: second, operationId: "export-two" });

51 assert.deepEqual(readFileSync(first), readFileSync(second));

52 assert.equal(exported.roots[0]?.lineage_id, "bundle-lineage");

54 const importer = new ReviewBundleImporter(target, { mutationLockPlatform: qualifiedReviewLockPlatform() });

55 const imported = importer.import({ inputPath: first, operationId: "import-one", acknowledgeUntrustedBundleSource: true });

56 assert.equal(imported.imported, true);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/review-bundle.test.tsView on unpkg · L54

57 assert.equal(ReviewTransactionStore.forRepository(target).read("bundle-lineage").lineage_id, "bundle-lineage");

58 assert.equal(importer.import({ inputPath: first, operationId: "import-two" }).imported, false);

59});

61// RISK2-001 (openspec/changes/bounded-review-graph-parity/reviews/post-apply-4r-round2-ledger.md):

62// repository_identity/root_commit_ids match alone cannot prove a bundle's lineage content was

63// ever produced by a legitimate export from THIS repository's own history — anyone who knows the

64// (often public) root commit can forge a structurally valid bundle claiming the same identity.

65// These tests exercise the resulting trust gate.

66test("bundle import denies adopting a brand-new lineage without an explicit untrusted-source acknowledgement", (t) => {

67 const { parent, source, target } = repository(t);

68 createLineage(source);

69 const bundle = join(parent, "transfer.review-bundle");

70 new ReviewBundleExporter(source).export({ outputPath: bundle, operationId: "export" });

71 assert.throws(

72 () => new ReviewBundleImporter(target, { mutationLockPlatform: qualifiedReviewLockPlatform() }).import({ inputPath: bundle, operationId: "no-acknowledgement" }),

73 /REVIEW_BUNDLE_UNTRUSTED_SOURCE/,

74 );

extensions/skill-registry.tsView file

Lines 34-74typescript

34interface SkillRegistryExtensionGlobal {

35 [SKILL_REGISTRY_EXTENSION_SOURCE_KEY]?: string;

36}

38async function pathExists(path: string): Promise<boolean> {