registry / pi-mega-compact / 0.8.1

pi-mega-compact@0.8.1

Layered, local, vector-backed context compressor for pi — supersede/collapse/cluster compaction with deduped inline recall.

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 303 file(s), 2.14 MB of source, external domains: 127.0.0.1

Source & flagged code

7 flagged

package.jsonView file

Lines 29-66json

29 "README.md",

30 "LICENSE"

31 ],

32 "pi": {

33 "extensions": [

34 "./extensions/mega-compact.ts"

35 ]

36 },

37 "openclaw": {

38 "plugin": "./extensions/openclaw-mega-compact.ts",

39 "manifest": "./openclaw.plugin.json",

40 "compactionProvider": "mega-compact"

41 },

42 "scripts": {

43 "build": "tsc -p tsconfig.json",

44 "lint": "tsc --noEmit && node scripts/guardrails-scan.mjs && node scripts/semantic-scan.mjs",

45 "test": "npm run build && node scripts/run-tests.mjs",

46 "guardrails": "python3 scripts/regression_check.py --all || node scripts/guardrails-scan.mjs || node scripts/semantic-scan.mjs",

47 "precommit": "bash .claude/hooks/pre-commit.sh",

48 "prepublishOnly": "npm run build",

49 "postinstall": "npm rebuild @mongodb-js/zstd || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L49

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L49

50 },

51 "peerDependencies": {

52 "@earendil-works/pi-coding-agent": "*",

53 "@earendil-works/pi-tui": ">=0.80",

54 "openclaw": ">=0.1.0"

55 },

56 "devDependencies": {

57 "@types/node": "^22.20.1",

58 "typescript": "^5.4.0"

59 },

60 "dependencies": {

61 "@electric-sql/pglite": "^0.5.4",

62 "@electric-sql/pglite-pgvector": "^0.0.5",

63 "@mongodb-js/zstd": "^7.0.0"

64 }

65}

dist/extensions/mega-dashboard-cmds.jsView file

Lines 1-30javascript

1/**

2 * mega-dashboard-cmds.ts — the local web-dashboard slash commands.

3 *

4 * Spawns / discovers / stops the optional localhost dashboard server

5 * (extensions/dashboard-server.ts) as a detached child process. All network

6 * usage here is loopback-only and audited via // guardrails-allow PREVENT-PI-004.

7 */

8import { join, dirname, sep } from "node:path";

dist/extensions/error-patterns.jsView file

Lines 1-24javascript

1// Error pattern detection for broken environment setups

2// Detects various states of incomplete or broken configurations

3export function detectBrokenEnvironmentSetup(configPath, missingFileExists = false) {

4 // Pattern 1: Checks if required config files are missing

5 const

dist/extensions/dashboard-server.test.jsView file

Lines 102-142javascript

102 test("round-trips port and pid", () => {

103 const dir = tmpDir();

104 const info = { port: 3847, pid:

dist/src/dedup/raptor/summarizer.jsView file

Lines 38-78javascript

38 *

39 * Uses local Ollama when MEGACOMPACT_RAPTOR_MODEL is set (localhost-only);

40 * otherwise falls back to deterministic extractive. The `fetch` is a localhost

41 * call inside the PREVENT-PI-

dist/extensions/dashboard-server-s32.test.jsView file

Lines 1-32javascript

1/**

2 * dashboard-server.test.ts — S32 game-state API + settings strip tests.

3 *

4 * GET/PUT /api/game-state round-trips the game_state SQLite row through the

5 * real server subprocess (spawn + waitFor + fetch), and the HTML template

6 * carries the data-theme attribute + settings strip + theme CSS-var blocks.

7 */

8import { test, describe } from "node:test";

Source & flagged code

7 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code