registry / @explorer02/cfm-survey-sdk / 0.9.3

@explorer02/cfm-survey-sdk@0.9.3

Headless React SDK for custom survey UIs. Matches CFM respondent-view behavior (navigation, logic, validation, progress, submission); you own all presentation.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

LPM blocks this version under the AI-agent control-surface policy. Install-time code mutates AI-agent instruction files in the consumer project. It performs this automatically based on environment detection, without an explicit user command.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

`npm install` as a dependency inside `node_modules`

Impact

Can steer Codex, Claude, Cursor, and related agents to follow package-supplied instructions in the host project.

Mechanism

postinstall AI-agent control-file injection

Policy narrative

On dependency installation, the package resolves the consumer project directory, detects coding-agent environment variables, and writes or merges package-controlled instruction stubs into project-level `AGENTS.md`, `CLAUDE.md`, and `.cursorrules`. These files affect broad AI-agent behavior outside the package directory. The mutation occurs automatically during `postinstall`, rather than through an explicit setup command.

Rationale

This is concrete, unconsented postinstall mutation of broad foreign AI-agent control surfaces. The lack of exfiltration does not mitigate the install-control-surface violation.

Evidence

package.jsonpostinstall.jspostinstall/detect-agent.jspostinstall/agent-stubs.jsAGENTS.mdCLAUDE.md.cursorrules

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for policy block

`package.json` runs `node postinstall.js` on install.
`postinstall.js` targets `INIT_CWD` or the consumer project root.
`postinstall.js` auto-detects AI-agent environment signals and writes project control files.
`postinstall/agent-stubs.js` injects instructions into `AGENTS.md` and `.cursorrules`, and creates `CLAUDE.md`.
Default/`all` target writes all three foreign project-level agent-control surfaces.

Evidence against

The postinstall stubs contain package documentation pointers, not credential theft or network code.
Existing `CLAUDE.md` with unrelated custom content is skipped.
CLI network, deployment, and package-install actions are explicit user-invoked commands.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 7 file(s), 398 KB of source, external domains: custom-p0.feedbook.me, distribution-dashboard-three.vercel.app, nodejs.org, raw.githubusercontent.com

Source & flagged code

8 flagged

package.jsonView file

Lines 11-51json

11 "require": "./dist/index.js"

12 }

13 },

14 "bin": {

15 "cfm-sdk": "./dist/cli/index.js"

16 },

17 "files": [

18 "dist",

19 "templates",

20 "postinstall.js",

21 "postinstall"

22 ],

23 "scripts": {

24 "build": "tsup",

25 "build:all": "npm run build",

26 "prepare": "npm run build",

27 "lint": "npm run lint:types && npm run lint:eslint",

28 "lint:types": "tsc --noEmit -p tsconfig.lint.json",

29 "lint:eslint": "eslint src",

30 "lint:fix": "eslint src --fix",

31 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test": "vitest run",

33 "test:watch": "vitest",

34 "test:coverage": "vitest run --coverage",

35 "docs:sync-manifest": "npx tsx scripts/generate-doc-manifest.ts",

36 "split-survey-ui-config": "npx tsx scripts/split-survey-ui-config.ts",

37 "merge-survey-ui-config": "npx tsx scripts/merge-survey-ui-config.ts",

38 "lint:agent-docs": "bash scripts/lint-agent-docs.sh",

39 "sync-agent-stubs": "node scripts/sync-monorepo-agent-stubs.js",

40 "prepublish:check": "npm run build && npm run test && npm run test:coverage && npm run lint && npm run lint:agent-docs && npm run docs:sync-manifest"

41 },

42 "peerDependencies": {

43 "@tanstack/react-query": "^5.0.0",

44 "react": ">=17.0.0"

45 },

46 "devDependencies": {

47 "@tanstack/react-query": "^5.0.0",

48 "@testing-library/jest-dom": "^6.4.2",

49 "@testing-library/react": "^14.2.1",

50 "@testing-library/user-event": "^14.5.2",

51 "@types/react": "^17.0.0",

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2"use strict";var cr=Object.create;var Ut=Object.defineProperty;var pr=Object.getOwnPropertyDescriptor;var dr=Object.getOwnPropertyNames;var ur=Object.getPrototypeOf,fr=Object.prototype.hasOwnProperty;var f=(e,t)=>

postinstall.jsView file

Lines 4-44javascript

4const {

5 NPM_AGENT_PATH,

6 getAgentsMdStub,

7 getCursorRulesStub,

8 getClaudeMdStub,

9 mergeMarkedBlock,

10 canUpdateClaudeMd,

11} = require('./postinstall/agent-stubs'

