registry / @vincentt-xr/cli / 0.1.3

@vincentt-xr/cli@0.1.3

Vincentt CLI — the vincentt command-line dev loop (login, create, publish, preview, diagnostics, feedback, relay, mcp)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 25 file(s), 93.9 KB of source, external domains: 127.0.0.1, api.vincentt.studio, editor.vincentt.studio, github.com

Source & flagged code

2 flagged

dist/cli/index.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// `vincentt` — the unified CLI for the local-first dev loop. A human and a

3// bash-capable coding agent drive the same verbs. No MCP registration is required

4// for the default path; `vincentt mcp` exists only for hosts without a shell.

5//

6// Verb groups:

7// auth login · logout · whoami

8// dev loop create · publish · preview

9// diagnostics logs · network · trace

10// reverse feedback (--wait | --watch)

11// servers relay · mcp

12import os from "node:os";

13import path from "node:path";

14import { runLogin } from "../login/login.js";

15import { clearMachineToken, clearProjectBinding, loadMachineConfig, } from "../shared/config.js";

16import { getMe } from "../lib/backend.js";

17import { diagQuery, diagRead, previewStart, previewStop, previewStopSignal, projectCreate, projectPublish, } from "../lib/lifecycle.js";

18import { writeQrPage } from "../preview/qrPage.js";

19import { fetchNext, readCursor, writeCursor } from "../lib/feedback.js";

20const DEFAULT_EDITOR_URL = "https://editor.vincentt.studio";

21const DEFAULT_API_URL = "https://api.vincentt.studio";

22// ---- arg helpers ------------------------------------------------------------

23const argv = process.argv.slice(2);

24function flag(name) {

25 const i = argv.indexOf(name);

26 return i !== -1 ? argv[i + 1] : undefined;

27}

28function has(name) {

29 return argv.includes(name);

30}

31function numFlag(name) {

32 const v = flag(name);

33 return v !== undefined ? Number(v) : undefined;

34}

35function projectDir() {

36 const dir = flag("--dir");

37 return dir ? path.resolve(dir) : process.cwd();

38}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L19

39// ---- auth -------------------------------------------------------------------

dist/preview/runner.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @vincentt-xr/cli@0.1.2 matchedIdentity = npm:QHZpbmNlbnR0LXhyL2NsaQ:0.1.2 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/preview/runner.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/cli/index.jsView file

19import { fetchNext, readCursor, writeCursor } from "../lib/feedback.js"; L20: const DEFAULT_EDITOR_URL = "https://editor.vincentt.studio"; L21: const DEFAULT_API_URL = "https://api.vincentt.studio"; ... L36: const dir = flag("--dir"); L37: return dir ? path.resolve(dir) : process.cwd(); L38: } ... L40: async function login() { L41: const editorUrl = flag("--editor") ?? process.env.VINCENTT_EDITOR_URL ?? DEFAULT_EDITOR_URL; L42: const apiUrl = flag("--api") ?? process.env.VINCENTT_API_URL ?? DEFAULT_API_URL; L43: const tokenName = flag("--name") ?? `Vincentt CLI (${os.hostname()})`; L44: console.log("Opening your browser to authorize this device…"); ... L63: console.log("Not signed in. Run `vincentt login`.");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L19

dist/preview/runner.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/preview/runner.jsView on unpkg

Findings

2 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/cli/index.js

HighPrevious Version Dangerous Deltadist/preview/runner.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/cli/index.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// `vincentt` — the unified CLI for the local-first dev loop. A human and a

3// bash-capable coding agent drive the same verbs. No MCP registration is required

4// for the default path; `vincentt mcp` exists only for hosts without a shell.

5//

6// Verb groups:

7// auth login · logout · whoami

8// dev loop create · publish · preview

9// diagnostics logs · network · trace

10// reverse feedback (--wait | --watch)

11// servers relay · mcp

12import os from "node:os";

13import path from "node:path";

14import { runLogin } from "../login/login.js";

15import { clearMachineToken, clearProjectBinding, loadMachineConfig, } from "../shared/config.js";

16import { getMe } from "../lib/backend.js";

17import { diagQuery, diagRead, previewStart, previewStop, previewStopSignal, projectCreate, projectPublish, } from "../lib/lifecycle.js";

18import { writeQrPage } from "../preview/qrPage.js";

19import { fetchNext, readCursor, writeCursor } from "../lib/feedback.js";

20const DEFAULT_EDITOR_URL = "https://editor.vincentt.studio";

21const DEFAULT_API_URL = "https://api.vincentt.studio";

22// ---- arg helpers ------------------------------------------------------------

23const argv = process.argv.slice(2);

24function flag(name) {

25 const i = argv.indexOf(name);

26 return i !== -1 ? argv[i + 1] : undefined;

27}

28function has(name) {

29 return argv.includes(name);

30}

31function numFlag(name) {

32 const v = flag(name);

33 return v !== undefined ? Number(v) : undefined;

34}

35function projectDir() {

36 const dir = flag("--dir");

37 return dir ? path.resolve(dir) : process.cwd();

38}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/index.jsView on unpkg · L19

39// ---- auth -------------------------------------------------------------------

dist/preview/runner.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/preview/runner.jsView on unpkg