registry / @frostime/pi-acp / 0.1.1

@frostime/pi-acp@0.1.1

ACP adapter for pi coding agent

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The user-invoked ACP adapter starts the preinstalled Pi agent, maintains its own session map, and performs a bounded npm version lookup for an update notice.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs `pi-acp` through an ACP client or with `--terminal-login`.

Impact

No credential harvesting, exfiltration, remote payload execution, or unconsented AI-agent configuration mutation was found.

Mechanism

Pi subprocess adapter with session persistence and update checking.

Rationale

The flagged subprocess and npm signals are package-aligned runtime behavior: this CLI adapts an already installed `pi` executable and checks its version. Source inspection found no install-time execution or concrete malicious chain.

Evidence

package.jsondist/index.jsREADME.md~/.pi/pi-acp/session-map.json~/.pi/agent/settings.json~/.pi/agent/sessions

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

`dist/index.js` launches the user-configured/preinstalled `pi` executable during ACP sessions.
`dist/index.js` runs `npm view @earendil-works/pi-coding-agent version` only to display an update notice.
`dist/index.js` writes ACP session metadata to `~/.pi/pi-acp/session-map.json`.

Evidence against

`package.json` has no `preinstall`, `install`, or `postinstall` hook.
No direct network client, payload download, eval/vm, or dynamic remote-code execution appears in `dist/index.js`.
`npm install` strings are user-facing prerequisite/error guidance; no runtime install command is executed.
Agent settings, skills, prompts, and extensions are read for startup display; no agent configuration is written.
Extension UI requests are routed through ACP permission prompts or cancelled.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

Manifest

CopyleftLicense

scanned 1 file(s), 108 KB of source

Source & flagged code

2 flagged

dist/index.jsView file

Lines 34-74javascript

34 return [method];

35}

36function terminalAuthLaunchSpec() {

37 const argv0 = process.argv[0] || "node";

38 const argv1 = process.argv[1];

39 if (argv1 && argv0) {

40 const isNode = argv0.includes("node");

41 const isJs = argv1.endsWith(".js");

42 if (isNode && isJs) {

43 return { command: argv0, args: [argv1, "--terminal-login"] };

44 }

45 }

46 return { command: "pi-acp", args: ["--terminal-login"] };

47}

49// src/acp/session.ts

50import { RequestError as RequestError2 } from "@agentclientprotocol/sdk";

51import { readFileSync as readFileSync3 } from "fs";

52import { isAbsolute, resolve as resolvePath } from "path";

54// src/pi-rpc/process.ts

55import { spawn } from "child_process";

56import * as readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L54

58// src/pi-rpc/command.ts

59import { platform } from "os";

60function defaultPiCommand() {

61 return platform() === "win32" ? "pi.cmd" : "pi";

62}

63function getPiCommand(override) {

64 return override ?? defaultPiCommand();

65}

66function shouldUseShellForPiCommand(cmd) {

67 if (platform() !== "win32") return false;

68 const normalized = cmd.trim().toLowerCase();

69 return normalized.endsWith(".cmd") || normalized.endsWith(".bat");

70}

72// src/pi-rpc/process.ts

73var PiRpcSpawnError = class extends Error {

74 /** Underlying spawn error code, e.g. ENOENT, EACCES */

Lines 2969-3009javascript

2969 if (!provider || !modelId) {

2970 throw RequestError3.invalidParams(`Unknown modelId: ${requestedModelId}`);

2971 }

2972 await proc.setModel(provider, modelId);

2973}

2974function isSemver(v) {

2975

Source & flagged code

2 flagged · loading source

dist/index.jsView file

54// src/pi-rpc/process.ts L55: import { spawn } from "child_process"; L56: import * as readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L54

2989try { L2990: const piVersion = spawnSync("pi", ["--version"], { encoding: "utf-8" }); L2991: const installed = (String(piVersion.stdout ?? "").trim() || String(piVersion.stderr ?? "").trim()).replace( ... L3002: if (compareSemver(latest, installed) <= 0) return null; L3003: return `New version available: v${latest} (installed v${installed}). Run: \`npm i -g @earendil-works/pi-coding-agent\``; L3004: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L2989

Findings

3 High1 Medium4 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowCopyleft License

Source & flagged code

2 flagged

dist/index.jsView file

Lines 34-74javascript

34 return [method];

35}

36function terminalAuthLaunchSpec() {

37 const argv0 = process.argv[0] || "node";

38 const argv1 = process.argv[1];

39 if (argv1 && argv0) {

40 const isNode = argv0.includes("node");

41 const isJs = argv1.endsWith(".js");

42 if (isNode && isJs) {

43 return { command: argv0, args: [argv1, "--terminal-login"] };

44 }

45 }

46 return { command: "pi-acp", args: ["--terminal-login"] };

47}

49// src/acp/session.ts

50import { RequestError as RequestError2 } from "@agentclientprotocol/sdk";

51import { readFileSync as readFileSync3 } from "fs";

52import { isAbsolute, resolve as resolvePath } from "path";

54// src/pi-rpc/process.ts

55import { spawn } from "child_process";

56import * as readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L54

58// src/pi-rpc/command.ts

59import { platform } from "os";

60function defaultPiCommand() {

61 return platform() === "win32" ? "pi.cmd" : "pi";

62}

63function getPiCommand(override) {

64 return override ?? defaultPiCommand();

65}

66function shouldUseShellForPiCommand(cmd) {

67 if (platform() !== "win32") return false;

68 const normalized = cmd.trim().toLowerCase();

69 return normalized.endsWith(".cmd") || normalized.endsWith(".bat");

70}

72// src/pi-rpc/process.ts

73var PiRpcSpawnError = class extends Error {

74 /** Underlying spawn error code, e.g. ENOENT, EACCES */

Lines 2969-3009javascript

2969 if (!provider || !modelId) {

2970 throw RequestError3.invalidParams(`Unknown modelId: ${requestedModelId}`);

2971 }

2972 await proc.setModel(provider, modelId);

2973}

2974function isSemver(v) {

2975