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 10916 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/cli/index.jsView file

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L1

114`),process.exit(1))):(console.log(` L115: \u274C ${c.red}winget package manager is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1. Install... L116: `),process.exit(1)):s?ge("brew")?(console.log(` ... L121: `),process.exit(1))):(console.log(` L122: \u274C ${c.red}Homebrew package manager (brew) is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1... L123: `),process.exit(1)):(console.log(` ... L128: \u26A0\uFE0F ${c.yellow}Global installation failed or permissions restricted.${c.reset}`),console.log(`\u2139 ${c.dim}Falling back: Running Vercel dynamically via npx.${c.reset}`)... L129: ${c.dim}Step 3/4: Checking Vercel Login...${c.reset}`);let t=!!process.env.VERCEL_TOKEN,n=!1;if(t)console.log(`\u2714 ${c.green}VERCEL_TOKEN environment variable detected. Skipping... L130: \u2714 ${c.green}Logged in successfully!${c.reset}`)}return t}k();ae();async function xn(e,t){console.log(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L114

1#!/usr/bin/env node L2: "use strict";var cr=Object.create;var Ut=Object.defineProperty;var pr=Object.getOwnPropertyDescriptor;var dr=Object.getOwnPropertyNames;var ur=Object.getPrototypeOf,fr=Object.proto... L3: ... L64: L65: Example reply: "yes, AWS" or "no"`,Tn="CFM_NEXT_STEP=ASK_DEPLOY"});function bn(e){return In.join(e,wr)}function Rn(){return process.env.CFM_SKIP_WORKFLOW_GATE==="1"}function je(e){... L66: `,"utf8")}function wn(e){Bt(e,{version:1,coreVerifyPassedAt:new Date().toISOString(),deployConfirmed:null,distributionS3Key:null})}function kn(e){let t=je(e);if(!t?.coreVerifyPasse... L67: `).length}function ct(e,t,n){let o=new Set;if(t==="fastPath"){let s=e.fastPath;for(let r of s?.read??[])o.add(r)}else if(t==="phase"&&n!==void 0){let r=e.phases?.find(i=>String(i.i... ... L74: Source: ${e.source}`),console.log(n),console.log(""),!1}function mt(e,t,n=!1){let o=ui(t,n);return o.length?gi({title:"INSTALL SURVEY-TYPE DEPS (run once before Phase 6)",packages:... L75: `)){let o=n.trim();if(!o||o.startsWith("#"))continue;let s=o.indexOf("=");if(s<=0)continue;let r=o.slice(0,s).trim(),i=o.slice(s+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.st... L76: `)}function Vs(e){r

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L1

121`),process.exit(1))):(console.log(` L122: \u274C ${c.red}Homebrew package manager (brew) is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1... L123: `),process.exit(1)):(console.log(` ... L126: ${c.dim}Step 2/4: Checking Vercel CLI...${c.reset}`);let e="vercel",t=!1;if(ge("vercel"))console.log(`\u2714 ${c.green}Vercel CLI is installed!${c.reset}`);else{console.log(`\u2753... L127: \u{1F4E5} ${c.cyan}Installing Vercel CLI globally... (npm install -g vercel)${c.reset}`),J("npm",["install","-g","vercel"])&&ge("vercel")?console.log(`\u2714 ${c.green}Vercel CLI i... L128: \u26A0\uFE0F ${c.yellow}Global installation failed or permissions restricted.${c.reset}`),console.log(`\u2139 ${c.dim}Falling back: Running Vercel dynamically via npx.${c.reset}`)...

