registry / @aiosbrain/aios / 2.0.0

@aiosbrain/aios@2.0.0

⚠ Under review

Agent-native operating system for an individual contributor: governed workspace scaffold, multi-agent harnesses with rubric-gated self-correction, AIOS Team Brain sync client, and a local GUI.

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 25 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 431 file(s), 3.21 MB of source, external domains: aiosbrain.dev, api.anthropic.com, api.deepseek.com, api.github.com, api.linear.app, api.telegram.org, brain.example, brain.example.com, cli.github.com, cursor.com, docs.claude.com, example.invalid, github.com, graph.microsoft.com, json-schema.org, linear.app, opencode.ai, openrouter.ai, railway.com, slack.com, www.apple.com, www.w3.org, your-brain.example.com

Source & flagged code

17 flagged

package.jsonView file

Lines 25-65json

25 "packages/mcp-core",

26 "packages/foundation/src",

27 "packages/foundation/package.json",

28 ".claude/rubrics/spec-readiness.md",

29 "docs/brain-api.md",

30 "docs/agentic-ergonomics/aios-issue-template.md",

31 "docs/agentic-ergonomics/aios-finding-template.md",

32 "docs/devtools-*.md",

33 "docs/ENGINEERING-CONSTITUTION.md",

34 "docs/GETTING-STARTED.md",

35 "docs/guard-verification.md",

36 "CHANGELOG.md",

37 "build.json"

38 ],

39 "workspaces": [

40 "packages/foundation"

41 ],

42 "scripts": {

43 "help": "node scripts/npm-menu.mjs",

44 "prepack": "node scripts/write-build-provenance.mjs",

45 "postinstall": "node scripts/ensure-loop-built.mjs && node scripts/postinstall-banner.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L45

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L45

46 "aios": "dotenvx run -- node scripts/aios.mjs",

47 "gen:catalog": "node scripts/gen-catalog.mjs",

48 "build:loop": "tsc -p tsconfig.json --noEmitOnError",

49 "check:context": "node scripts/check-context.mjs",

50 "check:docs": "node scripts/check-docs-drift.mjs",

51 "check:domains": "node scripts/check-domain-isolation.mjs",

52 "check:size": "node scripts/check-file-size.mjs",

53 "check:boundaries": "node scripts/check-boundaries.mjs",

54 "check:codebase-health": "node scripts/check-codebase-health.mjs",

55 "check:v1-linear": "node scripts/check-v1-linear-drift.mjs",

56 "check:workflow-policy": "node scripts/check-workflow-policy.mjs",

57 "check:inbox-audit": "node scripts/inbox-redaction-lint.mjs",

58 "integration:contracts:validate": "node scripts/integration-contracts.mjs",

59 "check:review-evidence-parity": "node scripts/check-review-evidence-parity.mjs",

60 "check:retired-routes": "node scripts/check-retired-routes.mjs",

61 "check:linear-skill-parity": "node scripts/check-linear-skill-parity.mjs",

62 "guard:selftest": "node scripts/guard-selftest.mjs",

63 "eval:transcripts": "node evals/transcript-extraction/extraction-eval.mjs",

64 "pr:backlog": "node scripts/pr-backlog-report.mjs",

65 "lint": "eslint scripts validation src test packages",

validation/check-secrets.shView file

Lines 91-131shell

91 # allowlisting a real credential that merely begins with those bytes.

92 sanitized=$(printf '%s\n' "$sanitized" | sed -E "s/(^|[^A-Za-z0-9_-])${placeholder}([^A-Za-z0-9_-]|$)/\\1\\2/g"

dist/operator-loop/connectors.jsView file

Lines 1-26javascript

1// AIO-366 — bounded, fail-open connector preamble for a recording owner daily run.

2//

3// This is loop-core (the composition point), not a workflow domain: it invokes the shipped

4// connector adapters concurrently, waits until each has exited or hit ITS OWN deadline, and returns

5// non-secret status values. Connector stdout/stderr is never inherited, so `loop daily --json`

6// remains a clean machine surface and a failing connector cannot leak response/credential text.

7import { spawn } from "node:child_process";

8import

scripts/mcp-credentials.mjsView file

Lines 1-38javascript

1// Shared default credential reader. Never print or return credentials in diagnostics.

2import { constants, lstatSync, openSync, fstatSync, readFileSync, closeSync } from "node:fs";

3import { execFileSync } from "node:child_process";

4import path from "node:path";

5import { homedir }

dist/operator-loop/asks/store.jsView file

Lines 1-38javascript

1// Asks store (AIO-167) — an append-only NDJSON escalation queue folded to state on read.

2//

3// Mirrors the C8 telemetry ledger pattern (local-only, admin-tier, gitignored under .aios/loop/,

4// never synced) with ONE addition: a writer-honored lockfile. Every writer (CLI, hook, transport)

5// acquires the lock before appending, and maintenance (compaction/GC) holds the SAME lock across

6// the fold → temp → rename rewrite. Because every append honors the lock, no line can be lost

7// during a rewrite — there is no optimistic-rename compare-and-swap to race.

8//

9// Two invariants shape the code:

scripts/loop-install.mjsView file

Lines 8-48javascript

8 * Environment heuristic (kept deliberately simple — see docs/loop-install.md):

9 * macOS → launchd LaunchAgent (StartCalendarInterval gives free catch-up-on-wake: a job

10 * missed while the laptop was asleep runs as

scripts/relay-core.mjsView file

Lines 77-117javascript

77];

79// Allowlist: letters, digits, hyphens, underscores, forward-slash, dots only.

80// Rejects any shell metacharacter before it reaches execFileSync.

81export const VALID_BRANCH_RE = /^[a-zA-Z0-9._/-]+$/;

83// c / die imported at the top of this file; re-exported so relay-core.mjs stays a

84// valid import surface for its existing consumers.

scripts/ci-workflow.mjsView file

2import { existsSync, readFileSync, writeFileSync } from "node:fs"; L3: import { execFileSync } from "node:child_process"; L4: import readline from "node:readline/promises"; ... L54: log(CI_WORKFLOW_EXPLANATION); L55: const rl = createInterface({ input: process.stdin, output: process.stdout }); L56: const answer = await rl.question("Are you actively building a codebase with AI? [y/N] "); ... L62: export function ghExecutable({ L63: platform = process.platform, L64: env = process.env, L65: exists = existsSync, ... L81: reason: L82: "GitHub CLI (`gh`) is not installed in a trusted location. Install it from https://cli.github.com/, then rerun this action.",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/ci-workflow.mjsView on unpkg · L2

scripts/export-commands.mjsView file

•Runtime or CLI code links a write operation to an explicit external AI-agent control path: n firstlinesummary(body) { const line = body .split("\n") .map((l) => l.trim()) .find((l) => l && !l.startswith("#") && !l.startswith("---")); return (line ?? "aios workflow command").slice(0, 160); } function wrapcommand(name, sourcebody) { const description = firstlinesummary(sourcebody); return `---\ndescription: ${description.replace(/"/g, '\\"')}\nstatus: active\n---\n\n${sourcebody.trim()}\n`; } function exportcommands({ commandsdir, outdir }) { if (!existssync(commandsdir)) { console.error(`error: commands dir not found: ${commandsdir}`); process.exit(1); } mkdirsync(outdir, { recursive: true }); const files = readdirsync(commandsdir).filter((f) => f.endsw

High

External Ai Agent Control Surface Mutation

Runtime or CLI source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/export-commands.mjsView on unpkg

scripts/gen-catalog.mjsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. k += `\n`; } if (others.length) { sk += `## skills\n\n| skill | what it does |\n|---|---|\n`; for (const s of others) sk += `| \`${s.name}\` | ${firstsentence(s.description)} |\n`; sk += `\n`; } sk += `## share a skill\n\npush a skill to the team brain so teammates can pull it:\n\n` + "```bash\naios push skill <name> # share skill.md + its reference files\naios pull skill <name> # fetch a shared skill into 1-inbox/from-brain/skills/\naios install-skill <name> # promote a pulled skill into .claude/skills/ (explicit, append-only)\n```\n\n" + `pulled skills are executable code — install is always a deliberate act; they never auto-activate

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

scripts/gen-catalog.mjsView on unpkg

hooks/aios-sync-nudge.shView file

•path = hooks/aios-sync-nudge.sh kind = build_helper sizeBytes = 1839 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/aios-sync-nudge.shView on unpkg

scaffold/.claude/skills/evolve/scripts/evolve_evidence.pyView file

•path = scaffold/.claude/skills/evolve/scripts/evolve_evidence.py kind = payload_in_excluded_dir sizeBytes = 12349 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

scaffold/.claude/skills/evolve/scripts/evolve_evidence.pyView on unpkg

hooks/claim-check-guard.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 29

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

hooks/claim-check-guard.mjs#virtual:normalized:round1View on unpkg

Source & flagged code

17 flagged · loading source

@aiosbrain/aios@2.0.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code