registry  /  clairvoyant-relay  /  0.2.0

clairvoyant-relay@0.2.0

Local relay that streams Claude Code sessions to smart glasses and mirrors permission prompts for approval by a glance.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason
No blocking static signals were detected.
Trigger
User runs `clairvoyant-relay install-hook` or starts relay/proxy commands.
Impact
A paired client can approve or deny Claude permission prompts; setup is user-invoked and package-aligned.
Mechanism
Claude Code hook installer plus token-authenticated local WebSocket relay
Rationale
Source inspection shows an explicit Claude hook installer and relay capable of influencing permission decisions, warranting a warning under the agent config mutation policy. It should not be blocked because there are no lifecycle hooks, no unconsented install-time mutation, and the network/file behavior matches the advertised relay function.
Evidence
package.jsondist/index.jsdist/install.jshook/clairvoyant-hook.mjsdist/relay.jsdist/server.jsdist/glasses.jsdist/funnel.jsdist/proxy.jsdist/transcriptTailer.jsdist/paths.jsdist/token.js~/.claude/settings.json~/.clairvoyant/channel-token~/.clairvoyant/relay.sock~/.claude/projects/<project>/<session_id>.jsonl
Network endpoints5
127.0.0.1:<localPort>/ws/ws/pair/qr.svg/regenerate-token

Decision evidence

public snapshot
AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
  • dist/index.js exposes explicit `install-hook` command that writes Claude Code hooks.
  • dist/install.js adds PermissionRequest, PreToolUse, and SessionEnd command hooks to a settings path, defaulting to `~/.claude/settings.json`.
  • hook/clairvoyant-hook.mjs can emit allow/deny/allow_always decisions based on relay responses.
  • dist/server.js exposes pairing token via local `/pair`; dist/glasses.js accepts permission responses over token-authenticated WebSocket.
Evidence against
  • package.json has no preinstall/install/postinstall lifecycle scripts, so no install-time mutation.
  • Hook setup is explicit CLI action, not automatic import/install execution.
  • Network behavior is package-aligned local relay/proxy; optional Tailscale funnel is user-requested with `--funnel`.
  • Token stored under `~/.clairvoyant/channel-token` with 0600 permissions; no hardcoded exfiltration endpoint found.
  • Transcript reads are scoped to Claude session transcript paths for relay display, not broad credential harvesting.
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
MinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 20 file(s), 65.8 KB of source, external domains: 127.0.0.1, tailscale.com, www.w3.org

Source & flagged code

4 flagged · loading source
dist/index.jsView file
•Published source reference
Medium
Ai Review Evidence

dist/index.js exposes explicit `install-hook` command that writes Claude Code hooks.

dist/index.jsView on unpkg
dist/install.jsView file
•Published source reference
Medium
Ai Review Evidence

dist/install.js adds PermissionRequest, PreToolUse, and SessionEnd command hooks to a settings path, defaulting to `~/.claude/settings.json`.

dist/install.jsView on unpkg
hook/clairvoyant-hook.mjsView file
•Published source reference
Medium
Ai Review Evidence

hook/clairvoyant-hook.mjs can emit allow/deny/allow_always decisions based on relay responses.

hook/clairvoyant-hook.mjsView on unpkg
dist/server.jsView file
•Published source reference
Medium
Ai Review Evidence

dist/server.js exposes pairing token via local `/pair`; dist/glasses.js accepts permission responses over token-authenticated WebSocket.

dist/server.jsView on unpkg

Findings

6 Medium3 Low
MediumNetwork
MediumEnvironment Vars
MediumAi Review Evidencedist/index.js
MediumAi Review Evidencedist/install.js
MediumAi Review Evidencehook/clairvoyant-hook.mjs
MediumAi Review Evidencedist/server.js
LowScripts Present
LowFilesystem
LowUrl Strings