registry / @herjarsa/omo-meta-governor / 0.26.3

@herjarsa/omo-meta-governor@0.26.3

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 706 KB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

5 flagged

dist/lib.jsView file

Lines 1-39javascript

1import{createRequire as Mk}from"node:module";var{defineProperty:T4,getOwnPropertyNames:Hk,getOwnPropertyDescriptor:Ak}=Object,Lk=Object.prototype.hasOwnProperty;function Bk(r){return this[r]}var Ek=(r)=>{var v=(LN??=new WeakMap).get(r),b;if(v)return v;if(v=T4({},"__esModule",{value:!0}),r&&typeof r==="object"||typeof r==="function"){for(var U of Hk(r))if(!Lk.call(v,U))T4(v,U,{get:Bk.bind(r,U),enumerable:!(b=Ak(r,U))||b.enumerable})}return LN.set(r,v),v},LN,Sk=(r,v)=>()=>(v||r((v={exports:{}}).exports,v),v.exports);var Dk=(r)=>r;function xk(r,v){this[r]=Dk.bind(null,v)}var jr=(r,v)=>{for(var b ...

2`}catch{O=JSON.stringify({timestamp:_.timestamp,level:r,message:v,data:"[unserializable]"})+`

3`}try{mk(_r,O)}catch{}if(r==="error")console.error(`[meta-governor] ${v}`)}function L(r,v,b){FN(r,v,b)}function lk(r){FN(r.level,r.message,r.data,r.event,r.sessionID)}function ok(){try{if(wv(_r))return xN(_r).size}catch{}return 0}function tk(){let r=0;for(let v=1;v<=h4;v++)if(wv(`${_r}.${v}`))r=v;else break;return r}var Ck,hk,_r,fk=10485760,h4=5;var J$=kv(()=>{Ck=[/eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,/sk-(?:proj-|svc-|)[a-zA-Z0-9]{20,}/g,/pk-[a-zA-Z0-9]{20,}/g,/ghp_[a-zA-Z0-9]{36,}/g,/ghs_[a-zA-Z0-9]{36,}/g,/github_pat_[a-zA-Z0-9]{22,}/g,/Bearer\s+[a-zA-Z0-9_\-]{20,}/gi,/(?:key ...

5Please call the \`${v.mcpTool}\` MCP tool with EXACTLY these args:

7\`\`\`json

8`+z+`

9\`\`\`

11Do not paraphrase, modify, or add fields. Pass the args through verbatim.

12After the tool call, briefly confirm what you stored and for which tool.`};try{return{ok:!0,messageID:(await uO($.session.prompt({path:{id:r},body:{parts:[O]}}),U,`session.prompt for ${v.mcpTool}`))?.data?.info?.id??null,error:null,durationMs:Date.

14Please invoke the \`task\` tool with \`subagent_type=oracle\` to perform a verification pass on the current session state. Decision context: ${r.evidenceCount} evidence unit(s). After Oracle returns, you should continue with the recommended action.`;return`[MetaGovernor] Escalation to user required. Reason: ${r.reasoning}

17`)b++;continue}if($==="/"&&b+1<r.length&&r[b+1]==="*"){b+=2;while(b<r.length){if(r[b]==="*"&&b+1<r.length&&r[b+1]==="/"){b+=2;break}b++}continue}v.push($),b++}let U=v.join("");for(let $=0;$<10;$++){let z=U;if(U=U.replace(/,(\s*[\]}])/g,"$1"),U===z)break}return U}function _N(r){try{let v=NN(r);return JSON.parse(v)}catch{return}}function ON(){return o0(d0(),".config","opencode",Nk)}function kN(r){let v=r??process.cwd();return t0(v,".opencode",Nk)}async function p0(r){try{return await l0(r),!0}catch{return!1}}async function x4(r){if(!await p0(r))return;try{let v=await i0(r,"utf-8");return _N(v)}c ...

18`).trim()}catch{return null}}function OK(r){let v=Uv(["run","list","--limit","1","--commit",r,"--json","databaseId,status,conclusion,displayTitle,headSha,url"],1e4);if(!v)

20… (${b.length-v} chars truncated) …`}var _K;var wk=kv(()=>{_K={enabled:!0,workflow:"CI",pollIntervalMs:15000,maxWaitMs:600000,failOnly:!0}});import{randomUUID as u9,createHash as JK}from"node:crypto";import{fileURLToPath as KK}from"node:url";import{execSync as ur,spawn as mN}from"node:child_process";import{access as pK,stat as fN}from"node:fs/promises";import{resolve as jv}from"node:path";import{homedir as dk}from"node:os";import{spawn as Fk,spawnSync as Zr}from"node:child_process";function BN(r){try{let v=Zr("pgrep",["-P",String(r)],{encoding:"utf8"});for(let b of v.stdout.trim().split(/\s+/) ...

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/lib.jsView on unpkg · L1

21 const OMO_MG_WATCH = 1;

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L19

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L19

22 const {spawn} = require("child_process");

23 const run = () => {

24 try {

25 const c = spawn("npx", ["codegraph", "update"], {

26 cwd: ${JSON.stringify(r)},

27 stdio: "ignore",

28 windowsHide: true,

29 shell: false,

30 });

31 c.unref();

32 } catch(e) { /* best effort */ }

33 };

34 run();

35 setInterval(run, 30_000);

36 `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else U=mN("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:r,stdio:"ignore",detached:!

37`)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if($)return $[1]}catch{}for(let v of["python","python3"])try{let U=y(v,["-c","import urllib.request, json; d=json.load(urllib.request.urlopen('https://pypi.org/pypi/graphifyy/json')); print(d['info']['version'])"],{timeoutMs:1e4}).stdout.trim();if(U.length>0)return U}catch{}return null}async function hN(r){let v=[{bin:"npx",args:["--yes","codegraph","--version"]},{bin:"node",args:["node_modules/.bin/codegraph","--version"]}];for(let{bin:b,args:U}of v)try{let $;if(r){let N=r(`${b} ${U.join(" ")}`,{stdio:"ignore",timeout:1e4});$= ...

38CREATE TABLE IF NOT EXISTS _meta (

39 key TEXT PRIMARY KEY,

Long lines were clipped for display.

Lines 92-132javascript

92);

94CREATE INDEX IF NOT EXISTS idx_entries_kind ON entries(kind);

95CREATE INDEX IF NOT EXISTS idx_entries_session ON entries

Source & flagged code

5 flagged · loading source

dist/lib.jsView file

16Present a clear summary to the user with the deviation(s) detected and your recommended next steps. Wait for explicit user input before proceeding.`}var bv,ZO=0,E4=null;var D4=kv((... L17: `)b++;continue}if($==="/"&&b+1<r.length&&r[b+1]==="*"){b+=2;while(b<r.length){if(r[b]==="*"&&b+1<r.length&&r[b+1]==="/"){b+=2;break}b++}continue}v.push($),b++}let U=v.join("");for(... L18: `).trim()}catch{return null}}function OK(r){let v=Uv(["run","list","--limit","1","--commit",r,"--json","databaseId,status,conclusion,displayTitle,headSha,url"],1e4);if(!v)return nu...

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code