registry / pilotswarm-sdk / 0.4.1

pilotswarm-sdk@0.4.1

A durable execution runtime for GitHub Copilot SDK agents. Crash recovery, durable timers, session dehydration, and multi-node scaling — powered by duroxide.

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 125 file(s), 5.23 MB of source, external domains: ossrdbms-aad.database.windows.net

Source & flagged code

2 flagged

dist/facts-store.jsView file

Lines 119-159javascript

119 },

120 };

121}

122function computeScopeKey(key, shared, sessionId) {

123 if (shared)

124 return `shared:${key}`;

125 if (!sessionId)

126 throw new Error("Session-scoped facts require a sessionId.");

127 return `session:${sessionId}:${key}`;

128}

129function normalizeLikePattern(pattern) {

130 if (!pattern)

131 return undefined;

132 if (pattern.includes("%"))

133 return pattern;

134 if (pattern.includes("*"))

135 return pattern.replaceAll("*", "%");

136 return pattern;

137}

138// Specifier for the OPTIONAL horizon provider peer. The `: string` annotation is

139// load-bearing: it widens the type away from a string literal so TypeScript does

140// NOT eagerly type-resolve `import(HORIZON_STORE_PACKAGE)` at compile time.

141// Resolving it would pull pilotswarm-horizon-store's emitted .d.ts into this

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/facts-store.jsView on unpkg · L139

142// compile, which re-imports `pilotswarm-sdk` and cycles back onto THIS package's

143// own dist/ — a TS5055 self-overwrite once dist/ exists. The peer is loaded

144// purely structurally at runtime (`mod` is `any`), so nothing is lost. Do NOT

145// inline this back to a string literal.

146const HORIZON_STORE_PACKAGE = "pilotswarm-horizon-store";

147export async function createFactStoreForUrl(storeUrl, schema, opts = {}) {

148 if (!(storeUrl.startsWith("postgres://") || storeUrl.startsWith("postgresql://"))) {

149 throw new Error("PilotSwarm facts require a PostgreSQL store. " +

150 `Received unsupported store URL: ${storeUrl}`);

151 }

152 if (opts.provider === "horizon") {

153 // Guarded dynamic import: the SDK builds/runs without the provider

154 // package. A missing package is a clear, actionable error ONLY when the

155 // horizon provider is explicitly selected.

156 let mod;

157 try {

158 mod = await import(HORIZON_STORE_PACKAGE);

159 }

dist/session-store.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pilotswarm-sdk@0.3.3 matchedIdentity = npm:cGlsb3Rzd2FybS1zZGs:0.3.3 similarity = 0.931 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/session-store.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/facts-store.jsView file

139// load-bearing: it widens the type away from a string literal so TypeScript does L140: // NOT eagerly type-resolve `import(HORIZON_STORE_PACKAGE)` at compile time. L141: // Resolving it would pull pilotswarm-horizon-store's emitted .d.ts into this

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/facts-store.jsView on unpkg · L139

dist/session-store.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/session-store.jsView on unpkg

Findings

1 High4 Medium4 Low

HighPrevious Version Dangerous Deltadist/session-store.js

MediumDynamic Requiredist/facts-store.js

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/facts-store.jsView file

Lines 119-159javascript

119 },

120 };

121}

122function computeScopeKey(key, shared, sessionId) {

123 if (shared)

124 return `shared:${key}`;

125 if (!sessionId)

126 throw new Error("Session-scoped facts require a sessionId.");

127 return `session:${sessionId}:${key}`;

128}

129function normalizeLikePattern(pattern) {

130 if (!pattern)

131 return undefined;

132 if (pattern.includes("%"))

133 return pattern;

134 if (pattern.includes("*"))

135 return pattern.replaceAll("*", "%");

136 return pattern;

137}

138// Specifier for the OPTIONAL horizon provider peer. The `: string` annotation is

139// load-bearing: it widens the type away from a string literal so TypeScript does

140// NOT eagerly type-resolve `import(HORIZON_STORE_PACKAGE)` at compile time.

141// Resolving it would pull pilotswarm-horizon-store's emitted .d.ts into this

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/facts-store.jsView on unpkg · L139

142// compile, which re-imports `pilotswarm-sdk` and cycles back onto THIS package's

143// own dist/ — a TS5055 self-overwrite once dist/ exists. The peer is loaded

144// purely structurally at runtime (`mod` is `any`), so nothing is lost. Do NOT

145// inline this back to a string literal.

146const HORIZON_STORE_PACKAGE = "pilotswarm-horizon-store";

147export async function createFactStoreForUrl(storeUrl, schema, opts = {}) {

148 if (!(storeUrl.startsWith("postgres://") || storeUrl.startsWith("postgresql://"))) {

149 throw new Error("PilotSwarm facts require a PostgreSQL store. " +

150 `Received unsupported store URL: ${storeUrl}`);

151 }

152 if (opts.provider === "horizon") {

153 // Guarded dynamic import: the SDK builds/runs without the provider

154 // package. A missing package is a clear, actionable error ONLY when the

155 // horizon provider is explicitly selected.

156 let mod;

157 try {

158 mod = await import(HORIZON_STORE_PACKAGE);

159 }

dist/session-store.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/session-store.jsView on unpkg