Loading npm security reports…
Supervised AI coding tasks for OpenCode.
LPM treats this as warn-only first-party agent extension lifecycle risk. Creating a user-approved Kagan task creates an isolated git worktree and registers Kagan in that worktree's OpenCode config. Configured setup/check commands can then execute in that worktree. No unconsented npm install-time mutation or data exfiltration was confirmed.
`dist/task/create.js` calls `ensureWorktreePluginConfig` when creating a task.
dist/task/create.jsView on unpkg`dist/git/runner.js` writes `.opencode/opencode.json` to add the Kagan plugin in each task worktree.
dist/git/runner.jsView on unpkg`dist/checks/runner.js` executes configured setup/check commands through `sh -c` in the task worktree.
dist/checks/runner.jsView on unpkg`dist/tui/updates/check.js` fetches the package's npm dist-tags endpoint; update installation runs only after a confirmation dialog.
dist/tui/updates/check.jsView on unpkg`dist/task/create.js` calls `ensureWorktreePluginConfig` when creating a task.
dist/task/create.jsView on unpkg`dist/git/runner.js` writes `.opencode/opencode.json` to add the Kagan plugin in each task worktree.
dist/git/runner.jsView on unpkg`dist/checks/runner.js` executes configured setup/check commands through `sh -c` in the task worktree.
dist/checks/runner.jsView on unpkg`dist/tui/updates/check.js` fetches the package's npm dist-tags endpoint; update installation runs only after a confirmation dialog.
dist/tui/updates/check.jsView on unpkg