registry / loomctl / 0.17.0

loomctl@0.17.0

Orchestrate a fleet of real Claude Code agents on your Claude subscription (Pro/Max), not per-token API bills — durable sessions, multi-agent orchestration, all local-first on your own machine.

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `loom` commands, starts a Loom session, or invokes `loom service install`.

Impact

Can alter Claude project trust/settings and execute dependency lifecycle scripts in Loom-created worktrees; no unconsented npm-install attack was found.

Mechanism

Claude-agent orchestration with project configuration, local service registration, and worktree dependency provisioning.

Rationale

The package is not malicious by the stated boundary because it has no lifecycle trigger or concrete stealth attack chain. Its explicit runtime AI-agent control, project configuration writes, and worktree installs create a real dangerous-capability risk that should be warned.

Evidence

package.jsonbin/loom.mjsbin/service.mjsdist/pty/claude-config.jsdist/pty/claude-settings.jsdist/skills/inject.jsdist/git/worktrees.jsdist/orchestration/usage-status.js~/.claude.json~/.claude/.credentials.json<project>/.claude/skills<project>/.git/info/exclude~/.config/systemd/user/loom.service~/Library/LaunchAgents/com.loom.daemon.plist~/.loom/service/Loom.xml

Network endpoints2

127.0.0.1api.anthropic.com/api/oauth/usage

Decision evidence

public snapshot

AI called this Suspicious at 87.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/pty/claude-config.js` writes trust flags to `~/.claude.json` before spawned sessions.
`dist/skills/inject.js` copies Loom skills into project `.claude/skills` and updates `.git/info/exclude`.
`dist/orchestration/usage-status.js` reads `~/.claude/.credentials.json` and sends its OAuth token to Anthropic's usage endpoint.
`dist/git/worktrees.js` runs detected package-manager installs/builds inside Loom-created user worktrees.
`bin/service.mjs` creates per-user autostart artifacts only via explicit `loom service install`.

Evidence against

`package.json` contains no `preinstall`, `install`, `postinstall`, or `prepare` lifecycle hook.
`bin/loom.mjs` only contacts the local daemon at `127.0.0.1` for management.
Credential use is package-aligned usage polling to `https://api.anthropic.com/api/oauth/usage`, not a third-party endpoint.
No eval, remote-payload download/execution, or hidden install-time mutation was confirmed.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 128 file(s), 3.78 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.telegram.org, github.com, react.dev, registry.npmjs.org, schemas.microsoft.com, www.w3.org

Source & flagged code

9 flagged

bin/loom.mjsView file

Lines 1-42javascript

1#!/usr/bin/env node

2// The public `loom` CLI — a small MANAGEMENT CLI over the single-process daemon (which serves the

3// prebuilt web viewport from its own loopback origin — Releases v1 Part 1).

4//

5// loom start the daemon in the FOREGROUND + open the browser (backward-compatible:

6// byte-identical to the original bare `loom`; same as `loom start`)

7// loom start [-d] start the daemon. --detach/-d backgrounds it + writes a PID file

8// loom stop gracefully stop a running (detached) daemon + clean the PID file

9// loom status report running/stopped + version + URL + PID (exit non-zero if not running)

10// loom restart stop, then start (honors --detach/--port/--no-open)

11// loom open open the browser to a running daemon

12// loom update [--channel stable|beta]

13// upgrade in place (npm i -g loomctl@<dist-tag>) + restart the daemon

14//

15// This file is shipped at <pkg>/bin/loom.mjs and the daemon at <pkg>/dist/index.js — the assembled npm

16// package layout (see scripts/build-npm-package.mjs). It is NOT meant to run from the monorepo source

17// tree (there is no <repo-root>/dist); use `pnpm daemon` for dev.

18import { pathToFileURL, fileURLToPath } from "node:url";

19import path from "node:path";

20import os from "node:os";

21import fs from "node:fs";

22import http from "node:http";

23import { spawn, spawnSync } from "node:child_process";

24import { CHANNELS, isValidChannel, installSpecFor, readChannel, writeChannel } from "./update-config.mjs";

High

Child Process

Package source references child process execution.

bin/loom.mjsView on unpkg · L22

26// UV_THREADPOOL_SIZE (task dea6728e, defense-in-depth): the default libuv pool is only 4 threads, so a

27// small handful of wedged fs ops could starve fs/dns/crypto process-wide. `startDetached`/`loom service`

28// spawn a FRESH node process for the daemon, where setting this on that child's env reliably works.

