registry / terse-cli / 0.2.5

terse-cli@0.2.5

CLI for scaffolding, testing, and deploying [Terse](https://useterse.ai) workflows.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 122 file(s), 678 KB of source, external domains: api.useterse.ai, api.workos.com, app.useterse.ai, docs.useterse.ai, github.com, pypi.org, raw.githubusercontent.com, registry.npmjs.org, your-app.example.com

Source & flagged code

3 flagged

dist/providers/typescript/durableRuntime.jsView file

Lines 1-39javascript

1import crypto from "node:crypto";

2import fs from "node:fs";

3import { createRequire } from "node:module";

4import path from "node:path";

5import { __buildJobStateAccessor, createSDKTrigger, fetchRegisteredJobs } from "terse-sdk";

6import { getRun, resumeHook, start } from "workflow/api";

7import { setWorld } from "workflow/runtime";

8import { createTerseWorld } from "../../terseWorld.js";

9import { transformJobSource } from "./jobMacro.js";

10import { TerseWorkflowBuilder } from "./terseWorkflowBuilder.js";

11let runtimePromise = null;

12export function getDurableRuntime(cwd = process.cwd()) {

13 return (runtimePromise ??= startDurableRuntime(cwd));

14}

15async function startDurableRuntime(cwd) {

16 const out = path.join(cwd, ".terse", "wf");

17 const workflowFnByJob = isBuildFresh(out, cwd) ? loadWorkflowArtifacts(out) : await buildWorkflowArtifacts(cwd);

18 const world = createTerseWorld();

19 setWorld(world);

20 const require = createRequire(import.meta.url);

21 world.registerHandler("__wkf_step_", require(path.join(out, "steps.cjs")).POST);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/providers/typescript/durableRuntime.jsView on unpkg · L19

22 world.registerHandler("__wkf_workflow_", require(path.join(out, "workflows.cjs")).POST);

23 const manifest = JSON.parse(fs.readFileSync(path.join(out, "manifest.json"), "utf8"));

24 const workflowIdByJob = new Map();

25 const missing = [];

26 for (const [name, { fnName, file }] of workflowFnByJob) {

27 const workflowId = lookupWorkflowId(manifest, fnName);

28 if (workflowId)

29 workflowIdByJob.set(name, workflowId);

30 else

31 missing.push({ name, file });

32 }

33 if (missing.length > 0) {

34 const lines = missing.map(m => ` - "${m.name}" (${m.file})`).join("\n");

35 throw new Error(`The durable build produced no "use workflow" for ${missing.length} job(s):\n${lines}\n\nEach file was transformed but its workflow never reached the manifest, which almost always means the file failed to compile during the bundle. Check that each file builds on its own, then re-run.`);

36 }

37 // start() re-enqueues recovered (pending/running) runs and begins draining the queue.

38 // It is NOT called during construction: a hook-resume must journal its payload first,

39 // or the re-enqueued replay races the payload write, re-arms the raced sleep, and

dist/commands/target.jsView file

Lines 1-28javascript

1import { confirm, isCancel } from "@clack/prompts";

2import chalk from "chalk";

3import fs from "node:fs";

4import os from "node:os";

5import path from "node:path";

6import

dist/auth.jsView file

Lines 1-22javascript

1import { confirm } from "@inquirer/prompts";

2import chalk from "chalk";

3import { exec } from "node:child_process";

4import fs from "node:fs";

5import path from "node:path";

6import

Source & flagged code

3 flagged · loading source

dist/providers/typescript/durableRuntime.jsView file

19setWorld(world); L20: const require = createRequire(import.meta.url); L21: world.registerHandler("__wkf_step_", require(path.join(out, "steps.cjs")).POST);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/providers/typescript/durableRuntime.jsView on unpkg · L19

dist/commands/target.jsView file

8const BLOCK_END = "# <<< terse target <<<"; L9: const LOCAL_BACKEND_URL = "http://localhost:3001"; L10: const LOCAL_FRONTEND_URL = "http://localhost:5173"; L11: export function targetStatus() { L12: const backendEnv = process.env.TERSE_BACKEND_URL; L13: const frontendEnv = process.env.TERSE_FRONTEND_URL; ... L34: if (!rcPath) { L35: console.log(chalk.yellow("Could not detect a shell rc file (~/.zshrc or ~/.bashrc).")); L36: console.log("Add these lines to your shell config manually:\n"); ... L110: const shell = process.env.SHELL ?? ""; L111: const home = os.homedir(); L112: if (shell.includes("zsh"))

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/target.jsView on unpkg · L8

dist/auth.jsView file

2import chalk from "chalk"; L3: import { exec } from "node:child_process"; L4: import fs from "node:fs"; ... L9: import { BACKEND_URL, WORKOS_CLIENT_ID } from "./config.js"; L10: const DEVICE_AUTH_URL = "https://api.workos.com/user_management/authorize/device"; L11: const TOKEN_URL = "https://api.workos.com/user_management/authenticate"; ... L16: function openInBrowser(url) { L17: const platform = process.platform; L18: const cmd = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open"; ... L24: headers: { "Content-Type": "application/x-www-form-urlencoded" }, L25: body: new URLSearchParams({ client_id: WORKOS_CLIENT_ID }) L26: });

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/auth.jsView on unpkg · L2

Findings

1 High5 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/auth.js

MediumDynamic Requiredist/providers/typescript/durableRuntime.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/commands/target.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/providers/typescript/durableRuntime.jsView file

Lines 1-39javascript

1import crypto from "node:crypto";

2import fs from "node:fs";

3import { createRequire } from "node:module";

4import path from "node:path";

5import { __buildJobStateAccessor, createSDKTrigger, fetchRegisteredJobs } from "terse-sdk";

6import { getRun, resumeHook, start } from "workflow/api";

7import { setWorld } from "workflow/runtime";

8import { createTerseWorld } from "../../terseWorld.js";

9import { transformJobSource } from "./jobMacro.js";

10import { TerseWorkflowBuilder } from "./terseWorkflowBuilder.js";

11let runtimePromise = null;

12export function getDurableRuntime(cwd = process.cwd()) {

13 return (runtimePromise ??= startDurableRuntime(cwd));

14}

15async function startDurableRuntime(cwd) {

16 const out = path.join(cwd, ".terse", "wf");

17 const workflowFnByJob = isBuildFresh(out, cwd) ? loadWorkflowArtifacts(out) : await buildWorkflowArtifacts(cwd);

18 const world = createTerseWorld();

19 setWorld(world);

20 const require = createRequire(import.meta.url);

21 world.registerHandler("__wkf_step_", require(path.join(out, "steps.cjs")).POST);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/providers/typescript/durableRuntime.jsView on unpkg · L19

22 world.registerHandler("__wkf_workflow_", require(path.join(out, "workflows.cjs")).POST);

23 const manifest = JSON.parse(fs.readFileSync(path.join(out, "manifest.json"), "utf8"));

24 const workflowIdByJob = new Map();

25 const missing = [];

26 for (const [name, { fnName, file }] of workflowFnByJob) {

27 const workflowId = lookupWorkflowId(manifest, fnName);

28 if (workflowId)

29 workflowIdByJob.set(name, workflowId);

30 else

31 missing.push({ name, file });

32 }

33 if (missing.length > 0) {

34 const lines = missing.map(m => ` - "${m.name}" (${m.file})`).join("\n");

36 }

37 // start() re-enqueues recovered (pending/running) runs and begins draining the queue.

38 // It is NOT called during construction: a hook-resume must journal its payload first,

39 // or the re-enqueued replay races the payload write, re-arms the raced sleep, and

dist/commands/target.jsView file

Lines 1-28javascript

1import { confirm, isCancel } from "@clack/prompts";

2import chalk from "chalk";

3import fs from "node:fs";

4import os from "node:os";

5import path from "node:path";

6import

dist/auth.jsView file

Lines 1-22javascript

1import { confirm } from "@inquirer/prompts";

2import chalk from "chalk";

3import { exec } from "node:child_process";

4import fs from "node:fs";

5import path from "node:path";

6import