Loading npm security reports…
grix-connector@3.15.0: AI-agent capability abuse – flagged | LPM Firewall
Flagged as AI-agent capability risk
Allowed by default with warning: agent-facing configuration or capability changes need review before use.
grix-connector@3.15.0 Connect local AI coding agents (Claude, Codex, Gemini, Qwen, DeepSeek, Cursor, OpenCode, Pi, OpenHuman, Reasonix) to the Grix scheduling platform. Also serves as an OpenClaw plugin for Grix channel transport.
scanned 3mo ago · by lpm-firewall-ai Source confirms unconsented weakening of Claude permission safeguards and runtime agent-extension registration. No concrete exfiltration or stealth remote payload chain was established, so this warrants a warning rather than a publish block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
npm installation; then starting a Claude or OpenHuman connector session
Impact
A user-launched connector can weaken Claude confirmation safeguards and add package-controlled agent tools.
Mechanism
AI-agent configuration and permission-state mutation
AI rationale
Source confirms unconsented weakening of Claude permission safeguards and runtime agent-extension registration. No concrete exfiltration or stealth remote payload chain was established, so this warrants a warning rather than a publish block.
Evidence
package.json scripts/install-guardian.mjs scripts/upgrade-guardian.sh dist/adapter/claude/claude-adapter.js dist/adapter/openhuman/openhuman-adapter.js dist/core/upgrade/upgrade-checker.js ~/.grix/bin/upgrade-guardian.sh ~/.claude/settings.json ~/.claude.json ~/.openhuman/users/local/workspace/mcp_clients/mcp_clients.db ~/.openhuman/skills
Network endpoints3
registry.npmjs.org registry.npmmirror.com codewhisperer.us-east-1.amazonaws.com
public snapshot AI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
postinstall forcibly overwrites ~/.grix/bin/upgrade-guardian.sh Claude adapter sets skipDangerousModePermissionPrompt=true Claude adapter pre-trusts configured workspaces and marks onboarding complete OpenHuman startup registers its MCP server and skills in ~/.openhuman runtime upgrade guardian runs detached and can npm-install a prior version Evidence against
No confirmed credential exfiltration or unrelated remote payload execution found Kiro token use targets Amazon Kiro quota endpoints npm registry use is explicit installer/upgrade functionality Behavioral surface
Source ChildProcess Crypto EnvironmentVars Filesystem NativeBindings Network Shell WebSocket
Supply chain HighEntropyStrings Minified UrlStrings
Manifest No manifest risk signals triggered.
10 flagged · loading source • scripts.postinstall = node scripts/install-guardian.mjs
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg 3107 // src/openclaw/gateway-provider.ts
L3108: import { execFile } from "node:child_process";
L3109: import { readFile, writeFile as writeFile2, mkdir as mkdir2, unlink as unlink2 } from "node:fs/promises";
High Child Process
Package source references child process execution.
openclaw-plugin/index.js View on unpkg · L3107 3058 }
L3059: function buildExecApprovalResolveArgv(params) {
L3060: const cliArgvPrefix = params.cliArgvPrefix && params.cliArgvPrefix.length > 0 ? params.cliArgvPrefix : resolveOpenClawCliArgvPrefix();
High Shell
Package source references shell execution.
openclaw-plugin/index.js 1 Critical 7 High 4 Medium 6 Low
Critical Previous Version Dangerous Delta dist/adapter/claude/claude-adapter.js
High Install Time Lifecycle Scripts package.json
High Child Process openclaw-plugin/index.js
High Shell openclaw-plugin/index.js
High Same File Env Network Execution dist/adapter/openhuman/openhuman-adapter.js
High Command Output Exfiltration dist/core/provider-quota/kiro.js
High Sandbox Evasion Gated Capability dist/core/installer/npm-registry.js
High Cross File Remote Execution Context dist/adapter/claude/claude-adapter.js
Medium Network
Medium Environment Vars
Medium Ships Build Helper dist/core/proxy/hermes-profile-relay.py
Affected versions and remediation This report applies to grix-connector@3.15.0 .
See all versions of grix-connector for other recorded verdicts.
Review the evidence and your use of grix-connector@3.15.0 before allowing it. Restrict the permissions described in this report. Choose an independently verified alternative or release. This report does not establish that other versions are safe. Evidence last updated: 2026-07-23 12:46:22.310Z (UTC) .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced .
96% Suspicious
AI assessment confidence
Package metadata npm Author askie
Maintainers askie
Version 3.15.0
Latest on npm 4.16.2
Published Jul 23, 2026
License MIT
Dependencies 8
Integrity verified
Package size 506 KB
Files 343
Keywords grix aibot agent-connector claude codex gemini qwen deepseek
scanned 303 file(s), 1.57 MB of source, external domains: 127.0.0.1, antigravity.google, api.anthropic.com, api.openai.com, api2.cursor.sh, brew.sh, cli.github.com, cli.kiro.dev, code.kimi.com, codewhisperer.us-east-1.amazonaws.com, curl.se, cursor.com, docs.anthropic.com, fnm.vercel.app, github.com, grix.dhf.pub, grix.internal, kiro.dev, moonshotai.github.io, nodejs.org, opencode.ai, qwen-code-assets.oss-cn-hangzhou.aliyuncs.com, raw.githubusercontent.com, registry.npmjs.org, registry.npmmirror.com, schemas.microsoft.com, www.apple.com
dist/core/proxy/crypto/certificate.js View file 1 import{createHash as x,createPrivateKey as G,createPublicKey as V,generateKeyPairSync as I,sign as z}from"node:crypto";import{existsSync as b}from"node:fs";import{mkdir as J,readFi...
L2: `)??"";return`-----BEGIN ${e}-----
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/core/proxy/crypto/certificate.js View on unpkg · L1 dist/adapter/openhuman/openhuman-adapter.js View file 1 import{EventEmitter as m}from"node:events";import{stat as I}from"node:fs/promises";import{mkdirSync as g}from"node:fs";import{homedir as u}from"node:os";import{join as p,resolve as...
L2: `);i("sqlite3",[s,l],{timeout:1e4,stdio:"ignore"}),n.info("openhuman-adapter",`MCP server registered in SQLite: ${s}`);const c=p(u(),".openhuman","skills"),h=y(c);h.length>0&&n.inf...
L3: `)+`
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/adapter/openhuman/openhuman-adapter.js View on unpkg · L1 1 import{readFile as _}from"node:fs/promises";import{existsSync as m}from"node:fs";import{homedir as h}from"node:os";import{join as u}from"node:path";import{execFile as I}from"node:c...
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/core/provider-quota/kiro.js View on unpkg · L1 1 import{execFile as f}from"node:child_process";import{promisify as y}from"node:util";import{log as g}from"../log/logger.js";import{probeUrls as h}from"./speed-test.js";const w=y(f),...
L2: ${m??""}`.trim())})})}function S(t){return c.map(e=>({label:e.label,command:`npm install -g ${t} --registry ${e.url}`}))}export{c as NPM_REGISTRIES,U as getCurrentRegistry,S as get...
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/core/installer/npm-registry.js View on unpkg · L1 dist/adapter/claude/claude-adapter.js View file • matchType = previous_version_dangerous_delta
matchedPackage = grix-connector@3.1.17
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:3.1.17
similarity = 0.425
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/adapter/claude/claude-adapter.js View on unpkg 1 Cross-file remote execution chain: dist/adapter/claude/claude-adapter.js spawns openclaw-plugin/index.js; helper contains network access plus dynamic code execution.
L1: import{spawn as G,spawnSync as De,execSync as Q,execFile as xe}from"node:child_process";import{promisify as Me}from"node:util";import{randomUUID as H}from"node:crypto";import{killP...
L2: `):"No skills found",data:n}}catch(n){return{status:"failed",message:`Failed to scan skills: ${n instanceof Error?n.message:n}`}}if(!this.claudeProcess&&!this.claudePty)if(e==="com...
L3: `)}finally{qe(r)}}else this.claudeProcess?.stdin?.write(`${s}
...
L5: `)}buildLostHistoryRecoveryPrompt(e){return["\u26A0\uFE0F \u672C\u4F1A\u8BDD\u7684\u672C\u5730\u5386\u53F2\u8BB0\u5F55\u5DF2\u4E22\u5931\uFF0C\u65E0\u6CD5\u7EED\u63A5\u4E4B\u524D\u...
