registry / @love-moon/conductor-cli / 0.7.0

@love-moon/conductor-cli@0.7.0

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 35 file(s), 624 KB of source, external domains: 127.0.0.1, aistudio.google.com, chat.deepseek.com, chat.openai.com, chat.qwen.ai, claude.ai, conductor.conductor-ai.top, grok.com, opencode.ai, registry.npmjs.org

Source & flagged code

5 flagged

bin/conductor-update.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

3/**

4 * conductor update - Check for and install updates to the CLI.

5 */

7import { fileURLToPath } from "node:url";

8import path from "node:path";

9import fs from "node:fs";

10import { spawn } from "node:child_process";

11import process from "node:process";

High

Child Process

Package source references child process execution.

bin/conductor-update.jsView on unpkg · L9

12import readline from "node:readline/promises";

13import {

14 PACKAGE_NAME,

15 buildUpgradeCommand,

16 resolveInstallMethod,

17 fetchLatestVersion,

18 isNewerVersion,

19 detectPackageManager,

20} from "../src/version-check.js";

21import {

22 buildPnpmAllowBuildArgs,

23 ensurePnpmOnlyBuiltDependencies,

24 repairAndVerifyGlobalNodePty,

25} from "../src/native-deps.js";

27const __filename = fileURLToPath(import.meta.url);

28const __dirname = path.dirname(__filename);

29const PKG_ROOT = path.join(__dirname, "..");

Lines 179-219javascript

179 case "pnpm":

180 cmd = "pnpm";

181 args = ["add", "-g", ...buildPnpmAllowBuildArgs(["node-pty"]), `${PACKAGE_NAME}@latest`];

182 break

bin/conductor.jsView file

Lines 15-55javascript

15 * project - Manage Conductor projects (list/show/create/...)

16 * issue - Manage issues (list/show/create/update/

bin/conductor-fire.jsView file

Lines 20-60javascript

20import yaml from "js-yaml";

21import { createAiSession } from "@love-moon/ai-sdk";

22import { ConductorClient, ProjectContext, loadConfig } from "@love-moon/conductor-sdk";

23import {

24 buildResumeArgsForBackend as

bin/conductor-config.jsView file

Lines 30-70javascript

30 kimi: {

31 command: "kimi",

32 execArgs: "",

33 description: "Moonshot Kimi CLI"

34 },

35 opencode: {

Source & flagged code

5 flagged · loading source

bin/conductor-update.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code