registry / @code-partner/codepipe / 0.3.1

@code-partner/codepipe@0.3.1

**CodePipe turns your tracker tasks into reviewed pull requests.** Assign a YouTrack task to yourself — an AI agent (Claude Code) studies your codebase, proposes a solution, waits for your approval, implements it, verifies the build and opens a PR. You co

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `codepipe up`, `codepipe daemon`, or `codepipe worker`.

Impact

A configured HUB job can cause agent and repository actions within the user-authorized CodePipe project workflow.

Mechanism

Remote job dispatch to an agent-capable local CLI with credential-backed git/API operations.

Rationale

The scanner signals are explained by the package's documented CLI/worker design. Its remote agent execution and credential-backed writes remain a meaningful dual-use capability, so warning is appropriate rather than a malicious block.

Evidence

package.jsonREADME.mddist/index.js~/.codepipe/config.json~/.codepipe/secrets/<project>.json~/.codepipe/worker/config.json.codepipe/project.yaml.codepipe-sandbox/repos

Network endpoints4

hub.codepipe.devapi.github.comgitlab.com/api/v4api.bitbucket.org

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/index.js` implements a HUB-connected worker that claims remote jobs and launches Claude Code.
`dist/index.js` reads/stores Git, YouTrack, and Claude credentials under `~/.codepipe`.
`dist/index.js` performs git operations and repository-host API writes when user invokes CLI commands.
Bundled worker includes a hard-coded non-English agent instruction, but it is part of an explicit Claude job workflow.

Evidence against

`package.json` has no preinstall, install, postinstall, prepare, or uninstall lifecycle hook.
Entrypoint is a `codepipe`/`devpipe` CLI bin; actions require explicit command execution.
No `eval`, `Function`, VM use, native module loading, or hidden agent-editor config paths were found.
Network hosts are CodePipe HUB and declared GitHub/GitLab/Bitbucket APIs, aligned with the package's documented workflow.
No evidence of covert credential exfiltration, destructive action, or foreign AI-agent control-surface mutation.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 279 KB of source, external domains: api.anthropic.com, api.bitbucket.org, api.github.com, example.com, gitlab.com, hub.codepipe.dev, id.atlassian.com, your.youtrack.cloud

Source & flagged code

3 flagged

dist/index.jsView file

Lines 406-456javascript

406 # Driving / repairing the lint/build/test run (BUILD phase).

407 build: sonnet

408 # Drafting a new issue from the Quick-task panel.

409 draft: sonnet

410 # One-shot repository indexing at registration.

411 index: opus

412

413# Concurrency is not a per-project setting: it is the operator-set per-account

414# sandbox quota (how many runners the account may occupy), enforced by the HUB

415# and sized on the farm. A solo 'codepipe up' runs one worker. (ADR-0030)

416

417# implementation:

418# # How IMPLEMENTING is ordered across tasks. Default: parallel.

419# # parallel \u2014 tasks branch independently off the base; conflicts are

420# # resolved reactively via \`@codepipe rebase\`. No head-of-line

421# # blocking between tasks.

422# # sequential \u2014 one task at a time in creation order; each branch stacks on

423# # the previous task's branch (auto-merge without reworking the

424# # tail of the chain).

425# mode: parallel

426`}function Gp(t){return`codepipe/context-migration-v${t}`}function Mp(t){let e=ui(t.templateVersion),r=[`CodePipe context format migration: **v${t.templateVersion} \u2192 v${t.currentVersion}**.`,"","Additive only \u2014 this PR creates files your context is missing and updates",`the \`${je

427`)}async function cs(t,e,r,n){let o=io(t);await o.pull(void 0,void 0,["--rebase"]).catch(()=>{});let i=Qr(t,e);if(!i.outdated)return i;let s=Gp(i.currentVersion),a=r?.branch??(await o.revparse(["--abbrev-ref","HEAD"]).catch(()=>"main")).trim();try{await o.fetch().catch(()=>{}),(await o.raw(["ls-remote","--heads","origin",s]).catch(()=>"")).trim().length===0?await Fp(t,e,r,i,s,a,n):n.info(`[ctx] migration branch ${s} already on origin \u2014 reusing`)}catch(l){return n.warn(`[ctx] context migration branch failed (will retry next start): ${l instanceof Error?l.message:String(l)}`),i}if(!r)return ...

428${l.trim()}`)}}let i=ds(n);try{await i.fetch()}catch(a){let c=a instanceof Error?a.message:String(a);throw new Error(`git fetch failed in ${n}

429${c.trim()}`)}let s=e.defaultBranch??"main";return await i.checkout(["-B",s,`origin/${s}`]).catch(()=>{}),i}async function gr(t,e){try{return await t.raw(["cat-file",

430${y.trim()}`)}}let h=(await t.revparse(["HEAD"])).trim(),C=f?["--force-with-lease","-u","origin",a]:["-u","origin",a];return await t.push(C),await t.push([n,"--delete",o]).catch(()=>{}),{commit:h}}async function hs(t,e,r){let{contextRepoCloneUrl:n,deliveryRef:o,deliverySha:i,baseSha:s,branchName:a,commitMessage:c,push:l}=r,u=await ms(t,i,()=>rn(t,{contextRepoCloneUrl:n,deliveryRef:o,deliverySha:i,baseSha:s,commitMessage:c}));return await t.raw(["branch","-f",a,u]),l&&await t.push(["--force-with-lease","-u","origin",a]),{commit:u,pushed:l}}async function ys(t,e,r){let{branchName:n,baseBranch:o, ...

431`)){let n=r.match(/CA Issuers - URI:\s*(https?:\/\/\S+)/i);if(n?.[1])return n[1].trim()}return null}function ld(t,e,r){return new Promise((n,o)=>{let i=Ze.connect({host:t,port:e,servername:t,rejectUnauthorized:!1},()=>{let s=i.getPeerCertificate(!0),a=new Set;for(;s?.issuerCertificate&&s.issuerCertificate!==s&&s.fingerprint256&&!a.has(s.fingerprint256);)a.add(s.fingerprint256),s=s.issuerCertificate;let c=s?.raw?new Cs(s.raw):null;i.end(),n(c)});i.on("error",o),i.setTimeout(r,()=>{i.destroy(),o(new Error("tls connect timeout"))})})}function lo(t,e,r){return new Promise(n=>{let o=Ze.connect({hos ...

432`)}function _d(t,e,r){let n=new Map,o=Je(t,`tasks/${e}/comments.jsonl`);if(aa(o))for(let i of jd(o,"utf-8").split(`

433`)){let s=i.trim();if(s)try{let a=JSON.parse(s);a&&typeof a.id=="string"&&n.set(a.id,a)}catch{}}for(let i of r){let s={id:i.id,author:i.author,origin:"youtrack",body:i.body,createdAt:new Date(i.createdAt).toISOString()},a=Gr

434`)+(t.length>0?`

435`:"")}function Nd(t,e,r){let n=[],o=Je(t,`tasks/${e}/attachments`);if(aa(o))for(let i of Pd(o))n.push(i);for(let i of r)n.includes(i.name)||n.push

436`,{mode:384})}function Kd(t){return la()[t]}function pn(t,e){let r=la();r[t]=e,Hd(r)}function dn(t,e){let r=ae(e),n=Kd(t);if(n&&n!==r)throw new Error(`farm ${t} key fingerprint changed (pinned ${n}, now ${r}) \u2014 refusing to seal. If the farm was re-registered intentionally, remove its entry from ${wo()}.`);return r}import Wd from"ws";function fn(t,e){let r=t.replace(/^http/,"ws")+`/cli/connect?token=${encodeURIComponent(e)}`;return new Wd(r)}var A=class extends Error{constructor(r,n,o){super(o);this.status=r;this.payload=n;this.name="HubHttpError"}};async function tt(t,e,r){return Se(t,e," ...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L426

437`,{mode:384})}function ef(t){return ja()[t]}function $o(t,e){let r=ja();r[t]=e,Zd(r)}function Pa(t,e){let r=ae(e),n=ef(t);if(n&&n

438`)?e:e+`

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L436

439`;return wf(t,r,{mode:384}),`ssh -i "${t}" -o IdentitiesOnly=yes -o StrictHostKeyChecking=accept-new`}function $f(t,e,r="x-access-token"){let n=`${encodeURIComponent(r)}:${encodeURIComponent(e)}`,o=t.match(/^git@([^:]+):(.+)$/);if(o)return`https://${n}@${o[1]}/${o[2]}`;let i=t.match(/^ssh:\/\/git@([^/]+)\/(.+)$/);if(i)return`https://${n}@${i[1]}/${i[2]}`;let s=t.match(/^https:\/\/(?:[^@/]+@)?(.+)$/);return s?`https://${n}@${s[1]}`:t}function vf(t,e){return e?.contextWrite?.token?{user:Mr(t),secret:e.contextWrite.token}:t===ur.gitlab?e?.gitlab?.token?{user:"oauth2",secret:e.gitlab.token}:null:t ...

