registry / @cocorograph/hub-agent / 0.7.72

@cocorograph/hub-agent@0.7.72

Hub Hosted Cockpit のローカル常駐 agent。Hub と outbound WSS で接続し、ローカルの tmux/pty を中継する。

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 44 file(s), 1.04 MB of source, external domains: api.hub.cocorograph.com, hub.cocorograph.com

Source & flagged code

6 flagged

package.jsonView file

Lines 2-42json

2 "name": "@cocorograph/hub-agent",

3 "version": "0.7.72",

4 "description": "Hub Hosted Cockpit のローカル常駐 agent。Hub と outbound WSS で接続し、ローカルの tmux/pty を中継する。",

5 "type": "module",

6 "license": "UNLICENSED",

7 "private": false,

8 "publishConfig": {

9 "access": "public",

10 "registry": "https://registry.npmjs.org/"

11 },

12 "bin": {

13 "hub-agent": "bin/hub-agent.mjs"

14 },

15 "main": "src/main.mjs",

16 "engines": {

17 "node": ">=20"

18 },

19 "scripts": {

20 "start": "node bin/hub-agent.mjs start",

21 "test": "node --test test/*.test.mjs",

22 "postinstall": "node scripts/fix-node-pty-perms.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

23 "check:publish-on-main": "node scripts/check-publish-on-main.mjs",

24 "prepublishOnly": "node scripts/check-publish-on-main.mjs && npm test"

25 },

26 "files": [

27 "bin/",

28 "src/",

29 "scripts/",

30 "templates/",

31 "plugins/",

32 "README.md",

33 "LICENSE"

34 ],

35 "dependencies": {

36 "@anthropic-ai/claude-agent-sdk": "^0.3.158",

37 "@lydell/node-pty": "1.2.0-beta.12",

38 "commander": "^12.1.0",

39 "pino": "^9.0.0",

40 "ws": "^8.18.0"

41 },

42 "repository": {

src/plugin-loader.mjsView file

Lines 1-40javascript

1/**

2 * `~/.hub/plugins/<prio>-<name>/plugin.mjs` を discovery し、hook chain を構築する。

3 *

4 * - ディレクトリ名の `<prio>` 数字昇順で並ぶ

5 * - 各 plugin の default export が `{ name, hooks }` を持つ

6 * - `runHookChain(name, ctx)` は最初に non-null を返した hook の戻り値を採用

7 *

8 * 仕様書: ナレッジ/インフラ/cockpit-hub-hosted-integration-spec (id=6080)

9 */

10import { promises as

src/tui-viewer-registry.mjsView file

Lines 6-46javascript

6 * PreToolUse 承認フック (bridge_permission.py) は、ツール実行前にこのマーカーの

7 * 鮮度を読み、「閲覧者がいる session だけ承認を Cockpit へブリッジ、いなければ

8 * 即 ask 縮退」する。これにより、承認フックを全ユーザーの settings.json に常設

9 * しても、非閲覧の対話セッション (リーダー / cockpit-orch サブ / ターミナルモード)

src/service-install.mjsView file

Lines 1-24javascript

1/**

2 * `hub-agent install-service` / `uninstall-service` の実装 (Sprint J)。

3 *

4 * - macOS: ~/Library/LaunchAgents/co.cocorograph.hub-agent.plist を install

5 * して launchctl bootstrap gui/<uid> で常駐化

6 * - Linux: ~/.config/systemd/user/hub-agent.service を install して

7 * systemctl --user enable --now hub-agent.service

8 *

9 * テンプレ内の __HUB_AGENT_BIN__ / __HOME__ / __PATH__ を実行時に置換する。

10 * 仕様書: ナレッジ/インフラ/cockpit-hub-hosted-integration-spec (id=6080)

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 40232 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

src/config.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @cocorograph/hub-agent@0.7.70 matchedIdentity = npm:QGNvY29yb2dyYXBoL2h1Yi1hZ2VudA:0.7.70 similarity = 0.886 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/config.mjsView on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code