registry / u1s1-cli / 0.11.0

u1s1-cli@0.11.0

⚠ Under review

u1s1 — 有一说一,最省心的 AI 编程搭子。终端里用中文说需求,AI 帮你读文件、改代码、跑命令。

Static Scan Results

scanned 18d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationUrlStrings

ManifestNo manifest risk signals triggered.

scanned 24 file(s), 1.07 MB of source, external domains: api.u1s1.io, bellard.org, github.com, reactjs.org, registry.npmjs.org, u1s1.io, www.w3.org

Source & flagged code

7 flagged

dist/web.jsView file

Lines 1-28javascript

1import { spawn, spawnSync } from "node:child_process";

2import { mkdirSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/web.jsView on unpkg · L1

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/web.jsView on unpkg · L1

3import { createRequire } from "node:module";

4import { dirname, join } from "node:path";

5import { cleanupBrandThemes, ensureAuthCredential, ensureBrandPrompt, ensureDefaultSettings, ensureProviderModels, writeWebToolsExtension, } from "./agent-setup.js";

6import { agentDir, apiModelToDef, resolvePreferredModel, setModelsFromApi, u1s1Dir, writeAgentDefaultModel, } from "./config.js";

7import { applyWebUiBranding, applyWebUiFrontend } from "./webui-brand.js";

8import { fetchModels } from "./api.js";

9const require = createRequire(import.meta.url);

10/**

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/web.jsView on unpkg · L8

11 * `u1s1 web` — 浏览器网页版。薄包装 pi-web-ui 的服务器:注入我们的 agentDir

12 * (品牌 prompt / models.json / 会话与 TUI 共享)和登录 key,其余原样透传

13 * (--port / --cwd / --no-browser)。

14 */

15/**

16 * 启动 pi-web-ui 服务器前的公共准备:品牌 prompt、模型列表、auth.json 凭据、

17 * 联网工具扩展、默认模型,并返回子进程需要的环境变量。CLI(`u1s1 web`)和

18 * 桌面版 App(packages/app,经 "u1s1-cli/embed" 引入)共用这一份逻辑。

19 */

20export async function prepareWebEnv(cfg) {

21 cleanupBrandThemes();

22 ensureBrandPrompt();

23 ensureDefaultSettings();

24 // Fetch model list from server; fall back to built-in MODELS on error.

25 // 服务端没开搜索(或老网关没有 features 字段)时不注册 web_search

26 let webSearchEnabled = true;

27 try {

28 const { models, features } = await fetchModels(cfg);

dist/update.jsView file

Lines 1-21javascript

1import { execSync } from "node:child_process";

2import { createRequire } from "node:module";

3import { isPortableInstall } from "./config.js";

4const require = createRequire

Source & flagged code

7 flagged · loading source

dist/web.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code