CodeVetter · Repo Unpack · Risk map
prisma/prisma
The sharp edges are warn-only marker checks, a contract loader that bundles and imports user TypeScript from the temp directory, package-manager and telemetry child processes, and a destructive migration consent flow that can be satisfied non-interactively. Supply-chain controls exist (frozen lockfile, release-age cooldown, OIDC publish, least-privilege CI tokens) but several trust exclusions are intentional. SQLite is not at parity, integration tests do not block the merge queue during the launch window, and the in-repo CLI can drift from the external prisma-cli host.
- verifyMarker never throws. CONTRACT.MARKER_MISSING and CONTRACT.MARKER_MISMATCH are log.warn events, after which setupDriverExecution continues into runQueryWithMiddleware. A database whose marker does not match the contract still serves queries unless a caller set verifyMarker to a stricter mode outside this default path.
- loadContractFromTs writes an esbuild bundle to os.tmpdir and, on the lines read, is about to import that module. The allowlist plugin ignores relative and absolute specifiers (args.path starting with . or /). Only bare imports from the entry are checked against @internal/*, @prisma/orm-*, and node:crypto. A contract file can therefore pull arbitrary relative modules into the bundle.
- runPackageManager spawns request.file with request.args, cwd, and signal, piping stdout to the engine and keeping only the last 64 KiB of stderr. The bin comment says the CLI engine chooses the manager and the argv and never imports child_process itself, so a bug in argv composition becomes a shell-out.
- redactSecrets only strips URL userinfo and _authToken/_auth/_password assignments from package-manager stderr during init. It does not scrub database URLs in general command output.
- Telemetry is on by default outside CI. resolveTelemetryHooks returns undefined when isCI() is true or resolveGating says disabled. Otherwise a detached fork POSTs to a compile-time backend URL. A malformed PRISMA_TELEMETRY_ENDPOINT falls back to production rather than failing closed. The root vitest config sets PRISMA_DISABLE_TELEMETRY=1 so tests do not fork the sender.
- The private app telemetry-backend (bun >=1.3 or node >=24) is the storage side of that channel: scripts include deploy, prisma contract emit, and start via bun run src/server.ts, and it depends on @prisma/orm-postgres. The sender URL is a Prisma Compute host, not this app's source path.
- db update's destructive gate is skippable. executeDbUpdate only calls guardDestructiveChanges when mode is apply and both acceptDataLoss and consent are unset. The CLI help says a CI or --no-interactive run takes the database name from --confirm. Consent is bound to a planHash and a mismatch returns CONSENT_PLAN_MISMATCH, but a matching hash or acceptDataLoss applies destructive ops.
- CI integration tests are explicitly not merge-blocking during the launch window: the test-integration job is skipped when github.event_name == merge_group. Package tests, e2e, and fixtures still run unless the diff is inert. A green merge queue therefore does not include the integration shard.
- scorecard.md records large areas that are implemented but only unit-tested (🟡) or absent (❌). SQLite is described in the README as a proof of concept, and MySQL is not a target yet. A passing package suite is not evidence that every scorecard row is ✅.
- Root pnpm.overrides force hono 4.11.4, js-yaml 3.14.2, lodash 4.17.23, minimatch patches, and rollup 4.59.0. That is a supply-chain pin, not a removal of those libraries. CI installs with --frozen-lockfile.
- The in-repo prisma bin and the published CLI are different repositories. cli.ts says this process mounts ormCommandFamily the same way the prisma-cli host does, but nothing in this repo compiles that host. Behavioral drift between the two is possible if one side changes command paths or config loading. (inferred)
- runtimeFromProcess always sets managementApi.baseUrl to https://api.prisma.io. Combined with the telemetry sender and the package-manager spawn, a normal CLI invocation can perform network and process side effects even for commands whose own handler is offline, unless telemetry gating suppresses the fork.