registry / loomctl / 0.15.0

loomctl@0.15.0

Orchestrate a fleet of real Claude Code agents on your Claude subscription (Pro/Max), not per-token API bills — durable sessions, multi-agent orchestration, all local-first on your own machine.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 105 file(s), 2.88 MB of source, external domains: 127.0.0.1, api.anthropic.com, github.com, react.dev, registry.npmjs.org, schemas.microsoft.com, www.w3.org

Source & flagged code

6 flagged

bin/loom.mjsView file

Lines 1-42javascript

1#!/usr/bin/env node

2// The public `loom` CLI — a small MANAGEMENT CLI over the single-process daemon (which serves the

3// prebuilt web viewport from its own loopback origin — Releases v1 Part 1).

4//

5// loom start the daemon in the FOREGROUND + open the browser (backward-compatible:

6// byte-identical to the original bare `loom`; same as `loom start`)

7// loom start [-d] start the daemon. --detach/-d backgrounds it + writes a PID file

8// loom stop gracefully stop a running (detached) daemon + clean the PID file

9// loom status report running/stopped + version + URL + PID (exit non-zero if not running)

10// loom restart stop, then start (honors --detach/--port/--no-open)

11// loom open open the browser to a running daemon

12// loom update [--channel stable|beta]

13// upgrade in place (npm i -g loomctl@<dist-tag>) + restart the daemon

14//

15// This file is shipped at <pkg>/bin/loom.mjs and the daemon at <pkg>/dist/index.js — the assembled npm

16// package layout (see scripts/build-npm-package.mjs). It is NOT meant to run from the monorepo source

17// tree (there is no <repo-root>/dist); use `pnpm daemon` for dev.

18import { pathToFileURL, fileURLToPath } from "node:url";

19import path from "node:path";

20import os from "node:os";

21import fs from "node:fs";

22import http from "node:http";

23import { spawn, spawnSync } from "node:child_process";

24import { CHANNELS, isValidChannel, installSpecFor, readChannel, writeChannel } from "./update-config.mjs";

High

Child Process

Package source references child process execution.

bin/loom.mjsView on unpkg · L22

26// UV_THREADPOOL_SIZE (task dea6728e, defense-in-depth): the default libuv pool is only 4 threads, so a

27// small handful of wedged fs ops could starve fs/dns/crypto process-wide. `startDetached`/`loom service`

28// spawn a FRESH node process for the daemon, where setting this on that child's env reliably works.

29// `startForeground` instead runs the daemon IN-PROCESS (the OS-service path: `loom start --no-open`) via

30// a dynamic import — by the time that import runs, this process's own ESM module loading has likely

31// already touched the threadpool, so this assignment is BEST-EFFORT for that path only, never a

32// guarantee (libuv reads the env var once, lazily, on first threadpool use — there is no in-process way

33// to resize it after the fact). Never overrides an operator's own explicit setting.

34if (!process.env.UV_THREADPOOL_SIZE) process.env.UV_THREADPOOL_SIZE = "16";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/loom.mjsView on unpkg · L21

36const here = path.dirname(fileURLToPath(import.meta.url));

37const pkgRoot = path.resolve(here, ".."); // the installed `loom` package root (holds the umbrella package.json)

38const DEFAULT_PORT = 4317;

39const SUBCOMMANDS = new Set(["start", "stop", "status", "restart", "open", "service", "update"]);

40const SERVICE_ACTIONS = new Set(["install", "uninstall", "status"]);

42function readVersion() {

Lines 250-290javascript

250

251function resolveDaemonEntry() {

252 const daemonEntry = path.join(pkgRoot, "dist", "index.js");

253 if (!fs.existsSync(daemonEntry)) {

254 console.error(`loom: daemon entry not found at ${daemonEntry}

255This package looks incomplete (was it built/assembled with scripts/build-npm-package.mjs?).`);

Lines 429-469javascript

429 const rec = readPidFile();

430 const port = explicitPort ?? rec?.port ?? (process.env.LOOM_PORT ? Number(process.env.LOOM_PORT) : DEFAULT_PORT);

431 const wasRunning = !!(await

bin/service.mjsView file

Lines 1-30javascript

1// `loom service install | uninstall | status` — register Loom to AUTOSTART in the background on

2// login/boot, on all three OSes. This is the management-CLI companion to bin/loom.mjs (Epic 2b).

