Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
User runs `revealui-harnesses start --http-port <port>`; a network client reaches the gateway before pairing.
Impact
A reachable client can invoke supported local AI processes or copy configuration into user AI-harness settings before authentication is established.
Mechanism
Pre-pair unauthenticated HTTP JSON-RPC exposes agent spawning and harness-config synchronization.
Rationale
Source inspection found no covert payload, credential theft, or lifecycle execution. The pre-pair network-exposed RPC and explicit AI-agent configuration mutation warrant a warning rather than a publish block.
Evidence
package.jsondist/cli.jsdist/chunk-TQUX5X3R.jsdist/index.js~/.claude/settings.json~/.cursor/settings.json~/.config/github-copilot/hosts.json~/.revealui/harness-configs/<harness>/settings.json<project>/.claude/workboard.md~/.local/share/revealui/harness.sock
Network endpoints4
0.0.0.0:<user-supplied-port>/v1/chat/completions