opencode-quota
LOW
maintainer lapsus
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package installs Node.js dependencies from npmjs.org, which is a trusted registry, and performs build-time operations on known project dependencies; the variable-named package installation refers to peerDependencies from the project's own package.json, not arbitrary external code.
Triggered rules
Low
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package installs Node.js dependencies from npmjs.org, which is a trusted registry, and performs build-time operations on known project dependencies; the variable-named package installation refers to peerDependencies from the project's own package.json, not arbitrary external code.
-
PKGBUILD:34
npm install --prefix "$srcdir/peer-root" --omit=dev --ignore-scripts --legacy-peer-deps "${_peerdeps[@]}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Yakov Till <yakov.till@gmail.com>
2
pkgname=opencode-quota
3
_npmname=@slkiser/opencode-quota
4
pkgver=4.9.0
5
pkgrel=1
6
pkgdesc="OpenCode plugin for quota & token usage tracking with zero context window pollution"
7
arch=('x86_64')
8
url="https://github.com/slkiser/opencode-quota"
9
license=('MIT')
10
depends=('gcc-libs' 'nodejs' 'opencode')
11
makedepends=('npm' 'node-gyp' 'python')
12
options=('!debug')
13
install=$pkgname.install
14
15
source=("$pkgname-$pkgver.tgz::https://registry.npmjs.org/$_npmname/-/$pkgname-$pkgver.tgz")
16
sha256sums=('ec7cbbf2533561a8ec947fde47d0c8b1d01342ab0e5ee88629602ec0ab27b358')
17
18
latestver() {
19
curl -fsSL "https://registry.npmjs.org/$_npmname/latest" | jq -r '.version'
20
}
21
22
package() {
23
cd "$srcdir/package"
24
25
npm install --omit=dev --omit=peer --ignore-scripts --legacy-peer-deps
26
27
mapfile -t _peerdeps < <(node -e '
28
const pkg = require("./package.json");
29
for (const [name, range] of Object.entries(pkg.peerDependencies ?? {}))
30
console.log(`${name}@${range}`);
31
')
32
if ((${#_peerdeps[@]})); then
33
rm -rf "$srcdir/peer-root"
34
npm install --prefix "$srcdir/peer-root" --omit=dev --ignore-scripts --legacy-peer-deps "${_peerdeps[@]}"
35
cp -a "$srcdir/peer-root/node_modules/." node_modules/
36
fi
37
38
# --ignore-scripts above means nothing compiles better-sqlite3's binding, and
39
# it ships no prebuilt one, so the module throws when loaded. It is only the
40
# fallback for runtimes without node:sqlite, which is why the plugin still
41
# works — but a module that cannot load has no business being in the package.
42
( cd node_modules/better-sqlite3 &&
43
npm_config_nodedir=/usr node-gyp rebuild --release &&
44
find build -mindepth 1 -maxdepth 1 ! -name Release -exec rm -rf {} + &&
45
find build/Release -mindepth 1 ! -name '*.node' -exec rm -rf {} + )
46
47
node -e '
48
const db = new (require("better-sqlite3"))(":memory:");
49
db.prepare("select 1").get();
50
db.close();
51
console.log("better-sqlite3 binding exercised");
52
'
53
54
# Remove build tools pulled in by npm resolution (not needed at runtime)
55
rm -rf node_modules/typescript node_modules/.bin
56
rm -f node_modules/@msgpackr-extract/msgpackr-extract-linux-x64/*.musl.node
57
rm -rf node_modules/@opentui/core/lib/tree-sitter/assets
58
rm -f node_modules/@opentui/core/lib/tree-sitter/update-assets.js node_modules/@opentui/core/lib/tree-sitter/update-assets.d.ts
59
rm -rf node_modules/jsesc/man node_modules/marked/man
60
61
install -d "$pkgdir/usr/lib/opencode/plugins/$pkgname"
62
cp -r . "$pkgdir/usr/lib/opencode/plugins/$pkgname/"
63
chmod 755 "$pkgdir/usr/lib/opencode/plugins/$pkgname/dist/bin/opencode-quota.js"
64
install -d "$pkgdir/usr/bin"
65
ln -s "/usr/lib/opencode/plugins/$pkgname/dist/bin/opencode-quota.js" "$pkgdir/usr/bin/opencode-quota"
66
67
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
68
}
69
Changes since previous scan
--- PKGBUILD @ 2026-09-07 00:30+++ PKGBUILD @ 2026-09-17 00:27@@ -1,8 +1,8 @@ # Maintainer: Yakov Till <yakov.till@gmail.com> pkgname=opencode-quota _npmname=@slkiser/opencode-quota-pkgver=4.8.2-pkgrel=2+pkgver=4.9.0+pkgrel=1 pkgdesc="OpenCode plugin for quota & token usage tracking with zero context window pollution" arch=('x86_64') url="https://github.com/slkiser/opencode-quota"@@ -13,7 +13,7 @@ install=$pkgname.install source=("$pkgname-$pkgver.tgz::https://registry.npmjs.org/$_npmname/-/$pkgname-$pkgver.tgz")-sha256sums=('b15930549ba3c963f2c6572c73aebc6d66eeb4ebac7f587da37437f9739c880d')+sha256sums=('ec7cbbf2533561a8ec947fde47d0c8b1d01342ab0e5ee88629602ec0ab27b358') latestver() { curl -fsSL "https://registry.npmjs.org/$_npmname/latest" | jq -r '.version'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 1 |
| 2026-09-16 00:03:17 | Low | 1 |
| 2026-09-15 00:25:31 | Low | 1 |
| 2026-09-14 00:27:57 | Low | 1 |
| 2026-09-13 00:19:54 | Low | 1 |
| 2026-09-12 00:25:17 | Low | 1 |
| 2026-09-11 00:19:22 | Low | 1 |
| 2026-09-10 00:22:44 | Low | 1 |
| 2026-09-09 00:04:09 | Low | 1 |
| 2026-09-08 00:18:08 | Low | 1 |
| 2026-09-07 17:15:15 | Low | 1 |
| 2026-09-07 00:30:15 | Low | 1 |
| 2026-09-06 00:17:06 | Low | 1 |
| 2026-09-05 00:16:27 | Low | 1 |
| 2026-09-04 00:03:13 | Low | 1 |
| 2026-09-03 00:15:47 | Low | 1 |
| 2026-09-02 00:02:31 | Low | 1 |
| 2026-09-01 01:46:26 | Low | 1 |
| 2026-09-01 00:11:19 | Low | 1 |
| 2026-08-31 00:19:57 | Low | 1 |