440[${p}] shutting down`),l.stop(),setTimeout(()=>process.exit(0),200))}process.on("SIGINT",()=>f("SIGINT")),process.on("SIGTERM",()=>f("SIGTERM")),await new Promise(()=>{})}import{hostname as Af}from"node:os";import{spawnSync as Cf}from"node:child_process";function Rf(){try{return Cf("podman",["--version"],{stdio:"ignore",timeout:5e3}).status===0}catch{return!1}}function Qa(t={}){let e=process.platform==="darwin"?"darwin":process.platform==="win32"?"windows":"linux",r=process.arch==="arm64"?"arm64":"x64";return{os:e,arch:r,containers:Rf(),node:process.versions.node,browser:!1,projects:t.projects ...

441`,{mode:384})}import Ef from"ws";var Dt=class{hubUrl;token;constructor(e,r){this.hubUrl=e,this.token=r}async register(e){let r=await fetch(`${this.hubUrl}/sandbox/register`,{method:"POST",headers:{"Content-Type"

442`}async function ic(t,e){if(!e.interactive)throw new Error("runInteractiveClaude called without an interactive channel");if(e.signal?.aborted)throw new Ke;let r=["--input-format","stream-json","--output-format","stream-json","--verbose","--dangerously-skip-permissions"];e.model&&e.model.trim().length>0&&r.push("--model",e.model.trim());for(let c of e.addDirs??[])r.push("--add-dir",c);let n=e.onActivity,o=c=>{if(n)try{n(c)}catch{}},i=[],s=null,a=c=>{let l=Date.now(),u=c.type;if(u==="assistant"){let f=c.message;for(let p of f?.content??[]){let g=p.type;if(g==="text"){let d=String(p.text??"").tri ...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L426

443`))!==-1;){let m=v.slice(0,x).trim();v=v.slice(x+1),m&&N(m)}}),u.stderr.on("data",P=>{i.push(P);for(let x of P.split(`

444`)){let m=x.trim();m&&console.warn(`[claude:chat:stderr] ${m}`)}}),u.on("error",P=>{k(),l(P)}),u.on("close",P=>{if(k(),f){l(new Ke);return}if(p){l(

445`))!==-1;){let m=N.slice(0,x).trim();if(N=N.slice(x+1),m){let T=sc(m);u(T),T&&g(T)}}}),C.stderr.on("data",P=>{n.push(P),o.push(P);for(let x of P.split(`

446`)){let m=x.trim();m&&console.warn(`[claude:stderr] ${m}`)}}),C.on("error",P=>{v(),h(P)}),C.on("close",P=>{if(v(),k){h(new Ke);return}if(N.trim()){let m=sc(N.trim());u(m),m&&g(m)}let x=i?.is_error===!0;if(P!==0||x){let m=typeof i?.api_error_status=="number"?i.api_error_status:void 0,T=typeof i?.subtype=="string"?i.subtype:void 0,b=typeof i?.result=="string"?i.result:void 0;h(new Bt(Mf(P,i,o.join("")),{code:P,apiErrorStatus:m,subtype:T,resultText:b,retryAfterMs:Ff(i)}));return}console.log("[claude] exit code=0"),d({artifactPaths:[],log:n.join(""),usage:Wf(i,s,a,c),...l?{rateLimit:l}:{}})})})}st ...

447`).slice(-5).join(`

448`),500)),n.join(" \u2014 ")}function Ff(t){if(!t)return;let e=t.retry_after;if(typeof e=="number"&&e>0)return Math.round(e*1e3);let r=typeof t.result=="string"

449`),s.push("NOTE.md"));return{artifactPaths:s,log:`mock runner produced ${s.length} artifact(s) for role=${e.role}`,usage:pt()}}async runInteractive(e){let r=e.onActivity,n=i=>{r?.({ts:Date.now(),kind:"text",author:"agent",text:i}),r?.({ts:Date.now(),kind:"result",author:"agent",text:"success"})};r?.({ts:Date.now(),kind:"start",author:"agent",text:"chat session started"}),n("\u041F\u0440\u0438\u0432\u0435\u0442! \u041E\u043F\u0438\u0448\u0438\u0442\u0435 \u0437\u0430\u0434\u0430\u0447\u0443, \u043A\u043E\u0442\u043E\u0440\u0443\u044E \u0445\u043E\u0442\u0438\u0442\u0435 \u0441\u0444\u043E\u0440 ...

450

451\u0421\u0444\u043E\u0440\u043C\u0438\u0440\u043E\u0432\u0430\u043D\u043E \u0432 \u0438\u043D\u0442\u0435\u0440\u0430\u043A\u0442\u0438\u0432\u043D\u043E\u043C \u0447\u0430\u0442\u0435 (mock runner).

452`),{artifactPaths:["DRAFT.md"],log:"mock chat session finalized DRAFT.md",usage:pt()}}};function zf(t,e,r){return`# ${t} \u2014 Estimate

453

454**Title:** ${e}

455

456## Effort

Long lines were clipped for display.

Source & flagged code

3 flagged · loading source

dist/index.jsView file

436`,{mode:384})}function Kd(t){return la()[t]}function pn(t,e){let r=la();r[t]=e,Hd(r)}function dn(t,e){let r=ae(e),n=Kd(t);if(n&&n!==r)throw new Error(`farm ${t} key fingerprint cha... L437: `,{mode:384})}function ef(t){return ja()[t]}function $o(t,e){let r=ja();r[t]=e,Zd(r)}function Pa(t,e){let r=ae(e),n=ef(t);if(n&&n!==r)throw new Error(`runner host ${t} key fingerpr... L438: `)?e:e+`

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L436

426`}function Gp(t){return`codepipe/context-migration-v${t}`}function Mp(t){let e=ui(t.templateVersion),r=[`CodePipe context format migration: **v${t.templateVersion} \u2192 v${t.curr... L427: `)}async function cs(t,e,r,n){let o=io(t);await o.pull(void 0,void 0,["--rebase"]).catch(()=>{});let i=Qr(t,e);if(!i.outdated)return i;let s=Gp(i.currentVersion),a=r?.branch??(awai... L428: ${l.trim()}`)}}let i=ds(n);try{await i.fetch()}catch(a){let c=a instanceof Error?a.message:String(a);throw new Error(`git fetch failed in ${n} ... L430: ${y.trim()}`)}}let h=(await t.revparse(["HEAD"])).trim(),C=f?["--force-with-lease","-u","origin",a]:["-u","origin",a];return await t.push(C),await t.push([n,"--delete",o]).catch(()... L431: `)){let n=r.match(/CA Issuers - URI:\s*(https?:\/\/\S+)/i);if(n?.[1])return n[1].trim()}return null}function ld(t,e,r){return new Promise((n,o)=>{let i=Ze.connect({host:t,port:e,se... L432: `)}function _d(t,e,r){let n=new Map,o=Je(t,`tasks/${e}/comments.jsonl`);if(aa(o))for(let i of jd(o,"utf-8").split(` ... L436: `,{mode:384})}function Kd(t){return la()[t]}function pn(t,e){let r=la();r[t]=e,Hd(r)}function dn(t,e){let r=ae(e),n=Kd(t);if(n&&n!==r)throw new Error(`farm

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L426

426`}function Gp(t){return`codepipe/context-migration-v${t}`}function Mp(t){let e=ui(t.templateVersion),r=[`CodePipe context format migration: **v${t.templateVersion} \u2192 v${t.curr... L427: `)}async function cs(t,e,r,n){let o=io(t);await o.pull(void 0,void 0,["--rebase"]).catch(()=>{});let i=Qr(t,e);if(!i.outdated)return i;let s=Gp(i.currentVersion),a=r?.branch??(awai... L428: ${l.trim()}`)}}let i=ds(n);try{await i.fetch()}catch(a){let c=a instanceof Error?a.message:String(a);throw new Error(`git fetch failed in ${n} ... L436: `,{mode:384})}function Kd(t){return la()[t]}function pn(t,e){let r=la();r[t]=e,Hd(r)}function dn(t,e){let r=ae(e),n=Kd(t);if(n&&n!==r)throw new Error(`farm ${t} key fingerprint cha... L437: `,{mode:384})}function ef(t){return ja()[t]}function $o(t,e){let r=ja();r[t]=e,Zd(r)}function Pa(t,e){let r=ae(e),n=ef(t);if(n&&n!==r)throw new Error(`runner host ${t} key fingerpr... L438: `)?e:e+` ... L441: `,{mode:384})}import Ef from"ws";var Dt=class{hubUrl;token;constructor(e,r){this.hubUrl=e,this.token=r}async register(e){let r=await fetch(`${this.hubUrl}/sandbox/register`,{method... L442: `}async function ic(t,e){if(!e.interactive)throw new Error("runInteracti

