github Swift re-analysis due deep scan · partial (208/1,621 files)

yanlingLabs/winter

A native macOS AI assistant that replaces the ChatGPT/Claude ecosystem: chat, a full coding agent, and an orchestrator — running on your own Mac, with your own account.

maintainer: yanlingLabs
licence: Apache-2.0
first seen: 2026-09-12
last seen: 2026-09-19
releases · 30d: 14
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport — counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit f49ed4d · analyzer v33 · 1h ago

skills & prompt files 2

agent-rules yanlingLabs-winter-f49ed4d/CLAUDE.md
skill yanlingLabs-winter-f49ed4d/packages/core/skills/writing-skills/SKILL.md

danger signals13

suspicious endpoint pastebin.com yanlingLabs-winter-f49ed4d/packages/core/test/agent/permission-rules.test.ts :299 expect(ruleMatches(domainRule, call("web_fetch", { url: "https://pastebin.com/raw/xyz" }))).toBe(true);
suspicious endpoint raw.pastebin.com yanlingLabs-winter-f49ed4d/packages/core/test/agent/permission-rules.test.ts :303 expect(ruleMatches(domainRule, call("web_fetch", { url: "https://raw.pastebin.com/xyz" }))).toBe(true);
suspicious endpoint PASTEBIN.com yanlingLabs-winter-f49ed4d/packages/core/test/agent/permission-rules.test.ts :316 expect(ruleMatches(mixedRule, call("web_fetch", { url: "https://PASTEBIN.com/x" }))).toBe(true);
suspicious endpoint transfer.sh yanlingLabs-winter-f49ed4d/packages/core/test/agent/permission-rules.test.ts :530 expect(pr.decision(call("web_fetch", { url: "https://transfer.sh/f" }), root)).toBe("allow");
suspicious endpoint www.google-analytics.com (telemetry) yanlingLabs-winter-f49ed4d/packages/core/test/agent/tools/page-core.test.ts :47 '<p>Analytics: <a href="https://www.google-analytics.com/analytics.js">ad3</a>.</p>' +
suspicious endpoint transfer.sh yanlingLabs-winter-f49ed4d/packages/core/test/agent/tools/page-core.test.ts :864 const m = checkDangerousDomain("https://transfer.sh/x");
suspicious endpoint raw.pastebin.com yanlingLabs-winter-f49ed4d/packages/core/test/agent/tools/page-core.test.ts :869 const m = checkDangerousDomain("https://raw.pastebin.com/abc");
suspicious endpoint pastebin.com yanlingLabs-winter-f49ed4d/packages/core/test/runtime-sdk/hooks.test.ts :360 const out = await fetchVerdict("https://pastebin.com/raw/abc");
suspicious endpoint PASTEBIN.COM yanlingLabs-winter-f49ed4d/packages/core/test/runtime-sdk/hooks.test.ts :370 "https://PASTEBIN.COM/x",
suspicious endpoint raw.pastebin.com yanlingLabs-winter-f49ed4d/packages/core/test/runtime-sdk/hooks.test.ts :375 "https://raw.pastebin.com/x",
suspicious endpoint 169.254.169.254 (cloud metadata) yanlingLabs-winter-f49ed4d/packages/core/test/runtime-sdk/private-address-floor.test.ts :66 "http://169.254.169.254/latest/", // link-local, the metadata surface
suspicious endpoint pastebin.com yanlingLabs-winter-f49ed4d/packages/core/test/runtime-sdk/web-floor-measure.e2e.test.ts :311 const got = await measure({ binary, firstTurn: toolUseTurn("WebFetch", { url: "https://pastebin.com/raw/measured", prompt: "what does this say?" }) });
credential in logs credential in log yanlingLabs-winter-f49ed4d/scripts/sign-relay-config.ts :229 console.log(`Public key (base64): ${rawPublicKey(privateKey).toString("base64")}`);

code evidence vv0.114.4 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1255

filesystem 284

fs yanlingLabs-winter-f49ed4d/infra/relay/provision.ts :24 import { readFileSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/cli/src/commands/migrate.ts :4 import { existsSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/cli/src/launchd.ts :3 import { writeFileSync, unlinkSync, existsSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/cli/src/main.ts :3 import { existsSync, readFileSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/cli/src/plugin-cli.ts :10 import { existsSync, mkdirSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/cli/src/tui/file-index.ts :9 import { readdir } from "node:fs/promises";
fs yanlingLabs-winter-f49ed4d/packages/cli/src/tui/history-store.ts :7 import { appendFileSync, readFileSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/client.test.ts :3 import { mkdtempSync, realpathSync, writeFileSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/credentials-cli.test.ts :2 import { mkdtempSync, readFileSync, rmSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/daemon-sigterm.test.ts :2 import { mkdtempSync, existsSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/main.test.ts :2 import { mkdtempSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/migrate-project.test.ts :2 import { existsSync, mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";

show 28 more

fs (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/migrate.test.ts :2 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/plugin-cli.test.ts :2 import { existsSync, mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/preload.ts :1 import { mkdtempSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/tui/app.test.tsx :15 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/tui/commands.test.ts :13 import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/tui/composer.test.tsx :1 import { mkdtempSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/tui/file-index.test.ts :8 import { chmodSync, mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/tui/history-store.test.ts :1 import { mkdtempSync, writeFileSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/core/scripts/capability-matrix.ts :41 import { writeFileSync } from "node:fs";
fs (weak) yanlingLabs-winter-f49ed4d/packages/core/scripts/capture-projector-goldens.ts :40 import { mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync, existsSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/agent-definitions.ts :35 import { lstatSync, readFileSync, readdirSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/bg-registry.ts :2 import { realpathSync, mkdirSync, appendFileSync, writeFileSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/context.ts :1 import { readdirSync, readFileSync, statSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/dirs.ts :1 import { realpathSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/dream-ops.ts :1 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync, readdirSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/dreamer.ts :1 import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/legacy-project-files.ts :7 import { existsSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/lsp/auto-diagnostics.ts :1 import { readFileSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/mcp/manager.ts :2 import { readFileSync, realpathSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/memory-dir.ts :3 import { realpathSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/memory-file-ops.ts :1 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/memory-migrate.ts :1 import { existsSync, mkdirSync, readdirSync, writeFileSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/memory.ts :1 import { mkdirSync, readFileSync, readdirSync, writeFileSync, appendFileSync, unlinkSync, existsSync, statSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/output-styles.ts :1 import { readFileSync, readdirSync, statSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/paths.ts :1 import { realpathSync, lstatSync, readlinkSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/permission-rules.ts :1 import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, renameSync, statSync, type Stats, writeFileSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/plugin-manifest.ts :1 import { existsSync, readFileSync } from "node:fs";
fs yanlingLabs-winter-f49ed4d/packages/core/src/agent/plugins.ts :1 import { existsSync, readdirSync, readFileSync } from "node:fs";

244 more not shown — this panel samples each group; the count above is the real total.

shell / exec 78

shell yanlingLabs-winter-f49ed4d/infra/relay/bench.ts :26 import { execFileSync } from "node:child_process";
shell yanlingLabs-winter-f49ed4d/infra/relay/health-check.ts :17 import { execFileSync } from "node:child_process";
shell yanlingLabs-winter-f49ed4d/infra/relay/oci.ts :16 import { execFileSync } from "node:child_process";
shell yanlingLabs-winter-f49ed4d/infra/relay/provision.ts :25 import { execFileSync } from "node:child_process";
shell yanlingLabs-winter-f49ed4d/packages/cli/src/launchd.ts :56 const proc = Bun.spawn(["launchctl", ...args], { stdout: "pipe", stderr: "pipe" });
shell yanlingLabs-winter-f49ed4d/packages/cli/src/main.ts :305 launchApp: () => { Bun.spawnSync(["open", "-g", "-b", "com.winter.app"]); },
shell yanlingLabs-winter-f49ed4d/packages/cli/src/plugin-cli.ts :51 const proc = Bun.spawnSync(["git", "clone", "--depth", "1", opts.url, target]);
shell (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/daemon-sigterm.test.ts :33 const proc = Bun.spawn(["bun", "-e", fixture], {
shell (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/main.test.ts :137 const proc = Bun.spawn(["bun", "src/main.ts", ...args], {
shell (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/plugin-cli.test.ts :19 Bun.spawnSync(["git", "init", "-q"], { cwd: src, env });
shell (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/tui/app.test.tsx :1218 const proc = Bun.spawnSync(["bun", "src/main.ts", "--help"], {
shell (weak) yanlingLabs-winter-f49ed4d/packages/cli/test/tui/state.test.ts :87 test("a nameless spawn (no `name` arg) produces no mapping even with a background-shaped result", () => {

