
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@ophirai/protocol
Advanced tools
Core protocol definitions for the Ophir Agent Negotiation Protocol — types, schemas, state machine, SLA metrics, and error codes
Core protocol definitions for the Ophir Agent Negotiation Protocol. This package contains TypeScript types, Zod validation schemas, constants, and error codes shared by all Ophir packages.
npm install @ophir/protocol
import {
METHODS,
DEFAULT_CONFIG,
RFQParamsSchema,
QuoteParamsSchema,
CounterParamsSchema,
AcceptParamsSchema,
RejectParamsSchema,
DisputeParamsSchema,
OphirError,
OphirErrorCode,
} from '@ophir/protocol';
import type {
RFQParams,
QuoteParams,
CounterParams,
AcceptParams,
RejectParams,
DisputeParams,
FinalTerms,
SLAMetricName,
NegotiationState,
} from '@ophir/protocol';
import { RFQParamsSchema, QuoteParamsSchema } from '@ophir/protocol';
// Throws ZodError if validation fails
const rfq = RFQParamsSchema.parse(incomingData);
const quote = QuoteParamsSchema.parse(incomingData);
import { METHODS, DEFAULT_CONFIG } from '@ophir/protocol';
METHODS.RFQ; // "negotiate/rfq"
METHODS.QUOTE; // "negotiate/quote"
METHODS.COUNTER; // "negotiate/counter"
METHODS.ACCEPT; // "negotiate/accept"
METHODS.REJECT; // "negotiate/reject"
METHODS.DISPUTE; // "negotiate/dispute"
DEFAULT_CONFIG.rfq_timeout_ms; // 300000 (5 minutes)
DEFAULT_CONFIG.quote_timeout_ms; // 120000 (2 minutes)
DEFAULT_CONFIG.counter_timeout_ms; // 120000 (2 minutes)
DEFAULT_CONFIG.max_negotiation_rounds; // 5
import { OphirError, OphirErrorCode } from '@ophir/protocol';
try {
// ... protocol operation
} catch (err) {
if (err instanceof OphirError) {
console.error(err.code); // e.g., "OPHIR_002"
console.error(err.message); // Human-readable description
console.error(err.data); // Optional structured context
}
}
TypeScript interfaces for every protocol message:
RFQParams, QuoteParams, CounterParams, AcceptParams, RejectParams, DisputeParamsFinalTerms, AgentIdentity, ServiceRequirement, BudgetConstraintSLARequirement, SLAMetric, SLAMetricNamePricingOffer, VolumeDiscount, EscrowRequirementViolationEvidence, NegotiationStateZod validation schemas for runtime message validation:
RFQParamsSchema, QuoteParamsSchema, CounterParamsSchemaAcceptParamsSchema, RejectParamsSchema, DisputeParamsSchemaMETHODS -- RPC method name constantsDEFAULT_CONFIG -- Default timeouts, currency, escrow seeds, max roundsOphirErrorCode -- Enum of all error codes (OPHIR_001 through OPHIR_504)OphirError -- Typed error class with code, message, and optional dataError code ranges:
OPHIR_001–006: Message validationOPHIR_100–104: NegotiationOPHIR_200–204: EscrowOPHIR_300–301: DisputeOPHIR_400–403: InfrastructureOPHIR_500–504: Clearinghouse (margin, exposure, netting, circuit breaker, PoD)uptime_pct | p50_latency_ms | p99_latency_ms | accuracy_pct |
throughput_rpm | error_rate_pct | time_to_first_byte_ms | custom
import { isValidTransition, isTerminalState, getValidNextStates } from '@ophirai/protocol';
IDLE → RFQ_SENT → QUOTES_RECEIVED → COUNTERING → ACCEPTED →
MARGIN_ASSESSED → ESCROWED → ACTIVE → COMPLETED
↘ DISPUTED → RESOLVED
Any non-terminal state → REJECTED (terminal)
12 states. Terminal: COMPLETED, REJECTED, RESOLVED.
FAQs
Core protocol definitions for the Ophir Agent Negotiation Protocol — types, schemas, state machine, SLA metrics, and error codes
We found that @ophirai/protocol demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.