registry / lavish-axi / 0.1.33

lavish-axi@0.1.33

HTML is the new markdown. Lavish is the new editor for your HTML artifacts.

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 567 KB of source, external domains: a.kunchenguid.com, api.ht-ml.app, bugs.chromium.org, bugs.webkit.org, bugzilla.mozilla.org, cdn.jsdelivr.net, daisyui.com, esm.sh, github.com, ht-ml.app, tailwindcss.com

Source & flagged code

5 flagged

dist/cli.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

3// src/cli.js

4import { spawn, spawnSync } from "node:child_process";

5import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L3

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L3

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/cli.mjsView on unpkg · L3

6import { access, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";

7import os2 from "node:os";

8import path5 from "node:path";

9import { fileURLToPath as fileURLToPath3 } from "node:url";

10import { AxiError, installSessionStartHooks, RESERVED_COMMANDS, runAxiCli } from "axi-sdk-js";

12// src/playbooks.js

13var PLAYBOOK_ROUTER_INSTRUCTION = "MUST open each matching playbook before writing HTML. Match against the use_when trigger; one artifact often combines several playbooks.";

14var PLAYBOOK_ROUTER_HELP = "One artifact often combines several playbooks (for example a plan that includes a comparison and a diagram), so MUST open each matching playbook before writing HTML.";

15var PLAYBOOKS = [

16 {

17 id: "diagram",

18 use_when: "Map relationships, flows, state, and architecture",

19 choose: [

20 "Use Mermaid when automatic node placement and edge routing matter more than rich card content.",

21 "Use CSS grid, SVG, or positioned HTML when each item needs prose, code, controls, or detailed annotations.",

22 "Use a hybrid shape for large systems: a small overview diagram followed by detailed module cards."

23 ],

Lines 6407-6447javascript

6407 hookDir: resolveCopilotHookDir(process.env, resolveHookHomeDir()),

6408 onError: (message) => errors.push(message)

6409 });

6410 if (errors.length > 0) {

6411 throw new AxiError("Failed to install lavish-axi agent hooks", "SERVER_ERROR"

Lines 6645-6685javascript

6645 await ensureStateDir();

6646 const entry = resolveServerEntry();

6647 let logFd = null;

6648 try {

6649 logFd = openSync(serverLogFile(), "a");

6650 } catch {

Source & flagged code

5 flagged · loading source

dist/cli.mjsView file

3// src/cli.js L4: import { spawn, spawnSync } from "node:child_process"; L5: import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L3

6427`const command = ${JSON.stringify(command)};`, L6428: 'const result = spawnSync(command, [], { encoding: "utf8", shell: true });', L6429: 'const detail = result.error ? result.error.message : (result.stderr || result.stdout || "exit " + (result.status ?? "unknown"));',

High

Shell

Package source references shell execution.

dist/cli.mjsView on unpkg · L6427

6665const stdio = ( L6666: /** @type {import("node:child_process").StdioOptions} */ L6667: logFd === null ? "ignore" : ["ignore", logFd, logFd] ... L6671: stdio, L6672: env: { ...process.env, LAVISH_AXI_NO_OPEN: "1" } L6673: }; ... L6678: try { L6679: response = await fetch(url); L6680: break;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.mjsView on unpkg · L6665

3Cross-file remote execution chain: dist/cli.mjs spawns dist/design/tailwindcss-browser.js; helper contains network access plus dynamic code execution. L3: // src/cli.js L4: import { spawn, spawnSync } from "node:child_process"; L5: import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs"; ... L144: <script type="module"> L145: import { File, FileDiff } from "https://esm.sh/@pierre/diffs@1.2.10?bundle"; L146: ... L219: "Lavish is strongest when the artifact becomes a focused review surface and not just a static page.", L220: `A native single-choice question should submit the final value: \`<form data-lavish-question="plan" onsubmit="event.preventDefault(); const choice = new FormData(event.currentTarge... L221: "A custom choice UI should make option buttons update local state, then use a separate Queue answer button with data-lavish-action to queue the final selected value.", ... L863: const ctx = { L864: baseDir: options.baseDir || process.cwd(), L865: confineDir,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L3

3Detached bundled service listener: dist/cli.mjs launches a Node helper and exposes a broad-bound HTTP listener. L3: // src/cli.js L4: import { spawn, spawnSync } from "node:child_process"; L5: import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs"; ... L144: <script type="module"> L145: import { File, FileDiff } from "https://esm.sh/@pierre/diffs@1.2.10?bundle"; L146: ... L219: "Lavish is strongest when the artifact becomes a focused review surface and not just a static page.", L220: `A native single-choice question should submit the final value: \`<form data-lavish-question="plan" onsubmit="event.preventDefault(); const choice = new FormData(event.currentTarge... L221: "A custom choice UI should make option buttons update local state, then use a separate Queue answer button with data-lavish-action to queue the final selected value.", ... L863: const ctx = { L864: baseDir: options.baseDir || process.cwd(), L865: confineDir,

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/cli.mjsView on unpkg · L3

Findings

5 High3 Medium4 Low

HighChild Processdist/cli.mjs

HighShelldist/cli.mjs

HighSame File Env Network Executiondist/cli.mjs

HighCross File Remote Execution Contextdist/cli.mjs

HighSpawned Bundled Service Listenerdist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/cli.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

3// src/cli.js

4import { spawn, spawnSync } from "node:child_process";

5import { closeSync, existsSync as existsSync2, mkdirSync, openSync, readFileSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/cli.mjsView on unpkg · L3

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L3

High

Spawned Bundled Service Listener

Source launches a detached bundled service that exposes a broad-bound HTTP listener.

dist/cli.mjsView on unpkg · L3

6import { access, readFile as readFile4, writeFile as writeFile2 } from "node:fs/promises";

7import os2 from "node:os";

8import path5 from "node:path";

9import { fileURLToPath as fileURLToPath3 } from "node:url";

10import { AxiError, installSessionStartHooks, RESERVED_COMMANDS, runAxiCli } from "axi-sdk-js";

12// src/playbooks.js

13var PLAYBOOK_ROUTER_INSTRUCTION = "MUST open each matching playbook before writing HTML. Match against the use_when trigger; one artifact often combines several playbooks.";

14var PLAYBOOK_ROUTER_HELP = "One artifact often combines several playbooks (for example a plan that includes a comparison and a diagram), so MUST open each matching playbook before writing HTML.";

15var PLAYBOOKS = [

16 {

17 id: "diagram",

18 use_when: "Map relationships, flows, state, and architecture",

19 choose: [

20 "Use Mermaid when automatic node placement and edge routing matter more than rich card content.",

21 "Use CSS grid, SVG, or positioned HTML when each item needs prose, code, controls, or detailed annotations.",

22 "Use a hybrid shape for large systems: a small overview diagram followed by detailed module cards."

23 ],

Lines 6407-6447javascript

6407 hookDir: resolveCopilotHookDir(process.env, resolveHookHomeDir()),

6408 onError: (message) => errors.push(message)

6409 });

6410 if (errors.length > 0) {

6411 throw new AxiError("Failed to install lavish-axi agent hooks", "SERVER_ERROR"

Lines 6645-6685javascript

6645 await ensureStateDir();

6646 const entry = resolveServerEntry();

6647 let logFd = null;

6648 try {

6649 logFd = openSync(serverLogFile(), "a");

6650 } catch {