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/adapter/claude/claude-adapter.js View on unpkg · L1 dist/core/proxy/hermes-profile-relay.py View file • path = dist/core/proxy/hermes-profile-relay.py
kind = build_helper
sizeBytes = 21259
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/core/proxy/hermes-profile-relay.py View on unpkg Medium
Structural Risk Force Deep Review
Low Non Install Lifecycle Scripts
Low Weak Crypto dist/core/proxy/crypto/certificate.js
Runtime surface package.json Entrypoints main → dist/index.js types → ./dist/index.d.ts bin → grix-connector
Runtime node >=18.0.0
Artifact 1.80 MB · 343 files 1 signature(s)
Install lifecycle postinstall prepublishOnly
Behavioral surface ChildProcess Crypto EnvironmentVars Filesystem NativeBindings Network Shell WebSocket HighEntropyStrings Minified UrlStrings Manifest: clean
10 flagged Lines 2-42 json
2 "name" : "grix-connector" ,
4 "description" : "Connect local AI coding agents (Claude, Codex, Gemini, Qwen, DeepSeek, Cursor, OpenCode, Pi, OpenHuman, Reasonix) to the Grix scheduling platform. Also serves as an OpenClaw plugin for Grix channel transport." ,
6 "main" : "dist/index.js" ,
8 "grix-connector" : "dist/grix.js"
16 "scripts/install-guardian.mjs" ,
17 "scripts/install-guardian.sh" ,
18 "scripts/upgrade-guardian.sh" ,
19 "openclaw.plugin.json"
22 "postinstall" : "node scripts/install-guardian.mjs" ,
High Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.json View on unpkg · L22 23 "prepublishOnly" : "npm run build:all" ,
24 "build" : "npm run check:isolation && node -e \" require('fs').rmSync('dist/default-skills',{recursive:true,force:true}) \" && tsc && node -e \" require('fs').cpSync('src/default-skills','dist/default-skills',{recursive:true,filter:s=>!s.endsWith('.ts')}) \" && node -e \" require('fs').cpSync('src/core/proxy/hermes-profile-relay.py','dist/core/proxy/hermes-profile-relay.py') \" " ,
25 "check:isolation" : "node scripts/check-adapter-isolation.mjs" ,
26 "build:plugin" : "node scripts/build-plugin.mjs" ,
27 "build:all" : "npm run build && node scripts/minify-dist.mjs && npm run build:plugin" ,
28 "dev" : "npm run build && node dist/grix.js" ,
29 "test" : "node --experimental-vm-modules node_modules/vitest/vitest.mjs run" ,
30 "test:watch" : "node --experimental-vm-modules node_modules/vitest/vitest.mjs" ,
31 "test:e2e" : "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e" ,
32 "test:e2e:smoke" : "RUN_REAL_AGENT_E2E=1 node --experimental-vm-modules node_modules/vitest/vitest.mjs run tests/e2e/smoke.test.ts" ,
33 "lint" : "npm run check:isolation && tsc --noEmit" ,
34 "start" : "node dist/grix.js start" ,
35 "stop" : "node dist/grix.js stop" ,
36 "restart" : "node dist/grix.js restart" ,
37 "status" : "node dist/grix.js status"
Lines 3038-3078 javascript
3038 function formatCommandFailure ( result ) {
3039 const parts = [ String (result.stderr ?? "" ). trim (), String (result.stdout ?? ""
dist/core/proxy/crypto/certificate.js View file Lines 1-6 javascript
1 import {createHash as x,createPrivateKey as G,createPublicKey as V,generateKeyPairSync as I,sign as z} from "node:crypto" ; import {existsSync as b} from "node:fs" ; import {mkdir as J,readFile as
dist/adapter/openhuman/openhuman-adapter.js View file Lines 1-9 javascript
1 import {EventEmitter as m} from "node:events" ; import {stat as I} from "node:fs/promises" ; import {mkdirSync as g} from "node:fs" ; import {homedir as u} from "node:os" ;
Lines 1-2 javascript
1 import {readFile as _} from "node:fs/promises" ; import {existsSync as m} from "node:fs" ; import {homedir as h} from "node:os" ; import {join as u} from "node:path" ;
Lines 1-3 javascript
1 import {execFile as f} from "node:child_process" ; import {promisify as y} from "node:util" ; import {log as g} from "../log/logger.js" ; import {probeUrls as h} from "./speed-test.js" ;
dist/adapter/claude/claude-adapter.js View file Lines 1-21 javascript
1 import {spawn as G,spawnSync as De,execSync as Q,execFile as xe} from "node:child_process" ; import {promisify as Me} from "node:util" ; import {randomUUID as H} from "node:crypto" ; import
dist/core/proxy/hermes-profile-relay.py View file • path = dist/core/proxy/hermes-profile-relay.py
kind = build_helper
sizeBytes = 21259
magicHex = [redacted]
Medium Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist/core/proxy/hermes-profile-relay.py View on unpkg ).
trim
()].
filter
(Boolean).
flatMap
((
text
)
=>
text.
split
(
/
\r
?
