119try {
L120: const parsed = JSON.parse(raw);
L121: if (!parsed || typeof parsed !== "object" || typeof parsed.accounts !== "object") {
...
L148: var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
L149: var PRE_TOOL_USE_MATCHER = "^(Bash|Read|Grep|Write|Edit|MultiEdit|NotebookEdit|Agent|PowerShell)$";
L150: function hookCommand(script, verb) {
...
L262: // `password=...`, `token = ...`, `access_key: ...` — the value need not be quoted.
L263: /\b(?:api[_-]?key|secret|password|passwd|token|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer)\b\s*[:=]\s*\S+/i,
L264: // Connection strings that embed credentials: `scheme://user:pass@host`.
...
L1880: "const p=require(`path`),f=require(`fs`),c=require(`child_process`);",
L1881: "let d=process.cwd();"
CriticalReverse Shell
Source matches reverse-shell style process and socket wiring.
dist/cli.jsView on unpkg · L119 119Trigger-reachable chain: manifest.bin -> dist/bin.js -> dist/cli.js
L119: try {
L120: const parsed = JSON.parse(raw);
L121: if (!parsed || typeof parsed !== "object" || typeof parsed.accounts !== "object") {
...
L148: var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
L149: var PRE_TOOL_USE_MATCHER = "^(Bash|Read|Grep|Write|Edit|MultiEdit|NotebookEdit|Agent|PowerShell)$";
L150: function hookCommand(script, verb) {
...
L262: // `password=...`, `token = ...`, `access_key: ...` — the value need not be quoted.
L263: /\b(?:api[_-]?key|secret|password|passwd|token|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer)\b\s*[:=]\s*\S+/i,
L264: // Connection strings that embed credentials: `scheme://user:pass@host`.
...
L1880: "const p=require(`path`),f=requi
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
dist/cli.jsView on unpkg · L119 11079// dist/control-origin.js
L11080: var DEFAULT_CONTROL_ORIGIN = "https://control.halfcycle.ai";
L11081: function resolveControlOrigin(env = process.env) {
L11082: const configured = env["HALFCYCLE_SERVICE_URL"]?.trim();
...
L11091: // dist/device-signin.js
L11092: import { spawn } from "node:child_process";
L11093: import { platform as platform3 } from "node:os";
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/cli.jsView on unpkg · L11079 119try {
L120: const parsed = JSON.parse(raw);
L121: if (!parsed || typeof parsed !== "object" || typeof parsed.accounts !== "object") {
...
L148: var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
L149: var PRE_TOOL_USE_MATCHER = "^(Bash|Read|Grep|Write|Edit|MultiEdit|NotebookEdit|Agent|PowerShell)$";
L150: function hookCommand(script, verb) {
...
L262: // `password=...`, `token = ...`, `access_key: ...` — the value need not be quoted.
L263: /\b(?:api[_-]?key|secret|password|passwd|token|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer)\b\s*[:=]\s*\S+/i,
L264: // Connection strings that embed credentials: `scheme://user:pass@host`.
...
L1880: "const p=require(`path`),f=require(`fs`),c=require(`child_process`);",
L1881: "let d=process.cwd();"
HighSandbox Evasion Gated Capability
Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.
dist/cli.jsView on unpkg · L119 119Cross-file remote execution chain: dist/cli.js spawns bin/bin.bundle.mjs; helper contains network access plus dynamic code execution.
L119: try {
L120: const parsed = JSON.parse(raw);
L121: if (!parsed || typeof parsed !== "object" || typeof parsed.accounts !== "object") {
...
L148: var WRITE_CAPABLE_TOOLS = ["Edit", "MultiEdit", "NotebookEdit", "Write"];
L149: var PRE_TOOL_USE_MATCHER = "^(Bash|Read|Grep|Write|Edit|MultiEdit|NotebookEdit|Agent|PowerShell)$";
L150: function hookCommand(script, verb) {
...
L262: // `password=...`, `token = ...`, `access_key: ...` — the value need not be quoted.
L263: /\b(?:api[_-]?key|secret|password|passwd|token|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|bearer)\b\s*[:=]\s*\S+/i,
L264: // Connection strings that embed credentials: `sch
HighCross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/cli.jsView on unpkg · L119 1873}
L1874: var CODEX_WINDOWS_NOT_SET_UP = "Halfcycle checks did not run because Halfcycle is not set up in this folder or any folder above it; run npx halfcycle in the project folder.";
L1875: var CODEX_WINDOWS_NO_GIT_BASH = "Halfcycle checks did not run because Git for Windows was not found; install Git for Windows, then open a new session.";
...
L1879: const program = [
L1880: "const p=require(`path`),f=require(`fs`),c=require(`child_process`);",
L1881: "let d=process.cwd();",
HighRuntime Package Install
Package source invokes a package manager install command at runtime.
dist/cli.jsView on unpkg · L1873