registry / typebulb / 0.23.1

typebulb@0.23.1

Typebulb CLI to run single-file markdown apps called bulbs, either as standalone web apps or embedded in agent responses.

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 1.54 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, api.typebulb.com, cdn.jsdelivr.net, cdn.skypack.dev, data.jsdelivr.com, esm.sh, generativelanguage.googleapis.com, openrouter.ai, registry.npmjs.org, unpkg.com

Oversized source lightweight scan

dist/agents/claude/client.js2.43 MB file, sampled 256 KB

NetworkChildProcessEvalObfuscatedHighEntropyStringsUrlStringscdn.skypack.devunpkg.com

dist/agents/pi/client.js2.43 MB file, sampled 256 KB

NetworkChildProcessEvalObfuscatedHighEntropyStringsUrlStringscdn.skypack.devunpkg.com

Source & flagged code

7 flagged

dist/servers.jsView file

Lines 119-158javascript

119\r `),Vn=s=>!s||ed.has(s),Wn=class{constructor(){this.atEnd=!1,this.blockScalarIndent=-1,this.blockScalarKeep=!1,this.buffer="",this.flowKey=!1,this.flowLevel=0,this.indentNext=0,this.indentValue=0,this.lineEndPos=null,this.next=null,this.pos=0}*lex(e,t=!1){if(e){if(typeof e!="string")throw TypeError("source is not a string");this.buffer=this.buffer?this.buffer+e:e,this.lineEndPos=null}this.atEnd=!t;let n=this.next??"stream";for(;n&&(t||this.hasChars(1));)n=yield*this.parseNext(n)}atLineEnd(){let e=this.pos,t=this.buffer[e];for(;t===" "||t===" ";)t=this.buffer[++e];return!t||t==="#"||t===`

120`?!0:t==="\r"?this.buffer[e+1]===`

121`:!1}charAt(e){return this.buffer[this.pos+e]}continueScalar(e){let t=this.buffer[e];if(this.indentNext>0){let n=0;for(;t===" ";)t=this.buffer[++n+e];if(t==="\r"){let r=this.buffer[n+e+1];if(r===`

122`||!r&&!this.atEnd)return e+n+1}return t===`

123`||n>=this.indentNext||!t&&!this.atEnd?e+n:-1}if(t==="-"||t==="."){let n=this.buffer.substr(e,3);if((n==="---"||n==="...")&&$(this.buffer[e+3]))return-1}return e}getLine(){let e=this.lineEndPos;return(typeof e!="number"||e!==-1&&e<this.pos)&&(e=this.buffer.indexOf(`

124`,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]==="\r"&&(e-=1),this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buffer.substring(this.pos),this.pos=0,this.lineEndPos=null,this.next=e,null}peek(e){return this.buffer.substr(this.pos,e)}*parseNext(e){switch(e){case"stream":return yield*this.parseStream();case"line-start":return yield*this.parseLineStart();case"block-start":return yield*this.parseBlockStart();case"doc":return yield*this.parseDocument();case"flow":return yi ...

125`,this.pos);if(r!==-1){for(;r!==-1;){let i=this.continueScalar(r+1);if(i===-1)break;r=n.indexOf(`

126`,i)}r!==-1&&(t=r-(n[r-1]==="\r"?2:1))}if(t===-1){if(!this.atEnd)return this.setNext("quoted-scalar");t=this.buffer.length}return yield*this.

127`:e=i,t=0;break;case"\r":{let o=this.buffer[i+1];if(!o&&!this.atEnd)return this.setNext("block-scalar");if(o===`

128`)break}default:break e}if(!n&&!this.atEnd)return this.setNext("block-scalar");if(t>=this.indentNext){this.blockScalarIndent===-1?this.indentNext=t:this.indentNext=this.blockScalarIndent+(this.indentNext

129`,i)}while(e!==-1);if(e===-1){if(!this.atEnd)return this.setNext("block-scalar");e=this.buffer.length}}let r=e+1;for(n=this.buffer[r];n===" ";)n=this.buffer[++r];

130`;)n=this.buffer[++r];e=r-1}else if(!this.blockScalarKeep)do{let i=e-1,o=this.buffer[i];o==="\r"&&(o=this.buffer[--i]);let a=i;for(;o===" "

131`&&i>=this.pos&&i+1+t>a)e=i;else break}while(!0);return yield st.SCALAR,yield*this.pushToIndex(e+1,!0),yield*this.parseLineStart()}*parsePlainScalar(){

132`?(n+=1,r=`

133`,i=this.buffer[n+1]):t=n),i==="#"||e&&ts.has(i))break;if(r===`

134`){let o=this.continueScalar(n+1);if(o===-1)break;n=Math.max(n,o-2)}}else{if(e&&ts.has(r))break;t=n}return!r&&!this.atEnd?this.setNext("plain-scalar")

135`?yield*this.pushCount(1):e==="\r"&&this.charAt(1)===`

136`?yield*this.pushCount(2):0}*pushSpaces(e){let t=this.pos-1,n;do n=this.buffer[++t];while(n===" "||e&&n===" ");let r=t-this.pos;return r>0&&(yield this.buffer.substr(this.pos,r),this.pos=t),r}*pushUntil(e){let t=this.pos,n=this.buffer[t];for(;!e(n);)n=this.buffer[++t];return yield*this.pushToIndex(t,!1)}};Wo.Lexer=Wn});var Qn=g(Go=>{"use strict";var Hn=class{constructor(){this.lineStarts=[],this.addNewLine=e=>this.lineStarts.push(e),this.linePos=e=>{let t=0,n=this.lineStarts.length;for(;t<n;){let i=t+n>>1;this.lineStarts[i]<e?t=i+1:n=i}if(this.lineStarts[t]===e)return{line:t+1,col:1};if(t===0) ...

137`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(`

138`,t)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(e){let t=e.items[e.items.length-1];switch(this.type){case"newline":if(this.onKeyLine=!1,t.value){let

139`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(`

140`,t)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":return this.flowScalar(this.type);case"block-scalar-header":return{type:"block-scalar",offset:this.offset,indent:this.indent,props:[this.sourceToken],source:""};case"flow-map-start":case"flow-seq-start":return{type:"flow-collection",offset:this.offset,indent:this.indent,start:this.sourceToken,items:[],end:[]};case"seq-item-ind":return{type:"block-seq",offset:this.offset,indent:this.indent,items:[{start ...

141`),t=0;if(e[t]?.trim()!=="---")return null;t++;let n=[];for(;t<e.length&&e[t]?.trim()!=="---";)n.push(e[t]),t++;if(e[t]?.trim()!=="---")return null;t++

142`)),a=t}else t++}return{frontmatter:r,files:i,warnings:o,bodyEndLine:a}}catch{return null}}function Ka(s,e,t){let n=[];for(let r=0;r<e.length;r++){let i=e[r]?.trim().match

143

144${o}${i}

145${r}

146${o}`});return["---",`format: ${fr}`,`name: ${ys(s.name)}`,"---","",...e].join(`

147`)}var Ad=Aa(oa(),1);function rs(s){return{...mr(s),server:s.files.get("server.ts")??""}}function aa(s){return!!s.server&&!s.code}function is(s){let e=/^---[^\n]*\n([\s\S]*?)\n---/.exec(s),t=e?/^\s*name:\s*(.+?)\s*$/m.exec(e[1]):null;return t?t[1].replace(/^["']|["']$/g,""):void 0}function kd(s){return(is(s)??"bulb").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"bulb"}function Nd(s){return s.replace(/^---[^\n]*\r?\n[\s\S]*?\r?\n---[^\n]*\r?\n?/,"").replace(/^\r?\n+/,"")}function ca(s,e,t){if(e>8)return t;let n;try{n=Od(s,{withFileTypes:!0})}catch{return t}for(let r of n)if( ...

148`)).map(e=>e.root)}function xd(s){let e=he(s);if(!e)return s;let t=e.files.get("code.tsx");if(!t)return s;let n=fa(t);if(!n.length)return

149

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/servers.jsView on unpkg · L139

150`){let n=e.filter(r=>r.role==="system").map(r=>r.content);return{system:n.length?n.join(t):void 0,conversationMessages:e.filter(r=>r.role!=="system")}}parseJsonError(e,t){if(!e)return{message:`HTTP ${t}`};try{let n=JSON.parse(e);return n.error&&typeof n.error=="object"?{message:n.error.message||`HTTP ${t}`,type:n.error.type}:n.message?{message:n.message}:{message:e}}catch{return{message:e}}}checkAndThrowError(e){if(typeof e!="object"||e===null)return;let t=e;if(t.type==="error"&&"message"in t){let n=t.code||"unknown";throw new Y(t.message,n,!!t.retryable)}if(t.error)throw new Y(this.extractErr ...

151`)),!t&&r.type==="message"&&r.content&&(t=r.content.filter(i=>i.type==="output_text").map(i=>i.text).join(""));return{text:t,reasoning:n}}parseProviderStreamChunk(e){if(!this.isResponsesApiEvent(e))return null;switch(e.type){case"response.failed":{let n=e.response?.error,r=n?.message||"Response failed",i=n?.code==="insufficient_quota"||n?.code==="rate_limit_exceeded";throw new Y(r,i?"rate_limit":"unknown",i)}case"response.output_text.delta":return{text:e.delta};case"response.reasoning_summary_text.delta":return{reasoning:e.delta};default:return null}}convertMessagesToInput(e){return e.map(t=>t ...

152

153`)}isResponsesApiEvent(e){return typeof e=="object"&&e!==null&&"type"in e&&typeof e.type=="string"}isResponsesApiResponse(e){return typeof e=="object"&&e!==null&&e.object==="response"}};var Te=class extends D{parseNonStreamingResponse(e){if(!this.hasChoices(e))return{text:""};let t=e,n=t.choices[0],r=n?.message,i=r?.content??n?.text??"",o=r?.reasoning??r?.reasoning_content??t.reasoning;return{text:i,reasoning:o}}parseProviderStreamChunk(e){if(!this.hasChoices(e))return null;let t=e.choices[0];if(!t)return null;let n=t.delta||t.message;if(!n)return null;let r=n.content||void 0,i=n.reasoning||n. ...

154

155`);return{text:t,reasoning:n||void 0}}parseProviderStreamChunk(e){return this.isAnthropicEvent(e)&&e.type==="content_block_delta"?e.delta.type==="text_delta"?{text:e.delta.text||""}:e.delta.type==="thinking_delta"?{reasoning:e.delta.thinking||""}:null:null}withLastMessageCached(e){let t=e.length-1;return e.map((n,r)=>r===t?{role:n.role,content:[{type:"text",text:n.content,cache_control:{type:"ephemeral"}}]}:n)}isAnthropicResponse(e){return typeof e=="object"&&e!==null&&e.type==="message"&&Array.isArray(e.content)}isAnthropicEvent(e){return typeof e=="object"&&e!==null&&"type"in e}isModernModel ...

156`),l={contents:o.map(p=>({role:p.role==="assistant"?"model":"user",parts:[{text:p.content}]}))};n?.webSearch!==!1&&(l.tools=[{google_search:{}}]),i&&(l.systemInstruction={role:"system",parts:[{text:i}]});let c=n?.effort;if(c!==void 0){let u={0:0,1:1024,2:8192,3:-1}[c];l.generationConfig={thinkingConfig:u===0?{thinkingBudget:0}:{includeThoughts:!0,thinkingBudget:u}}}return l}parseError(e,t){if(!e)return{message:`HTTP ${t}`};try{let n=JSON.parse(e),r=Array.isArray(n)?n[0]?.error:n?.error;return r&&typeof r=="object"?{message:(r.message||`HTTP ${t}`).split(`

157`)[0],type:r.status,code:r.code?.toString()}:n.message?{message:n.message}:{message:e}}catch{return{message:e}}}parseNonStreamingResponse(e){if(this.checkAndThrowError(e),this.checkGeminiError(e),!this.isGeminiResponse(e))return{text:"",status:"failed",error:"Invalid response format"};let t=this.extractParts(e).text||"",n=e.candidates?.[0]?.finishReason,r="complete";return n==="MAX_TOKENS"?r="interrupted":(n==="SAFETY"||n==="RECITATION")&&(r="failed"),{text:t,status:r}}parseProviderStreamChunk(e){if(this.checkGeminiError(e),!this.isGeminiResponse(e))return null;let t=this.extractParts(e);retur ...

158

Long lines were clipped for display.

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);

3var eg=Object.create;var Vi=Object.defineProperty;var tg=Object.getOwnPropertyDescriptor;var rg=Object.getOwnPropertyNames;

dist/render.jsView file

Lines 255-295javascript

255 const result = await ASYNC_OPTIONAL_CHAIN_NAME(ops);

256 return result == null ? true : result;

257 }

258 `},zr=class t{__init(){this.helperNames={}}__init2(){this.createRequireName=null}constructor(e){this.nameManager=e,t.prototype.__init.call(this),t.prototype.__init2.call(this)}getHelperName(e){let s=this.helperNames[e];return s||(s=this.nameManager.claimFreeName(`_${e}`),this.helperNames[e]=s,s)}emitHelpers(){let e="";this.helperNames.optionalChainDelete&&this.getHelperName("optionalChain"),this.helperNames.asyncOptionalChainDelete&&this.getHelperName("asyncOptionalChain");for(let[s,n]of Object.entries(Hd)){let o=this.helperNames[s],i=n;s==="optionalChainDelete"?i=i.replace("OPTIONAL_CHAIN_N ...

dist/agents/claude/client.jsView file

•path = dist/agents/claude/client.js kind = oversized_source_file sizeBytes = 2547393 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/agents/claude/client.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/servers.jsView file

High

Child Process

Package source references child process execution.

dist/servers.jsView on unpkg · L139

139`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(` L140: `,t)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-... L141: `),t=0;if(e[t]?.trim()!=="---")return null;t++;let n=[];for(;t<e.length&&e[t]?.trim()!=="---";)n.push(e[t]),t++;if(e[t]?.trim()!=="---")return null;t++;let r=Ya(n);if(!r)return nul... ... L147: `)}var Ad=Aa(oa(),1);function rs(s){return{...mr(s),server:s.files.get("server.ts")??""}}function aa(s){return!!s.server&&!s.code}function is(s){let e=/^---[^\n]*\n([\s\S]*?)\n---/... L148: `)).map(e=>e.root)}function xd(s){let e=he(s);if(!e)return s;let t=e.files.get("code.tsx");if(!t)return s;let n=fa(t);if(!n.length)return s;let r=e.files.get("config.json"),i={};if... L149:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/servers.jsView on unpkg · L139

dist/index.jsView file

347`)){if(!l.trim())continue;let f;try{f=JSON.parse(l)}catch{continue}if(!f||mn(f)||f.type!=="user")continue;let u=f.message?.content,d="";typeof u=="string"?d=rt(u):Array.isArray(u)&... L348: `),c=i.filter(u=>u.type==="tool_use").map(u=>({id:u.id??"",name:u.name??"",input:u.input??{}}));if(o||a||c.length){let u=Date.parse(e.timestamp??""),d=!isNaN(u)&&u>=t;n.push({type:... L349: name: typebulb

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L347

325L326: `){let n=e.filter(s=>s.role==="system").map(s=>s.content);return{system:n.length?n.join(t):void 0,conversationMessages:e.filter(s=>s.role!=="system")}}parseJsonError(e,t){if(!e)ret... L327: `)),!t&&s.type==="message"&&s.content&&(t=s.content.filter(i=>i.type==="output_text").map(i=>i.text).join(""));return{text:t,reasoning:n}}parseProviderStreamChunk(e){if(!this.isRes... ... L332: `),c={contents:o.map(f=>({role:f.role==="assistant"?"model":"user",parts:[{text:f.content}]}))};n?.webSearch!==!1&&(c.tools=[{google_search:{}}]),i&&(c.systemInstruction={role:"sys... L333: `)[0],type:s.status,code:s.code?.toString()}:n.message?{message:n.message}:{message:e}}catch{return{message:e}}}parseNonStreamingResponse(e){if(this.checkAndThrowError(e),this.chec... L334: \r ... L338: `).trim();if(!n)return null;if(n==="[DONE]")return"done";try{return JSON.parse(n)}catch{return null}}async function*fp(r,e,t){let n=new TextDecoder,s="",i=e?new Promise((o,a)=>{e.a... L339: `)}var rr,US,JS,KS,tr,si,nr=R(()=>{rr={anthropic:"ANTHROPIC_API_KEY",openai:"OPENAI_API_KEY",gemini:"GOOGLE_API_KEY",openrouter:"OPENROUTER_API_KEY"};US="https://api.typebulb.com/a... L340: `),n=[];if(t.forEach((o,a)=>{l

