Loading npm security reports…
wind-agent-cli@1.46.7: Agent extension lifecycle risk – flagged | LPM Firewall
Flagged as agent extension risk
Allowed by default with warning: install-time first-party agent extension setup was detected.
scanned 9d ago · by lpm-firewall-ai The inspected source establishes a user-triggered plugin installation and code execution path, so the package carries guarded extension lifecycle risk. Authentication and the explicit repository URL submission reduce concern, and no malicious account action was established.
Static reason
High-risk behavior combination matched malicious policy.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source
Trigger
A user submits a plugin repository URL to the protected plugin installation API.
Impact
A selected plugin can execute code with the application user's access; this creates extension lifecycle risk when installing plugins.
Mechanism
The application may run the plugin's declared build script and launches its server as a Node subprocess with the host home directory and executable path in its environment.
AI rationale
The inspected source establishes a user-triggered plugin installation and code execution path, so the package carries guarded extension lifecycle risk. Authentication and the explicit repository URL submission reduce concern, and no malicious account action was established.
Evidence
dist-server/server/modules/plugins/plugin-registry.service.js dist-server/server/modules/plugins/plugins.service.js dist-server/server/modules/plugins/plugins.routes.js dist-server/server/index.js dist-server/server/modules/plugins/plugin-process.service.js
public snapshot AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
The plugin installation endpoint requires an authenticated API request and accepts a URL submitted by the user. Installation clones the selected plugin, may run its build script, and starts its declared server. A plugin server runs as a Node subprocess with the host home and executable path available. The three flagged chat locations handle session subscriptions and WebSocket dispatch, not automatic account changes. Evidence against
Dependency installation for a plugin uses an option that suppresses dependency lifecycle scripts. The plugin endpoint is protected by token authentication, and the installation URL is supplied in the request. The inspected account-action hints show user-requested chat subscriptions rather than publisher-selected account actions. Behavioral surface
Source ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket
39 flagged · loading source • scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-pm2-windows-console.js
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg • scripts.postinstall = node scripts/fix-node-pty.js && node scripts/fix-pm2-windows-console.js
Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg 1 patternName = github_pat
severity = critical
line = 1
Critical Critical Secret
Package contains a critical-looking secret pattern.
dist/assets/common-DNF7JDgr.js View on unpkg · L1 9 Critical 17 High 14 Medium 10 Low
Critical Critical Secret dist/assets/common-DNF7JDgr.js
Critical Secret Pattern dist/assets/common-DNF7JDgr.js
Critical Secret Pattern dist/assets/common-CvdMNM4z.js
Critical Secret Pattern dist/assets/common-aa-F3pKQ.js
Critical Secret Pattern dist/assets/common-DFjOIvLC.js
Critical Secret Pattern dist/assets/common-DYLsXN9b.js
Critical Secret Pattern dist/assets/common-BwJZhc81.js
Critical Secret Pattern dist/assets/common-ClXrYLNn.js
Critical Secret Pattern dist/assets/feature-workspace-CSJk56lW.js
High Install Time Lifecycle Scripts package.json
High Child Process dist-server/server/shared/claude-cli-path.js
Affected versions and remediation This report applies to wind-agent-cli@1.46.7 .
See all versions of wind-agent-cli for other recorded verdicts.
Review the evidence and your use of wind-agent-cli@1.46.7 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-10-13 20:14:55.254Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
84% Suspicious
AI assessment confidence
Package metadata npm Author WindCli contributors
Maintainers caine.luo
Version 1.46.7
Latest on npm 1.47.4
Published Oct 12, 2026
License AGPL-3.0-or-later
Dependencies 68
Integrity verified
Package size 11.1 MB
Files 1,351
Keywords claude code claude-code claude-code-ui cloudcli codex cursor cursor-cli anthropic
Supply chain HighEntropyStrings Minified PossibleObfuscation Telemetry UrlStrings
scanned 877 file(s), 11.9 MB of source, external domains: 0.0.0.0, 10.0.0.7, 127.0.0.1, 127.0.0.2, 169.254.169.254, 172.16.2.9, 192.168.1.10, 192.168.1.9, another-project.test, api-gateway.cloudcli.ai, api.example.com, api.exemple.com, api.github.com, api.openai.com, app.example.test, attacker.example, bit.ly, browser-restarted.test, chevrotain.io, cloudcli.ai, cloudcli.example, codex.example.com, cursor.com, data-pipeline.cloudcli.ai, desktop.test, developer.mozilla.org, docs.anthropic.com, docs.docker.com, en.wikipedia.org, example.com, example.org, example.test, extension.test, fb.me, github.com, github.com.evil.example, global.example.com, langium.org, legacy.test, localhost.example.com, master.example, master.example.evil, master.lan, ml-trainer.cloudcli.ai, mobile.test, new-project.test, new.test, old.test, opencode.ai, opencode.example.com
1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-DNF7JDgr.js
dist/assets/common-DNF7JDgr.js View on unpkg · L1 dist-server/server/shared/claude-cli-path.js View file 1 import { execFileSync } from 'node:child_process';
L2: import fs from 'node:fs';
High Child Process
Package source references child process execution.
dist-server/server/shared/claude-cli-path.js View on unpkg · L1 3 `+gt),tt&&(gt=_e(gt)),R&&Zt?P(gt):gt},K.setConfig=function(){let X=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};xe(X),At=!0,Ft=t,Tt=x},K.clearConfig=function(){Jt=null...
L4: \0`,Y+=u(z,2),Y+=B.magic,Y+=u(v,2),Y+=u(T,2),Y+=u(it.crc32,4),Y+=u(it.compressedSize,4),Y+=u(it.uncompressedSize,4),Y+=u(W.length,2),Y+=u(P.length,2),{fileRecord:g.LOCAL_FILE_HEADE...
Low Eval
Package source references a known benign dynamic code generation pattern.
dist/assets/vendor-data-DPft5PCw.js View on unpkg · L3 dist-server/server/modules/auth/auth.module.js View file 7 // composition root narrows its CommonJS runtime surface before injecting it.
L8: const require = createRequire(import.meta.url);
L9: const bcrypt = require('bcrypt');
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist-server/server/modules/auth/auth.module.js View on unpkg · L7 dist-server/server/modules/auth/tests/server-error-mapping.test.js View file 52 execute([helper, ...parsers]);
L53: app.post('/echo', (req, res) => res.json({ parsed: Boolean(req.body?.data) }));
L54: app.get('/app-error', () => {
...
L79: await once(server, 'listening');
L80: const baseUrl = `http://127.0.0.1:${server.address().port}`;
L81: try {
Medium Unsafe Vm Context
Package source executes code through a VM context API.
dist-server/server/modules/auth/tests/server-error-mapping.test.js View on unpkg · L52 dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.js View file 106 try {
L107: return JSON.parse(trimmed);
L108: }
...
L172: const { default: Database } = await import('better-sqlite3');
L173: const cwdId = crypto.createHash('md5').update(projectPath || process.cwd()).digest('hex');
L174: const safeSessionId = sanitizeLeafDirectoryName(sessionId, 'cursor session id');
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.js View on unpkg · L106 6 Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network
L6: import os from 'os';
L7: import http from 'http';
L8: import express from 'express';
...
L36: import { configureWebPush } from './modules/notifications/index.js';
L37: const __dirname = getModuleDirectory(import.meta.url);
L38: // The server source runs from /server, while the compiled output runs from /dist-server/server.
...
L42: // Version of the code that is actually running, captured once at process
L43: // startup. This intentionally does NOT re-read package.json per request: after
L44: // an update replaces the files on disk, package.json reflects the NEW version
...
L49: try {
L50: return JSON.parse(fs.readFileSync(path.join(APP_ROOT, 'package.json'), 'utf8')).vers
High Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
dist-server/server/index.js View on unpkg · L6 1 import { app, BrowserWindow, clipboard, dialog, ipcMain, session, shell, webContents } from 'electron';
L2: import { spawn } from 'node:child_process';
L3: import path from 'node:path';
...
L12:
L13: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L14:
...
L18: const CALLBACK_URL = `${CALLBACK_PROTOCOL}://auth/callback`;
L19: const CLOUDCLI_CONTROL_PLANE_URL = process.env.CLOUDCLI_CONTROL_PLANE_URL || 'https://cloudcli.ai';
L20: const REMOTE_START_TIMEOUT_MS = 30000;
...
L24:
L25: if (process.platform === 'win32') {
L26: app.setAppUserModelId(APP_USER_MODEL_ID);
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
electron/main.js View on unpkg · L1 dist-server/server/modules/cli/cli.module.js View file 1 Detached bundled service listener: dist-server/server/modules/cli/cli.module.js spawns dist-server/server/index.js; helper exposes a broad-bound HTTP listener.
L1: import { execFileSync } from 'node:child_process';
L2: import fs from 'node:fs';
...
L18: if (result.status !== 0) {
L19: const stderr = typeof result.stderr === 'string' ? result.stderr.trim() : '';
L20: throw new Error(stderr || `npm exited with status ${result.status ?? 'unknown'}`);
...
L30: stdio: 'inherit',
L31: env: { ...process.env, WINDCLI_DEFER_SERVER_PROMOTION: '1' },
L32: });
...
L41: const applicationRoot = findApplicationRoot(getModuleDirectory(import.meta.url));
L42: const packageMetadataJson = JSON.parse(fs.readFileSync(path.join(applicationRoot, 'package.json'), 'utf8'));
L43: const packageMetadata = {
...
L58:
High Spawned Bundled Service Listener
Source launches a detached bundled service that exposes a broad-bound HTTP listener.
dist-server/server/modules/cli/cli.module.js View on unpkg · L1 • matchType = previous_version_dangerous_delta
matchedPackage = wind-agent-cli@1.46.8
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.46.8
similarity = 0.842
summary = stored previous version shares package body but lacks this dangerous source file
High Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist-server/server/modules/cli/cli.module.js View on unpkg scripts/windows-hidden-command-proxy.exe View file • path = scripts/windows-hidden-command-proxy.exe
kind = native_binary
sizeBytes = 100352
magicHex = [redacted]
Medium Ships Native Binary
Package ships native binary artifacts.
scripts/windows-hidden-command-proxy.exe View on unpkg • path = scripts/generate-pwa-icons.ps1
kind = build_helper
sizeBytes = 71
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/generate-pwa-icons.ps1 View on unpkg • path = dist/windcli-browser-bridge.zip
kind = high_entropy_blob
sizeBytes = 85566
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/windcli-browser-bridge.zip View on unpkg • path = dist/windcli-browser-bridge.zip
kind = compressed_blob
sizeBytes = 85566
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/windcli-browser-bridge.zip View on unpkg • path = dist/windcli-browser-bridge.zip
kind = nested_archive_needs_inspection
sizeBytes = 85566
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
dist/windcli-browser-bridge.zip View on unpkg dist-server/server/modules/assets/services/image-assets.service.js View file • stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 20
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist-server/server/modules/assets/services/image-assets.service.js View on unpkg dist-server/server/modules/plugins/plugin-process.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-process.service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/plugins/plugin-process.service.js View on unpkg dist-server/server/modules/plugins/plugin-registry.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-registry.service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/plugins/plugin-registry.service.js View on unpkg dist-server/server/modules/cli/sandbox.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted].service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/cli/sandbox.service.js View on unpkg dist-server/server/modules/projects/services/project-clone.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-clone.service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/projects/services/project-clone.service.js View on unpkg dist/assets/diagram-Q27KOJAE-Cw6qUHkI.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist/assets/diagram-Q27KOJAE-D_1NRrhv.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/assets/diagram-Q27KOJAE-Cw6qUHkI.js View on unpkg dist/assets/flowDiagram-UKHOOZJN-BdR3qcLl.js View file • matchType = token_shingles
matchedPackage = @dotobokuri/fleet-console@1.90.0
matchedPath = dist/client/assets/flowDiagram-DWJPFMVM-Dz5wLJVG.js
matchedIdentity = npm:[redacted]:1.90.0
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/assets/flowDiagram-UKHOOZJN-BdR3qcLl.js View on unpkg dist/assets/wardleyDiagram-T6FBY63Y-CAIK16It.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist/assets/wardleyDiagram-T6FBY63Y-CRgRdD3Z.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/assets/wardleyDiagram-T6FBY63Y-CAIK16It.js View on unpkg • matchType = normalized_sha256
matchedPackage = termdock@1.4.268
matchedPath = dist/client/workbox-9845bf53.js
matchedIdentity = npm:dGVybWRvY2s:1.4.268
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/workbox-9845bf53.js View on unpkg 1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-CvdMNM4z.js
dist/assets/common-CvdMNM4z.js View on unpkg · L1 1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-aa-F3pKQ.js
dist/assets/common-aa-F3pKQ.js View on unpkg · L1 1 patternName = generic_password
severity = medium
line = 1
Medium Secret Pattern
Hardcoded password in dist/assets/auth-BJY84eW-.js
dist/assets/auth-BJY84eW-.js View on unpkg · L1 1 patternName = generic_password
severity = medium
line = 1
Medium Secret Pattern
Hardcoded password in dist/assets/auth-Cy4bRM81.js
dist/assets/auth-Cy4bRM81.js View on unpkg · L1 1 patternName = generic_password
severity = medium
line = 1
Medium Secret Pattern
Hardcoded password in dist/assets/auth-k4fLNwIH.js
dist/assets/auth-k4fLNwIH.js View on unpkg · L1 1 patternName = generic_password
severity = medium
line = 1
Medium Secret Pattern
Hardcoded password in dist/assets/auth-uY1ymbuO.js
dist/assets/auth-uY1ymbuO.js View on unpkg · L1 1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-DFjOIvLC.js
dist/assets/common-DFjOIvLC.js View on unpkg · L1 1 patternName = generic_password
severity = medium
line = 1
Medium Secret Pattern
Hardcoded password in dist/assets/auth-B4uLGHR4.js
dist/assets/auth-B4uLGHR4.js View on unpkg · L1 1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-DYLsXN9b.js
dist/assets/common-DYLsXN9b.js View on unpkg · L1 1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-BwJZhc81.js
dist/assets/common-BwJZhc81.js View on unpkg · L1 1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-ClXrYLNn.js
dist/assets/common-ClXrYLNn.js View on unpkg · L1 dist/assets/feature-workspace-CSJk56lW.js View file 42 patternName = github_pat
severity = critical
line = 42
Critical Secret Pattern
GitHub personal access token in dist/assets/feature-workspace-CSJk56lW.js
dist/assets/feature-workspace-CSJk56lW.js View on unpkg · L42 High Entrypoint Build Divergence dist-server/server/index.js
High Sandbox Evasion Gated Capability electron/main.js
