registry / @frostime/pi-acp / 0.2.1

@frostime/pi-acp@0.2.1

ACP adapter for pi coding agent

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

CopyleftLicense

scanned 1 file(s), 114 KB of source

Source & flagged code

2 flagged

dist/index.jsView file

Lines 34-74javascript

34 return [method];

35}

36function terminalAuthLaunchSpec() {

37 const argv0 = process.argv[0] || "node";

38 const argv1 =

Source & flagged code

2 flagged · loading source

dist/index.jsView file

54// src/pi-rpc/process.ts L55: import { spawn } from "child_process"; L56: import * as readline from "readline";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L54

3178try { L3179: const piVersion = spawnSync("pi", ["--version"], { encoding: "utf-8" }); L3180: const installed = (String(piVersion.stdout ?? "").trim() || String(piVersion.stderr ?? "").trim()).replace( ... L3191: if (compareSemver(latest, installed) <= 0) return null; L3192: return `New version available: v${latest} (installed v${installed}). Run: \`npm i -g @earendil-works/pi-coding-agent\``; L3193: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3178

Findings

3 High2 Medium5 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowCopyleft License

Lines 3158-3198javascript

3158 if (!provider || !modelId) {

3159 throw RequestError3.invalidParams(`Unknown modelId: ${requestedModelId}`);

3160 }

3161 await proc.setModel(provider, modelId);

3162}

3163function isSemver(v) {

3164 return /^\d+\.\d+\.\d+(?:[-+].+)?$/.test(v);

3165}

3166function compareSemver(a, b) {

3167 const pa = a.split(/[.-]/).slice(0, 3).map((n) => Number(n));

3168 const pb = b.split(/[.-]/).slice(0, 3).map((n) => Number(n));

3169 for (let i = 0; i < 3; i++) {

3170 const da = pa[i] ?? 0;

3171 const db = pb[i] ?? 0;

3172 if (da > db) return 1;

3173 if (da < db) return -1;

3174 }

3175 return 0;

3176}

3177function buildUpdateNotice() {

3178 try {

3179 const piVersion = spawnSync("pi", ["--version"], { encoding: "utf-8" });

3180 const installed = (String(piVersion.stdout ?? "").trim() || String(piVersion.stderr ?? "").trim()).replace(

3181 /^v/i,

3182 ""

3183 );

3184 if (!installed || !isSemver(installed)) return null;

3185 const latestRes = spawnSync("npm", ["view", "@earendil-works/pi-coding-agent", "version"], {

3186 encoding: "utf-8",

3187 timeout: 800

3188 });

3189 const latest = String(latestRes.stdout ?? "").trim().replace(/^v/i, "");

3190 if (!latest || !isSemver(latest)) return null;

3191 if (compareSemver(latest, installed) <= 0) return null;

3192 return `New version available: v${latest} (installed v${installed}). Run: \`npm i -g @earendil-works/pi-coding-agent\``;

3193 } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L3178

3194 return null;

3195 }

3196}

3197function buildStartupInfo(opts) {

3198 void opts.fileCommands;