registry / m9r-cli / 0.6.12

m9r-cli@0.6.12

M9R CLI — connect coding agents, report live presence, coordinate bounded assignments, and record human-approved evidence.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Source inspection resolved the scanner's execution and network signals to user-invoked agent setup and local runtime features. No install-time attack, unrelated credential recipient, or other concrete attack behavior was established.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

A user runs the CLI connect/setup flow or explicitly starts the local terminal runtime.

Impact

No confirmed attack impact was established; the inspected behavior supports the package's stated coordination features.

Mechanism

Connect adds local agent capture configuration; the runtime accepts provider-scoped local clients and reports file changes to the configured M9R service using a connected provider token.

AI rationale

Evidence

.oathlock/capture/pending.jsonl.claude/settings.local.json.codex/hooks.json

Network endpoints2

m9r-web-staging.m9r.workers.devws://127.0.0.1

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json exposes two CLI entrypoints and has build/prepack scripts, with no install lifecycle hook.
The agent capture setup is reached through the connect flow, writes local provider configuration, and spools session data for later handling.
The terminal bridge serves provider-scoped local WebSocket clients; its runtime is explicitly started, and file-change reports use a connected provider token and the configured M9R service.
The inspected dependency and flagged source excerpts show protocol, file-watching, MCP, and process-adapter code; they do not establish an independent attack chain.

Evidence against

The bridge sends bounded project file-change content to the configured service, and agent capture stores session data; these behaviors are part of user-invoked product setup and operation, with no verified unrelated recipient or unconsented install-time activation.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Source & flagged code

8 flagged

dist/resident-provider-adapters.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

3import { redactSession } from "./session-redaction.js";

4import { extractCost, extractTokenUsage } from "./usage-normalization.js";

5import { providerLabel } from "./provider-adapter-config.js";

6import { createGrantWorktree, quarantineGrantWorktree, removeGrantWorktree, worktreeHeadCommit } from "./resident-write-isolation.js";

7/**

8 * The provider CLI's stream-json events already carry usage/cost — Claude

9 * Code's final `result` event and Codex's `turn.completed`/`token_count`

10 * events. Scans every event and keeps the last reported usage block (later

11 * events report cumulative totals, so last-wins beats summing per-event

12 * deltas and risking double count).

13 */

14function extractProviderUsage(events) {

15 const merged = { inputTokens: null, outputTokens: null, totalTokens: null, costUsd: null };

16 let sawAny = false;

17 for (const event of events) {

18 const tokens = extractTokenUsage(event);

19 const cost = extractCost(event);

20 if (tokens.usage === null && cost.costUsd === null)

21 continue;

dist/acp-stdio-adapter.jsView file

Lines 592-632javascript

592 capabilities.usage_reporting = true;

593 capabilities.tool_event_reporting = true;

594 capabilities.approval_requests = true;

595 capabilities.repository_editing = true;

596 capabilities.file_event_reporting

dist/oathlock-terminal-bridge.jsView file

Lines 1-30javascript

1import { createServer } from "node:http";

2import { open, readFile, stat, mkdir } from "node:fs/promises";

3import { createWriteStream } from "node:fs";

4import { randomBytes } from "node:crypto"

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View file

18import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); ... L24: const port = Number.isInteger(requestedPort) && requestedPort > 0 && requestedPort <= 65_535 ? requestedPort : DEFAULT_BRIDGE_PORT; L25: // The hosted app never receives a terminal WebSocket. It embeds the local L26: // workspace document below, and the browser"s same-origin policy keeps the\n// hosted page from reading or injecting terminal traffic. Only local origins\n// may upgrade to a shel... L27: server.once("error", (error) => { L28: if (error.code === "EADDRINUSE") { L29: process.stdout.write(`M9R local runtime is already running on ${host}:${port}.\n`); L30: process.exit(0);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/oathlock-terminal-bridge.js#virtual:normalized:round1View on unpkg · L18

18Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/m9r.js -> dist/oathlock-terminal-bridge.js L18: import { createResidentSupervisor } from "./resident-supervisor.js"; L19: import { spawn } from "node:child_process"; L20: const repositoryRoot = process.cwd(); ... L24: const port = Number.isInteger(requestedPort) && requestedPort > 0 && requestedPort <= 65_535 ? requestedPort : DEFAULT_BRIDGE_PORT; L25: // The hosted app never receives a terminal WebSocket. It embeds the local L26: // workspace document below, and the browser"s same-origin policy keeps the\n// hosted page from reading or injecting terminal traffic. Only local origins\n// may upgrade to a shel... L27: server.once("error", (error) => { L28: if (error.code === "EADDRINUSE") { L29: process.stdout.write(`M

High

dist/cross-agent-capture-setup-core.jsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: rately minimal: no dependencies, no network, one append, exit. // never throws into the caller -- claude code/codex treat this hook as // advisory and non-blocking, but a stack trace on stderr would still be // a needless surprise in someone's terminal on session exit. import { appendfile, mkdir } from "node:fs/promises"; import { dirname, join } from "node:path"; const provider = process.argv[2] === "codex" ? "codex" : "claude-code"; function readstdin() { return new promise((resolve) => { let data = ""; process.stdin.setencoding("utf8"); process.stdin.on("data", (chunk) => { data += chunk; }); process.stdin.on("end", () => resolve(data)); process.stdin.on("err

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

dist/cross-agent-capture-setup-core.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/resident-provider-adapters.jsView file

1import { spawn } from "node:child_process"; L2: import { isAbsolute, join, resolve } from "node:path";

High

Child Process

Package source references child process execution.

dist/resident-provider-adapters.jsView on unpkg · L1

dist/acp-stdio-adapter.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = m9r-cli@0.6.3 matchedIdentity = npm:bTlyLWNsaQ:0.6.3 similarity = 0.680 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/acp-stdio-adapter.jsView on unpkg

612// Node deprecates (DEP0190) passing a separate args array alongside L613: // shell: true -- with a shell, args are concatenated into the shell L614: // command line unescaped, so a non-empty args array is a footgun even

Findings

1 Critical7 High2 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/acp-stdio-adapter.js

HighChild Processdist/resident-provider-adapters.js

HighShelldist/acp-stdio-adapter.js

HighSame File Env Network Executiondist/oathlock-terminal-bridge.js

HighCommand Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1

HighExternal Ai Agent Control Surface Mutationdist/cross-agent-capture-setup-core.js

HighTrigger Reachable Command Output Exfiltrationdist/oathlock-terminal-bridge.js#virtual:normalized:round1

HighSemantic Analysis Limiteddist/acp-stdio-adapter.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

Affected versions and remediation

This report applies to m9r-cli@0.6.12.

See all versions of m9r-cli for other recorded verdicts.

Review the evidence and your use of m9r-cli@0.6.12 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-22 21:52:21.206Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.