github TypeScript analyzed db9edb9

kapstanhq/agileharness

github

Um quadro de User Story Mapping que agentes operam sozinhos.

maintainer: kapstanhq
licence: Apache-2.0
first seen: 2026-09-08
last seen: 2026-09-11
releases · 30d: 0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit db9edb9 · analyzer v33 · 1w ago

skills & prompt files 25

danger signals5

dynamic code execution new Function() kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/doc/doc-shell.test.ts :45 new Function("exports", js)(exportsObj);
dynamic code execution vm exec kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/terminal/webterm-panes.test.ts :148 vm.runInNewContext(`${fonte}; __out = assignSlots;`, ctx);
committed secret Slack token kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/credential-elision-segmented.test.ts :32 xoxb-2…(41 chars, redacted)
committed secret Google API key kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/scan-secrets-blindspots.test.ts :49 AIzaSy…(39 chars, redacted)
committed secret AWS access key id kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/scan-secrets.test.ts :26 AKIA3F…(20 chars, redacted)

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1074

filesystem 276

fs kapstanhq-agileharness-db9edb9/.claude/hooks/checks/pre-edit/block-runtime-board-writes.js :72 const fs = require('fs');
fs kapstanhq-agileharness-db9edb9/.claude/hooks/checks/pre-write/guard-business-intent.js :22 const fs = require('fs');
fs kapstanhq-agileharness-db9edb9/.claude/hooks/checks/pre-write/validate-storymap-gate.js :31 const fs = require('fs');
fs kapstanhq-agileharness-db9edb9/.claude/hooks/runner.js :6 const fs = require('fs');
fs (weak) kapstanhq-agileharness-db9edb9/.claude/hooks/tests/block-runtime-board-writes.test.js :21 const fs = require('node:fs');
fs (weak) kapstanhq-agileharness-db9edb9/.claude/hooks/tests/guard-business-intent.test.js :15 const fs = require('node:fs');
fs (weak) kapstanhq-agileharness-db9edb9/.claude/hooks/tests/validate-storymap-gate.test.js :15 const fs = require("node:fs");
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/scripts/gen-icons.ts :26 import { writeFileSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/scripts/gen-qa-discovery.ts :16 import { promises as fs } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/scripts/gen-readme-logo.ts :25 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/scripts/gen-splash.ts :29 import { existsSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/scripts/qa-dev-server.ts :36 import { unlinkSync } from "node:fs";

show 28 more

fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/action-guard-exhaustiveness.test.ts :1 import { readdirSync, readFileSync } from "node:fs";
fs kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/actions.ts :115 import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/auth/login/route.test.ts :11 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/avatar/route.test.ts :12 import { promises as fs } from "node:fs";
fs kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/avatar/route.ts :2 import { mkdir, writeFile } from "node:fs/promises";
fs kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/copilot/upload/route.ts :8 import { mkdir, writeFile } from "node:fs/promises";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/design/ref/route.test.ts :2 import { promises as fs } from "node:fs";
fs kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/design/ref/route.ts :11 import { readFile } from "node:fs/promises";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/design/upload/route.test.ts :2 import { promises as fs } from "node:fs";
fs kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/design/upload/route.ts :13 import { mkdir, readdir, writeFile } from "node:fs/promises";
fs kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/feedback/shot/route.ts :26 import { mkdir, readFile, writeFile } from "node:fs/promises";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/mcp/mcp-route-perimeter.test.ts :22 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/runner/deploy-webhook/route.test.ts :3 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/runner/events/route.test.ts :10 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/runner/perimeter.test.ts :16 import { mkdtempSync, rmSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/runner/pulse/route.test.ts :14 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/runner/test-webhook/route.test.ts :3 import { mkdtempSync, rmSync } from "node:fs";
fs kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/terminal/meter/route.ts :25 import { statSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/terminal/sessions/route.test.ts :2 import { mkdtempSync, rmSync } from "node:fs";
fs kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/terminal/upload/route.ts :11 import { mkdir, writeFile } from "node:fs/promises";
fs kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/assisted-edit-actions.ts :16 import { promises as fs } from "node:fs";
fs kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/design-actions.ts :16 import { promises as fs } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/jido-animation.test.ts :44 import { readFileSync, readdirSync, statSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/safe-methods-readonly.test.ts :32 import { readdirSync, readFileSync, mkdtempSync, rmSync, writeFileSync, mkdirSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/QuickActionButton.contract.test.ts :2 import { readFileSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/cockpit-renderers.test.ts :2 import { readFileSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/doc/blocknote/adapter.test.ts :9 import { readFileSync } from "node:fs";
fs (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/doc/doc-shell.test.ts :1 import { readFileSync } from "node:fs";

236 more not shown — this panel samples each group; the count above is the real total.

shell / exec 125

shell (weak) kapstanhq-agileharness-db9edb9/.claude/hooks/tests/block-runtime-board-writes.test.js :20 const { spawnSync, spawn } = require('node:child_process');
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/next.config.js :209 // `UnhandledSchemeError: Reading from "node:child_process"`. Externalizing these
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/scripts/gen-readme-logo.ts :24 import { execFileSync } from "node:child_process";
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/scripts/gen-splash.ts :28 import { execFileSync } from "node:child_process";
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/scripts/qa-dev-server.ts :28 import { spawn, type ChildProcess } from "node:child_process";
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/actions.ts :35 import { execFile, spawn } from "node:child_process";
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/copilot/turn/route.test.ts :2 import type { ChildProcess } from "node:child_process";
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/assisted-edit-actions.ts :17 import { execFile } from "node:child_process";
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/move-autorun.test.ts :14 // The engine spy stands in for the run-skill spawn (never launches a real `claude`).
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/auth/mcp-handle-cross-process.test.ts :22 import { spawn } from "node:child_process";
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/notifications/server/channels/autorun-eval.test.ts :190 it("WS-8.1 — a recently-cancelled card is PHASE-BRAKED: the cascade does NOT spawn (both re-eval paths)", async () => {
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/notifications/server/channels/autorun-eval.ts :323 // forever). NOTE the anti-over-count invariant: recordStart fires once per ACTUAL spawn (a deduped/

show 28 more

shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/copilot/agent-session.test.ts :2 import type { ChildProcess } from "node:child_process";
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/copilot/agent-session.ts :15 import { spawn, type ChildProcess } from "node:child_process";
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/copilot/model-resolution.ts :13 // spawn (`{"type":"system","subtype":"init","model":"claude-sonnet-5"}` — verificado na CLI 2.1.220). Este
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/env-aliases.ts :23 // 2. no chokepoint de spawn (`runner/spawn-env.ts`): o env de um FILHO também sai com as duas grafias,
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/frontmatter.ts :230 * o teto ali só pode vir de um limite de buffer no spawn (`maxBuffer`), senão o volume entra na
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/mcp/dev-tools.test.ts :178 // === claude_new: poll de persistência pós-spawn (AC1, t1/t2/t8) ============
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/mcp/dev-tools.ts :21 import { execFile, spawn } from "node:child_process";
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/mcp/resources.ts :239 const { spawnSync } = await import("node:child_process");
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/oss-governance.test.ts :40 import { execFileSync } from "node:child_process";
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/oss-root-docs-truth.test.ts :3 import { execFileSync } from "node:child_process";
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/oss-secret-hygiene.test.ts :15 import { execFileSync } from "node:child_process";
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/preflight.ts :33 // runs que já não rodariam. O fail-closed mora no sítio de spawn (`runner/claude-bin.ts`), onde
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/autonomy-sandbox.ts :30 import { spawnSync } from "node:child_process";
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/branch-gc.ts :271 const { stdout } = await exec(`git log -1 --format=%ct ${JSON.stringify(branch)}`, { cwd: repoRoot, timeout: 15_000 });
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/capability-probe.ts :25 import { spawn } from "node:child_process";
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/card-read-byte-cap.test.ts :17 // `child_process.exec` — um número acidental, que qualquer wrapper maior apaga em silêncio.
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/commit-message-safety.test.ts :73 await exec(`git init -q -b main`, { cwd: repo });
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/concurrent-work.test.ts :9 import { exec as nodeExec } from "node:child_process";
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/concurrent-work.ts :94 await exec(`git merge-base --is-ancestor ${JSON.stringify(sha)} ${JSON.stringify(session.branch)}`, {
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/config.ts :1084 /** Per-column CLI flags for a spawn (model/effort/max-turns), policy-resolved. */
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/convergence.test.ts :10 import { exec as nodeExec } from "node:child_process";
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/convergence.ts :45 // `landed` ⇒ do not spawn ($0), stamp instead.
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/delivery-deps.ts :46 const { stdout } = await exec(`git ${cmd}`, { cwd: findRepoRoot(), timeout: GIT_TIMEOUT_MS });
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/deploy-agent-spawn.test.ts :1 // deploy-agent-spawn (D-AG3/D-AG4) — the prompt is assembled ONLY from board config + card facts, the
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/deploy-agent-spawn.ts :10 // accepts a prompt for this spawn (D-AG5 — the MCP surface is untouched). So the agent is the same risk
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/deploy-command-guard.ts :44 const SHELL_METACHARS = /[;&|$`(){}[\]<>*?!~#\\\n\r]/;
shell kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/deploy-reconcile.ts :170 const { stdout } = await exec(`git rev-parse --verify --quiet ${JSON.stringify(`${ref}^{commit}`)}`, {
shell (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/deploy.test.ts :1105 `node -e "require('child_process').execSync('id > /tmp/pwn')"`,

85 more not shown — this panel samples each group; the count above is the real total.

network 30

net kapstanhq-agileharness-db9edb9/packages/storymap-ui/public/ah-overlay.js :219 fetch(destinationsEndpoint, { headers: { accept: "application/json" }, credentials: "same-origin" })
net (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/avatar/route.test.ts :35 `<svg xmlns="http://www.w3.org/2000/svg"><script>fetch('/api/vps')</script></svg>`,
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/copilot/cancel/route.ts :1 // Cancel explícito do turno do Jido (F1.2) — belt do abort do fetch (o stream cancel já mata no
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/processes/FleetPanel.tsx :373 const res = await fetch("/api/processes/fleet", { cache: "no-store" });
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/processes/ProcessesClient.tsx :532 const res = await fetch("/api/processes", { cache: "no-store" });
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/BoardHeader.tsx :1060 fetch("/api/terminal/sessions", { cache: "no-store" })
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/CopilotChat.tsx :112 const [attempt, setAttempt] = useState(0); // 2.5 — bump re-dispara o fetch (botão "Tentar de novo")
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/VocabularyManager.tsx :651 const res = await fetch("/api/avatar", { method: "POST", body: fd });
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/auth/LoginForm.tsx :62 const res = await fetch("/api/auth/login", {
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/chat/ChatPanel.tsx :471 const res = await fetch("/api/copilot/upload", { method: "POST", body: fd });
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/design/RefsUploader.tsx :75 const res = await fetch("/api/design/upload", { method: "POST", body: fd });
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/hitl/useCopilotAgent.ts :318 const res = await fetch(`/api/copilot/history?boardId=${encodeURIComponent(boardId)}${viewQS}&limit=40`);

show 18 more

net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/inicio/TerminalsPanel.tsx :73 const r = await fetch("/api/terminal/sessions", {
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/components/terminal/useServiceMeters.ts :32 const r = await fetch("/api/processes/meters", { cache: "no-store" });
net (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/auth/auth-audit.test.ts :15 import type { IncomingMessage, ServerResponse } from "node:http";
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/feedback/guard.ts :28 // catalog read is `fetch(..., {credentials:"same-origin"})`, a GET — no `Origin` (the spec omits it for
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/notifications/client/push-channel.ts :61 const { publicKey } = (await fetch("/api/notifications/vapid").then((r) => r.json())) as {
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/notifications/server/channels/slack-channel.ts :21 await fetch(url, {
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/inbox-seen-client.ts :10 const res = await fetch("/api/inbox/seen", {
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/mcp/dev-tools.ts :1479 "Verifica a saúde desta instalação: um GET HTTP via node fetch (NUNCA curl — curl dispara WAF de " +
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/dev-server.ts :16 import net from "node:net";
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/stack-health.ts :37 /** node global fetch (localhost direct — never curl / never the WAF). */
net (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/supply-chain/vex-fixture.ts :55 "node_modules/sdk-exemplo/dist/server/http.js": 'import http from "node:http";\n',
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/wireframe-html/frame.ts :10 // navigate, or fetch (sandbox + CSP), so "hi-fi drift" is a taste boundary, not a security one.
net (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/wireframe-html/wireframe-html.test.ts :9 `<div>ok</div><script>fetch('/api/vps')</script><iframe src="x"></iframe><object data="x"></object><embed src="x">`,
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/vps/metrics.ts :161 const res = await fetch(url, { signal: ctrl.signal, cache: "no-store" });
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/server/main.ts :27 import { createServer, type IncomingMessage, type ServerResponse } from "node:http";
net (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/server/terminal-gateway.test.ts :2 import type { IncomingMessage, ServerResponse } from "node:http";
net kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/server/terminal-gateway.ts :65 // • SEM cookie — uma página qualquer consegue `fetch('/ttyd/token', {credentials:'omit'})` do
net (weak) kapstanhq-agileharness-db9edb9/scripts/security/osv-query.mjs :39 const r = await fetch(url, {

secrets 18

secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/runner/deploy-webhook/route.test.ts :51 prev = process.env.AGILEHARNESS_MCP_TOKEN;
secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/runner/events/route.test.ts :42 prevToken = process.env.AGILEHARNESS_MCP_TOKEN;
secrets kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/runner/perimeter.ts :55 * É exatamente o conjunto de hoje (`isMcpTokenValid(secret, process.env.AGILEHARNESS_MCP_TOKEN)`), e o
secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/runner/pulse/route.test.ts :51 prevToken = process.env.AGILEHARNESS_MCP_TOKEN;
secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/app/api/runner/test-webhook/route.test.ts :55 prev = process.env.AGILEHARNESS_MCP_TOKEN;
secrets kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/auth/env.ts :10 // repetia como literal (`process.env.AGILEHARNESS_SESSION_SECRET`) — uma segunda verdade que só
secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/feedback/guard-wiring.test.ts :170 process.env.AGILEHARNESS_SESSION_SECRET = "segredo-de-sessao-de-teste-000000000001";
secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/feedback/intake-lanes.test.ts :56 process.env.AGILEHARNESS_SESSION_SECRET = SESSION_SECRET;
secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/feedback/session-gate.test.ts :26 process.env.AGILEHARNESS_SESSION_SECRET = SECRET;
secrets kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/notifications/server/channels/web-push-channel.ts :55 return !!(process.env.AGILEHARNESS_VAPID_PUBLIC_KEY && process.env.AGILEHARNESS_VAPID_PRIVATE_KEY && vapidSubject());
secrets kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/copilot/agent-session.ts :346 const token = (mcpLevel === "ro" ? process.env.AGILEHARNESS_MCP_TOKEN_RO : process.env.AGILEHARNESS_MCP_TOKEN)?.trim();
secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/lib/storymap/runner/scan-secrets-blindspots.test.ts :211 expect(scanLine("packages/acmeapp/api/src/llm.ts", " const apiKey = process.env.OPENAI_API_KEY;").code).toBe(0);

show 6 more

secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/server/bind-audit.test.ts :88 delete process.env.AGILEHARNESS_MCP_TOKEN;
secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/server/boot-env-order.test.ts :92 delete process.env.AGILEHARNESS_MCP_TOKEN;
secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/server/boot-refuses-weak-mcp-token.test.ts :84 delete process.env.AGILEHARNESS_MCP_TOKEN;
secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/server/boot-survives-weak-mcp-token.test.ts :69 process.env.AGILEHARNESS_MCP_TOKEN = DO_PISO_ANTIGO;
secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/server/generate-mcp-token-command.test.ts :67 delete process.env.AGILEHARNESS_MCP_TOKEN;
secrets (weak) kapstanhq-agileharness-db9edb9/packages/storymap-ui/src/server/mcp-handle-commands.test.ts :79 delete process.env.AGILEHARNESS_MCP_TOKEN;

declared dependencies 1

js-yaml@^4.3.0