registry / session-orchestrator / 3.16.0

session-orchestrator@3.16.0

Loop engineering for AI coding agents — turn ad-hoc sessions into a repeatable research → plan → wave-execute → close loop with verification gates. Runs on Claude Code, Codex CLI, Cursor, and Pi.

Static Scan Results

scanned 20h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 419 file(s), 3.66 MB of source, external domains: github.com, gitlab.com, json.schemastore.org

Source & flagged code

11 flagged

scripts/lib/validate/check-test-fixture-shapes.mjsView file

Lines 1-41javascript

1#!/usr/bin/env node

2// @secret-shape-allowed

3// (Self-application: this file is the validator itself — it defines the

4// forbidden credential-shape regex literals and the canonical placeholder

5// substrings. Eating own dog food per #558 M3 — magic-comment replaces

6// the previous hardcoded SELF_EXCLUSIONS Set.)

7/**

8 * check-test-fixture-shapes.mjs — Scan tests/ tracked files for live-credential

9 * shape patterns that would block a public GitHub-mirror push.

10 *

11 * Implements issue #556 (release-day blocker — fixture-shape validator).

12 *

13 * Forbidden patterns:

14 * F1 /sk_live_[A-Za-z0-9]{24,}/ — Stripe live secret key

15 * F2 /xoxb-\d{6,}/ — Slack bot token (digit-prefix form)

16 * F3 /AKIA[A-Z0-9]{16}/ — AWS access key

17 * F4 /AIzaSy[A-Za-z0-9_-]{33}/ — Google API key

18 *

19 * Allowlist (hard-coded — these strings are recommended placeholders or

20 * documentation canonical examples that MUST NOT be blocked):

21 * - AKIAIOSFODNN7EXAMPLE (AWS docs canonical example — appears in

Critical

Critical Secret

Package contains a critical-looking secret pattern.

scripts/lib/validate/check-test-fixture-shapes.mjsView on unpkg · L21

Critical

Secret Pattern

AWS access key ID in scripts/lib/validate/check-test-fixture-shapes.mjs

scripts/lib/validate/check-test-fixture-shapes.mjsView on unpkg · L21

22 * tests/unit/quality-gate-diagnostics.test.mjs)

23 * - sk_test_<...> (Stripe test-mode prefix — the suggested

24 * replacement for sk_live_)

25 * - xoxb-PLACEHOLDER (canonical Slack placeholder)

26 * - AIzaSy-PLACEHOLDER (canonical Google API placeholder)

27 *

28 * Per-file allowlist:

29 * - // @secret-shape-allowed magic comment in first 5 lines of file

30 * opts that file out of all pattern checks. Use for fixtures that

31 * intentionally test secret scanners.

32 *

33 * Scope:

34 * Only tracked files under tests/ matching *.{mjs,ts,js}.

35 * Snapshot files (*.snap) are excluded.

36 * Production source (scripts/, hooks/, skills/, etc.) is NOT scanned —

37 * gitleaks / .gitleaks.toml handles that surface.

38 *

39 * Exit codes:

40 * 0 — all checks passed

41 * 1 — at least one violation found

Lines 63-160javascript

64// ---------------------------------------------------------------------------

65// Forbidden patterns (with hints)

66// ---------------------------------------------------------------------------

68/** @type {Array<{name: string, regex: RegExp, hint: string}>} */

69const PATTERNS = [

70 {

71 name: 'F1 (Stripe sk_live_)',

scripts/measure-policy-cache-effectiveness.mjsView file

Lines 130-170javascript

130// Setup: create a tmpdir repo with a seeded cache record

131// ---------------------------------------------------------------------------

132

133function setupTmpRepo() {

134 const tmpRepo = mkdtempSync(join(tmpdir(), 'pce-repo-'

scripts/lib/reconcile/renderer.mjsView file

Lines 1-21javascript

1/**

2 * renderer.mjs — Reconciliation-engine rule renderer (Epic #693 FA2, issue #695).

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/lib/reconcile/renderer.mjsView on unpkg · L1

3 *

4 * Turns an eligible learning + its activation-metadata (from the sibling

5 * {@link module:reconcile/emitter.toActivationMetadata}) into a complete,

6 * loader-parseable `.claude/rules/<slug>.md` markdown document.

hooks/agent-teams-h3-test.shView file

•path = hooks/agent-teams-h3-test.sh kind = build_helper sizeBytes = 14905 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/agent-teams-h3-test.shView on unpkg

templates/python-uv/tests/test_sanity.pyView file

•path = templates/python-uv/tests/test_sanity.py kind = payload_in_excluded_dir sizeBytes = 49 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/python-uv/tests/test_sanity.pyView on unpkg

skills/repo-audit/SKILL.mdView file

105patternName = aws_access_key severity = critical line = 105 matchedText = | No PAT...t. |

Critical

Secret Pattern

AWS access key ID in skills/repo-audit/SKILL.md

skills/repo-audit/SKILL.mdView on unpkg · L105

Source & flagged code

11 flagged · loading source

scripts/lib/validate/check-test-fixture-shapes.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code