registry / pi-aftc-toolset / 1.3.1

pi-aftc-toolset@1.3.1

AFTC productivity toolset for pi — footer diagnostics, SQLite model usage reports, cache analysis, input shortcuts, cache-audit skill, theme, and SSH tools backed by a PyQt6 GUI.

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 227 KB of source, external domains: 127.0.0.85, github.com

Source & flagged code

4 flagged

tests/full-check/full-check.mjsView file

Lines 158-198javascript

158 innerHTML: "", id, style: {}, classList: { toggle: () => {}, add: () => {}, remove: () => {}, contains: () => false },

159 addEventListener: function() {}, appendChild() {}, querySelectorAll: () => [], querySelector: () => null,

160 getBoundingClientRect: () => ({}), dataset: { state: "include" },

161 lastElementChild: null, children: { length: 0 },

162 removeChild: function() {}, textContent: "",

163 });

164 const document = {

165 getElementById: (id) => _els[id] || (_els[id] = _fakeEl(id)),

166 createElement: () => ({ className: "", innerHTML: "", style: {}, appendChild() {}, classList: { add: () => {}, remove: () => {}, contains: () => false }, dataset: {} }),

167 querySelectorAll: () => [],

168 };

169 const window = {};

170 const Number = Number;

171 const Math = Math;

172 const String = String;

173 const Array = Array;

174 const JSON = JSON;

175 const Date = Date;

176 `;

177 const fullScript = stubs + "\n" + m2[1];

178 try {

179 new Function(fullScript)();

180 console.log(" OK Module script executes (DOM-stubbed, empty JSON)");

Low

Eval

Package source references a known benign dynamic code generation pattern.

tests/full-check/full-check.mjsView on unpkg · L178

181 } catch (e) {

182 if (e instanceof SyntaxError) {

183 console.error(" FAIL SyntaxError: " + e.message);

184 allOk = false;

185 } else {

186 console.log(" OK no syntax error (stub runtime: " + e.message + ")");

187 }

188 }

189}

190

191console.log(allOk && shapeOk ? "\nALL HTML CHECKS PASSED" : "\nSOME CHECKS FAILED");

192

193// ---------- 5. Final re-parse ----------

194jiti(`${ROOT}/extensions/toolset/usage-report.ts`);

195console.log("\n=== FINAL RE-PARSE ===");

196console.log(" OK");

197

198process.exit(allOk && shapeOk ? 0 : 1);

tests/load-test/load-test.cjsView file

Lines 1-26javascript

1// Load-test harness for extensions/toolset/index.ts — no API calls, no TUI.

2// Uses pi's bundled jiti to load the TS extension with a stub ExtensionAPI.

3// Resolve the globally-installed pi package portably via `npm root -g`.

4// Exercises the factory, every event handler, every slash command, and

5// the widget render path end-to-end against a real SQLite DB so we

6// verify per-turn recording actually inserts rows.

7const { execSync } = require("node:child_process");

8const globalRoot

internal-python-gui/bin/uv.exeView file

•path = internal-python-gui/bin/uv.exe kind = native_binary sizeBytes = 65102336 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

internal-python-gui/bin/uv.exeView on unpkg

internal-python-gui/main.pyView file

•path = internal-python-gui/main.py kind = build_helper sizeBytes = 28810 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

internal-python-gui/main.pyView on unpkg

Source & flagged code

4 flagged · loading source

tests/full-check/full-check.mjsView file

178try { L179: new Function(fullScript)(); L180: console.log(" OK Module script executes (DOM-stubbed, empty JSON)");

Low

Eval

Package source references a known benign dynamic code generation pattern.

tests/full-check/full-check.mjsView on unpkg · L178

tests/load-test/load-test.cjsView file

6// verify per-turn recording actually inserts rows. L7: const { execSync } = require("node:child_process"); L8: const globalRoot = execSync("npm root -g", { encoding: "utf8" }).trim();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/load-test/load-test.cjsView on unpkg · L6

internal-python-gui/bin/uv.exeView file

•path = internal-python-gui/bin/uv.exe kind = native_binary sizeBytes = 65102336 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

internal-python-gui/bin/uv.exeView on unpkg

internal-python-gui/main.pyView file

•path = internal-python-gui/main.py kind = build_helper sizeBytes = 28810 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

internal-python-gui/main.pyView on unpkg

Findings

6 Medium4 Low

MediumDynamic Requiretests/load-test/load-test.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryinternal-python-gui/bin/uv.exe

MediumShips Build Helperinternal-python-gui/main.py

MediumStructural Risk Force Deep Review

LowEvaltests/full-check/full-check.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

tests/full-check/full-check.mjsView file

Lines 158-198javascript

158 innerHTML: "", id, style: {}, classList: { toggle: () => {}, add: () => {}, remove: () => {}, contains: () => false },

159 addEventListener: function() {}, appendChild() {}, querySelectorAll: () => [], querySelector: () => null,

160 getBoundingClientRect: () => ({}), dataset: { state: "include" },

161 lastElementChild: null, children: { length: 0 },

162 removeChild: function() {}, textContent: "",

163 });

164 const document = {

165 getElementById: (id) => _els[id] || (_els[id] = _fakeEl(id)),

166 createElement: () => ({ className: "", innerHTML: "", style: {}, appendChild() {}, classList: { add: () => {}, remove: () => {}, contains: () => false }, dataset: {} }),

167 querySelectorAll: () => [],

168 };

169 const window = {};

170 const Number = Number;

171 const Math = Math;

172 const String = String;

173 const Array = Array;

174 const JSON = JSON;

175 const Date = Date;

176 `;

177 const fullScript = stubs + "\n" + m2[1];

178 try {

179 new Function(fullScript)();

180 console.log(" OK Module script executes (DOM-stubbed, empty JSON)");

Low

Eval

Package source references a known benign dynamic code generation pattern.

tests/full-check/full-check.mjsView on unpkg · L178

181 } catch (e) {

182 if (e instanceof SyntaxError) {

183 console.error(" FAIL SyntaxError: " + e.message);

184 allOk = false;

185 } else {

186 console.log(" OK no syntax error (stub runtime: " + e.message + ")");

187 }

188 }

189}

190

191console.log(allOk && shapeOk ? "\nALL HTML CHECKS PASSED" : "\nSOME CHECKS FAILED");

192

193// ---------- 5. Final re-parse ----------

194jiti(`${ROOT}/extensions/toolset/usage-report.ts`);

195console.log("\n=== FINAL RE-PARSE ===");

196console.log(" OK");

197

198process.exit(allOk && shapeOk ? 0 : 1);

tests/load-test/load-test.cjsView file

Lines 1-26javascript

1// Load-test harness for extensions/toolset/index.ts — no API calls, no TUI.

2// Uses pi's bundled jiti to load the TS extension with a stub ExtensionAPI.

3// Resolve the globally-installed pi package portably via `npm root -g`.

4// Exercises the factory, every event handler, every slash command, and

5// the widget render path end-to-end against a real SQLite DB so we

6// verify per-turn recording actually inserts rows.

7const { execSync } = require("node:child_process");

8const globalRoot

internal-python-gui/bin/uv.exeView file

•path = internal-python-gui/bin/uv.exe kind = native_binary sizeBytes = 65102336 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

internal-python-gui/bin/uv.exeView on unpkg

internal-python-gui/main.pyView file

•path = internal-python-gui/main.py kind = build_helper sizeBytes = 28810 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

internal-python-gui/main.pyView on unpkg