registry / pilotswarm-sdk / 0.5.7

pilotswarm-sdk@0.5.7

A durable execution runtime for GitHub Copilot SDK agents. Crash recovery, durable timers, session dehydration, and multi-node scaling — powered by duroxide.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 152 file(s), 5.87 MB of source, external domains: ossrdbms-aad.database.windows.net

Source & flagged code

1 flagged

dist/facts-store.jsView file

Lines 119-159javascript

119 },

120 };

121}

122function computeScopeKey(key, shared, sessionId) {

123 if (shared)

124 return `shared:${key}`;

125 if (!sessionId)

126 throw new Error("Session-scoped facts require a sessionId.");

127 return `session:${sessionId}:${key}`;

128}

129function normalizeLikePattern(pattern) {

130 if (!pattern)

131 return undefined;

132 if (pattern.includes("%"))

133 return pattern;

134 if (pattern.includes("*"))

135 return pattern.replaceAll("*", "%");

136 return pattern;

137}

138// Specifier for the OPTIONAL horizon provider peer. The `: string` annotation is

139// load-bearing: it widens the type away from a string literal so TypeScript does

140// NOT eagerly type-resolve `import(HORIZON_STORE_PACKAGE)` at compile time.

141// Resolving it would pull pilotswarm-horizon-store's emitted .d.ts into this

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/facts-store.jsView on unpkg · L139

142// compile, which re-imports `pilotswarm-sdk` and cycles back onto THIS package's

143// own dist/ — a TS5055 self-overwrite once dist/ exists. The peer is loaded

144// purely structurally at runtime (`mod` is `any`), so nothing is lost. Do NOT

145// inline this back to a string literal.

146const HORIZON_STORE_PACKAGE = "pilotswarm-horizon-store";

147export async function createFactStoreForUrl(storeUrl, schema, opts = {}) {

148 if (!(storeUrl.startsWith("postgres://") || storeUrl.startsWith("postgresql://"))) {

149 throw new Error("PilotSwarm facts require a PostgreSQL store. " +

150 `Received unsupported store URL: ${storeUrl}`);

151 }

152 if (opts.provider === "horizon") {

153 // Guarded dynamic import: the SDK builds/runs without the provider

154 // package. A missing package is a clear, actionable error ONLY when the

155 // horizon provider is explicitly selected.

156 let mod;

157 try {

158 mod = await import(HORIZON_STORE_PACKAGE);

159 }

Source & flagged code

1 flagged · loading source

dist/facts-store.jsView file

139// load-bearing: it widens the type away from a string literal so TypeScript does L140: // NOT eagerly type-resolve `import(HORIZON_STORE_PACKAGE)` at compile time. L141: // Resolving it would pull pilotswarm-horizon-store's emitted .d.ts into this

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/facts-store.jsView on unpkg · L139

Findings

4 Medium4 Low

MediumDynamic Requiredist/facts-store.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/facts-store.jsView file

Lines 119-159javascript

119 },

120 };

121}

122function computeScopeKey(key, shared, sessionId) {

123 if (shared)

124 return `shared:${key}`;

125 if (!sessionId)

126 throw new Error("Session-scoped facts require a sessionId.");

127 return `session:${sessionId}:${key}`;

128}

129function normalizeLikePattern(pattern) {

130 if (!pattern)

131 return undefined;

132 if (pattern.includes("%"))

133 return pattern;

134 if (pattern.includes("*"))

135 return pattern.replaceAll("*", "%");

136 return pattern;

137}

138// Specifier for the OPTIONAL horizon provider peer. The `: string` annotation is

139// load-bearing: it widens the type away from a string literal so TypeScript does

140// NOT eagerly type-resolve `import(HORIZON_STORE_PACKAGE)` at compile time.

141// Resolving it would pull pilotswarm-horizon-store's emitted .d.ts into this

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/facts-store.jsView on unpkg · L139

142// compile, which re-imports `pilotswarm-sdk` and cycles back onto THIS package's

143// own dist/ — a TS5055 self-overwrite once dist/ exists. The peer is loaded

144// purely structurally at runtime (`mod` is `any`), so nothing is lost. Do NOT

145// inline this back to a string literal.

146const HORIZON_STORE_PACKAGE = "pilotswarm-horizon-store";

147export async function createFactStoreForUrl(storeUrl, schema, opts = {}) {

148 if (!(storeUrl.startsWith("postgres://") || storeUrl.startsWith("postgresql://"))) {

149 throw new Error("PilotSwarm facts require a PostgreSQL store. " +

150 `Received unsupported store URL: ${storeUrl}`);

151 }

152 if (opts.provider === "horizon") {

153 // Guarded dynamic import: the SDK builds/runs without the provider

154 // package. A missing package is a clear, actionable error ONLY when the

155 // horizon provider is explicitly selected.

156 let mod;

157 try {

158 mod = await import(HORIZON_STORE_PACKAGE);

159 }