High Spawned Bundled Service Listener dist-server/server/modules/cli/cli.module.js
High Ships High Entropy Blob dist/windcli-browser-bridge.zip
High Semantic Analysis Limited dist-server/server/modules/assets/services/image-assets.service.js
High Known Malware Source Similarity dist-server/server/modules/plugins/plugin-process.service.js
High Known Malware Source Similarity dist-server/server/modules/plugins/plugin-registry.service.js
High Known Malware Source Similarity dist-server/server/modules/cli/sandbox.service.js
High Known Malware Source Similarity dist-server/server/modules/projects/services/project-clone.service.js
High Known Malware Source Similarity dist/assets/diagram-Q27KOJAE-Cw6qUHkI.js
High Known Malware Source Similarity dist/assets/flowDiagram-UKHOOZJN-BdR3qcLl.js
High Known Malware Source Similarity dist/assets/wardleyDiagram-T6FBY63Y-CAIK16It.js
High Known Malware Source Similarity dist/workbox-9845bf53.js
High Previous Version Dangerous Delta dist-server/server/modules/cli/cli.module.js
Medium Ambiguous Install Lifecycle Script package.json
Medium Dynamic Require dist-server/server/modules/auth/auth.module.js
Medium Unsafe Vm Context dist-server/server/modules/auth/tests/server-error-mapping.test.js
Medium Ships Native Binary scripts/windows-hidden-command-proxy.exe
Medium Ships Build Helper scripts/generate-pwa-icons.ps1
Medium Ships Compressed Blob dist/windcli-browser-bridge.zip
Medium Structural Risk Force Deep Review
Medium Secret Pattern dist/assets/auth-BJY84eW-.js
Medium Secret Pattern dist/assets/auth-Cy4bRM81.js
Medium Secret Pattern dist/assets/auth-k4fLNwIH.js
Medium Secret Pattern dist/assets/auth-uY1ymbuO.js
Medium Secret Pattern dist/assets/auth-B4uLGHR4.js
Low Non Install Lifecycle Scripts
Low Eval dist/assets/vendor-data-DPft5PCw.js
Low Weak Crypto dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.js
Low Nested Archive Needs Inspection dist/windcli-browser-bridge.zip
Runtime surface package.json Entrypoints main → dist-server/server/index.js bin → wacli
Runtime node >=22
Artifact 25.1 MB · 1,351 files 2 signature(s)
Install lifecycle postinstall prepare prepublishOnly
Behavioral surface ChildProcess Crypto DynamicRequire EnvironmentVars Eval Filesystem Network Shell WebSocket HighEntropyStrings Minified PossibleObfuscation Telemetry UrlStrings CopyleftLicense
39 flagged Lines 53-93 json
53 "build:client" : "node scripts/package-browser-extension.mjs && node scripts/build-client.mjs && node scripts/verify-pwa-build.mjs" ,
54 "perf:client" : "node scripts/measure-performance-baselines.mjs" ,
55 "perf:history" : "tsx --tsconfig server/tsconfig.json scripts/measure-history-baselines.ts" ,
56 "perf:federation" : "node scripts/measure-federation-overhead.mjs" ,
57 "prebuild:server" : "node -e \" require('node:fs').rmSync('dist-server.next', { recursive: true, force: true }) \" " ,
58 "build:server" : "tsc -p server/tsconfig.json && tsc-alias -p server/tsconfig.json" ,
59 "build:server:defer" : "cross-env WINDCLI_DEFER_SERVER_PROMOTION=1 npm run build:server" ,
60 "postbuild:server" : "node scripts/promote-dist-server.mjs" ,
61 "preview" : "vite preview" ,
62 "typecheck" : "tsc --noEmit -p tsconfig.json && tsc --noEmit -p server/tsconfig.json" ,
63 "test" : "tsx --tsconfig server/tsconfig.json --test --test-concurrency=1 \" server/**/*.test.ts \" \" server/**/*.test.js \" " ,
64 "test:client" : "tsx --test \" src/**/*.test.ts \" \" src/**/*.test.tsx \" && npm run test:browser-extension && npm run test:browser-i18n" ,
65 "test:browser-extension" : "node --test scripts/tests/browser-extension-*.test.mjs" ,
66 "test:browser-i18n" : "node --test scripts/tests/browser-i18n-runtime.test.mjs" ,
67 "test:desktop-updater" : "node --test scripts/tests/desktop-updater.test.mjs scripts/tests/desktop-package.test.mjs" ,
68 "lint" : "eslint src/ server/ --max-warnings=0" ,
69 "lint:fix" : "eslint src/ server/ --fix" ,
70 "start" : "npm run build && npm run server" ,
71 "release" : "./release.sh" ,
72 "prepublishOnly" : "npm run build" ,
73 "postinstall" : "node scripts/fix-node-pty.js && node scripts/fix-pm2-windows-console.js" ,
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg · L73 Medium Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.json View on unpkg · L73 75 "update:platform" : "./update-platform.sh" ,
76 "audit:production" : "npm audit --omit=dev --audit-level=low" ,
77 "audit:all" : "npm audit --audit-level=low"
80 "appId" : "ai.cloudcli.desktop" ,
81 "productName" : "WindCli" ,
83 "artifactName" : "windcli-desktop-${version}-${os}-${arch}.${ext}" ,
85 "output" : "release/desktop"
88 "main" : "electron/main.js"
Lines 1-2 javascript
1 const e = {save: "儲存" ,cancel: "取消" ,delete: "刪除" ,create: "建立" ,edit: "編輯" ,close: "關閉" ,confirm: "確認" ,submit: "送出" ,retry: "重試" ,refresh: "重新整理" ,search: "搜尋" ,clear: "清除"
dist-server/server/shared/claude-cli-path.js View file Lines 1-21 javascript
1 import { execFileSync } from 'node:child_process' ;
2 import fs from 'node:fs' ;
High Child Process
Package source references child process execution.
dist-server/server/shared/claude-cli-path.js View on unpkg · L1 3 import path from 'node:path' ;
Lines 1-5 javascript
1 import {e as we,g as jr} from "./vendor-react-C0GMoFE4.js" ; function ar ( j , K ){( K == null || K > j. length ) && ( K
dist-server/server/modules/auth/auth.module.js View file Lines 1-27 javascript
1 import { createRequire } from 'node:module' ;
2 import { getConnection, userDb } from '../../modules/database/index.js' ;
3 import { authenticateToken, generateToken } from './auth.middleware.js' ;
4 import { createAuthAttemptLimiter, createAuthRouter } from
dist-server/server/modules/auth/tests/server-error-mapping.test.js View file Lines 32-72 javascript
32 function createParserFixture () {
33 const app = express ();
dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.js View file 6 Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network
L6: import os from 'os';
L7: import http from 'http';
L8: import express from 'express';
...
L36: import { configureWebPush } from './modules/notifications/index.js';
L37: const __dirname = getModuleDirectory(import.meta.url);
L38: // The server source runs from /server, while the compiled output runs from /dist-server/server.
...
L42: // Version of the code that is actually running, captured once at process
L43: // startup. This intentionally does NOT re-read package.json per request: after
L44: // an update replaces the files on disk, package.json reflects the NEW version
...
L49: try {
L50: return JSON.parse(fs.readFileSync(path.join(APP_ROOT, 'package.json'), 'utf8')).vers
High Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
dist-server/server/index.js View on unpkg · L6 1 import { app, BrowserWindow, clipboard, dialog, ipcMain, session, shell, webContents } from 'electron';
L2: import { spawn } from 'node:child_process';
L3: import path from 'node:path';
...
L12:
L13: const __dirname = path.dirname(fileURLToPath(import.meta.url));
L14:
...
L18: const CALLBACK_URL = `${CALLBACK_PROTOCOL}://auth/callback`;
L19: const CLOUDCLI_CONTROL_PLANE_URL = process.env.CLOUDCLI_CONTROL_PLANE_URL || 'https://cloudcli.ai';
L20: const REMOTE_START_TIMEOUT_MS = 30000;
...
L24:
L25: if (process.platform === 'win32') {
L26: app.setAppUserModelId(APP_USER_MODEL_ID);
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
electron/main.js View on unpkg · L1 dist-server/server/modules/cli/cli.module.js View file 1 Detached bundled service listener: dist-server/server/modules/cli/cli.module.js spawns dist-server/server/index.js; helper exposes a broad-bound HTTP listener.
L1: import { execFileSync } from 'node:child_process';
L2: import fs from 'node:fs';
...
L18: if (result.status !== 0) {
L19: const stderr = typeof result.stderr === 'string' ? result.stderr.trim() : '';
L20: throw new Error(stderr || `npm exited with status ${result.status ?? 'unknown'}`);
...
L30: stdio: 'inherit',
L31: env: { ...process.env, WINDCLI_DEFER_SERVER_PROMOTION: '1' },
L32: });
...
L41: const applicationRoot = findApplicationRoot(getModuleDirectory(import.meta.url));
L42: const packageMetadataJson = JSON.parse(fs.readFileSync(path.join(applicationRoot, 'package.json'), 'utf8'));
L43: const packageMetadata = {
...
L58:
High Spawned Bundled Service Listener
Source launches a detached bundled service that exposes a broad-bound HTTP listener.
dist-server/server/modules/cli/cli.module.js View on unpkg · L1 • matchType = previous_version_dangerous_delta
matchedPackage = wind-agent-cli@1.46.8
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.46.8
similarity = 0.842
summary = stored previous version shares package body but lacks this dangerous source file
High Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist-server/server/modules/cli/cli.module.js View on unpkg scripts/windows-hidden-command-proxy.exe View file • path = scripts/windows-hidden-command-proxy.exe
kind = native_binary
sizeBytes = 100352
magicHex = [redacted]
Medium Ships Native Binary
Package ships native binary artifacts.
scripts/windows-hidden-command-proxy.exe View on unpkg • path = scripts/generate-pwa-icons.ps1
kind = build_helper
sizeBytes = 71
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
scripts/generate-pwa-icons.ps1 View on unpkg • path = dist/windcli-browser-bridge.zip
kind = high_entropy_blob
sizeBytes = 85566
magicHex = [redacted]
High Ships High Entropy Blob
Package ships high-entropy non-source blobs.
dist/windcli-browser-bridge.zip View on unpkg • path = dist/windcli-browser-bridge.zip
kind = compressed_blob
sizeBytes = 85566
magicHex = [redacted]
Medium Ships Compressed Blob
Package ships compressed or archive-like blobs.
dist/windcli-browser-bridge.zip View on unpkg • path = dist/windcli-browser-bridge.zip
kind = nested_archive_needs_inspection
sizeBytes = 85566
magicHex = [redacted]
Low Nested Archive Needs Inspection
Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.
dist/windcli-browser-bridge.zip View on unpkg dist-server/server/modules/assets/services/image-assets.service.js View file • stage = ast_semantic_analysis; reason = ast_alias_growth_limit_exceeded; limitedFiles = 20
High Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
dist-server/server/modules/assets/services/image-assets.service.js View on unpkg dist-server/server/modules/plugins/plugin-process.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-process.service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/plugins/plugin-process.service.js View on unpkg dist-server/server/modules/plugins/plugin-registry.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-registry.service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/plugins/plugin-registry.service.js View on unpkg dist-server/server/modules/cli/sandbox.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted].service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/cli/sandbox.service.js View on unpkg dist-server/server/modules/projects/services/project-clone.service.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist-[redacted]-clone.service.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist-server/server/modules/projects/services/project-clone.service.js View on unpkg dist/assets/diagram-Q27KOJAE-Cw6qUHkI.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist/assets/diagram-Q27KOJAE-D_1NRrhv.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/assets/diagram-Q27KOJAE-Cw6qUHkI.js View on unpkg dist/assets/flowDiagram-UKHOOZJN-BdR3qcLl.js View file • matchType = token_shingles
matchedPackage = @dotobokuri/fleet-console@1.90.0
matchedPath = dist/client/assets/flowDiagram-DWJPFMVM-Dz5wLJVG.js
matchedIdentity = npm:[redacted]:1.90.0
similarity = 1.000
shingleOverlap = 48
summary = source token shingles overlapped finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/assets/flowDiagram-UKHOOZJN-BdR3qcLl.js View on unpkg dist/assets/wardleyDiagram-T6FBY63Y-CAIK16It.js View file • matchType = normalized_sha256
matchedPackage = wind-agent-cli@1.40.0
matchedPath = dist/assets/wardleyDiagram-T6FBY63Y-CRgRdD3Z.js
matchedIdentity = npm:d2luZC1hZ2VudC1jbGk:1.40.0
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/assets/wardleyDiagram-T6FBY63Y-CAIK16It.js View on unpkg • matchType = normalized_sha256
matchedPackage = termdock@1.4.268
matchedPath = dist/client/workbox-9845bf53.js
matchedIdentity = npm:dGVybWRvY2s:1.4.268
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/workbox-9845bf53.js View on unpkg 1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-CvdMNM4z.js
dist/assets/common-CvdMNM4z.js View on unpkg · L1 1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-aa-F3pKQ.js
dist/assets/common-aa-F3pKQ.js View on unpkg · L1 1 patternName = generic_password
severity = medium
line = 1
Medium Secret Pattern
Hardcoded password in dist/assets/auth-BJY84eW-.js
dist/assets/auth-BJY84eW-.js View on unpkg · L1 1 patternName = generic_password
severity = medium
line = 1
Medium Secret Pattern
Hardcoded password in dist/assets/auth-Cy4bRM81.js
dist/assets/auth-Cy4bRM81.js View on unpkg · L1 1 patternName = generic_password
severity = medium
line = 1
Medium Secret Pattern
Hardcoded password in dist/assets/auth-k4fLNwIH.js
dist/assets/auth-k4fLNwIH.js View on unpkg · L1 1 patternName = generic_password
severity = medium
line = 1
Medium Secret Pattern
Hardcoded password in dist/assets/auth-uY1ymbuO.js
dist/assets/auth-uY1ymbuO.js View on unpkg · L1 1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-DFjOIvLC.js
dist/assets/common-DFjOIvLC.js View on unpkg · L1 1 patternName = generic_password
severity = medium
line = 1
Medium Secret Pattern
Hardcoded password in dist/assets/auth-B4uLGHR4.js
dist/assets/auth-B4uLGHR4.js View on unpkg · L1 1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-DYLsXN9b.js
dist/assets/common-DYLsXN9b.js View on unpkg · L1 1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-BwJZhc81.js
dist/assets/common-BwJZhc81.js View on unpkg · L1 1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-ClXrYLNn.js
dist/assets/common-ClXrYLNn.js View on unpkg · L1 dist/assets/feature-workspace-CSJk56lW.js View file 42 patternName = github_pat
severity = critical
line = 42
Critical Secret Pattern
GitHub personal access token in dist/assets/feature-workspace-CSJk56lW.js
dist/assets/feature-workspace-CSJk56lW.js View on unpkg · L42 ,copy:
"複製"
,download:
"下載"
,upload:
"上傳"
,browse:
"瀏覽"
},
t
=
{chat:
"聊天"
,shell:
"終端機"
,files:
"檔案"
,git:
"版本控制"
,tasks:
"任務"
,browser:
"瀏覽器"
,computer:
"電腦"
},
o
=
{loading:
"載入中..."
,success:
"成功"
,error:
"錯誤"
,failed:
"失敗"
,pending:
"待處理"
,completed:
"已完成"
,inProgress:
"進行中"
},
n
=
{savedSuccessfully:
"儲存成功"
,deletedSuccessfully:
"刪除成功"
,updatedSuccessfully:
"更新成功"
,operationFailed:
"操作失敗"
,networkError:
"網路錯誤，請檢查您的連線。"
,unauthorized:
"未授權，請登入。"
,notFound:
"找不到"
,invalidInput:
"輸入無效"
,requiredField:
"此欄 ..
.
Critical Critical Secret
Package contains a critical-looking secret pattern.
dist/assets/common-DNF7JDgr.js View on unpkg · L1 Long lines were clipped for display.
1 patternName = github_pat
severity = critical
line = 1
Critical Secret Pattern
GitHub personal access token in dist/assets/common-DNF7JDgr.js
dist/assets/common-DNF7JDgr.js View on unpkg · L1 4 const DEFAULT_CLAUDE_COMMAND = 'claude' ;
5 const CLAUDE_SCRIPT_EXTENSIONS = new Set ([ '.cjs' , '.js' , '.jsx' , '.mjs' , '.ts' , '.tsx' ]);
6 const CLAUDE_WRAPPER_SEGMENTS = [ 'node_modules' , '@anthropic-ai' , 'claude-code' , 'bin' , 'claude.exe' ];
7 function getPathApi ( platform ) {
8 return platform === 'win32' ? path.win32 : path;
10 function stripWrappingQuotes ( value ) {
11 const trimmed = value. trim ();
12 if ((trimmed. startsWith ( '"' ) && trimmed. endsWith ( '"' )) ||
13 (trimmed. startsWith ( "'" ) && trimmed. endsWith ( "'" ))) {
14 return trimmed. slice ( 1 , - 1 );
18 function isPathLike ( value ) {
19 return value. includes ( '/' ) || value. includes ( ' \\ ' );
21 function resolveClaudeWrapperBinary ( wrapperPath , deps ) {
=
j.
length
);
for
(
var
h
=
0
,
I
=
Array
(
K
);h
<
K
;h
++
)
I
[h]
=
j[h];
return
I
}
function
Wr
(
j
){
if
(Array.
isArray
(j))
return
j}
function
Hr
(
j
,
K
){
var
h
=
j
==
null
?
null
:typeof
Symbol<
"u"
&&
j
[
Symbol
.
iterator
]
||
j
[
"@@iterator"
];
if
(
h
!=
null
){
var
I
,
_
,
u
,
l
,
n
=
[],
c
=!
0
,
w
=!
1
;
try
{
if
(
u
=
(h
=
h.
call
(j)).next,
K
!==0)
for
(;!(
c
=
(
I
=
u.
call
(h)).done)&&(n.push(I.value),
n
.
length
!
==
K
);
c
=!
0
);}catch(k){w=!0,_=k}finally{try{if(!c&&h.return!=null&&(l=h.return(),Object(l)!==l))return}finally{if(w)throw _}}return n}}function Zr(){throw new TypeError(`Invalid a ...
2 In order to be iterable, non - array objects must have a [Symbol.iterator]() method.`)} function Gr ( j , K ){ return Wr ( j )|| Hr ( j , K )|| Yr ( j , K )|| Zr ()} function Yr ( j , K ){ if ( j ){ if ( typeof j == "string" ) return ar (j, K ); var h = {}.toString. call (j). slice ( 8 , - 1 ); return h === "Object" && j. constructor && (h = j. constructor .name),h === "Map" || h === "Set" ? Array. from (j) : h === "Arguments" || / ^ (?:Ui | I)nt(?:8 | 16 | 32)(?:Clamped) ? Array $ / . test (h) ? ar (j, K ) :void 0 }} const vr = Object . entries , sr = Object . setPrototypeOf , Xr = Object . isFrozen , Kr = Object . getPrototypeOf , Vr = Object . getOwnPropertyDescriptor ; let vt = Object . freeze , Et = Object . seal , te = Object . create , kr = t ...
3 `+gt),tt&&(gt=_e(gt)),R&&Zt?P(gt):gt},K.setConfig=function(){let X=arguments.length>0&&arguments[0]!==void 0?arguments[0]:{};xe(X),At=!0,Ft=t,Tt=x},K.clearConfig=function(){Jt=null,At=!1,Ft=null,Tt=null,R=rt,G=""},K.isValidAttribute=function(X,a,A){Jt||xe({});const M=bt(X),J=bt(a);return rr(M,J,A)},K.addHook=function(X,a){typeof a=="function"&&Rt(Y,X)&&oe(Y[X],a)},K.removeHook=function(X,a){if(Rt(Y,X)){if(a!==void 0){const A=qr(Y[X],a);return A===-1?void 0:$r(Y[X],A,1)[0]}return or(Y[X])}},K.removeHooks=function(X){Rt(Y,X)&&(Y[X]=[])},K.removeAllHooks=function(){Y=yr()},K}var Tn=Ar();function ...
4 \0 ` , Y += u ( z ,2), Y += B . magic , Y += u ( v ,2), Y += u ( T ,2), Y += u ( it . crc32 , 4 ), Y += u ( it . compressedSize , 4 ), Y += u ( it . uncompressedSize , 4 ), Y += u ( W . length , 2 ), Y += u ( P . length , 2 ),{ fileRecord : g . LOCAL_FILE_HEADER + Y + W + P , dirRecord : g . CENTRAL_FILE_HEADER + u ( nt ,2)+ Y + u ( rt . length , 2 )+ " \0\0\0\0 " + u ( O ,4)+ u ( f ,4)+ W + P + rt }} var n = h ( "../utils" ), c = h ( "../stream/GenericWorker" ), w = h ( "../utf8" ), k = h ( "../crc32" ), g = h ( "../signature" ); function y ( i , p , r , f ){ c . call ( this , "ZipFileWorker" ), this . bytesWritten = 0 , this . zipComment = p, this . zipPlatform = r, this . encodeFileName = f, this . streamFiles = i, this . accumulate =! 1 , this . contentBuffer = [], this . dirRecords = [], this . currentS ...
Low Eval
Package source references a known benign dynamic code generation pattern.
dist/assets/vendor-data-DPft5PCw.js View on unpkg · L3 Long lines were clipped for display.
'./auth.routes.js'
;
5 import { createAuthService } from './auth.service.js' ;
6 // bcrypt does not ship TypeScript declarations in this project, so the
7 // composition root narrows its CommonJS runtime surface before injecting it.
8 const require = createRequire ( import . meta .url);
9 const bcrypt = require ( 'bcrypt' );
Medium Dynamic Require
Package source references dynamic require/import behavior.
dist-server/server/modules/auth/auth.module.js View on unpkg · L7 10 const databaseConnection = getConnection ();
11 const authService = createAuthService ({
13 hasUsers : () => userDb. hasUsers (),
14 createUser : ( username , passwordHash ) => userDb. createUser (username, passwordHash),
15 getUserByUsername : ( username ) => userDb. getUserByUsername (username),
16 updateLastLogin : ( userId ) => userDb. updateLastLogin (userId),
19 begin : () => databaseConnection. prepare ( 'BEGIN' ). run (),
20 commit : () => databaseConnection. prepare ( 'COMMIT' ). run (),
21 rollback : () => databaseConnection. prepare ( 'ROLLBACK' ). run (),
23 hashPassword : ( password ) => bcrypt. hash (password, 12 ),
24 comparePassword : ( password , passwordHash ) => bcrypt. compare (password, passwordHash),
27 const authAttemptLimiter = createAuthAttemptLimiter ();
exports
=
{};
36 const helper = source.statements. find (( statement ) => ts. isFunctionDeclaration (statement)
37 && statement.name?.text === 'mapRequestBodyError' );
39 const parsers = source.statements. filter (isParserRegistration);
40 assert. equal (parsers. length , 2 );
41 const errorMiddleware = source.statements. filter (isErrorMiddleware);
42 assert. equal (errorMiddleware. length , 1 );
43 // Execute the actual entrypoint declarations without importing its startup,
44 // database, provider, or Browser MCP side effects.
45 const context = { app, express, AppError, SyntaxError, exports, console: { error : ( error ) => logs. push (error) } };
46 const execute = ( statements ) => {
47 const code = statements. map (( statement ) => statement. getText (source)). join ( ' \n ' );
48 runInNewContext (ts. transpileModule (code, {
49 compilerOptions: { module: ts.ModuleKind.CommonJS, target: ts.ScriptTarget. ES2022 },
50 }).outputText, context);
52 execute ([helper, ... parsers]);
53 app. post ( '/echo' , ( req , res ) => res. json ({ parsed: Boolean (req.body?.data) }));
54 app. get ( '/app-error' , () => {
Medium Unsafe Vm Context
Package source executes code through a VM context API.
dist-server/server/modules/auth/tests/server-error-mapping.test.js View on unpkg · L52 55 throw new AppError ( 'Controlled failure' , { statusCode: 403 , code: 'CONTROLLED' , details: 'detail' });
57 app. get ( '/unexpected' , () => { throw new Error ( 'secret stack and message' ); });
58 app. get ( '/syntax' , () => { throw new SyntaxError ( 'Internal JSON parsing failure' ); });
59 execute (errorMiddleware);
60 assert. ok ( exports .mapRequestBodyError);
61 return { app, logs, mapRequestBodyError: exports .mapRequestBodyError };
63 test ( 'pure parser error mapping excludes stacks, payloads and non-parser syntax errors' , () => {
64 const { mapRequestBodyError } = createParserFixture ();
65 assert. deepEqual ( JSON . parse ( JSON . stringify ( mapRequestBodyError ({ type: 'entity.too.large' , stack: 'secret' }))), {
66 statusCode: 413 , code: 'BODY_TOO_LARGE' , message: 'Request body is too large' ,
68 const error = Object. assign ( new SyntaxError ( 'secret payload' ), { type: 'entity.parse.failed' , body: 'secret' });
69 assert. deepEqual ( JSON . parse ( JSON . stringify ( mapRequestBodyError (error))), {
70 statusCode: 400 , code: 'INVALID_JSON' , message: 'Invalid JSON payload' ,
72 for ( const error of [ null , 'error' , new Error ( 'ordinary failure' ), new SyntaxError ( 'internal failure' )]) {
92 if (experimentalText. trim ()) {
93 return experimentalText;
96 return typeof item.result === 'string' ? item.result : '' ;
98 function parseCursorToolInput ( rawInput ) {
99 if ( typeof rawInput !== 'string' ) {
102 const trimmed = rawInput. trim ();
107 return JSON . parse (trimmed);
108 }
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist-server/server/modules/providers/list/cursor/cursor-sessions.provider.js View on unpkg · L106 113 function normalizeCursorToolInput ( toolName , rawInput ) {
114 const parsed = parseCursorToolInput (rawInput);
115 if ( ! parsed || typeof parsed !== 'object' || Array. isArray (parsed)) {
118 const input = parsed;
119 const normalized = { ... input };
120 const filePath = input.file_path
125 if ( typeof filePath === 'string' && filePath. trim ()) {
126 normalized.file_path = filePath;