registry / @oas-framework/oas / 0.6.0

@oas-framework/oas@0.6.0

OAS (Open Agent Specialization) — durable souls, disposable instances, harvest-back: the oas CLI and kernel. Runtime adapters: @oas-framework/pi (pi), Claude plugin (planned)

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 5 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 93.9 KB of source

Source & flagged code

2 flagged

integrations/oas-okf/bin/oas-okf.mjsView file

Lines 142-182javascript

142 const metaFile = join(home, "instance.json");

143 const meta = existsSync(metaFile) ? JSON.parse(readFileSync(metaFile, "utf8")) : {};

144 const inst = instance || meta.instance;

145 const agName = process.env.OAS_AGENT || meta.agent || "agent";

146 const sDir = soulDir || join(home, "soul");

147 const context = process.env.OAS_CONTEXT || meta.repo;

148 let root = process.env.OAS_ROOT;

149 if (!root) { // walk up from home to the agents/ dir

150 let d = home;

151 while (d !== dirname(d)) { if (d.endsWith("/instances")) { root = join(d, "..", ".."); break; } d = dirname(d); }

152 root = root ? realpathSync(join(root)) : undefined;

153 // instances live at <root>/<agent>/instances/<inst> or <root>/local-agents/<agent>/instances/<inst>

154 if (root && ["local-agents", "tmp-agents"].includes(root.split("/").pop())) root = dirname(root);

155 }

156 const notesDir = join(home, "notes");

157 const skip = (why) => out({ meta: { harvestSpawn: "skipped", why } });

158 if (String(agName).startsWith("memory-harvest")) skip("self (loop guard)");

159 const notes = existsSync(notesDir) ? readdirSync(notesDir).filter((f) => f.endsWith(".md")) : [];

160 if (notes.length === 0) skip("no pending notes");

161 if (!root || !existsSync(root)) skip("no agents root found above this home");

162 if (!inst) skip("no instance identity (run from an instance home)");

163 const core = await import(pathToFileURL(join(FRAMEWORK_ROOT, "lib", "core.mjs")).href);

164 const slug = String(inst).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 30);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

integrations/oas-okf/bin/oas-okf.mjsView on unpkg · L162

165 // Debounce: one harvester per source instance at a time.

166 const harvesterHome = (base) => join(root, base, "memory-harvest", "instances", `memory-harvest-${slug}`);

167 if (["local-agents", "tmp-agents"].some((b) => existsSync(harvesterHome(b)))) skip("harvester already running for this instance");

168 let agentDef = core.findAgent(root, "memory-harvest");

169 if (!agentDef) {

170 core.upsertTmpAgent(root, { name: "memory-harvest", instructions: readFileSync(join(FRAMEWORK_ROOT, "integrations", "oas-okf", "agents", "memory-harvest.md"), "utf8") });

171 agentDef = core.findAgent(root, "memory-harvest");

172 }

173 // Harvest model: explicit okf settings win (hook env, or resolved from config

174 // when agent-initiated); else the integration's default.

175 let harvestModel = settings["harvest-model"];

176 if (!harvestModel && context) {

177 try { harvestModel = core.resolveOasConfig(context).layers?.knowledge?.settings?.["harvest-model"]; } catch { /* config unreadable: use default */ }

178 }

179 harvestModel = harvestModel || DEFAULT_HARVEST_MODEL;

180 const workDir = realpathSync(join(home, "work"));

181 // Repo-resident souls: write to the soul AS SEEN FROM THE WORK TREE, so the

182 // promotion commits onto the instance's own branch. Otherwise the canonical soul.

bin/oas.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @oas-framework/oas@0.5.0 matchedIdentity = npm:QG9hcy1mcmFtZXdvcmsvb2Fz:0.5.0 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/oas.mjsView on unpkg

