registry / loomctl / 0.18.0

loomctl@0.18.0

Orchestrate a fleet of real Claude Code agents on your Claude subscription (Pro/Max), not per-token API bills — durable sessions, multi-agent orchestration, all local-first on your own machine.

AI Security Review

scanned 17h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs Loom and starts or resumes an orchestrated Claude session.

Impact

Claude may treat a Loom-managed project as trusted and load Loom-provided project skills without its usual onboarding prompt.

Mechanism

Runtime Claude configuration mutation and PTY-based agent orchestration.

Rationale

The static malicious label is not supported by the inspected install path: there are no lifecycle hooks or unattended install-time mutations. The package does perform user-invoked, security-relevant Claude configuration changes, so it warrants a warning rather than a clean or blocking verdict.

Evidence

package.jsonbin/loom.mjsbin/service.mjsdist/pty/host.jsdist/pty/claude-config.jsdist/skills/inject.js~/.claude.json<cwd>/.claude/skillsdist/index.js

Network endpoints1

127.0.0.1:<port>

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`dist/pty/claude-config.js` atomically writes `~/.claude.json` trust/onboarding flags.
`dist/pty/host.js` calls `ensureTrusted(opts.cwd)` before spawning Claude.
`dist/skills/inject.js` mirrors Loom skills into `<cwd>/.claude/skills`.
`bin/service.mjs` installs user-login persistence only through explicit `loom service install`.
`dist/pty/host.js` launches Claude through a PTY for orchestrated agent sessions.

Evidence against

`package.json` has no `preinstall`, `install`, `postinstall`, or other lifecycle hook.
CLI behavior is user-invoked through `bin/loom.mjs`; no import-time daemon start found.
CLI HTTP probes target loopback `127.0.0.1`, not a hard-coded remote collector.
Reviewed config writes do not add external MCP servers or exfiltrate credentials.
Runtime package-manager use in `dist/git/worktrees.js` provisions user worktrees, not this package's install path.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 144 file(s), 4.27 MB of source, external domains: 127.0.0.1, accounts.google.com, api.anthropic.com, api.telegram.org, github.com, oauth2.googleapis.com, react.dev, registry.npmjs.org, schemas.microsoft.com, www.w3.org

Source & flagged code

9 flagged

bin/loom.mjsView file

Lines 1-42javascript

1#!/usr/bin/env node

2// The public `loom` CLI — a small MANAGEMENT CLI over the single-process daemon (which serves the

3// prebuilt web viewport from its own loopback origin — Releases v1 Part 1).

4//

5// loom start the daemon in the FOREGROUND + open the browser (backward-compatible:

6// byte-identical to the original bare `loom`; same as `loom start`)

7// loom start [-d] start the daemon. --detach/-d backgrounds it + writes a PID file

8// loom stop gracefully stop a running (detached) daemon + clean the PID file

9// loom status report running/stopped + version + URL + PID (exit non-zero if not running)

10// loom restart stop, then start (honors --detach/--port/--no-open)

11// loom open open the browser to a running daemon

12// loom update [--channel stable|beta]

13// upgrade in place (npm i -g loomctl@<dist-tag>) + restart the daemon

14//

15// This file is shipped at <pkg>/bin/loom.mjs and the daemon at <pkg>/dist/index.js — the assembled npm

16// package layout (see scripts/build-npm-package.mjs). It is NOT meant to run from the monorepo source

17// tree (there is no <repo-root>/dist); use `pnpm daemon` for dev.

18import { pathToFileURL, fileURLToPath } from "node:url";

19import path from "node:path";

20import os from "node:os";

21import fs from "node:fs";

22import http from "node:http";

23import { spawn, spawnSync } from "node:child_process";

24import { CHANNELS, isValidChannel, installSpecFor, readChannel, writeChannel } from "./update-config.mjs";

High

Child Process

Package source references child process execution.

bin/loom.mjsView on unpkg · L22

26// UV_THREADPOOL_SIZE (task dea6728e, defense-in-depth): the default libuv pool is only 4 threads, so a

27// small handful of wedged fs ops could starve fs/dns/crypto process-wide. `startDetached`/`loom service`

28// spawn a FRESH node process for the daemon, where setting this on that child's env reliably works.

29// `startForeground` instead runs the daemon IN-PROCESS (the OS-service path: `loom start --no-open`) via

30// a dynamic import — by the time that import runs, this process's own ESM module loading has likely

31// already touched the threadpool, so this assignment is BEST-EFFORT for that path only, never a

32// guarantee (libuv reads the env var once, lazily, on first threadpool use — there is no in-process way

33// to resize it after the fact). Never overrides an operator's own explicit setting.

34if (!process.env.UV_THREADPOOL_SIZE) process.env.UV_THREADPOOL_SIZE = "16";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/loom.mjsView on unpkg · L21

36const here = path.dirname(fileURLToPath(import.meta.url));

37const pkgRoot = path.resolve(here, ".."); // the installed `loom` package root (holds the umbrella package.json)

38const DEFAULT_PORT = 4317;

39const SUBCOMMANDS = new Set(["start", "stop", "status", "restart", "open", "service", "update"]);

40const SERVICE_ACTIONS = new Set(["install", "uninstall", "status"]);

42function readVersion() {

Lines 250-290javascript

250

251function resolveDaemonEntry() {

252 const daemonEntry = path.join(pkgRoot, "dist", "index.js");

253 if (!fs.existsSync(daemonEntry)) {

254 console.error(`loom: daemon entry not found at ${daemonEntry}

255This package looks incomplete (was it built/assembled with scripts/build-npm-package.mjs?).`);

Lines 429-469javascript

429 const rec = readPidFile();

430 const port = explicitPort ?? rec?.port ?? (process.env.LOOM_PORT ? Number(process.env.LOOM_PORT) : DEFAULT_PORT);

431 const wasRunning = !!(await

dist/mcp/repo-read.jsView file

Lines 42-82javascript

42// (exponential) backtracking pattern like /(a+)+$/: empirically, even a ~25-30 char adversarial input

43// already takes multiple SECONDS and scales exponentially from there, so even a 500-char (MAX_LINE_LEN)

44// clamp never returns unguarded — and normal source lines (~30-120 chars) sit exactly in that danger zone,

45// so there is no length threshold that's both safe and useful. The real boundary is a hard wall-clock

46// ceiling via V8 isolate termination (`vm.runInContext(..., {timeout})`, confirmed by direct testing to

47// interrupt mid-backtrack — unlike a plain synchronous `.test()`, which cannot be preempted once started).

48// That vm crossing is paid ONCE PER FILE, not once per line (a per-line crossing measured ~0.3ms/call —

49// an always-paid tax that would make a broad grep itself slow): `GREP_FILE_TIMEOUT_MS` bounds ONE

50// vm.runInContext call that runs the WHOLE per-file match loop (every clamped line probe against `rx`);

bin/service.mjsView file

Lines 1-30javascript

1// `loom service install | uninstall | status` — register Loom to AUTOSTART in the background on

2// login/boot, on all three OSes. This is the management-CLI companion to bin/loom.mjs (Epic 2b).

3//

4// ARCHITECTURE (decided by the Lead — see the task): END USERS get NO supervisor

5// (scripts/daemon-supervisor.mjs is NOT shipped in the npm package). So the registered OS service runs

6// **`loom start --no-open`** in the FOREGROUND and the OS service manager owns the lifecycle +

7// keep-alive/restart:

8// - Linux : a systemd --user unit (Restart=on-failure, WantedBy=default.target) under

9// ~/.config/systemd/user, enabled+started via `systemctl --user`.

10// - macOS : a launchd LaunchAgent plist (RunAtLoad + KeepAlive) under ~/Library/LaunchAgents,

dist/git/worktrees.jsView file

Lines 72-112javascript

72/**

73 * Bound on the captured stdout+stderr TAIL kept per provisioning child — enough to diagnose a real

74 * failure (the actual tool error, e.g. an npm/pnpm/yarn error block) without letting a noisy/failing

75 * install grow the buffer unboundedly in memory before the child is killed or exits. Mirrors the

76 * markitdown provisioning-status pattern's captured ~4KB error tail (see CLAUDE.md).

77 */

78const OUTPUT_TAIL_MAX_CHARS = 4000;

79/** Append `chunk` to `tail`, keeping only the LAST {@link OUTPUT_TAIL_MAX_CHARS

assets/python/synthesize.pyView file

•path = assets/python/synthesize.py kind = build_helper sizeBytes = 11311 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/python/synthesize.pyView on unpkg

dist/pty/host.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = loomctl@0.17.0 matchedIdentity = npm:bG9vbWN0bA:0.17.0 similarity = 0.583 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/pty/host.jsView on unpkg

Source & flagged code

9 flagged · loading source

bin/loom.mjsView file

22import http from "node:http"; L23: import { spawn, spawnSync } from "node:child_process"; L24: import { CHANNELS, isValidChannel, installSpecFor, readChannel, writeChannel } from "./update-config.mjs";

High

Child Process

Package source references child process execution.

bin/loom.mjsView on unpkg · L22

449// no shell-injection surface. L450: const r = spawnSync("npm", ["i", "-g", spec], { stdio: "inherit", shell: true }); L451: if (r.error || r.status !== 0) {

High

Shell

Package source references shell execution.

bin/loom.mjsView on unpkg · L449

21import fs from "node:fs"; L22: import http from "node:http"; L23: import { spawn, spawnSync } from "node:child_process"; L24: import { CHANNELS, isValidChannel, installSpecFor, readChannel, writeChannel } from "./update-config.mjs"; ... L33: // to resize it after the fact). Never overrides an operator's own explicit setting. L34: if (!process.env.UV_THREADPOOL_SIZE) process.env.UV_THREADPOOL_SIZE = "16"; L35:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/loom.mjsView on unpkg · L21

270// readiness. L271: await import(pathToFileURL(daemonEntry).href); L272:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/loom.mjsView on unpkg · L270

dist/mcp/repo-read.jsView file

62for (let i = 0; i < s.length; i++) L63: if (s.charCodeAt(i) === 0) L64: return true;

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/mcp/repo-read.jsView on unpkg · L62

bin/service.mjsView file

10// - macOS : a launchd LaunchAgent plist (RunAtLoad + KeepAlive) under ~/Library/LaunchAgents, L11: // loaded via `launchctl`. L12: // - Windows: a Task Scheduler logon task (schtasks /create /xml) running at logon — no admin / no ... L22: import path from "node:path"; L23: import { spawnSync } from "node:child_process"; L24: ... L74: // launchd LaunchAgent plist. RunAtLoad starts it when the agent is loaded at login; KeepAlive restarts L75: // it if it exits (the keep-alive). Stdout/stderr go to a log under LOOM_HOME so a background boot stays L76: // debuggable. ... L118: return `<?xml version="1.0" encoding="UTF-16"?> L119: <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"> L120: <RegistrationInfo>

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/service.mjsView on unpkg · L10

dist/git/worktrees.jsView file

92/** L93: * Run a BOUNDED, NON-INTERACTIVE `pnpm install --frozen-lockfile --prefer-offline` in `worktreePath`, L94: * killing the child if it exceeds `timeoutMs`. ASYNC (child_process.spawn, NOT spawnSync) on purpose: L95: * createWorktree is awaited on the worker-spawn hot path, and a synchronous spawnSync would freeze the

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/git/worktrees.jsView on unpkg · L92

assets/python/synthesize.pyView file

•path = assets/python/synthesize.py kind = build_helper sizeBytes = 11311 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/python/synthesize.pyView on unpkg

dist/pty/host.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/pty/host.jsView on unpkg

Findings

1 Critical4 High7 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/pty/host.js

HighChild Processbin/loom.mjs

HighShellbin/loom.mjs

HighSame File Env Network Executionbin/loom.mjs

HighRuntime Package Installdist/git/worktrees.js

MediumDynamic Requirebin/loom.mjs

MediumUnsafe Vm Contextdist/mcp/repo-read.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/service.mjs

MediumShips Build Helperassets/python/synthesize.py

MediumStructural Risk Force Deep Review

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings