registry / @vincentt-xr/cli / 0.1.2

@vincentt-xr/cli@0.1.2

Vincentt CLI — the vincentt command-line dev loop (login, create, publish, preview, diagnostics, feedback, relay, mcp)

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 24 file(s), 87.8 KB of source, external domains: 127.0.0.1, api.vincentt.studio, editor.vincentt.studio, github.com

Source & flagged code

1 flagged

dist/cli/index.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// `vincentt` — the unified CLI for the local-first dev loop. A human and a

3// bash-capable coding agent drive the same verbs. No MCP registration is required

4// for the default path; `vincentt mcp` exists only for hosts without a shell.

5//

6// Verb groups:

7// auth login · logout · whoami

8// dev loop create · publish · preview

9// diagnostics logs · network · trace

10// reverse feedback (--wait | --watch)

11// servers relay · mcp

12import os from "node:os";

13import path from "node:path";

14import { runLogin } from "../login/login.js";

15import { clearMachineToken, clearProjectBinding, loadMachineConfig, } from "../shared/config.js";

16import { getMe } from "../lib/backend.js";

17import { diagQuery, diagRead, previewStart, previewStop, projectCreate, projectPublish, } from "../lib/lifecycle.js";

18import { fetchNext, readCursor, writeCursor } from "../lib/feedback.js";

19const DEFAULT_EDITOR_URL = "https://editor.vincentt.studio";

20const DEFAULT_API_URL = "https://api.vincentt.studio";

21// ---- arg helpers ------------------------------------------------------------

22const argv = process.argv.slice(2);

23function flag(name) {

24 const i = argv.indexOf(name);

25 return i !== -1 ? argv[i + 1] : undefined;

26}

27function has(name) {

28 return argv.includes(name);

29}

30function numFlag(name) {

31 const v = flag(name);

32 return v !== undefined ? Number(v) : undefined;

33}

34function projectDir() {

35 const dir = flag("--dir");

36 return dir ? path.resolve(dir) : process.cwd();

37}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L18

38// ---- auth -------------------------------------------------------------------

Source & flagged code

1 flagged · loading source

dist/cli/index.jsView file

18import { fetchNext, readCursor, writeCursor } from "../lib/feedback.js"; L19: const DEFAULT_EDITOR_URL = "https://editor.vincentt.studio"; L20: const DEFAULT_API_URL = "https://api.vincentt.studio"; ... L35: const dir = flag("--dir"); L36: return dir ? path.resolve(dir) : process.cwd(); L37: } ... L39: async function login() { L40: const editorUrl = flag("--editor") ?? process.env.VINCENTT_EDITOR_URL ?? DEFAULT_EDITOR_URL; L41: const apiUrl = flag("--api") ?? process.env.VINCENTT_API_URL ?? DEFAULT_API_URL; L42: const tokenName = flag("--name") ?? `Vincentt CLI (${os.hostname()})`; L43: console.log("Opening your browser to authorize this device…"); ... L62: console.log("Not signed in. Run `vincentt login`.");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L18

Findings

1 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/cli/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

dist/cli/index.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// `vincentt` — the unified CLI for the local-first dev loop. A human and a

3// bash-capable coding agent drive the same verbs. No MCP registration is required

4// for the default path; `vincentt mcp` exists only for hosts without a shell.

5//

6// Verb groups:

7// auth login · logout · whoami

8// dev loop create · publish · preview

9// diagnostics logs · network · trace

10// reverse feedback (--wait | --watch)

11// servers relay · mcp

12import os from "node:os";

13import path from "node:path";

14import { runLogin } from "../login/login.js";

15import { clearMachineToken, clearProjectBinding, loadMachineConfig, } from "../shared/config.js";

16import { getMe } from "../lib/backend.js";

17import { diagQuery, diagRead, previewStart, previewStop, projectCreate, projectPublish, } from "../lib/lifecycle.js";

18import { fetchNext, readCursor, writeCursor } from "../lib/feedback.js";

19const DEFAULT_EDITOR_URL = "https://editor.vincentt.studio";

20const DEFAULT_API_URL = "https://api.vincentt.studio";

21// ---- arg helpers ------------------------------------------------------------

22const argv = process.argv.slice(2);

23function flag(name) {

24 const i = argv.indexOf(name);

25 return i !== -1 ? argv[i + 1] : undefined;

26}

27function has(name) {

28 return argv.includes(name);

29}

30function numFlag(name) {

31 const v = flag(name);

32 return v !== undefined ? Number(v) : undefined;

33}

34function projectDir() {

35 const dir = flag("--dir");

36 return dir ? path.resolve(dir) : process.cwd();

37}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L18

38// ---- auth -------------------------------------------------------------------