registry / zelari-code / 0.4.3

zelari-code@0.4.3

Zelari Code — AI Council coding agent CLI. Multi-agent orchestration (Caronte, Nettuno, Gerione, Plutone, Minosse, Lucifero) with slash commands, provider-agnostic LLM streaming, and self-update.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is an interactive AI coding-agent CLI with user-invoked remote model, filesystem, and shell capabilities that are package-aligned and guarded by sandbox/blocklist wrappers.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs zelari-code and submits prompts or /council or /update commands.

Impact

Remote model may request project-scoped reads/writes or shell commands during normal CLI use; no install-time or covert execution found.

Mechanism

user-invoked AI coding agent tools

Rationale

Static inspection shows a legitimate coding-agent CLI with powerful but user-invoked capabilities; the risky primitives are aligned with the package purpose and wrapped with sandbox, blocklist, and audit controls. I found no install-time execution, covert credential collection, persistence, destructive payload, or unconsented AI-agent control-surface mutation.

Evidence

package.jsonbin/zelari-code.jsdist/cli/main.jsdist/cli/updater.jsdist/cli/provider/openai-compatible.jsdist/cli/toolRegistry.jsdist/main/core/tools/builtin/filesystem.jsdist/main/core/tools/builtin/shell.jsdist/cli/workspace/agentsMd.jsAGENTS.MD.zelari/

Network endpoints9

registry.npmjs.org/zelari-code/latestapi.x.ai/v1api.MiniMax.chat/v1api.z.ai/v1auth.x.ai/oauth2/device/codeauth.x.ai/oauth2/tokenapi.openai.com/v1api.z.ai/api/paas/v4api.minimaxi.chat/v1

Decision evidence

public snapshot

AI called this Clean at 83.0% confidence as Benign with medium false-positive risk.

Evidence for block

dist/main/core/tools/builtin/shell.js exposes a model-callable bash tool using spawn(...,{shell:true}).
dist/main/core/tools/builtin/filesystem.js exposes read/write/edit file tools.
dist/cli/provider/openai-compatible.js sends chat and tool schemas to configured LLM endpoints.
dist/cli/workspace/agentsMd.js can create/update project AGENTS.MD after council runs.

Evidence against

package.json has no install/postinstall lifecycle; prepublishOnly is publish-time only.
bin/zelari-code.js only imports dist/cli/main.bundled.js or dist/cli/main.js when user runs the CLI.
dist/cli/toolRegistry.js wraps file tools with sandboxPath rooted at process.cwd().
dist/cli/toolRegistry.js wraps bash with shellBlocklist and audits tool calls.
dist/cli/updater.js only checks npm registry on startup; npm install -g update runs through user /update flow.
No credential harvesting or hardcoded exfiltration endpoint found; provider API keys are used for normal LLM requests.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 98 file(s), 1.56 MB of source, external domains: api.minimax.chat, api.minimaxi.chat, api.openai.com, api.x.ai, api.z.ai, auth.x.ai, json-schema.org, registry.npmjs.org

Source & flagged code

6 flagged

dist/cli/updater.jsView file

Lines 1-38javascript

1/**

2 * updater — npm registry self-update mechanism for zelari-code.

3 *

4 * Functions:

5 * - getCurrentVersion(): reads bundled package.json

6 * - checkForUpdate(): fetches https://registry.npmjs.org/zelari-code/latest,

7 * compares semver, returns { currentVersion, latestVersion, updateAvailable }

8 * - performUpdate(): spawns `npm install -g zelari-code@latest`,

9 * captures stdout/stderr, returns { ok, output, error? }

10 *

11 * All network + spawn operations are injectable for testing (see tests).

12 *

13 * Channel: `latest` only (locked per user decision, v3-N).

14 * No self-restart: caller is expected to display "please restart manually".

15 *

16 * @see docs/plans/2026-06-30-anathema-coder-v3-N.md

17 */

18import { createRequire } from 'node:module';

19import { spawn } from 'node:child_process';

20import path from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli/updater.jsView on unpkg · L18

21import { fileURLToPath } from 'node:url';

22const require = createRequire(import.meta.url);

23const __dirname = path.dirname(fileURLToPath(import.meta.url));

24/**

25 * Read the bundled package.json and return its version.

26 * Falls back to '0.0.0' if the file cannot be resolved (very unlikely).

27 */

28export function getCurrentVersion() {

29 try {

30 // Resolve from the package root (this file lives at <pkg>/electron/cli/updater.ts

31 // or <pkg>/dist/electron/cli/updater.js after build)

32 const pkgPath = path.resolve(__dirname, '..', '..', 'package.json');

33 const pkg = require(pkgPath);

34 return pkg.version;

35 }

36 catch {

37 return '0.0.0';

38 }

Lines 106-146javascript

106 const latest = await fetchLatestVersion(fetcher, registryUrl);

107 if ('error' in latest) {

108 return {

109 currentVersion,

110 latestVersion: currentVersion,

111 updateAvailable: false,

112 error: latest.error,

113 };

bin/zelari-code.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2/**

3 * zelari-code — npm bin entrypoint.

4 *

5 * Spawned by npm when running `zelari-code` from anywhere after

6 * `npm install -g zelari-code`. Resolves to the compiled CLI bundle

7 * (tsc + esbuild output) OR falls back to tsx (dev/source workflow).

8 *

9 * Strategy:

10 * 1. If `dist/cli/main.bundled.js` exists (production build), require it.

11 * 2. Otherwise (dev/source install), use tsx to run the TS source directly.

