registry / @axhub/acp / 0.1.8

@axhub/acp@0.1.8

Experimental sibling project for validating an ACP + [assistant-ui](https://github.com/assistant-ui/assistant-ui) migration path.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 184 file(s), 1.75 MB of source, external domains: 127.0.0.1, api.example.com, api.openai.com, client.example.com, docs.fal.ai, github.com, react.dev, registry.npmjs.org, www.ifdian.net, www.w3.org

Source & flagged code

5 flagged

bin/acp.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawn } from "node:child_process";

4import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/acp.mjsView on unpkg · L2

5import { createRequire } from "node:module";

6import { dirname, join } from "node:path";

7import { fileURLToPath } from "node:url";

8import { DEFAULT_CORS_ORIGINS, DEFAULT_PORT } from "./defaults.mjs";

10const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));

11const launchCwd = process.cwd();

12const require = createRequire(import.meta.url);

14function printHelp() {

15 console.log(`Usage: acp [options]

17Start the ACP Web UI.

19Options:

20 -p, --port <port> Port to listen on (default: ${DEFAULT_PORT})

21 -H, --hostname <hostname> Hostname to bind (default: 0.0.0.0)

22 --cors-origin <origin[,..]> Allowed CORS Origin for /api/* routes (default: ${DEFAULT_CORS_ORIGINS})

dist/lib/acp2aisdk/provider-command.mjsView file

Lines 1-23javascript

1import { execFileSync } from "node:child_process";

2import { accessSync, constants, existsSync, readdirSync, readFileSync, statSync, } from "node:fs";

3import path from "node:path";

4const WINDOWS_COMMAND_PROCESSOR = "cmd.exe";

5const POSIX_GUI_PATHS

dist/lib/conversations/client-adapter.mjsView file

Lines 322-362javascript

322 await aui

323 .threadListItem()

324 .initialize()

325 .catch(() => null);

326 return (_a = aui.threadListItem().getState().remoteId) !== null &&

dist/lib/cc-connect/launcher.mjsView file

Lines 1-21javascript

1var _a;

2import { execFile, spawn } from "node:child_process";

3import { randomBytes } from "node:crypto";

4import fs from "node:fs/promises";

5import os from "node:os";

6import path from

public/image-playground/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = public/image-playground/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/image-playground/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Source & flagged code

5 flagged · loading source

bin/acp.mjsView file

2L3: import { spawn } from "node:child_process"; L4: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/acp.mjsView on unpkg · L2

dist/lib/acp2aisdk/provider-command.mjsView file

3import path from "node:path"; L4: const WINDOWS_COMMAND_PROCESSOR = "cmd.exe"; L5: const POSIX_GUI_PATHS = [

High

Shell

Package source references shell execution.

dist/lib/acp2aisdk/provider-command.mjsView on unpkg · L3

dist/lib/conversations/client-adapter.mjsView file

342if (externalRepo.messages.length === 0) { L343: aui.thread().import({ messages: [] }); L344: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/conversations/client-adapter.mjsView on unpkg · L342

dist/lib/cc-connect/launcher.mjsView file

1var _a; L2: import { execFile, spawn } from "node:child_process"; L3: import { randomBytes } from "node:crypto"; ... L8: const execFileAsync = promisify(execFile); L9: const DEFAULT_CC_CONNECT_WEB_URL = "http://localhost:9820"; L10: const DEFAULT_CC_CONNECT_CONFIG_PATH = path.join(os.homedir(), ".cc-connect", "config.toml"); L11: const DEFAULT_CC_CONNECT_COMMAND = "cc-connect"; L12: const CC_CONNECT_PACKAGE = ((_a = process.env.CC_CONNECT_PACKAGE) === null || _a === void 0 ? void 0 : _a.trim()) || "cc-connect"; L13: const DEFAULT_STARTUP_TIMEOUT_MS = 30000;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/lib/cc-connect/launcher.mjsView on unpkg · L1

public/image-playground/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = public/image-playground/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/image-playground/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

Findings

4 High4 Medium5 Low

HighChild Processbin/acp.mjs

HighShelldist/lib/acp2aisdk/provider-command.mjs

HighSame File Env Network Executiondist/lib/cc-connect/launcher.mjs

HighShips High Entropy Blobpublic/image-playground/assets/KaTeX_Script-Regular-D3wIWfF6.woff2

MediumDynamic Requiredist/lib/conversations/client-adapter.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

bin/acp.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

3import { spawn } from "node:child_process";

4import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

bin/acp.mjsView on unpkg · L2

5import { createRequire } from "node:module";

6import { dirname, join } from "node:path";

7import { fileURLToPath } from "node:url";

8import { DEFAULT_CORS_ORIGINS, DEFAULT_PORT } from "./defaults.mjs";

10const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));

11const launchCwd = process.cwd();

12const require = createRequire(import.meta.url);

14function printHelp() {

15 console.log(`Usage: acp [options]

17Start the ACP Web UI.

19Options:

20 -p, --port <port> Port to listen on (default: ${DEFAULT_PORT})

21 -H, --hostname <hostname> Hostname to bind (default: 0.0.0.0)

22 --cors-origin <origin[,..]> Allowed CORS Origin for /api/* routes (default: ${DEFAULT_CORS_ORIGINS})

dist/lib/acp2aisdk/provider-command.mjsView file

Lines 1-23javascript

1import { execFileSync } from "node:child_process";

2import { accessSync, constants, existsSync, readdirSync, readFileSync, statSync, } from "node:fs";

3import path from "node:path";

4const WINDOWS_COMMAND_PROCESSOR = "cmd.exe";

5const POSIX_GUI_PATHS

dist/lib/conversations/client-adapter.mjsView file

Lines 322-362javascript

322 await aui

323 .threadListItem()

324 .initialize()

325 .catch(() => null);

326 return (_a = aui.threadListItem().getState().remoteId) !== null &&

dist/lib/cc-connect/launcher.mjsView file

Lines 1-21javascript

1var _a;

2import { execFile, spawn } from "node:child_process";

3import { randomBytes } from "node:crypto";

4import fs from "node:fs/promises";

5import os from "node:os";

6import path from

public/image-playground/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = public/image-playground/assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

public/image-playground/assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg