registry / pi-mega-compact / 0.4.25

pi-mega-compact@0.4.25

Layered, local, vector-backed context compressor for pi — supersede/collapse/cluster compaction with deduped inline recall.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. This is a first-party pi/OpenClaw extension with automatic compaction hooks and local persistence. Optional commands launch a loopback dashboard; opt-in local model integrations receive compacted text.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

pi/OpenClaw loads the declared extension; dashboard launch requires `/mega-dashboard`; local-model calls require relevant environment variables.

Impact

Can process and persist agent-session context locally and expose it to local loopback services; no confirmed remote exfiltration or malicious mutation.

Mechanism

Agent lifecycle hooks, local vector storage, and loopback-only local services.

Rationale

Scanner signals map to legitimate local dashboard and optional local-model features, not exfiltration or install-time compromise. Warn because it is a first-party AI-agent extension with automatic lifecycle access and local context persistence.

Evidence

package.jsonextensions/mega-compact.tsextensions/openclaw-mega-compact.tsextensions/mega-dashboard-cmds.tsextensions/dashboard-server.tssrc/dedup/raptor/summarizer.tssrc/httpEmbedder.tsextensions/mega-events.tssrc/store/sqlite.ts

Network endpoints3

127.0.0.1:11434/api/generatelocalhost:9320-9329/api/snapshotlocalhost:9320-9329/api/version

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`extensions/mega-compact.ts` registers automatic pi lifecycle handlers.
`extensions/openclaw-mega-compact.ts` registers a compaction provider, hooks, and recall tools.
`extensions/mega-dashboard-cmds.ts` can spawn a detached local dashboard after an explicit slash command.
`src/dedup/raptor/summarizer.ts` sends conversation text to an opt-in local Ollama endpoint.

Evidence against

`package.json` postinstall only rebuilds `@mongodb-js/zstd`; it has no agent-config mutation.
`src/dedup/raptor/summarizer.ts` rejects non-loopback Ollama URLs.
`src/httpEmbedder.ts` rejects non-loopback embedding endpoints.
`extensions/dashboard-server.ts` binds only `127.0.0.1`.
No remote endpoint, credential exfiltration, payload download, or import-time shell execution was found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 162 file(s), 1.29 MB of source, external domains: 127.0.0.1

Source & flagged code

8 flagged

package.jsonView file

Lines 29-65json

29 "README.md",

30 "LICENSE"

31 ],

32 "pi": {

33 "extensions": [

34 "./extensions/mega-compact.ts"

35 ]

36 },

37 "openclaw": {

38 "plugin": "./extensions/openclaw-mega-compact.ts",

39 "manifest": "./openclaw.plugin.json",

40 "compactionProvider": "mega-compact"

41 },

42 "scripts": {

43 "build": "tsc -p tsconfig.json",

44 "lint": "tsc --noEmit && node scripts/guardrails-scan.mjs",

45 "test": "npm run build && node --test \"dist/src/**/*.test.js\" \"dist/extensions/**/*.test.js\"",

46 "guardrails": "python3 scripts/regression_check.py --all || node scripts/guardrails-scan.mjs",

47 "precommit": "bash .claude/hooks/pre-commit.sh",

48 "prepublishOnly": "npm run build",

49 "postinstall": "npm rebuild @mongodb-js/zstd || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "peerDependencies": {

52 "@earendil-works/pi-coding-agent": "*",

53 "openclaw": ">=0.1.0"

54 },

55 "devDependencies": {

56 "@types/node": "^22.20.1",

57 "typescript": "^5.4.0"

58 },

59 "dependencies": {

60 "@electric-sql/pglite": "^0.5.4",

61 "@electric-sql/pglite-pgvector": "^0.0.5",

62 "@mongodb-js/zstd": "^7.0.0"

63 }

64}

dist/extensions/mega-dashboard-cmds.jsView file

Lines 1-30javascript

1/**

2 * mega-dashboard-cmds.ts — the local web-dashboard slash commands.

3 *

4 * Spawns / discovers / stops the optional localhost dashboard server

5 * (extensions/dashboard-server.ts) as a detached child process. All network

6 * usage here is loopback-only and audited via // guardrails-allow PREVENT-PI-004.

7 */

8import { join, dirname, sep } from "node:path";

9import { fileURLToPath } from "node:url"

dist/src/dedup/raptor/summarizer.jsView file

Lines 1-78javascript

1/**

2 * summarizer.ts — per-cluster summary for the RAPTOR tree (Sprint 13, Phase 6).

3 *

4 * Default: pure extractive (deterministic, zero network, zero model) reusing

5 * extractive.ts. Optional: a LOCAL Ollama model (llama3.2:3b by default) when

6 * MEGACOMPACT_RAPTOR_MODEL is set — localhost only, same PREVENT-PI-004

7 * exception class as HttpEmbedder/the dashboard. No remote API is ever called.

8 *

9 * The summarizer returns structured text + a token estimate. Faithfulness is

10 * enforced downstream by guardrails.ts — this module only produces candidates.

11 */

dist/src/store/sqlite.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = pi-mega-compact@0.4.24 matchedIdentity = npm:cGktbWVnYS1jb21wYWN0:0.4.24 similarity = 0.917 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/store/sqlite.jsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = npm rebuild @mongodb-js/zstd || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = npm rebuild @mongodb-js/zstd || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/extensions/mega-dashboard-cmds.jsView file

10import { existsSync, writeFileSync, readFileSync, unlinkSync, openSync, closeSync } from "node:fs"; L11: import { spawn } from "node:child_process"; // guardrails-allow PREVENT-PI-004: spawns the optional, user-triggered localhost dashboard server only L12: /** Register the dashboard server lifecycle commands. */

High

Child Process

Package source references child process execution.

dist/extensions/mega-dashboard-cmds.jsView on unpkg · L10

10Cross-file remote execution chain: dist/extensions/mega-dashboard-cmds.js spawns dist/extensions/dashboard-server.js; helper contains network access plus dynamic code execution. L10: import { existsSync, writeFileSync, readFileSync, unlinkSync, openSync, closeSync } from "node:fs"; L11: import { spawn } from "node:child_process"; // guardrails-allow PREVENT-PI-004: spawns the optional, user-triggered localhost dashboard server only L12: /** Register the dashboard server lifecycle commands. */ ... L26: try { L27: const res = await fetch(`http://localhost:${port}/api/snapshot`, { signal: AbortSignal.timeout(800) }); // guardrails-allow PREVENT-PI-004: localhost liveness probe of the dashboar... L28: if (res.ok) ... L58: return null; L59: const j = await res.json(); L60: return j.version ?? null; ... L65: } L66: /** Version of THIS extension (read from its own package.json). */ L67: function ownVersion() {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/extensions/mega-dashboard-cmds.jsView on unpkg · L10

80try { L81: const { execSync } = require("node:child_process"); // guardrails-allow PREVENT-PI-004: localhost-only, reads our own dashboard port owner L82: const out = execSync(`ss -ltnp 2>/dev/null | grep ':${port} '`, { encoding: "utf-8" });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/extensions/mega-dashboard-cmds.jsView on unpkg · L80

dist/src/dedup/raptor/summarizer.jsView file

13import { estimateBlockTokens } from "../../tokens.js"; L14: import { spawnSync } from "node:child_process"; // guardrails-allow PREVENT-PI-004: localhost-only user-spawned Ollama server (BYO local model, never remote) L15: /** The local Ollama endpoint (loopback). Read lazily so tests can avoid it. */ L16: function ollamaEndpoint() { L17: const model = process.env.MEGACOMPACT_RAPTOR_MODEL; L18: if (!model) L19: return null; L20: const base = process.env.MEGACOMPACT_RAPTOR_URL ?? "http://127.0.0.1:11434"; L21: // Guard: only loopback is permitted (remote Ollama would violate PREVENT-PI-004).

