registry / pi-quiver / 3.1.0

pi-quiver@3.1.0

Personal pack of Pi coding-agent extensions. First-party-quality tools that keep context clean. Ships a context-safe fetch tool and a doc_to_md PDF/DOCX/PPTX-to-Markdown converter.

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 56.2 KB of source, external domains: github.com

Source & flagged code

3 flagged

doc_to_md.tsView file

Lines 1-33typescript

1/**

2 * doc_to_md Extension

3 *

4 * Registers a `doc_to_md` tool that converts a local PDF, DOCX, or PPTX file

5 * to Markdown. Primary engine: pymupdf4llm via ephemeral `uv run --with`

6 * (warm-once per process, no repo venv). Fallback: unpdf pure-JS text

7 * extraction (degraded, explicitly marked). DOCX/PPTX convert to PDF first

8 * via headless soffice, then feed the PDF pipeline. Output over 32 KB or

9 * 1000 lines is spilled to a temp .md file with a 60-line preview; smaller

10 * content is returned inline.

11 */

13import { mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";

14import { spawn } from "node:child_process";

15import { tmpdir } from "node:os";

Low

Weak Crypto

Package source references weak cryptographic algorithms.

doc_to_md.tsView on unpkg · L13

16import { basename, extname, join, resolve } from "node:path";

17import { createHash } from "node:crypto";

18import { fileURLToPath } from "node:url";

19import { extractText, getDocumentProxy } from "unpdf";

20import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";

21import { formatSize, keyHint } from "@earendil-works/pi-coding-agent";

22import { Text } from "@earendil-works/pi-tui";

23import { Type } from "@sinclair/typebox";

25// --- Types ---

27export type InputType = "pdf" | "docx" | "pptx";

28export type Engine = "pymupdf4llm" | "unpdf";

30export interface DocToMdConfig {

31 pymupdfVersion: string;

32 warmTimeoutMs: number;

33 convertTimeoutMs: number;

scripts/pdf_to_md.pyView file

•path = scripts/pdf_to_md.py kind = build_helper sizeBytes = 997 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/pdf_to_md.pyView on unpkg

fetch.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = pi-quiver@3.0.0 matchedIdentity = npm:cGktcXVpdmVy:3.0.0 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

fetch.tsView on unpkg

Source & flagged code

3 flagged · loading source

doc_to_md.tsView file

13import { mkdirSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs"; L14: import { spawn } from "node:child_process"; L15: import { tmpdir } from "node:os"; ... L48: export interface CappedResult { L49: stdout: string; L50: stderr: string; ... L108: L109: export function applyGate(body: string): { spill: boolean; bytes: number; lines: number } { L110: const bytes = Buffer.byteLength(body, "utf8"); ... L185: L186: const child = spawn(cmd, args, { env: opts.env ?? process.env }); L187:

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code