registry / @nopeek/agent-bridge / 0.4.1

@nopeek/agent-bridge@0.4.1

Run your own agents as E2EE NoPeek bots. Pairs with a one-time code, runs every bot you own, and pipes messages to any command or webhook.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 84.2 KB of source, external domains: 127.0.0.1, d32w3to73s0pu5.cloudfront.net, d3qweh72vesa98.cloudfront.net, www.apple.com

Source & flagged code

5 flagged

dist/bridge.jsView file

Lines 1-28javascript

1// Orchestrator. A bridge has two states:

2// unpaired — local control API up, waiting for the NoPeek app to POST /pair

3// paired — runs every bot the runtime owns (GET /runtime/bots), keeps the

4// fleet current via the control WebSocket (adopt_bot arrives live),

5// and still serves the local API for status + live brain changes.

6// Pairing, unpairing and brain config all happen at runtime (from the app) and

7// persist to <home>/settings.json — no restart, no terminal.

8import { hostname } from "node:os";

9import { spawn } from "node:child_process";

10import { saveSettings } from "./config.js";

High

Child Process

Package source references child process execution.

dist/bridge.jsView on unpkg · L8

11import { BotRunner } from "./bot.js";

12import { ControlSocket } from "./control.js";

13import { resolveBrain } from "./brain.js";

14import { provisionSoul } from "./backends.js";

15import { isBrainBackend } from "./config.js";

16export const VERSION = "0.4.1";

17export class PairError extends Error {

18 code;

19 constructor(code, message) {

20 super(message);

21 this.code = code;

22 }

23}

24export class BridgeApp {

25 cfg;

26 startedAt = Date.now();

27 bots = new Map(); // botUserId -> runner

28 control = null;

dist/brain.jsView file

Lines 1-40javascript

1// Generic brain contract: (text, ctx) -> reply string. Resolved PER BOT:

2// 1. BRAIN_MAP["<handle>"] -> {"cmd": "…"} or {"url": "…"}

3// 2. global BRAIN_CMD (shell, stdin -> stdout)

4// 3. global BRAIN_URL (webhook, JSON in -> JSON out)

5// 4. echo ("You said: …") — zero-config smoke test

6// This is how ANY agentic runtime plugs in (Hermes, OpenClaw, a curl to your

7// own service): the bridge never knows or cares what's on the other side.

8import { spawn } from "node:child_process";

dist/backends.jsView file

Lines 1-28javascript

1// Native brain backends — no external shell scripts required. Two batteries-

2// included agent runtimes the bridge can drive directly:

3//

4// claude — Claude Code headless (`claude -p`), one continuous session per

5// (bot, channel) via a deterministic session UUID, streaming

6// assistant text deltas (stream-json) to onChunk.

7// hermes — a per-bot Hermes profile (own soul + memories) under

8// $HERMES_HOME/profiles/bot-<handle>, one persistent chat session

9// per channel (--continue), streaming stdout lines to onChunk.

10//

dist/service.jsView file

Lines 1-24javascript

1// `nopeek-agent-bridge install` — the ONE terminal command. Installs the bridge

2// as an always-on background service (launchd on macOS, systemd --user on

3// Linux) that starts at login and waits, unpaired, for the NoPeek app to

4// connect it. Everything after this happens in the app.

5import { execFileSync, spawnSync } from "node:child_process";

6import { mkdirSync, realpathSync, writeFileSync, rmSync, existsSync } from "node:fs";

Source & flagged code

5 flagged · loading source

dist/bridge.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code