Agent-agnostic webhook router that pushes external events into running AI coding CLI sessions (Claude Code, Codex).
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 1 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
reply
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit d748584 · analyzer v33 · 2w ago
skills & prompt files 3
danger signals1
- suspicious endpoint 169.254.169.254 (cloud metadata) Anish98821-agent-session-router-d748584/test/unit/safeFetch.test.ts :47
await reject('https://169.254.169.254/latest/meta-data/');
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 106
filesystem 27
- fs Anish98821-agent-session-router-d748584/src/adapters/claude/mcpConfig.ts :1
import fs from 'node:fs'; - fs Anish98821-agent-session-router-d748584/src/adapters/claude/processManager.ts :2
import fs from 'node:fs'; - fs Anish98821-agent-session-router-d748584/src/adapters/claude/transcripts.ts :1
import fs from 'node:fs'; - fs Anish98821-agent-session-router-d748584/src/cli.ts :2
import fs from 'node:fs'; - fs Anish98821-agent-session-router-d748584/src/lib/pinLock.ts :2
import fs from 'node:fs'; - fs Anish98821-agent-session-router-d748584/src/lib/projectRoot.ts :1
import fs from 'node:fs'; - fs Anish98821-agent-session-router-d748584/src/lib/tokenStore.ts :2
import fs from 'node:fs'; - fs Anish98821-agent-session-router-d748584/src/lib/workspaceRoots.ts :1
import fs from 'node:fs'; - fs Anish98821-agent-session-router-d748584/src/registry/persistence.ts :1
import fs from 'node:fs'; - fs Anish98821-agent-session-router-d748584/src/routes/filesystem.ts :1
import fs from 'node:fs/promises'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/auth.test.ts :1
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/authKeys.test.ts :1
import fs from 'node:fs';
show 15 more
- fs (weak) Anish98821-agent-session-router-d748584/test/unit/claudeAdapter.test.ts :1
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/claudeSpawnConfig.test.ts :1
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/claudeTranscripts.test.ts :1
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/cli.test.ts :1
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/filesystemRoute.test.ts :1
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/httpApi.test.ts :1
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/persistence.test.ts :1
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/pinLock.test.ts :2
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/projectRoot.test.ts :1
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/rateLimit.test.ts :1
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/registry.test.ts :1
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/spaFallback.test.ts :1
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/terminalRoute.test.ts :2
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/tunnelExposure.test.ts :1
import fs from 'node:fs'; - fs (weak) Anish98821-agent-session-router-d748584/test/unit/workspaceRoots.test.ts :1
import fs from 'node:fs';
shell / exec 2
- shell Anish98821-agent-session-router-d748584/src/adapters/claude/processManager.ts :1
import { execFileSync } from 'node:child_process'; - shell (weak) Anish98821-agent-session-router-d748584/test/unit/claudeAdapter.test.ts :53
// Simulate the CLI dying right after spawn (bad workDir, auth prompt, …).
network 16
- net Anish98821-agent-session-router-d748584/src/adapters/claude/ClaudeAdapter.ts :68
const res = await fetch(`http://127.0.0.1:${port}/health`, { signal: AbortSignal.timeout(1000) }); - net Anish98821-agent-session-router-d748584/src/adapters/claude/channelServer.ts :21
import http from 'node:http'; - net Anish98821-agent-session-router-d748584/src/adapters/claude/portAllocator.ts :1
import net from 'node:net'; - net Anish98821-agent-session-router-d748584/src/index.ts :1
import http from 'node:http'; - net Anish98821-agent-session-router-d748584/src/lib/auth.ts :2
import type { IncomingMessage } from 'node:http'; - net Anish98821-agent-session-router-d748584/src/lib/authPolicy.ts :1
import type { IncomingMessage } from 'node:http'; - net Anish98821-agent-session-router-d748584/src/lib/safeFetch.ts :2
import net from 'node:net'; - net Anish98821-agent-session-router-d748584/src/routes/auth.ts :1
import type { IncomingMessage } from 'node:http'; - net Anish98821-agent-session-router-d748584/src/routes/terminal.ts :1
import type { Server } from "node:http"; - net (weak) Anish98821-agent-session-router-d748584/test/unit/auth.test.ts :2
import http from 'node:http'; - net (weak) Anish98821-agent-session-router-d748584/test/unit/authKeys.test.ts :2
import http from 'node:http'; - net (weak) Anish98821-agent-session-router-d748584/test/unit/httpApi.test.ts :4
import http from 'node:http';
show 4 more
- net (weak) Anish98821-agent-session-router-d748584/test/unit/pinLock.test.ts :3
import http from 'node:http'; - net (weak) Anish98821-agent-session-router-d748584/test/unit/terminalRoute.test.ts :1
import http from 'node:http'; - net (weak) Anish98821-agent-session-router-d748584/vite.config.ts :13
* through to the Express server, so `fetch('/sessions')` is same-origin in - net Anish98821-agent-session-router-d748584/webui/src/api.ts :40
let res = await fetch(path, options);
secrets 2
- secrets Anish98821-agent-session-router-d748584/src/adapters/claude/channelServer.ts :29
const CHANNEL_TOKEN = process.env.ROUTER_CHANNEL_TOKEN ?? ''; - secrets Anish98821-agent-session-router-d748584/src/config.ts :17
authToken: process.env.ROUTER_AUTH_TOKEN || undefined,
tool registrations 1
- reply Anish98821-agent-session-router-d748584/src/adapters/claude/channelServer.ts :50
install hooks 1
- prepublishOnly Anish98821-agent-session-router-d748584/package.json :42
npm run build
declared dependencies 36
- @modelcontextprotocol/sdk@^1.12.0
- express@^4.21.0
- node-pty@^1.1.0
- ws@^8.21.1
- zod@^3.23.8
- @fontsource/ibm-plex-mono@^5.3.0
- @fontsource/ibm-plex-sans@^5.3.0
- @tailwindcss/vite@^4.3.3
- @testing-library/react@^16.3.2
- @testing-library/user-event@^14.6.1
- @types/express@^4.17.21
- @types/node@^20.14.0
show 24 more
- @types/react@^19.2.17
- @types/react-dom@^19.2.3
- @types/supertest@^6.0.2
- @types/ws@^8.18.1
- @vitejs/plugin-react@^6.0.4
- @xterm/addon-fit@^0.11.0
- @xterm/xterm@^6.0.0
- class-variance-authority@^0.7.1
- clsx@^2.1.1
- cmdk@^1.1.1
- jsdom@^29.1.1
- lucide-react@^1.27.0
- radix-ui@^1.6.7
- react@^19.2.8
- react-dom@^19.2.8
- sonner@^2.0.7
- supertest@^7.0.0
- tailwind-merge@^3.6.0
- tailwindcss@^4.3.3
- tsx@^4.19.0
- tw-animate-css@^1.4.0
- typescript@^5.6.0
- vite@^8.1.5
- vitest@^4.1.10