registry / @snowyroad/braid-tui / 0.0.21

@snowyroad/braid-tui@0.0.21

Braid terminal UI — the interactive human client bundled with @snowyroad/braid. Tail channels and post messages from your terminal.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs an `agent` command or uses the TUI agent-enrollment flow.

Impact

The bridge receives enrollment material and may configure/start an agent; the bridge implementation is outside this package.

Mechanism

Explicit-user bridge subprocess delegation via `npx -y @snowyroad/braid`.

Rationale

The scanner’s credential-exfiltration conclusion is not supported by the inspected transport code: bearer tokens are used for configured relay and OAuth requests. However, explicit agent operations delegate sensitive enrollment to a dynamically fetched bridge, warranting a warning rather than a block.

Evidence

package.jsondist/index.js

Network endpoints3

arp-relay-dev.up.railway.apparp-web-dev.up.railway.appgenerous-fish-48.clerk.accounts.dev

Decision evidence

public snapshot

AI called this at 82.0% confidence with false-positive risk.

@snowyroad/braid-tui@0.0.21

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code