registry / @fny/joy-tmux / 1.8.0

@fny/joy-tmux@1.8.0

joy-tmux daemon + CLI — run Claude Code sessions in tmux, bridged to the joy/Happy relay.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 41 file(s), 568 KB of source, external domains: 0.0.0.0, 127.0.0.1, api.cluster-fluster.com, claude.com, example.com, exp.host, github.com, www.apple.com

Source & flagged code

6 flagged

src/cli.tsView file

Lines 1-30typescript

1#!/usr/bin/env -S node --import tsx

2// joy — CLI for the joy-tmux daemon. Mirrors happy-cli's surface (start/stop/

3// restart/status/list/doctor/install/auth/notify) but drives the joy-tmux

4// daemon over its localhost HTTP API. The daemon writes ~/.happy/joy-tmux-state/

5// daemon.json (token+pid+port) on startup, which is how this CLI finds and

6// authenticates to it.

8import { existsSync, readFileSync, writeFileSync, mkdirSync, openSync, rmSync } from "fs";

9import { join, dirname, resolve, basename, sep } from "path";

10import { homedir, platform as osPlatform } from "os";

11import { spawn, spawnSync } from "child_process";

12import { moduleDir } from "./esm";

High

Child Process

Package source references child process execution.

src/cli.tsView on unpkg · L10

13import { happyHomeDir, joyStateDir } from "./paths";

15const PORT = parseInt(process.env.PORT ?? "4997");

16const BASE = `http://127.0.0.1:${PORT}`;

17const HAPPY_HOME = happyHomeDir();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/cli.tsView on unpkg · L10

18const STATE_DIR = joyStateDir();

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli.tsView on unpkg · L10

19const STATE_FILE = join(STATE_DIR, "daemon.json");

20const LOG_FILE = join(STATE_DIR, "daemon.log");

21// pnpm global installs resolve import.meta.url into pnpm's versioned content-addressed

22// store (…/.pnpm/@fny+joy-tmux@1.0.15_…/node_modules/@fny/joy-tmux). Baking THAT into a

23// launchd/systemd service breaks on the next `pnpm add -g`: pnpm makes a fresh store dir

24// for the new version and deletes the old one, so the service's server.ts path vanishes

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/cli.tsView on unpkg · L10

25// and the daemon crash-loops. Collapse it to pnpm's stable top-level node_modules symlink

26// (always repointed at the current version). No-op for source checkouts / npm-global,

27// which have no .pnpm segment. (NODE = process.execPath is already a stable, canonical

28// version-install path — verified — so it needs no such treatment.)

29const PKG_DIR = moduleDir(import.meta.url).replace(/\/\.pnpm\/[^/]+\/node_modules\//, "/node_modules/");

30const SERVER_TS = join(PKG_DIR, "server.ts");

src/domain/operations.tsView file

Lines 28-68typescript

28import { cwdToTranscriptDir } from "../claude/transcript";

29import { joySessionDir } from "../paths";

30import { existsSync, statSync, readdirSync, readFileSync, openSync, readSync, closeSync } from "fs";

31import { readFile } from "fs/promises";

32import { basename, join } from "path";

bin/joy.mjsView file

Lines 1-17javascript

1#!/usr/bin/env node

2// Global-install entrypoint for the `joy` CLI.

3//

4// We ship TypeScript and run it through tsx. A naive bin of `src/cli.ts` with a

5// `#!/usr/bin/env -S node --import tsx` shebang breaks when installed globally:

6// `--import tsx` resolves the loader relative to the caller's CWD, so running

7// `joy` from anywhere but the package dir throws ERR_MODULE_NOT_FOUND for tsx.

8//

9// Instead, register tsx's ESM loader via a STATIC import here — that resolves

10// `tsx` relative to THIS file (the package's own node_modules), regardless of

11// CWD — then hand off to the real CLI.

Source & flagged code

6 flagged · loading source

src/cli.tsView file

10import { homedir, platform as osPlatform } from "os"; L11: import { spawn, spawnSync } from "child_process"; L12: import { moduleDir } from "./esm";

High

Child Process

Package source references child process execution.

src/cli.tsView on unpkg · L10

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/cli.tsView on unpkg · L10

10import { homedir, platform as osPlatform } from "os"; L11: import { spawn, spawnSync } from "child_process"; L12: import { moduleDir } from "./esm"; ... L22: // store (…/.pnpm/@fny+joy-tmux@1.0.15_…/node_modules/@fny/joy-tmux). Baking THAT into a L23: // launchd/systemd service breaks on the next `pnpm add -g`: pnpm makes a fresh store dir L24: // for the new version and deletes the old one, so the service's server.ts path vanishes

