halfcycle@0.4.2
Your coding agents are the engineers. Halfcycle is the rest of the team: product owner, architect, planner and independent reviewer for Claude Code.
AI Security Review
scanned 18d ago · by lpm-firewall-aiThe source verifies conditional exposure of a saved engagement token to an environment-selected endpoint, so this warrants a warning. The override is user-configured and the package has no install hook; the evidence does not establish covert transfer or malicious intent.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user runs the Halfcycle setup CLI or a project command while HALFCYCLE_SERVICE_URL points to another service.
Impact
The configured recipient can receive the existing engagement credential; the source does not establish what the recipient does with it.
Mechanism
The CLI combines an environment-selected service URL with a token loaded from the pinned engagement store, then sends the token in a Bearer authorization header without a recipient-origin check.
AI rationale
The source verifies conditional exposure of a saved engagement token to an environment-selected endpoint, so this warrants a warning. The override is user-configured and the package has no install hook; the evidence does not establish covert transfer or malicious intent.
Evidence
dist/cli.jsdist/index.js
Network endpoints2
control.halfcycle.aioperator-provided HALFCYCLE_SERVICE_URL
Decision evidence
public snapshotAI called this Suspicious at 94.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The CLI accepts HALFCYCLE_SERVICE_URL from the environment and uses it in preference to the service URL stored with a pinned engagement. Repo credential loading independently falls back to the pinned engagement’s stored token, then returns that token with the selected service URL.
- CLI setup passes credentials into create and join requests, and its request helper sends them as Bearer headers without checking that the request URL matches the credential’s recorded service origin or requiring recipient-specific confirmation.
- Project commands load a token from the environment or pinned engagement store and use the selected service URL for phase and build-record requests with Bearer authentication.
- The exported index helpers also send passed credentials to their caller-supplied URLs. Separately, the bundled MCP header helper checks the requested server origin against the recorded origin before returning a credential.
Evidence against
- The package manifest lists no install lifecycle hook, so the exposure requires a user-invoked CLI operation or project command.
- The bundled MCP header helper rejects a requested server whose origin differs from the recorded origin; the verified exposure is in separate CLI request paths.
Source & flagged code
8 flaggedbin/bin.bundle.mjsView file
15715// dist/git.js
L15716: import { spawnSync } from "node:child_process";
L15717: import { existsSync, readFileSync } from "node:fs";
High
Child Process
Package source references child process execution.
bin/bin.bundle.mjsView on unpkg · L15715dist/cli.jsView file
•matchType = previous_version_dangerous_delta
matchedPackage = halfcycle@0.4.1
matchedIdentity = npm:aGFsZmN5Y2xl:0.4.1
similarity = 0.800
summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/cli.jsView on unpkg3176// dist/control-origin.js
L3177: var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
L3178: function resolveControlOrigin(env = process.env) {
L3179: const configured = env["HALFCYCLE_SERVICE_URL"]?.trim();
...
L3188: // dist/device-signin.js
L3189: import { spawn } from "node:child_process";
L3190: import { platform as platform3 } from "node:os";
Findings
1 Critical7 High3 Medium5 Low
CriticalPrevious Version Dangerous Deltadist/cli.js
HighChild Processbin/bin.bundle.mjs
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighCross File Remote Execution Contextdist/cli.js
HighTrigger Reachable Command Output Exfiltrationdist/cli.js
HighRuntime Package Installdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowFilesystem
Affected versions and remediation
This report applies to halfcycle@0.4.2.
See all versions of halfcycle for other recorded verdicts.
- Review the evidence and your use of halfcycle@0.4.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.