registry / @vincentt-xr/cli / 0.1.5

@vincentt-xr/cli@0.1.5

Vincentt CLI — the vincentt command-line dev loop (login, create, publish, preview, diagnostics, feedback, relay, mcp)

Static Scan Results

scanned 44m ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 23 file(s), 94.1 KB of source, external domains: 127.0.0.1, api.vincentt.studio, editor.vincentt.studio, github.com

Source & flagged code

1 flagged

dist/cli/index.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2// `vincentt` — the unified CLI for the local-first dev loop. A human and a

3// bash-capable coding agent drive the same verbs. No MCP registration is required

4// for the default path; `vincentt mcp` exists only for hosts without a shell.

5//

6// Verb groups:

7// auth login · logout · whoami

8// dev loop create · publish · preview

9// diagnostics logs · network · trace

10// reverse feedback (--wait | --watch)

11// servers relay · mcp

12import os from "node:os";

13import path from "node:path";

14import { runLogin } from "../login/login.js";

15import { ensureLoggedIn } from "../login/ensure.js";

16import { clearMachineToken, clearProjectBinding, loadMachineConfig, } from "../shared/config.js";

17import { getMe } from "../lib/backend.js";

18import { diagQuery, diagRead, previewStart, previewStop, previewStopSignal, projectCreate, projectPublish, } from "../lib/lifecycle.js";

19import { writeQrPage } from "../preview/qrPage.js";

20import { fetchNext, readCursor, writeCursor } from "../lib/feedback.js";

21const DEFAULT_EDITOR_URL = "https://editor.vincentt.studio";

22const DEFAULT_API_URL = "https://api.vincentt.studio";

23// ---- arg helpers ------------------------------------------------------------

24const argv = process.argv.slice(2);

25function flag(name) {

26 const i = argv.indexOf(name);

27 return i !== -1 ? argv[i + 1] : undefined;

28}

29function has(name) {

30 return argv.includes(name);

31}

32function numFlag(name) {

33 const v = flag(name);

34 return v !== undefined ? Number(v) : undefined;

35}

36function projectDir() {

37 const dir = flag("--dir");

38 return dir ? path.resolve(dir) : process.cwd();

39}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L20

40// ---- auth -------------------------------------------------------------------

Source & flagged code

1 flagged · loading source

dist/cli/index.jsView file

20import { fetchNext, readCursor, writeCursor } from "../lib/feedback.js"; L21: const DEFAULT_EDITOR_URL = "https://editor.vincentt.studio"; L22: const DEFAULT_API_URL = "https://api.vincentt.studio"; ... L37: const dir = flag("--dir"); L38: return dir ? path.resolve(dir) : process.cwd(); L39: } ... L41: async function login() { L42: const editorUrl = flag("--editor") ?? process.env.VINCENTT_EDITOR_URL ?? DEFAULT_EDITOR_URL; L43: const apiUrl = flag("--api") ?? process.env.VINCENTT_API_URL ?? DEFAULT_API_URL; L44: const tokenName = flag("--name") ?? `Vincentt CLI (${os.hostname()})`; L45: console.log("Opening your browser to authorize this device…"); ... L76: console.log("Not signed in. Run `vincentt login`.");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L20

Findings

1 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/cli/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

dist/cli/index.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2// `vincentt` — the unified CLI for the local-first dev loop. A human and a

3// bash-capable coding agent drive the same verbs. No MCP registration is required

4// for the default path; `vincentt mcp` exists only for hosts without a shell.

5//

6// Verb groups:

7// auth login · logout · whoami

8// dev loop create · publish · preview

9// diagnostics logs · network · trace

10// reverse feedback (--wait | --watch)

11// servers relay · mcp

12import os from "node:os";

13import path from "node:path";

14import { runLogin } from "../login/login.js";

15import { ensureLoggedIn } from "../login/ensure.js";

16import { clearMachineToken, clearProjectBinding, loadMachineConfig, } from "../shared/config.js";

17import { getMe } from "../lib/backend.js";

18import { diagQuery, diagRead, previewStart, previewStop, previewStopSignal, projectCreate, projectPublish, } from "../lib/lifecycle.js";

19import { writeQrPage } from "../preview/qrPage.js";

20import { fetchNext, readCursor, writeCursor } from "../lib/feedback.js";

21const DEFAULT_EDITOR_URL = "https://editor.vincentt.studio";

22const DEFAULT_API_URL = "https://api.vincentt.studio";

23// ---- arg helpers ------------------------------------------------------------

24const argv = process.argv.slice(2);

25function flag(name) {

26 const i = argv.indexOf(name);

27 return i !== -1 ? argv[i + 1] : undefined;

28}

29function has(name) {

30 return argv.includes(name);

31}

32function numFlag(name) {

33 const v = flag(name);

34 return v !== undefined ? Number(v) : undefined;

35}

36function projectDir() {

37 const dir = flag("--dir");

38 return dir ? path.resolve(dir) : process.cwd();

39}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L20

40// ---- auth -------------------------------------------------------------------