\n
/
)).
map
((
line
)
=>
line.
trim
()).
filter
(Boolean);
3040 if (parts. length > 0 ) {
3041 return parts. at ( - 1 ) ?? "unknown error" ;
3043 if (result.signal) {
3044 return `signal=${ result . signal }` ;
3046 if (result.code !== null ) {
3047 return `exit code ${ result . code }` ;
3049 return result.termination || "unknown failure" ;
3051 function resolveOpenClawCliArgvPrefix () {
3052 const execPath = String (process.execPath ?? "" ). trim ();
3053 const scriptPath = String (process.argv[ 1 ] ?? "" ). trim ();
3054 if (execPath && scriptPath) {
3055 return [execPath, scriptPath];
3057 return [ "openclaw" ];
3059 function buildExecApprovalResolveArgv ( params ) {
3060 const cliArgvPrefix = params.cliArgvPrefix && params.cliArgvPrefix. length > 0 ? params.cliArgvPrefix : resolveOpenClawCliArgvPrefix ();
3061 const timeoutMs = Math. max ( 1e3 , Math. floor (params.timeoutMs ?? 15e3 ));
3066 "exec.approval.resolve" ,
3073 decision: params.decision
3077 async function submitExecApprovalDecision ( params ) {
3078 const runner = resolveCommandRunner ({
Lines 3087-3127 javascript
3089 const result = await runner (argv, { timeoutMs });
3090 if (result.termination !== "exit" || result.code !== 0 ) {
3091 throw new Error ( formatCommandFailure (result));
3095 // src/openclaw/runtime.ts
3097 function setAibotRuntime ( next ) {
3100 function getAibotRuntime () {
3102 throw new Error ( "Aibot runtime not initialized" );
3107 // src/openclaw/gateway-provider.ts
3108 import { execFile } from "node:child_process" ;
3109 import { readFile, writeFile as writeFile2, mkdir as mkdir2, unlink as unlink2 } from "node:fs/promises" ;
High Child Process
Package source references child process execution.
openclaw-plugin/index.js View on unpkg · L3107 3110 import { existsSync } from "node:fs" ;
3111 import { homedir as homedir4 } from "node:os" ;
3112 import { dirname as dirname2, join as join3 } from "node:path" ;
3113 import { promisify } from "node:util" ;
3114 var execFileAsync = promisify (execFile);
3115 var CLI_TIMEOUT_MS = 3e4 ;
3116 var GRIX_PROVIDER_ID = "grix" ;
3117 function stateDir () {
3118 const explicit = process.env. OPENCLAW_STATE_DIR ?. trim ();
3119 if (explicit) return explicit;
3120 const cfg = process.env. OPENCLAW_CONFIG_PATH ?. trim ();
3121 if (cfg) return dirname2 (cfg);
3122 return join3 ( homedir4 (), ".openclaw" );
3124 function sidecarPath () {
3125 return join3 ( stateDir (), ".grix-relay-state.json" );
3127 async function runOpenClaw ( args , stdin ) {
Z,writeFile
as
T}
from
"node:fs/promises"
;
import
{isIP
as
q}
from
"node:net"
;
import
{join
as
_}
from
"node:path"
;
import
{createSecureContext
as
W}
from
"node:tls"
;
const
X
=
"root-ca-cert.pem"
,
Q
=
"root-ca-key.pem"
,
p
=
"Grix Proxy Root CA"
,
v
=
30
,
ee
=
3650
,
C
=
2048
,
te
=
"1.3.6.1.5.5.7.3.1"
,
re
=
"1.2.840.113549.1.1.11"
,
ne
=
"2.5.4.3"
,
B
=
"2.5.29.19"
,
E
=
"2.5.29.15"
,
oe
=
"2.5.29.37"
,
ie
=
"2.5.29.17"
,
D
=
"2.5.29.14"
,
ce
=
"2.5.29.35"
;
function
fe
(
e
){
if
(e
<
12
...
2 `)??"";return` ----- BEGIN ${e} -----
Low Weak Crypto
Package source references weak cryptographic algorithms.
dist/core/proxy/crypto/certificate.js View on unpkg · L1 5 `}function h(e){const t=e.export({format:"der",type:"spki"});return x("sha1").update(t).digest()}function R(){const e=x("sha256").update(Buffer.from(` ${Date.now()} - ${Math.random()} `)).digest().subarray(0,16);return e[0]=(e[0]??0)&127,e}function k(e,t){return new Date(e.getTime()+t*24*60*60*1e3)}function Y(e){return o(N(e))}function j(e){const t=e.length===0?0:Math.max(...e),r=Math.floor(t/8)+1,n=Buffer.alloc(Math.max(r,1),0);for(const i of e){const s=Math.floor(i/8),c=7-i%8;n[s]=(n[s]??0)|1<<c}return K(n)}function de(e){return o(...e.map(t=>S(t)))}function ge(e){return o(l(0,e))}function F(e){ ...
Long lines were clipped for display.
import
{join
as
p,resolve
as
_}
from
"node:path"
;
import
{fileURLToPath
as
k}
from
"node:url"
;
import
{randomUUID
as
E}
from
"node:crypto"
;
import
{resolveCommandPath
as
x,spawnCommand
as
w,killProcessGroup
as
f,hasChildProcesses
as
S}
from
"../../core/runtime/spawn.js"
;
import
{InternalApiServer
as
b}
from
"../../core/mcp/internal-api-server.js"
;
import
{syncDefaultSkillsToDir
as
y}
from
"../../default-skills/index.js"
;
import
{buildSimpleProbeReport
as
$}
from
"../sha ..
.
2 `);i("sqlite3",[s,l],{timeout:1e4,stdio:"ignore"}),n.info("openhuman-adapter",` MCP server registered in SQLite : ${s} `);const c=p(u(),".openhuman","skills"),h=y(c);h.length>0&&n.info("openhuman-adapter",` Synced connector skills to ${c}: [${h.join( ", " )}] `)}catch(t){n.warn("openhuman-adapter",` Failed to inject MCP tools (non-fatal): ${t instanceof Error?t.message: String (t)} `)}}async spawnProcess(t,e){const s=this.config.command||"openhuman-core",i=x(s,typeof process.env.PATH=="string"?process.env.PATH:void 0),r=this.config.args??[],l=r.includes("run")||r.includes("serve")?r:["run","--host",t,"-- ...
3 ` ) + `
High Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/adapter/openhuman/openhuman-adapter.js View on unpkg · L1 5 ` + e),this.identity.injectOnce(t.adapterSessionId,e)} buildPromptTextFromEvent (t){let e = t.content || "" ; if (t.context_messages_json)try{const s = JSON . parse (t.context_messages_json);Array. isArray (s) && s. length > 0 && (e = s. map ( r => `[context] ${ r . sender_id ?? "unknown"}: ${ r . content }` ). join ( `
8 ` + e)}catch{}return this .identity. injectOnce (t.session_id,e)}}export{nt as OpenHumanAdapter };
Long lines were clipped for display.
import
{execFile
as
I}
from
"node:child_process"
;
import
{promisify
as
O}
from
"node:util"
;
const
f
=
O
(
I
),
N
=
[
u
(
h
(),
".aws/sso/cache/kiro-auth-token-cli.json"
),
u
(
h
(),
".aws/sso/cache/kiro-auth-token.json"
)],
R
=
"https://codewhisperer.us-east-1.amazonaws.com"
,
b
=
"AmazonCodeWhispererService.GetUsageLimits"
,
S
=
1e4
,
E
=
"kirocli:odic:token"
,
C
=
"kirocli:odic:device-registration"
;
async
function
x
(
t
){
try
{
const
{
stdout
:
r
}
=await
f
(
"security"
,[
"find-generic-password"
,
"-s"
,t,
"-w"
...
High Command Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/core/provider-quota/kiro.js View on unpkg · L1 Long lines were clipped for display.
const
w
=
y
(f),
T
=
1e4
,
c
=
[{id:
"official"
,label:
"npm
\u5B98\u65B9
"
,url:
"https://registry.npmjs.org"
},{id:
"npmmirror"
,label:
"npmmirror (
\u6DD8\u5B9D\u955C\u50CF
)"
,url:
"https://registry.npmmirror.com"
}];
async
function
x
(){
const
t
=await
h
(c.
map
(
r
=>
({url:r.url,label:r.label})),
5e3
),
e
=
[];
for
(
const
r
of
t)
if
(r.reachable){
const
n
=
c.
find
(
o
=>
o.url
===
r.url);n
&&
e.
push
(n)}
for
(
const
r
of
t)
if
(
!
r.reachable){
const
n
=
c.
find
(
o
=>
o.url
===
r.url);n
&&!
e.in
...
2 ${m ?? "" } `.trim())})})}function S(t){return c.map(e=>({label:e.label,command:` npm install - g ${t} -- registry ${e.url} `}))}export{c as NPM_REGISTRIES,U as getCurrentRegistry,S as getMirrorInstallCommands,I as isRetriableRegistryError,M as isTransientInstallError,A as npmInstallWithMirror,x as probeRegistries};
High Sandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/core/installer/npm-registry.js View on unpkg · L1 Long lines were clipped for display.
{killProcessGroup
as
N,hasChildProcesses
as
Le}
from
"../../core/runtime/spawn.js"
;
import
{readdirSync
as
re,readFileSync
as
j,realpathSync
as
Oe,rmSync
as
Fe,statSync
as
L,truncateSync
as
Ne,existsSync
as
k,openSync
as
je,writeSync
as
Ue,closeSync
as
qe,renameSync
as
He,mkdirSync
as
Be,constants
as
ae,watch
as
Je}
from
"node:fs"
;
import
{mkdir
as
O,readFile
as
w,rm
as
oe,stat
as
le,writeFile
as
A}
from
"node:fs/promises"
;
import
{jo ...
2 `):"No skills found",data:n}}catch(n){return{status:"failed",message:` Failed to scan skills: ${n instanceof Error?n.message:n} `}}if(!this.claudeProcess&&!this.claudePty)if(e==="compact"){try{await this.ensureClaudeProcessReady()}catch(n){return{status:"failed",message:` Failed to start Claude for compact: ${n instanceof Error?n.message:n} `}}if(await new Promise(n=>setTimeout(n,2e3)),!this.claudeProcess&&!this.claudePty)return{status:"failed",message:"Claude process exited during startup"}}else return{status:"failed",message:"Claude process is not running"};if(this.getStatus().busy)return{status ...
3 ` )}finally{qe(r)}}else this.claudeProcess?.stdin?.write( `${ s }
4 ` );if(e=== "compact" ){const n=new Promise(a=>{this.compactionDoneResolver=a});this.beginCompaction();const r=await n;return r=== "process-exit" ?{status: "failed" ,message: "Claude exited during compaction" }:r=== "stopped" ?{status: "failed" ,message: "Adapter stopped during compaction" }:{status: "ok" ,message: "Compacted" }}return{status: "ok" ,message: `Sent: ${s}` }}catch(n){return{status: "failed" ,message: `Failed to send: ${n instanceof Error?n.message:n}` }}}handleStatusLineUpdate(e){try{const t=e.context_window,i=e.cost,s=e.model,n=e.rate_limits??e.rateLimits,r=t?.current_usage;if(this.sessionState={contextW ...
5 `)}buildLostHistoryRecoveryPrompt(e){return[ "\u26A0\uFE0F \u672C\u4F1A\u8BDD\u7684\u672C\u5730\u5386\u53F2\u8BB0\u5F55\u5DF2\u4E22\u5931\uFF0C\u65E0\u6CD5\u7EED\u63A5\u4E4B\u524D\u7684\u4E0A\u4E0B\u6587\u3002\u4E0D\u8981\u5047\u88C5\u8BB0\u5F97\u4E4B\u524D\u804A\u8FC7\u7684\u5185\u5BB9\u3002" , "\u8BF7\u6309\u4EE5\u4E0B\u4E24\u6B65\u5904\u7406\uFF1A" , "\u7B2C\u4E00\u6B65\uFF1A\u7528 AskUserQuestion \u5DE5\u5177\u95EE\u7528\u6237\u5982\u4F55\u7EE7\u7EED\uFF0C\u63D0\u4F9B\u4E24\u4E2A\u9009\u9879\uFF1A" ," \u2460 \u65B0\u5EFA\u8BDD\u9898\u2014\u2014\u653E\u5F03\u65E7\u4E0A\u4E0B\u6587\uFF0C\u5F53\u4 ...
6 `)}extractSingleTurnDelta(e){const t=e.trim();if(!t)return "" ;try{const i=JSON.parse(t),s=String(i.type?? "" );if(s=== "content_block_delta" ){const n=i.delta;if(n&&typeof n== "object" ){const r=String(n.text?? "" );if(r)return r}}return s=== "result" ?String(i.result?? "" ):typeof i.text== "string" &&i.text?i.text: "" }catch{return t}}buildClaudeRuntimeEnv(){const e={...process.env,...this.config.env};return delete e.CLAUDECODE,e.CLAUDE_PLUGIN_DATA=E().dataDir,e.GRIX_HOOK_SIGNALS_PATH=this.resolveHookSignalsPath(),this.internalApi&&(e.GRIX_CLAUDE_INTERNAL_API_URL=this.internalApi.baseUrl,e.GRIX_CLAUDE_INTERNA ...
