registry / soloforge / 1.1.142

soloforge@1.1.142

AI-driven development workflow system - 结构化交付闭环(需求→设计→切片→实现→验证→审查→交付),保证流程与证据可追溯;业务语义正确性仍依赖使用者判断,非自动替代高级工程师

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 227 file(s), 1.44 MB of source

Source & flagged code

4 flagged

dist/context/engine/views/file_impact.jsView file

Lines 1-28javascript

1/**

2 * File Impact — 上下文引擎模块。

3 *

4 * 职责边界：

5 * - 负责：FileRefInfo 等上下文引擎职责

6 * - 不负责：不属于本模块的职责由对应模块承担

7 *

8 * 被谁调用：管线上下文解析、视图查询

9 * 调用谁：node:fs、node:path、node:child_process、view_registry、logger

10 *

High

Child Process

Package source references child process execution.

dist/context/engine/views/file_impact.jsView on unpkg · L8

11 * 数据流：输入 → FileRefInfo 处理 → 输出

12 * 持久化：读写本地文件（详见代码内路径）

13 */

14import fs from "node:fs";

15import path from "node:path";

16import { execFileSync } from "node:child_process";

17import { debug } from "../../../shared/logger.js";

18// ── 辅助函数 ──

19/** 判断文件路径是否为测试文件 */

20function isTestFile(filePath) {

21 return /(?:test|spec|__tests__)[./]/i.test(filePath);

22}

23/** 从文件路径提取模块名（不含扩展名和目录） */

24function extractModuleName(filePath) {

25 const base = path.basename(filePath, path.extname(filePath));

26 // index 文件取父目录名

27 if (base === "index") {

28 return path.basename(path.dirname(filePath));

dist/core/doctor_service.jsView file

Lines 8-48javascript

8 * 被谁调用：server/tools/sf_doctor 与 cli/doctor

9 * 调用谁：任务、验证、waiver、知识、探针和资产注册表的只读查询接口

10 *

11 * 数据流：projectRoot → 各 check 读状态/门禁/探针 → 聚合 DoctorReport（纯数据，不写盘）

dist/gate/release/gate_checks/checkTemplateKnowledgeHygiene.jsView file

Lines 16-54javascript

16 const absolutePath = path.join(directory, entry.name);

17 if (entry.isDirectory()) {

18 scanScaffolds(absolutePath);

19 continue;

dist/gate/release/release_readiness_gate.jsView file

Lines 24-64javascript

24import { execFileSync } from "node:child_process";

25import fss from "node:fs";

26import { sortReleaseCandidates } from "./release_candidate_utils.js";

27// ── TypeScript 编译检查 ──

28/**

Source & flagged code

4 flagged · loading source

dist/context/engine/views/file_impact.jsView file

8* 被谁调用：管线上下文解析、视图查询 L9: * 调用谁：node:fs、node:path、node:child_process、view_registry、logger L10: *

High

Child Process

Package source references child process execution.

dist/context/engine/views/file_impact.jsView on unpkg · L8

dist/core/doctor_service.jsView file

28import { existsSync, readdirSync, readFileSync } from "node:fs"; L29: import { execa } from "execa"; L30: import { extractManagedHookSub } from "../shared/hook_command.js";

High

Shell

Package source references shell execution.

dist/core/doctor_service.jsView on unpkg · L28

dist/gate/release/gate_checks/checkTemplateKnowledgeHygiene.jsView file

36throw new Error("dist/ 目录不存在"); L37: const contractMod = await import(path.join(distDir, "domain", "asset_registry", "template_asset_contract_registry.js")); L38: const contracts = contractMod.listTemplateAssetContracts?.() ?? [];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/gate/release/gate_checks/checkTemplateKnowledgeHygiene.jsView on unpkg · L36

dist/gate/release/release_readiness_gate.jsView file

44try { L45: execFileSync("npx", ["tsc", "--noEmit"], { cwd: distDir, encoding: "utf-8", timeout: 120_000, stdio: ["pipe", "pipe", "pipe"] }); L46: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/gate/release/release_readiness_gate.jsView on unpkg · L44

Findings

3 High4 Medium4 Low

HighChild Processdist/context/engine/views/file_impact.js

HighShelldist/core/doctor_service.js

HighRuntime Package Installdist/gate/release/release_readiness_gate.js

MediumDynamic Requiredist/gate/release/gate_checks/checkTemplateKnowledgeHygiene.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

dist/context/engine/views/file_impact.jsView file

Lines 1-28javascript

1/**

2 * File Impact — 上下文引擎模块。

3 *

4 * 职责边界：

5 * - 负责：FileRefInfo 等上下文引擎职责

6 * - 不负责：不属于本模块的职责由对应模块承担

7 *

8 * 被谁调用：管线上下文解析、视图查询

9 * 调用谁：node:fs、node:path、node:child_process、view_registry、logger

10 *

High

Child Process

Package source references child process execution.

dist/context/engine/views/file_impact.jsView on unpkg · L8

11 * 数据流：输入 → FileRefInfo 处理 → 输出

12 * 持久化：读写本地文件（详见代码内路径）

13 */

14import fs from "node:fs";

15import path from "node:path";

16import { execFileSync } from "node:child_process";

17import { debug } from "../../../shared/logger.js";

18// ── 辅助函数 ──

19/** 判断文件路径是否为测试文件 */

20function isTestFile(filePath) {

21 return /(?:test|spec|__tests__)[./]/i.test(filePath);

22}

23/** 从文件路径提取模块名（不含扩展名和目录） */

24function extractModuleName(filePath) {

25 const base = path.basename(filePath, path.extname(filePath));

26 // index 文件取父目录名

27 if (base === "index") {

28 return path.basename(path.dirname(filePath));

dist/core/doctor_service.jsView file

Lines 8-48javascript

8 * 被谁调用：server/tools/sf_doctor 与 cli/doctor

9 * 调用谁：任务、验证、waiver、知识、探针和资产注册表的只读查询接口

10 *

11 * 数据流：projectRoot → 各 check 读状态/门禁/探针 → 聚合 DoctorReport（纯数据，不写盘）

dist/gate/release/gate_checks/checkTemplateKnowledgeHygiene.jsView file

Lines 16-54javascript

16 const absolutePath = path.join(directory, entry.name);

17 if (entry.isDirectory()) {

18 scanScaffolds(absolutePath);

19 continue;

dist/gate/release/release_readiness_gate.jsView file

Lines 24-64javascript

24import { execFileSync } from "node:child_process";

25import fss from "node:fs";

26import { sortReleaseCandidates } from "./release_candidate_utils.js";

27// ── TypeScript 编译检查 ──

28/**