glmn-ai/neurosquad-cli

Review signals: 1 connection review, 1 download and execute, 6 encoded blob, 1 outside write, 3 sensitive read. 5 static matches retained as context.

Reviewed as expected for a test run: npm built the package inside its global install folder; opened pseudo-terminals; read only test files inside the test workspace or its temporary folders; resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 2 distinct locations. 2 attributed processes.

Source contains download and execute; review its purpose. packaging/install/install.sh

Source contains encoded blob; review its purpose. packages/tui-theme/src/logos.generated.ts 6 findings.

Repository processes attempted these writes outside documented output/cache paths. /usr/bin/python3 1 attributed processes.

PID 8756: /usr/bin/node · npm lifecycle

A repository process attempted to read this sensitive path. 3 distinct locations. 3 findings. 16 attributed processes.

5 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Run any command as an agent: Real input produced the expected result: started coldpass-claim

  Source: nsq run [--name n] -- <command…> any command

  Input: node -e console.log('NEUROSQUAD_OPERATION_OK')

  Expected: starts an agent

  Command: npx --yes [email protected] run --name coldpass-claim -- node -e 'console.log('"'"'NEUROSQUAD_OPERATION_OK'"'"')'

  Observed: started coldpass-claim-2 (command) in /tmp nsq attach coldpass-claim-2 · nsq (dashboard)

Examples

• Run command agent and list status: command completed successfully

  Source: README.md / Quick start; Commands

  Input: node command printing marker

  Expected: agent appears then exits

  Command: bash -lc 'cd /tmp && npx --yes [email protected] run --name coldpass-example -- node -e '"'"'console.log("EXAMPLE_OK")'"'"' && npx --yes [email protected] ls --json && npx --yes [email protected] down'

  Observed: "-e", "console.log('NEUROSQUAD_OPERATION_OK')" ], "createdAt": 1792812663394, "running": false, "status": "exited", "statusAt": 1792812663489 }, { "id": "1172b088-5ac5-4b12-99cb-5b6737b394e3", "name": "coldpass-example-2", "harness": "command", "workspace": "/tmp", "cwd": "/tmp", "command": [ "node", "-e", "console.log(\"EXAMPLE_OK\")" ], "createdAt": 1792812666139, "running": false, "status": "exited", "statusAt": 1792812666225 } ] stopped the nsq daemon and its agents (they resume with `nsq up`)

Local or hosted: local

Run an arbitrary command under nsq and inspect agent status

pwd; rg --files -g 'README*' -g 'AGENTS.md' -g 'package.json' -g 'pyproject.toml' -g 'requirements*.txt' -g 'Makefile' -g 'uv.lock' -g 'package-lock.json' -g 'pnpm-lock.yaml' -g 'yarn.lock' -g '*.toml' -g '*.json' | head -100; vault-search 'neurosquad-cli README operation' 2>&1 | head -80; cat <host-path> 2>/dev/null | head -80
ls -la; find .. -name AGENTS.md -o -iname 'README*' | head -80
cat README.md; cat package.json; python3 --version; node --version; npm --version
id -u; ls -la .coldpass; curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -; sudo apt-get install -y nodejs
npm install -g neurosquad
npx --yes neurosquad ls --json
npm install && npm run build && npm run release:smoke
sudo apt-get install -y build-essential python3-dev && npm install && npm run build && npm run release:smoke
cd /tmp && npx --yes [email protected] ls --json
cd /tmp && npx --yes [email protected] run --name coldpass-agent -- node -e 'console.log("NEUROSQUAD_OPERATION_OK")' && npx --yes [email protected] ls --json && npx --yes [email protected] down
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["npx","--yes","[email protected]","run","--name","coldpass-agent","--","node","-e","console.log('NEUROSQUAD_OPERATION_OK')"],"cwd":"/tmp","expected_text":"started coldpass-agent"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Run any command as an agent","source":"`nsq run -- npm run dev                                    # any command, as an agent`","input":"node -e console.log('NEUROSQUAD_OPERATION_OK')","expected":"starts an agent","probe_kind":"cli","argv":["npx","--yes","[email protected]","run","--name","coldpass-claim","--","node","-e","console.log('NEUROSQUAD_OPERATION_OK')"],"expected_text":"started coldpass-claim","cwd":"/tmp"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Run command agent and list status","source":"README.md / Quick start; Commands","input":"node command printing marker","expected":"agent appears then exits","argv":["bash","-lc","cd /tmp && npx --yes [email protected] run --name coldpass-example -- node -e 'console.log(\"EXAMPLE_OK\")' && npx --yes [email protected] ls --json && npx --yes [email protected] down"],"cwd":"/tmp","expected_text":"coldpass-example"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"README entry points provide interactive dashboard and persistent daemon commands; no scheduled cycle or loop is documented."}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
python3 - <<'PY'
p='.coldpass/claims.json'
s=open(p).read().replace('`nsq run -- npm run dev                                    # any command, as an agent`','nsq run [--name n] -- <command…>      any command')
open(p,'w').write(s)
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run an arbitrary command under nsq and inspect agent status","operation_scope":"Node.js 22.23.4 with native build prerequisites; npm-installed dependencies and packaged CLI smoke test","steps":["Installed Node.js 22.23.4 using the NodeSource Node 22 setup script and apt.","Installed build-essential and python3-dev after npm install required make for node-pty's native build.","npm install","npm run build","npm run release:smoke","From /tmp: npx --yes [email protected] run --name coldpass-agent -- node -e 'console.log(\"NEUROSQUAD_OPERATION_OK\")'; npx --yes [email protected] ls --json; npx --yes [email protected] down"],"deviations":["The initial documented global npm install failed with EACCES; used the documented npx installation method.","Initial npm install failed because make was absent; installed documented native-build prerequisites and retried."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF