registry / pi-mega-compact / 0.4.4

pi-mega-compact@0.4.4

Layered, local, vector-backed context compressor for pi — supersede/collapse/cluster compaction with deduped inline recall.

AI Security Review

scanned 1d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The extension stores compaction state locally and exposes an explicitly invoked localhost dashboard; optional model calls are restricted to loopback.

Static reason

One or more suspicious static signals were detected.

Trigger

Pi/OpenClaw plugin activation for compaction; dashboard requires the mega-dashboard command and local model backends require user environment configuration.

Impact

Writes package state and compacted session data to its configured state directory; no confirmed external exfiltration or unconsented control-surface mutation.

Mechanism

Local context compaction, local persistence, and loopback-only optional services.

Rationale

Source inspection shows package-aligned local compaction behavior. Process execution and network primitives are limited to explicit dashboard actions, git root lookup, or validated loopback-only user-configured services.

Evidence

package.jsonextensions/mega-compact.tsextensions/dashboard-server.tsextensions/openclaw-mega-compact.tssrc/httpEmbedder.tssrc/dedup/raptor/summarizer.tssrc/config.tssrc/store/sqlite.ts.pi/mega-compact_dashboard-runner.mjsdashboard.jsonevents.logport.pidsqlite.db

Network endpoints2

127.0.0.1:11434/api/generatelocalhost:9320

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with high false-positive risk.

Evidence for block

Evidence against

package.json has no preinstall/install/postinstall lifecycle hooks.
extensions/mega-compact.ts uses execSync only for git root discovery.
Dashboard spawning is explicit via the mega-dashboard command and binds loopback only.
src/httpEmbedder.ts and raptor/summarizer.ts reject non-loopback endpoints.
No remote endpoint, credential harvesting, destructive operation, or foreign agent-config mutation found.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 65 file(s), 511 KB of source, external domains: 127.0.0.1

Source & flagged code

3 flagged

extensions/mega-compact.tsView file

Lines 24-64typescript

24 * before_agent_start systemPrompt prepend (PREVENT-PI-003).

25 */

27import type { ExtensionAPI, ExtensionContext, ContextEvent, SessionBeforeCompactEvent } from "@earendil-works/pi-coding-agent";

28import { sessionEntryToContextMessages } from "@earendil-works/pi-coding-agent";

29import type { AgentMessage } from "@earendil-works/pi-agent-core";

30import { join, dirname } from "node:path";

31import { fileURLToPath } from "node:url";

32import { STATE_DIR_DEFAULT } from "../src/config.js";

33import { VectorStore } from "../src/vectorStore.js";

34import { toEngineMessages, dropCompactedRange } from "../src/adapt.js";

35import { compactSession } from "../src/engine.js";

36import { recallAndInline } from "../src/recall.js";

37import { autoCompactCheck } from "../src/compact.js";

38import { estimateSessionTokens } from "../src/tokens.js";

39import { normalizeSessionId } from "../src/store.js";

40import { touchSession, logDaily } from "../src/store/sqlite.js";

41import { Logger } from "../src/log.js";

42import type { EngineMessage } from "../src/types.js";

43import { writeFileSync, appendFileSync, readFileSync } from "node:fs";

44import { existsSync, mkdirSync, unlinkSync } from "node:fs";

45import { spawn } from "node:child_process"; // guardrails-allow PREVENT-PI-004: spawns the optional, user-triggered localhost dashboard server only

46import { execSync } from "node:child_process"; // guardrails-allow PREVENT-PI-004: read-only `git rev-parse` to scope the store per-repo

High

Child Process

Package source references child process execution.

extensions/mega-compact.tsView on unpkg · L44

48const STATUS_KEY = "mega-compact";

49const WIDGET_KEY = "mega-compact-stats";

50const MARKER_TYPE = "mega-compact-marker";

52/** Per-session runtime state kept in the closure (mirrors neuralwatt-mcr). */

53interface SessionRuntime {

54 sessionId: string;

55 persistedThisSession: boolean;

56 lastCheckpointId: string | undefined;

57 lastCompactedFrom: number;

58 lastCompactedTokens: number;

59 dedupSkips: number; // compactions skipped because regionHash already stored

60 dedupAttempts: number; // total compaction attempts (for hit-rate denominator)

61 tokensSaved: number; // this session-instance only: reset on session_start

62}

64function envFlag(name: string, fallback: number): number {

src/dedup/raptor/summarizer.tsView file

Lines 1-35typescript

1/**

2 * summarizer.ts — per-cluster summary for the RAPTOR tree (Sprint 13, Phase 6).

3 *

4 * Default: pure extractive (deterministic, zero network, zero model) reusing

5 * extractive.ts. Optional: a LOCAL Ollama model (llama3.2:3b by default) when

6 * MEGACOMPACT_RAPTOR_MODEL is set — localhost only, same PREVENT-PI-004

7 * exception class as HttpEmbedder/the dashboard. No remote API is ever called.

8 *

9 * The summarizer returns structured text + a token estimate. Faithfulness is

10 * enforced downstream by guardrails.ts — this module only produces candidates.

11 */

Source & flagged code

3 flagged · loading source

extensions/mega-compact.tsView file

44import { existsSync, mkdirSync, unlinkSync } from "node:fs"; L45: import { spawn } from "node:child_process"; // guardrails-allow PREVENT-PI-004: spawns the optional, user-triggered localhost dashboard server only L46: import { execSync } from "node:child_process"; // guardrails-allow PREVENT-PI-004: read-only `git rev-parse` to scope the store per-repo

High

Child Process

Package source references child process execution.

extensions/mega-compact.tsView on unpkg · L44

src/dedup/raptor/summarizer.tsView file

15import { estimateBlockTokens } from "../../tokens.js"; L16: import { spawnSync } from "node:child_process"; // guardrails-allow PREVENT-PI-004: localhost-only user-spawned Ollama server (BYO local model, never remote) L17: ... L24: function ollamaEndpoint(): { url: string; model: string } | null { L25: const model = process.env.MEGACOMPACT_RAPTOR_MODEL; L26: if (!model) return null; L27: const base = process.env.MEGACOMPACT_RAPTOR_URL ?? "http://127.0.0.1:11434"; L28: // Guard: only loopback is permitted (remote Ollama would violate PREVENT-PI-004).

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/dedup/raptor/summarizer.tsView on unpkg · L15

69try { L70: const r = await fetch(url, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ model, prompt, stream: false }) }); // guardrails-allow PREVENT... L71: const j = await r.json(); L72: process.stdout.write(JSON.stringify({ ok: r.ok, text: j.response || "" })); L73: } catch (e) { ... L76: `; L77: const res = spawnSync(process.execPath, ["-e", WORKER], { L78: encoding: "utf8",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/dedup/raptor/summarizer.tsView on unpkg · L69

Findings

4 High2 Medium4 Low

HighChild Processextensions/mega-compact.ts

HighShell

HighSame File Env Network Executionsrc/dedup/raptor/summarizer.ts

HighCommand Output Exfiltrationsrc/dedup/raptor/summarizer.ts

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

extensions/mega-compact.tsView file

Lines 24-64typescript

24 * before_agent_start systemPrompt prepend (PREVENT-PI-003).

25 */

27import type { ExtensionAPI, ExtensionContext, ContextEvent, SessionBeforeCompactEvent } from "@earendil-works/pi-coding-agent";

28import { sessionEntryToContextMessages } from "@earendil-works/pi-coding-agent";

29import type { AgentMessage } from "@earendil-works/pi-agent-core";

30import { join, dirname } from "node:path";

31import { fileURLToPath } from "node:url";

32import { STATE_DIR_DEFAULT } from "../src/config.js";

33import { VectorStore } from "../src/vectorStore.js";

34import { toEngineMessages, dropCompactedRange } from "../src/adapt.js";

35import { compactSession } from "../src/engine.js";

36import { recallAndInline } from "../src/recall.js";

37import { autoCompactCheck } from "../src/compact.js";

38import { estimateSessionTokens } from "../src/tokens.js";

39import { normalizeSessionId } from "../src/store.js";

40import { touchSession, logDaily } from "../src/store/sqlite.js";

41import { Logger } from "../src/log.js";

42import type { EngineMessage } from "../src/types.js";

43import { writeFileSync, appendFileSync, readFileSync } from "node:fs";

44import { existsSync, mkdirSync, unlinkSync } from "node:fs";

45import { spawn } from "node:child_process"; // guardrails-allow PREVENT-PI-004: spawns the optional, user-triggered localhost dashboard server only

46import { execSync } from "node:child_process"; // guardrails-allow PREVENT-PI-004: read-only `git rev-parse` to scope the store per-repo

High

Child Process

Package source references child process execution.

extensions/mega-compact.tsView on unpkg · L44

48const STATUS_KEY = "mega-compact";

49const WIDGET_KEY = "mega-compact-stats";

50const MARKER_TYPE = "mega-compact-marker";

52/** Per-session runtime state kept in the closure (mirrors neuralwatt-mcr). */

53interface SessionRuntime {

54 sessionId: string;

55 persistedThisSession: boolean;

56 lastCheckpointId: string | undefined;

57 lastCompactedFrom: number;

58 lastCompactedTokens: number;

59 dedupSkips: number; // compactions skipped because regionHash already stored

60 dedupAttempts: number; // total compaction attempts (for hit-rate denominator)

61 tokensSaved: number; // this session-instance only: reset on session_start

62}

64function envFlag(name: string, fallback: number): number {

src/dedup/raptor/summarizer.tsView file

Lines 1-35typescript

1/**

2 * summarizer.ts — per-cluster summary for the RAPTOR tree (Sprint 13, Phase 6).

3 *

4 * Default: pure extractive (deterministic, zero network, zero model) reusing

5 * extractive.ts. Optional: a LOCAL Ollama model (llama3.2:3b by default) when

6 * MEGACOMPACT_RAPTOR_MODEL is set — localhost only, same PREVENT-PI-004

7 * exception class as HttpEmbedder/the dashboard. No remote API is ever called.

8 *

9 * The summarizer returns structured text + a token estimate. Faithfulness is

10 * enforced downstream by guardrails.ts — this module only produces candidates.

11 */

Lines 49-89typescript

49 *

50 * Uses local Ollama when MEGACOMPACT_RAPTOR_MODEL is set (localhost-only);

51 * otherwise falls back to deterministic extractive. The `fetch` is a localhost

52 * call inside the PREVENT-PI-004 exception — annotated accordingly.

53 */

54export function summarizeCluster(messages: EngineMessage[]): ClusterSummary {

55 const ollama = ollamaEndpoint();

56 if (!ollama) return extractiveClusterSummary(messages);

57 return ollamaSummarize(messages, ollama);

58}

60function ollamaSummarize(messages: EngineMessage[], ollama: { url: string; model: string }): ClusterSummary {

61 // The fetch below is localhost-only (loopback Ollama) — the PREVENT-PI-004

62 // sanctioned local-model exceptions (same class as /dashboard, HttpEmbedder).

63 const prompt = messages.map((m) => `${m.role}: ${m.text}`).join("\n");

64 // Synchronous bridge: spawnSync an inline worker so the call blocks without

65 // deadlocking fetch (mirrors HttpEmbedder — Atomics.wait on main thread would

66 // hang). A blocked main thread cannot pump the socket.

67 const WORKER = String.raw`

68 const url = process.env.R_URL, model = process.env.R_MODEL, prompt = process.env.R_PROMPT;

69 try {

70 const r = await fetch(url, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ model, prompt, stream: false }) }); // guardrails-allow PREVENT-PI-004: localhost-only user-spawned Ollama server (BYO local model, never remote)

71 const j = await r.json();

72 process.stdout.write(JSON.stringify({ ok: r.ok, text: j.response || "" }));

73 } catch (e) {

74 process.stdout.write(JSON.stringify({ ok: false, error: String(e && e.message ? e.message : e) }));

75 }

76 `;

77 const res = spawnSync(process.execPath, ["-e", WORKER], {

78 encoding: "utf8",

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/dedup/raptor/summarizer.tsView on unpkg · L69

79 env: { ...process.env, R_URL: ollama.url, R_MODEL: ollama.model, R_PROMPT: prompt },

80 });

81 let parsed: { ok: boolean; text?: string; error?: string } = { ok: false, error: "no response" };

82 if (typeof res.stdout === "string" && res.stdout.length > 0) {

83 try { parsed = JSON.parse(res.stdout); } catch { parsed = { ok: false, error: "bad json" }; }

84 }

85 if (!parsed.ok || !parsed.text) {

86 // Ollama unavailable → deterministic extractive fallback (never fail the build).

87 return extractiveClusterSummary(messages);

88 }

89 const summary = parsed.text.trim();