registry / @jolli.ai/cli / 0.99.11

@jolli.ai/cli@0.99.11

Automatic development memory for AI coding agents: turns your Claude Code, Codex, Gemini, Cursor, Copilot, Cline, Devin, OpenCode, Antigravity and Kimi Code sessions into structured commit summaries your agent can recall over MCP

Static Scan Results

scanned 22d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 98 file(s), 3.29 MB of source, external domains: 127.0.0.1, auth.jolli.ai, context7.com, docs.zoom.us, git-scm.com, github.com, www.eclipse.org, www.jolli.ai, www.w3.org

Source & flagged code

5 flagged

package.jsonView file

Lines 26-66json

26 "schemas/",

27 "README.md"

28 ],

29 "scripts": {

30 "all": "npm run clean && npm run build && npm run lint && npm run test",

31 "build": "vite build && tsc --project tsconfig.build.json",

32 "postbuild": "node -e \"require('fs').chmodSync('dist/Cli.js', 0o755)\"",

33 "clean": "rimraf dist/",

34 "typecheck": "tsc --noEmit",

35 "lint": "biome check --error-on-warnings",

36 "lint:fix": "biome check --write",

37 "cli": "tsx src/Cli.ts",

38 "cli:build": "npm run build && node dist/Cli.js",

39 "gen:telemetry-doc": "tsx scripts/gen-telemetry-doc.mjs",

40 "test": "vitest run --coverage",

41 "test:fast": "vitest run --mode fast --coverage --reporter=dot",

42 "test:slow": "vitest run --mode slow --reporter=dot",

43 "test:changed": "vitest run --changed origin/main --reporter=dot",

44 "test:watch": "vitest",

45 "test:acceptance": "vitest run --config vitest.acceptance.config.ts",

46 "postinstall": "node -e \"require('fs').existsSync('dist/PostInstall.js') && require('child_process').spawnSync(process.execPath,['dist/PostInstall.js'],{stdio:'inherit'})\""

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L46

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L46

47 },

48 "keywords": [

49 "ai",

50 "ai-agent",

51 "coding-agent",

52 "mcp",

53 "model-context-protocol",

54 "memory",

55 "documentation",

56 "git-hooks",

57 "claude-code",

58 "codex",

59 "gemini",

60 "opencode",

61 "kimi",

62 "cursor",

63 "copilot",

64 "cline",

65 "devin",

66 "antigravity",

dist/CliUtils.jsView file

Lines 422-462javascript

422 }));

423 }

424 }

425 return r;

426}

427async function We(e, t, n) {

428

dist/QueueWorker.jsView file

Lines 48-88javascript

48 const n = Et(e);

49 await G(n, { recursive: !0 });

50 const s = { lastIngestedAt: new

dist/graph-assets/vendor/elk.bundled.jsView file

•stage = ast_semantic_analysis; reason = ast_path_work_budget_exceeded; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/graph-assets/vendor/elk.bundled.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code