Wavespeed Cli

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  scripts/build-binary.mjs, line 55

  fs.rmSync(work, { recursive: true, force: true });

  src/commands/setup.ts, line 171

  if (state.existed === false) fs.rmSync(state.file, { force: true });

  src/commands/setup.ts, line 176

  fs.rmSync(bak, { force: true });

  Show more

  src/commands/setup.ts, line 190

  else fs.rmSync(agent.file, { force: true });

  src/commands/setup.ts, line 191

  fs.rmSync(bak, { force: true });

  src/commands/setup.ts, line 197

  if (after.trim() === '') fs.rmSync(state.file, { force: true }); else fs.writeFileSync(state.file, after);

  src/commands/setup.ts, line 203

  if (after.trim() === '') fs.rmSync(state.file, { force: true }); else fs.writeFileSync(state.file, after);

  src/commands/setup.ts, line 209

  if (!(state.previous as { existed: boolean }).existed) fs.rmSync(state.file, { force: true }); else fs.writeFileSync(state.file, after);

• Install and update

  Note

  README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell.

  INSTALL_DOCUMENTED_INSTALLER

  README.md, line 43

  curl -fsSL https://raw.githubusercontent.com/WaveSpeedAI/wavespeed-cli/main/install.sh | bash

  install.sh, line 4

  # curl -fsSL https://raw.githubusercontent.com/WaveSpeedAI/wavespeed-cli/main/install.sh | bash

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  install.sh, line 37

  curl -fsSL "$base/$asset" -o "$tmp/$asset" && curl -fsSL "$base/SHA256SUMS" -o "$tmp/SHA256SUMS" \

  src/commands/auth.ts, line 49

  res = await fetch(`${baseUrl}/api/v3/balance`, {

  src/commands/download.ts, line 12

  const res = await fetch(url);

  Show more

  src/commands/schema.ts, line 81

  .option('--refresh', 'Force a live fetch (bypass the 1h cache)')

  src/commands/setup.ts, line 74

  const res = await fetch(`${base}/chat/completions`, {

  src/commands/upgrade.ts, line 18

  const res = await fetch('https://api.github.com/repos/WaveSpeedAI/wavespeed-cli/releases/latest', {

  src/commands/upgrade.ts, line 29

  const res = await fetch(url, { signal: AbortSignal.timeout(300_000), redirect: 'follow' });

  src/commands/upgrade.ts, line 66

  const res = await fetch(REGISTRY_URL, {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/commands/auth.ts, line 162

  (process.env.WAVESPEED_API_KEY

  src/commands/setup.ts, line 41

  // Gemini CLI reads the base URL and key from ~/.gemini/.env (trusted folders only); the model and auth type live in settings.json.

  src/commands/setup.ts, line 42

  { id: 'gemini', name: 'Gemini CLI', file: path.join(home, '.gemini', '.env'), command: 'gemini', kind: 'gemini', keyInFile: true },

  Show more

  src/commands/setup.ts, line 363

  alk.yellow('\nGemini CLI reads ~/.gemini/.env only in folders it trusts: accept the t

  src/lib/config.ts, line 69

  return process.env.WAVESPEED_API_KEY || userConfig.get('apiKey');

  src/lib/setup-agents.ts, line 622

  // ---------- Gemini CLI (managed block in ~/.gemini/.env + two keys in settings.json) ----------

  .gitignore, line 4

  .DS_Store

  .gitignore, line 5

  .env

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 779f728b8d8d. can delete files. README documents an installer that pipes a download into a shell. The docs document an installer that pipes a download into a shell. can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host. reads a credential or environment file.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen