registry / @oas-framework/oas / 0.11.1

@oas-framework/oas@0.11.1

OAS (Open Agent Specialization) — durable souls, disposable instances, targetable capability packages, and the runtime-neutral oas CLI/kernel.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 188 KB of source, external domains: api.linear.app, aweb.ai

Source & flagged code

2 flagged

capabilities/oas-okf/bin/oas-okf.mjsView file

Lines 140-180javascript

140 const metaFile = join(home, "instance.json");

141 const meta = existsSync(metaFile) ? JSON.parse(readFileSync(metaFile, "utf8")) : {};

142 const inst = instance || meta.instance;

143 const agName = process.env.OAS_AGENT || meta.agent || "agent";

144 const sDir = soulDir || join(home, "soul");

145 const context = process.env.OAS_CONTEXT || meta.repo;

146 let root = process.env.OAS_ROOT;

147 if (!root) { // walk up from home to the agents/ dir

148 let d = home;

149 while (d !== dirname(d)) { if (d.endsWith("/instances")) { root = join(d, "..", ".."); break; } d = dirname(d); }

150 root = root ? realpathSync(join(root)) : undefined;

151 // instances live at <root>/<agent>/instances/<inst> or <root>/local-agents/<agent>/instances/<inst>

152 if (root && ["local-agents", "tmp-agents"].includes(root.split("/").pop())) root = dirname(root);

153 }

154 const notesDir = join(home, "notes");

155 const skip = (why) => out({ meta: { harvestSpawn: "skipped", why } });

156 if (String(agName).startsWith("memory-harvest")) skip("self (loop guard)");

157 const notes = existsSync(notesDir) ? readdirSync(notesDir).filter((f) => f.endsWith(".md")) : [];

158 if (notes.length === 0) skip("no pending notes");

159 if (!root || !existsSync(root)) skip("no agents root found above this home");

160 if (!inst) skip("no instance identity (run from an instance home)");

161 const core = await import(pathToFileURL(join(FRAMEWORK_ROOT, "lib", "core.mjs")).href);

162 const slug = String(inst).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 30);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

capabilities/oas-okf/bin/oas-okf.mjsView on unpkg · L160

163 // Debounce: one harvester per source instance at a time.

164 const harvesterHome = (base) => join(root, base, "memory-harvest", "instances", `memory-harvest-${slug}`);

165 if (["local-agents", "tmp-agents"].some((b) => existsSync(harvesterHome(b)))) skip("harvester already running for this instance");

166 let agentDef = core.findAgent(root, "memory-harvest");

167 if (!agentDef) {

168 core.upsertTmpAgent(root, { name: "memory-harvest", instructions: readFileSync(join(FRAMEWORK_ROOT, "capabilities", "oas-okf", "agents", "memory-harvest.md"), "utf8") });

169 agentDef = core.findAgent(root, "memory-harvest");

170 }

171 // Harvest model: explicit okf settings win (hook env, or resolved from config

172 // when agent-initiated); else the integration's default.

173 let harvestModel = settings["harvest-model"];

174 if (!harvestModel && context) {

175 try { harvestModel = core.resolveOasConfig(context).layers?.knowledge?.settings?.["harvest-model"]; } catch { /* config unreadable: use default */ }

176 }

177 harvestModel = harvestModel || DEFAULT_HARVEST_MODEL;

178 const workDir = realpathSync(join(home, "work"));

179 // Repo-resident souls: write to the soul AS SEEN FROM THE WORK TREE, so the

180 // promotion commits onto the instance's own branch. Otherwise the canonical soul.

