registry / soloforge / 1.1.138

soloforge@1.1.138

AI-driven development workflow system - one person does the work of a five-person team

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 223 file(s), 1.37 MB of source

Source & flagged code

4 flagged

dist/context/engine/views/file_impact.jsView file

Lines 1-28javascript

1/**

2 * File Impact — 上下文引擎模块。

3 *

4 * 职责边界：

5 * - 负责：FileRefInfo 等上下文引擎职责

6 * - 不负责：不属于本模块的职责由对应模块承担

7 *

8 * 被谁调用：管线上下文解析、视图查询

9 * 调用谁：node:fs、node:path、node:child_process、view_registry、logger

10 *

High

Child Process

Package source references child process execution.

dist/context/engine/views/file_impact.jsView on unpkg · L8

11 * 数据流：输入 → FileRefInfo 处理 → 输出

12 * 持久化：读写本地文件（详见代码内路径）

13 */

14import fs from "node:fs";

15import path from "node:path";

16import { execFileSync } from "node:child_process";

17import { debug } from "../../../shared/logger.js";

18// ── 辅助函数 ──

19/** 判断文件路径是否为测试文件 */

20function isTestFile(filePath) {

21 return /(?:test|spec|__tests__)[./]/i.test(filePath);

22}

23/** 从文件路径提取模块名（不含扩展名和目录） */

24function extractModuleName(filePath) {

25 const base = path.basename(filePath, path.extname(filePath));

26 // index 文件取父目录名

27 if (base === "index") {

28 return path.basename(path.dirname(filePath));

dist/core/doctor_service.jsView file

Lines 8-48javascript

8 * 被谁调用：server/tools/sf_doctor 与 cli/doctor

9 * 调用谁：任务、验证、waiver、知识、探针和资产注册表的只读查询接口

10 *

11 * 数据流：projectRoot → 各 check 读状态/门禁/探针 → 聚合 DoctorReport（纯数据，不写盘）

12 * 持久化：只读（.soloforge/state、reviews、gates、knowledge、内置 templates），不写盘

13 *

dist/gate/release/gate_checks/checkTemplateKnowledgeHygiene.jsView file

Lines 16-54javascript

16 const absolutePath = path.join(directory, entry.name);

17 if (entry.isDirectory()) {

18 scanScaffolds(absolutePath);

19 continue;

20 }

21 if (!entry.

Source & flagged code

4 flagged · loading source

dist/context/engine/views/file_impact.jsView file

8* 被谁调用：管线上下文解析、视图查询 L9: * 调用谁：node:fs、node:path、node:child_process、view_registry、logger L10: *

High

Child Process

Package source references child process execution.

dist/context/engine/views/file_impact.jsView on unpkg · L8

dist/core/doctor_service.jsView file

28import { existsSync, readdirSync, readFileSync } from "node:fs"; L29: import { execa } from "execa"; L30: import { resolveConfig } from "../context/config/resolver.js";

High

Shell

Package source references shell execution.

dist/core/doctor_service.jsView on unpkg · L28

192* .mcp.json 硬编码 command:"soloforge"，若 PATH 找不到（npx/nvm/finder 启动致子进程 PATH 与 shell 不同），MCP 连接会失败且难定位。 L193: * 复刻 checkProbes 的 execa 模式（跨平台、不经 shell）。 */ L194: async function checkCommand() { ... L201: ? `soloforge 命令可解析${result.version ? `（${result.version}）` : ""}。` L202: : `⚠️ soloforge 命令在 PATH 中不可解析——Claude Code 启动 MCP 子进程可能找不到它，MCP 连接会失败。检查 npm install -g 安装或子进程 PATH。${result.error ? `（${result.error}）` : ""}`, L203: };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/doctor_service.jsView on unpkg · L192

dist/gate/release/gate_checks/checkTemplateKnowledgeHygiene.jsView file

36throw new Error("dist/ 目录不存在"); L37: const contractMod = await import(path.join(distDir, "domain", "asset_registry", "template_asset_contract_registry.js")); L38: const contracts = contractMod.listTemplateAssetContracts?.() ?? [];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/gate/release/gate_checks/checkTemplateKnowledgeHygiene.jsView on unpkg · L36

Findings

3 High4 Medium4 Low

HighChild Processdist/context/engine/views/file_impact.js

HighShelldist/core/doctor_service.js

HighRuntime Package Installdist/core/doctor_service.js

MediumDynamic Requiredist/gate/release/gate_checks/checkTemplateKnowledgeHygiene.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

dist/context/engine/views/file_impact.jsView file

Lines 1-28javascript

1/**

2 * File Impact — 上下文引擎模块。

3 *

4 * 职责边界：

5 * - 负责：FileRefInfo 等上下文引擎职责

6 * - 不负责：不属于本模块的职责由对应模块承担

7 *

8 * 被谁调用：管线上下文解析、视图查询

9 * 调用谁：node:fs、node:path、node:child_process、view_registry、logger

10 *

High

Child Process

Package source references child process execution.

dist/context/engine/views/file_impact.jsView on unpkg · L8

11 * 数据流：输入 → FileRefInfo 处理 → 输出

12 * 持久化：读写本地文件（详见代码内路径）

13 */

14import fs from "node:fs";

15import path from "node:path";

16import { execFileSync } from "node:child_process";

17import { debug } from "../../../shared/logger.js";

18// ── 辅助函数 ──

19/** 判断文件路径是否为测试文件 */

20function isTestFile(filePath) {

21 return /(?:test|spec|__tests__)[./]/i.test(filePath);

22}

23/** 从文件路径提取模块名（不含扩展名和目录） */

24function extractModuleName(filePath) {

25 const base = path.basename(filePath, path.extname(filePath));

26 // index 文件取父目录名

27 if (base === "index") {

28 return path.basename(path.dirname(filePath));

dist/core/doctor_service.jsView file

Lines 8-48javascript

8 * 被谁调用：server/tools/sf_doctor 与 cli/doctor

9 * 调用谁：任务、验证、waiver、知识、探针和资产注册表的只读查询接口

10 *

11 * 数据流：projectRoot → 各 check 读状态/门禁/探针 → 聚合 DoctorReport（纯数据，不写盘）

12 * 持久化：只读（.soloforge/state、reviews、gates、knowledge、内置 templates），不写盘

13 *

dist/gate/release/gate_checks/checkTemplateKnowledgeHygiene.jsView file

Lines 16-54javascript

16 const absolutePath = path.join(directory, entry.name);

17 if (entry.isDirectory()) {

18 scanScaffolds(absolutePath);

19 continue;

20 }

21 if (!entry.

Lines 172-212javascript

172 const { rules, errors } = loadProjectProbeRules(projectRoot);

173 const needTools = new Set();

174 for (const r of rules) {

175 if (r.probe_kind === "semgrep")

176 needTools.add("semgrep");

177 if (r.probe_kind === "rego")

178 needTools.add("opa");

179 }

180 const missing = [];

181 for (const t of needTools) {

182 try {

183 await execa(t, ["--version"], { reject: true });

184 }

185 catch {

186 missing.push(t);

187 }

188 }

189 return { total: rules.length, errors, missing_tools: missing };

190}

191/** 检查 soloforge 命令是否在 PATH 可解析——MCP 子进程能否启动。

192 * .mcp.json 硬编码 command:"soloforge"，若 PATH 找不到（npx/nvm/finder 启动致子进程 PATH 与 shell 不同），MCP 连接会失败且难定位。

193 * 复刻 checkProbes 的 execa 模式（跨平台、不经 shell）。 */

194async function checkCommand() {

195 const result = await checkCommandResolvable();

196 return {

197 check_type: "command",

198 success: true,

199 command: result,

200 message: result.resolved

201 ? `soloforge 命令可解析${result.version ? `（${result.version}）` : ""}。`

202 : `⚠️ soloforge 命令在 PATH 中不可解析——Claude Code 启动 MCP 子进程可能找不到它，MCP 连接会失败。检查 npm install -g 安装或子进程 PATH。${result.error ? `（${result.error}）` : ""}`,

203 };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/doctor_service.jsView on unpkg · L192

204}

205async function checkCommandResolvable() {

206 try {

207 const { stdout } = await execa("soloforge", ["--version"], { reject: true });

208 return { resolved: true, version: stdout.trim() || undefined };

209 }

210 catch (err) {

211 return { resolved: false, error: err instanceof Error ? err.message : String(err) };

212 }