registry / pi-harness-runtime / 0.7.0

pi-harness-runtime@0.7.0

[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 357 file(s), 1.88 MB of source, external domains: 127.0.0.1, api.dicebear.com, api.myai.example.com, api.telegram.org, ntfy.sh, picsum.photos, platform.minimax.io

Source & flagged code

3 flagged

harness/e2e/playwright-runner.tsView file

Lines 149-189typescript

149 await this.page.waitForSelector(selector, {

150 timeout: timeoutMs ?? this.config.timeout,

151 });

152 }

153

154 /**

155 * Take a screenshot

156 */

157 async screenshot(path: string): Promise<void> {

158 if (!this.page) throw new Error("Browser not started");

159 await this.page.screenshot({ path, fullPage: true });

160 }

161

162 /**

163 * Assert a condition

164 */

165 async assert(condition: string, message?: string): Promise<boolean> {

166 if (!this.page) throw new Error("Browser not started");

167

168 const result = await this.page.evaluate((cond: unknown) => {

169 // eslint-disable-next-line no-eval

170 return eval(String(cond)) as boolean; // eslint-disable-line

171 }, condition);

Low

Eval

Package source references a known benign dynamic code generation pattern.

harness/e2e/playwright-runner.tsView on unpkg · L169

172

173 if (!result && message) {

174 throw new Error(message);

175 }

176

177 return result;

178 }

179

180 /**

181 * Get the underlying page for advanced operations

182 */

183 getPage() {

184 return this.page;

185 }

186

187 /**

188 * Start tracing for debugging

189 */

packages/auth/src/minimax-browser-auth.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = pi-harness-runtime@0.5.0 matchedIdentity = npm:cGktaGFybmVzcy1ydW50aW1l:0.5.0 similarity = 0.476 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

packages/auth/src/minimax-browser-auth.tsView on unpkg

packages/prompt-compiler/test/prompt-compiler.test.tsView file

Lines 291-331typescript

291 assert.ok(

292 pkg1.user.includes("Implement user login"),

293 "OpenAI should have objective",

294 );

295 assert.ok(

296 pkg2.user.includes("Implement user login"

Source & flagged code

3 flagged · loading source

harness/e2e/playwright-runner.tsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code