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L325

2import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L3: var eg=Object.create;var Vi=Object.defineProperty;var tg=Object.getOwnPropertyDescriptor;var rg=Object.getOwnPropertyNames;var ng=Object.getPrototypeOf,sg=Object.prototype.hasOwnPr... L4: `),t=0;if(e[t]?.trim()!=="---")return null;t++;let n=[];for(;t<e.length&&e[t]?.trim()!=="---";)n.push(e[t]),t++;if(e[t]?.trim()!=="---")return null;t++;let s=bg(n);if(!s)return nul... ... L9: ${o}`});return["---",`format: ${vl}`,`name: ${Qi(r.name)}`,"---","",...e].join(` L10: `)}var Ol=R(()=>{On();Rn()});function Rl(r){if(!r.trim())return{};try{return JSON.parse(r)}catch{return{}}}var _l=R(()=>{});var Cl=R(()=>{});function Zi(r,e,t){let s=new RegExp(e).... L11: >/]`,i);if(n&&console.log("[xml-utils] start:",o),o===-1)return;let a=r.slice(o+e.length),c=br(a,"^[^<]*[ /]>",0),l=c!==-1&&a[c-1]==="/";if(n&&console.log("[xml-utils] selfClosing:... ... L181: \`\`\`typescript L182: import React from "https://esm.sh/react" L183: import _ from "https://cdn.skypack.dev/lodash" ... L295: L296: **CRITICAL**: \`window.location\` changes, \`window.open()\`, and page reloads will break the app. L297:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L2

dist/render.jsView file

275`);return a===-1&&(a=i.length,i+=` L276: `),{code:i.slice(0,a+1)+s+i.slice(a+1)+n,mappings:this.shiftMappings(o.mappings,s.length)}}else return{code:s+i+n,mappings:this.shiftMappings(o.mappings,s.length)}}processBalancedC... L277: `);for(let a=0;a<i.length;a++){let l=i[a],u=a+1;for(let f of ek)f.targets.includes(s)&&f.pattern.test(l)&&o.push({type:f.type,severity:"error",message:ik(f.type,u),lineNumber:u,lin...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/render.jsView on unpkg · L275

dist/agents/claude/client.jsView file

•path = dist/agents/claude/client.js kind = oversized_source_file sizeBytes = 2547393 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/agents/claude/client.jsView on unpkg

Findings

5 High3 Medium8 Low

HighChild Processdist/servers.js

HighShelldist/index.js

HighSame File Env Network Executiondist/servers.js

HighCommand Output Exfiltrationdist/index.js

HighOversized Source Filedist/agents/claude/client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/render.js

LowWeak Cryptodist/index.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/servers.jsView file

Lines 119-158javascript

120`?!0:t==="\r"?this.buffer[e+1]===`

121`:!1}charAt(e){return this.buffer[this.pos+e]}continueScalar(e){let t=this.buffer[e];if(this.indentNext>0){let n=0;for(;t===" ";)t=this.buffer[++n+e];if(t==="\r"){let r=this.buffer[n+e+1];if(r===`

122`||!r&&!this.atEnd)return e+n+1}return t===`

125`,this.pos);if(r!==-1){for(;r!==-1;){let i=this.continueScalar(r+1);if(i===-1)break;r=n.indexOf(`

126`,i)}r!==-1&&(t=r-(n[r-1]==="\r"?2:1))}if(t===-1){if(!this.atEnd)return this.setNext("quoted-scalar");t=this.buffer.length}return yield*this.

