registry / soloforge / 1.1.112

soloforge@1.1.112

AI-driven development workflow system - one person does the work of a five-person team

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 326 file(s), 2.54 MB of source, external domains: opencode.ai

Source & flagged code

5 flagged

dist/context/engine/views/file_impact.jsView file

Lines 1-28javascript

1/**

2 * File Impact — 上下文引擎模块。

3 *

4 * 职责边界：

5 * - 负责：FileRefInfo 等上下文引擎职责

6 * - 不负责：不属于本模块的职责由对应模块承担

7 *

8 * 被谁调用：管线上下文解析、视图查询

9 * 调用谁：node:fs、node:path、node:child_process、view_registry、logger

10 *

High

Child Process

Package source references child process execution.

dist/context/engine/views/file_impact.jsView on unpkg · L8

11 * 数据流：输入 → FileRefInfo 处理 → 输出

12 * 持久化：读写本地文件（详见代码内路径）

13 */

14import fs from "node:fs";

15import path from "node:path";

16import { execFileSync } from "node:child_process";

17import { debugLog } from "../../../shared/logger.js";

18// ── 辅助函数 ──

19/** 判断文件路径是否为测试文件 */

20function isTestFile(filePath) {

21 return /(?:test|spec|__tests__)[./]/i.test(filePath);

22}

23/** 从文件路径提取模块名（不含扩展名和目录） */

24function extractModuleName(filePath) {

25 const base = path.basename(filePath, path.extname(filePath));

26 // index 文件取父目录名

27 if (base === "index") {

28 return path.basename(path.dirname(filePath));

dist/core/doctor_service.jsView file

Lines 9-49javascript

9 * 调用谁：task_context、gate_record_store、waiver_store、git_utils、domain/engine_helpers、observer、domain/index（ALL_CONTRACTS）、gate/gate_engine、gate_registry_bridge、verify/audit/probe_rule、derived_registry

10 *

11 * 数据流：projectRoot → 各 check 读状态/门禁/探针 → 聚合 DoctorReport（纯数据，不写盘）

12 * 持久化：只读（.soloforge/state、reviews、gates、knowledge、内置 templates），不写盘

dist/gate/release/gate_checks/checkWorkflowNavigation.jsView file

Lines 7-47javascript

7 *

8 * 被谁调用：发布工具（sf_release）、门禁

9 * 调用谁：node:path、node:fs、node:os、types、workflow_navigation_contract、helpers

10 *

11 * 数据流：项目状态 → 门禁检查 → 发布决策

12 * 持久化：读写本地文件（详见代码内路径）

13 */

dist/verify/audit/probe_executor.jsView file

Lines 89-129javascript

89 const tmpDir = mkdtempSync(join(tmpdir(), "soloforge-rego-"));

90 try {

91 const inputPath = join(tmpDir, "input.json");

92 writeFileSync(inputPath, buildRegoInput

dist/verify/contracts/code_maintainability_observability_contract.jsView file

Lines 64-104javascript

64 .filter((p) => p.length > 0);

65}

66function hasNearbyChineseLineComment(lines, lineIndex) {

67 const nearby = lines.slice(Math.max

Source & flagged code

5 flagged · loading source

dist/context/engine/views/file_impact.jsView file

8* 被谁调用：管线上下文解析、视图查询 L9: * 调用谁：node:fs、node:path、node:child_process、view_registry、logger L10: *

High

Child Process

Package source references child process execution.

dist/context/engine/views/file_impact.jsView on unpkg · L8

dist/core/doctor_service.jsView file

29import { existsSync, readdirSync, readFileSync } from "node:fs"; L30: import { execa } from "execa"; L31: function projectContracts(projectRoot) {

High

Shell

Package source references shell execution.

dist/core/doctor_service.jsView on unpkg · L29

dist/gate/release/gate_checks/checkWorkflowNavigation.jsView file

27// 2. 核心导出存在性 L28: // eslint-disable-next-line @typescript-eslint/consistent-type-imports -- 动态导入需要 typeof import() 类型声明 L29: let nav;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/gate/release/gate_checks/checkWorkflowNavigation.jsView on unpkg · L27

dist/verify/audit/probe_executor.jsView file

109async execute(rule, _ctx) { L110: const { exitCode, stdout, stderr } = await execa("npx", ["vitest", "run", rule.probe_payload], { L111: reject: false,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/verify/audit/probe_executor.jsView on unpkg · L109

dist/verify/contracts/code_maintainability_observability_contract.jsView file

84patternName = generic_password severity = medium line = 84 matchedText = // logge..., t)

Medium

Secret Pattern

Hardcoded password in dist/verify/contracts/code_maintainability_observability_contract.js

dist/verify/contracts/code_maintainability_observability_contract.jsView on unpkg · L84

Findings

3 High5 Medium5 Low

HighChild Processdist/context/engine/views/file_impact.js

HighShelldist/core/doctor_service.js

HighRuntime Package Installdist/verify/audit/probe_executor.js

MediumDynamic Requiredist/gate/release/gate_checks/checkWorkflowNavigation.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/verify/contracts/code_maintainability_observability_contract.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/context/engine/views/file_impact.jsView file

Lines 1-28javascript

1/**

2 * File Impact — 上下文引擎模块。

3 *

4 * 职责边界：

5 * - 负责：FileRefInfo 等上下文引擎职责

6 * - 不负责：不属于本模块的职责由对应模块承担

7 *

8 * 被谁调用：管线上下文解析、视图查询

9 * 调用谁：node:fs、node:path、node:child_process、view_registry、logger

10 *

High

Child Process

Package source references child process execution.

dist/context/engine/views/file_impact.jsView on unpkg · L8

11 * 数据流：输入 → FileRefInfo 处理 → 输出

12 * 持久化：读写本地文件（详见代码内路径）

13 */

14import fs from "node:fs";

15import path from "node:path";

16import { execFileSync } from "node:child_process";

17import { debugLog } from "../../../shared/logger.js";

18// ── 辅助函数 ──

19/** 判断文件路径是否为测试文件 */

20function isTestFile(filePath) {

21 return /(?:test|spec|__tests__)[./]/i.test(filePath);

22}

23/** 从文件路径提取模块名（不含扩展名和目录） */

24function extractModuleName(filePath) {

25 const base = path.basename(filePath, path.extname(filePath));

26 // index 文件取父目录名

27 if (base === "index") {

28 return path.basename(path.dirname(filePath));

dist/core/doctor_service.jsView file

Lines 9-49javascript

10 *

11 * 数据流：projectRoot → 各 check 读状态/门禁/探针 → 聚合 DoctorReport（纯数据，不写盘）

12 * 持久化：只读（.soloforge/state、reviews、gates、knowledge、内置 templates），不写盘

dist/gate/release/gate_checks/checkWorkflowNavigation.jsView file

Lines 7-47javascript

7 *

8 * 被谁调用：发布工具（sf_release）、门禁

9 * 调用谁：node:path、node:fs、node:os、types、workflow_navigation_contract、helpers

10 *

11 * 数据流：项目状态 → 门禁检查 → 发布决策

12 * 持久化：读写本地文件（详见代码内路径）

13 */

dist/verify/audit/probe_executor.jsView file

Lines 89-129javascript

89 const tmpDir = mkdtempSync(join(tmpdir(), "soloforge-rego-"));

90 try {

91 const inputPath = join(tmpDir, "input.json");

92 writeFileSync(inputPath, buildRegoInput

dist/verify/contracts/code_maintainability_observability_contract.jsView file

Lines 64-104javascript

64 .filter((p) => p.length > 0);

65}

66function hasNearbyChineseLineComment(lines, lineIndex) {

67 const nearby = lines.slice(Math.max