registry / bob-worktrees / 2.1.0

bob-worktrees@2.1.0

Git worktree management for parallel development with IBM Bob IDE. Installs globally and auto-configures the MCP server so Bob can create, switch, merge, and delete worktrees via natural language.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM flags this version as an AI-agent control-surface risk. Installing the package automatically modifies Bob's global MCP configuration, affecting all workspaces. It registers this package as a server that can invoke repository-defined shell hooks during worktree creation.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation, followed by Bob invoking the registered MCP worktree-creation tool.

Impact

A package install changes a broad AI-agent control surface without an explicit setup command; subsequent agent use can execute commands from the opened repository.

Mechanism

Automatic global MCP registration plus execution of repository-supplied hook commands.

Policy narrative

The postinstall hook selects or creates a global Bob MCP configuration file and inserts an entry that launches the package's MCP server. This occurs automatically on installation and can reset malformed configuration. Once loaded by Bob, the server's worktree-creation path reads a repository hooks file and executes each configured command. The automatic broad agent configuration mutation and resulting command-execution path create an unconsented control-surface risk.

Rationale

This package uses an automatic npm lifecycle hook to modify a global AI-agent configuration rather than requiring an explicit user setup action. The registered server can then execute repository-supplied commands, making the combined path concrete install-hook abuse.

Evidence

package.jsonscripts/postinstall.jsmcp-server/index.js~/.bob/settings/mcp.json~/.bob/mcp.json~/.config/bob/mcp.json.bob-worktrees/hooks.json

Decision evidence

public snapshot

AI identified this as a dangerous AI-agent capability at 94.0% confidence with low false-positive risk.

Evidence for policy risk

The manifest automatically runs a postinstall script.
Postinstall targets Bob's global MCP configuration locations and registers a server launched from this package.
The install hook creates parent directories and rewrites the selected global MCP configuration; malformed existing configuration is reset.
The registered MCP server can execute commands supplied by a repository hooks file when a worktree is created.

Evidence against

No network requests, credential harvesting, self-dependency, or payload download were found.
The registered command points to the package's local MCP server rather than a remote executable.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 4 file(s), 39.7 KB of source

Source & flagged code

8 flagged

package.jsonView file

Lines 1-41json

2 "name": "bob-worktrees",

3 "version": "2.1.0",

4 "description": "Git worktree management for parallel development with IBM Bob IDE. Installs globally and auto-configures the MCP server so Bob can create, switch, merge, and delete worktrees via natural language.",

5 "main": "cli/index.js",

6 "type": "module",

7 "bin": {

8 "bob-worktree": "cli/index.js"

9 },

10 "files": [

11 "cli/",

12 "mcp-server/",

13 "scripts/postinstall.js",

14 "skill/",

15 "README.md",

16 "LICENSE"

17 ],

18 "scripts": {

19 "start": "node cli/index.js",

20 "mcp": "node mcp-server/index.js",

21 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L21

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L21

22 "test": "node --test tests/postinstall.test.js tests/mcp-server.test.js",

23 "health": "node scripts/health-check.cjs"

24 },

High

Suspicious Lifecycle Evidence

The manifest automatically runs a postinstall script.

package.jsonView on unpkg · L18

25 "keywords": [

26 "git",

27 "worktree",

28 "bob",

29 "ibm-bob",

30 "mcp",

31 "model-context-protocol",

32 "parallel-development",

33 "developer-tools"

34 ],

35 "author": "IBM Data Core Agentic Engineering Guild",

36 "license": "MIT",

37 "repository": {

38 "type": "git",

39 "url": "git+https://github.com/Gola-k/bob-worktrees.git"

40 },

41 "bugs": {

scripts/postinstall.jsView file

Lines 2-42javascript

2/**

3 * postinstall.js — runs after `npm install -g bob-worktrees`

4 *

5 * Locates (or creates) the user's Bob IDE global mcp.json and adds

6 * the bob-worktrees MCP server entry without touching any other entries.

7 */

9import fs from 'fs';

10import path from 'path';

11import os from 'os';

12import { fileURLToPath } from 'url';

14const __dirname = path.dirname(fileURLToPath(import.meta.url));

16// ── Resolve the absolute path to the installed MCP server ──────────────────

17// When installed globally: __dirname = <npm-global>/lib/node_modules/bob-worktrees/scripts

18// When installed locally: __dirname = <project>/node_modules/bob-worktrees/scripts

19const packageRoot = path.resolve(__dirname, '..');

20const mcpServerPath = path.join(packageRoot, 'mcp-server', 'index.js');

22// ── Candidate locations for Bob IDE's mcp.json (checked in order) ──────────

23// Bob IDE v2+ reads: ~/.bob/settings/mcp.json (global, all workspaces)

24// Bob IDE legacy: ~/.bob/mcp.json (pre-v2 global fallback)

25// Workspace-local: .bob/mcp.json (project-only override)

26const home = os.homedir();

27const MCP_CANDIDATES = [

28 path.join(home, '.bob', 'settings', 'mcp.json'), // Bob IDE v2+ (primary)

29 path.join(home, '.bob', 'mcp.json'), // Bob IDE v1 legacy

30 path.join(home, '.config', 'bob', 'mcp.json'), // XDG fallback

31];

High

Suspicious Lifecycle Evidence

Postinstall targets Bob's global MCP configuration locations and registers a server launched from this package.

scripts/postinstall.jsView on unpkg · L22

33// ── The entry we want to write ──────────────────────────────────────────────

34const SERVER_KEY = 'bob-worktrees';

35const SERVER_ENTRY = {

36 command: process.execPath, // absolute path to the node binary

37 args: [mcpServerPath],

38 env: { NODE_ENV: 'production' },

39};

41// ── Helpers ─────────────────────────────────────────────────────────────────

42function readJson(filePath) {

Lines 53-116javascript

53function locateMcpJson() {

54 for (const candidate of MCP_CANDIDATES) {

55 if (fs.existsSync(candidate)) return candidate;

56 }

57 return null; // will be created at MCP_CANDIDATES[0]

58}

60// ── Main ────────────────────────────────────────────────────────────────────

61function run() {

62 // Skip during local `npm install` inside the bob-worktrees repo itself

63 // (only run when user installs the package into their own environment)

64 const initCwd = process.env.INIT_CWD || '';

65 if (initCwd === packageRoot || initCwd === process.cwd()) {

66 // Running inside the package repo — skip

67 console.log('ℹ Skipping MCP auto-configuration (running inside package repo).');

68 return;

69 }

71 const TARGET_PATH = locateMcpJson() ?? MCP_CANDIDATES[0];

73 // Ensure parent directory exists

74 fs.mkdirSync(path.dirname(TARGET_PATH), { recursive: true });

76 // Read existing config

77 let config = readJson(TARGET_PATH);

78 const wasCorrupt = config === null;

79 if (wasCorrupt) {

80 console.warn(`⚠ Existing ${TARGET_PATH} contained invalid JSON — it will be reset.`);

81 config = {};

82 }

84 // Ensure structure

85 if (!config.mcpServers) config.mcpServers = {};

87 // Idempotent write

High

Suspicious Lifecycle Evidence

The install hook creates parent directories and rewrites the selected global MCP configuration; malformed existing configuration is reset.

scripts/postinstall.jsView on unpkg · L76

88 const alreadyPresent =

89 JSON.stringify(config.mcpServers[SERVER_KEY]) === JSON.stringify(SERVER_ENTRY);

91 if (alreadyPresent) {

92 console.log(`✓ bob-worktrees MCP server already configured in:\n ${TARGET_PATH}`);

93 return;

94 }

96 config.mcpServers[SERVER_KEY] = SERVER_ENTRY;

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L73

98 try {

99 fs.writeFileSync(TARGET_PATH, JSON.stringify(config, null, 2) + '\n', 'utf8');

High

Suspicious Lifecycle Evidence

The install hook creates parent directories and rewrites the selected global MCP configuration; malformed existing configuration is reset.

scripts/postinstall.jsView on unpkg · L96

100

101 console.log('\n╔══════════════════════════════════════════════════════════╗');

102 console.log('║ bob-worktrees — MCP server configured ✓ ║');

103 console.log('╚══════════════════════════════════════════════════════════╝\n');

104 console.log(` Config file : ${TARGET_PATH}`);

105 console.log(` Node binary : ${process.execPath}`);

106 console.log(` MCP server : ${mcpServerPath}`);

107 console.log('\n Restart IBM Bob IDE to load the MCP server, then try:');

108 console.log(' "List my git worktrees"\n');

109 } catch (writeErr) {

110 printManualInstructions(TARGET_PATH, writeErr.message);

111 }

112}

113

114function printManualInstructions(targetPath, reason) {

115 console.error(`\n✗ Could not write to ${targetPath}: ${reason}`);

116 console.error(' Please add the following entry to your Bob IDE mcp.json manually:\n');

mcp-server/index.jsView file

Lines 90-130javascript

90}

92/** Build the default worktree path for a new branch */

93async function buildWorktreePath(branch, repoRoot) {

94 const git = simpleGit(repoRoot);

95 const remotes = await git.getRemotes(true);

96 let repoName;

97 if (remotes.length > 0) {

98 const url =

99 remotes.find(r => r.name === 'origin')?.refs?.fetch ?? remotes[0].refs.fetch;

100 const m = url.match(/\/([^/]+?)(\.git)?$/);

101 repoName = m ? m[1] : path.basename(repoRoot);

102 } else {

103 repoName = path.basename(repoRoot);

104 }

105 const dir = path.join(WORKTREE_BASE, repoName);

106 fs.mkdirSync(dir, { recursive: true });

107 return path.join(dir, `${branch}-${Date.now()}`);

108}

109

110/** Run post-setup hooks if a hooks.json exists */

111function runHooks(worktreePath, repoRoot) {

112 const hooksFile = path.join(repoRoot, '.bob-worktrees', 'hooks.json');