29// `startForeground` instead runs the daemon IN-PROCESS (the OS-service path: `loom start --no-open`) via

30// a dynamic import — by the time that import runs, this process's own ESM module loading has likely

31// already touched the threadpool, so this assignment is BEST-EFFORT for that path only, never a

32// guarantee (libuv reads the env var once, lazily, on first threadpool use — there is no in-process way

33// to resize it after the fact). Never overrides an operator's own explicit setting.

34if (!process.env.UV_THREADPOOL_SIZE) process.env.UV_THREADPOOL_SIZE = "16";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/loom.mjsView on unpkg · L21

36const here = path.dirname(fileURLToPath(import.meta.url));

37const pkgRoot = path.resolve(here, ".."); // the installed `loom` package root (holds the umbrella package.json)

38const DEFAULT_PORT = 4317;

39const SUBCOMMANDS = new Set(["start", "stop", "status", "restart", "open", "service", "update"]);

40const SERVICE_ACTIONS = new Set(["install", "uninstall", "status"]);

42function readVersion() {

Lines 250-290javascript

250

251function resolveDaemonEntry() {

252 const daemonEntry = path.join(pkgRoot, "dist", "index.js");

253 if (!fs.existsSync(daemonEntry)) {

254 console.error(`loom: daemon entry not found at ${daemonEntry}

255This package looks incomplete (was it built/assembled with scripts/build-npm-package.mjs?).`);

Lines 429-469javascript

429 const rec = readPidFile();

430 const port = explicitPort ?? rec?.port ?? (process.env.LOOM_PORT ? Number(process.env.LOOM_PORT) : DEFAULT_PORT);

431 const wasRunning = !!(await

dist/mcp/repo-read.jsView file

Lines 42-82javascript

42// (exponential) backtracking pattern like /(a+)+$/: empirically, even a ~25-30 char adversarial input

43// already takes multiple SECONDS and scales exponentially from there, so even a 500-char (MAX_LINE_LEN)

44// clamp never returns unguarded — and normal source lines (~30-120 chars) sit exactly in that danger zone,

45// so there is no length threshold that's both safe and useful. The real boundary is a hard wall-clock

46// ceiling via V8 isolate termination (`vm.runInContext(..., {timeout})`, confirmed by direct testing to

47// interrupt mid-backtrack — unlike a plain synchronous `.test()`, which cannot be preempted once started).

48// That vm crossing is paid ONCE PER FILE, not once per line (a per-line crossing measured ~0.3ms/call —

49// an always-paid tax that would make a broad grep itself slow): `GREP_FILE_TIMEOUT_MS` bounds ONE

50// vm.runInContext call that runs the WHOLE per-file match loop (every clamped line probe against `rx`);

bin/service.mjsView file

Lines 1-30javascript

1// `loom service install | uninstall | status` — register Loom to AUTOSTART in the background on

2// login/boot, on all three OSes. This is the management-CLI companion to bin/loom.mjs (Epic 2b).

3//

4// ARCHITECTURE (decided by the Lead — see the task): END USERS get NO supervisor

5// (scripts/daemon-supervisor.mjs is NOT shipped in the npm package). So the registered OS service runs

6// **`loom start --no-open`** in the FOREGROUND and the OS service manager owns the lifecycle +

7// keep-alive/restart:

8// - Linux : a systemd --user unit (Restart=on-failure, WantedBy=default.target) under

9// ~/.config/systemd/user, enabled+started via `systemctl --user`.

10// - macOS : a launchd LaunchAgent plist (RunAtLoad + KeepAlive) under ~/Library/LaunchAgents,

dist/git/worktrees.jsView file

Lines 72-112javascript

72/**

73 * Bound on the captured stdout+stderr TAIL kept per provisioning child — enough to diagnose a real

74 * failure (the actual tool error, e.g. an npm/pnpm/yarn error block) without letting a noisy/failing

75 * install grow the buffer unboundedly in memory before the child is killed or exits. Mirrors the

76 * markitdown provisioning-status pattern's captured ~4KB error tail (see CLAUDE.md).

77 */

78const OUTPUT_TAIL_MAX_CHARS = 4000;

79/** Append `chunk` to `tail`, keeping only the LAST {@link OUTPUT_TAIL_MAX_CHARS

assets/python/synthesize.pyView file

•path = assets/python/synthesize.py kind = build_helper sizeBytes = 11311 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/python/synthesize.pyView on unpkg

dist/pty/host.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = loomctl@0.15.0 matchedIdentity = npm:bG9vbWN0bA:0.15.0 similarity = 0.505 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/pty/host.jsView on unpkg

Source & flagged code

9 flagged · loading source

bin/loom.mjsView file

22import http from "node:http"; L23: import { spawn, spawnSync } from "node:child_process"; L24: import { CHANNELS, isValidChannel, installSpecFor, readChannel, writeChannel } from "./update-config.mjs";

High

Child Process

Package source references child process execution.

bin/loom.mjsView on unpkg · L22

449// no shell-injection surface. L450: const r = spawnSync("npm", ["i", "-g", spec], { stdio: "inherit", shell: true }); L451: if (r.error || r.status !== 0) {

High

Shell

Package source references shell execution.

bin/loom.mjsView on unpkg · L449

21import fs from "node:fs"; L22: import http from "node:http"; L23: import { spawn, spawnSync } from "node:child_process"; L24: import { CHANNELS, isValidChannel, installSpecFor, readChannel, writeChannel } from "./update-config.mjs"; ... L33: // to resize it after the fact). Never overrides an operator's own explicit setting. L34: if (!process.env.UV_THREADPOOL_SIZE) process.env.UV_THREADPOOL_SIZE = "16"; L35:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/loom.mjsView on unpkg · L21

270// readiness. L271: await import(pathToFileURL(daemonEntry).href); L272:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/loom.mjsView on unpkg · L270

dist/mcp/repo-read.jsView file

62for (let i = 0; i < s.length; i++) L63: if (s.charCodeAt(i) === 0) L64: return true;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/mcp/repo-read.jsView on unpkg · L62

bin/service.mjsView file

10// - macOS : a launchd LaunchAgent plist (RunAtLoad + KeepAlive) under ~/Library/LaunchAgents, L11: // loaded via `launchctl`. L12: // - Windows: a Task Scheduler logon task (schtasks /create /xml) running at logon — no admin / no ... L22: import path from "node:path"; L23: import { spawnSync } from "node:child_process"; L24: ... L74: // launchd LaunchAgent plist. RunAtLoad starts it when the agent is loaded at login; KeepAlive restarts L75: // it if it exits (the keep-alive). Stdout/stderr go to a log under LOOM_HOME so a background boot stays L76: // debuggable. ... L118: return `<?xml version="1.0" encoding="UTF-16"?> L119: <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> L120: <RegistrationInfo>

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/service.mjsView on unpkg · L10

dist/git/worktrees.jsView file

92/** L93: * Run a BOUNDED, NON-INTERACTIVE `pnpm install --frozen-lockfile --prefer-offline` in `worktreePath`, L94: * killing the child if it exceeds `timeoutMs`. ASYNC (child_process.spawn, NOT spawnSync) on purpose: L95: * createWorktree is awaited on the worker-spawn hot path, and a synchronous spawnSync would freeze the

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/git/worktrees.jsView on unpkg · L92

assets/python/synthesize.pyView file

•path = assets/python/synthesize.py kind = build_helper sizeBytes = 11311 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/python/synthesize.pyView on unpkg

dist/pty/host.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/pty/host.jsView on unpkg

Findings

1 Critical4 High7 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/pty/host.js

HighChild Processbin/loom.mjs

HighShellbin/loom.mjs

HighSame File Env Network Executionbin/loom.mjs

HighRuntime Package Installdist/git/worktrees.js

MediumDynamic Requirebin/loom.mjs

MediumUnsafe Vm Contextdist/mcp/repo-read.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/service.mjs

MediumShips Build Helperassets/python/synthesize.py

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings