registry / @huicai/cli / 2026.709.53670

@huicai/cli@2026.709.53670

在终端运行的智能体 CLI：以 HuiCai_AI 平台的 OpenAI 兼容 /v1 为模型后端，在用户本机执行文件/命令工具。

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 190 KB of source, external domains: huicai-ai.sjht.com

Source & flagged code

4 flagged

src/device.jsView file

Lines 1-30javascript

1// 设备授权码流（浏览器授权登录）：发起 → 引导用户在浏览器确认 → 轮询换取授权登录令牌。

2// 服务端在用户确认时签发带时限的登录令牌（JWT，默认 7 天）——不再为每次登录铸造 API 令牌，

3// 不占用会员 API 令牌数量额度；令牌过期或改密后需重新授权。响应字段名保留 apiKey 以兼容旧版。

4// 全程只用平台网关的 /v1/device/*（免签名/免登录），CLI 无需预置任何凭据。

6import { spawn } from 'node:child_process';

7import { c } from './colors.js';

High

Child Process

Package source references child process execution.

src/device.jsView on unpkg · L5

9/** 尽力打开系统浏览器（失败静默，用户可手动打开）。HUICAI_NO_BROWSER 置位时跳过（无头/测试环境）。 */

10function openBrowser(url) {

11 if (!url || process.env.HUICAI_NO_BROWSER) return;

12 const platform = process.platform;

13 const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'cmd' : 'xdg-open';

14 const args = platform === 'win32' ? ['/c', 'start', '', url] : [url];

15 try {

16 const child = spawn(cmd, args, { stdio: 'ignore', detached: true });

17 child.on('error', () => {});

18 child.unref();

19 } catch {

20 /* 用户可手动打开 */

21 }

22}

24async function postJson(baseUrl, path, body) {

25 const res = await fetch(`${baseUrl}${path}`, {

26 method: 'POST',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/device.jsView on unpkg · L10

27 headers: { 'Content-Type': 'application/json' },

28 body: JSON.stringify(body || {}),

29 });

30 const text = await res.text();

src/executors.jsView file

Lines 266-306javascript

266 filesHit.push(r);

267 if (args.files_only && filesHit.length >= maxMatches) break;

268 }

269 }

270 if (args.files_only) {

271 return filesHit.length ? filesHit.join('

src/memory.jsView file

Lines 1-21javascript

1// 长期记忆（跨会话）：按项目目录归属，存于 ~/.huicai/memory/<hash>.md。

2// 模型经内置 memory_write 工具主动记录「值得跨会话记住的事实」（用户偏好、项目结论、约定等），

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/memory.jsView on unpkg · L1

3// 每次新会话由 context.js 注入系统提示词——即「长期记忆」；「短期记忆」= 会话消息 + 非破坏式上下文压缩摘要。

4// 开关：config.memoryEnabled（默认开，配置 memory:false 或环境变量 HUICAI_MEMORY=0 关闭）。

6import fs from 'node:fs';

7import path from 'node:path';

Source & flagged code

4 flagged · loading source

src/device.jsView file

5L6: import { spawn } from 'node:child_process'; L7: import { c } from './colors.js';

High

Child Process

Package source references child process execution.

src/device.jsView on unpkg · L5

10function openBrowser(url) { L11: if (!url || process.env.HUICAI_NO_BROWSER) return; L12: const platform = process.platform; ... L15: try { L16: const child = spawn(cmd, args, { stdio: 'ignore', detached: true }); L17: child.on('error', () => {}); ... L24: async function postJson(baseUrl, path, body) { L25: const res = await fetch(`${baseUrl}${path}`, { L26: method: 'POST',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/device.jsView on unpkg · L10

src/executors.jsView file

286const child = isWin L287: ? spawn(process.env.COMSPEC || 'cmd.exe', ['/d', '/s', '/c', command], { cwd, windowsVerbatimArguments: true }) L288: : spawn(process.env.SHELL || '/bin/sh', ['-c', command], { cwd, detached: true });

High

Shell

Package source references shell execution.

src/executors.jsView on unpkg · L286

src/memory.jsView file

1// 长期记忆（跨会话）：按项目目录归属，存于 ~/.huicai/memory/<hash>.md。 L2: // 模型经内置 memory_write 工具主动记录「值得跨会话记住的事实」（用户偏好、项目结论、约定等），

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/memory.jsView on unpkg · L1

Findings

3 High2 Medium6 Low

HighChild Processsrc/device.js

HighShellsrc/executors.js

HighSame File Env Network Executionsrc/device.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/memory.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

src/device.jsView file

Lines 1-30javascript

1// 设备授权码流（浏览器授权登录）：发起 → 引导用户在浏览器确认 → 轮询换取授权登录令牌。

2// 服务端在用户确认时签发带时限的登录令牌（JWT，默认 7 天）——不再为每次登录铸造 API 令牌，

3// 不占用会员 API 令牌数量额度；令牌过期或改密后需重新授权。响应字段名保留 apiKey 以兼容旧版。

4// 全程只用平台网关的 /v1/device/*（免签名/免登录），CLI 无需预置任何凭据。

6import { spawn } from 'node:child_process';

7import { c } from './colors.js';

High

Child Process

Package source references child process execution.

src/device.jsView on unpkg · L5

9/** 尽力打开系统浏览器（失败静默，用户可手动打开）。HUICAI_NO_BROWSER 置位时跳过（无头/测试环境）。 */

10function openBrowser(url) {

11 if (!url || process.env.HUICAI_NO_BROWSER) return;

12 const platform = process.platform;

13 const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'cmd' : 'xdg-open';

14 const args = platform === 'win32' ? ['/c', 'start', '', url] : [url];

15 try {

16 const child = spawn(cmd, args, { stdio: 'ignore', detached: true });

17 child.on('error', () => {});

18 child.unref();

19 } catch {

20 /* 用户可手动打开 */

21 }

22}

24async function postJson(baseUrl, path, body) {

25 const res = await fetch(`${baseUrl}${path}`, {

26 method: 'POST',

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/device.jsView on unpkg · L10

27 headers: { 'Content-Type': 'application/json' },

28 body: JSON.stringify(body || {}),

29 });

30 const text = await res.text();

src/executors.jsView file

Lines 266-306javascript

266 filesHit.push(r);

267 if (args.files_only && filesHit.length >= maxMatches) break;

268 }

269 }

270 if (args.files_only) {

271 return filesHit.length ? filesHit.join('

src/memory.jsView file

Lines 1-21javascript

1// 长期记忆（跨会话）：按项目目录归属，存于 ~/.huicai/memory/<hash>.md。

2// 模型经内置 memory_write 工具主动记录「值得跨会话记住的事实」（用户偏好、项目结论、约定等），

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/memory.jsView on unpkg · L1

3// 每次新会话由 context.js 注入系统提示词——即「长期记忆」；「短期记忆」= 会话消息 + 非破坏式上下文压缩摘要。

4// 开关：config.memoryEnabled（默认开，配置 memory:false 或环境变量 HUICAI_MEMORY=0 关闭）。

6import fs from 'node:fs';

7import path from 'node:path';