registry / opencode-orchestrator / 1.7.21

opencode-orchestrator@1.7.21

⚠ Under review

Multi-agent mission control for OpenCode with Commander, Planner, Worker, and Reviewer workflows.

Static Scan Results

scanned 23d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 394 KB of source, external domains: opencode.ai

Source & flagged code

5 flagged

package.jsonView file

•scripts.postinstall = node scripts/run-install-hook.mjs postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/run-install-hook.mjs postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/index.jsView file

Lines 3230-3270javascript

3230 }

3231 }

3232 /**

3233 * Clear task memory (Short-term)

3234 */

3235 clearTaskMemory() {

3236 for (const entry of this.storage["task" /* TASK */]) {

3237 this.memories.delete(entry.id);

3238 }

3239 this.storage["task" /* TASK */] = [];

3240 log("[MemoryManager] Task memory cleared.");

3241 }

3242 /**

3243 * Export full memory state (for persistence)

3244 */

3245 export() {

3246 return { ...this.storage };

3247 }

3248 /**

3249 * Import memory state

3250 */

3251 import(snapshot) {

3252 this.storage = snapshot;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/index.jsView on unpkg · L3250

3253 this.memories.clear();

3254 for (const level of Object.values(MemoryLevel)) {

3255 for (const entry of this.storage[level]) {

3256 this.memories.set(entry.id, level);

3257 }

3258 }

3259 }

3260};

3261

3262// src/agents/prompts/shared/philosophy.ts

3263var CORE_PHILOSOPHY = `${PROMPT_TAGS.CORE_PHILOSOPHY.open}

3264${PHILOSOPHY_TAGLINE}: inspect the project, record useful findings, adapt to its conventions, and act with verification.

3265${PROMPT_TAGS.CORE_PHILOSOPHY.close}`;

3266

3267// src/agents/prompts/common.ts

3268var WORKING_DISCIPLINE = `Read the user's instructions, relevant project files, and existing mission context before changing anything. Preserve unrelated work and existing mission data. Use the project's actual build/test commands and installed tool schemas; do not invent APIs or claim checks you did not run.

3269Use native OpenCode tools or the project's CLI for exploration and changes. For external documentation, use the host's webfetch when available; websearch depends on host/provider configuration. If a capability is unavailable, report that limitation and use a supported alternative.

3270Keep changes focused and synchronize affected tests, types, imports, configuration, and documentation. For behavior changes, demonstrate a failing regression test, implement the fix, and retain the passing test. Report observed results, failed checks, and remaining limitations honestly.`;

bin/orchestrator-macos-arm64View file

•path = bin/orchestrator-macos-arm64 kind = native_binary sizeBytes = 4681296 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

bin/orchestrator-macos-arm64View on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = opencode-orchestrator@1.7.17 matchedIdentity = npm:b3BlbmNvZGUtb3JjaGVzdHJhdG9y:1.7.17 similarity = 0.800 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

5 flagged · loading source

package.jsonView file

opencode-orchestrator@1.7.21

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code