registry / @jolli.ai/cli / 0.99.8

@jolli.ai/cli@0.99.8

AI development process auto-documentation tool - generates structured commit summaries from Claude Code, Codex, Gemini, OpenCode, Cursor, and Copilot sessions

AI Security Review

scanned 27d ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A guarded upgrade-time installer can re-enable Jolli hooks and MCP registrations across detected AI-agent surfaces. No credential theft, destructive action, or remote code-loading chain was confirmed.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall during a legacy Jolli installation with ~/.jolli/jollimemory/dist-path or dist-paths present

Impact

Registers a local Jolli MCP command and hooks in project and machine-global agent configuration.

Mechanism

Legacy Jolli migration invokes installer and writes local hook/MCP configuration

Rationale

Source confirms guarded postinstall mutation of broad AI-agent control surfaces, so it merits a warning under the lifecycle policy. The mutation is tied to an existing Jolli installation and uses local package code; no exfiltration or remote payload execution was found.

Evidence

package.jsondist/PostInstall.jsdist/Installer.jsREADME.md~/.jolli/jollimemory/~/.codex/config.toml~/.gemini/settings.json~/.config/opencode/opencode.json~/.copilot/mcp-config.json

Decision evidence

public snapshot

with false-positive risk.

@jolli.ai/cli@0.99.8

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code