registry / @kontourai/flow-agents / 2.4.0

@kontourai/flow-agents@2.4.0

Flow Agents — a Kontour product that applies Flow and Veritas discipline as a portable process layer inside the agent tools you already use: Claude Code, Codex, Kiro, opencode, pi, and GitHub Actions — with framework adapters (AWS Strands preview) on the

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 170 file(s), 2.42 MB of source, external domains: github.com, hachure.org, in-toto.io, kontourai.dev, opencode.ai

Source & flagged code

7 flagged

evals/integration/test_hook_category_behaviors.shView file

Lines 135-175shell

135 pass "post-edit accumulator and stop formatter cooperate without blocking"

136 else

137 fail "stop formatter should fail open"

138 fi

139else

140 fail "post-edit accumulator should pass through"

141fi

142

143if node "$ROOT/scripts/hooks/quality-gate.js" >"$TMPDIR_EVAL/quality.out" 2>"$TMPDIR_EVAL/quality.err" <<JSON

144{"hook_event_name":"PostToolUse","tool_input":{"path":"$TMPDIR_EVAL/repo/example.ts"}}

145JSON

146then

147 pass "quality policy hook is non-blocking"

148else

149 fail "quality policy hook should be non-blocking"

150fi

151

152audit_dir="$TMPDIR_EVAL/audit"

153mkdir -p "$audit_dir/sessions"

154printf '{"session_id":"session-1"}\n' > "$audit_dir/sessions/one.session"

155if printf '%s\n' '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"echo AKIA1234567890ABCDEF && rm -rf /tmp/example"}}' \

Critical

Critical Secret

Package contains a critical-looking secret pattern.

evals/integration/test_hook_category_behaviors.shView on unpkg · L155

Critical

Secret Pattern

AWS access key ID in evals/integration/test_hook_category_behaviors.sh

evals/integration/test_hook_category_behaviors.shView on unpkg · L155

156 | TELEMETRY_GOVERNANCE=true TELEMETRY_DATA_DIR="$audit_dir" TELEMETRY_SESSION_DIR="$audit_dir/sessions" bash "$ROOT/scripts/hooks/governance-audit.sh" preToolUse dev >"$TMPDIR_EVAL/governance.out" 2>"$TMPDIR_EVAL/governance.err"; then

157 sleep 0.2

158 if [[ -s "$audit_dir/audit.jsonl" ]] \

159 && grep -q '"event_type":"governance.secret_detected"' "$audit_dir/audit.jsonl" \

160 && grep -q '"event_type":"governance.destructive_operation"' "$audit_dir/audit.jsonl"; then

161 pass "governance audit policy emits audit events through shared libraries"

162 else

163 fail "governance audit did not emit expected audit events"

164 fi

165else

166 fail "governance audit should fail open"

167fi

168

169if printf '%s\n' '{"hook_event_name":"Stop","last_assistant_message":"done"}' \

170 | TELEMETRY_NOTIFICATIONS=false bash "$ROOT/scripts/hooks/desktop-notify.sh" stop dev >"$TMPDIR_EVAL/notify.out" 2>"$TMPDIR_EVAL/notify.err"; then

171 grep -q '"last_assistant_message":"done"' "$TMPDIR_EVAL/notify.out" \

172 && pass "local notification helper passes hook input through when disabled" \

173 || fail "notification helper did not pass input through"

174else

175 fail "notification helper should fail open when disabled"

packaging/conformance/run-conformance.jsView file

Lines 2-42javascript

2/**

3 * run-conformance.js — Flow Agents policy engine conformance test runner.

4 *

5 * Usage:

6 * node packaging/conformance/run-conformance.js --self

7 * node packaging/conformance/run-conformance.js --adapter-cmd "node my-adapter.js"

8 * node packaging/conformance/run-conformance.js --adapter-cmd "..." --level L1

9 *

10 * Options:

11 * --self Run against the canonical engine (must reach L2).

12 * --adapter-cmd CMD Shell command to test. Receives JSON payload on stdin,

context/scripts/hooks/stop-format-typecheck.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * Stop Hook: Batch format + typecheck all JS/TS files edited this response

4 *

5 * Reads the accumulator from post-edit-accumulator.js, groups files by

6 * project root for formatter and by tsconfig dir for typecheck.

7 * Budget is distributed evenly across batches.