show 28 more

shell yanlingLabs-winter-f49ed4d/packages/core/src/agent/bg-agent-registry.ts :54 // 4h-ii-b Task 3 (D5) — additive: the rest of what resume needs, CAPTURED at spawn (not
shell yanlingLabs-winter-f49ed4d/packages/core/src/agent/bg-registry.ts :1 import { spawn, type ChildProcess } from "node:child_process";
shell yanlingLabs-winter-f49ed4d/packages/core/src/agent/lsp/client.ts :1 import { spawn, type ChildProcess } from "node:child_process";
shell yanlingLabs-winter-f49ed4d/packages/core/src/agent/lsp/manager.ts :13 // In particular `spawn()`'s catch: `start()` can fork a REAL child before ultimately failing
shell yanlingLabs-winter-f49ed4d/packages/core/src/agent/mcp/client.ts :1 import { spawn, type ChildProcess } from "node:child_process";
shell yanlingLabs-winter-f49ed4d/packages/core/src/agent/memory-dir.ts :64 const p = Bun.spawnSync(["git", "-C", key, "rev-parse", "--git-common-dir"]);
shell yanlingLabs-winter-f49ed4d/packages/core/src/agent/notify-fallback.ts :30 Bun.spawn(cmd, { stdout: "ignore", stderr: "ignore", stdin: "ignore" });
shell yanlingLabs-winter-f49ed4d/packages/core/src/agent/plugin-manifest.ts :87 * exec (any code execution — mcpServers, hooks, a Tier-2 entry point, or an explicit
shell yanlingLabs-winter-f49ed4d/packages/core/src/agent/sandbox.ts :2 import { spawnSync } from "node:child_process";
shell yanlingLabs-winter-f49ed4d/packages/core/src/agent/worktree.ts :19 const p = Bun.spawnSync(["git", "-C", cwd, ...args]);
shell yanlingLabs-winter-f49ed4d/packages/core/src/daemon.ts :1280 // Async spawn (4h-ii-a): tracks DETACHED (`run_in_background:true`) child threads — see
shell yanlingLabs-winter-f49ed4d/packages/core/src/migration/project-files.ts :7 import { execFileSync } from "node:child_process";
shell yanlingLabs-winter-f49ed4d/packages/core/src/plugins/hook-runner.ts :111 proc = Bun.spawn(["sh", "-c", spec.command], {
shell yanlingLabs-winter-f49ed4d/packages/core/src/plugins/supervisor.ts :19 * broker.ts's `expiredLeases`) and `spawn()` is injectable (tests never touch a real OS process).
shell yanlingLabs-winter-f49ed4d/packages/core/src/projector/index.ts :429 // The wire may carry no error flag for a failed spawn (the engine drops a returned
shell yanlingLabs-winter-f49ed4d/packages/core/src/providers/model-catalog-wire.ts :156 // profile, checked LIVE at every spawn (`console_profile_missing`), so
shell yanlingLabs-winter-f49ed4d/packages/core/src/runtime-sdk/official-options.ts :90 * is actually about to spawn (or fake-spawn) a session.
shell yanlingLabs-winter-f49ed4d/packages/core/src/runtime-sdk/runtimes-probe.ts :10 import { spawnSync } from "node:child_process";
shell yanlingLabs-winter-f49ed4d/packages/core/src/runtime-state/leases.ts :91 const result = Bun.spawnSync(["ps", "-o", "lstart=", "-p", String(pid)], { env: { ...process.env, TZ: "UTC" } });
shell yanlingLabs-winter-f49ed4d/packages/core/src/workflows/runtime.ts :1 import { spawn, type ChildProcess } from "node:child_process";
shell (weak) yanlingLabs-winter-f49ed4d/packages/core/src/workflows/sandbox.test.ts :5 import { spawnSync } from "node:child_process";
shell yanlingLabs-winter-f49ed4d/packages/core/src/workflows/sandbox.ts :35 (allow process-exec (literal "${sbplString(self)}"))
shell (weak) yanlingLabs-winter-f49ed4d/packages/core/src/workflows/subprocess-entry.test.ts :2 import { spawn } from "node:child_process";
shell (weak) yanlingLabs-winter-f49ed4d/packages/core/test/agent/lsp/client.test.ts :10 // process.env before spawning and restore it after — spawn() inherits the parent's env.
shell (weak) yanlingLabs-winter-f49ed4d/packages/core/test/agent/lsp/manager.test.ts :3 import { ChildProcess } from "node:child_process";
shell (weak) yanlingLabs-winter-f49ed4d/packages/core/test/agent/memory-dir.test.ts :20 const p = Bun.spawnSync(["git", "-C", cwd, ...args]);
shell (weak) yanlingLabs-winter-f49ed4d/packages/core/test/agent/plugins.test.ts :378 // OR-derivation, not AND — requiredConsentClasses still requires exec (see the
shell (weak) yanlingLabs-winter-f49ed4d/packages/core/test/agent/tools/lsp.test.ts :20 // Same pattern as client.test.ts's own withEnv: spawn() inherits the parent's env synchronously