113 if (!fs.existsSync(hooksFile)) return { ran: false };

114 try {

115 const cfg = JSON.parse(fs.readFileSync(hooksFile, 'utf8'));

116 const hooks = cfg.hooks?.post_setup_worktree ?? [];

117 const results = [];

118 for (const h of hooks) {

119 execSync(h.command, {

120 cwd: worktreePath,

121 env: { ...process.env, ROOT_WORKSPACE_PATH: repoRoot },

High

Ai Review Evidence

The registered MCP server can execute commands supplied by a repository hooks file when a worktree is created.

mcp-server/index.jsView on unpkg · L110

122 stdio: 'pipe',

123 });

124 results.push(h.command);

125 }

126 return { ran: true, results };

127 } catch (e) {

128 return { ran: true, error: e.message };

129 }

130}

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

18"scripts": { "start": "node cli/index.js", "mcp": "node mcp-server/index.js", "postinstall": "node scripts/postinstall.js", "test": "node --test tests/postinstall.test.js tests/mcp-server.test.js", "health": "node scripts/health-check.cjs" },

High

Suspicious Lifecycle Evidence

The manifest automatically runs a postinstall script.

package.jsonView on unpkg · L18

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/postinstall.jsView file

73// Ensure parent directory exists L74: fs.mkdirSync(path.dirname(TARGET_PATH), { recursive: true }); L75: ... L84: // Ensure structure L85: if (!config.mcpServers) config.mcpServers = {}; L86: ... L88: const alreadyPresent = L89: JSON.stringify(config.mcpServers[SERVER_KEY]) === JSON.stringify(SERVER_ENTRY); L90: ... L95: L96: config.mcpServers[SERVER_KEY] = SERVER_ENTRY; L97:

Critical

Ai Agent Control Hijack

Source creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.

scripts/postinstall.jsView on unpkg · L73

22// ── Candidate locations for Bob IDE's mcp.json (checked in order) ────────── // Bob IDE v2+ reads: ~/.bob/settings/mcp.json (global, all workspaces) // Bob IDE legacy: ~/.bob/mcp.json (pre-v2 global fallback) // Workspace-local: .bob/mcp.json (project-only override) const home = os.homedir(); const MCP_CANDIDATES = [ path.join(home, '.bob', 'settings', 'mcp.json'), // Bob IDE v2+ (primary) path.join(home, '.bob', 'mcp.json'), // Bob IDE v1 legacy path.join(home, '.config', 'bob', 'mcp.json'), // XDG fallback ];

High

Suspicious Lifecycle Evidence

Postinstall targets Bob's global MCP configuration locations and registers a server launched from this package.

scripts/postinstall.jsView on unpkg · L22

76// Read existing config let config = readJson(TARGET_PATH); const wasCorrupt = config === null; if (wasCorrupt) { console.warn(`⚠ Existing ${TARGET_PATH} contained invalid JSON — it will be reset.`); config = {}; } // Ensure structure if (!config.mcpServers) config.mcpServers = {}; // Idempotent write const alreadyPresent = JSON.stringify(config.mcpServers[SERVER_KEY]) === JSON.stringify(SERVER_ENTRY); if (alreadyPresent) { console.log(`✓ bob-worktrees MCP server already configured in:\n ${TARGET_PATH}`); return; } config.mcpServers[SERVE

High

Suspicious Lifecycle Evidence

The install hook creates parent directories and rewrites the selected global MCP configuration; malformed existing configuration is reset.

scripts/postinstall.jsView on unpkg · L76

96config.mcpServers[SERVER_KEY] = SERVER_ENTRY; try { fs.writeFileSync(TARGET_PATH, JSON.stringify(config, null, 2) + '\n', 'utf8');

High

Suspicious Lifecycle Evidence

The install hook creates parent directories and rewrites the selected global MCP configuration; malformed existing configuration is reset.

scripts/postinstall.jsView on unpkg · L96

mcp-server/index.jsView file

110/** Run post-setup hooks if a hooks.json exists */ function runHooks(worktreePath, repoRoot) { const hooksFile = path.join(repoRoot, '.bob-worktrees', 'hooks.json'); if (!fs.existsSync(hooksFile)) return { ran: false }; try { const cfg = JSON.parse(fs.readFileSync(hooksFile, 'utf8')); const hooks = cfg.hooks?.post_setup_worktree ?? []; const results = []; for (const h of hooks) { execSync(h.command, { cwd: worktreePath, env: { ...process.env, ROOT_WORKSPACE_PATH: repoRoot }, stdio: 'pipe', }); results.push(h.command); }

High

Ai Review Evidence

The registered MCP server can execute commands supplied by a repository hooks file when a worktree is created.

mcp-server/index.jsView on unpkg · L110

Findings

1 Critical6 High3 Medium2 Low

CriticalAi Agent Control Hijackscripts/postinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighSuspicious Lifecycle Evidencepackage.json

HighSuspicious Lifecycle Evidencescripts/postinstall.js

HighAi Review Evidencemcp-server/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem