Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.
-
line length 865 characters (raw pass, confidence 0.50)
- [`error.isTerminated`](api.md#erroristerminated): [signal termination](termination.md#signal-termination). This includes the [`timeout`](termination.md#timeout) and [`forceKillAfterDelay`](termination.md#forceful-termination) options since those terminate the subprocess with a [signal](termination.md#default-signal).
-
line length 890 characters (raw pass, confidence 0.50)
How to setup the subprocess' [standard input](https://en.wikipedia.org/wiki/Standard_streams#Standard_input_(stdin)). This can be [`'pipe'`](streams.md#manual-streaming), [`'overlapped'`](windows.md#asynchronous-io), [`'ignore`](input.md#ignore-input), [`'inherit'`](input.md#terminal-input), a [file descriptor integer]
-
line length 701 characters (raw pass, confidence 0.50)
How to setup the subprocess' [standard output](https://en.wikipedia.org/wiki/Standard_streams#Standard_input_(stdin)). This can be [`'pipe'`](output.md#stdout-and-stderr), [`'overlapped'`](windows.md#asynchronous-io), [`'ignore`](output.md#ignore-output), [`'inherit'`](output.md#terminal-output), a [file descriptor int
-
line length 700 characters (raw pass, confidence 0.50)
How to setup the subprocess' [standard error](https://en.wikipedia.org/wiki/Standard_streams#Standard_input_(stdin)). This can be [`'pipe'`](output.md#stdout-and-stderr), [`'overlapped'`](windows.md#asynchronous-io), [`'ignore`](output.md#ignore-output), [`'inherit'`](output.md#terminal-output), a [file descriptor inte
-
line length 606 characters (raw pass, confidence 0.50)
- [Featureful](#simplicity): all Execa features are available ([text lines iteration](#iterate-over-output-lines), [advanced piping](#piping-stdout-to-another-command), [simple IPC](#ipc), [passing any input type](#pass-any-input-type), [returning any output type](#return-any-output-type), [transforms](#transforms), [w
-
line length 660 characters (raw pass, confidence 0.50)
zx includes many builtin utilities: [`fetch()`](#http-requests), [`question()`](#cli-prompts), [`sleep()`](#sleep), [`echo()`](#printing-to-stdout), [`stdin()`](#retrieve-stdin), [`retry()`](#retry-on-error), [`spinner()`](#cli-spinner), [`globby`](#globbing), [`chalk`](https://github.com/chalk/chalk), [`fs`](https://g
-
[embedded bash] command name is a variable (`$options`) that this file sets only to plain text (ast pass, confidence 0.40)
options="timeout 5"
$options npm run init
$options npm run build
$options npm run test
-
[embedded bash] command name is a variable (`$options`) that this file sets only to plain text (ast pass, confidence 0.40)
$options npm run init
$options npm run build
$options npm run test
-
[embedded bash] command name is a variable (`$options`) that this file sets only to plain text (ast pass, confidence 0.40)
$options npm run build
$options npm run test
-
U+FE0F VARIATION SELECTOR-16 (invisible payload carrier) in source (raw pass, confidence 0.90)
[**Next**: 💻 Shell](shell.md)\
[**Previous**: ⟨U+FE0F⟩▶⟨U+FE0F⟩ Basic execution](execution.md)\
[**Top**: Table of contents](../readme.md#documentation)
likely benign
LLM, confidence 0.90
Markdown docs navigation links containing emoji with U+FE0F variation selectors.
Reasoning
The U+FE0F variation selectors sit directly after emoji (💻, ▶⟨U+FE0F⟩) in Markdown link labels, which is how emoji presentation is normally encoded. The file is documentation and the characters do not form a hidden payload, so this is a raw-pass false positive.
-
line length 545 characters (raw pass, confidence 0.50)
- The [`stdin`](api.md#optionsstdin), [`stdout`](api.md#optionsstdout), [`stderr`](api.md#optionsstderr) and [`stdio`](api.md#optionsstdio) options cannot be [`'overlapped'`](api.md#optionsstdout), an [async iterable](lines.md#progressive-splitting), an async [transform](transform.md), a [`Duplex`](transform.md#duplext
-
line length 849 characters (raw pass, confidence 0.50)
Alternatively, input can be provided to [`stdin`](https://en.wikipedia.org/wiki/Standard_streams#Standard_input_(stdin)). Unlike [command arguments](#command-arguments) and [environment variables](#environment-variables) which have [size](https://unix.stackexchange.com/questions/120642/what-defines-the-maximum-size-for
-
line length 767 characters (raw pass, confidence 0.50)
Some options are related to the subprocess output: [`verbose`](api.md#optionsverbose), [`lines`](api.md#optionslines), [`stripFinalNewline`](api.md#optionsstripfinalnewline), [`buffer`](api.md#optionsbuffer), [`maxBuffer`](api.md#optionsmaxbuffer). By default, those options apply to all [file descriptors](https://en.wi
-
line length 807 characters (raw pass, confidence 0.50)
If you'd prefer avoiding adding any dependency, you may use `node:child_process` directly. However, you might miss some basic [features](https://github.com/sindresorhus/nano-spawn#features) that both Execa and nano-spawn provide: [proper error handling](https://github.com/sindresorhus/nano-spawn#subprocesserror), [full
-
line length 546 characters (raw pass, confidence 0.50)
When using [`subprocess.readable()`](api.md#subprocessreadablereadableoptions), [`subprocess.writable()`](api.md#subprocesswritablewritableoptions) or [`subprocess.duplex()`](api.md#subprocessduplexduplexoptions), the stream waits for the subprocess to end, and emits an [`error`](https://nodejs.org/api/stream.html#even
-
line length 983 characters (raw pass, confidence 0.50)
The [`subprocess.readableStream()`](api.md#subprocessreadablestreamreadableoptions), [`subprocess.writableStream()`](api.md#subprocesswritablestreamwritableoptions) and [`subprocess.transformStream()`](api.md#subprocesstransformstreamduplexoptions) methods are the [web streams](#web-streams) counterparts of [`subproces
-
line length 1044 characters (raw pass, confidence 0.50)
The [`AbortSignal`](https://developer.mozilla.org/en-US/docs/Web/API/AbortSignal) returned by [`getCancelSignal()`](api.md#getcancelsignal) can be passed to most long-running Node.js methods: [`setTimeout()`](https://nodejs.org/api/timers.html#timerspromisessettimeoutdelay-value-options), [`setInterval()`](https://node
-
line length 521 characters (raw pass, confidence 0.50)
Transforms map or filter the input or output of a subprocess. They are defined by passing a [generator function](https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/function*) or a [transform options object](api.md#transform-options) to the [`stdin`](api.md#optionsstdin), [`stdout`](api.md#opti
-
line length 570 characters (raw pass, confidence 0.50)
The following types can be imported: [`ResultPromise`](api.md#return-value), [`Subprocess`](api.md#subprocess), [`Result`](api.md#result), [`ExecaError`](api.md#execaerror), [`Options`](api.md#options-1), [`StdinOption`](api.md#optionsstdin), [`StdoutStderrOption`](api.md#optionsstdout), [`TemplateExpression`](api.md#e
-
line length 504 characters (raw pass, confidence 0.50)
Several options are typed as unions of strings: [`stdin`](api.md#optionsstdin), [`stdout`](api.md#optionsstdout), [`stderr`](api.md#optionsstderr), [`encoding`](api.md#optionsencoding), [`serialization`](api.md#optionsserialization), [`verbose`](api.md#optionsverbose), [`killSignal`](api.md#optionskillsignal), [`from`]
-
file mixes tab and space indentation (179 tab-indented and 2 space-indented lines) (raw pass, confidence 0.40)
import {
getStdioItemType,
isRegularUrl,
isUnknownStdioString,
-
file mixes tab and space indentation (18 tab-indented and 1 space-indented lines) (raw pass, confidence 0.40)
export const getValidateTransformInput = (writableObjectMode, optionName) => writableObjectMode
? undefined
: validateStringTransformInput.bind(undefined, optionName);
-
orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
test('result.escapedCommand - \\uD800', () => testEscapedCommand(['\u{D800}'], '\'\\ud800\'', '"\\ud800"', '\'\u{D800}\'', '"\u{D800}"'));
test('result.escapedCommand - \\uE000', () => testEscapedCommand(['\u{E000}'], '\'\\ue000\'', '"\\ue000"', '\'\u{E000}\'', '"\u{E000}"'));
-
orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
test('result.escapedCommand - \\uD800', () => testEscapedCommand(['\u{D800}'], '\'\\ud800\'', '"\\ud800"', '\'\u{D800}\'', '"\u{D800}"'));
test('result.escapedCommand - \\uE000', () => testEscapedCommand(['\u{E000}'], '\'\\ue000\'', '"\\ue000"', '\'\u{E000}\'', '"\u{E000}"'));
-
orphaned high surrogate \uD800 (no matching low surrogate) (token pass, confidence 0.65)
test('result.escapedCommand - \\uD800', () => testEscapedCommand(['\u{D800}'], '\'\\ud800\'', '"\\ud800"', '\'\u{D800}\'', '"\u{D800}"'));
test('result.escapedCommand - \\uE000', () => testEscapedCommand(['\u{E000}'], '\'\\ue000\'', '"\\ue000"', '\'\u{E000}\'', '"\u{E000}"'));
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.65)
const {getOptions} = await import(new URL(optionsFixture, NESTED_URL));
return {...options, ...getOptions({...options, ...optionsInput})};
};
likely benign
LLM, confidence 0.90
Test helper dynamically importing an options fixture module via a URL.
Reasoning
This is a test helper that dynamically imports a fixture module from a URL built from a constant base. The specifier comes from test setup, not untrusted input, and the import feeds a local getOptions helper. The AST rule fires on any non-literal import, so this is a legitimate test pattern.
-
file mixes tab and space indentation (43 tab-indented and 11 space-indented lines) (raw pass, confidence 0.40)
const escapedCall = string => {
const templates = [string];
templates.raw = [string];
return $(templates);
-
dynamic `import(...)` with a non-literal specifier (ast pass, confidence 0.80)
fakeWindowsCount += 1;
const {getKillFunction} = await import(`../../lib/terminate/kill-descendants.js?fake-windows=${fakeWindowsCount}`);
return getKillFunction;
};
likely benign
LLM, confidence 0.90
Test re-importing the kill-descendants module with a query string to bust the module cache.
Reasoning
This test re-imports the kill-descendants library with a cache-busting query string so it can simulate a different Windows call count. The specifier is built from a local counter in test code, not external data, so this is an ordinary test technique rather than a dropper or evasion.
Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.
disclude.io