
Research
/Security News
GlassWASM: WebAssembly Malware Found in Trojanized Open VSX Extensions
The trojanized extensions use TinyGo-compiled WebAssembly and Solana transaction memos to resolve command-and-control infrastructure.
@sleep2agi/agent-node
Advanced tools
AI Agent runtime for CommHub networks. Supports 4 runtimes: Claude Code CLI, Claude Agent SDK, Codex SDK, and Grok Build ACP.
Agent runtime for Agent Network. Connects to a CommHub server, registers under an alias, and processes incoming tasks with Claude, Codex, Grok Build, or compatible HTTP runtimes.
The supported entry point is the anet CLI from @sleep2agi/agent-network, which writes the right config.json, network token, and environment variables for you.
You usually don't install this package directly — anet node create and anet node start use it via npx. To pin it:
npm install -g @sleep2agi/agent-node
npm install -g @sleep2agi/agent-network
anet hub start # local hub (terminal 1)
anet hub dashboard # web UI (terminal 2)
anet login --username admin --password anethub
anet node create my-bot # two-step picker: runtime, then provider
anet node start my-bot # → SSE connected
The picker writes .anet/nodes/<name>/config.json. anet node start reads it and runs this package under the hood.
For scripts and CI:
npx @sleep2agi/agent-node --alias my-bot --hub http://127.0.0.1:9200 --tools all
CLI flags:
| Flag | Default | Notes |
|---|---|---|
--alias | required | unique name in the hub |
--hub | http://127.0.0.1:9200 | CommHub URL |
--runtime | claude-agent-sdk | claude-agent-sdk / codex-sdk / claude-code-cli / grok-build-acp / http-api |
--model | runtime default | passed through to the SDK |
--tools | (none) | all or comma-separated list |
--max-turns | 50 | upper bound per task |
--session | (none) | resume a prior session / thread |
| Runtime | Backend | Status | Notes |
|---|---|---|---|
claude-agent-sdk | @anthropic-ai/claude-agent-sdk | verified | Anthropic-compatible API; works with MiniMax, DeepSeek, GLM, Kimi, Anthropic, OpenRouter, or custom endpoints |
codex-sdk | @openai/codex-sdk | unverified end-to-end | unit tests pass, no full E2E with real codex auth |
claude-code-cli | local claude CLI | unverified end-to-end | runs locally for Claude Pro subscribers (v0.8.2 fixed the session-resume default-loss bug; see changelog) |
grok-build-acp | local grok agent stdio | stable runtime, native MCP injection boundary remains preview | requires Grok Build CLI login; stable for receive/reply, session persistence, and explicit CommHub delegation handled by agent-node |
http-api | OpenAI/Anthropic-compatible HTTP | experimental | reads ANTHROPIC_*, OPENAI_*, or MINIMAX_CODING_API_KEY environment variables |
Runtimes are loaded lazily — picking one doesn't pull the others' dependencies. claude-code-cli adds zero extra SDK weight.
grok-build-acp runs the local Grok Build CLI over Agent Client Protocol:
curl -fsSL https://x.ai/cli/install.sh | bash
grok
anet node create grok-demo --runtime grok-build-acp
anet node start grok-demo
The runtime starts grok agent stdio, authenticates with the cached Grok login, opens or loads a Grok session, sends the task prompt, collects streamed ACP notifications, and writes grokSession back to the node config.