38 more not shown — this panel samples each group; the count above is the real total.

network 15

net yanlingLabs-winter-f49ed4d/infra/relay/health-check.ts :72 const res = await fetch(`https://${host}/`, { signal: AbortSignal.timeout(10_000) });
net yanlingLabs-winter-f49ed4d/infra/relay/oci.ts :180 const res = await fetch(url, { method, headers, body: bodyText });
net yanlingLabs-winter-f49ed4d/infra/relay/provision.ts :564 const res = await fetch(`https://api.cloudflare.com/client/v4${path}`, {
net yanlingLabs-winter-f49ed4d/packages/core/src/agent/dangerous-domains.ts :1 import { isIP } from "node:net";
net yanlingLabs-winter-f49ed4d/packages/core/src/agent/tools/web.ts :850 * of every `text/html` fetch (`web_fetch`, and `fetchCleanPage` for ReadPage / FetchPage / the
net yanlingLabs-winter-f49ed4d/packages/core/src/providers/pkce.ts :35 const res = await fetch(tokenUrl, {
net (weak) yanlingLabs-winter-f49ed4d/packages/core/src/workflows/sandbox.test.ts :104 import { connect } from "node:net";
net (weak) yanlingLabs-winter-f49ed4d/packages/core/test/agent/tools/page-core.test.ts :70 // .txt/code fetch (the non-HTML path skips htmlToText, which is the only place \r was ever being
net (weak) yanlingLabs-winter-f49ed4d/packages/core/test/agent/tools/search.test.ts :285 describe("Search: the key never leaks, through Bun's REAL fetch (N5)", () => {
net (weak) yanlingLabs-winter-f49ed4d/packages/core/test/capabilities/research.test.ts :124 const searchFetch = ((_url: string, init?: RequestInit) => fetch(local, init)) as unknown as typeof fetch;
net (weak) yanlingLabs-winter-f49ed4d/packages/core/test/ipc/panel-methods.test.ts :398 "data:text/html,<script>fetch('//evil')</script>",
net (weak) yanlingLabs-winter-f49ed4d/packages/core/test/providers/pkce.test.ts :25 async fetch(req) {

show 3 more

net (weak) yanlingLabs-winter-f49ed4d/packages/core/test/runtime-sdk/hooks.test.ts :340 return (await fetch(preInput({ tool_name: "WebFetch", tool_input: { url }, tool_use_id: "t1" }), "t1", { signal: abortSignal() })) as Record<string, unknown>;
net (weak) yanlingLabs-winter-f49ed4d/scripts/fetch-ant.test.ts :97 fetch(req) {
net (weak) yanlingLabs-winter-f49ed4d/scripts/sparkle-feed-gate.ts :128 fetch(req) {

secrets 2

secrets yanlingLabs-winter-f49ed4d/packages/plugin-sdk/src/index.ts :492 token = opts?.token ?? process.env.WINTER_PLUGIN_TOKEN;
secrets (weak) yanlingLabs-winter-f49ed4d/packages/plugin-sdk/test/sdk.test.ts :370 const savedToken = process.env.WINTER_PLUGIN_TOKEN;

declared dependencies 3

@resvg/resvg-js@^2.6.2
@types/bun@^1.3.0
typescript@^5.6.0