registry / @herjarsa/omo-meta-governor / 0.26.4

@herjarsa/omo-meta-governor@0.26.4

Self-judging agent orchestration layer for OpenCode. Reads memory, scores sessions, dispatches decisions.

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 706 KB of source, external domains: github.com, json-schema.org, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

5 flagged

dist/lib.jsView file

Lines 1-39javascript

1import{createRequire as Mk}from"node:module";var{defineProperty:T4,getOwnPropertyNames:Hk,getOwnPropertyDescriptor:Ak}=Object,Lk=Object.prototype.hasOwnProperty;function Bk(r){return this[r]}var Ek=(r)=>{var v=(AN??=new WeakMap).get(r),b;if(v)return v;if(v=T4({},"__esModule",{value:!0}),r&&typeof r==="object"||typeof r==="function"){for(var U of Hk(r))if(!Lk.call(v,U))T4(v,U,{get:Bk.bind(r,U),enumerable:!(b=Ak(r,U))||b.enumerable})}return AN.set(r,v),v},AN,Sk=(r,v)=>()=>(v||r((v={exports:{}}).exports,v),v.exports);var Dk=(r)=>r;function xk(r,v){this[r]=Dk.bind(null,v)}var jr=(r,v)=>{for(var b ...

2`}catch{O=JSON.stringify({timestamp:_.timestamp,level:r,message:v,data:"[unserializable]"})+`

3`}try{mk(_r,O)}catch{}if(r==="error")console.error(`[meta-governor] ${v}`)}function L(r,v,b){MN(r,v,b)}function lk(r){MN(r.level,r.message,r.data,r.event,r.sessionID)}function ok(){try{if(wv(_r))return DN(_r).size}catch{}return 0}function tk(){let r=0;for(let v=1;v<=h4;v++)if(wv(`${_r}.${v}`))r=v;else break;return r}var nk,hk,_r,fk=10485760,h4=5;var J$=kv(()=>{nk=[/eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+/g,/sk-(?:proj-|svc-|)[a-zA-Z0-9]{20,}/g,/pk-[a-zA-Z0-9]{20,}/g,/ghp_[a-zA-Z0-9]{36,}/g,/ghs_[a-zA-Z0-9]{36,}/g,/github_pat_[a-zA-Z0-9]{22,}/g,/Bearer\s+[a-zA-Z0-9_\-]{20,}/gi,/(?:key ...

5Please call the \`${v.mcpTool}\` MCP tool with EXACTLY these args:

7\`\`\`json

8`+z+`

9\`\`\`

11Do not paraphrase, modify, or add fields. Pass the args through verbatim.

12After the tool call, briefly confirm what you stored and for which tool.`};try{return{ok:!0,messageID:(await ZO($.session.prompt({path:{id:r},body:{parts:[O]}}),U,`session.prompt for ${v.mcpTool}`))?.data?.info?.id??null,error:null,durationMs:Date.

14Please invoke the \`task\` tool with \`subagent_type=oracle\` to perform a verification pass on the current session state. Decision context: ${r.evidenceCount} evidence unit(s). After Oracle returns, you should continue with the recommended action.`;return`[MetaGovernor] Escalation to user required. Reason: ${r.reasoning}

17`)b++;continue}if($==="/"&&b+1<r.length&&r[b+1]==="*"){b+=2;while(b<r.length){if(r[b]==="*"&&b+1<r.length&&r[b+1]==="/"){b+=2;break}b++}continue}v.push($),b++}let U=v.join("");for(let $=0;$<10;$++){let z=U;if(U=U.replace(/,(\s*[\]}])/g,"$1"),U===z)break}return U}function NN(r){try{let v=zN(r);return JSON.parse(v)}catch{return}}function _N(){return e0(s0(),".config","opencode",Nk)}function ON(r){let v=r??process.cwd();return a0(v,".opencode",Nk)}async function rK(r){try{return await p0(r),!0}catch{return!1}}async function x4(r){if(!await rK(r))return;try{let v=await d0(r,"utf-8");return NN(v)}c ...

