Lines 1-61javascript
2var Dw=Object.create;var uc=Object.defineProperty;var Lw=Object.getOwnPropertyDescriptor;var Zw=Object.getOwnPropertyNames;var jw=Object.getPrototypeOf,Mw=Object.prototype.hasOwnProperty;var $=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),lc=(t,e)=>{for(var r in e)uc(t,r,{get:e[r],enumerable:!0})},Uw=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of Zw(e))!Mw.call(t,o)&&o!==r&&uc(t,o,{get:()=>e[o],enumerable:!(n=Lw(e,o))||n.enumerable});return t};var it=(t,e,r)=>(r=t!=null?Dw(jw(t)):{},Uw(e||!t||!t.__esModule?uc(r,"default",{value:t,enumerable:!0}):r,t));var ms= ...
3`:""},this._extScope=e,this._scope=new Lt.Scope({parent:e}),this._nodes=[new rd]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){return this._extScope.name(e)}scopeValue(e,r){let n=this._extScope.value(e,r);return(this._values[n.prefix]||(this._values[n.prefix]=new Set)).add(n),n}getScopeValue(e,r){return this._extScope.getValue(e,r)}scopeRefs(e){return this._extScope.scopeRefs(e,this._values)}scopeCode(){return this._extScope.scopeCode(this._values)}_def(e,r,n,o){let s=this._scope.toName(r);return n!==void 0&&o&&(this._constants[s.str]=n),this._l ...
4 || (${i} == "string" && ${o} && ${o} == +${o})`).assign(a,(0,K._)`+${o}`);return;case"integer":n.elseIf((0,K._)`${i} === "boolean" || ${o} === null
5 || (${i} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,K._)`+${o}`);return;case"boolean":n.elseIf((0,K._)`${o} === "false" || ${o} === 0 || ${o} === null`).assign(a,!1).elseIf((0,K
6 || ${i} === "boolean" || ${o} === null`).assign(a,(0,K._)`[${o}]`)}}}function Zk({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,K._)`${e} !== undefined`,()=>t.assign((0,K
7 missingProperty: ${n},
LowEval
Package source references a known benign dynamic code generation pattern.
dist/punchlist-mcp.cjsView on unpkg · L5 9 deps: ${r}}`};var yP={keyword:"dependencies",type:"object",schemaType:"object",error:Xt.error,code(t){let[e,r]=_P(t);C_(t,e),A_(t,r)}};function _P({schema:t}){let e={},r={};for(let n in
10`).filter(i=>i),o=Math.min(...n.map(i=>i.length-i.trimStart().length)),s=n.map(i=>i.slice(o)).map(i=>" ".repeat(this.indent*2)+i);for(let i of s)this.content.push(i)}compile(){let e=Function,r=this?.args,o=[...(this?.content??[""]).map(s=>` ${s}`)];return new e(...r,o.join(`
11`))}};var Bh={major:4,minor:0,patch:0};var fe=E("$ZodType",(t,e)=>{var r;t??(t={}),t._zod.def=e,t._zod.bag=t._zod.bag||{},t._zod.version=Bh;let n=[...t._zod.def.checks??[]];t._zod.traits.has("$ZodCheck")&&n.unshift(t);for(let o of n)for(let s of o._zod.onattach)s(t);if(n.length===0)(r=t._zod).deferred??(r.deferred=[]),t._zod.deferred?.push(()=>{t._zod.run=t._zod.parse});else{let o=(s,i,a)=>{let c=wn(s),u;for(let f of i){if(f._zod.def.when){if(!f._zod.def.when(s))continue}else if(c)continue;let d=s.issues.length,y=f._zod.check(s);if(y instanceof Promise&&a?.async===!1)throw new dr;if(u||y insta ...
12 if (${h}.issues.length) {
13 if (input[${w}] === undefined) {
15 newResult[${w}] = undefined;
18 payload.issues = payload.issues.concat(
19 ${h}.issues.map((iss) => ({
21 path: iss.path ? [${w}, ...iss.path] : [${w}],
25 } else if (${h}.value === undefined) {
26 if (${w} in input) newResult[${w}] = undefined;
28 newResult[${w}] = ${h}.value;
30 `)}else{let h=m[v];y.write(`const ${h} = ${l(v)};`),y.write(`
31 if (${h}.issues.length) payload.issues = payload.issues.concat(${h}.issues.map(iss => ({
33 path: iss.path ? [${vn(v)}, ...iss.path] : [${vn(v)}]
34 })));`),y.write(`newResult[${vn(v)}] = ${h}.value`)}y.write("payload.value = newResult;"),y.write("return payload;");let _=y.compile();return(v,h)=>_(d,v,h)},o,s=ro,i=!ri.jitless,c=i&&wc.value,u=e.catchall,f;t._zod.parse=(d,y)=>{f??(f=r.value);let p=d.value;if(!s(p))return d.issues.push({expected:"object",code:"invalid_type",input:p,inst:t}),d;let l=[];if(i&&c&&y?.async===!1&&y.jitless!==!0)o||(o=n(e.shape)),d=o(d,y);else{d.value={};let h=f.shape;for(let w of f.keys){let x=h[w],S=x._zod.run({value:p[w],issues:[]},y),I=x._zod.optin==="optional"&&x._zod.optout==="optional";S instanceof ...
36Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let f of this.seen.entries()){let d=f[1];if(e===f[0]){i(f);continue}if(n.external){let p=n.external.registry.get(f[0])?.id;if(e!==f[
37]))`;continue}else if(n[c]==="$"){o+=`($|(?=[\r
38]))`;continue}}if(r.s&&n[c]==="."){o+=i?`${n[c]}\r
40]`;continue}o+=n[c],n[c]==="\\"?s=!0:i&&n[c]==="]"?i=!1:!i&&n[c]==="["&&(i=!0)}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${e.currentPath.join("/")} to a flag-independent form! Falling back to the flag-ignorant source`),t.source}return o}function Wi(t,e){if(e.target===
41`);if(e===-1)return null;let r=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),W1(r)}clear(){this._buffer=void 0}};function W1(t){return Vm.parse(JSON.parse(t))}function Dv(t){return JSON.stringify(t)+`
42`}var La=class{constructor(e=Up.default.stdin,r=Up.default.stdout){this._stdin=e,this._stdout=r,this._readBuffer=new Da,this._started=!1,this._ondata=n=>{this._readBuffer.append(n),this.processReadBuffer()},this._onerror=n=>{this.onerror?.(n)}}async start(){if(this._started)throw new Error("StdioServerTransport already started! If using Server class, note that connect() calls start() automatically.");this._started=!0,this._stdin.on("data",this._ondata),this._stdin.on("error",this._onerror)}processReadBuffer(){for(;;)try{let e=this._readBuffer.readMessage();if(e===null)break;this.onmessage?.(e) ...
43${e}
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/punchlist-mcp.cjsView on unpkg · L29 HighChild Process
Package source references child process execution.
dist/punchlist-mcp.cjsView on unpkg · L41 46${i}`,c=Qa.default.createHmac("sha256",r).update(a).digest("hex");return{"X-Punchlist-Timestamp":o,"X-Punchlist-Nonce":s,"X-Punchlist-Signature":c}}function cR(t,e,r){return(n,o)=>{let s=!1,i=/^[\d.]+$
48${o}`)}catch{r.push(n)}return{text:e.join(`
52`),missing:r}}async function Df(t){let r=(await Ce()).instructionSources?.[t.name]??{},n=[];for(let[o,s]of Object.entries(r))try{let{text:i}=await Zf(s.files),a=(0,Js.createHash)("sha256").update(i).digest("hex");if(a===s.lastHash)continue;await If(t,o,i),await Bp(t.name,o,{files:s.files,lastHash:a}),n.push(o)}catch{break}return n}async function Lf(t){let r=(await Ce()).iconSources?.[t.name]??{};if(Object.keys(r).length===0)return[];let n=null,o=[];for(let[s,i]of Object.entries(r))try{let a=await en.promises.readFile(i.file).catch(()=>null);if(!a)continue;let c=(0,Js.createHash)("sha256").upda ...
54${a}`))}catch(s){return Re(s)}}),t.registerTool("list_pending_punchlists",{title:"List pending punchlists",description:'List unprocessed punchlist sessions. Merges the LAN device (GET /mcp/pending) with the iCloud source when connect_icloud has been run, so sessions show up even when the phone is off-LAN. Each item carries a `source` ("lan" or "cloud"); when the same session is on both, the LAN copy wins. If one source is unreachable the other still answers (see `sources_responded`/`source_errors`). Each item includes `target_app` \u2014 the app the session was recorded for \u2014 when the use ...
58`),y=await Tf(c,e);if(o&&d){let l=(await Ws(c)).find(m=>m.name===y)?.instructions;l&&(d=`${l}
Long lines were clipped for display.