registry / pingfusi / 0.2.0

pingfusi@0.2.0

pingfusi: clone websites pixel-perfect and polish any AI-built draft, verified with review rounds. Enforced, gated workflow — a green check is a command that exits 0, never a screenshot.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 419 KB of source, external domains: 127.0.0.1, cdn.example.com, developers.cloudflare.com, docs.claude.com, engines-pad-firewire-investing.trycloudflare.com, example.com, nodejs.org, pingfusi.com, www.w3.org, x.trycloudflare.com

Source & flagged code

4 flagged

tools/cli-selftest.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * cli-selftest.js — guards the TOOL CONTRACTS of the kit's Node entry points.

4 *

5 * selftest.js guards what the diff *measures*; this guards how the tools *behave at their

6 * edges* — the Claude Code tool-contract properties: validate input, bound output, fail

7 * loudly with a self-describing, actionable message (never a raw stack), and use stable

8 * exit codes. Each assertion here is a bug we fixed; this file keeps it fixed.

9 *

10 * Runs against the real pixel-diff CLI (child process) and the pure, exported guards of

11 * serve.js / sink.js (no sockets). Exit 0 = green.

12 */

13"use strict";

14const fs = require("fs");

15const os = require("os");

16const path = require("path");

17const cp = require("child_process");

High

Child Process

Package source references child process execution.

tools/cli-selftest.jsView on unpkg · L16

19const PD = path.join(__dirname, "pixel-diff.js");

20const { resolvePath } = require("../harness/serve.js");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

tools/cli-selftest.jsView on unpkg · L7

21const { classifyBody, sanitizeName } = require("./sink.js");

23let failed = 0;

24const ok = (cond, msg) => { if (cond) console.log(` ✓ ${msg}`); else { failed++; console.log(` ✗ ${msg}`); } };

26// scratch dir in the OS temp area (hermetic)

27const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pingfusi-cli-"));

28process.on("exit", () => { try { fs.rmSync(dir, { recursive: true, force: true }); } catch (e) {} });

29const w = (f, s) => { const p = path.join(dir, f); fs.writeFileSync(p, s); return p; };

30const snap = JSON.stringify({ viewport: { width: 1728 }, elements: { logo: { present: true, rect: { x: 0, y: 0, w: 10, h: 10, top: 0, right: 10, bottom: 10, fromRight: 0 } } } });

31const run = (args) => { const r = cp.spawnSync(process.execPath, [PD, ...args], { encoding: "utf8" }); return { code: r.status, out: (r.stdout || "") + (r.stderr || "") }; };

33const a = w("a.json", snap), b = w("b.json", snap);

35console.log("cli-selftest — tool contracts (validate input, self-describing errors, exit codes)");

tools/merge-snapshot.jsView file

Lines 4-44javascript

4// WHY: the slow half of a verification round is the browser capture, not the diff — and

5// after a one-element fix, re-capturing all N targets to re-run a gate wastes minutes per

6// iteration (astryx: 35-target full captures for single-region fixes, dozens of times).

7// Capture ONLY the affected targets instead (`pxSend(url, subsetTargets)`), then fold them

8// in here: elements present in the partial overwrite their counterparts in the full file;

9// everything else carries over. Gates then run on the merged file in seconds.

10//

11// HONESTY CONTRACT: a merged snapshot is an ITERATION artifact, not a proof — the

12// carried-over elements' measurements are only as fresh as the last full capture, and a fix

13// can shift things outside the subset you re-measured (astryx's bento-height fix moved the

vendor/pingfusi-review.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// pingfusi — install the pingfusi review MCP server in your AI client.

3// One command: shows a one-time code, you approve it in the browser

4// (RFC 8628 device flow), your client configs get patched, you're done.

6import { writeFile, readFile, mkdir, stat } from "node:fs/promises";

7import { homedir, platform, hostname, userInfo } from "node:os";

8import { join, dirname } from "node:path"

Source & flagged code

4 flagged · loading source

tools/cli-selftest.jsView file

16const path = require("path"); L17: const cp = require("child_process"); L18:

High

Child Process

Package source references child process execution.

tools/cli-selftest.jsView on unpkg · L16

7Cross-file remote execution chain: tools/cli-selftest.js spawns harness/serve.js; helper contains network access plus dynamic code execution. L7: * loudly with a self-describing, actionable message (never a raw stack), and use stable L8: * exit codes. Each assertion here is a bug we fixed; this file keeps it fixed. L9: * ... L16: const path = require("path"); L17: const cp = require("child_process"); L18: L19: const PD = path.join(__dirname, "pixel-diff.js"); L20: const { resolvePath } = require("../harness/serve.js"); ... L98: { L99: const holder = cp.spawn(process.execPath, ["-e", "require('http').createServer(() => {}).listen(18094, () => console.log('up')); setTimeout(() => {}, 30000)"], { stdio: ["ignore", ... L100: try { ... L115: cwd: dir,

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

tools/cli-selftest.jsView on unpkg · L7

tools/merge-snapshot.jsView file

24L25: const fs = require("fs"); L26:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tools/merge-snapshot.jsView on unpkg · L24

vendor/pingfusi-review.mjsView file

9import { createHash } from "node:crypto"; L10: import { execFile } from "node:child_process"; L11: import { promisify } from "node:util"; ... L15: const execFileP = promisify(execFile); L16: const APP_URL = process.env.PINGHUMANS_APP_URL ?? process.env.PINGFUSI_APP_URL ?? "https://pingfusi.com"; L17: // Hoisted with the other top-of-module consts — the entry try-block runs

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

vendor/pingfusi-review.mjsView on unpkg · L9

Findings

4 High3 Medium4 Low

HighChild Processtools/cli-selftest.js

HighShell

HighSame File Env Network Executionvendor/pingfusi-review.mjs

HighCross File Remote Execution Contexttools/cli-selftest.js

MediumDynamic Requiretools/merge-snapshot.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

tools/cli-selftest.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * cli-selftest.js — guards the TOOL CONTRACTS of the kit's Node entry points.

4 *

5 * selftest.js guards what the diff *measures*; this guards how the tools *behave at their

6 * edges* — the Claude Code tool-contract properties: validate input, bound output, fail

7 * loudly with a self-describing, actionable message (never a raw stack), and use stable

8 * exit codes. Each assertion here is a bug we fixed; this file keeps it fixed.

9 *

10 * Runs against the real pixel-diff CLI (child process) and the pure, exported guards of

11 * serve.js / sink.js (no sockets). Exit 0 = green.

12 */

13"use strict";

14const fs = require("fs");

15const os = require("os");

16const path = require("path");

17const cp = require("child_process");

High

Child Process

Package source references child process execution.

tools/cli-selftest.jsView on unpkg · L16

19const PD = path.join(__dirname, "pixel-diff.js");

20const { resolvePath } = require("../harness/serve.js");

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

tools/cli-selftest.jsView on unpkg · L7

21const { classifyBody, sanitizeName } = require("./sink.js");

23let failed = 0;

24const ok = (cond, msg) => { if (cond) console.log(` ✓ ${msg}`); else { failed++; console.log(` ✗ ${msg}`); } };

26// scratch dir in the OS temp area (hermetic)

27const dir = fs.mkdtempSync(path.join(os.tmpdir(), "pingfusi-cli-"));

28process.on("exit", () => { try { fs.rmSync(dir, { recursive: true, force: true }); } catch (e) {} });

29const w = (f, s) => { const p = path.join(dir, f); fs.writeFileSync(p, s); return p; };

30const snap = JSON.stringify({ viewport: { width: 1728 }, elements: { logo: { present: true, rect: { x: 0, y: 0, w: 10, h: 10, top: 0, right: 10, bottom: 10, fromRight: 0 } } } });

31const run = (args) => { const r = cp.spawnSync(process.execPath, [PD, ...args], { encoding: "utf8" }); return { code: r.status, out: (r.stdout || "") + (r.stderr || "") }; };

33const a = w("a.json", snap), b = w("b.json", snap);

35console.log("cli-selftest — tool contracts (validate input, self-describing errors, exit codes)");

tools/merge-snapshot.jsView file

Lines 4-44javascript

4// WHY: the slow half of a verification round is the browser capture, not the diff — and

5// after a one-element fix, re-capturing all N targets to re-run a gate wastes minutes per

6// iteration (astryx: 35-target full captures for single-region fixes, dozens of times).

7// Capture ONLY the affected targets instead (`pxSend(url, subsetTargets)`), then fold them

8// in here: elements present in the partial overwrite their counterparts in the full file;

9// everything else carries over. Gates then run on the merged file in seconds.

10//

11// HONESTY CONTRACT: a merged snapshot is an ITERATION artifact, not a proof — the

12// carried-over elements' measurements are only as fresh as the last full capture, and a fix

13// can shift things outside the subset you re-measured (astryx's bento-height fix moved the

vendor/pingfusi-review.mjsView file

Lines 1-29javascript

1#!/usr/bin/env node

2// pingfusi — install the pingfusi review MCP server in your AI client.

3// One command: shows a one-time code, you approve it in the browser

4// (RFC 8628 device flow), your client configs get patched, you're done.

6import { writeFile, readFile, mkdir, stat } from "node:fs/promises";

7import { homedir, platform, hostname, userInfo } from "node:os";

8import { join, dirname } from "node:path"