registry / @mammothb/pi-memory / 1.0.0

@mammothb/pi-memory@1.0.0

VCC conversation compaction for Pi, backed by mm-cli

AI Security Review

scanned 8h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. First-party Pi extension performs import-time setup of its own settings file and processes session history when its commands/hooks run. No exfiltration or foreign agent-control mutation is established.

Static reason

No blocking static signals were detected.

Trigger

Pi loads the declared extension; compaction or recall is invoked.

Impact

Creates package-owned Pi settings and exposes session content to a locally configured mm executable.

Mechanism

Pi extension setup, session recall, and local mm-cli subprocess compaction.

Rationale

This is a first-party agent extension with import-time configuration and session-processing subprocess capability, so it warrants a lifecycle-risk warning under policy, not a malware block.

Evidence

package.jsonindex.tssrc/core/settings.tssrc/core/summarize.tssrc/core/load-messages.tssrc/hooks/before-compact.ts~/.pi/agent/pi-memory.json/tmp/mm-compact-debug.jsonsession file from ctx.sessionManagerMM_CLI_PATH or discovered mm executable

Decision evidence

public snapshot

AI called this at 90.0% confidence with false-positive risk.

@mammothb/pi-memory@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code