7 `);for(;R>=0;){const Re=x.slice(0,R);x=x.slice(R+1);const ne=this.extractSingleTurnDelta(Re);ne&&(g+=1,C=!0,this.bridgeCallbacks.sendStreamChunk(e.event_id,e.session_id,ne,g,!1,$,e.quoted_message_id)),R=x.indexOf(`
8 `)}}),y.stderr?.setEncoding("utf8"),y.stderr?.on("data",M=>{b.length>=Z||(b+=M,b.length>Z&&(b=b.slice(0,Z)))}),y.on("error",M=>D(M)),y.on("close",M=>{if(x.trim()){const R=this.extractSingleTurnDelta(x);R&&(g+=1,C=!0,this.bridgeCallbacks.sendStreamChunk(e.event_id,e.session_id,R,g,!1,$,e.quoted_message_id))}if(M!==0&&!C){const R=b.trim();D(new Error(R||` claude single-turn exited with code ${M} `));return}g+=1,this.bridgeCallbacks.sendStreamChunk(e.event_id,e.session_id,"",g,!0,$,e.quoted_message_id),P()})}),this.activeEvent?.eventId===e.event_id&&(this.bridgeCallbacks.sendEventResult(e.event_id, ...
10 Error: Claude authentication failed -- please re-login` ,1,!1),this.bridgeCallbacks.sendEventResult(this.activeEvent.eventId, "failed" , "Claude authentication failed -- please re-login" ),this.clearActiveEvent())),ht.some(t=>t.test(e))&&(o.error( "claude-adapter" , `Usage limit: ${ e }` ),this.usageLimitUntil=Date.now()+fe,this.activeEvent&&(this.bridgeCallbacks.sendStreamChunk(this.activeEvent.eventId,this.activeEvent.sessionId, `
12 Error: Claude usage limit reached -- waiting for reset` ,1,!1),this.bridgeCallbacks.sendEventResult(this.activeEvent.eventId, "failed" , "Claude usage limit reached -- waiting for reset" ),this.clearActiveEvent())),pt.test(e)&&this.activeEvent&&(o.error( "claude-adapter" , `API format error (400 server_tool_use.id): ${ e . slice ( 0 , 200 ) }` ),this.activeEvent.apiFormatError=!0)}async ensureClaudePluginDir(){const e=this.resolveProjectRoot(),t=h(E().dataDir, "claude-plugin" ),i=h(t, ".claude-plugin" ),s=h(i, "plugin.json" ),n=h(e, ".claude-plugin" , "plugin.json" );await O(i,{recursive:!0});let r= "" ;try{r=await w(n,"ut ...
13 `}let a="";try{a=await w(s,"utf8")}catch{}a!==r&&(await A(s,r,"utf8"),o.info("claude-adapter",` Wrote Claude plugin manifest: ${s} `));const c=h(e,"dist","scripts"),l=P=>`"${String(P).replace(/" /g, ' \\ "' )} "`,u=P=>`${l(process.execPath)} ${l(h(c,P))}`,p=`${JSON.stringify({hooks:{SessionStart:[{hooks:[{type:" command ",command:u(" lifecycle-hook.js ")}]}],Elicitation:[{hooks:[{type:" command ",command:u(" elicitation-hook.js "),timeout:630}]}],ElicitationResult:[{matcher:"",hooks:[{type:" command ",command:u(" lifecycle-hook.js ")}]}],UserPromptSubmit:[{hooks:[{type:" command ",command:u(" user-prompt-submit-hook ...
High Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/adapter/claude/claude-adapter.js View on unpkg · L1 14 `,f=h(t,"hooks"),m=h(f,"hooks.json");await O(f,{recursive:!0});let S="";try{S=await w(m,"utf8")}catch{}S!==p&&(await A(m,p,"utf8"),o.info("claude-adapter",` Wrote Claude hooks config: ${m} `));const v=h(t,"skills"),T=st(v);return T.length>0&&o.info("claude-adapter",` Synced connector skills to plugin: [${T.join( ", " )}] `),t}async ensureStdioMcpServer(){const e=this.resolveProjectRoot(),t=this.resolveStdioServerPath(e);if(this.ensureStdioServerArtifact(e,t),!k(t))throw new Error(` MCP stdio server entry point not found: ${t} `);const i=this.getInternalApiUrl(),s=this.notifyPort,n=[t,"--handle-url",i, ...
