registry / @ai-support-agent/cli / 0.3.0

@ai-support-agent/cli@0.3.0

AI Support Agent CLI client

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 162 file(s), 1.12 MB of source, external domains: api.ai-support-agent.com, api.anthropic.com, app.ai-support-agent.com, dev.mysql.com, schemas.microsoft.com, www.apple.com, www.postgresql.org

Source & flagged code

3 flagged

dist/terminal/terminal-session.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.TerminalSession = exports.GIT_SSH_KEY_ENV_NAME = void 0;

37exports.isNodePtyAvailable = isNodePtyAvailable;

38const fs = __importStar(require("fs"));

39const os = __importStar(require("os"));

40const path = __importStar(require("path"));

41const child_process_1 = require("child_process");

42const constants_1 = require("../constants");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/terminal/terminal-session.jsView on unpkg · L40

43const env_vars_filter_1 = require("../env-vars-filter");

44const logger_1 = require("../logger");

45const security_1 = require("../security");

46const claude_config_validator_1 = require("../utils/claude-config-validator");

47const claude_json_oauth_sync_1 = require("../utils/claude-json-oauth-sync");

48const utils_1 = require("../utils");

49const constants_2 = require("./constants");

50const sandbox_init_script_1 = require("./sandbox-init-script");

51// eslint-disable-next-line @typescript-eslint/no-explicit-any

52let pty = null;

53let ptyLoadError = null;

54try {

55 // eslint-disable-next-line @typescript-eslint/no-require-imports

56 pty = require('node-pty');

57}

58catch (e) /* istanbul ignore next -- only when native build fails */ {

59 ptyLoadError = (0, utils_1.getErrorMessage)(e);

60 logger_1.logger.debug(`[terminal] node-pty is not available: ${ptyLoadError}`);

docker/entrypoint.shView file

•path = docker/entrypoint.sh kind = build_helper sizeBytes = 662 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker/entrypoint.shView on unpkg

dist/commands/codex-runner.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ai-support-agent/cli@0.2.6 matchedIdentity = npm:QGFpLXN1cHBvcnQtYWdlbnQvY2xp:0.2.6 similarity = 0.892 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/codex-runner.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/terminal/terminal-session.jsView file

40const path = __importStar(require("path")); L41: const child_process_1 = require("child_process"); L42: const constants_1 = require("../constants"); ... L72: * 直接チェックする。Docker コンテナ内の Node.js プロセスは shell init を経由せず L73: * 起動するため、process.env.PATH がインタラクティブシェルの PATH と異なり L74: * spawnSync がバイナリを見つけられないことがある。 ... L101: * L102: * API サーバーが base64 エンコードされた PEM 秘密鍵をこの変数名で送ってくる。 L103: * TerminalSession はこれを検出してファイルに書き出し、GIT_SSH_COMMAND を設定する。 ... L123: * (clear grace timer + remove from map). It is kept separate from the public L124: * `exitCallback` so that a later `onExit()` registration by the websocket L125: * handler (which sends the 'exit' frame) does NOT overwrite the manager's

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/terminal/terminal-session.jsView on unpkg · L40

docker/entrypoint.shView file

•path = docker/entrypoint.sh kind = build_helper sizeBytes = 662 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker/entrypoint.shView on unpkg

dist/commands/codex-runner.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/codex-runner.jsView on unpkg

Findings

1 High5 Medium5 Low

HighPrevious Version Dangerous Deltadist/commands/codex-runner.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/terminal/terminal-session.js

MediumShips Build Helperdocker/entrypoint.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/terminal/terminal-session.jsView file

Lines 20-60javascript

20 ownKeys = Object.getOwnPropertyNames || function (o) {

21 var ar = [];

22 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

23 return ar;

24 };

25 return ownKeys(o);

26 };

27 return function (mod) {

28 if (mod && mod.__esModule) return mod;

29 var result = {};

30 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

31 __setModuleDefault(result, mod);

32 return result;

33 };

34})();

35Object.defineProperty(exports, "__esModule", { value: true });

36exports.TerminalSession = exports.GIT_SSH_KEY_ENV_NAME = void 0;

37exports.isNodePtyAvailable = isNodePtyAvailable;

38const fs = __importStar(require("fs"));

39const os = __importStar(require("os"));

40const path = __importStar(require("path"));

41const child_process_1 = require("child_process");

42const constants_1 = require("../constants");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/terminal/terminal-session.jsView on unpkg · L40

43const env_vars_filter_1 = require("../env-vars-filter");

44const logger_1 = require("../logger");

45const security_1 = require("../security");

46const claude_config_validator_1 = require("../utils/claude-config-validator");

47const claude_json_oauth_sync_1 = require("../utils/claude-json-oauth-sync");

48const utils_1 = require("../utils");

49const constants_2 = require("./constants");

50const sandbox_init_script_1 = require("./sandbox-init-script");

51// eslint-disable-next-line @typescript-eslint/no-explicit-any

52let pty = null;

53let ptyLoadError = null;

54try {

55 // eslint-disable-next-line @typescript-eslint/no-require-imports

56 pty = require('node-pty');

57}

58catch (e) /* istanbul ignore next -- only when native build fails */ {

59 ptyLoadError = (0, utils_1.getErrorMessage)(e);

60 logger_1.logger.debug(`[terminal] node-pty is not available: ${ptyLoadError}`);

docker/entrypoint.shView file

•path = docker/entrypoint.sh kind = build_helper sizeBytes = 662 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

docker/entrypoint.shView on unpkg

dist/commands/codex-runner.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/codex-runner.jsView on unpkg