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L121

postinstall.jsView file

24Install-time AI-agent control hijack evidence: L34: L35: fs.writeFileSync(filePath, newContent, 'utf8'); L36: } ... L41: function writeClaudeMd(targetDir) { L42: const filePath = path.join(targetDir, 'CLAUDE.md'); L43: const stub = getClaudeMdStub(); ... L47: if (!canUpdateClaudeMd(existing)) { L48: console.log('Skipped CLAUDE.md (custom content outside @AGENTS.md bridge)'); L49: return; ... L51: if (existing.trim() === stub.trim()) { L52: console.log('CLAUDE.md already up to date'); L53: return; Payload evidence from postinstall/detect-agent.js: L24: */ L25: function detectAgent(env = process.env) { L26: const override = env.CFM_SDK_AGENT;

Critical

Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

postinstall.jsView on unpkg · L24

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 10916 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

Findings

1 Critical5 High5 Medium6 Low

CriticalAi Agent Control Hijackpostinstall.js

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/cli/index.js

HighSame File Env Network Executiondist/cli/index.js

HighSandbox Evasion Gated Capabilitydist/cli/index.js

HighRuntime Package Installdist/cli/index.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/docs/survey-ui/verify-agent-build.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

8 flagged

package.jsonView file

Lines 11-51json

11 "require": "./dist/index.js"

12 }

13 },

14 "bin": {

15 "cfm-sdk": "./dist/cli/index.js"

16 },

17 "files": [

18 "dist",

19 "templates",

20 "postinstall.js",

21 "postinstall"

22 ],

23 "scripts": {

24 "build": "tsup",

25 "build:all": "npm run build",

26 "prepare": "npm run build",

27 "lint": "npm run lint:types && npm run lint:eslint",

28 "lint:types": "tsc --noEmit -p tsconfig.lint.json",

29 "lint:eslint": "eslint src",

30 "lint:fix": "eslint src --fix",

31 "postinstall": "node postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L31

32 "test": "vitest run",

33 "test:watch": "vitest",

34 "test:coverage": "vitest run --coverage",

35 "docs:sync-manifest": "npx tsx scripts/generate-doc-manifest.ts",

36 "split-survey-ui-config": "npx tsx scripts/split-survey-ui-config.ts",

37 "merge-survey-ui-config": "npx tsx scripts/merge-survey-ui-config.ts",

38 "lint:agent-docs": "bash scripts/lint-agent-docs.sh",

39 "sync-agent-stubs": "node scripts/sync-monorepo-agent-stubs.js",

40 "prepublish:check": "npm run build && npm run test && npm run test:coverage && npm run lint && npm run lint:agent-docs && npm run docs:sync-manifest"

41 },

42 "peerDependencies": {

43 "@tanstack/react-query": "^5.0.0",

44 "react": ">=17.0.0"

45 },

46 "devDependencies": {

47 "@tanstack/react-query": "^5.0.0",

48 "@testing-library/jest-dom": "^6.4.2",

49 "@testing-library/react": "^14.2.1",

50 "@testing-library/user-event": "^14.5.2",

51 "@types/react": "^17.0.0",

dist/cli/index.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

postinstall.jsView file

Lines 4-44javascript

4const {

5 NPM_AGENT_PATH,

6 getAgentsMdStub,

7 getCursorRulesStub,

8 getClaudeMdStub,

9 mergeMarkedBlock,

10 canUpdateClaudeMd,

11} = require('./postinstall/agent-stubs'

templates/docs/survey-ui/verify-agent-build.shView file

•path = templates/docs/survey-ui/verify-agent-build.sh kind = build_helper sizeBytes = 10916 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/docs/survey-ui/verify-agent-build.shView on unpkg

Lines 94-141javascript

94`);try{let{planPath:n,surveyTypes:o,hasMcqOtherPickers:s}=await Ft({projectRoot:t,instanceIdOverride:e.instanceIdOverride});console.log(`${Q.green}\u2705 Patched ${n} from live fetch (\xA70, \xA73b\u2013\xA73e)${Q.reset}`),mt(t,o,s),console.log(`${Q.dim}Author a component for each fetched type \u2014 read its ui-spec first${Q.reset}`);let r=Fn(t);return console.log(`

95${vn(r)}

96`),console.log(`${Q.dim}Next: npx cfm-sdk verify-build${Q.reset}`),0}catch(n){return console.error(`

97${Q.red}\u274C ${N(n)}${Q.reset}`),console.error(`${Q.dim}Fallback: npx cfm-sdk fill-implementation-plan --from-fetch${Q.reset}`),1}}var Q,er=f(()=>{"use strict";k();Ye();cn();Xe();ne();he();ze();Q=c});var dn={};Ne(dn,{SURVEY_DEPLOY_CONFIG_FILE:()=>Qt,readDeployTarget:()=>or,runGetDeployTarget:()=>Aa,runSetDeployTarget:()=>va,writeDeployTarget:()=>sr});function tr(e){return pn.join(e,Qt)}function nr(e){return pn.join(e,xa)}function Ta(e){let t=tr(e);if(G.existsSync(t))return t;let n=nr(e);return G.existsSync(n)?n:t}function or(e){let t=Ta(e);if(!G.existsSync(t))throw new Error(`${Qt} not found ...

98`,"utf8"),n}function Aa(e={}){let t=_(e.projectRoot),n=or(t),o=jt(n);return console.log(`${M.green}deploy.target:${M.reset} ${n}`),console.log(`${M.dim}Platform: ${o} (from ${Qt})${M.reset}`),0}async function va(e={}){let t=e.target?.toLowerCase().trim();if(t!=="aws"&&t!=="vercel")return console.error(`${M.red}FAIL:${M.reset} Usage: npx cfm-sdk set-deploy-target aws|vercel`),1;let n=_(e.projectRoot);if(!je(n)?.coreVerifyPassedAt)return console.error(`

99${M.red}Core verify not recorded. Run npx cfm-sdk verify-build successfully before set-deploy-target.${M.reset}`),1;let s=sr(n,t),r=jt(t);try{kn(n)}catch(i){return console.error(`

100${M.red}${N(i)}${M.reset}`),1}if(console.log(`${M.green}OK:${M.reset} Wrote deploy.target=${t} (${r}) \u2192 ${s}`),t==="aws"){let i=e.surveyId?.trim()||"<survey-id>",a=process.env.CFM_INSTANCE_ID?.trim();if(a&&i==="<survey-id>")try{let{survey:l}=await ue(n,a);i=l.id}catch{}console.log(`

101${at(i)}

102`),console.log(`${M.dim}After client pastes key: npx cfm-sdk create-distribution --s3-key=<key>${M.reset}`)}else console.log(`${M.dim}After client confirms deploy yes: npx cfm-sdk deploy${M.reset}`);return 0}var G,pn,M,Qt,xa,un=f(()=>{"use strict";G=h(require("fs")),pn=h(require("path"));k();ne();he();qe

103${at(S)}

104`),1}try{Dn(t,r)}catch(S){return console.error(`${Z.red}${N(S)}${Z.reset}`),1}if(!o)throw new Error("Missing OUT_DIR \u2014 set OUT_DIR to the absolute path of out/ or dist/");if(!re.existsSync(W.join(o,"index.html")))throw new Error(`Missing ${W.join(o,"index.html")} \u2014 run build first`);let{survey:i,apiResponse:a}=await ue(t,s),l=i.id,d=a.cfmSurveyDTO?.name?.trim()||l,u=ba(),g=wa(o);console.log(`${Z.cyan}\u2192 Creating distribution${Z.reset} for ${d} (${l}, s3Key: ${r})`),console.log(` uploading ${g.length} files from ${o}\u2026`);let y=await La(n,s,r,g);await Da(o,y.uploads,g),console ...

105${En(R)}

106`),Ln(t,r),0}catch(t){return console.error(`${Z.red}\u274C create-distribution failed: ${N(t)}${Z.reset}`),1}}var re,W,Z,rr,Ca,fn,Ea,ka,ar=f(()=>{"use strict";re=h(require("fs")),W=h(require("path"));Ze();ne();k();ze();he();qe();Z=c,rr=500,Ca=52428800,fn=3,Ea=2e3;ka=e=>new Promise(t=>setTimeout(t,e))});k();k();ae();var mn=h(require("readline/promises")),rt=require("process");async function ye(e){let t=mn.default.createInterface({input:rt.stdin,output:rt.stdout});try{return(await t.question(e

107`);let t=await ye("Would you like to install/upgrade Node.js v18+ automatically? (y/N): ");t.toLowerCase()==="y"||t.toLowerCase()==="yes"||(console.log(`

108\u274C ${c.red}Aborted. Please manually upgrade Node.js to v18+ and try again.${c.reset}

109`),process.exit(1));let o=process.platform==="win32",s=process.platform==="darwin";o?ge("winget")?(console.log(`

110\u{1F4E6} ${c.green}winget package manager found! Installing Node.js v18+ in background...${c.reset}`),J("winget",["upgrade","OpenJS.NodeJS","--silent","--accept-package-agreements","--accept-source-agreements"])?(console.log(`

111\u2714 ${c.green}Node.js installation triggered successfully. Please restart your terminal/command-prompt for changes to take effect.${c.reset}

112`),process.exit(0)):(console.log(`

113\u274C ${c.red}winget update failed. Please update Node.js manually at https://nodejs.org/${c.reset}

114`),process.exit(1))):(console.log(`

115\u274C ${c.red}winget package manager is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1. Install winget (App Installer) from the Microsoft Store."),console.log(` 2. Or manually download and install Node.js (v18+) from: https://nodejs.org/

116`),process.exit(1)):s?ge("brew")?(console.log(`

117\u{1F4E6} ${c.green}Homebrew package manager found! Installing Node.js v18+ in background...${c.reset}`),J("brew",["install","node"])?console.log(`

118\u2714 ${c.green}Node.js installed successfully via Homebrew.${c.reset}

119`):(console.log(`

120\u274C ${c.red}Homebrew installation failed. Please install Node.js manually at https://nodejs.org/${c.reset}

121`),process.exit(1))):(console.log(`

122\u274C ${c.red}Homebrew package manager (brew) is not installed on this system.${c.reset}`),console.log(`${c.bold}\u{1F449} To proceed, please either:${c.reset}`),console.log(" 1. Install Homebrew by running the following command in your terminal:"),console.log(` ${c.cyan}/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"${c.reset}`),console.log(` 2. Or manually download and install Node.js (v18+) from: https://nodejs.org/

123`),process.exit(1)):(console.log(`

124\u274C ${c.red}Please install or update Node.js to v18+ using your system's package manager.${c.reset}

125`),process.exit(1))}else console.log(`\u2714 ${c.green}Node.js version (v${e}) is sufficient.${c.reset}`)}k();ae();async function yn(){console.log(`

126${c.dim}Step 2/4: Checking Vercel CLI...${c.reset}`);let e="vercel",t=!1;if(ge("vercel"))console.log(`\u2714 ${c.green}Vercel CLI is installed!${c.reset}`);else{console.log(`\u2753 ${c.yellow}Vercel CLI was not found on your system.${c.reset}`);let n=await ye("\u{1F449} Would you like to install Vercel CLI globally? (Y/n): ");n.toLowerCase()==="y"||n===""?(console.log(`

127\u{1F4E5} ${c.cyan}Installing Vercel CLI globally... (npm install -g vercel)${c.reset}`),J("npm",["install","-g","vercel"])&&ge("vercel")?console.log(`\u2714 ${c.green}Vercel CLI installed successfully!${c.reset}`):(console.log(`

128\u26A0\uFE0F ${c.yellow}Global installation failed or permissions restricted.${c.reset}`),console.log(`\u2139 ${c.dim}Falling back: Running Vercel dynamically via npx.${c.reset}`),e="npx --yes vercel",t=!0)):(console.log(`\u2139 ${c.dim}Skipping global installation. Running Vercel dynamically via npx.${c.reset}`),e="npx --yes vercel",t=!0)}return{vercelCmd:e,useNpx:t}}var hn=require("child_process");k();ae();var yr={stdio:"ignore",shell:process.platform==="win32"?"cmd.exe":"/bin/sh"};async function Sn(e){console.log(`

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/index.jsView on unpkg · L121

129${c.dim}Step 3/4: Checking Vercel Login...${c.reset}`);let t=!!process.env.VERCEL_TOKEN,n=!1;if(t)console.log(`\u2714 ${c.green}VERCEL_TOKEN environment variable detected. Skipping login check.${c.reset}`),n=!0;else try{(0,hn.execSync)(e?"npx --yes vercel whoami":"vercel whoami",yr),n=!0,console.log(`\u2714 ${c.green}Logged in!${c.reset}`)}catch{n=!1}if(!n){console.log(`\u{1F511} ${c.yellow}Not logged in to Vercel.${c.reset}`),await ye("\u{1F449} Press [Enter] to login to Vercel... ");let o=["login"],s=e?"npx":"vercel",r=e?["--yes","vercel",...o]:o;if(await st(s,r)!==0)throw new Error("Vercel ...

