registry / zelari-code / 0.2.2

zelari-code@0.2.2

Zelari Code — AI Council coding agent CLI. Multi-agent orchestration (Sisyphus, Prometheus, Hephaestus, Atlas, Oracle, Chairman) with slash commands, provider-agnostic LLM streaming, and self-update.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 73 file(s), 1.35 MB of source, external domains: api.minimax.chat, api.minimaxi.chat, api.openai.com, api.x.ai, api.z.ai, auth.x.ai, json-schema.org, registry.npmjs.org

Source & flagged code

4 flagged

dist/cli/updater.jsView file

Lines 1-38javascript

1/**

2 * updater — npm registry self-update mechanism for zelari-code.

3 *

4 * Functions:

5 * - getCurrentVersion(): reads bundled package.json

6 * - checkForUpdate(): fetches https://registry.npmjs.org/zelari-code/latest,

7 * compares semver, returns { currentVersion, latestVersion, updateAvailable }

8 * - performUpdate(): spawns `npm install -g zelari-code@latest`,

9 * captures stdout/stderr, returns { ok, output, error? }

10 *

11 * All network + spawn operations are injectable for testing (see tests).

12 *

13 * Channel: `latest` only (locked per user decision, v3-N).

14 * No self-restart: caller is expected to display "please restart manually".

15 *

16 * @see docs/plans/2026-06-30-anathema-coder-v3-N.md

17 */

18import { createRequire } from 'node:module';

19import { spawn } from 'node:child_process';

20import path from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli/updater.jsView on unpkg · L18

21import { fileURLToPath } from 'node:url';

22const require = createRequire(import.meta.url);

23const __dirname = path.dirname(fileURLToPath(import.meta.url));

24/**

25 * Read the bundled package.json and return its version.

26 * Falls back to '0.0.0' if the file cannot be resolved (very unlikely).

27 */

28export function getCurrentVersion() {

29 try {

30 // Resolve from the package root (this file lives at <pkg>/electron/cli/updater.ts

31 // or <pkg>/dist/electron/cli/updater.js after build)

32 const pkgPath = path.resolve(__dirname, '..', '..', 'package.json');

33 const pkg = require(pkgPath);

34 return pkg.version;

35 }

36 catch {

37 return '0.0.0';

38 }

Lines 106-146javascript

106 const latest = await fetchLatestVersion(fetcher, registryUrl);

107 if ('error' in latest) {

108 return {

109 currentVersion,

110 latestVersion: currentVersion,

111 updateAvailable: false,

112 error: latest.error,

113 };

bin/zelari-code.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2/**

3 * zelari-code — npm bin entrypoint.

4 *

5 * Spawned by npm when running `zelari-code` from anywhere after

6 * `npm install -g zelari-code`. Resolves to the compiled CLI bundle

7 * (tsc + esbuild output) OR falls back to tsx (dev/source workflow).

8 *

9 * Strategy:

10 * 1. If `dist/cli/main.bundled.js` exists (production build), require it.

11 * 2. Otherwise (dev/source install), use tsx to run the TS source directly.

12 *

dist/cli/main.bundled.jsView file

250async function openBrowser(url2) { L251: const { spawn: spawn3 } = await import("node:child_process"); L252: const cmd = (() => { ... L376: try { L377: const raw = readFileSync(file2, "utf-8"); L378: const parsed = JSON.parse(raw); ... L499: { id: "openai-compatible", displayName: "OpenAI-compatible", envVar: "OPENAI_API_KEY" }, L500: { id: "minimax", displayName: "MiniMax", envVar: "MINIMAX_API_KEY", baseUrl: "https://api.MiniMax.chat/v1" }, L501: { id: "glm", displayName: "GLM / Z.AI", envVar: "GLM_API_KEY", baseUrl: "https://api.z.ai/v1" }, ... L5275: - Prefer to consolidate related actions into a single tools block at the end of your response. L5276: - Never invent tool names \u2014 use only the tools listed in your AVAILABLE TOOLS section. L5277: - After creating artifacts via tools, briefly name what you created so downstream agents can build on it without re-querying.`

