registry / kanbento / 0.2.0

kanbento@0.2.0

A file-based kanban board for coordinating work across agent sessions and repos.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 25 file(s), 354 KB of source, external domains: www.apple.com

Source & flagged code

2 flagged

src/cli.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import { Command } from 'commander';

3import { join, resolve, basename, dirname } from 'node:path';

4import { fileURLToPath, pathToFileURL } from 'node:url';

5import { existsSync, statSync, readdirSync, readFileSync, appendFileSync } from 'node:fs';

6import { mkdir, writeFile, copyFile, readFile } from 'node:fs/promises';

7import { createHash, randomUUID } from 'node:crypto';

8import { openBoard } from './kernel.js';

9import { FileLog } from './eventlog.js';

10import { resolveBoardDir, resolveInitTarget, manifestPathIn, dataDirIn, hasManifest, repoRoot, registerBoard, gitObserver, gitIdentity, homeConfig } from './boards.js';

11import { compile, diffCompiled, isEmptyChangeset, reconcileMoves } from './compile.js';

12import { indexRecords, indexDocs } from './binding.js';

13import { forwardEdges, collectBacklinks, neighborhood, parseCurie, refEdges, collectFrontier, stageProcedurePath, stageAgreementPath, presentIncoming } from './refs.js';

14import { parseAgreement } from './agreement.js';

15import { lintRecords } from './lint.js';

16import { renderMap, renderMapIndex, renderFootprints, renderCuration, recordFootprints } from './map.js';

17import { writeFrontmatterBlock, writeFrontmatterField } from './frontmatter.js';

18import { execFileSync, spawn } from 'node:child_process';

19import { execCommand } from './hooks.js';

20import { materialize, materializeNetwork, renderNetwork, renderBoard, renderPortfolio, writeProjection, handle } from './projection.js';

21import { slugify } from './slug.js';

22import { resolveBody, editFile } from './input.js';

23import { renderAgents } from './agents.js';

24import { EVOLVING_MD } from './evolving.js';

25import { renderSchema } from './protocol.js';

26import { loadManifest, mergeManifests, typeDef, vocabTerms, embodiedTypes, recordTypes, portfolioTypes } from './manifest.js';

27import { discoverBoards, deriveRoster, discoverNetworks, anchorOf } from './network.js';

28import { retain as retainCase, taxonomy as caseTaxonomy } from './cases.js';

29import { captureCard, noteCard, elaborateCard, reaffirmCard, applyReslug, syncBoard, parseLane, mergeRefs, linkRefs, unlinkRefs, resolvePiece, listSkills, assembleProcedure, revisedStale } from './commands.js';

30import { registerSchedule, removeSchedule, annotateSchedules, fireSchedule, grantSummary } from './schedule.js';

32// Advertise this entrypoint so hook handlers can call verbs back (the board

33// reacting to itself). Inherited by spawned handlers via the environment.

34process.env.KANBENTO_CLI ??= fileURLToPath(import.meta.url);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli.jsView on unpkg · L17

36// Thin CLI adapter over the kernel. The kernel is a library (openBoard); this is

37// one transport. Each verb is a Commander command — options/help/validation come

procedures/status-update/scripts/git-activity.shView file

•path = procedures/status-update/scripts/git-activity.sh kind = build_helper sizeBytes = 3420 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

procedures/status-update/scripts/git-activity.shView on unpkg

Source & flagged code

2 flagged · loading source

src/cli.jsView file

17import { writeFrontmatterBlock, writeFrontmatterField } from './frontmatter.js'; L18: import { execFileSync, spawn } from 'node:child_process'; L19: import { execCommand } from './hooks.js'; ... L33: // reacting to itself). Inherited by spawned handlers via the environment. L34: process.env.KANBENTO_CLI ??= fileURLToPath(import.meta.url); L35: ... L119: L120: const VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version ?? '0.0.0'; L121: ... L270: console.log(` ${res.steps.length} step(s) · workspace → ${runDir}`); L271: if (res.outcome !== 'delivered') process.exitCode = 1; L272: }));

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli.jsView on unpkg · L17

procedures/status-update/scripts/git-activity.shView file

•path = procedures/status-update/scripts/git-activity.sh kind = build_helper sizeBytes = 3420 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

procedures/status-update/scripts/git-activity.shView on unpkg

Findings

4 Medium4 Low

MediumEnvironment Vars

MediumInstall Persistencesrc/cli.js

MediumShips Build Helperprocedures/status-update/scripts/git-activity.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/cli.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import { Command } from 'commander';

3import { join, resolve, basename, dirname } from 'node:path';

4import { fileURLToPath, pathToFileURL } from 'node:url';

5import { existsSync, statSync, readdirSync, readFileSync, appendFileSync } from 'node:fs';

6import { mkdir, writeFile, copyFile, readFile } from 'node:fs/promises';

7import { createHash, randomUUID } from 'node:crypto';

8import { openBoard } from './kernel.js';

9import { FileLog } from './eventlog.js';

10import { resolveBoardDir, resolveInitTarget, manifestPathIn, dataDirIn, hasManifest, repoRoot, registerBoard, gitObserver, gitIdentity, homeConfig } from './boards.js';

11import { compile, diffCompiled, isEmptyChangeset, reconcileMoves } from './compile.js';

12import { indexRecords, indexDocs } from './binding.js';

13import { forwardEdges, collectBacklinks, neighborhood, parseCurie, refEdges, collectFrontier, stageProcedurePath, stageAgreementPath, presentIncoming } from './refs.js';

14import { parseAgreement } from './agreement.js';

15import { lintRecords } from './lint.js';

16import { renderMap, renderMapIndex, renderFootprints, renderCuration, recordFootprints } from './map.js';

17import { writeFrontmatterBlock, writeFrontmatterField } from './frontmatter.js';

18import { execFileSync, spawn } from 'node:child_process';

19import { execCommand } from './hooks.js';

20import { materialize, materializeNetwork, renderNetwork, renderBoard, renderPortfolio, writeProjection, handle } from './projection.js';

21import { slugify } from './slug.js';

22import { resolveBody, editFile } from './input.js';

23import { renderAgents } from './agents.js';

24import { EVOLVING_MD } from './evolving.js';

25import { renderSchema } from './protocol.js';

26import { loadManifest, mergeManifests, typeDef, vocabTerms, embodiedTypes, recordTypes, portfolioTypes } from './manifest.js';

27import { discoverBoards, deriveRoster, discoverNetworks, anchorOf } from './network.js';

28import { retain as retainCase, taxonomy as caseTaxonomy } from './cases.js';

30import { registerSchedule, removeSchedule, annotateSchedules, fireSchedule, grantSummary } from './schedule.js';

32// Advertise this entrypoint so hook handlers can call verbs back (the board

33// reacting to itself). Inherited by spawned handlers via the environment.

34process.env.KANBENTO_CLI ??= fileURLToPath(import.meta.url);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli.jsView on unpkg · L17

36// Thin CLI adapter over the kernel. The kernel is a library (openBoard); this is

37// one transport. Each verb is a Commander command — options/help/validation come

procedures/status-update/scripts/git-activity.shView file

•path = procedures/status-update/scripts/git-activity.sh kind = build_helper sizeBytes = 3420 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

procedures/status-update/scripts/git-activity.shView on unpkg