registry / @cestoliv/wt / 0.5.1

@cestoliv/wt@0.5.1

Merged into @cestoliv/forest — npm i -g @cestoliv/forest (provides wt).

Fast, interactive TUI to browse, create, open, and delete git worktrees across repos.

AI Security Review

scanned 10h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `wt agent` or selects the agent action in the interactive TUI.

Impact

Can execute user-configured commands and invoke an AI agent with a selected permission mode in the chosen worktree.

Mechanism

User-invoked worktree management, shell-configured setup commands, and Zed agent-task/keybinding automation.

Rationale

Source inspection confirms an explicit AI-agent/control-surface capability and shell execution, but no malicious install-time or covert behavior. Warn for the user-invoked capability under policy.

Evidence

package.jsondist/cli.jsdist/agent-QYE5UNA3.jsdist/chunk-XOP26UY4.jsdist/chunk-OA55NRNT.js<worktree>/.zed/tasks.json~/.config/zed/keymap.json<worktree>

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with false-positive risk.

@cestoliv/wt@0.5.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code