130\u2714 ${c.green}Logged in successfully!${c.reset}`)}return t}k();ae();async function xn(e,t){console.log(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L114

131${c.dim}Step 4/4: Deploying project to production...${c.reset}`);let n=["--prod","--yes"];t&&n.push("--token",process.env.VERCEL_TOKEN);let o=e?"npx":"vercel",s=e?["--yes","vercel",...n]:n;if(console.log(`${c

132`),await st(o,s)!==0)throw new Error("Vercel deployment failed.");console.log(`

133${c.bold}${c.green}\u{1F389} Deployment completed successfully!${c.reset}

134`)}qe();ne();async function On(){Ht(_()),console.log(`

135${c.bold}${c.cyan}\u{1F680} Starting CFM Vercel Deployment...${c.reset}

136`),await gn();let{useNpx:e}=await yn(),t=await Sn(e);await xn(e,t)}k();Kt();ne();var V=h(require("fs")),oe=h(require("path"));Ye();function Qr(e){let t=oe.join(e,"package.json");if(!V.existsSync(t))return null;try{return JSON.parse(V.readFileSync(t,"utf8"))}catch{return null}}function pt(e,t){for(let n of t){let o=oe.join(e,n);if(V.existsSync(o))return n}return null}function Wt(e,t){return V.readFileSync(oe.join(e,t),"utf8")}function Ur(e){if(process.env.CFM_DEPLOY_TARGET==="aws")return!0;let t=["survey-deploy-config.json","survey-ui-config.json"];for(let n of t){let o=oe.join(e,n);if(V.exists ...

137`);let n=dt(t);for(let o of n.warnings)console.log(`${E.yellow}WARN:${E.reset} ${o}`);if(n.errors.length>0){console.log(`${E.red}FAIL:${E.reset} Framework scaffold incomplete (${n.framework}) \u2014 fix all items before authoring components:`);for(let o of n.errors)console.log(` - ${o}`);return console.log(`

138${E.dim}Fix: setup/index.md \xB7 Next: npx cfm-sdk scaffold-check${E.reset}`),1}return n.framework!=="unknown"&&console.log(`${E.green}OK:${E.reset} Framework scaffold verified (${n.framework})`),console.log(`${E.dim}Core deps OK. Survey-type deps print after fill-implementation-plan --from-fetch.${E.reset}`),console.log(`${E.dim}Scaffold complete \u2014 run npx cfm-sdk seed-phase5 next.${E.reset}`),console.log(`

139${E.dim}${Xt()}${E.reset}`),console.log(`

140${E.dim}Next: Phase 3\u20134 copy bundle + implementation_plan${E.reset}`),0}var gt=h(require("fs")),yt=h(require("path"));k();ne();var I=h(require("fs")),L=h(require("path")),qr=["src","components","app","lib"],Br=["src/components/IntroPage.tsx","components/IntroPage.tsx","app/components/IntroPage.tsx"],Hr=["src/components/SurveyPage.tsx","components/SurveyPage.tsx","app/components/SurveyPage.tsx"],Vr=["src/components/EndPage.tsx","components/EndPage.tsx","app/components/EndPage.tsx"],Vn=["src/components/Question.tsx","components/Question.tsx","app/components/Question.tsx"],zt=["CsatMatrixSca ...

141`);for(let i=0;i<r.length;i++){let a=r[i];Wr(a)||(Xr.test(a)||Kr.test(a))&&t.push(`${n}:${i+1}: hardcoded color \u2014 use survey-ui-config.json + var(--cfm-*)`)}}return t}function Jr(e){let t=[],n=Ge(e,Br);if(!n)return t.push

Long lines were clipped for display.