registry / @orcha-ai/runtime-bridge / 0.1.4

@orcha-ai/runtime-bridge@0.1.4

Local Orcha runtime bridge for ACP-compatible agent runtimes.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

User-invoked runtime bridge exposes local agent runtimes to Orcha over HTTP/WebSocket and can spawn configured CLI/ACP targets. It may read matching Codex transcript artifacts and send runtime updates, but this is aligned with the documented bridge function and is not install-triggered.

Static reason

One or more suspicious static signals were detected.

Trigger

User runs orcha-runtime-bridge, npm start, or orcha-runtime-bridge start.

Impact

Remote Orcha requests can create agents, dispatch prompts, cancel sessions, and respond to permissions for configured local runtimes while the bridge is running.

Mechanism

agent runtime bridge with configured child process execution and WebSocket/HTTP RPC relay

Rationale

Static inspection confirms dangerous agent-facing bridge capability, child process spawning, and transcript/artifact collection, but all are user-invoked and documented for the Orcha runtime bridge. No lifecycle hijack, hidden exfiltration, destructive behavior, or unconsented foreign agent configuration mutation was found.

Evidence

package.jsonbin/orcha-runtime-bridge.jsREADME.md.env.example.env.orcha-runtime-bridge.pid.orcha-runtime-bridge.logCODEX_HOME/sessions~/.codex/sessions

Network endpoints3

ORCHA_RUNTIME_ORCHA_URL/api/agent-runtime-bridge/wsorcha.tansuo.cloudorcha.example.com

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

bin/orcha-runtime-bridge.js spawns configured runtime commands and relays prompt/update data over HTTP/WebSocket bridge paths.
CLI can run detached via user-invoked start, writing .orcha-runtime-bridge.pid and .orcha-runtime-bridge.log.
Codex CLI support reads CODEX_HOME or ~/.codex/sessions transcripts to collect matching runtime output/artifacts.
Reads ORCHA_RUNTIME_* env/.env values including node token, bridge token, target command JSON, pid/log paths.

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks; activation is bin or npm start.
No package code writes Claude/Codex/Cursor/MCP control-surface configs or shell/VCS persistence files during install.
Network endpoint is package-aligned Orcha runtime bridge WebSocket derived from ORCHA_RUNTIME_ORCHA_URL.
Command execution is explicit runtime target behavior configured by ORCHA_RUNTIME_TARGETS_JSON, not hidden payload execution.
Logs redact keys matching token/secret/password/authorization before JSON logging.

Behavioral surface

Source

EnvironmentVars

Supply chain

Minified

Manifest

NoLicense

scanned 1 file(s), 49.1 KB of source

Source & flagged code

2 flagged

bin/orcha-runtime-bridge.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import{spawn as rn}from"node:child_process";import{closeSync as nn,existsSync as Te,mkdirSync as sn,openSync as on,readFileSync as Rt,rmSync as an,statSync as pe,writeFileSync as we}from"node:fs";import{dirname as cn,resolve as xt}from"node:path";import{fileURLToPath as un}from"node:url";import{randomUUID as Z}from"node:crypto";var k="0.1.4";function F(){return new Date().toISOString()}function _(e,t=2){return String(e).padStart(t,"0")}function Pt(e){let t=e>=0?"+":"-",r=Math.abs(e);return`${t}${_(Math.floor(r/60))}:${_(r%60)}`}function Ae(e){let t=-e.getTimezoneOffset();return[`${e.getFullYea ...

3`):""}var G=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}}async sessionPrompt(t,r){let n=j(t.prompt);return r({sessionId:t.sessionId,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n?`Echo runtime received: ${n}`:"Echo runtime received an empty prompt."}}}),{stopReason:"end_turn"}}async sessionCancel(){return{ok:!0}}};import{spawn as ke}from"node:child_process";var $="2.0",Pe=3e4;function De(e){return{code:Number.isInteger(e?.code)?e.code:-32e3,messag ...

