registry / botook / 0.2.0

botook@0.2.0

Install botook into Claude Code: browser OAuth, an always-on launchd receiver, and MCP registration — one `npx botook init`.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 58.0 KB of source, external domains: botook.ai, bun.sh, git-scm.com, github.com, www.apple.com, x.example

Source & flagged code

3 flagged

lib/channel.mjsView file

Lines 1-64javascript

1// Provision the botook-channel plugin the always-on receiver loads via

2// --plugin-dir. Without it, the launchd session has nothing to run and flaps,

3// so `init` calls provisionChannel() before registering the receiver. This

4// mirrors botook-channel/install.sh so the two install paths stay in sync:

5//

6// • a git checkout already there → `git pull --ff-only` (update)

7// • a populated non-git dev copy → keep as-is (never clobber a checkout)

8// • nothing there → `git clone --depth=1`

9// then, if node_modules is missing or we just fetched → `bun install`

10//

11// Idempotent: on an already-provisioned machine it's a quiet no-op. Every step

12// gives an actionable error instead of leaving a half-installed receiver.

14import fs from "node:fs";

15import path from "node:path";

16import { execFileSync } from "node:child_process";

17import { CHANNEL_DIR, CHANNEL_REPO_URL } from "./config.mjs";

High

Child Process

Package source references child process execution.

lib/channel.mjsView on unpkg · L15

19function has(bin) {

20 try {

21 execFileSync("bash", ["-lc", `command -v ${bin}`], { stdio: "ignore" });

22 return true;

23 } catch {

24 return false;

25 }

26}

28// Inspect CHANNEL_DIR without changing anything. Read-only — safe in status/dry-run.

29export function channelStatus(dir = CHANNEL_DIR) {

30 const isGit = fs.existsSync(path.join(dir, ".git"));

31 const populated =

32 fs.existsSync(path.join(dir, "server.ts")) &&

33 fs.existsSync(path.join(dir, "package.json"));

34 const hasDeps = fs.existsSync(path.join(dir, "node_modules"));

35 return { dir, present: isGit || populated, isGit, populated, hasDeps };

36}

38// Describe what provisionChannel() would do, for `init --dry-run`. No side effects.

39export function describeProvision(dir = CHANNEL_DIR) {

40 const s = channelStatus(dir);

41 const lines = [];

42 if (s.isGit) lines.push(`git -C ${dir} pull --ff-only (update the existing checkout)`);

43 else if (s.populated) lines.push(`keep existing channel at ${dir} (non-git copy — left untouched)`);

44 else lines.push(`git clone --depth=1 ${CHANNEL_REPO_URL} ${dir}`);

45 if (!s.hasDeps || s.isGit) lines.push(`bun install (in ${dir})`);

46 else lines.push(`bun install skipped — node_modules already present`);

47 return lines;

48}

50function run(cmd, args, opts = {}) {

51 execFileSync(cmd, args, { stdio: "ignore", ...opts });

52}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/channel.mjsView on unpkg · L44

54// Bring CHANNEL_DIR to a runnable state. Returns { action, installedDeps }.

55// Throws Error with a fix-it message when git/bun are missing or a step fails.

56export function provisionChannel(dir = CHANNEL_DIR) {

57 const s = channelStatus(dir);

58 let action;

59 let fetched = false;

61 if (s.isGit) {

62 if (!has("git"))

63 throw new Error(

64 `git is required to update the channel at ${dir}, but it isn't on PATH. ` +

lib/launchd.mjsView file

Lines 1-27javascript

1// launchd LaunchAgent for the always-on receiver session (spec 3.1 step 2,

2// plist label com.botook.channel). RunAtLoad + KeepAlive so it comes up at

3// login and after a crash — that's what makes offline messages get delivered

4// when the machine wakes back up (spec §六 acceptance #5).

6import fs from "node:fs";

7import path from "node:path";

8import { execFileSync } from "node:child_process";

Source & flagged code

3 flagged · loading source

lib/channel.mjsView file

15import path from "node:path"; L16: import { execFileSync } from "node:child_process"; L17: import { CHANNEL_DIR, CHANNEL_REPO_URL } from "./config.mjs";

High

Child Process

Package source references child process execution.

lib/channel.mjsView on unpkg · L15

44else lines.push(`git clone --depth=1 ${CHANNEL_REPO_URL} ${dir}`); L45: if (!s.hasDeps || s.isGit) lines.push(`bun install (in ${dir})`); L46: else lines.push(`bun install skipped — node_modules already present`); ... L50: function run(cmd, args, opts = {}) { L51: execFileSync(cmd, args, { stdio: "ignore", ...opts }); L52: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/channel.mjsView on unpkg · L44

lib/launchd.mjsView file

7import path from "node:path"; L8: import { execFileSync } from "node:child_process"; L9: import { ... L17: L18: const HOME = process.env.HOME || ""; L19: ... L99: try { L100: const out = execFileSync("launchctl", ["print", target], { L101: encoding: "utf8", ... L110: if (/state = running/.test(out)) running = true; L111: const exitM = out.match(/last exit code = (\d+)/); L112: if (exitM) lastExit = Number(exitM[1]);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/launchd.mjsView on unpkg · L7

Findings

3 High4 Medium3 Low

HighChild Processlib/channel.mjs

HighShell

HighRuntime Package Installlib/channel.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencelib/launchd.mjs

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

lib/channel.mjsView file

Lines 1-64javascript

1// Provision the botook-channel plugin the always-on receiver loads via

2// --plugin-dir. Without it, the launchd session has nothing to run and flaps,

3// so `init` calls provisionChannel() before registering the receiver. This

4// mirrors botook-channel/install.sh so the two install paths stay in sync:

5//

6// • a git checkout already there → `git pull --ff-only` (update)

7// • a populated non-git dev copy → keep as-is (never clobber a checkout)

8// • nothing there → `git clone --depth=1`

9// then, if node_modules is missing or we just fetched → `bun install`

10//

11// Idempotent: on an already-provisioned machine it's a quiet no-op. Every step

12// gives an actionable error instead of leaving a half-installed receiver.

14import fs from "node:fs";

15import path from "node:path";

16import { execFileSync } from "node:child_process";

17import { CHANNEL_DIR, CHANNEL_REPO_URL } from "./config.mjs";

High

Child Process

Package source references child process execution.

lib/channel.mjsView on unpkg · L15

19function has(bin) {

20 try {

21 execFileSync("bash", ["-lc", `command -v ${bin}`], { stdio: "ignore" });

22 return true;

23 } catch {

24 return false;

25 }

26}

28// Inspect CHANNEL_DIR without changing anything. Read-only — safe in status/dry-run.

29export function channelStatus(dir = CHANNEL_DIR) {

30 const isGit = fs.existsSync(path.join(dir, ".git"));

31 const populated =

32 fs.existsSync(path.join(dir, "server.ts")) &&

33 fs.existsSync(path.join(dir, "package.json"));

34 const hasDeps = fs.existsSync(path.join(dir, "node_modules"));

35 return { dir, present: isGit || populated, isGit, populated, hasDeps };

36}

38// Describe what provisionChannel() would do, for `init --dry-run`. No side effects.

39export function describeProvision(dir = CHANNEL_DIR) {

40 const s = channelStatus(dir);

41 const lines = [];

42 if (s.isGit) lines.push(`git -C ${dir} pull --ff-only (update the existing checkout)`);

43 else if (s.populated) lines.push(`keep existing channel at ${dir} (non-git copy — left untouched)`);

44 else lines.push(`git clone --depth=1 ${CHANNEL_REPO_URL} ${dir}`);

45 if (!s.hasDeps || s.isGit) lines.push(`bun install (in ${dir})`);

46 else lines.push(`bun install skipped — node_modules already present`);

47 return lines;

48}

50function run(cmd, args, opts = {}) {

51 execFileSync(cmd, args, { stdio: "ignore", ...opts });

52}

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/channel.mjsView on unpkg · L44

54// Bring CHANNEL_DIR to a runnable state. Returns { action, installedDeps }.

55// Throws Error with a fix-it message when git/bun are missing or a step fails.

56export function provisionChannel(dir = CHANNEL_DIR) {

57 const s = channelStatus(dir);

58 let action;

59 let fetched = false;

61 if (s.isGit) {

62 if (!has("git"))

63 throw new Error(

64 `git is required to update the channel at ${dir}, but it isn't on PATH. ` +

lib/launchd.mjsView file

Lines 1-27javascript

1// launchd LaunchAgent for the always-on receiver session (spec 3.1 step 2,

2// plist label com.botook.channel). RunAtLoad + KeepAlive so it comes up at

3// login and after a crash — that's what makes offline messages get delivered

4// when the machine wakes back up (spec §六 acceptance #5).

6import fs from "node:fs";

7import path from "node:path";

8import { execFileSync } from "node:child_process";