registry / @jaggerxtrm/pi-extensions / 0.9.5

@jaggerxtrm/pi-extensions@0.9.5

Unified Pi extension entrypoint for xtrm-managed extensions

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 47 file(s), 206 KB of source, external domains: chat.qwen.ai, dashscope.aliyuncs.com, github.com

Source & flagged code

1 flagged

extensions/xtrm-ui/index.tsView file

Lines 155-195typescript

155 if (realArgvPath.endsWith("/dist/cli.js")) {

156 candidates.push(join(dirname(realArgvPath), "index.js"));

157 }

158 }

159

160 candidates.push(

161 join(dirname(process.execPath), "..", "lib", "node_modules", "@earendil-works", "pi-coding-agent", "dist", "index.js"),

162 );

163

164 try {

165 candidates.push(maybeFileUrlToPath(import.meta.resolve("@earendil-works/pi-coding-agent")));

166 } catch {}

167

168 const entryPath = candidates.find((candidate) => existsSync(candidate));

169 if (!entryPath) throw new Error("Could not resolve pi-coding-agent entry path");

170 return entryPath;

171}

172

173async function installSilentHiddenThinkingPatch(): Promise<void> {

174 const entryPath = resolvePiCodingAgentEntryPath();

175 const componentPath = join(dirname(entryPath), "modes", "interactive", "components", "assistant-message.js");

176 const mod = await import(pathToFileURL(componentPath).href) as {

177 AssistantMessageComponent?: AssistantMessageComponentCtor;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

extensions/xtrm-ui/index.tsView on unpkg · L175

178 };

179 const proto = mod.AssistantMessageComponent?.prototype as

180 | (AssistantMessageComponentCtor["prototype"] & { [PATCHED_ASSISTANT_MESSAGE]?: boolean })

181 | undefined;

182 if (!proto?.updateContent || proto[PATCHED_ASSISTANT_MESSAGE]) return;

183

184 const updateContent = proto.updateContent;

185 proto.updateContent = function patchedUpdateContent(this: PatchableAssistantMessage, message: AssistantMessageLike) {

186 if (this.hiddenThinkingLabel === "" && Array.isArray(message.content)) {

187 if (!this.__xtrmThinkingExpanded) {

188 updateContent.call(this, {

189 ...message,

190 content: message.content.filter((block) => block.type !== "thinking" || !block.thinking?.trim()),

191 });

192 return;

193 }

194

195 const previousHideThinking = this.hideThinkingBlock;

Source & flagged code

1 flagged · loading source

extensions/xtrm-ui/index.tsView file

175const componentPath = join(dirname(entryPath), "modes", "interactive", "components", "assistant-message.js"); L176: const mod = await import(pathToFileURL(componentPath).href) as { L177: AssistantMessageComponent?: AssistantMessageComponentCtor;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

extensions/xtrm-ui/index.tsView on unpkg · L175

Findings

4 Medium5 Low

MediumDynamic Requireextensions/xtrm-ui/index.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

extensions/xtrm-ui/index.tsView file

Lines 155-195typescript

155 if (realArgvPath.endsWith("/dist/cli.js")) {

156 candidates.push(join(dirname(realArgvPath), "index.js"));

157 }

158 }

159

160 candidates.push(

161 join(dirname(process.execPath), "..", "lib", "node_modules", "@earendil-works", "pi-coding-agent", "dist", "index.js"),

162 );

163

164 try {

165 candidates.push(maybeFileUrlToPath(import.meta.resolve("@earendil-works/pi-coding-agent")));

166 } catch {}

167

168 const entryPath = candidates.find((candidate) => existsSync(candidate));

169 if (!entryPath) throw new Error("Could not resolve pi-coding-agent entry path");

170 return entryPath;

171}

172

173async function installSilentHiddenThinkingPatch(): Promise<void> {

174 const entryPath = resolvePiCodingAgentEntryPath();

175 const componentPath = join(dirname(entryPath), "modes", "interactive", "components", "assistant-message.js");

176 const mod = await import(pathToFileURL(componentPath).href) as {

177 AssistantMessageComponent?: AssistantMessageComponentCtor;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

extensions/xtrm-ui/index.tsView on unpkg · L175

178 };

179 const proto = mod.AssistantMessageComponent?.prototype as

180 | (AssistantMessageComponentCtor["prototype"] & { [PATCHED_ASSISTANT_MESSAGE]?: boolean })

181 | undefined;

182 if (!proto?.updateContent || proto[PATCHED_ASSISTANT_MESSAGE]) return;

183

184 const updateContent = proto.updateContent;

185 proto.updateContent = function patchedUpdateContent(this: PatchableAssistantMessage, message: AssistantMessageLike) {

186 if (this.hiddenThinkingLabel === "" && Array.isArray(message.content)) {

187 if (!this.__xtrmThinkingExpanded) {

188 updateContent.call(this, {

189 ...message,

190 content: message.content.filter((block) => block.type !== "thinking" || !block.thinking?.trim()),

191 });

192 return;

193 }

194

195 const previousHideThinking = this.hideThinkingBlock;