3//

4// ARCHITECTURE (decided by the Lead — see the task): END USERS get NO supervisor

5// (scripts/daemon-supervisor.mjs is NOT shipped in the npm package). So the registered OS service runs

6// **`loom start --no-open`** in the FOREGROUND and the OS service manager owns the lifecycle +

7// keep-alive/restart:

8// - Linux : a systemd --user unit (Restart=on-failure, WantedBy=default.target) under

9// ~/.config/systemd/user, enabled+started via `systemctl --user`.

10// - macOS : a launchd LaunchAgent plist (RunAtLoad + KeepAlive) under ~/Library/LaunchAgents,

dist/git/worktrees.jsView file

Lines 33-73javascript

33 p.then((v) => { clearTimeout(timer); resolve(v); }, (e) => { clearTimeout(timer); reject(e); });

34 });

35}

36/**

37 * Filesystem- and ref-safe key for a task: 12 hex chars of sha256(taskId). Keyed off the FULL id,

38 * not `taskId.slice(0,8)` — two human-readable task ids sharing the first 8 chars used to collide

39 * onto the same branch/worktree (H1.3). Deterministic, so the SAME task always resolves to the same

Source & flagged code

6 flagged · loading source

bin/loom.mjsView file

22import http from "node:http"; L23: import { spawn, spawnSync } from "node:child_process"; L24: import { CHANNELS, isValidChannel, installSpecFor, readChannel, writeChannel } from "./update-config.mjs";

High

Child Process

Package source references child process execution.

bin/loom.mjsView on unpkg · L22

449// no shell-injection surface. L450: const r = spawnSync("npm", ["i", "-g", spec], { stdio: "inherit", shell: true }); L451: if (r.error || r.status !== 0) {

High

Shell

Package source references shell execution.

bin/loom.mjsView on unpkg · L449

21import fs from "node:fs"; L22: import http from "node:http"; L23: import { spawn, spawnSync } from "node:child_process"; L24: import { CHANNELS, isValidChannel, installSpecFor, readChannel, writeChannel } from "./update-config.mjs"; ... L33: // to resize it after the fact). Never overrides an operator's own explicit setting. L34: if (!process.env.UV_THREADPOOL_SIZE) process.env.UV_THREADPOOL_SIZE = "16"; L35:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/loom.mjsView on unpkg · L21

270// readiness. L271: await import(pathToFileURL(daemonEntry).href); L272:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/loom.mjsView on unpkg · L270

bin/service.mjsView file

10// - macOS : a launchd LaunchAgent plist (RunAtLoad + KeepAlive) under ~/Library/LaunchAgents, L11: // loaded via `launchctl`. L12: // - Windows: a Task Scheduler logon task (schtasks /create /xml) running at logon — no admin / no ... L22: import path from "node:path"; L23: import { spawnSync } from "node:child_process"; L24: ... L74: // launchd LaunchAgent plist. RunAtLoad starts it when the agent is loaded at login; KeepAlive restarts L75: // it if it exits (the keep-alive). Stdout/stderr go to a log under LOOM_HOME so a background boot stays L76: // debuggable. ... L118: return `<?xml version="1.0" encoding="UTF-16"?> L119: <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> L120: <RegistrationInfo>

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/service.mjsView on unpkg · L10

dist/git/worktrees.jsView file

53/** L54: * Run a BOUNDED, NON-INTERACTIVE `pnpm install --frozen-lockfile --prefer-offline` in `worktreePath`, L55: * killing the child if it exceeds `timeoutMs`. ASYNC (child_process.spawn, NOT spawnSync) on purpose: L56: * createWorktree is awaited on the worker-spawn hot path, and a synchronous spawnSync would freeze the

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/git/worktrees.jsView on unpkg · L53

Findings

4 High5 Medium4 Low

HighChild Processbin/loom.mjs

HighShellbin/loom.mjs

HighSame File Env Network Executionbin/loom.mjs

HighRuntime Package Installdist/git/worktrees.js

MediumDynamic Requirebin/loom.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/service.mjs

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings