registry / @frostime/pi-acp / 0.2.1

@frostime/pi-acp@0.2.1

ACP adapter for pi coding agent

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

CopyleftLicense

scanned 1 file(s), 114 KB of source

Source & flagged code

2 flagged

dist/index.jsView file

Lines 34-74javascript

34 return [method];

35}

36function terminalAuthLaunchSpec() {

37 const argv0 = process.argv[0] || "node";

38 const argv1 = process.argv[1];

39 if (argv1 && argv0) {

40 const isNode = argv0.includes("node");

41 const isJs = argv1.endsWith(".js");

42 if (isNode && isJs) {

43 return { command: argv0, args: [argv1, "--terminal-login"] };

44 }

45 }

46 return { command: "pi-acp", args: ["--terminal-login"] };

47}

49// src/acp/session.ts

50import { RequestError as RequestError2 } from "@agentclientprotocol/sdk";

51import { readFileSync as readFileSync3 } from "fs";

52import { isAbsolute, resolve as resolvePath } from "path";

54// src/pi-rpc/process.ts

55import { spawn } from "child_process";

56import * as readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L54

58// src/pi-rpc/command.ts

59import { platform } from "os";

60function defaultPiCommand() {

61 return platform() === "win32" ? "pi.cmd" : "pi";

62}

63function getPiCommand(override) {

64 return override ?? defaultPiCommand();

65}

66function shouldUseShellForPiCommand(cmd) {

67 if (platform() !== "win32") return false;

68 const normalized = cmd.trim().toLowerCase();

69 return normalized.endsWith(".cmd") || normalized.endsWith(".bat");

70}

72// src/pi-rpc/process.ts

73var PiRpcSpawnError = class extends Error {

74 /** Underlying spawn error code, e.g. ENOENT, EACCES */

Lines 3158-3198javascript

3158 if (!provider || !modelId) {

3159 throw RequestError3.invalidParams(`Unknown modelId: ${requestedModelId}`);

3160 }

3161 await proc.setModel(provider, modelId);

3162}

3163function isSemver(v) {

3164

Source & flagged code

2 flagged · loading source

dist/index.jsView file

54// src/pi-rpc/process.ts L55: import { spawn } from "child_process"; L56: import * as readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L54

3178try { L3179: const piVersion = spawnSync("pi", ["--version"], { encoding: "utf-8" }); L3180: const installed = (String(piVersion.stdout ?? "").trim() || String(piVersion.stderr ?? "").trim()).replace( ... L3191: if (compareSemver(latest, installed) <= 0) return null; L3192: return `New version available: v${latest} (installed v${installed}). Run: \`npm i -g @earendil-works/pi-coding-agent\``; L3193: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3178

Findings

3 High2 Medium5 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowCopyleft License

Source & flagged code

2 flagged

dist/index.jsView file

Lines 34-74javascript

34 return [method];

35}

36function terminalAuthLaunchSpec() {

37 const argv0 = process.argv[0] || "node";

38 const argv1 = process.argv[1];

39 if (argv1 && argv0) {

40 const isNode = argv0.includes("node");

41 const isJs = argv1.endsWith(".js");

42 if (isNode && isJs) {

43 return { command: argv0, args: [argv1, "--terminal-login"] };

44 }

45 }

46 return { command: "pi-acp", args: ["--terminal-login"] };

47}

49// src/acp/session.ts

50import { RequestError as RequestError2 } from "@agentclientprotocol/sdk";

51import { readFileSync as readFileSync3 } from "fs";

52import { isAbsolute, resolve as resolvePath } from "path";

54// src/pi-rpc/process.ts

55import { spawn } from "child_process";

56import * as readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L54

58// src/pi-rpc/command.ts

59import { platform } from "os";

60function defaultPiCommand() {

61 return platform() === "win32" ? "pi.cmd" : "pi";

62}

63function getPiCommand(override) {

64 return override ?? defaultPiCommand();

65}

66function shouldUseShellForPiCommand(cmd) {

67 if (platform() !== "win32") return false;

68 const normalized = cmd.trim().toLowerCase();

69 return normalized.endsWith(".cmd") || normalized.endsWith(".bat");

70}

72// src/pi-rpc/process.ts

73var PiRpcSpawnError = class extends Error {

74 /** Underlying spawn error code, e.g. ENOENT, EACCES */

Lines 3158-3198javascript

3158 if (!provider || !modelId) {

3159 throw RequestError3.invalidParams(`Unknown modelId: ${requestedModelId}`);

3160 }

3161 await proc.setModel(provider, modelId);

3162}

3163function isSemver(v) {

3164