Stable behavior:
agent-node, not by Grok itself.给 <alias> 发任务: <task>.parent_task_id, polls get_task, and returns the child result.Known boundary:
commhub_get_all_status or commhub_send_task.promptCapabilities.image=false.grok ACP error -32603 is treated as retryable once with a fresh session; the runtime now logs JSON-RPC error.data when Grok provides it.anet node create step 2 picks one of these and writes ANTHROPIC_BASE_URL + a default model. All Anthropic-compatible HTTP API; --model is passed through verbatim.
| Provider | Base URL | Default model | Status |
|---|---|---|---|
| Anthropic | https://api.anthropic.com | configured by --model | verified |
| MiniMax (国际) | https://api.minimax.io/anthropic | MiniMax-M2.7 | verified |
| MiniMax (国内) | https://api.minimaxi.com/anthropic | MiniMax-M2.7 | verified |
| DeepSeek | https://api.deepseek.com/anthropic | deepseek-chat | verified |
| GLM (智谱) | https://open.bigmodel.cn/api/anthropic | glm-4-plus | verified |
| Kimi (Moonshot) | https://api.moonshot.cn/anthropic | moonshot-v1-32k | verified |
| OpenRouter | https://openrouter.ai/api/v1 | (user-chosen) | unverified end-to-end |
| Custom | user-supplied | user-supplied | unverified end-to-end |
# DeepSeek
ANTHROPIC_BASE_URL=https://api.deepseek.com/anthropic \
ANTHROPIC_AUTH_TOKEN=sk-... \
npx @sleep2agi/agent-node --alias deep --hub http://127.0.0.1:9200 --tools all
# MiniMax
ANTHROPIC_BASE_URL=https://api.minimax.io/anthropic \
ANTHROPIC_AUTH_TOKEN=your-key \
npx @sleep2agi/agent-node --alias mini --model <minimax-model-id> --hub http://127.0.0.1:9200 --tools all
Typical output of anet node create at .anet/nodes/<name>/config.json:
{
"node_id": "n_a1b2c3d4",
"node_name": "my-bot",
"hub": "http://127.0.0.1:9200",
"token": "ntok_...",
"runtime": "claude-agent-sdk",
"model": "<minimax-model-id>",
"channels": ["server:commhub"],
"tools": ["Read", "Write", "Edit", "Bash", "Glob", "Grep"],
"env": {
"ANTHROPIC_BASE_URL": "https://api.minimax.io/anthropic",
"ANTHROPIC_AUTH_TOKEN": "sk-..."
},
"flags": {
"dangerouslySkipPermissions": true,
"teammateMode": "in-process",
"maxTurns": 50
}
}
Per-node config wins over ~/.anet/config.json; missing fields fall back to global, then defaults.
Same shape across runtimes:
start
→ report_status: idle
→ SSE long-poll /events/:alias
→ on new_task: get_inbox → ack_inbox
→ report_status: working
→ run the LLM (with commhub MCP tools injected)
→ send_reply
→ report_status: idle
When the agent runs, the commhub MCP tools are auto-injected. The model can call:
commhub_get_all_status() — see who else is onlinecommhub_send_task(alias, task) — dispatch a sub-task to a peercommhub_get_task(task_id) — poll for the peer's replycommhub_send_message(alias, message) — chat without a task lifecyclecommhub_report_status(status, task) — push status updateThis is what powers the multi-agent flow demonstrated in anet hub dashboard (e.g. ask one bot to consult another — the Tasks and Messages pages show the full handshake live).
When the runtime is claude-code-cli, the spawned subprocess gets settingSources: [] so it doesn't read the host's ~/.claude.json and accidentally cross networks.
| Package | Version |
|---|---|
| @sleep2agi/agent-network | 2.2.10 |
| @sleep2agi/commhub-server | 0.8.4 |
| @sleep2agi/agent-network-dashboard | 0.5.6 |
Apache-2.0
FAQs
AI Agent runtime for CommHub networks. Supports 4 runtimes: Claude Code CLI, Claude Agent SDK, Codex SDK, and Grok Build ACP.
We found that @sleep2agi/agent-node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The trojanized extensions use TinyGo-compiled WebAssembly and Solana transaction memos to resolve command-and-control infrastructure.

Security News
Anthropic says the directive cited national security concerns over a narrow jailbreak, but offered no specific technical details.

Security News
A network of 152 Chrome live wallpaper extensions hid ad tracking and made extension-driven traffic look like Google search clicks.