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L426

Findings

3 High2 Medium5 Low

HighChild Processdist/index.js

HighSame File Env Network Executiondist/index.js

HighCommand Output Exfiltrationdist/index.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

3 flagged

dist/index.jsView file

Lines 406-456javascript

406 # Driving / repairing the lint/build/test run (BUILD phase).

407 build: sonnet

408 # Drafting a new issue from the Quick-task panel.

409 draft: sonnet

410 # One-shot repository indexing at registration.

411 index: opus

412

413# Concurrency is not a per-project setting: it is the operator-set per-account

414# sandbox quota (how many runners the account may occupy), enforced by the HUB

415# and sized on the farm. A solo 'codepipe up' runs one worker. (ADR-0030)

416

417# implementation:

418# # How IMPLEMENTING is ordered across tasks. Default: parallel.

419# # parallel \u2014 tasks branch independently off the base; conflicts are

420# # resolved reactively via \`@codepipe rebase\`. No head-of-line

421# # blocking between tasks.

422# # sequential \u2014 one task at a time in creation order; each branch stacks on

423# # the previous task's branch (auto-merge without reworking the

424# # tail of the chain).

425# mode: parallel

426`}function Gp(t){return`codepipe/context-migration-v${t}`}function Mp(t){let e=ui(t.templateVersion),r=[`CodePipe context format migration: **v${t.templateVersion} \u2192 v${t.currentVersion}**.`,"","Additive only \u2014 this PR creates files your context is missing and updates",`the \`${je

428${l.trim()}`)}}let i=ds(n);try{await i.fetch()}catch(a){let c=a instanceof Error?a.message:String(a);throw new Error(`git fetch failed in ${n}

429${c.trim()}`)}let s=e.defaultBranch??"main";return await i.checkout(["-B",s,`origin/${s}`]).catch(()=>{}),i}async function gr(t,e){try{return await t.raw(["cat-file",

432`)}function _d(t,e,r){let n=new Map,o=Je(t,`tasks/${e}/comments.jsonl`);if(aa(o))for(let i of jd(o,"utf-8").split(`

434`)+(t.length>0?`

435`:"")}function Nd(t,e,r){let n=[],o=Je(t,`tasks/${e}/attachments`);if(aa(o))for(let i of Pd(o))n.push(i);for(let i of r)n.includes(i.name)||n.push

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L426

437`,{mode:384})}function ef(t){return ja()[t]}function $o(t,e){let r=ja();r[t]=e,Zd(r)}function Pa(t,e){let r=ae(e),n=ef(t);if(n&&n

438`)?e:e+`

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L436

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L426

443`))!==-1;){let m=v.slice(0,x).trim();v=v.slice(x+1),m&&N(m)}}),u.stderr.on("data",P=>{i.push(P);for(let x of P.split(`

444`)){let m=x.trim();m&&console.warn(`[claude:chat:stderr] ${m}`)}}),u.on("error",P=>{k(),l(P)}),u.on("close",P=>{if(k(),f){l(new Ke);return}if(p){l(

445`))!==-1;){let m=N.slice(0,x).trim();if(N=N.slice(x+1),m){let T=sc(m);u(T),T&&g(T)}}}),C.stderr.on("data",P=>{n.push(P),o.push(P);for(let x of P.split(`

447`).slice(-5).join(`

448`),500)),n.join(" \u2014 ")}function Ff(t){if(!t)return;let e=t.retry_after;if(typeof e=="number"&&e>0)return Math.round(e*1e3);let r=typeof t.result=="string"

450

452`),{artifactPaths:["DRAFT.md"],log:"mock chat session finalized DRAFT.md",usage:pt()}}};function zf(t,e,r){return`# ${t} \u2014 Estimate

453

454**Title:** ${e}

455

456## Effort

Long lines were clipped for display.