registry / roadmapped / 0.1.0

roadmapped@0.1.0

Project management as flat files in your repo — YAML tasks, a computed roadmap, driven by your AI agent through a CLI and a Claude skill. No database, no SaaS, no account.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 65 file(s), 1.85 MB of source, external domains: base-ui.com, github.com, reactjs.org, www.w3.org

Source & flagged code

5 flagged

bin/roadmapped.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2// Dispatcher for the roadmapped package — the only published entry point (spec

3// 2026-07-08-distribution, §2). Three families of verbs:

4// init / upgrade → install plumbing in the host repo (scripts/install.mjs)

5// dashboard → Vite (dev) from the PACKAGE, data anchored to the HOST repo

6// everything else → transparent proxy to scripts/task.mjs (portable CLI:

7// `npx roadmapped done 42` works in any repo)

8//

9// NO static .ts import here: we first check the Node version (native strip-types

10// required — locked decision: we ship the raw .ts), so it fails with a clear

11// message rather than a cryptic SyntaxError.

13const [major = 0, minor = 0] = process.versions.node.split('.').map(Number)

14if (major < 22 || (major === 22 && minor < 18)) {

15 console.error(

16 `roadmapped requires Node >= 22.18 (native TypeScript imports, strip-types) — detected version: ${process.versions.node}.`,

17 )

18 process.exit(1)

19}

21const { spawnSync } = await import('node:child_process')

22const { fileURLToPath, pathToFileURL } = await import('node:url')

High

Child Process

Package source references child process execution.

bin/roadmapped.mjsView on unpkg · L20

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/roadmapped.mjsView on unpkg · L20

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/roadmapped.mjsView on unpkg · L20

23const { dirname, join, resolve } = await import('node:path')

25// Root of the PACKAGE (where this bin lives) — NOT the host repo (= cwd walked up, cf. paths.ts).

26const packageDir = resolve(dirname(fileURLToPath(import.meta.url)), '..')

27const [cmd, ...rest] = process.argv.slice(2)

29const importPkg = (rel) => import(pathToFileURL(join(packageDir, rel)).href)

31// Node refuses to strip types under node_modules: we register the amaro loader

32// BEFORE any .ts import (see scripts/register-ts.mjs). The subprocesses (task.mjs

33// proxy) get the same loader via --import.

34const registerTs = join(packageDir, 'scripts', 'register-ts.mjs')

35await import(pathToFileURL(registerTs).href)

36const nodeTs = (script, args) => [

37 '--import', registerTs, join(packageDir, 'scripts', script), ...args,

38]

40const USAGE = `Usage: roadmapped <command>

src/lib/updateNotifier.tsView file

Lines 102-143typescript

102 return { installed: installed.slice(0, 7), remote: remote.slice(0, 7) }

103 } catch {

104 return null

105 }

106}

107

108/** Ligne terminale au lancement du dashboard (#207) — dérivée de checkUpdate. */

Source & flagged code

5 flagged · loading source

bin/roadmapped.mjsView file

20L21: const { spawnSync } = await import('node:child_process') L22: const { fileURLToPath, pathToFileURL } = await import('node:url')

High

Child Process

Package source references child process execution.

bin/roadmapped.mjsView on unpkg · L20

20Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network, execution+network L20: L21: const { spawnSync } = await import('node:child_process') L22: const { fileURLToPath, pathToFileURL } = await import('node:url') ... L71: const { findHostRoot } = await importPkg('src/lib/paths.ts') L72: const envRoot = process.env.ROADMAPPED_ROOT L73: const hostRoot = envRoot && envRoot.trim() !== '' ? resolve(envRoot) : findHostRoot() ... L94: try { L95: const res = await fetch(`http://localhost:${p}/api/tree`, { signal: AbortSignal.timeout(500) }) L96: const body = res.ok ? await res.json().catch(() => null) : null L97: return body && typeof body.ok === 'boolean' && body.hostRoot === hostRoot ? p : null

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/roadmapped.mjsView on unpkg · L20

20L21: const { spawnSync } = await import('node:child_process') L22: const { fileURLToPath, pathToFileURL } = await import('node:url')

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/roadmapped.mjsView on unpkg · L20

src/lib/updateNotifier.tsView file

123const child = spawn(`npm install github:${REPO} && npx roadmapped upgrade`, { L124: cwd: hostRoot, detached: true, stdio: 'ignore', shell: true, L125: })

High

Shell

Package source references shell execution.

src/lib/updateNotifier.tsView on unpkg · L123

122function runUpdate(hostRoot: string): void { L123: const child = spawn(`npm install github:${REPO} && npx roadmapped upgrade`, { L124: cwd: hostRoot, detached: true, stdio: 'ignore', shell: true,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/lib/updateNotifier.tsView on unpkg · L122

Findings

4 High4 Medium5 Low

HighChild Processbin/roadmapped.mjs

HighShellsrc/lib/updateNotifier.ts

HighEntrypoint Build Divergencebin/roadmapped.mjs

HighRuntime Package Installsrc/lib/updateNotifier.ts

MediumDynamic Requirebin/roadmapped.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

bin/roadmapped.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2// Dispatcher for the roadmapped package — the only published entry point (spec

3// 2026-07-08-distribution, §2). Three families of verbs:

4// init / upgrade → install plumbing in the host repo (scripts/install.mjs)

5// dashboard → Vite (dev) from the PACKAGE, data anchored to the HOST repo

6// everything else → transparent proxy to scripts/task.mjs (portable CLI:

7// `npx roadmapped done 42` works in any repo)

8//

9// NO static .ts import here: we first check the Node version (native strip-types

10// required — locked decision: we ship the raw .ts), so it fails with a clear

11// message rather than a cryptic SyntaxError.

13const [major = 0, minor = 0] = process.versions.node.split('.').map(Number)

14if (major < 22 || (major === 22 && minor < 18)) {

15 console.error(

16 `roadmapped requires Node >= 22.18 (native TypeScript imports, strip-types) — detected version: ${process.versions.node}.`,

17 )

18 process.exit(1)

19}

21const { spawnSync } = await import('node:child_process')

22const { fileURLToPath, pathToFileURL } = await import('node:url')

High

Child Process

Package source references child process execution.

bin/roadmapped.mjsView on unpkg · L20

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/roadmapped.mjsView on unpkg · L20

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/roadmapped.mjsView on unpkg · L20

23const { dirname, join, resolve } = await import('node:path')

25// Root of the PACKAGE (where this bin lives) — NOT the host repo (= cwd walked up, cf. paths.ts).

26const packageDir = resolve(dirname(fileURLToPath(import.meta.url)), '..')

27const [cmd, ...rest] = process.argv.slice(2)

29const importPkg = (rel) => import(pathToFileURL(join(packageDir, rel)).href)

31// Node refuses to strip types under node_modules: we register the amaro loader

32// BEFORE any .ts import (see scripts/register-ts.mjs). The subprocesses (task.mjs

33// proxy) get the same loader via --import.

34const registerTs = join(packageDir, 'scripts', 'register-ts.mjs')

35await import(pathToFileURL(registerTs).href)

36const nodeTs = (script, args) => [

37 '--import', registerTs, join(packageDir, 'scripts', script), ...args,

38]

40const USAGE = `Usage: roadmapped <command>

src/lib/updateNotifier.tsView file

Lines 102-143typescript

102 return { installed: installed.slice(0, 7), remote: remote.slice(0, 7) }

103 } catch {

104 return null

105 }

106}

107

108/** Ligne terminale au lancement du dashboard (#207) — dérivée de checkUpdate. */