4\r

5`);if(r<0)return;let s=this.headerBuffer.subarray(0,r).toString("utf8").match(/content-length:\s*(\d+)/i);if(!s){p("warn","runtime.protocol","missing Content-Length header",{

6\r

7${n}`:`${n}

8`;this.child.stdin.write(s,r)}onNotification(t,r){let n=this.notificationHandlers.get(t)||new Set;return n.add(r),this.notificationHandlers.set(t,n),()=>{n.delete(r),n.size===0&&this.notificationHandlers.delete(t)}}onRequest(t,r){return this.requestHandlers.set(t,r),()=>this.requestHandlers.delete(t)}onExit(t){return this.exitHandlers.add(t),()=>this.exitHandlers.delete(t)}rejectAll(t){for(let r of this.pending.values())clearTimeout(r.timer),r.reject(t);this.pending.clear()}handleExit(t,r){this.rejectAll(new Error(

10${s}`:s;t.emittedTexts.add(s),n({sessionId:r,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:i}}})}ee(t,te(e,t.artifactOptions)),Ur(e)&&n({sessionId:r,update:{sessionUpdate:"runtime_event",event:re(e)}})}function Kt(e,t,r,n,s=Date.now()){if(!t)return{artifactCount:0,transcriptCount:0};let i=e.artifacts.size,c=0,a=Or(t,r,s);if(a){let d=Math.min(t.processedLines.get(a.path)||0,a.events.length),l=e.artifacts.size;for(let f of a.events.slice(d))Cr(f,e,r,n);t.processedLines.set(a.path,a.events.length),(a.events.length>d||e.artifacts.size>l)&&(c=1)}return{artifactCount:e.artifa ...

11`,it,x,i,r);let ct=Kt(x,ot,i,r,Date.now());ct.artifactCount>0&&p("info","runtime.cli","codex transcript artifacts collected",{target:this.agent.targetCode,sessionId:i,artifactCount:ct.artifactCount,transcriptCount:ct.transcriptCount});let B=Nr(A);B&&!x.emittedTexts.has(B)&&(x.emittedTexts.add(B),r({sessionId:i,update:{sessionUpdate:

12`}}})}}}async sessionCancel(t){let r=o(t.sessionId),n=this.active.get(r);return n?(p("info","runtime.cli","cancelling runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid}),X(n,"SIGTERM"),this.active.delete(r),{ok:!0,cancelled:!0}):{ok:!0,cancelled:!1}}stop(t="stop"){for(let[r,n]of this.active.entries())p("info","runtime.cli","stopping runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid,reason:t}),X(n,"SIGTERM");this.active.clear()}};var ht=24e3,mt=8,gt=50,yt=6e3,Mr=new Set(["agentId","taskId","executionId","sessionId","nodeId","targetCode","framework","workspace", ...

13... [truncated ${n} characters]`}function Fr(e){if(!u(e))return"";let t=u(e.update)?e.update:e,n=(u(t.content)?t.content:{}).text??t.text;return n==null?"":String(n)}function $r(e){let

14`?1:0)).trim()}function Hr(e){let t=String(e||"").trim();if(!t.endsWith("}"))return"";for(let r=t.lastIndexOf("{");r>=0;r=t.lastIndexOf("{"

15`)}];return this.prompt({...t,agentId:n,sessionId:c,prompt:l},r)}async requestPermission({agent:t,runtimeSessionId:r,request:n,emitUpdate:s}){let i=Z(),a=this.runtimeSessionIndex.get(`${t.agentId}:${r}`)?.sessionId||r||Z(),d={permissionId:i,agentId:t.agentId,sessionId:a,runtimeSessionId:r,request:u(n)?n:{},status:"pending",createdAt:F()};return s?.({sessionId:r,update:{sessionUpdate:"permission_request",permission:d}}),await new Promise(l=>{let f=w(n?.timeoutMs,this.config.permissionRequestTimeoutMs),h=setTimeout(()=>{this.pendingPermissions.delete(i),l({permissionId:i,outcome:"denied",respons ...

16`).replaceAll("\\r","\r").replaceAll("\\t"," ").replaceAll('\\"','"').replaceAll("\\\\","\\")}function tn(e){let t=!1,r=!1;for(

17`),console.log(JSON.stringify({status:"started",pid:i.pid,pidFile:e,logFile:t}))}async function ge({quiet:e=!1}={}){let t=Ot(),r=At(t);if(!r){e||console.log(JSON.stringify({status:"not_running",pidFile:t}));return}if(!D(r)){St(t),e||console.log(JSON.stringify({status:"not_running",pid:r,pidFile:t}));return}process.kill(r,"SIGTERM"),!await ye(r,1e4)&&D(r)&&(process.kill(r,"SIGKILL"),await ye(r,3e3)),St(t),e||console.log(JSON.stringify({status:"stopped",pid:r,pidFile:t}))}function _n(){let e=Ot(),t=Re(),r=At(e),n=!!(r&&D(r));console.log(JSON.stringify({status:n?"running":"not_running",running:n, ...

18`);we(e,f?`${f}

19`:""),p("info","runtime-bridge","runtime log cleanup completed",{logFile:e,retentionDays:t,removed:a})}catch(l){p("warn","runtime-bridge","runtime log cleanup failed",{logFile:e,error:String(l)})}}function Rn(e,t){

21Commands:

Long lines were clipped for display.

Source & flagged code

2 flagged · loading source

bin/orcha-runtime-bridge.jsView file

1#!/usr/bin/env node L2: import{spawn as rn}from"node:child_process";import{closeSync as nn,existsSync as Te,mkdirSync as sn,openSync as on,readFileSync as Rt,rmSync as an,statSync as pe,writeFileSync as w... L3: `):""}var G=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}... ... L14: `?1:0)).trim()}function Hr(e){let t=String(e||"").trim();if(!t.endsWith("}"))return"";for(let r=t.lastIndexOf("{");r>=0;r=t.lastIndexOf("{",r-1)){let n=t.slice(r);try{let s=JSON.pa... L15: `)}];return this.prompt({...t,agentId:n,sessionId:c,prompt:l},r)}async requestPermission({agent:t,runtimeSessionId:r,request:n,emitUpdate:s}){let i=Z(),a=this.runtimeSessionIndex.g... L16: `).replaceAll("\\r","\r").replaceAll("\\t"," ").replaceAll('\\"','"').replaceAll("\\\\","\\")}function tn(e){let t=!1,r=!1;for(let n=0;n<e.length;n+=1){let s=e[n],i=e[n-1];if(s==="...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/orcha-runtime-bridge.jsView on unpkg · L1

1#!/usr/bin/env node L2: import{spawn as rn}from"node:child_process";import{closeSync as nn,existsSync as Te,mkdirSync as sn,openSync as on,readFileSync as Rt,rmSync as an,statSync as pe,writeFileSync as w... L3: `):""}var G=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}... L4: \r ... L14: `?1:0)).trim()}function Hr(e){let t=String(e||"").trim();if(!t.endsWith("}"))return"";for(let r=t.lastIndexOf("{");r>=0;r=t.lastIndexOf("{",r-1)){let n=t.slice(r);try{let s=JSON.pa... L15: `)}];return this.prompt({...t,agentId:n,sessionId:c,prompt:l},r)}async requestPermission({agent:t,runtimeSessionId:r,request:n,emitUpdate:s}){let i=Z(),a=this.runtimeSessionIndex.g... L16: `).replaceAll("\\r","\r").replaceAll("\\t"," ").replaceAll('\\"','"').replaceAll("\\\\","\\")}function tn(e){let t=!1,r=!1;for(let n=0;n<e.length;n+=1){let s=e[n],i=e[n-1];if(s==="...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/orcha-runtime-bridge.jsView on unpkg · L1

Findings

2 High1 Medium2 Low

HighSame File Env Network Executionbin/orcha-runtime-bridge.js

HighCommand Output Exfiltrationbin/orcha-runtime-bridge.js

MediumEnvironment Vars

LowScripts Present

LowNo License

Source & flagged code

2 flagged

bin/orcha-runtime-bridge.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

4\r

5`);if(r<0)return;let s=this.headerBuffer.subarray(0,r).toString("utf8").match(/content-length:\s*(\d+)/i);if(!s){p("warn","runtime.protocol","missing Content-Length header",{

6\r

7${n}`:`${n}

13... [truncated ${n} characters]`}function Fr(e){if(!u(e))return"";let t=u(e.update)?e.update:e,n=(u(t.content)?t.content:{}).text??t.text;return n==null?"":String(n)}function $r(e){let

14`?1:0)).trim()}function Hr(e){let t=String(e||"").trim();if(!t.endsWith("}"))return"";for(let r=t.lastIndexOf("{");r>=0;r=t.lastIndexOf("{"

16`).replaceAll("\\r","\r").replaceAll("\\t"," ").replaceAll('\\"','"').replaceAll("\\\\","\\")}function tn(e){let t=!1,r=!1;for(

18`);we(e,f?`${f}

21Commands:

Long lines were clipped for display.