aws-runtime-bridge@1.9.58: Suspicious npm security report (Warn) | LPM Firewall

Loading npm security reports…

aws-runtime-bridge@1.9.58: Suspicious npm security report (Warn) | LPM Firewall

dist/index.jsView file

Lines 203-243javascript

203 return;

204 }

205 logger.info(`[runtime-bridge] ★ 已显式启用启动清理，检测 ${persistedSessions.length} 个持久化会话的孤儿进程...`);

206 const orphans = await detectOrphanProcesses(persistedSessions.map((s) => ({

207 agentId: s.agentId,

208 pid: s.pid,

209 workspacePath: s.workspacePath,

210 command: s.command,

211 })));

212 if (orphans.length > 0) {

213 logger.warn(`[runtime-bridge] ★ 检测到 ${orphans.length} 个孤儿进程仍在运行：`);

214 for (const orphan of orphans) {

215 logger.warn(` - agentId=${orphan.agentId}, pid=${orphan.process.pid}, command=${orphan.process.command?.slice(0, 50)}`);

216 }

217 // ★ 自动清理所有孤儿进程

218 logger.info("[runtime-bridge] 正在自动清理所有孤儿进程...");

219 for (const orphan of orphans) {

220 try {

221 if (orphan.process.pid) {

222 // 使用跨平台方式终止进程

223 if (process.platform === "win32") {

224 const { execSync } = await import("node:child_process");

225 execSync(`taskkill /PID ${orphan.process.pid} /T /F`, {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L223

226 encoding: "utf8",

227 timeout: 3000,

228 });

229 logger.info(`[runtime-bridge] 已自动终止孤儿进程: agentId=${orphan.agentId}, PID=${orphan.process.pid}`);

230 }

231 else {

232 process.kill(orphan.process.pid, "SIGKILL");

233 logger.info(`[runtime-bridge] 已自动终止孤儿进程: agentId=${orphan.agentId}, PID=${orphan.process.pid}`);

234 }

235 }

236 }

237 catch (killError) {

238 const err = killError;

239 logger.warn(`[runtime-bridge] 自动终止孤儿进程失败: agentId=${orphan.agentId}, PID=${orphan.process.pid}, error=${err.message}`);

240 }

241 }

242 // 等待进程完全终止

243 await new Promise((resolve) => setTimeout(resolve, 1000));

dist/adapter/OpencodeSdkAdapter.jsView file

Lines 121-161javascript

121 totalUsage: { inputTokens: 0, outputTokens: 0 },

122 },

123 config,

124 sseActive: false,

125 pendingPermissions: new Map(),

126 emittedToolStarts: new Set(),

127 workingDirectory: config.workingDirectory,

128 userMessageIds: new Set(),

129 currentAssistantText: '',

130 seenTextPartIds: new Set(),

131 };

132 this.sessions.set(sessionId, session);

133 this.emit('status-change', sessionId, 'starting');

134 try {

135 // 步骤 1：找空闲端口

136 const port = await findAvailablePort();

137 session.port = port;

138 console.log(`[OpencodeSdkAdapter] ★★★ 使用端口 ★★★ port=${port}`);

139 // 步骤 2：启动 opencode serve 进程

140 const openCodeCommand = findOpenCodeExecutable(config.command);

141 console.log(`[OpencodeSdkAdapter] ★★★ 启动命令 ★★★ command="${openCodeCommand}"`);

142 // ★ 关键：Windows 上 .cmd 必须使用 shell: true

143 const useShell = openCodeCommand.endsWith('.cmd') ||

144 openCodeCommand.endsWith('.CMD') ||

145 (process.platform === 'win32' && !path.isAbsolute(openCodeCommand));

146 console.log(`[OpencodeSdkAdapter] shell=${useShell}`);

147 const env = { ...process.env, ...config.envOverrides };

148 // ★ 通过 OPENCODE_CONFIG_CONTENT 注入运行时配置（OpenCode 标准 inline config，优先级 6）

149 // 参考：https://opencode.ai/docs/config/ — "Inline config (OPENCODE_CONFIG_CONTENT env var) - runtime overrides"

150 const inlineConfig = {};

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/adapter/OpencodeSdkAdapter.jsView on unpkg · L141

151 const parsedModel = parseOpenCodeModelSpec(config.model);

152 if (parsedModel?.modelID) {

153 inlineConfig.model = config.model.trim();

154 }

155 // 系统提示词：由 SDK 原生机制注入为 role=system，而非作为 user message

156 if (config.systemPrompt && typeof config.systemPrompt === 'string') {

157 inlineConfig.systemPrompt = config.systemPrompt;

158 }

159 if (Object.keys(inlineConfig).length > 0) {

160 env.OPENCODE_CONFIG_CONTENT = JSON.stringify(inlineConfig);

161 log.info(`[OpencodeSdkAdapter] OPENCODE_CONFIG_CONTENT keys=${Object.keys(inlineConfig).join(',')}`);