registry / first-tree-staging / 0.5.12-staging.654.1

first-tree-staging@0.5.12-staging.654.1

First Tree — unified CLI for Context Tree onboarding, agent management, and team messaging. (Source-tree dev build; CI rewrites `name` and `bin` for prod / staging publishes — see docs/local-dev-isolation.md.)

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 521 KB of source, external domains: github.com, www.apple.com

Oversized source lightweight scan

dist/connect-token-R_61ywJ4.mjs2.36 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsCryptoShellWebSocketHighEntropyStringsUrlStringsgithub.comwww.apple.com

Source & flagged code

6 flagged

package.jsonView file

Lines 28-68json

28 "files": [

29 "dist",

30 "skills",

31 "scripts/prune-codex-runtime-binary.mjs",

32 "scripts/prune-claude-runtime-binary.mjs",

33 "scripts/prune-claude-sdk-deps.mjs",

34 "README.md",

35 "LICENSE"

36 ],

37 "publishConfig": {

38 "access": "public"

39 },

40 "scripts": {

41 "dev": "tsx src/cli/index.ts",

42 "build": "tsdown src/cli/index.ts src/index.ts --format esm --no-dts --external @anthropic-ai/claude-agent-sdk --external @openai/codex-sdk && node ../../scripts/copy-client-runtime-templates.mjs apps/cli",

43 "typecheck": "tsc --noEmit",

44 "test": "vitest run --passWithNoTests",

45 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

46 "prepack": "rm -rf skills && cp -R ../../skills .",

47 "postpack": "rm -rf skills",

48 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L48

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L48

49 },

50 "license": "Apache-2.0",

51 "repository": {

52 "type": "git",

53 "url": "https://github.com/agent-team-foundation/first-tree.git",

54 "directory": "apps/cli"

55 },

56 "engines": {

57 "node": ">=22.13.0"

58 },

59 "dependencies": {

60 "@anthropic-ai/claude-agent-sdk": "^0.3.187",

61 "@inquirer/prompts": "^8.3.0",

62 "@openai/codex-sdk": "^0.140.0",

63 "commander": "^13.1.0",

64 "ejs": "^6.0.1",

65 "gray-matter": "^4.0.3",

66 "jose": "^6.0.0",

67 "semver": "^7.6.3",

68 "ws": "^8.20.0",

dist/cli/index.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

2import { $ as startClientService, $t as discoverClaudeCodeSkills, At as agentConfigSchema, B as checkNodeVersion, Bt as resolveConfigReadonly, Ct as formatStaleReason, Dt as print, Et as isJsonMode, F as installCodexRuntime, Ft as getConfigValue, G as runtimeProviderChecks, Gt as resetConfig, H as checkWebSocket, Ht as channelConfig, I as installClaudeRuntime, It as initConfig, J as isServiceSupported, Jt as

dist/connect-token-R_61ywJ4.mjsView file

•path = dist/connect-token-R_61ywJ4.mjs kind = oversized_source_file sizeBytes = 2476487 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/connect-token-R_61ywJ4.mjsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.mjsView file

6import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, unlinkSync } from "node:fs"; L7: import { execFileSync } from "node:child_process"; L8: import { readFile as readFile$1, stat } from "node:fs/promises";

High

Child Process

Package source references child process execution.

dist/cli/index.mjsView on unpkg · L6

2206print.line(" command=/usr/local/bin/strip-wslg-overlay.sh\n\n"); L2207: print.line(" Then run `wsl --shutdown` in Windows PowerShell and reopen the shell.\n"); L2208: }

High

Shell

Package source references shell execution.

dist/cli/index.mjsView on unpkg · L2206

1#!/usr/bin/env node L2: import { $ as startClientService, $t as discoverClaudeCodeSkills, At as agentConfigSchema, B as checkNodeVersion, Bt as resolveConfigReadonly, Ct as formatStaleReason, Dt as print,... L3: import "node:crypto"; ... L6: import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, rmSync, statSync, unlinkSync } from "node:fs"; L7: import { execFileSync } from "node:child_process"; L8: import { readFile as readFile$1, stat } from "node:fs/promises"; ... L13: //#region src/core/channel-env.ts L14: if (!process.env.FIRST_TREE_HOME) process.env.FIRST_TREE_HOME = channelConfig.defaultHome; L15: process.title = channelConfig.binName;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.mjsView on unpkg · L1

dist/connect-token-R_61ywJ4.mjsView file

•path = dist/connect-token-R_61ywJ4.mjs kind = oversized_source_file sizeBytes = 2476487 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/connect-token-R_61ywJ4.mjsView on unpkg

Findings

5 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.mjs

HighShelldist/cli/index.mjs

HighSame File Env Network Executiondist/cli/index.mjs

HighOversized Source Filedist/connect-token-R_61ywJ4.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 28-68json

