Lines 1-61javascript
2var gx=Object.create;var kc=Object.defineProperty;var yx=Object.getOwnPropertyDescriptor;var _x=Object.getOwnPropertyNames;var vx=Object.getPrototypeOf,wx=Object.prototype.hasOwnProperty;var S=(t,e)=>()=>(e||t((e={exports:{}}).exports,e),e.exports),Tc=(t,e)=>{for(var r in e)kc(t,r,{get:e[r],enumerable:!0})},xx=(t,e,r,n)=>{if(e&&typeof e=="object"||typeof e=="function")for(let o of _x(e))!wx.call(t,o)&&o!==r&&kc(t,o,{get:()=>e[o],enumerable:!(n=yx(e,o))||n.enumerable});return t};var ut=(t,e,r)=>(r=t!=null?gx(vx(t)):{},xx(e||!t||!t.__esModule?kc(r,"default",{value:t,enumerable:!0}):r,t));var Ss= ...
3`:""},this._extScope=e,this._scope=new Mt.Scope({parent:e}),this._nodes=[new vd]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){return this._extScope.name(e)}scopeValue(e,r){let n=this._extScope.value(e,r);return(this._values[n.prefix]||(this._values[n.prefix]=new Set)).add(n),n}getScopeValue(e,r){return this._extScope.getValue(e,r)}scopeRefs(e){return this._extScope.scopeRefs(e,this._values)}scopeCode(){return this._extScope.scopeCode(this._values)}_def(e,r,n,o){let s=this._scope.toName(r);return n!==void 0&&o&&(this._constants[s.str]=n),this._l ...
4 || (${i} == "string" && ${o} && ${o} == +${o})`).assign(a,(0,G._)`+${o}`);return;case"integer":n.elseIf((0,G._)`${i} === "boolean" || ${o} === null
5 || (${i} === "string" && ${o} && ${o} == +${o} && !(${o} % 1))`).assign(a,(0,G._)`+${o}`);return;case"boolean":n.elseIf((0,G._)`${o} === "false" || ${o} === 0 || ${o} === null`).assign(a,!1).elseIf((0,G
6 || ${i} === "boolean" || ${o} === null`).assign(a,(0,G._)`[${o}]`)}}}function _T({gen:t,parentData:e,parentDataProperty:r},n){t.if((0,G._)`${e} !== undefined`,()=>t.assign((0,G
7 missingProperty: ${n},
LowEval
Package source references a known benign dynamic code generation pattern.
dist/punchlist-mcp.cjsView on unpkg · L5 9 deps: ${r}}`};var XP={keyword:"dependencies",type:"object",schemaType:"object",error:nr.error,code(t){let[e,r]=YP(t);W_(t,e),J_(t,r)}};function YP({schema:t}){let e={},r={};for(let n
10`).filter(i=>i),o=Math.min(...n.map(i=>i.length-i.trimStart().length)),s=n.map(i=>i.slice(o)).map(i=>" ".repeat(this.indent*2)+i);for(let i of s)this.content.push(i)}compile(){let e=Function,r=this?.args,o=[...(this?.content??[""]).map(s=>` ${s}`)];return new e(...r,o.join(`
11`))}};var sm={major:4,minor:0,patch:0};var me=E("$ZodType",(t,e)=>{var r;t??(t={}),t._zod.def=e,t._zod.bag=t._zod.bag||{},t._zod.version=sm;let n=[...t._zod.def.checks??[]];t._zod.traits.has("$ZodCheck")&&n.unshift(t);for(let o of n)for(let s of o._zod.onattach)s(t);if(n.length===0)(r=t._zod).deferred??(r.deferred=[]),t._zod.deferred?.push(()=>{t._zod.run=t._zod.parse});else{let o=(s,i,a)=>{let c=Pn(s),u;for(let f of i){if(f._zod.def.when){if(!f._zod.def.when(s))continue}else if(c)continue;let d=s.issues.length,y=f._zod.check(s);if(y instanceof Promise&&a?.async===!1)throw new vr;if(u||y insta ...
12 if (${h}.issues.length) {
13 if (input[${w}] === undefined) {
15 newResult[${w}] = undefined;
18 payload.issues = payload.issues.concat(
19 ${h}.issues.map((iss) => ({
21 path: iss.path ? [${w}, ...iss.path] : [${w}],
25 } else if (${h}.value === undefined) {
26 if (${w} in input) newResult[${w}] = undefined;
28 newResult[${w}] = ${h}.value;
30 `)}else{let h=m[v];y.write(`const ${h} = ${l(v)};`),y.write(`
31 if (${h}.issues.length) payload.issues = payload.issues.concat(${h}.issues.map(iss => ({
33 path: iss.path ? [${zn(v)}, ...iss.path] : [${zn(v)}]
34 })));`),y.write(`newResult[${zn(v)}] = ${h}.value`)}y.write("payload.value = newResult;"),y.write("return payload;");let _=y.compile();return(v,h)=>_(d,v,h)},o,s=co,i=!gi.jitless,c=i&&Lc.value,u=e.catchall,f;t._zod.parse=(d,y)=>{f??(f=r.value);let p=d.value;if(!s(p))return d.issues.push({expected:"object",code:"invalid_type",input:p,inst:t}),d;let l=[];if(i&&c&&y?.async===!1&&y.jitless!==!0)o||(o=n(e.shape)),d=o(d,y);else{d.value={};let h=f.shape;for(let w of f.keys){let x=h[w],$=x._zod.run({value:p[w],issues:[]},y),I=x._zod.optin==="optional"&&x._zod.optout==="optional";$ instanceof ...
36Set the \`cycles\` parameter to \`"ref"\` to resolve cyclical schemas with defs.`)}for(let f of this.seen.entries()){let d=f[1];if(e===f[0]){i(f);continue}if(n.external){let p=n.external.registry.get(f[0])?.id;if(e!==f[
37]))`;continue}else if(n[c]==="$"){o+=`($|(?=[\r
38]))`;continue}}if(r.s&&n[c]==="."){o+=i?`${n[c]}\r
40]`;continue}o+=n[c],n[c]==="\\"?s=!0:i&&n[c]==="]"?i=!1:!i&&n[c]==="["&&(i=!0)}try{new RegExp(o)}catch{return console.warn(`Could not convert regex pattern at ${e.currentPath.join("/")} to a flag-independent form! Falling back to the flag-ignorant source`),t.source}return o}function ua(t,e){if(e.target===
41`);if(e===-1)return null;let r=this._buffer.toString("utf8",0,e).replace(/\r$/,"");return this._buffer=this._buffer.subarray(e+1),zO(r)}clear(){this._buffer=void 0}};function zO(t){return ig.parse(JSON.parse(t))}function Xv(t){return JSON.stringify(t)+`
42`}var Xa=class{constructor(e=of.default.stdin,r=of.default.stdout){this._stdin=e,this._stdout=r,this._readBuffer=new Ja,this._started=!1,this._ondata=n=>{this._readBuffer.append(n),this.processReadBuffer()},this._onerror=n=>{this.onerror?.(n)}}async start(){if(this._started)throw new Error("StdioServerTransport already started! If using Server class, note that connect() calls start() automatically.");this._started=!0,this._stdin.on("data",this._ondata),this._stdin.on("error",this._onerror)}processReadBuffer(){for(;;)try{let e=this._readBuffer.readMessage();if(e===null)break;this.onmessage?.(e) ...
43${e}
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/punchlist-mcp.cjsView on unpkg · L29 HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist/punchlist-mcp.cjsView on unpkg · L35 HighChild Process
Package source references child process execution.
dist/punchlist-mcp.cjsView on unpkg · L41 46${i}`,c=vc.default.createHmac("sha256",r).update(a).digest("hex");return{"X-Punchlist-Timestamp":o,"X-Punchlist-Nonce":s,"X-Punchlist-Signature":c}}function nN(t,e,r){return(n,o)=>{let s=!1,i=/^[\d.]+$
48${o}`)}catch{r.push(n)}return{text:e.join(`
52`),missing:r}}async function Xf(t){let r=(await Ie()).instructionSources?.[t.name]??{},n=[];for(let[o,s]of Object.entries(r))try{let{text:i}=await li(s.files),a=(0,ln.createHash)("sha256").update(i).digest("hex");if(a===s.lastHash)continue;await bc(t,o,i),await oc(t.name,o,{files:s.files,lastHash:a}),n.push(o)}catch{break}return n}async function Yf(t){let r=(await Ie()).iconSources?.[t.name]??{};if(Object.keys(r).length===0)return[];let n=null,o=[];for(let[s,i]of Object.entries(r))try{let a=await Wt.promises.readFile(i.file).catch(()=>null);if(!a)continue;let c=(0,ln.createHash)("sha256").upda ...
54${c}`))}catch(i){return ae(i)}}),t.registerTool("export_icloud_credentials",{title:"Export iCloud credentials for a remote environment",description:"Mint iCloud credentials for a headless/remote environment (cloud sandbox, CI, a Claude remote session) that can't open a browser to sign in itself. Runs the same Apple ID sign-in flow as connect_icloud on THIS machine, but mints a SEPARATE web-auth token and does NOT touch the local config \u2014 each export is an independent token lineage, so the remote environment and this machine never invalidate each other through token rotation. Returns the v ...
56${i}`))}catch(o){return ae(o)}}),t.registerTool("list_pending_punchlists",{title:"List pending punchlists",description:'List unprocessed punchlist sessions. Merges the LAN device (GET /mcp/pending) with the iCloud source when connect_icloud has been run, so sessions show up even when the phone is off-LAN. Each item carries a `source` ("lan" or "cloud"); when the same session is on both, the LAN copy wins. If one source is unreachable the other still answers (see `sources_responded`/`source_errors`). Each item includes `target_app` \u2014 the app the session was recorded for \u2014 when the use ...
60`);if(p.length>6e4)return ae(new Error(`Instructions are ${p.length} characters; keep them under 60k so they stay useful as context.`));if(await bc(c,u,p),f.instructions_chars=p.length,s&&o&&o.length>0){let{text:l}=await li(o),m=(
Long lines were clipped for display.