18`).trim()}catch{return null}}function JK(r){let v=Uv(["run","list","--limit","1","--commit",r,"--json","databaseId,status,conclusion,displayTitle,headSha,url"],1e4);if(!v)

20… (${b.length-v} chars truncated) …`}var wK;var wk=kv(()=>{wK={enabled:!0,workflow:"CI",pollIntervalMs:15000,maxWaitMs:600000,failOnly:!0}});import{randomUUID as fP,createHash as PK}from"node:crypto";import{fileURLToPath as WK}from"node:url";import{execSync as ur,spawn as FN}from"node:child_process";import{access as rj,stat as hN}from"node:fs/promises";import{resolve as jv}from"node:path";import{homedir as dk}from"node:os";import{spawn as Fk,spawnSync as Zr}from"node:child_process";function LN(r){try{let v=Zr("pgrep",["-P",String(r)],{encoding:"utf8"});for(let b of v.stdout.trim().split(/\s+/) ...

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/lib.jsView on unpkg · L1

21 const OMO_MG_WATCH = 1;

High

Shell

Package source references shell execution.

dist/lib.jsView on unpkg · L19

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib.jsView on unpkg · L19

22 const {spawn} = require("child_process");

23 const run = () => {

24 try {

25 const c = spawn("npx", ["codegraph", "update"], {

26 cwd: ${JSON.stringify(r)},

27 stdio: "ignore",

28 windowsHide: true,

29 shell: false,

30 });

31 c.unref();

32 } catch(e) { /* best effort */ }

33 };

34 run();

35 setInterval(run, 30_000);

36 `],{stdio:"ignore",detached:!0,shell:!1,env:{...process.env,OMO_MG_SPAWN:"1"}});else U=FN("python3",["-m","graphify",".","--no-viz","--watch"],{cwd:r,stdio:"ignore",detached:!

37`)[0]??"").match(/graphifyy\s*\(?([0-9]+\.[0-9]+\.[0-9]+[^\s)]*)/);if($)return $[1]}catch{}for(let v of["python","python3"])try{let U=y(v,["-c","import urllib.request, json; d=json.load(urllib.request.urlopen('https://pypi.org/pypi/graphifyy/json')); print(d['info']['version'])"],{timeoutMs:1e4}).stdout.trim();if(U.length>0)return U}catch{}return null}async function nN(r){let v=[{bin:"npx",args:["--yes","codegraph","--version"]},{bin:"node",args:["node_modules/.bin/codegraph","--version"]}];for(let{bin:b,args:U}of v)try{let $;if(r){let N=r(`${b} ${U.join(" ")}`,{stdio:"ignore",timeout:1e4});$= ...

38CREATE TABLE IF NOT EXISTS _meta (

39 key TEXT PRIMARY KEY,

Long lines were clipped for display.

Lines 92-132javascript

92);

94CREATE INDEX IF NOT EXISTS idx_entries_kind ON entries(kind);

95CREATE INDEX IF NOT EXISTS idx_entries_session ON entries

Source & flagged code

5 flagged · loading source

dist/lib.jsView file

16Present a clear summary to the user with the deviation(s) detected and your recommended next steps. Wait for explicit user input before proceeding.`}var bv,mO=0,E4=null;var D4=kv((... L17: `)b++;continue}if($==="/"&&b+1<r.length&&r[b+1]==="*"){b+=2;while(b<r.length){if(r[b]==="*"&&b+1<r.length&&r[b+1]==="/"){b+=2;break}b++}continue}v.push($),b++}let U=v.join("");for(... L18: `).trim()}catch{return null}}function JK(r){let v=Uv(["run","list","--limit","1","--commit",r,"--json","databaseId,status,conclusion,displayTitle,headSha,url"],1e4);if(!v)return nu...

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code