registry / glissa / 0.17.0

glissa@0.17.0

Spawn and manage Claude Code sessions with a browser dashboard: a Windows terminal manager with real-time xterm.js streaming

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 1.04 MB of source, external domains: 127.0.0.1, github.com, registry.npmjs.org

Source & flagged code

3 flagged

package.jsonView file

Lines 50-89json

50 "homepage": "https://github.com/johncwaters/glissa#readme",

51 "bugs": {

52 "url": "https://github.com/johncwaters/glissa/issues"

53 },

54 "keywords": [

55 "claude",

56 "claude-code",

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall-path-check.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

session/sessions.jsView file

49// L50: // gitOut resolves stdout on success AND on a non-zero exit (git diff prints to stdout L51: // even when it exits non-zero), mirroring the old getDiff helper that returned ... L56: return new Promise((resolve) => { L57: execFile("git", args, opts, (_err, stdout) => resolve(stdout != null ? String(stdout) : "")); L58: }); ... L861: // The integration branch this session forks from / merges into. Public read accessor so the backend L862: // can group sessions for the shared integration-ref watcher without reaching into the private field. L863: get integrationBranch() { ... L972: }); L973: this.write(`\x1b[200~${prompt}\x1b[201~`); L974: return { ok: true };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

session/sessions.jsView on unpkg · L49

dist/audio/Coins_jingle_(4).wav.oggView file

•path = dist/audio/Coins_jingle_(4).wav.ogg kind = high_entropy_blob sizeBytes = 7312 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/audio/Coins_jingle_(4).wav.oggView on unpkg

Findings

2 High3 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighShips High Entropy Blobdist/audio/Coins_jingle_(4).wav.ogg

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosession/sessions.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

session/sessions.jsView file

Lines 29-69javascript

29const { decideSignatureDemotion, decideDiffSelfHeal } = require("./core/merge-gate");

30const agentTracker = require("./core/agent-tracker");

31const wakeupTracker = require("./core/wakeup-tracker");

33const KILL_POLL_INTERVAL_MS = 200;

34const KILL_MAX_WAIT_MS = 3000;

35const SLEEP_KILL_TIMEOUT_MS = 15 * 60 * 1000;

37// Trailing debounce for the worktree-change funnel: a single `git commit` touches

38// several gitdir files and a turn-end can race the fs.watch, so collapse a burst

39// into one signature recompute. The triggers are all event-driven (no poll): the per-worktree gitdir

40// fs.watch, the turn-end hook, and the backend's integration-ref watcher fan-out.

41const WORKTREE_CHECK_DEBOUNCE_MS = 400;

43// Async git. The review-gate probes (signature, diff) run on hot, recurring paths

44// (every turn-end, every gitdir fs.watch nudge, and the backend's integration-ref

45// watcher fan-out). The synchronous execFileSync they used to call BLOCKS the single Node

46// event loop for the whole subprocess - on a slower machine, with several sessions,

47// that stalls every session's PTY streaming and keystroke handling at once. execFile

48// runs git in a child process while the loop keeps pumping that I/O.

49//

50// gitOut resolves stdout on success AND on a non-zero exit (git diff prints to stdout

51// even when it exits non-zero), mirroring the old getDiff helper that returned

52// e.stdout from its catch. gitStrict rejects on a non-zero exit / spawn error so a

53// caller's try/catch can treat an unreadable worktree as UNKNOWN, mirroring the old

54// signature helper whose throw was caught into a null signature.

55function gitOut(args, opts) {

56 return new Promise((resolve) => {

57 execFile("git", args, opts, (_err, stdout) => resolve(stdout != null ? String(stdout) : ""));

58 });

Low

Weak Crypto

Package source references weak cryptographic algorithms.

session/sessions.jsView on unpkg · L49

59}

60function gitStrict(args, opts) {

61 return new Promise((resolve, reject) => {

62 execFile("git", args, opts, (err, stdout) => (err ? reject(err) : resolve(stdout != null ? String(stdout) : "")));

63 });

64}

66// ---------------------------------------------------------------------------

67// State machine. Status is driven by structural signals from StatusSource

68// (Claude Code hooks = authoritative; OSC-0 title = degraded fallback), mapped

69// to transitions in _onStatus per the signal x state matrix. There is NO