capabilities/oas-aweb/bin/oas-aweb.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @oas-framework/oas@0.7.0 matchedIdentity = npm:QG9hcy1mcmFtZXdvcmsvb2Fz:0.7.0 similarity = 0.727 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

capabilities/oas-aweb/bin/oas-aweb.mjsView on unpkg

Source & flagged code

2 flagged · loading source

capabilities/oas-okf/bin/oas-okf.mjsView file

160if (!inst) skip("no instance identity (run from an instance home)"); L161: const core = await import(pathToFileURL(join(FRAMEWORK_ROOT, "lib", "core.mjs")).href); L162: const slug = String(inst).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 30);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

capabilities/oas-okf/bin/oas-okf.mjsView on unpkg · L160

capabilities/oas-aweb/bin/oas-aweb.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

capabilities/oas-aweb/bin/oas-aweb.mjsView on unpkg

Findings

1 High3 Medium4 Low

HighPrevious Version Dangerous Deltacapabilities/oas-aweb/bin/oas-aweb.mjs

MediumDynamic Requirecapabilities/oas-okf/bin/oas-okf.mjs

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

capabilities/oas-okf/bin/oas-okf.mjsView file

Lines 140-180javascript

140 const metaFile = join(home, "instance.json");

141 const meta = existsSync(metaFile) ? JSON.parse(readFileSync(metaFile, "utf8")) : {};

142 const inst = instance || meta.instance;

143 const agName = process.env.OAS_AGENT || meta.agent || "agent";

144 const sDir = soulDir || join(home, "soul");

145 const context = process.env.OAS_CONTEXT || meta.repo;

146 let root = process.env.OAS_ROOT;

147 if (!root) { // walk up from home to the agents/ dir

148 let d = home;

149 while (d !== dirname(d)) { if (d.endsWith("/instances")) { root = join(d, "..", ".."); break; } d = dirname(d); }

150 root = root ? realpathSync(join(root)) : undefined;

151 // instances live at <root>/<agent>/instances/<inst> or <root>/local-agents/<agent>/instances/<inst>

152 if (root && ["local-agents", "tmp-agents"].includes(root.split("/").pop())) root = dirname(root);

153 }

154 const notesDir = join(home, "notes");

155 const skip = (why) => out({ meta: { harvestSpawn: "skipped", why } });

156 if (String(agName).startsWith("memory-harvest")) skip("self (loop guard)");

157 const notes = existsSync(notesDir) ? readdirSync(notesDir).filter((f) => f.endsWith(".md")) : [];

158 if (notes.length === 0) skip("no pending notes");

159 if (!root || !existsSync(root)) skip("no agents root found above this home");

160 if (!inst) skip("no instance identity (run from an instance home)");

161 const core = await import(pathToFileURL(join(FRAMEWORK_ROOT, "lib", "core.mjs")).href);

162 const slug = String(inst).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 30);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

capabilities/oas-okf/bin/oas-okf.mjsView on unpkg · L160

163 // Debounce: one harvester per source instance at a time.

164 const harvesterHome = (base) => join(root, base, "memory-harvest", "instances", `memory-harvest-${slug}`);

165 if (["local-agents", "tmp-agents"].some((b) => existsSync(harvesterHome(b)))) skip("harvester already running for this instance");

166 let agentDef = core.findAgent(root, "memory-harvest");

167 if (!agentDef) {

168 core.upsertTmpAgent(root, { name: "memory-harvest", instructions: readFileSync(join(FRAMEWORK_ROOT, "capabilities", "oas-okf", "agents", "memory-harvest.md"), "utf8") });

169 agentDef = core.findAgent(root, "memory-harvest");

170 }

171 // Harvest model: explicit okf settings win (hook env, or resolved from config

172 // when agent-initiated); else the integration's default.

173 let harvestModel = settings["harvest-model"];

174 if (!harvestModel && context) {

175 try { harvestModel = core.resolveOasConfig(context).layers?.knowledge?.settings?.["harvest-model"]; } catch { /* config unreadable: use default */ }

176 }

177 harvestModel = harvestModel || DEFAULT_HARVEST_MODEL;

178 const workDir = realpathSync(join(home, "work"));

179 // Repo-resident souls: write to the soul AS SEEN FROM THE WORK TREE, so the

180 // promotion commits onto the instance's own branch. Otherwise the canonical soul.

capabilities/oas-aweb/bin/oas-aweb.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

capabilities/oas-aweb/bin/oas-aweb.mjsView on unpkg