registry / specrails-desktop / 2.28.1

specrails-desktop@2.28.1

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Trigger

User runs the CLI/server or explicitly installs plugins/prerequisites in the app.

Impact

Can run local AI agent jobs and modify project/provider configuration when the user opts into those workflows; no unconsented install-time behavior confirmed.

Mechanism

user-invoked AI CLI spawn and project-scoped agent/MCP configuration mutation

Rationale

Source inspection shows dangerous but package-aligned desktop agent orchestration features, activated by user CLI/app actions rather than npm lifecycle hooks or import-time code. Because it can mutate AI-agent control surfaces and run permission-skipping agent jobs, warn rather than block.

Evidence

package.jsoncli/dist/specrails-desktop.jsserver/dist/auth.jsserver/dist/providers/claude-adapter.jsserver/dist/claude-trust.jsserver/dist/plugins/serena/install.jsserver/dist/plugins/prereq-installer.jsserver/dist/plugin-manager.js~/.specrails/desktop.token~/.specrails/manager.pid~/.specrails/projects/<slug>/codex-home~/.claude.json<project>/.mcp.json<project>/.claude/agents/custom-serena.md<project>/CLAUDE.md<project>/AGENTS.md~/.gemini/acknowledgments/agents.json

Network endpoints5

127.0.0.1:<port>astral.sh/uv/install.shastral.sh/uv/install.ps1git+https://github.com/oraios/serenaspecrails.dev/companion-signal.php

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

cli/dist/specrails-desktop.js user-invoked fallback spawns `claude` with `--dangerously-skip-permissions`.
server/dist/providers/claude-adapter.js uses `--dangerously-skip-permissions` for Claude agent spawns.
server/dist/claude-trust.js best-effort writes `~/.claude.json` trust flags before Claude spawns.
server/dist/plugins/serena/install.js can add Serena MCP to project `.mcp.json` or per-project Codex `CODEX_HOME` on plugin install.
server/dist/plugins/prereq-installer.js can run official uv installers from `https://astral.sh/uv/install.sh` or `.ps1` when requested.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks.
Network use is loopback manager traffic or documented setup/update endpoints, not hidden exfiltration.
server/dist/auth.js binds sensitive API expectations to loopback auth, host validation, and bearer token checks.
Plugin and agent config mutations are explicit app/plugin actions with rollback/ownership tracking, not install-time mutation.
Serena MCP registration is first-party app plugin setup scoped to project `.mcp.json` or per-project Codex home.
No credential harvesting or remote payload execution found in inspected entrypoints/hot files.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 581 file(s), 9.53 MB of source, external domains: 127.0.0.1, acme.atlassian.net, astral.sh, bit.ly, bugzilla.mozilla.org, claude.com, cli.github.com, code.google.com, dein-unternehmen.atlassian.net, developer.mozilla.org, developers.google.com, developers.openai.com, docs.astral.sh, drafts.csswg.org, en.wikipedia.org, example.atlassian.net, git-scm.com, github.com, googlechrome.github.io, hacks.mozilla.org, help.yahoo.com, html.spec.whatwg.org, nodejs.org, r12a.github.io, react.dev, reactflow.dev, redux-toolkit.js.org, redux.js.org, registry.npmjs.org, sass-lang.com, schema.org, specrails.dev, stackoverflow.com, sua-empresa.atlassian.net, support.google.com, tools.ietf.org, tu-empresa.atlassian.net, tua-azienda.atlassian.net, votre-entreprise.atlassian.net, wiki.whatwg.org, www.bing.com, www.dmoz.org, www.iana.org, www.ietf.org, www.w3.org, www.whatwg.org, your-company.atlassian.net

Oversized source lightweight scan

client/dist/assets/editor.api2-C3B0tp2x.js3.46 MB file, sampled 256 KB

ChildProcessObfuscatedHighEntropyStringsMinified

client/dist/assets/index-89SuhD4Y.js2.10 MB file, sampled 256 KB

FilesystemNetworkChildProcessWebSocketObfuscatedHighEntropyStringsMinifiedUrlStringsreact.devwww.w3.org

client/dist/assets/ts.worker-METxwbDZ.js6.57 MB file, sampled 256 KB

FilesystemNetworkChildProcess

Source & flagged code

6 flagged

server/dist/worktree-overlay.jsView file

Lines 24-64javascript

24 * the whole dir is absent, per-file/per-child when partially present). The

25 * checkout's own content is NEVER overwritten — tracked files always win.

26 * - `agent-memory` is linked like everything else: all runs SHARE agent memory,

27 * exactly matching the pre-isolation shared-cwd semantics (deliberate).

