registry / ripplo / 0.7.37

ripplo@0.7.37

CLI for Ripplo — AI-powered end-to-end testing

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 15 file(s), 1.65 MB of source, external domains: 127.0.0.1, evilmartians.com, json-schema.org, ripplo.ai, ripplo.invalid, www.w3.org, www.w3ctech.com

Source & flagged code

4 flagged

dist/chunk-SM6N6ZSY.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import{B as Je,V as Ke,W as Qe,Z as Ge,_ as Xe,a as N,b as De,g as _e,i as qe,j as He,k as We,l as g,m as Be,o as Ve,p as ie,q as h,r as F,s as ze,w as I}from"./chunk-ITI53W73.js";import{b as Ue,d as f,e as y,g as Oe,h as w,i as Ne}from"./chunk-5VRJXHWH.js";import en from"fs";import W from"path";import{config as kt}from"dotenv";import{z as q}from"zod";import{err as St,ok as nn}from"neverthrow";import _ from"fs";import le from"path";import{err as ae,ok as Ye}from"neverthrow";import{z as D}from"zod";var mt=le.join(".ripplo","project.json"),se=[".env",".env.local"],gt=D.object({envFiles:D.array(D ...

3`)}function Rt(e){return e.length!==se.length?!1:e.every((n,t)=>n===se[t])}function ea(e){let t=ce(e)?.envFiles??[".env",".env.local"],r=W.join(e,".ripplo");t.forEach(o=>{let i=W.resolve(r,o);en.existsSync(i)&&kt({override:!0,path:i,quiet:!0})}),H=void 0}var xt=q.object({RIPPLO_APP_URL:q.url(),RIPPLO_ENGINE_URL:q.url(),RIPPLO_WEBHOOK_SECRET:q.string().min(1)}),H;function B(){return H!=null?nn(H):bt().map(e=>(H=e,e))}function wt(e){let t=ce(e)?.envFiles??[],r=W.join(e,".ripplo");return t.map(o=>W.resolve(r,o)).filter(o=>!en.existsSync(o))}function bt(){let e=xt.safeParse(process.env);if(!e.succ ...

4`};return{diagnostics:P.formatDiagnosticsWithColorAndContext(s,l).split(`

5`).filter(d=>d.length>0),ok:!1}}function Pt(e,n){let t=e.file?.fileName;return t==null?!0:t.startsWith(n)}var Ct=M.join(".local","tsbuildinfo");function Tt(e){return

6`)}function Pa(){return`${T} is up to date`}function Ca(e){return[`${T} is ${e==="missing"?"missing":"out of date"} \u2014 run \`npx ripplo compile\` and commit the result`,j("setup")].join(`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-SM6N6ZSY.jsView on unpkg · L4

7`)}function Ta(){return`Wrote ${T}`}function qt(e){switch(e.kind){case"typecheck-failed":return["TypeScript errors in .ripplo/:",...cn(e.diagnostics)].join(`

8`);case"not-ripplo":return`${e.entryPath} must default-export a Ripplo (createRipplo({ entities, singletons, workflows })). Check that the default export is the value returned by createRipplo, not a function or a re-export.`;case"invalid-lockfile":return["Lockfile failed schema validation (stale or hand-edited .ripplo/ripplo.lock?):",...cn(e.issues),"Regenerate with `npx ripplo compile` \u2014 never hand-edit the lockfile."].join(`

9`);case"load-threw":return[`.ripplo/index.ts threw while loading: ${e.message}`,"Usually a bad import or a top-level throw in .ripplo/ \u2014 run `npx ripplo compile` for the stack."].join(`

10`);case"fixture-failed":return Ht(e.error)}}function cn(e,n=8){return e.length<=n?e:[...e.slice(0,n),`\u2026 and ${String(e.length-n)} more`]}function Ht(

11`);case"project-file-invalid":return[`${e.path} is invalid:`,...e.issues.map(n=>` ${n}`),"Fix the file by hand or re-run `npx ripplo init`."].join(`

12`);case"not-authenticated":return["Not signed in. Run `npx ripplo auth login`.","(Claude Code: run it yourself in the background \u2014 the user just approves in the browser.)"].join(`

13`);case"env-invalid":return Wt(e);case"playwright-install-failed":return["Playwright browser install failed \u2014 Chromium is still missing.","Run `npx playwright install chromium` and check its output for network, proxy, or disk-space errors."].join(`

