Loading npm security reports…
[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.
LPM treats this as warn-only first-party agent extension lifecycle risk. At pi extension runtime, the package alters the host agent prompt and watches its package-owned cookie drop directory. When provider cookies are present, it automatically queries provider quota APIs with them.
Package defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgPackage source references a known benign dynamic code generation pattern.
harness/e2e/playwright-runner.tsView on unpkg · L169Package source references dynamic require/import behavior.
packages/mcp-adapter/dist/server.jsView on unpkg · L144Source writes installer persistence such as shell profile or service configuration.
packages/scheduler-adapter/dist/cron.jsView on unpkg · L3This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
packages/auth/dist/minimax-browser-auth.jsView on unpkgPackage defines install-time lifecycle scripts.
package.jsonView on unpkg · L8Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L8This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
packages/auth/dist/minimax-browser-auth.jsView on unpkgPackage source references a known benign dynamic code generation pattern.
harness/e2e/playwright-runner.tsView on unpkg · L169Package source references dynamic require/import behavior.
packages/mcp-adapter/dist/server.jsView on unpkg · L144Source writes installer persistence such as shell profile or service configuration.
packages/scheduler-adapter/dist/cron.jsView on unpkg · L3