8 */

10'use strict';

12const {

evals/ci/run-baseline.shView file

•path = evals/ci/run-baseline.sh kind = build_helper sizeBytes = 14929 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

evals/ci/run-baseline.shView on unpkg

evals/fixtures/veritas-governance-adapter/fake-veritas-secret-fail.shView file

•path = evals/fixtures/veritas-governance-adapter/fake-veritas-secret-fail.sh kind = payload_in_excluded_dir sizeBytes = 279 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

evals/fixtures/veritas-governance-adapter/fake-veritas-secret-fail.shView on unpkg

scripts/check-content-boundary.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @kontourai/flow-agents@2.3.0 matchedIdentity = npm:QGtvbnRvdXJhaS9mbG93LWFnZW50cw:2.3.0 similarity = 0.567 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/check-content-boundary.cjsView on unpkg

Source & flagged code

7 flagged · loading source

evals/integration/test_hook_category_behaviors.shView file

155patternName = aws_access_key severity = critical line = 155 matchedText = if print...}' \

Critical

Critical Secret

Package contains a critical-looking secret pattern.

evals/integration/test_hook_category_behaviors.shView on unpkg · L155

155patternName = aws_access_key severity = critical line = 155 matchedText = if print...}' \

Critical

Secret Pattern

AWS access key ID in evals/integration/test_hook_category_behaviors.sh

evals/integration/test_hook_category_behaviors.shView on unpkg · L155

packaging/conformance/run-conformance.jsView file

22L23: const fs = require('fs'); L24: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packaging/conformance/run-conformance.jsView on unpkg · L22

context/scripts/hooks/stop-format-typecheck.jsView file

11L12: const { execFileSync, spawnSync } = require('child_process'); L13: const fs = require('fs'); ... L26: const os = require('os'); L27: const id = crypto.createHash('sha1').update(process.cwd()).digest('hex').slice(0, 12); L28: return path.join(os.tmpdir(), `flow-agents-edited-${id}.txt`); ... L65: const opts = { cwd: tsConfigDir, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], timeout: timeoutMs }; L66: let stdout = '', stderr = '', failed = false; L67: try { ... L81: if (relevant.length > 0) { L82: process.stderr.write(`[Hook] TypeScript errors in ${path.basename(filePath)}:\n`); L83: relevant.forEach(l => process.stderr.write(l + '\n'));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

context/scripts/hooks/stop-format-typecheck.jsView on unpkg · L11

evals/ci/run-baseline.shView file

•path = evals/ci/run-baseline.sh kind = build_helper sizeBytes = 14929 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

evals/ci/run-baseline.shView on unpkg

evals/fixtures/veritas-governance-adapter/fake-veritas-secret-fail.shView file

•path = evals/fixtures/veritas-governance-adapter/fake-veritas-secret-fail.sh kind = payload_in_excluded_dir sizeBytes = 279 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

evals/fixtures/veritas-governance-adapter/fake-veritas-secret-fail.shView on unpkg

scripts/check-content-boundary.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/check-content-boundary.cjsView on unpkg

Findings

2 Critical2 High5 Medium5 Low

CriticalCritical Secretevals/integration/test_hook_category_behaviors.sh

CriticalSecret Patternevals/integration/test_hook_category_behaviors.sh

HighPayload In Excluded Direvals/fixtures/veritas-governance-adapter/fake-veritas-secret-fail.sh

HighPrevious Version Dangerous Deltascripts/check-content-boundary.cjs

MediumDynamic Requirepackaging/conformance/run-conformance.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperevals/ci/run-baseline.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptocontext/scripts/hooks/stop-format-typecheck.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

93%Warn

Verdict confidence

Firewall policyMatched warn-list

Package metadata

npm

Maintainersbriananderson1222

Version3.3.0

PublishedJul 3, 2026

LicenseApache-2.0

Dependencies3

Integrityverified

Package size1.65 MB

Files729

Keywordsagentsai-agentsworkflowskillshooksclaude-codecodexkiro

LinksRepository Homepage Issues

Runtime surface

package.json

Entrypointsmain → build/src/index.jstypes → build/src/index.d.tsexports mapbin → flow-agents, flow-agents-build-bundles, flow-agents-console-learning-projection +9

Runtimenode >=22

Artifact6.58 MB · 729 files1 signature(s) · provenance

Install lifecycleNo install hooks · other: build, build:bundles, check:content-boundary, check:decisions +8

Behavioral surface

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellHighEntropyStringsUrlStringsManifest: clean

Source & flagged code

7 flagged

evals/integration/test_hook_category_behaviors.shView file

Lines 135-175shell

135 pass "post-edit accumulator and stop formatter cooperate without blocking"

136 else

137 fail "stop formatter should fail open"

138 fi

139else

140 fail "post-edit accumulator should pass through"

141fi

142

143if node "$ROOT/scripts/hooks/quality-gate.js" >"$TMPDIR_EVAL/quality.out" 2>"$TMPDIR_EVAL/quality.err" <<JSON

144{"hook_event_name":"PostToolUse","tool_input":{"path":"$TMPDIR_EVAL/repo/example.ts"}}

145JSON

146then

147 pass "quality policy hook is non-blocking"

148else

149 fail "quality policy hook should be non-blocking"

150fi

151

152audit_dir="$TMPDIR_EVAL/audit"

153mkdir -p "$audit_dir/sessions"

154printf '{"session_id":"session-1"}\n' > "$audit_dir/sessions/one.session"

155if printf '%s\n' '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"echo AKIA1234567890ABCDEF && rm -rf /tmp/example"}}' \

Critical

Critical Secret

Package contains a critical-looking secret pattern.

evals/integration/test_hook_category_behaviors.shView on unpkg · L155

Critical

Secret Pattern

AWS access key ID in evals/integration/test_hook_category_behaviors.sh

evals/integration/test_hook_category_behaviors.shView on unpkg · L155

157 sleep 0.2

158 if [[ -s "$audit_dir/audit.jsonl" ]] \

159 && grep -q '"event_type":"governance.secret_detected"' "$audit_dir/audit.jsonl" \

160 && grep -q '"event_type":"governance.destructive_operation"' "$audit_dir/audit.jsonl"; then

161 pass "governance audit policy emits audit events through shared libraries"

162 else

163 fail "governance audit did not emit expected audit events"

164 fi

165else

166 fail "governance audit should fail open"

167fi

168

169if printf '%s\n' '{"hook_event_name":"Stop","last_assistant_message":"done"}' \

170 | TELEMETRY_NOTIFICATIONS=false bash "$ROOT/scripts/hooks/desktop-notify.sh" stop dev >"$TMPDIR_EVAL/notify.out" 2>"$TMPDIR_EVAL/notify.err"; then

171 grep -q '"last_assistant_message":"done"' "$TMPDIR_EVAL/notify.out" \

172 && pass "local notification helper passes hook input through when disabled" \

173 || fail "notification helper did not pass input through"

174else

175 fail "notification helper should fail open when disabled"

packaging/conformance/run-conformance.jsView file

Lines 2-42javascript

2/**

3 * run-conformance.js — Flow Agents policy engine conformance test runner.

4 *

5 * Usage:

6 * node packaging/conformance/run-conformance.js --self

7 * node packaging/conformance/run-conformance.js --adapter-cmd "node my-adapter.js"

8 * node packaging/conformance/run-conformance.js --adapter-cmd "..." --level L1

9 *

10 * Options:

11 * --self Run against the canonical engine (must reach L2).

12 * --adapter-cmd CMD Shell command to test. Receives JSON payload on stdin,

context/scripts/hooks/stop-format-typecheck.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * Stop Hook: Batch format + typecheck all JS/TS files edited this response

4 *

5 * Reads the accumulator from post-edit-accumulator.js, groups files by

6 * project root for formatter and by tsconfig dir for typecheck.

7 * Budget is distributed evenly across batches.

8 */

10'use strict';

12const {

evals/ci/run-baseline.shView file

•path = evals/ci/run-baseline.sh kind = build_helper sizeBytes = 14929 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

evals/ci/run-baseline.shView on unpkg

evals/fixtures/veritas-governance-adapter/fake-veritas-secret-fail.shView file

•path = evals/fixtures/veritas-governance-adapter/fake-veritas-secret-fail.sh kind = payload_in_excluded_dir sizeBytes = 279 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

evals/fixtures/veritas-governance-adapter/fake-veritas-secret-fail.shView on unpkg

scripts/check-content-boundary.cjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/check-content-boundary.cjsView on unpkg