12 *

dist/cli/main.bundled.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = zelari-code@0.2.2 matchedIdentity = npm:emVsYXJpLWNvZGU:0.2.2 similarity = 0.783 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli/main.bundled.jsView on unpkg

420async function openBrowser(url2) { L421: const { spawn: spawn3 } = await import("node:child_process"); L422: const cmd = (() => { ... L546: try { L547: const raw = readFileSync(file2, "utf-8"); L548: const parsed = JSON.parse(raw); ... L669: { id: "openai-compatible", displayName: "OpenAI-compatible", envVar: "OPENAI_API_KEY" }, L670: { id: "minimax", displayName: "MiniMax", envVar: "MINIMAX_API_KEY", baseUrl: "https://api.MiniMax.chat/v1" }, L671: { id: "glm", displayName: "GLM / Z.AI", envVar: "GLM_API_KEY", baseUrl: "https://api.z.ai/v1" }, ... L17279: - Prefer to consolidate related actions into a single tools block at the end of your response. L17280: - Never invent tool names \u2014 use only the tools listed in your AVAILABLE TOOLS section. L17281: - After creating artifacts via tools, briefly name what you created so downstream agents can build on it without re-querying.`

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli/main.bundled.jsView on unpkg · L420

195}, L196: body: new URLSearchParams({ L197: client_id: options.clientId, ... L207: if (!response.ok) { L208: const errText = await response.text().catch(() => ""); L209: throw new GrokOAuthError( ... L340: async function runGrokOAuthFlow(options = {}) { L341: const clientId = options.clientId || process.env.GROK_OAUTH_CLIENT_ID || DEFAULT_GROK_OAUTH_CLIENT_ID; L342: if (!clientId || clientId.trim().length === 0) { ... L420: async function openBrowser(url2) { L421: const { spawn: spawn3 } = await import("node:child_process"); L422: const cmd = (() => {

Source & flagged code

6 flagged · loading source

dist/cli/updater.jsView file

18import { createRequire } from 'node:module'; L19: import { spawn } from 'node:child_process'; L20: import path from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli/updater.jsView on unpkg · L18

126* On Windows, `spawn('npm', ...)` fails with ENOENT because npm is a .cmd L127: * shim — `shell: true` lets the shell resolve the extension. L128: */

High

Shell

Package source references shell execution.

dist/cli/updater.jsView on unpkg · L126

bin/zelari-code.jsView file

21L22: const require = createRequire(import.meta.url); L23: const __dirname = path.dirname(fileURLToPath(import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/zelari-code.jsView on unpkg · L21

dist/cli/main.bundled.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli/main.bundled.jsView on unpkg

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli/main.bundled.jsView on unpkg · L420

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/main.bundled.jsView on unpkg · L195

Findings

1 Critical3 High4 Medium7 Low

CriticalPrevious Version Dangerous Deltadist/cli/main.bundled.js

HighChild Processdist/cli/updater.js

HighShelldist/cli/updater.js

HighRemote Agent Bridgedist/cli/main.bundled.js

MediumDynamic Requirebin/zelari-code.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli/main.bundled.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/cli/updater.jsView file

Lines 1-38javascript

1/**

2 * updater — npm registry self-update mechanism for zelari-code.

3 *

4 * Functions:

5 * - getCurrentVersion(): reads bundled package.json

6 * - checkForUpdate(): fetches https://registry.npmjs.org/zelari-code/latest,

7 * compares semver, returns { currentVersion, latestVersion, updateAvailable }

8 * - performUpdate(): spawns `npm install -g zelari-code@latest`,

9 * captures stdout/stderr, returns { ok, output, error? }

10 *

11 * All network + spawn operations are injectable for testing (see tests).

12 *

13 * Channel: `latest` only (locked per user decision, v3-N).

14 * No self-restart: caller is expected to display "please restart manually".

15 *

16 * @see docs/plans/2026-06-30-anathema-coder-v3-N.md

17 */

18import { createRequire } from 'node:module';

19import { spawn } from 'node:child_process';

20import path from 'node:path';

High

Child Process

Package source references child process execution.

dist/cli/updater.jsView on unpkg · L18

21import { fileURLToPath } from 'node:url';

22const require = createRequire(import.meta.url);

23const __dirname = path.dirname(fileURLToPath(import.meta.url));

24/**

25 * Read the bundled package.json and return its version.

26 * Falls back to '0.0.0' if the file cannot be resolved (very unlikely).

27 */

28export function getCurrentVersion() {

29 try {

30 // Resolve from the package root (this file lives at <pkg>/electron/cli/updater.ts

31 // or <pkg>/dist/electron/cli/updater.js after build)

32 const pkgPath = path.resolve(__dirname, '..', '..', 'package.json');

33 const pkg = require(pkgPath);

34 return pkg.version;

35 }

36 catch {

37 return '0.0.0';

38 }

Lines 106-146javascript

106 const latest = await fetchLatestVersion(fetcher, registryUrl);

107 if ('error' in latest) {

108 return {

109 currentVersion,

110 latestVersion: currentVersion,

111 updateAvailable: false,

112 error: latest.error,

113 };

bin/zelari-code.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2/**

3 * zelari-code — npm bin entrypoint.

4 *

5 * Spawned by npm when running `zelari-code` from anywhere after

6 * `npm install -g zelari-code`. Resolves to the compiled CLI bundle

7 * (tsc + esbuild output) OR falls back to tsx (dev/source workflow).

8 *

9 * Strategy:

10 * 1. If `dist/cli/main.bundled.js` exists (production build), require it.

11 * 2. Otherwise (dev/source install), use tsx to run the TS source directly.

12 *

dist/cli/main.bundled.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli/main.bundled.jsView on unpkg

High

Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli/main.bundled.jsView on unpkg · L420