registry / @nopeek/agent-bridge / 0.6.3

@nopeek/agent-bridge@0.6.3

Run your own agents as E2EE NoPeek bots. Pairs with one-time codes (multiple accounts per computer), runs every bot each account owns, and pipes messages to any command or webhook.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 12 file(s), 119 KB of source, external domains: 127.0.0.1, d32w3to73s0pu5.cloudfront.net, d3qweh72vesa98.cloudfront.net, www.apple.com

Source & flagged code

5 flagged

dist/bridge.jsView file

Lines 1-31javascript

1// Orchestrator. A bridge has two states:

2// unpaired — local control API up, waiting for the NoPeek app to POST /pair

3// paired — one PairingRuntime PER PAIRED ACCOUNT, each with its own control

4// WebSocket and bot fleet (GET /runtime/bots + live adopt_bot),

5// all running simultaneously; the local API serves status + live

6// brain changes across all of them.

7// Pairing, unpairing and brain config all happen at runtime (from the app) and

8// persist to <home>/settings.json — no restart, no terminal. Brains

9// (brainMap/serverBackends) are GLOBAL per machine: handles are globally

10// unique, so a handle→brain map needs no per-account scoping.

11import { hostname } from "node:os";

12import { spawn } from "node:child_process";

13import { saveSettings } from "./config.js";

High

Child Process

Package source references child process execution.

dist/bridge.jsView on unpkg · L11

14import { BotRunner } from "./bot.js";

15import { ControlSocket } from "./control.js";

16import { resolveBrain } from "./brain.js";

17import { provisionSoul, provisionHermesProfile } from "./backends.js";

18import { reportCapabilities } from "./capabilities.js";

19import { isBrainBackend } from "./config.js";

20export const VERSION = "0.6.3";

21/** How often to re-probe + report brain availability to the server. */

22const CAPABILITIES_INTERVAL_MS = 5 * 60_000;

23export class PairError extends Error {

24 code;

25 constructor(code, message) {

26 super(message);

27 this.code = code;

28 }

29}

30/**

31 * Everything ONE pairing runs: its control WebSocket, its bot fleet, and its

dist/brain.jsView file

Lines 1-40javascript

1// Generic brain contract: (text, ctx) -> reply string. Resolved PER BOT:

2// 1. BRAIN_MAP["<handle>"] -> {"cmd": "…"} or {"url": "…"}

3// 2. global BRAIN_CMD (shell, stdin -> stdout)

4// 3. global BRAIN_URL (webhook, JSON in -> JSON out)

5// 4. echo ("You said: …") — zero-config smoke test

6// This is how ANY agentic runtime plugs in (Hermes, OpenClaw, a curl to your

7// own service): the bridge never knows or cares what's on the other side.

8import { spawn } from "node:child_process";

dist/backends.jsView file

Lines 1-28javascript

1// Native brain backends — no external shell scripts required. Two batteries-

2// included agent runtimes the bridge can drive directly:

3//

4// claude — Claude Code headless (`claude -p`), one continuous session per

5// (bot, channel) via a deterministic session UUID, streaming

6// assistant text deltas (stream-json) to onChunk.

7// hermes — a per-bot Hermes profile (own soul + memories) under

8// $HERMES_HOME/profiles/bot-<handle>, one persistent chat session

9// per channel (--continue), streaming stdout lines to onChunk.

10//

dist/service.jsView file

Lines 1-24javascript

1// `nopeek-agent-bridge install` — the ONE terminal command. Installs the bridge

2// as an always-on background service (launchd on macOS, systemd --user on

3// Linux) that starts at login and waits, unpaired, for the NoPeek app to

4// connect it. Everything after this happens in the app.

5import { execFileSync, spawnSync } from "node:child_process";

6import { mkdirSync, realpathSync, writeFileSync, rmSync, existsSync } from "node:fs";

Source & flagged code

5 flagged · loading source

dist/bridge.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code