14`);case"gitdir-unrecognized":return`Unrecognized .git file at ${e.marker} \u2014 expected a directory or a "gitdir:" pointer (worktree). Is the repo corrupted?`;case"gitdir-empty":return`Empty gitdir pointer at ${e.marker} \u2014 the worktree's .git file points nowhere. Re-create the worktree.`;case"oauth-device-code-failed":return[`Could not start sign-in (device-code request failed): ${e.description}`,"Is the Ripplo server reachable? Check RIPPLO_SERVER_URL and retry."].join(`

15`);case"oauth-authorization-failed":return[`Sign-in failed (${e.code}): ${e.description}`,e.code==="expired_token"?"The approval window expired \u2014 run `npx ripplo auth login` again.":"Run `npx ripplo auth login` to retry."].join(`

16`);case"compilation-failed":return K(e.error)}}function Wt(e){let n=e.missingEnvFiles.length===0?[]:["Declared env files not found:",...e.missingEnvFiles.map(t=>` ${t}`),"In a git worktree? Env files aren't copied from the main checkout \u2014 recreate them, or symlink to a shared file outside the working tree."];return["Env config invalid:",...e.issues.

17`)}import{err as zt,ok as Jt}from"neverthrow";import{z as Re}from"zod";var Bt="https://ripplo.ai";function pn(){return yn().RIPPLO_SERVER_URL}function fn(){return yn().RIPPLO_PROJECT_ID}var Vt=Re.object({RIPPLO_PROJECT_ID:Re.string().min(1

18 mutation SyncDevSession(

19 $projectId: String!

20 $cwd: String!

21 $branch: String

22 $lockfileContent: String

23 $fixtures: [SyncDevFixtureInput!]

24 $preconditions: [SyncDevPreconditionInput!]!

Long lines were clipped for display.

Lines 68-108javascript

68 code

69 }

70 }

71 }

72`);async function In(e){try{let t=(await f({config:e.config,document:mr,variables:gr(e)})).createRun;return t==null?Y({detail:"create-run-null",type:"generic"}):t.__typename==="MutationCreateRunSuccess"?null:t.__typename==="LimitExceededError"?Y({code:t.code,type:"limit"}):Y({detail:t.__typename,type:"generic"})}catch(n){return hr(n)}}function gr({executor:e,lockfileHash:n,runId:t,target:r}){return{clientVersion:V(),executor:e,id:t,lockfileHash:n,target:e==="cloud"?"tunnel":void 0,testId:r.testId,workflowId:r.workflowId}}function Y(e){return{kind:"dispatch-error",reason:e}}function hr(e){retur ...

73 query DaemonWorkflows($projectId: String!, $cwd: String!) {

74 project(id: $projectId) {

75 id

76 devSession(cwd: $cwd) {

77 id

78 workflows {

dist/chunk-5VRJXHWH.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{a as q}from"./chunk-IHSHBPJY.js";import{b as G}from"./chunk-7UWDMECF.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let

dist/index.jsView file

Lines 73-113javascript

73 }

74`);function tt(e){switch(e.status){case"active":return e.gitMidOperation?"\u2713 Dev session: ripplo daemon is live (hooks auto-paused while git is mid-merge/rebase/cherry-pick \u2014 they resume when the operation ends)":"\u2713 Dev session: ripplo daemon is live for this directory";case"starting":return"! Dev session: the daemon is running locally but hasn't registered with the server yet. Wait a few seconds and re-run `npx ripplo doctor`. If it persists, check the daemon output for auth or network errors.";case"missing":{let n="\u2717 Dev session: no daemon running for this directory. Start ...

75`)}}}async function ot(e){let n=Re(e),r=

Source & flagged code

4 flagged · loading source

dist/chunk-SM6N6ZSY.jsView file

88} L89: `);import{CancellationTokenSource as Ar}from"vscode-jsonrpc/node";function Ie(e){return`${e.workflowSlug}/${e.testSlug}`}function On(e){let{headed:n,inflight:t,jobId:r,lockfileHash... L90: mutation AddDirtyTestsToScope($projectId: String!, $cwd: String!, $workflowSlugs: [String!]!) {

High

Child Process

Package source references child process execution.

dist/chunk-SM6N6ZSY.jsView on unpkg · L88

4`};return{diagnostics:P.[redacted](s,l).split(` L5: `).filter(d=>d.length>0),ok:!1}}function Pt(e,n){let t=e.file?.fileName;return t==null?!0:t.startsWith(n)}var Ct=M.join(".local","tsbuildinfo");function Tt(e){return{allowImporting... L6: `)}function Pa(){return`${T} is up to date`}function Ca(e){return[`${T} is ${e==="missing"?"missing":"out of date"} \u2014 run \`npx ripplo compile\` and commit the result`,j("setu...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-SM6N6ZSY.jsView on unpkg · L4

dist/chunk-5VRJXHWH.jsView file

1#!/usr/bin/env node L2: import{a as q}from"./chunk-IHSHBPJY.js";import{b as G}from"./chunk-7UWDMECF.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let... L3: query AgentReviewContextWorker($reviewId: String!) {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/chunk-5VRJXHWH.jsView on unpkg · L1

dist/index.jsView file

93} L94: `),Ea="Failed to connect to Ripplo server";async function dt({serverUrl:e,token:n}){try{let r=await d({config:W({serverUrl:e,token:n}),document:$a,variables:void 0});return r.curre... L95: `);let t=r.map(i=>it(i));process.stdout.write(t.join(` ... L105: `)}async function ht(e,n){let r=h(e).unwrapOr(void 0);r!=null&&await d({config:r,document:Ga,variables:{paused:n,projectId:r.projectId}}).catch(t=>{process.stderr.write(`Warning: c... L106: `)})}import re from"fs";import te from"path";import{input as Rt,select as Ct}from"@inquirer/prompts";import{graphql as Rl}from"gql.tada";import{exec as za,execFile as Qa}from"child... L107: `)[0]??r.message:String(r);return M.warn("Install failed (%s): %s",n,t),{cmd:n,ok:!1,reason:t}}}async function il(e){try{await ee(e);return}catch(n){return`Couldn't compile initial...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L93

Findings

4 High5 Medium5 Low

HighChild Processdist/chunk-SM6N6ZSY.js

HighSame File Env Network Executiondist/chunk-5VRJXHWH.js

HighCommand Output Exfiltrationdist/index.js

HighObfuscated

MediumDynamic Requiredist/chunk-SM6N6ZSY.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/chunk-SM6N6ZSY.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

4`};return{diagnostics:P.formatDiagnosticsWithColorAndContext(s,l).split(`

5`).filter(d=>d.length>0),ok:!1}}function Pt(e,n){let t=e.file?.fileName;return t==null?!0:t.startsWith(n)}var Ct=M.join(".local","tsbuildinfo");function Tt(e){return

6`)}function Pa(){return`${T} is up to date`}function Ca(e){return[`${T} is ${e==="missing"?"missing":"out of date"} \u2014 run \`npx ripplo compile\` and commit the result`,j("setup")].join(`

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-SM6N6ZSY.jsView on unpkg · L4

7`)}function Ta(){return`Wrote ${T}`}function qt(e){switch(e.kind){case"typecheck-failed":return["TypeScript errors in .ripplo/:",...cn(e.diagnostics)].join(`

9`);case"load-threw":return[`.ripplo/index.ts threw while loading: ${e.message}`,"Usually a bad import or a top-level throw in .ripplo/ \u2014 run `npx ripplo compile` for the stack."].join(`

10`);case"fixture-failed":return Ht(e.error)}}function cn(e,n=8){return e.length<=n?e:[...e.slice(0,n),`\u2026 and ${String(e.length-n)} more`]}function Ht(

11`);case"project-file-invalid":return[`${e.path} is invalid:`,...e.issues.map(n=>` ${n}`),"Fix the file by hand or re-run `npx ripplo init`."].join(`

12`);case"not-authenticated":return["Not signed in. Run `npx ripplo auth login`.","(Claude Code: run it yourself in the background \u2014 the user just approves in the browser.)"].join(`

18 mutation SyncDevSession(

19 $projectId: String!

20 $cwd: String!

21 $branch: String

22 $lockfileContent: String

23 $fixtures: [SyncDevFixtureInput!]

24 $preconditions: [SyncDevPreconditionInput!]!

Long lines were clipped for display.

Lines 68-108javascript

68 code

69 }

70 }

71 }

73 query DaemonWorkflows($projectId: String!, $cwd: String!) {

74 project(id: $projectId) {

75 id

76 devSession(cwd: $cwd) {

77 id

78 workflows {

dist/chunk-5VRJXHWH.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{a as q}from"./chunk-IHSHBPJY.js";import{b as G}from"./chunk-7UWDMECF.js";import{execFileSync as O}from"child_process";import U from"fs";import p from"path";function F(e){let

dist/index.jsView file

Lines 73-113javascript

73 }

75`)}}}async function ot(e){let n=Re(e),r=