28 "files": [

29 "dist",

30 "skills",

31 "scripts/prune-codex-runtime-binary.mjs",

32 "scripts/prune-claude-runtime-binary.mjs",

33 "scripts/prune-claude-sdk-deps.mjs",

34 "README.md",

35 "LICENSE"

36 ],

37 "publishConfig": {

38 "access": "public"

39 },

40 "scripts": {

41 "dev": "tsx src/cli/index.ts",

43 "typecheck": "tsc --noEmit",

44 "test": "vitest run --passWithNoTests",

45 "coverage": "pnpm run build && vitest run --coverage --passWithNoTests",

46 "prepack": "rm -rf skills && cp -R ../../skills .",

47 "postpack": "rm -rf skills",

48 "postinstall": "node scripts/prune-codex-runtime-binary.mjs && node scripts/prune-claude-runtime-binary.mjs && node scripts/prune-claude-sdk-deps.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L48

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L48

49 },

50 "license": "Apache-2.0",

51 "repository": {

52 "type": "git",

53 "url": "https://github.com/agent-team-foundation/first-tree.git",

54 "directory": "apps/cli"

55 },

56 "engines": {

57 "node": ">=22.13.0"

58 },

59 "dependencies": {

60 "@anthropic-ai/claude-agent-sdk": "^0.3.187",

61 "@inquirer/prompts": "^8.3.0",

62 "@openai/codex-sdk": "^0.140.0",

63 "commander": "^13.1.0",

64 "ejs": "^6.0.1",

65 "gray-matter": "^4.0.3",

66 "jose": "^6.0.0",

67 "semver": "^7.6.3",

68 "ws": "^8.20.0",

dist/cli/index.mjsView file

Lines 1-26javascript

1#!/usr/bin/env node

dist/connect-token-R_61ywJ4.mjsView file

•path = dist/connect-token-R_61ywJ4.mjs kind = oversized_source_file sizeBytes = 2476487 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/connect-token-R_61ywJ4.mjsView on unpkg

Lines 2186-2226javascript

2186 print.line(" the user dbus socket. The systemd user manager is fine; the bus\n");

2187 print.line(" socket just isn't reachable from your shell.\n\n");

2188 print.line(" Quick fix (one-shot, lost on reboot):\n");

2189 print.line(" sudo umount -l /run/user/$(id -u)\n\n");

2190 print.line(" Permanent fix — install a boot-time helper, then update wsl.conf:\n\n");

2191 print.line(" sudo tee /usr/local/bin/strip-wslg-overlay.sh >/dev/null <<'EOF'\n");

2192 print.line(" #!/bin/sh\n");

2193 print.line(" for d in /run/user/*; do\n");

2194 print.line(" uid=$(basename \"$d\")\n");

2195 print.line(" case \"$uid\" in \"\"|*[!0-9]*) continue ;; esac\n");

2196 print.line(" for i in $(seq 1 30); do\n");

2197 print.line(" if mount | grep -q \"tmpfs on $d .*mode=755\"; then\n");

2198 print.line(" umount -l \"$d\"; break\n");

2199 print.line(" fi\n");

2200 print.line(" sleep 1\n");

2201 print.line(" done\n");

2202 print.line(" done\n");

2203 print.line(" EOF\n");

2204 print.line(" sudo chmod +x /usr/local/bin/strip-wslg-overlay.sh\n\n");

2205 print.line(" Then add to /etc/wsl.conf under [boot]:\n");

2206 print.line(" command=/usr/local/bin/strip-wslg-overlay.sh\n\n");

2207 print.line(" Then run `wsl --shutdown` in Windows PowerShell and reopen the shell.\n");

2208 }

High

Shell

Package source references shell execution.

dist/cli/index.mjsView on unpkg · L2206

2209 print.line(" Try `--foreground` to run inline instead.\n\n");

2210 process.exit(1);

2211 }

2212 const after = getClientServiceStatus();

2213 print.line("\n");

2214 print.line(` Started ${after.platform} service${after.detail ? ` (${after.detail})` : ""}.\n`);

2215 const journalHint = after.platform === "systemd" ? ` (or \`journalctl --user -u ${after.label.replace(/\.service$/, "")}\`)` : "";

2216 print.line(` Logs: ${after.logDir}${journalHint}\n\n`);

2217 return;

2218 }

2219 if (svc.state === "unknown") {

2220 print.line(`\n Service state could not be determined (${svc.platform}${svc.detail ? `: ${svc.detail}` : ""}).\n`);

2221 print.line(` Inspect with \`${binName} daemon doctor\`, or pass \`--foreground\` to bypass.\n\n`);

2222 process.exit(1);

2223 }

2224 }

2225 await promptMissingFields({

2226 schema: clientConfigSchema,