PatchWRK Scanner 0.1.0 — experimental beta (no-build archive)

PatchWRK Scanner 0.1.0 — experimental beta (no-build archive)

GitHub prerelease: v0.1.0.
Source: 77d009f07067c3c82a8b45b5cf30f97e0d41d171.

Free, MIT-licensed local Scanner for bounded static API SDK discovery in JavaScript
and TypeScript, with terminal/JSON output, optional visual HTML reports, explicit
local history and manual comparison. No Cloud account, credentials or network access
is required for scanning. No scanned source is executed or uploaded. No telemetry,
automatic scans, automatic browser opening, monitoring or repairs.

No-build first use

Requires Node.js 24 and a POSIX shell/archive utility. macOS and Ubuntu are tested;
Windows security is unverified. No cloning, npm installation, pnpm or compilation.

After this prerelease is published, download patchwrk-scanner-0.1.0.tgz and
patchwrk-scanner-0.1.0.tgz.sha256 from this repository's release assets into a
new directory. Do not substitute GitHub's automatically generated source archives.
No executable remote installer is used. Download needs network; subsequent scanning
works offline. Check the expected digest against trusted maintainer evidence:

af240d14973c8416bb18bcd6b75ed8cad3e4404598f1663d88987f7f2665132d

macOS (Linux: use sha256sum -c instead of shasum -a 256 -c):

node --version
shasum -a 256 -c patchwrk-scanner-0.1.0.tgz.sha256
tar -tzf patchwrk-scanner-0.1.0.tgz
mkdir patchwrk-0.1.0
tar -xzf patchwrk-scanner-0.1.0.tgz -C patchwrk-0.1.0
node patchwrk-0.1.0/package/dist/index.js --help
node patchwrk-0.1.0/package/dist/index.js scan /absolute/path/to/authorized-checkout --html ./report.html

Stop on mismatch or unexpected entries. Expected archive has 15 files under
package/: LICENSE, README.md, SECURITY.md, CONTRIBUTING.md, FEEDBACK.md,
PUBLIC_PROVENANCE.md, THIRD_PARTY_NOTICES.txt, package.json, dist/index.js,
dist/data/catalog.v1.json, docs/SCANNER_REPORTS.md, docs/SCANNER_HISTORY.md,
licenses/semver.LICENSE, licenses/typescript.LICENSE.txt and
licenses/typescript.ThirdPartyNoticeText.txt. Use a fresh extraction directory and
new report destinations; do not overwrite another installation or report.

Open report.html manually with Chrome File → Open File. Scan only a stable checkout
you own or are authorized to inspect, using a direct path without ...
Raw terminal/JSON reports may include absolute paths. HTML/history privacy filtering
does not make all metadata safe to share; review filenames and identifiers privately.

For history, initialize an explicit private directory and use its returned project ID:

node patchwrk-0.1.0/package/dist/index.js history init --directory ./scan-history --json
node patchwrk-0.1.0/package/dist/index.js scan /absolute/path/to/authorized-checkout --history-dir ./scan-history --project-id PROJECT_UUID
node patchwrk-0.1.0/package/dist/index.js history list --directory ./scan-history --html ./history.html
node patchwrk-0.1.0/package/dist/index.js history show SCAN_UUID --directory ./scan-history --html ./historical.html

After saving a second scan explicitly, use its real returned UUID:

node patchwrk-0.1.0/package/dist/index.js history compare BEFORE_UUID AFTER_UUID --directory ./scan-history --html ./comparison.html

Replace uppercase UUID placeholders with actual CLI output. Nothing is saved
implicitly. Deletion/pruning preview by default and require explicit --apply.
Comparison uses saved snapshots, not live compatibility checks or automatic rescans.

Browser acceptance limits

The founder manually reviewed the generated reports in Google Chrome: desktop/mobile presentation, expandable evidence, and Tab/Spacebar interaction worked; Console showed no visible errors and Network showed no visible external requests. One recorded network entry was not individually identified, so zero external browser traffic is not independently proven. Screen-reader behavior was not tested and browser CSP enforcement was not independently proven. These are experimental-beta review limits, not accessibility certification or independent browser-security passes.

Scope, security and limitations

Detects supported static Stripe, OpenAI, Anthropic, Shopify and Twilio SDK evidence.
Bundled catalog revision 3 contains only four historical Stripe/OpenAI records.
Unknown/partial coverage is explicit. Affected means applicability to a recorded
change, not tested runtime breakage. Missing findings or exit 0 do not prove health,
security or a repair. Dynamic imports, wrappers, ambiguous configuration and several
lockfile formats remain unsupported or uncertain.

Portable filesystem checks are not a sandbox against hostile concurrent mutation.
Use a stable checkout and OS isolation/resource limits where needed. Parser budgets
are not hard CPU/memory isolation. New output destinations are required; interrupted
writes can leave incomplete files. History is local, bounded and privacy-filtered,
but not authenticated; preserve and review snapshots privately.

TypeScript 5.9.3 and semver 7.8.5 are bundled with notices; the archive has no runtime
dependency installation or lifecycle scripts. Consumer runtime audit found no known
advisories at review time. The source development toolchain has two moderate
@vitest/mocker@4.1.11 advisories (GHSA-qxg6-89mg-rqv8 and GHSA-xp26-3454-mjgp).
Vitest/mocker is absent from this archive; the vulnerable browser-mocker server paths
are not part of normal Scanner use. Source contributors must review the advisories
and avoid affected server modes pending an approved maintenance update. This is not
a claim of zero vulnerabilities or an independent security audit.

Experimental v0.x support is best effort, without response/remediation guarantees.
Report vulnerabilities confidentially using the security policy;
never post private source, raw reports or credentials in public issues.

README and limitations ·
Beta testing guide ·
HTML report guide ·
History/comparison guide.

Those source documents preserve the pre-publication state and source-install examples;
use these asset instructions for the no-build route. Testing-guide source-only demo
scripts/fixtures are not in the archive. No tester round is opened by this release.
PatchWRK Cloud remains planned and unavailable. No Cloud collection, monitoring,
AI repair, hosted history or paid capability is activated.

MIT copyright © 2026 Jovan Simon. Bundled dependency attribution is in LICENSE,
THIRD_PARTY_NOTICES.txt and licenses/.