registry / @opus-aether-ai/legion-core / 0.14.1

@opus-aether-ai/legion-core@0.14.1

Legion engine — model-agnostic delegation, observability, orchestration, and cross-harness setup for AI coding agents. Consumed by legion-code and other agents.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 2 file(s), 41.0 KB of source, external domains: api.minimax.io

Source & flagged code

2 flagged

legion-router/scripts/sandcastle-run.mjsView file

Lines 33-73javascript

33 model,

34 sandbox,

35 cwd,

36 main_repo: mainRepo = cwd,

37 base = "HEAD",

38 diff_path: diffPath,

39 artifact_dir: artifactDir,

40 untrusted = false,

41} = job;

43if (!task || !model || !sandbox || !cwd || !sandboxImport[sandbox]) {

44 console.error(

45 "sandcastle-run: expected { task, model, sandbox, cwd, base?, diff_path? }",

46 );

47 process.exit(2);

48}

50let run;

51let codex;

52let sandboxFactory;

53try {

54 ({ run, codex } = await import("@ai-hero/sandcastle"));

55 ({ [providerName[sandbox]]: sandboxFactory } = await import(

Medium

Dynamic Require

Package source references dynamic require/import behavior.

legion-router/scripts/sandcastle-run.mjsView on unpkg · L53

56 sandboxImport[sandbox]

57 ));

58} catch {

59 console.error(INSTALL_HINT);

60 process.exit(3);

61}

63const baseSha = git(cwd, ["rev-parse", base]).trim();

64const branch =

65 job.branch || `legion/sandcastle-${Date.now()}-${randomUUID().slice(0, 8)}`;

67// codex() only accepts effort ∈ low|medium|high|xhigh (it bypasses approvals by

68// default, so no permission flag is needed). Map Legion's "max" → "xhigh" and

69// drop anything else rather than passing an invalid value.

70const CODEX_EFFORTS = new Set(["low", "medium", "high", "xhigh"]);

71let effort = job.effort === "max" ? "xhigh" : job.effort;

72if (effort && !CODEX_EFFORTS.has(effort)) effort = undefined;

legion-observability/bench/tools/import-aider-polyglot.pyView file

•path = legion-[redacted]-aider-polyglot.py kind = build_helper sizeBytes = 11771 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

legion-observability/bench/tools/import-aider-polyglot.pyView on unpkg

Source & flagged code

2 flagged · loading source

legion-router/scripts/sandcastle-run.mjsView file

53try { L54: ({ run, codex } = await import("@ai-hero/sandcastle")); L55: ({ [providerName[sandbox]]: sandboxFactory } = await import(

Medium

Dynamic Require

Package source references dynamic require/import behavior.

legion-router/scripts/sandcastle-run.mjsView on unpkg · L53

legion-observability/bench/tools/import-aider-polyglot.pyView file

•path = legion-[redacted]-aider-polyglot.py kind = build_helper sizeBytes = 11771 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

legion-observability/bench/tools/import-aider-polyglot.pyView on unpkg

Findings

6 Medium3 Low

MediumDynamic Requirelegion-router/scripts/sandcastle-run.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperlegion-observability/bench/tools/import-aider-polyglot.py

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

legion-router/scripts/sandcastle-run.mjsView file

Lines 33-73javascript

33 model,

34 sandbox,

35 cwd,

36 main_repo: mainRepo = cwd,

37 base = "HEAD",

38 diff_path: diffPath,

39 artifact_dir: artifactDir,

40 untrusted = false,

41} = job;

43if (!task || !model || !sandbox || !cwd || !sandboxImport[sandbox]) {

44 console.error(

45 "sandcastle-run: expected { task, model, sandbox, cwd, base?, diff_path? }",

46 );

47 process.exit(2);

48}

50let run;

51let codex;

52let sandboxFactory;

53try {

54 ({ run, codex } = await import("@ai-hero/sandcastle"));

55 ({ [providerName[sandbox]]: sandboxFactory } = await import(

Medium

Dynamic Require

Package source references dynamic require/import behavior.

legion-router/scripts/sandcastle-run.mjsView on unpkg · L53

56 sandboxImport[sandbox]

57 ));

58} catch {

59 console.error(INSTALL_HINT);

60 process.exit(3);

61}

63const baseSha = git(cwd, ["rev-parse", base]).trim();

64const branch =

65 job.branch || `legion/sandcastle-${Date.now()}-${randomUUID().slice(0, 8)}`;

67// codex() only accepts effort ∈ low|medium|high|xhigh (it bypasses approvals by

68// default, so no permission flag is needed). Map Legion's "max" → "xhigh" and

69// drop anything else rather than passing an invalid value.

70const CODEX_EFFORTS = new Set(["low", "medium", "high", "xhigh"]);

71let effort = job.effort === "max" ? "xhigh" : job.effort;

72if (effort && !CODEX_EFFORTS.has(effort)) effort = undefined;

legion-observability/bench/tools/import-aider-polyglot.pyView file

•path = legion-[redacted]-aider-polyglot.py kind = build_helper sizeBytes = 11771 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

legion-observability/bench/tools/import-aider-polyglot.pyView on unpkg