registry / @orcha-ai/runtime-bridge / 0.1.2

@orcha-ai/runtime-bridge@0.1.2

Local Orcha runtime bridge for ACP-compatible agent runtimes.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs orcha-runtime-bridge, orcha-runtime-bridge start, or npm start.

Impact

Configured Orcha endpoint can request prompts, dispatch tasks, receive runtime output/artifacts, and cancel sessions through the bridge.

Mechanism

configured WebSocket bridge spawning configured agent CLI/ACP targets

Policy narrative

When explicitly run, the package loads ORCHA_RUNTIME_* configuration, connects to the configured Orcha WebSocket, authenticates with a node token, and processes remote runtime requests by creating agents, prompting configured local runtimes, and forwarding updates. It can spawn configured commands such as codex/openclaw/claude and collect matching Codex transcript artifacts. This is a dangerous remote-control capability but matches the package's documented runtime-bridge purpose and is not delivered through npm lifecycle execution.

Rationale

The source shows a documented, user-invoked runtime bridge with remote agent execution capability, not covert malware or unconsented install-time agent control-surface mutation. Because it exposes powerful AI-agent control to a configured remote service, downgrade to warn rather than mark clean.

Evidence

package.jsonbin/orcha-runtime-bridge.jsREADME.md.env.example.env.orcha-runtime-bridge.pid.orcha-runtime-bridge.log$CODEX_HOME/sessions/**/*.jsonl

Network endpoints2

ORCHA_RUNTIME_ORCHA_URL -> /api/agent-runtime-bridge/wsorcha.example.com

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

bin/orcha-runtime-bridge.js opens a WebSocket to configured ORCHA_RUNTIME_ORCHA_URL and accepts remote Orcha RPC methods.
bin/orcha-runtime-bridge.js can spawn configured local runtimes via child_process for stdio-acp/openclaw/cli targets.
bin/orcha-runtime-bridge.js can read Codex session JSONL files under CODEX_HOME/.codex sessions to collect matching artifacts.
bin/orcha-runtime-bridge.js start mode creates a detached background process with pid/log files.

Evidence against

package.json has no npm lifecycle hooks; execution is via bin/start script only.
README.md and .env.example document the bridge, Orcha WebSocket, target commands, pid/log files, and env configuration.
Network destination and runtime commands are user-configured, not hardcoded covert endpoints or payload URLs.
No code writes foreign AI-agent config files, MCP configs, shell startup files, or VCS hooks.
No credential harvesting beyond reading its own ORCHA_RUNTIME_* config/env values was found.

Behavioral surface

Source

EnvironmentVars

Supply chain

Minified

Manifest

NoLicense

scanned 1 file(s), 40.1 KB of source

Source & flagged code

2 flagged

bin/orcha-runtime-bridge.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{spawn as Ye}from"node:child_process";import{closeSync as Qe,existsSync as Ze,mkdirSync as tr,openSync as er,readFileSync as rr,rmSync as nr,writeFileSync as sr}from"node:fs";import{dirname as ir,resolve as Vt}from"node:path";import{fileURLToPath as or}from"node:url";import{randomUUID as j}from"node:crypto";var U="0.1.2";function O(){return new Date().toISOString()}function u(r){return r!==null&&typeof r=="object"&&!Array.isArray(r)}function c(r){return String(r??"").trim()}function T(r,t){let e=Number.parseInt(String(r??""),10);return Number.isFinite(e)?e:t}function k(r){return Array.is ...

3`):""}var D=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}}async sessionPrompt(t,e){let n=L(t.prompt);return e({sessionId:t.sessionId,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n?`Echo runtime received: ${n}`:"Echo runtime received an empty prompt."}}}),{stopReason:"end_turn"}}async sessionCancel(){return{ok:!0}}};import{spawn as te}from"node:child_process";var C="2.0",ee=3e4;function re(r){return{code:Number.isInteger(r?.code)?r.code:-32e3,messag ...

4\r

5`);if(e<0)return;let s=this.headerBuffer.subarray(0,e).toString("utf8").match(/content-length:\s*(\d+)/i);if(!s){h("warn","runtime.protocol","missing Content-Length header",{target:this.label}),this.headerBuffer=Buffer.

6\r

7${n}`:`${n}

8`;this.child.stdin.write(s,e)}onNotification(t,e){let n=this.notificationHandlers.get(t)||new Set;return n.add(e),this.notificationHandlers.set(t,n),()=>{n.delete(e),n.size===0&&this.notificationHandlers.delete(t)}}onRequest(t,e){return this.requestHandlers.set(t,e),()=>this.requestHandlers.delete(t)}onExit(t){return this.exitHandlers.add(t),()=>this.exitHandlers.delete(t)}rejectAll(t){for(let e of this.pending.values())clearTimeout(e.timer),e.reject(t);this.pending.clear()}handleExit(t,e){this.rejectAll(new Error(`runtime exited before response (${t}/${e})`));for(let n of this.exitHandlers)n( ...

10${s}`:s;t.emittedTexts.add(s),n({sessionId:e,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:i}}})}at(t,ot(r)),ve(r)&&n({sessionId:e,update:{sessionUpdate:"runtime_event",event:bt(r)}})}function At(r,t,e,n,s=Date.now()){if(!t)return{artifactCount:0

11`,E,g,i,e),At(g,X,i,e,Date.now());let v=Le(l);if(v&&!g.emittedTexts.has(v)&&(g.emittedTexts.add(v),e({sessionId:i,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:v}}})),Ot(s,this.target)){let Q=ke(g,{target:this.target,promptText:a,startedAtMs:n,endedAtMs:Date.now()});Q.artifactCount>0&&h("info","runtime.cli","codex transcript artifacts collected",{target:this.agent.targetCode,sessionId:i,artifactCount:Q.artifactCount,transcriptCount:Q.transcriptCount})}let P=_.trim();P&&h("debug","runtime.cli","runtime stderr",{target:this.agent.targetCode,sessionId:i,stderr:P}),h("info" ...

12`}}})}}}async sessionCancel(t){let e=c(t.sessionId),n=this.active.get(e);return n?(h("info","runtime.cli","cancelling runtime child",{target:this.agent.targetCode,sessionId:e,pid:n.pid}),z(n,"SIGTERM"),this.active.delete(e),{ok:!0,cancelled:!0}):{ok:!0,cancelled:!1

13`)}];return this.prompt({...t,agentId:n,sessionId:a,prompt:d},e)}async requestPermission({agent:t,runtimeSessionId:e,request:n,emitUpdate:s}){let i=j(),o=this.runtimeSessionIndex.get(`${t.agentId}:${e}`)?.sessionId||e||j(),d={permissionId:i,agentId:t.agentId,sessionId:o,runtimeSessionId:e,request:u(n)?n:{},status:"pending",createdAt:O()};return s?.({sessionId:e,update:{sessionUpdate:"permission_request",permission:d}}),await new Promise(l=>{let p=T(n?.timeoutMs,this.config.permissionRequestTimeoutMs),m=setTimeout(()=>{this.pendingPermissions.delete(i),l({permissionId:i,outcome:"denied",respons ...

14`).replaceAll("\\r","\r").replaceAll("\\t"," ").replaceAll('\\"','"').replaceAll("\\\\","\\")}function Ve(r){let t=!1,e=!1;

15`),console.log(JSON.stringify({status:"started",pid:s.pid,pidFile:r,logFile:t}))}async function Jt({quiet:r=!1}={}){let t=pt(),e=ft(t);if(!e){r||console.log(JSON.stringify({status:"not_running",pidFile:t}));return}if(!N(e)){lt(t),r||console.log(JSON.stringify({status:"not_running",pid:e,pidFile:t}));return}process.kill(e,"SIGTERM"),!await Kt(e,1e4)&&N(e)&&(process.kill(e,"SIGKILL"),await Kt(e,3e3)),lt(t),r||console.log(JSON.stringify({status:"stopped",pid:e,pidFile:t}))}function fr(){let r=pt(),t=Yt(),e=ft(r),n=!!(e&&N(e));console.log(JSON.stringify({status:n?"running":"not_running",running:n, ...

17Commands:

18 run, foreground Run in the foreground. This is the default.

19 start Start in the background and write a pid file.

20 reload, restart Stop the background process and start it again.

21 stop Stop the background process.

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

bin/orcha-runtime-bridge.jsView file

1#!/usr/bin/env node L2: import{spawn as Ye}from"node:child_process";import{closeSync as Qe,existsSync as Ze,mkdirSync as tr,openSync as er,readFileSync as rr,rmSync as nr,writeFileSync as sr}from"node:fs"... L3: `):""}var D=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}... L4: \r ... L12: `}}})}}}async sessionCancel(t){let e=c(t.sessionId),n=this.active.get(e);return n?(h("info","runtime.cli","cancelling runtime child",{target:this.agent.targetCode,sessionId:e,pid:n... L13: `)}];return this.prompt({...t,agentId:n,sessionId:a,prompt:d},e)}async requestPermission({agent:t,runtimeSessionId:e,request:n,emitUpdate:s}){let i=j(),o=this.runtimeSessionIndex.g... L14: `).replaceAll("\\r","\r").replaceAll("\\t"," ").replaceAll('\\"','"').replaceAll("\\\\","\\")}function Ve(r){let t=!1,e=!1;for(let n=0;n<r.length;n+=1){let s=r[n],i=r[n-1];if(s==="...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/orcha-runtime-bridge.jsView on unpkg · L1

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/orcha-runtime-bridge.jsView on unpkg · L1

Findings

2 High1 Medium2 Low

HighSame File Env Network Executionbin/orcha-runtime-bridge.js

HighCommand Output Exfiltrationbin/orcha-runtime-bridge.js

MediumEnvironment Vars

LowScripts Present

LowNo License

Source & flagged code

2 flagged

bin/orcha-runtime-bridge.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

4\r

6\r

7${n}`:`${n}

14`).replaceAll("\\r","\r").replaceAll("\\t"," ").replaceAll('\\"','"').replaceAll("\\\\","\\")}function Ve(r){let t=!1,e=!1;

17Commands:

18 run, foreground Run in the foreground. This is the default.

19 start Start in the background and write a pid file.

20 reload, restart Stop the background process and start it again.

21 stop Stop the background process.

Long lines were clipped for display.