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/dedup/raptor/summarizer.jsView on unpkg · L13

58try { L59: const r = await fetch(url, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ model, prompt, stream: false }) }); // guardrails-allow PREVENT... L60: const j = await r.json(); L61: process.stdout.write(JSON.stringify({ ok: r.ok, text: j.response || "" })); L62: } catch (e) { ... L65: `; L66: const res = spawnSync(process.execPath, ["-e", WORKER], { L67: encoding: "utf8",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/src/dedup/raptor/summarizer.jsView on unpkg · L58

dist/src/store/sqlite.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/store/sqlite.jsView on unpkg

Findings

1 Critical6 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/src/store/sqlite.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/extensions/mega-dashboard-cmds.js

HighShell

HighSame File Env Network Executiondist/src/dedup/raptor/summarizer.js

HighCommand Output Exfiltrationdist/src/dedup/raptor/summarizer.js

HighCross File Remote Execution Contextdist/extensions/mega-dashboard-cmds.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/extensions/mega-dashboard-cmds.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 29-65json

29 "README.md",

30 "LICENSE"

31 ],

32 "pi": {

33 "extensions": [

34 "./extensions/mega-compact.ts"

35 ]

36 },

37 "openclaw": {

38 "plugin": "./extensions/openclaw-mega-compact.ts",

39 "manifest": "./openclaw.plugin.json",

40 "compactionProvider": "mega-compact"

41 },

42 "scripts": {

43 "build": "tsc -p tsconfig.json",

44 "lint": "tsc --noEmit && node scripts/guardrails-scan.mjs",

45 "test": "npm run build && node --test \"dist/src/**/*.test.js\" \"dist/extensions/**/*.test.js\"",

46 "guardrails": "python3 scripts/regression_check.py --all || node scripts/guardrails-scan.mjs",

47 "precommit": "bash .claude/hooks/pre-commit.sh",

48 "prepublishOnly": "npm run build",

49 "postinstall": "npm rebuild @mongodb-js/zstd || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "peerDependencies": {

52 "@earendil-works/pi-coding-agent": "*",

53 "openclaw": ">=0.1.0"

54 },

55 "devDependencies": {

56 "@types/node": "^22.20.1",

57 "typescript": "^5.4.0"

58 },

59 "dependencies": {

60 "@electric-sql/pglite": "^0.5.4",

61 "@electric-sql/pglite-pgvector": "^0.0.5",

62 "@mongodb-js/zstd": "^7.0.0"

63 }

64}

dist/extensions/mega-dashboard-cmds.jsView file

Lines 1-30javascript

1/**

2 * mega-dashboard-cmds.ts — the local web-dashboard slash commands.

3 *

4 * Spawns / discovers / stops the optional localhost dashboard server

5 * (extensions/dashboard-server.ts) as a detached child process. All network

6 * usage here is loopback-only and audited via // guardrails-allow PREVENT-PI-004.

7 */

8import { join, dirname, sep } from "node:path";

9import { fileURLToPath } from "node:url"

dist/src/dedup/raptor/summarizer.jsView file

Lines 1-78javascript

1/**

2 * summarizer.ts — per-cluster summary for the RAPTOR tree (Sprint 13, Phase 6).

3 *

4 * Default: pure extractive (deterministic, zero network, zero model) reusing

5 * extractive.ts. Optional: a LOCAL Ollama model (llama3.2:3b by default) when

6 * MEGACOMPACT_RAPTOR_MODEL is set — localhost only, same PREVENT-PI-004

7 * exception class as HttpEmbedder/the dashboard. No remote API is ever called.

8 *

9 * The summarizer returns structured text + a token estimate. Faithfulness is

10 * enforced downstream by guardrails.ts — this module only produces candidates.

11 */

dist/src/store/sqlite.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/store/sqlite.jsView on unpkg