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/cli.tsView on unpkg · L10

10import { homedir, platform as osPlatform } from "os"; L11: import { spawn, spawnSync } from "child_process"; L12: import { moduleDir } from "./esm"; ... L14: L15: const PORT = parseInt(process.env.PORT ?? "4997"); L16: const BASE = `http://127.0.0.1:${PORT}`; L17: const HAPPY_HOME = happyHomeDir(); L18: const STATE_DIR = joyStateDir(); ... L47: function readState(): DaemonState | null { L48: try { return JSON.parse(readFileSync(STATE_FILE, "utf8")) as DaemonState; } catch { return null; } L49: } ... L61: headers: authHeaders(),

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli.tsView on unpkg · L10

src/domain/operations.tsView file

48// like `--import tsx` + the script path) so the replacement runs the same way. L49: const argv = [process.execPath, ...process.execArgv, ...process.argv.slice(1)]; L50: const cmd = argv.map(a => `'${a.replace(/'/g, "'\\''")}'`).join(" ");

High

Shell

Package source references shell execution.

src/domain/operations.tsView on unpkg · L48

bin/joy.mjsView file

15L16: await import(new URL('../src/cli.ts', import.meta.url).href);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/joy.mjsView on unpkg · L15

Findings

4 High5 Medium5 Low

HighChild Processsrc/cli.ts

HighShellsrc/domain/operations.ts

HighSame File Env Network Executionsrc/cli.ts

HighRuntime Package Installsrc/cli.ts

MediumDynamic Requirebin/joy.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/cli.ts

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

src/cli.tsView file

Lines 1-30typescript

1#!/usr/bin/env -S node --import tsx

2// joy — CLI for the joy-tmux daemon. Mirrors happy-cli's surface (start/stop/

3// restart/status/list/doctor/install/auth/notify) but drives the joy-tmux

4// daemon over its localhost HTTP API. The daemon writes ~/.happy/joy-tmux-state/

5// daemon.json (token+pid+port) on startup, which is how this CLI finds and

6// authenticates to it.

8import { existsSync, readFileSync, writeFileSync, mkdirSync, openSync, rmSync } from "fs";

9import { join, dirname, resolve, basename, sep } from "path";

10import { homedir, platform as osPlatform } from "os";

11import { spawn, spawnSync } from "child_process";

12import { moduleDir } from "./esm";

High

Child Process

Package source references child process execution.

src/cli.tsView on unpkg · L10

13import { happyHomeDir, joyStateDir } from "./paths";

15const PORT = parseInt(process.env.PORT ?? "4997");

16const BASE = `http://127.0.0.1:${PORT}`;

17const HAPPY_HOME = happyHomeDir();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/cli.tsView on unpkg · L10

18const STATE_DIR = joyStateDir();

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli.tsView on unpkg · L10

19const STATE_FILE = join(STATE_DIR, "daemon.json");

20const LOG_FILE = join(STATE_DIR, "daemon.log");

21// pnpm global installs resolve import.meta.url into pnpm's versioned content-addressed

22// store (…/.pnpm/@fny+joy-tmux@1.0.15_…/node_modules/@fny/joy-tmux). Baking THAT into a

23// launchd/systemd service breaks on the next `pnpm add -g`: pnpm makes a fresh store dir

24// for the new version and deletes the old one, so the service's server.ts path vanishes

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/cli.tsView on unpkg · L10

25// and the daemon crash-loops. Collapse it to pnpm's stable top-level node_modules symlink

26// (always repointed at the current version). No-op for source checkouts / npm-global,

27// which have no .pnpm segment. (NODE = process.execPath is already a stable, canonical

28// version-install path — verified — so it needs no such treatment.)

29const PKG_DIR = moduleDir(import.meta.url).replace(/\/\.pnpm\/[^/]+\/node_modules\//, "/node_modules/");

30const SERVER_TS = join(PKG_DIR, "server.ts");

src/domain/operations.tsView file

Lines 28-68typescript

28import { cwdToTranscriptDir } from "../claude/transcript";

29import { joySessionDir } from "../paths";

30import { existsSync, statSync, readdirSync, readFileSync, openSync, readSync, closeSync } from "fs";

31import { readFile } from "fs/promises";

32import { basename, join } from "path";

bin/joy.mjsView file

Lines 1-17javascript

1#!/usr/bin/env node

2// Global-install entrypoint for the `joy` CLI.

3//

4// We ship TypeScript and run it through tsx. A naive bin of `src/cli.ts` with a

5// `#!/usr/bin/env -S node --import tsx` shebang breaks when installed globally:

6// `--import tsx` resolves the loader relative to the caller's CWD, so running

7// `joy` from anywhere but the package dir throws ERR_MODULE_NOT_FOUND for tsx.

8//

9// Instead, register tsx's ESM loader via a STATIC import here — that resolves

10// `tsx` relative to THIS file (the package's own node_modules), regardless of

11// CWD — then hand off to the real CLI.