registry / phasegate / 0.167.0

phasegate@0.167.0

Phasegate — AI-agnostic quality defense toolkit. Enforces structural integrity between design intent and code.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 996 file(s), 2.05 MB of source, external domains: json-schema.org, phasegate.dev

Source & flagged code

7 flagged

scripts/harness/biome-ast-engine/infrastructure/adapters/biome-cli-executor-adapter.tsView file

Lines 1-25typescript

1/**

2 * @layer infrastructure

3 * @unit biome-ast-engine

4 */

6import { spawnSync } from 'node:child_process';

7import type { FilePath } from '../../domain/value-objects/file-path.js';

High

Child Process

Package source references child process execution.

scripts/harness/biome-ast-engine/infrastructure/adapters/biome-cli-executor-adapter.tsView on unpkg · L5

8import type { BiomeExecutorPort } from '../../domain/ports/biome-executor-port.js';

10export class BiomeCliExecutionError extends Error {

11 constructor(

12 readonly exitCode: number,

13 readonly stderr: string

14 ) {

15 super(`biome check failed with exit code ${exitCode}: ${stderr}`);

16 this.name = 'BiomeCliExecutionError';

17 }

18}

20export interface BiomeCliExecutorAdapterDeps {

21 readonly cwd: string;

22 readonly biomeBin?: string;

23}

25/**

scripts/harness/agent-integration/presentation/phasegate-status-context.tsView file

Lines 1-36typescript

1/**

2 * @layer presentation

3 * @unit agent-integration

4 * @work-item-id WI-208

5 *

6 * Phasegate 状態を context 文字列として組み立てる共有ヘルパー。

7 * SessionStart / UserPromptSubmit hook が共通で使用する。

8 *

9 * 副作用: phasegate.config.json の読み込み / docs/product/construction/ の走査のみ。

10 */

scripts/harness/main.tsView file

Lines 2781-2821typescript

2781 if (json) flags.json = true;

2782 await mod.handlers.completeCheck.handle({}, flags);

2783 break;

2784 }

2785

2786 case "phasegate:impact-analysis": {

2787 const mod = createHarnessApiModule();

scripts/harness/harness-api/infrastructure/adapters/harness-config-query-adapter.tsView file

Lines 21-61typescript

21 paths?: {

22 designDocs?: string;

23 integrationTests?: string;

24 };

25 baseline?: {

26 enabled?: boolean;

27 path?: string;

28 };

29}

scripts/harness/regression-suite/infrastructure/adapters/vitest-test-runner-adapter.tsView file

Lines 47-87typescript

47 const unitResults = new Map<string, boolean>();

49 for (const [unit] of Array.from(unitToTestCases.entries())) {

50 if (

scripts/delegate-sonnet.shView file

•path = scripts/delegate-sonnet.sh kind = build_helper sizeBytes = 2944 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/delegate-sonnet.shView on unpkg

templates/.claude/scripts/format-settings-hook.shView file

•path = templates/.claude/scripts/format-settings-hook.sh kind = payload_in_excluded_dir sizeBytes = 918 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.claude/scripts/format-settings-hook.shView on unpkg

Source & flagged code

7 flagged · loading source

scripts/harness/biome-ast-engine/infrastructure/adapters/biome-cli-executor-adapter.tsView file

5L6: import { spawnSync } from 'node:child_process'; L7: import type { FilePath } from '../../domain/value-objects/file-path.js';

High

Child Process

Package source references child process execution.

scripts/harness/biome-ast-engine/infrastructure/adapters/biome-cli-executor-adapter.tsView on unpkg · L5

scripts/harness/agent-integration/presentation/phasegate-status-context.tsView file

16L17: const execAsync = promisify(exec); L18:

High

Shell

Package source references shell execution.

scripts/harness/agent-integration/presentation/phasegate-status-context.tsView on unpkg · L16

scripts/harness/main.tsView file

2801try { L2802: const { createConfigFoundationModule } = await import("./config-foundation/composition-root.js"); L2803: const configModule = createConfigFoundationModule();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/harness/main.tsView on unpkg · L2801

scripts/harness/harness-api/infrastructure/adapters/harness-config-query-adapter.tsView file

41export class HarnessConfigQueryAdapter implements ConfigQueryPort { L42: private readonly configPath: string; L43: private cachedConfig: HarnessConfigJson | null = null; ... L51: const content = await fs.readFile(this.configPath, 'utf-8'); L52: this.cachedConfig = JSON.parse(content) as HarnessConfigJson; L53: return this.cachedConfig;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/harness/harness-api/infrastructure/adapters/harness-config-query-adapter.tsView on unpkg · L41

scripts/harness/regression-suite/infrastructure/adapters/vitest-test-runner-adapter.tsView file

67try { L68: execSync( L69: `npx tsx node_modules/vitest/vitest.mjs run --config scripts/harness/__tests__/vitest.config.ts "${testPattern}"`, L70: { cwd: this.rootDir, stdio: 'pipe', timeout: 60_000 },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/harness/regression-suite/infrastructure/adapters/vitest-test-runner-adapter.tsView on unpkg · L67

scripts/delegate-sonnet.shView file

•path = scripts/delegate-sonnet.sh kind = build_helper sizeBytes = 2944 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/delegate-sonnet.shView on unpkg

templates/.claude/scripts/format-settings-hook.shView file

•path = templates/.claude/scripts/format-settings-hook.sh kind = payload_in_excluded_dir sizeBytes = 918 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.claude/scripts/format-settings-hook.shView on unpkg

Findings

4 High4 Medium5 Low

HighChild Processscripts/harness/biome-ast-engine/infrastructure/adapters/biome-cli-executor-adapter.ts

HighShellscripts/harness/agent-integration/presentation/phasegate-status-context.ts

HighRuntime Package Installscripts/harness/regression-suite/infrastructure/adapters/vitest-test-runner-adapter.ts

HighPayload In Excluded Dirtemplates/.claude/scripts/format-settings-hook.sh

MediumDynamic Requirescripts/harness/main.ts

MediumEnvironment Vars

MediumShips Build Helperscripts/delegate-sonnet.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptoscripts/harness/harness-api/infrastructure/adapters/harness-config-query-adapter.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

scripts/harness/biome-ast-engine/infrastructure/adapters/biome-cli-executor-adapter.tsView file

Lines 1-25typescript

1/**

2 * @layer infrastructure

3 * @unit biome-ast-engine

4 */

6import { spawnSync } from 'node:child_process';

7import type { FilePath } from '../../domain/value-objects/file-path.js';

High

Child Process

Package source references child process execution.

scripts/harness/biome-ast-engine/infrastructure/adapters/biome-cli-executor-adapter.tsView on unpkg · L5

8import type { BiomeExecutorPort } from '../../domain/ports/biome-executor-port.js';

10export class BiomeCliExecutionError extends Error {

11 constructor(

12 readonly exitCode: number,

13 readonly stderr: string

14 ) {

15 super(`biome check failed with exit code ${exitCode}: ${stderr}`);

16 this.name = 'BiomeCliExecutionError';

17 }

18}

20export interface BiomeCliExecutorAdapterDeps {

21 readonly cwd: string;

22 readonly biomeBin?: string;

23}

25/**

scripts/harness/agent-integration/presentation/phasegate-status-context.tsView file

Lines 1-36typescript

1/**

2 * @layer presentation

3 * @unit agent-integration

4 * @work-item-id WI-208

5 *

6 * Phasegate 状態を context 文字列として組み立てる共有ヘルパー。

7 * SessionStart / UserPromptSubmit hook が共通で使用する。

8 *

9 * 副作用: phasegate.config.json の読み込み / docs/product/construction/ の走査のみ。

10 */

scripts/harness/main.tsView file

Lines 2781-2821typescript

2781 if (json) flags.json = true;

2782 await mod.handlers.completeCheck.handle({}, flags);

2783 break;

2784 }

2785

2786 case "phasegate:impact-analysis": {

2787 const mod = createHarnessApiModule();

scripts/harness/harness-api/infrastructure/adapters/harness-config-query-adapter.tsView file

Lines 21-61typescript

21 paths?: {

22 designDocs?: string;

23 integrationTests?: string;

24 };

25 baseline?: {

26 enabled?: boolean;

27 path?: string;

28 };

29}

scripts/harness/regression-suite/infrastructure/adapters/vitest-test-runner-adapter.tsView file

Lines 47-87typescript

47 const unitResults = new Map<string, boolean>();

49 for (const [unit] of Array.from(unitToTestCases.entries())) {

50 if (

scripts/delegate-sonnet.shView file

•path = scripts/delegate-sonnet.sh kind = build_helper sizeBytes = 2944 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/delegate-sonnet.shView on unpkg

templates/.claude/scripts/format-settings-hook.shView file

•path = templates/.claude/scripts/format-settings-hook.sh kind = payload_in_excluded_dir sizeBytes = 918 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.claude/scripts/format-settings-hook.shView on unpkg