registry / @pat-lewczuk/cezar / 0.1.2

@pat-lewczuk/cezar@0.1.2

Local cockpit for running and tracking AI agent tasks in your repo. Uses your logged-in `claude` CLI and `gh` — zero config, zero database.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 321 KB of source, external domains: claude.com, github.com

Source & flagged code

2 flagged

dist/core/claude-cli-runner.jsView file

Lines 1-21javascript

1import { spawn as nodeSpawn } from 'node:child_process';

2import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

dist/core/claude-cli-runner.jsView on unpkg · L1

3import { dirname, resolve as resolvePath } from 'node:path';

4import { costWeightedTokens } from './usage.js';

5/** Default wall-clock cap for a single run before SIGTERM → SIGKILL.

6 * Interactive sessions pass `timeoutMs: 0` to disable it entirely. */

7export const DEFAULT_RUN_TIMEOUT_MS = 30 * 60_000;

8/** Grace period between SIGTERM and SIGKILL when a timeout fires. */

9export const KILL_GRACE_MS = 10_000;

10/** After `end()` closes stdin: claude in stream-json mode can ignore EOF and

11 * hang (janitor-confirmed CLI bug) — escalate SIGTERM, then SIGKILL. */

12export const EOF_TERM_GRACE_MS = 8_000;

13export const EOF_KILL_GRACE_MS = 4_000;

14/** Reopen window after a turn ends before an auto-ended session closes stdin. */

15export const AUTO_END_DELAY_MS = 250;

16/**

17 * `AgentRunner` over the Claude Code CLI in headless stream-json mode. Auth =

18 * the host's logged-in Pro/Max subscription (no API key needed). Sandboxing is

19 * `--allowedTools` (default-deny) + running inside the repo `cwd`; `Bash` is

20 * narrowed to `Bash(<prefix>:*)` patterns when `bashAllowlist` is set.

21 *

dist/core/backend-detect.jsView file

Lines 18-58javascript

18 const version = stdout.trim();

19 // A generic `claude` binary (a shell wrapper, an unrelated tool) can shadow

20 // the real CLI on $PATH — reject anything that doesn't match the banner.

21 if (!/^\d+\.\d+|^claude(\s+code)?\s+version

Source & flagged code

2 flagged · loading source

dist/core/claude-cli-runner.jsView file

1import { spawn as nodeSpawn } from 'node:child_process'; L2: import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

dist/core/claude-cli-runner.jsView on unpkg · L1

dist/core/backend-detect.jsView file

38available: false, L39: hint: 'install Claude Code (npm i -g @anthropic-ai/claude-code) and log in', L40: }; ... L44: try { L45: const { stdout } = await exec('gh', ['auth', 'token'], { timeout: 10_000 }); L46: return { name: 'gh', available: stdout.trim().length > 0, version: 'authenticated' };

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/backend-detect.jsView on unpkg · L38

Findings

3 High3 Medium5 Low

HighChild Processdist/core/claude-cli-runner.js

HighShell

HighRuntime Package Installdist/core/backend-detect.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/core/claude-cli-runner.jsView file

Lines 1-21javascript

1import { spawn as nodeSpawn } from 'node:child_process';

2import { fileURLToPath } from 'node:url';

High

Child Process

Package source references child process execution.

dist/core/claude-cli-runner.jsView on unpkg · L1

3import { dirname, resolve as resolvePath } from 'node:path';

4import { costWeightedTokens } from './usage.js';

5/** Default wall-clock cap for a single run before SIGTERM → SIGKILL.

6 * Interactive sessions pass `timeoutMs: 0` to disable it entirely. */

7export const DEFAULT_RUN_TIMEOUT_MS = 30 * 60_000;

8/** Grace period between SIGTERM and SIGKILL when a timeout fires. */

9export const KILL_GRACE_MS = 10_000;

10/** After `end()` closes stdin: claude in stream-json mode can ignore EOF and

11 * hang (janitor-confirmed CLI bug) — escalate SIGTERM, then SIGKILL. */

12export const EOF_TERM_GRACE_MS = 8_000;

13export const EOF_KILL_GRACE_MS = 4_000;

14/** Reopen window after a turn ends before an auto-ended session closes stdin. */

15export const AUTO_END_DELAY_MS = 250;

16/**

17 * `AgentRunner` over the Claude Code CLI in headless stream-json mode. Auth =

18 * the host's logged-in Pro/Max subscription (no API key needed). Sandboxing is

19 * `--allowedTools` (default-deny) + running inside the repo `cwd`; `Bash` is

20 * narrowed to `Bash(<prefix>:*)` patterns when `bashAllowlist` is set.

21 *

dist/core/backend-detect.jsView file

Lines 18-58javascript

18 const version = stdout.trim();

19 // A generic `claude` binary (a shell wrapper, an unrelated tool) can shadow

20 // the real CLI on $PATH — reject anything that doesn't match the banner.

21 if (!/^\d+\.\d+|^claude(\s+code)?\s+version