Source & flagged code

2 flagged · loading source

integrations/oas-okf/bin/oas-okf.mjsView file

162if (!inst) skip("no instance identity (run from an instance home)"); L163: const core = await import(pathToFileURL(join(FRAMEWORK_ROOT, "lib", "core.mjs")).href); L164: const slug = String(inst).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 30);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

integrations/oas-okf/bin/oas-okf.mjsView on unpkg · L162

bin/oas.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/oas.mjsView on unpkg

Findings

1 High2 Medium2 Low

HighPrevious Version Dangerous Deltabin/oas.mjs

MediumDynamic Requireintegrations/oas-okf/bin/oas-okf.mjs

MediumEnvironment Vars

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

integrations/oas-okf/bin/oas-okf.mjsView file

Lines 142-182javascript

142 const metaFile = join(home, "instance.json");

143 const meta = existsSync(metaFile) ? JSON.parse(readFileSync(metaFile, "utf8")) : {};

144 const inst = instance || meta.instance;

145 const agName = process.env.OAS_AGENT || meta.agent || "agent";

146 const sDir = soulDir || join(home, "soul");

147 const context = process.env.OAS_CONTEXT || meta.repo;

148 let root = process.env.OAS_ROOT;

149 if (!root) { // walk up from home to the agents/ dir

150 let d = home;

151 while (d !== dirname(d)) { if (d.endsWith("/instances")) { root = join(d, "..", ".."); break; } d = dirname(d); }

152 root = root ? realpathSync(join(root)) : undefined;

153 // instances live at <root>/<agent>/instances/<inst> or <root>/local-agents/<agent>/instances/<inst>

154 if (root && ["local-agents", "tmp-agents"].includes(root.split("/").pop())) root = dirname(root);

155 }

156 const notesDir = join(home, "notes");

157 const skip = (why) => out({ meta: { harvestSpawn: "skipped", why } });

158 if (String(agName).startsWith("memory-harvest")) skip("self (loop guard)");

159 const notes = existsSync(notesDir) ? readdirSync(notesDir).filter((f) => f.endsWith(".md")) : [];

160 if (notes.length === 0) skip("no pending notes");

161 if (!root || !existsSync(root)) skip("no agents root found above this home");

162 if (!inst) skip("no instance identity (run from an instance home)");

163 const core = await import(pathToFileURL(join(FRAMEWORK_ROOT, "lib", "core.mjs")).href);

164 const slug = String(inst).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 30);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

integrations/oas-okf/bin/oas-okf.mjsView on unpkg · L162

165 // Debounce: one harvester per source instance at a time.

166 const harvesterHome = (base) => join(root, base, "memory-harvest", "instances", `memory-harvest-${slug}`);

167 if (["local-agents", "tmp-agents"].some((b) => existsSync(harvesterHome(b)))) skip("harvester already running for this instance");

168 let agentDef = core.findAgent(root, "memory-harvest");

169 if (!agentDef) {

170 core.upsertTmpAgent(root, { name: "memory-harvest", instructions: readFileSync(join(FRAMEWORK_ROOT, "integrations", "oas-okf", "agents", "memory-harvest.md"), "utf8") });

171 agentDef = core.findAgent(root, "memory-harvest");

172 }

173 // Harvest model: explicit okf settings win (hook env, or resolved from config

174 // when agent-initiated); else the integration's default.

175 let harvestModel = settings["harvest-model"];

176 if (!harvestModel && context) {

177 try { harvestModel = core.resolveOasConfig(context).layers?.knowledge?.settings?.["harvest-model"]; } catch { /* config unreadable: use default */ }

178 }

179 harvestModel = harvestModel || DEFAULT_HARVEST_MODEL;

180 const workDir = realpathSync(join(home, "work"));

181 // Repo-resident souls: write to the soul AS SEEN FROM THE WORK TREE, so the

182 // promotion commits onto the instance's own branch. Otherwise the canonical soul.

bin/oas.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/oas.mjsView on unpkg