registry / pi-harness-runtime / 0.4.0

pi-harness-runtime@0.4.0

[BETA] Codex-style /usage status + autonomous coding harness for pi. Not production ready — expect breaking changes.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

No confirmed malicious attack surface. Browser automation and filesystem writes are tied to explicit auth/harness functions and local package state.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Explicit harness-auth command, pi extension command, or configured notification use.

Impact

No unconsented install-time execution, credential exfiltration, remote payload execution, or foreign AI-agent control-surface mutation was confirmed.

Mechanism

User-invoked MiniMax browser automation, local status storage, and harness extension commands.

Rationale

Static source inspection found potentially sensitive browser automation and local profile/status handling, but these are explicit user-invoked package features. No lifecycle hook, hidden execution path, credential harvesting, exfiltration, remote code loading, or unauthorized agent-control mutation was found.

Evidence

package.jsonindex.tspackages/auth/src/run-minimax-auth.tspackages/auth/src/minimax-browser-auth.tsharness/e2e/playwright-runner.ts

Decision evidence

public snapshot

AI called this Clean at 94.0% confidence as Benign with low false-positive risk.

Evidence for block

pi-harness-runtime@0.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code