registry / @shgroup/opencode-serenity-plugin / 0.5.36

@shgroup/opencode-serenity-plugin@0.5.36

Serenity — 为 OpenCode Agent 提供认知容器 (CCC) 基础设施。9 个工具 (msm_list/msm_exec/msm_admin/cc-fs/session/cc-ck/eap/neat/cc-git) + 6 个 hook。D1 Init 向导：CLI 交互式创建 CCC + Phase 2 强制访谈。

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 495 KB of source, external domains: 127.0.0.1, github.com, opencode.ai

Source & flagged code

2 flagged

dist/init/init-wizard.jsView file

Lines 1-37javascript

1/**

2 * init-wizard.ts — D1 Init 向导 Phase 1

3 *

4 * CLI 交互式创建认知容器 (CCC) 的目录骨架、git 初始化并复制标准技能模板。

5 *

6 * 设计文档：docs/ccc-init-flow-design.md（home-serenity 仓）

7 *

8 * 流程：

9 * 1. 交互问答 4 题（prefix / description / remote / scope）

10 * 2. git init → add → commit（Phase 1 写骨架前）

11 * 3. 创建目录骨架（.serenity, opencode.json, AGENT_SESSIONS/, docs/）

12 * 4. 复制 3 个标准技能模板到 .opencode/skills/

13 * 5. git remote add → push（如果提供了 remote）

14 * 6. 写入 Phase 2 Agent prompt

15 * 7. 输出完成信息

16 */

17import { existsSync, mkdirSync, writeFileSync } from 'node:fs';

18import { execFileSync } from 'node:child_process';

19import { join, basename } from 'node:path';

High

Child Process

Package source references child process execution.

dist/init/init-wizard.jsView on unpkg · L17

20import { createInterface } from 'node:readline';

21import { stdin, stdout } from 'node:process';

22import { getTemplatesDir, installTemplate, defaultPlaceholders, } from '../skills/template-loader.js';

23import { isValidPrefix, buildCccName } from '../util/init.js';

24// ── 默认值 ──

25/** Phase 1 预装的 3 个标准技能（设计决策 D20） */

26const STANDARD_SKILLS = [

27 'compass',

28 'session',

29 'sqc',

30];

31/** 从目录名推断 prefix（kebab-case，取第一部分） */

32function inferPrefix(dirName) {

33 const cleaned = dirName.replace(/[^a-zA-Z0-9-]/g, '');

34 const first = cleaned.split(/[-_]/)[0];

35 if (!first)

36 return 'my';

37 return first.toLowerCase().slice(0, 8);

dist/util/msm-exec-runtime.jsView file

Lines 25-65javascript

25 * --format=<text|json> 输出格式 (默认 text)

26 * --log <path> JSON Lines 日志

27 * --help / -h 自身或某 msm 的帮助

Source & flagged code

2 flagged · loading source

dist/init/init-wizard.jsView file

17import { existsSync, mkdirSync, writeFileSync } from 'node:fs'; L18: import { execFileSync } from 'node:child_process'; L19: import { join, basename } from 'node:path';

High

Child Process

Package source references child process execution.

dist/init/init-wizard.jsView on unpkg · L17

dist/util/msm-exec-runtime.jsView file

45* npx tsx msm-exec-runtime.ts --log /tmp/x.log --format=json <msm-name> [args...] L46: * npx tsx msm-exec-runtime.ts --list L47: * npx tsx msm-exec-runtime.ts --schema <msm-name> ... L60: import { readFileSync, appendFileSync, existsSync, writeFileSync, mkdirSync } from "node:fs"; L61: import { spawn } from "node:child_process"; L62: import { resolve, dirname } from "node:path";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/util/msm-exec-runtime.jsView on unpkg · L45

Findings

3 High2 Medium4 Low

HighChild Processdist/init/init-wizard.js

HighShell

HighRuntime Package Installdist/util/msm-exec-runtime.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/init/init-wizard.jsView file

Lines 1-37javascript

1/**

2 * init-wizard.ts — D1 Init 向导 Phase 1

3 *

4 * CLI 交互式创建认知容器 (CCC) 的目录骨架、git 初始化并复制标准技能模板。

5 *

6 * 设计文档：docs/ccc-init-flow-design.md（home-serenity 仓）

7 *

8 * 流程：

9 * 1. 交互问答 4 题（prefix / description / remote / scope）

10 * 2. git init → add → commit（Phase 1 写骨架前）

11 * 3. 创建目录骨架（.serenity, opencode.json, AGENT_SESSIONS/, docs/）

12 * 4. 复制 3 个标准技能模板到 .opencode/skills/

13 * 5. git remote add → push（如果提供了 remote）

14 * 6. 写入 Phase 2 Agent prompt

15 * 7. 输出完成信息

16 */

17import { existsSync, mkdirSync, writeFileSync } from 'node:fs';

18import { execFileSync } from 'node:child_process';

19import { join, basename } from 'node:path';

High

Child Process

Package source references child process execution.

dist/init/init-wizard.jsView on unpkg · L17

20import { createInterface } from 'node:readline';

21import { stdin, stdout } from 'node:process';

22import { getTemplatesDir, installTemplate, defaultPlaceholders, } from '../skills/template-loader.js';

23import { isValidPrefix, buildCccName } from '../util/init.js';

24// ── 默认值 ──

25/** Phase 1 预装的 3 个标准技能（设计决策 D20） */

26const STANDARD_SKILLS = [

27 'compass',

28 'session',

29 'sqc',

30];

31/** 从目录名推断 prefix（kebab-case，取第一部分） */

32function inferPrefix(dirName) {

33 const cleaned = dirName.replace(/[^a-zA-Z0-9-]/g, '');

34 const first = cleaned.split(/[-_]/)[0];

35 if (!first)

36 return 'my';

37 return first.toLowerCase().slice(0, 8);

dist/util/msm-exec-runtime.jsView file

Lines 25-65javascript

25 * --format=<text|json> 输出格式 (默认 text)

26 * --log <path> JSON Lines 日志

27 * --help / -h 自身或某 msm 的帮助