15 ` ; "write" in t?t.write(i):t.write(i,()=>{}),o.info( "claude-adapter" , `Deferred model switch: /model ${ e }` )}catch{}},3e3)}async waitForWindowsChannelReady(e){const t=Date.now();let i=!1;const s=setInterval(()=>{if(this.startupChannelListening){clearInterval(s);return}try{this.claudePty?(this.claudePty.write( "\r" ),i||(o.info( "claude-adapter" , "Windows PTY: sending Enter to auto-confirm dev channels dialog" ),i=!0)):this.claudeProcess?.stdin?.writable&&(this.claudeProcess.stdin.write( "\r" ),i||(o.info( "claude-adapter" , "Windows shell: sending Enter to auto-confirm dev channels dialog" ),i=!0))}catch{}}, ...
16 `)}),this.notifySocket.on("error",s=>{o.error("claude-adapter",` Notify socket error: ${s.message} `),this.notifySocket=null}),this.notifySocket.on("close",()=>{this.notifySocket=null})):this.notifySocket.write(i+`
17 `)}stopMcpServer(){if(this.mcpServerReady=!1,this.notifySocket){try{this.notifySocket.destroy()}catch{}this.notifySocket=null}if(this.mcpServerProcess){try{this.mcpServerProcess.kill("SIGTERM")}catch{}this.mcpServerProcess=null}}releaseNotifyPortReservation(){Dt(this.notifyPort),this.notifyPort=0}killClaudeProcess(e){const t=this.claudeProcess,i=this.claudePty,s=this.claudeChildPid;if(this.claudeProcess=null,this.claudePty=null,this.claudeChildPid=0,this.spawnPromise=null,this.alive=!1,this.stopMcpServer(),this.releaseNotifyPortReservation(),this.mcpChannelBroken=!1,this.channelGateClosed=!1,t ...
18 ` ;await A(n,l, "utf8" ),o.info( "claude-adapter" , `Injected statusLine settings: ${ n }` )}catch(t){o.warn( "claude-adapter" , `Failed to inject statusLine settings: ${t instanceof Error?t.message:t}` )}}async ensureUserMcpServer(e,t,i){const s=this.resolveServerEntryPath(t),n=process.execPath,r=[s],a=h(I(), ".claude.json" );let c=null;try{const f=await w(a, "utf8" );c=JSON.parse(f)?.mcpServers?.[F]??null}catch{}if(c&&String(c.type|| "stdio" ).trim()=== "stdio" &&String(c.command?? "" ).trim()===n&&Array.isArray(c.args)&&c.args.length===r.length&&c.args.every((f,m)=>f===r[m]))return;o.info( "claude-adapter" , `Regist ...
20 Error: MCP server startup failed` ,1,!1),this.bridgeCallbacks.sendEventResult(e, "failed" , "MCP server startup failed" ),this.completedEventIds.set(e,Date.now()),this.clearActiveEvent()}}}class Lt extends ce{adapterSessionId;constructor(e){super(),this.adapterSessionId=e}emitDone(e){this.emit( "done" ,e)}emitError(e){if(this.listenerCount( "error" )===0){o.warn( "claude-adapter" , `Prompt handle error (no listeners): ${e.message}` );return}this.emit( "error" ,e)}async cancel(){}}function _(d){if(d==null)return 0;const e=Number(d);return Number.isFinite(e)?e:0}function z(d){return String(d).replace(/\\/g,"\\ ...
21 `),"utf8"),{expectPath:i,pidPath:s}}async function Ft(d,e=50,t=100){for(let i=0;i<e;i++){try{const s=await w(d,"utf8"),n=parseInt(String(s).trim(),10);if(Number.isFinite(n)&&n>0)return n}catch{}await new Promise(s=>setTimeout(s,t))}return 0}function Nt(d,e){return new Promise((t,i)=>{let s=!1;const n=a=>{s||(s=!0,d.off("error",r),a())},r=a=>n(()=>i(a));d.once("error",r),Ft(e).then(a=>n(()=>t(a))).catch(a=>n(()=>i(a)))})}function Ie(d){return d.replace(/[/\\]/g,"-")}function jt(d){const e=E();return h(e.dataDir,"claude-mcp-configs",` ${Ie(d)}. json `)}function Ut(d){const e=E();return h(e.dataDir, ...
Long lines were clipped for display.
• matchType = previous_version_dangerous_delta
matchedPackage = grix-connector@3.1.17
matchedIdentity = npm:Z3JpeC1jb25uZWN0b3I:3.1.17
similarity = 0.425
summary = stored previous version shares package body but lacks this dangerous source file
Critical Previous Version Dangerous Delta
This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
dist/adapter/claude/claude-adapter.js View on unpkg