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli/main.bundled.jsView on unpkg · L250

Source & flagged code

4 flagged · loading source

dist/cli/updater.jsView file

18import { createRequire } from 'node:module'; L19: import { spawn } from 'node:child_process'; L20: import path from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli/updater.jsView on unpkg · L18

126* On Windows, `spawn('npm', ...)` fails with ENOENT because npm is a .cmd L127: * shim — `shell: true` lets the shell resolve the extension. L128: */

High

Shell

Package source references shell execution.

dist/cli/updater.jsView on unpkg · L126

bin/zelari-code.jsView file

21L22: const require = createRequire(import.meta.url); L23: const __dirname = path.dirname(fileURLToPath(import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/zelari-code.jsView on unpkg · L21

dist/cli/main.bundled.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli/main.bundled.jsView on unpkg · L250

Findings

3 High4 Medium6 Low

HighChild Processdist/cli/updater.js

HighShelldist/cli/updater.js

HighRemote Agent Bridgedist/cli/main.bundled.js

MediumDynamic Requirebin/zelari-code.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/cli/updater.jsView file

Lines 1-38javascript

1/**

2 * updater — npm registry self-update mechanism for zelari-code.

3 *

4 * Functions:

5 * - getCurrentVersion(): reads bundled package.json

6 * - checkForUpdate(): fetches https://registry.npmjs.org/zelari-code/latest,

7 * compares semver, returns { currentVersion, latestVersion, updateAvailable }

8 * - performUpdate(): spawns `npm install -g zelari-code@latest`,

9 * captures stdout/stderr, returns { ok, output, error? }

10 *

11 * All network + spawn operations are injectable for testing (see tests).

12 *

13 * Channel: `latest` only (locked per user decision, v3-N).

14 * No self-restart: caller is expected to display "please restart manually".

15 *

16 * @see docs/plans/2026-06-30-anathema-coder-v3-N.md

17 */

18import { createRequire } from 'node:module';

19import { spawn } from 'node:child_process';

20import path from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli/updater.jsView on unpkg · L18

21import { fileURLToPath } from 'node:url';

22const require = createRequire(import.meta.url);

23const __dirname = path.dirname(fileURLToPath(import.meta.url));

24/**

25 * Read the bundled package.json and return its version.

26 * Falls back to '0.0.0' if the file cannot be resolved (very unlikely).

27 */

28export function getCurrentVersion() {

29 try {

30 // Resolve from the package root (this file lives at <pkg>/electron/cli/updater.ts

31 // or <pkg>/dist/electron/cli/updater.js after build)

32 const pkgPath = path.resolve(__dirname, '..', '..', 'package.json');

33 const pkg = require(pkgPath);

34 return pkg.version;

35 }

36 catch {

37 return '0.0.0';

38 }

Lines 106-146javascript

106 const latest = await fetchLatestVersion(fetcher, registryUrl);

107 if ('error' in latest) {

108 return {

109 currentVersion,

110 latestVersion: currentVersion,

111 updateAvailable: false,

112 error: latest.error,

113 };

bin/zelari-code.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2/**

3 * zelari-code — npm bin entrypoint.

4 *

5 * Spawned by npm when running `zelari-code` from anywhere after

6 * `npm install -g zelari-code`. Resolves to the compiled CLI bundle

7 * (tsc + esbuild output) OR falls back to tsx (dev/source workflow).

8 *

9 * Strategy:

10 * 1. If `dist/cli/main.bundled.js` exists (production build), require it.

11 * 2. Otherwise (dev/source install), use tsx to run the TS source directly.

12 *

dist/cli/main.bundled.jsView file

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli/main.bundled.jsView on unpkg · L250