registry / @phnx-labs/agents-cli / 1.23.17

@phnx-labs/agents-cli@1.23.17

⚠ Under review

One CLI for all your AI coding agents - versions, config, cloud dispatch, sessions, and teams (now with first-class Grok Build CLI support)

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The inspected lifecycle and notification excerpts do not establish malicious behavior. Manual review is appropriate because required plugin and session-discovery source files were unreadable, leaving their runtime behavior unresolved.

Static reason

High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Trigger

Unknown; the unresolved modules may be reached through package runtime entrypoints.

Impact

Unassessed; the available evidence does not establish an attack.

Mechanism

The plugin and session-discovery modules could not be inspected as UTF-8 source, preventing assessment of their behavior and callers.

AI rationale

Evidence

dist/lib/plugins/plugins.jsdist/lib/session/discover.js

Decision evidence

public snapshot

AI called this Manual Review at 82.0% confidence as Unknown with medium false-positive risk.

AI review observations

The manifest configures a postinstall script and exposes the CLI through dist/index.js.
The visible local-install branch exits after advising the user to run setup.
Visible owner notifications send a session or device credential to the configured Rush API base; the recipient restriction was not fully assessed.
The postinstall path can start or restart the daemon when its enabled setting is true.
The required plugin and session-discovery modules could not be inspected as text, leaving relevant behavior unresolved.

Evidence against

The inspected local-install path does not modify shell configuration; it only prints setup guidance.
The inspected notification code uses the package's Rush API base, with no evidence in these excerpts of disclosure to an unrelated recipient.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

Source & flagged code

20 flagged

package.jsonView file

Lines 29-69json

29 "CHANGELOG.md",

30 "README.md",

31 "LICENSE"

32 ],

33 "publishConfig": {

34 "provenance": true

35 },

36 "repository": {

37 "type": "git",

38 "url": "git+https://github.com/phnx-labs/agi-cli.git"

39 },

40 "homepage": "https://agents-cli.sh",

41 "bugs": {

42 "url": "https://github.com/phnx-labs/agi-cli/issues"

43 },

44 "scripts": {

45 "build": "tsc && rm -rf 'dist/lib/menubar/MenubarHelper.app' && ([ -f 'bin/agents-macos' ] && mkdir -p dist/bin && cp -f 'bin/agents-macos' 'dist/bin/agents' && chmod 755 'dist/bin/agents' || true)",

46 "build:bin": "scripts/build-bin.sh",

47 "prepare": "npm run build",

48 "prepack": "cp ../README.md README.md",

49 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 "dev": "tsx src/index.ts",

51 "changelog": "bun scripts/gen-changelog.ts",

52 "gen:index": "bun scripts/gen-command-index.ts",

53 "verify:index": "bash scripts/verify-command-index.sh",

54 "start": "node dist/index.js",

55 "test": "TZ=UTC node ./node_modules/vitest/vitest.mjs run",

56 "bench": "node ./node_modules/vitest/vitest.mjs bench --run",

57 "typecheck:bench": "tsc --noEmit --ignoreConfig --skipLibCheck --module esnext --moduleResolution bundler --target es2022 --strict --esModuleInterop --lib es2022 --types node src/lib/*.bench.ts src/lib/**/*.bench.ts",

58 "test:remote": "scripts/sandbox.sh test",

59 "verify-docs": "scripts/verify-docs.sh",

60 "test:watch": "node ./node_modules/vitest/vitest.mjs"

61 },

62 "keywords": [

63 "agents",

64 "cli",

65 "dotfiles",

66 "claude",

67 "codex",

68 "cursor",

69 "opencode",

dist/lib/sqlite.jsView file

Lines 1-22javascript

1import { createRequire } from 'module';

2const isBun = typeof globalThis.Bun !== 'undefined';

3const require = createRequire(

dist/lib/platform/ipc.jsView file

Lines 1-9javascript

1import * as crypto from 'crypto';

2export function ipcEndpoint(socketPath, platform = process.platform) {

3 if (platform ===

dist/lib/menubar/install-menubar.jsView file

Lines 1-21javascript

1import { fileURLToPath } from 'url';

2import { execFileSync, spawnSync, spawn } from 'child_process';

3import * as fs from 'fs';

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/commands/setup-fleet.jsView file

Lines 1-21javascript

1import chalk from 'chalk';

2import { spawnSync } from 'node:child_process';

3import { getCliLaunch } from '../lib/cli-entry.js';

4import { loadDevices } from '../lib/devices/registry.js'

dist/lib/daemon/daemon.jsView file

Lines 1-31javascript

1import { daemonProcessViewAllowed, recordDaemonProcessView } from '../session/process-view.js';

2import { spawn, execFileSync } from 'child_process';

3import * as fs from 'fs';

4import

dist/lib/state.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. import * as fs from 'fs'; import * as path from 'path'; import * as os from 'os'; import * as yaml from 'yaml'; import { stringifydoc } from './yaml-io.js'; import { execfilesync } from 'child_process'; import { ensurelocktarget, atomicwritefilesync, withfilelock } from './fs-atomic.js'; import { default_system_repo, systemreposlug } from './types.js'; import { machineid } from './machine-id.js'; const home = process.env.home ?? os.homedir(); function issamepath(a, b) { try { return fs.realpathsync.native(a) === fs.realpathsync.native(b); } catch { const norm = (p) => process.platform === 'win32' ? path.resolve(p).tolowercase() : path.resolve(p);

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/lib/state.jsView on unpkg

scripts/postinstall.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2// Runs after npm install -g @phnx-labs/agents-cli.

4import * as fs from 'fs';

5import * as path from 'path';

dist/session-tracker/dist/hook.shView file

•path = dist/session-tracker/dist/hook.sh kind = build_helper sizeBytes = 4499 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/session-tracker/dist/hook.shView on unpkg

dist/commands/daemon.js#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 25

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

dist/commands/daemon.js#virtual:normalized:round1View on unpkg

dist/lib/session/discover.jsView file

•matchType = token_shingles matchedPackage = @phnx-labs/agents-cli@1.22.109 matchedPath = dist/lib/session/discover.js matchedIdentity = npm:QHBobngtbGFicy9hZ2VudHMtY2xp:1.22.109 similarity = 1.000 shingleOverlap = 48 summary = source token shingles overlapped finalized malicious source

High