28 * - The providerDir ROOT itself is never linked (a real dir is created) so

29 * nested pipeline worktrees (`.claude/worktrees/**`) stay LOCAL to this

30 * worktree instead of colliding in the shared workspace. The source's

31 * `worktrees` entry is skipped for the same reason.

32 * - `.mcp.json` and the provider instruction file (CLAUDE.md / AGENTS.md /

33 * GEMINI.md) are COPIED (spawn-local), only when the checkout lacks them.

34 * - Windows: junction fallback for dirs, then a dereferencing copy (the

35 * explore-cwd precedent).

36 *

37 * Idempotent + resume-safe: every created entry is recorded in a manifest

38 * (`.sr-rail-overlay.json`, itself overlay-owned) whose UNION across passes is

39 * returned as `createdPaths` — the caller excludes those paths from

40 * `commitWorktree`'s `git add -A` so overlay scaffolding NEVER lands on the

41 * ticket branch / PR. Failures degrade per entry into `warnings` (the spawn

42 * proceeds — a partial surface beats an aborted rail); this function never

43 * throws.

44 */

45const fs_1 = __importDefault(require("fs"));

46const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/worktree-overlay.jsView on unpkg · L44

47/** Overlay manifest filename (worktree root). Overlay-owned + git-excluded. */

48exports.OVERLAY_MANIFEST = '.sr-rail-overlay.json';

49/** providerDir children that must NEVER be linked into a worktree: nested

50 * pipeline worktrees must stay local to THIS worktree (linking would share

51 * them across concurrent rails — collisions). */

52const SKIP_PROVIDER_ENTRIES = new Set(['worktrees']);

53function errMsg(err) {

54 return err instanceof Error ? err.message : String(err);

55}

56/** True when `p` resolves (following symlinks) to a directory. */

57function isDir(p) {

58 try {

59 return fs_1.default.statSync(p).isDirectory();

60 }

61 catch {

62 return false;

63 }

64}

server/dist/terminal-shell-integration.jsView file

Lines 3-43javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.NO_SHELL_INTEGRATION = void 0;

server/dist/plugins/prereq-installer.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.installPrerequisite = installPrerequisite;

4const child_process_1 = require("child_process");

5const win_spawn_1 =

client/dist/assets/html.worker-CQP8QQsS.jsView file

29contains invisible/control Unicode U+2060 (word joiner) `,"nexist;":`∄`,"nexists;":`∄`,"Nfr;":`𝔑`,"nfr;":`𝔫`,"ngE;":`≧̸`,"nge;":`≱`,"ngeq;":`≱`,"ngeqq;":`≧̸`,"ngeqslant;":`⩾̸`,"nges;":`⩾̸`,"nGg;":`⋙̸`,"ngsim;":`≵`,"nGt;":`≫⃒`,"ngt;":`≯`,"ngtr;":`≯`,"nGtv;":`≫̸`,"nhArr;":`⇎`,"nharr;":`↮`,"nhpar;"

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/editor.api2-C3B0tp2x.jsView file

•path = client/dist/assets/editor.api2-C3B0tp2x.js kind = oversized_source_file sizeBytes = 3626915 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/editor.api2-C3B0tp2x.jsView on unpkg

server/dist/headroom-manager.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = specrails-desktop@2.24.1 matchedIdentity = npm:c3BlY3JhaWxzLWRlc2t0b3A:2.24.1 similarity = 0.708 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/dist/headroom-manager.jsView on unpkg

Source & flagged code

6 flagged · loading source

server/dist/worktree-overlay.jsView file

44*/ L45: const fs_1 = __importDefault(require("fs")); L46: const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/worktree-overlay.jsView on unpkg · L44

server/dist/terminal-shell-integration.jsView file

23* Resolve the shell basename for our switch logic. We accept full paths or bare L24: * basenames (e.g. "/bin/zsh", "C:\\Program Files\\PowerShell\\7\\pwsh.exe"). L25: */ ... L34: const candidates = [ L35: path_1.default.resolve(__dirname, 'shell-integration', name), L36: // Desktop bundle: shims ship under binaries/shell-integration (declared in ... L65: function specrailsHome() { L66: return process.env.SPECRAILS_REGISTRY_HOME || os_1.default.homedir(); L67: } ... L91: return exports.NO_SHELL_INTEGRATION; L92: const userZdotdirZshrc = path_1.default.join(shimDir, '.zshrc'); L93: const shimContent = `# Specrails auto-generated zsh entry — do not edit\nsource '${bundled.replace(/'/g, `'\\''`)}'\n`;

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

server/dist/terminal-shell-integration.jsView on unpkg · L23

server/dist/plugins/prereq-installer.jsView file

3exports.installPrerequisite = installPrerequisite; L4: const child_process_1 = require("child_process"); L5: const win_spawn_1 = require("../util/win-spawn"); ... L13: return null; L14: if (process.platform === 'darwin' || process.platform === 'linux') { L15: return { L16: label: 'Astral uv installer (curl)', L17: shell: 'curl -LsSf https://astral.sh/uv/install.sh | sh', L18: }; ... L31: /** L32: * Run the platform-appropriate installer for `name` and stream stdout+stderr L33: * to `broadcast` as `plugin.prereq_install_progress` events. Resolves once the

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

server/dist/plugins/prereq-installer.jsView on unpkg · L3

client/dist/assets/html.worker-CQP8QQsS.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/editor.api2-C3B0tp2x.jsView file

•path = client/dist/assets/editor.api2-C3B0tp2x.js kind = oversized_source_file sizeBytes = 3626915 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/editor.api2-C3B0tp2x.jsView on unpkg

server/dist/headroom-manager.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/dist/headroom-manager.jsView on unpkg

Findings

1 Critical3 High6 Medium5 Low

CriticalTrojan Source Unicodeclient/dist/assets/html.worker-CQP8QQsS.js

HighSandbox Evasion Gated Capabilityserver/dist/plugins/prereq-installer.js

HighOversized Source Fileclient/dist/assets/editor.api2-C3B0tp2x.js

HighPrevious Version Dangerous Deltaserver/dist/headroom-manager.js

MediumDynamic Requireserver/dist/worktree-overlay.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceserver/dist/terminal-shell-integration.js

MediumProtestware

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

server/dist/worktree-overlay.jsView file

Lines 24-64javascript

24 * the whole dir is absent, per-file/per-child when partially present). The

25 * checkout's own content is NEVER overwritten — tracked files always win.

26 * - `agent-memory` is linked like everything else: all runs SHARE agent memory,

27 * exactly matching the pre-isolation shared-cwd semantics (deliberate).

28 * - The providerDir ROOT itself is never linked (a real dir is created) so

29 * nested pipeline worktrees (`.claude/worktrees/**`) stay LOCAL to this

30 * worktree instead of colliding in the shared workspace. The source's

31 * `worktrees` entry is skipped for the same reason.

32 * - `.mcp.json` and the provider instruction file (CLAUDE.md / AGENTS.md /

33 * GEMINI.md) are COPIED (spawn-local), only when the checkout lacks them.

34 * - Windows: junction fallback for dirs, then a dereferencing copy (the

35 * explore-cwd precedent).

36 *

37 * Idempotent + resume-safe: every created entry is recorded in a manifest

38 * (`.sr-rail-overlay.json`, itself overlay-owned) whose UNION across passes is

39 * returned as `createdPaths` — the caller excludes those paths from

40 * `commitWorktree`'s `git add -A` so overlay scaffolding NEVER lands on the

41 * ticket branch / PR. Failures degrade per entry into `warnings` (the spawn

42 * proceeds — a partial surface beats an aborted rail); this function never

43 * throws.

44 */

45const fs_1 = __importDefault(require("fs"));

46const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

server/dist/worktree-overlay.jsView on unpkg · L44

47/** Overlay manifest filename (worktree root). Overlay-owned + git-excluded. */

48exports.OVERLAY_MANIFEST = '.sr-rail-overlay.json';

49/** providerDir children that must NEVER be linked into a worktree: nested

50 * pipeline worktrees must stay local to THIS worktree (linking would share

51 * them across concurrent rails — collisions). */

52const SKIP_PROVIDER_ENTRIES = new Set(['worktrees']);

53function errMsg(err) {

54 return err instanceof Error ? err.message : String(err);

55}

56/** True when `p` resolves (following symlinks) to a directory. */

57function isDir(p) {

58 try {

59 return fs_1.default.statSync(p).isDirectory();

60 }

61 catch {

62 return false;

63 }

64}

server/dist/terminal-shell-integration.jsView file

Lines 3-43javascript

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.NO_SHELL_INTEGRATION = void 0;

server/dist/plugins/prereq-installer.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.installPrerequisite = installPrerequisite;

4const child_process_1 = require("child_process");

5const win_spawn_1 =

client/dist/assets/html.worker-CQP8QQsS.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

client/dist/assets/html.worker-CQP8QQsS.jsView on unpkg · L29

client/dist/assets/editor.api2-C3B0tp2x.jsView file

•path = client/dist/assets/editor.api2-C3B0tp2x.js kind = oversized_source_file sizeBytes = 3626915 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

client/dist/assets/editor.api2-C3B0tp2x.jsView on unpkg

server/dist/headroom-manager.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

server/dist/headroom-manager.jsView on unpkg