registry / @solidnumber/cli / 2.14.0

@solidnumber/cli@2.14.0

⚠ Under review

Be There — the system that answers, books, and takes payment when you can't. CLI + SDK + MCP tools for SMBs, agencies, and AI agents. solid clone plumber → working business in 30 seconds.

Static Scan Results

scanned 3mo ago · by rust-scanner

Static analysis flagged 18 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 166 file(s), 2.14 MB of source, external domains: api.solidnumber.com, app.solidnumber.com, claude.ai, code.visualstudio.com, cursor.com, developers.solidnumber.com, ex.com, example.com, github.com, grok.com, me.ngrok.app, pay.solidnumber.com, placehold.co, schema.org, solidnumber.com, stitch.withgoogle.com, www.figma.com, www.npmjs.com, www.w3.org, www.youtube.com, your-url.com

Source & flagged code

10 flagged

package.jsonView file

Lines 28-68json

28 },

29 "scripts": {

30 "build": "tsc && node -e \"require('fs').cpSync('src/data','dist/data',{recursive:true})\"",

31 "postbuild": "ts-node scripts/generate-llms.ts",

32 "verify:llms": "ts-node scripts/generate-llms.ts --check",

33 "dev": "ts-node src/index.ts",

34 "start": "node dist/index.js",

35 "lint": "eslint src/**/*.ts",

36 "test": "jest --forceExit --detectOpenHandles",

37 "test:coverage": "jest --coverage --forceExit --detectOpenHandles",

38 "test:smoke": "jest --testPathPattern=integration --forceExit",

39 "test:contracts": "jest --testPathPattern='integration/(contracts|smoke|http-behavior)' --forceExit",

40 "test:security": "jest --testPathPattern=company-isolation --forceExit",

41 "verify:schemas": "ts-node scripts/verify-schemas.ts",

42 "audit": "npm audit --audit-level=high",

43 "audit:prod": "npm audit --omit=dev --audit-level=high",

44 "prepublish:check": "bash scripts/prepublish.sh",

45 "test:tarball": "bash scripts/test-tarball.sh",

46 "verify:deps": "node scripts/verify-runtime-deps.mjs",

47 "prepublishOnly": "npm run build && npm test && npm run test:contracts && npm run test:security && npm run audit:prod && npm run verify:deps",

48 "postinstall": "node -e \"try{if(!process.env.CI)console.log('\\n Solid# CLI installed. Get started: solid setup\\n')}catch(e){}\""

Critical

Red Install Lifecycle Script

Install-time lifecycle script matches a deterministic static-gate block pattern.

package.jsonView on unpkg · L48

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L48

49 },

50 "keywords": [

51 "cli",

52 "ai",

53 "crm",

54 "business",

55 "saas",

56 "mcp",

57 "ai-agents",

58 "voice-ai",

59 "multi-tenant",

60 "payments",

61 "small-business",

62 "agency",

63 "white-label",

64 "plumber",

65 "hvac",

66 "dentist",

67 "booking",

68 "scheduling",

dist/index.jsView file

Lines 761-792javascript

761});

762// Bare `solid` (no args):

763// - First run AND TTY → drop into the `solid setup` wizard (Phase 2 of

764// SPRINT-CLI-ONE-COMMAND-ONBOARDING.md). Same UX as `gh auth login` on

765// first run. Detected by absence of `~/.solid/config.json` AND no

766// SOLID_API_KEY env var (CI / scripted callers stay on the help screen).

767// - Otherwise → branded help (existing behavior).

768//

769// SOLID_SKIP_FIRST_RUN_WIZARD=1 forces the help path even on first run —

770// useful for tests, CI, and users who explicitly don't want the wizard.

dist/commands/import.jsView file

Lines 443-483javascript

443 let html = '';

444 // Read HTML from source

445 if (options.stdin) {

446 // Read from stdin

447 const chunks = [];

dist/lib/esm-import.jsView file

Lines 1-23javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.importESM = importESM;

4/**

5 * Import an ESM-only package from this CommonJS bundle.

6 *

7 * The CLI compiles with `module: CommonJS`, under which tsc rewrites a plain

dist/client.jsView file

Lines 3-43javascript

3exports.createSolidClient = createSolidClient;

4/**

5 * @solidnumber/cli/client — programmatic capability surface.

6 *

7 * Embed the Solid# platform in another Node program instead of shelling out to

8 * the `solid` binary or re-implementing against raw HTTP. This wraps the same

9 * api-client the CLI uses, so you inherit idempotency keys, token refresh, the

10 * typed error envelope, dry-run, and agent headers — and adds the high-level

11 * capabilities (verb dispatch + declarative apply) on top.

dist/commands/completion.jsView file

Lines 1-29javascript

1"use strict";

2/**

3 * Shell completion for Solid CLI — generated dynamically from the live

4 * commander tree, so completions never drift from the registered commands.

5 *

6 * solid completion → zsh (default)

7 * solid completion --bash → bash

8 * solid completion --fish → fish

9 *

10 * Install: eval "$(solid completion)" in ~/.zshrc (or pipe to a file sourced

dist/lib/first-run.jsView file

Lines 36-76javascript

36 return ar;

37 };

38 return ownKeys(o);

39 };

40 return function (mod) {

41 if (mod &&

dist/commands/visual.jsView file

21exports.visualCommand = void 0; L22: const child_process_1 = require("child_process"); L23: const chalk_1 = __importDefault(require("chalk")); ... L26: if (host) { L27: return host.startsWith('http') ? host : `https://${host}`; L28: } ... L30: // fall back to prod. Local dev users: SOLID_WEB_URL=http://localhost:3000 L31: const env = process.env.SOLID_WEB_URL || L32: (process.env.SOLID_API_URL ? process.env.SOLID_API_URL.replace('//api.', '//app.') : ''); ... L35: function openInBrowser(url) { L36: const platform = process.platform; L37: const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'start ""' : 'xdg-open';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/commands/visual.jsView on unpkg · L21

dist/commands/demo.jsView file

478console.log(''); L479: console.log(chalk_1.default.dim(' Like it? Keep it: `npm i -g @solidnumber/cli && solid auth login`')); L480: console.log(''); L481: if (options.open !== false) { L482: const { exec } = await Promise.resolve().then(() => __importStar(require('child_process'))); L483: exec(`open "${data.site_url}"`);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/demo.jsView on unpkg · L478

Source & flagged code

10 flagged · loading source

@solidnumber/cli@2.14.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code