registry / groundwork-method / 0.13.0

groundwork-method@0.13.0

An installable delivery system for AI-driven software development: facilitated discovery to canonical docs, generators to a booted monorepo, and a contract-gated bet delivery loop.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 111 file(s), 671 KB of source, external domains: 10.0.0.5, attacker.example, core.test, docs.astral.sh, example.com, golangci-lint.run

Source & flagged code

5 flagged

bin/groundwork.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3const fs = require('fs');

4const path = require('path');

5const crypto = require('crypto');

6const readline = require('readline');

7const { execSync, execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

bin/groundwork.jsView on unpkg · L6

9const command = process.argv[2];

10const PKG = require(path.join(__dirname, '..', 'package.json'));

12// ─── Output helpers ─────────────────────────────────────────────────────────

14const c = {

15 ok: (msg) => console.log(`\x1b[32m✔\x1b[0m ${msg}`),

16 warn: (msg) => console.warn(`\x1b[33m[warn]\x1b[0m ${msg}`),

17 err: (msg) => console.error(`\x1b[31m✖\x1b[0m ${msg}`),

18 info: (msg) => console.log(`\x1b[34m[info]\x1b[0m ${msg}`),

19 dim: (msg) => console.log(`\x1b[2m${msg}\x1b[0m`),

20};

22function banner() {

23 console.log(`\n\x1b[1m\x1b[36m▲ GroundWork\x1b[0m\n`);

24}

26function printHelp() {

src/generators/workspace-dev-cli/cli-src/src/util/proc.tsView file

Lines 9-49typescript

10/** Run a command synchronously, inheriting stdio (for user-visible subprocesses

11 * like `docker compose up`). Returns the exit status. */

12export function run(cmd: string, args: string[], opts: SpawnSyncOptions = {}): number {

migrations/_template/cli-migration.jsView file

Lines 1-26javascript

1// gw-<id> — <one-line imperative title>

2//

3// <Why this migration exists: what init does now that update never did, or what

4// shape moved. Mechanical only — see migrations/README.md if this needs judgment.>

5//

6// Contract (migrations/README.md): forward-only, idempotent, detect-first.

7// detect() MUST be read-only — `update --dry-run` calls it. Use only Node built-ins;

8// never import from bin/. ctx = { targetDir, packageRoot }.

10const fs = require

dist/src/generators/nextjs-app/generator.jsView file

Lines 264-294javascript

264 // Conditionally remove auth files

265 if (options.auth !== 'clerk') {

266 tree.delete(`${projectRoot}/app/(auth)`);

267 tree.delete(`${projectRoot}/proxy.ts`);

268 tree.delete(`${projectRoot}/proxy.test.ts`

lib/repo-map/grammars/tree-sitter-go.wasmView file

•path = lib/repo-map/grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 218901 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/repo-map/grammars/tree-sitter-go.wasmView on unpkg

Source & flagged code

5 flagged · loading source

bin/groundwork.jsView file

6const readline = require('readline'); L7: const { execSync, execFileSync } = require('child_process'); L8:

High

Child Process

Package source references child process execution.

bin/groundwork.jsView on unpkg · L6

src/generators/workspace-dev-cli/cli-src/src/util/proc.tsView file

29export function sh(command: string, opts: SpawnSyncOptions = {}): RunResult { L30: const r = spawnSync(command, { shell: true, encoding: 'utf8', ...opts }); L31: return {

High

Shell

Package source references shell execution.

src/generators/workspace-dev-cli/cli-src/src/util/proc.tsView on unpkg · L29

migrations/_template/cli-migration.jsView file

9L10: const fs = require('fs'); L11: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

migrations/_template/cli-migration.jsView on unpkg · L9

dist/src/generators/nextjs-app/generator.jsView file

284return () => { L285: const { execSync } = require('child_process'); L286: try { ... L289: catch (e) { L290: console.warn(`Failed to run pnpm install in ${projectRoot}. Run it manually.`); L291: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/src/generators/nextjs-app/generator.jsView on unpkg · L284

lib/repo-map/grammars/tree-sitter-go.wasmView file

•path = lib/repo-map/grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 218901 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/repo-map/grammars/tree-sitter-go.wasmView on unpkg

Findings

3 High5 Medium5 Low

HighChild Processbin/groundwork.js

HighShellsrc/generators/workspace-dev-cli/cli-src/src/util/proc.ts

HighRuntime Package Installdist/src/generators/nextjs-app/generator.js

MediumDynamic Requiremigrations/_template/cli-migration.js

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Modulelib/repo-map/grammars/tree-sitter-go.wasm

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

bin/groundwork.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3const fs = require('fs');

4const path = require('path');

5const crypto = require('crypto');

6const readline = require('readline');

7const { execSync, execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

bin/groundwork.jsView on unpkg · L6

9const command = process.argv[2];

10const PKG = require(path.join(__dirname, '..', 'package.json'));

14const c = {

15 ok: (msg) => console.log(`\x1b[32m✔\x1b[0m ${msg}`),

16 warn: (msg) => console.warn(`\x1b[33m[warn]\x1b[0m ${msg}`),

17 err: (msg) => console.error(`\x1b[31m✖\x1b[0m ${msg}`),

18 info: (msg) => console.log(`\x1b[34m[info]\x1b[0m ${msg}`),

19 dim: (msg) => console.log(`\x1b[2m${msg}\x1b[0m`),

20};

22function banner() {

23 console.log(`\n\x1b[1m\x1b[36m▲ GroundWork\x1b[0m\n`);

24}

26function printHelp() {

src/generators/workspace-dev-cli/cli-src/src/util/proc.tsView file

Lines 9-49typescript

10/** Run a command synchronously, inheriting stdio (for user-visible subprocesses

11 * like `docker compose up`). Returns the exit status. */

12export function run(cmd: string, args: string[], opts: SpawnSyncOptions = {}): number {

migrations/_template/cli-migration.jsView file

Lines 1-26javascript

1// gw-<id> — <one-line imperative title>

2//

3// <Why this migration exists: what init does now that update never did, or what

4// shape moved. Mechanical only — see migrations/README.md if this needs judgment.>

5//

6// Contract (migrations/README.md): forward-only, idempotent, detect-first.

7// detect() MUST be read-only — `update --dry-run` calls it. Use only Node built-ins;

8// never import from bin/. ctx = { targetDir, packageRoot }.

10const fs = require

dist/src/generators/nextjs-app/generator.jsView file

Lines 264-294javascript

264 // Conditionally remove auth files

265 if (options.auth !== 'clerk') {

266 tree.delete(`${projectRoot}/app/(auth)`);

267 tree.delete(`${projectRoot}/proxy.ts`);

268 tree.delete(`${projectRoot}/proxy.test.ts`

lib/repo-map/grammars/tree-sitter-go.wasmView file

•path = lib/repo-map/grammars/tree-sitter-go.wasm kind = wasm_module sizeBytes = 218901 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

lib/repo-map/grammars/tree-sitter-go.wasmView on unpkg