127`:e=i,t=0;break;case"\r":{let o=this.buffer[i+1];if(!o&&!this.atEnd)return this.setNext("block-scalar");if(o===`

129`,i)}while(e!==-1);if(e===-1){if(!this.atEnd)return this.setNext("block-scalar");e=this.buffer.length}}let r=e+1;for(n=this.buffer[r];n===" ";)n=this.buffer[++r];

130`;)n=this.buffer[++r];e=r-1}else if(!this.blockScalarKeep)do{let i=e-1,o=this.buffer[i];o==="\r"&&(o=this.buffer[--i]);let a=i;for(;o===" "

131`&&i>=this.pos&&i+1+t>a)e=i;else break}while(!0);return yield st.SCALAR,yield*this.pushToIndex(e+1,!0),yield*this.parseLineStart()}*parsePlainScalar(){

132`?(n+=1,r=`

133`,i=this.buffer[n+1]):t=n),i==="#"||e&&ts.has(i))break;if(r===`

134`){let o=this.continueScalar(n+1);if(o===-1)break;n=Math.max(n,o-2)}}else{if(e&&ts.has(r))break;t=n}return!r&&!this.atEnd?this.setNext("plain-scalar")

135`?yield*this.pushCount(1):e==="\r"&&this.charAt(1)===`

137`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(`

138`,t)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(e){let t=e.items[e.items.length-1];switch(this.type){case"newline":if(this.onKeyLine=!1,t.value){let

139`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(`

141`),t=0;if(e[t]?.trim()!=="---")return null;t++;let n=[];for(;t<e.length&&e[t]?.trim()!=="---";)n.push(e[t]),t++;if(e[t]?.trim()!=="---")return null;t++

142`)),a=t}else t++}return{frontmatter:r,files:i,warnings:o,bodyEndLine:a}}catch{return null}}function Ka(s,e,t){let n=[];for(let r=0;r<e.length;r++){let i=e[r]?.trim().match

143

144${o}${i}

145${r}

146${o}`});return["---",`format: ${fr}`,`name: ${ys(s.name)}`,"---","",...e].join(`

148`)).map(e=>e.root)}function xd(s){let e=he(s);if(!e)return s;let t=e.files.get("code.tsx");if(!t)return s;let n=fa(t);if(!n.length)return

149

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/servers.jsView on unpkg · L139

152

154

158

Long lines were clipped for display.

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);

3var eg=Object.create;var Vi=Object.defineProperty;var tg=Object.getOwnPropertyDescriptor;var rg=Object.getOwnPropertyNames;

dist/render.jsView file

Lines 255-295javascript

255 const result = await ASYNC_OPTIONAL_CHAIN_NAME(ops);

256 return result == null ? true : result;

257 }

dist/agents/claude/client.jsView file

•path = dist/agents/claude/client.js kind = oversized_source_file sizeBytes = 2547393 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/agents/claude/client.jsView on unpkg

Lines 305-367javascript

305window.location.reload()

306window.location.href = "..."

307window.open("...")

308\`\`\`

309

310**Fix:** Remove the navigation call. To "restart", reset your state variables instead.`:`CommonJS \`require()\` is not supported! Found on line ${e}.

311

312**CRITICAL**: Use ES6 \`import\` statements at the TOP of the file:

313

314\u2705 CORRECT - ES6 import:

315\`\`\`typescript

316import { something } from 'module-name'

317\`\`\`

318

319\u274C WRONG - CommonJS require:

320\`\`\`typescript

321const something = require('module-name') // NOT SUPPORTED!

322\`\`\`

323

324**Fix:** Replace all \`require()\` calls with ES6 \`import\` statements at the top of the file.`}var dt,pt,tS,rS,Os=R(()=>{dt=["client"],pt=["client","server"],tS=[{type:"DYNAMIC_IMPORT",pattern:/\bimport\s*\(\s*['"`]/,targets:dt},{type:"COMMONJS_REQUIRE",pattern:/\brequire\s

325

326`){let n=e.filter(s=>s.role==="system").map(s=>s.content);return{system:n.length?n.join(t):void 0,conversationMessages:e.filter(s=>s.role!=="system")}}parseJsonError(e,t){if(!e)return{message:`HTTP ${t}`};try{let n=JSON.parse(e);return n.error&&typeof n.error=="object"?{message:n.error.message||`HTTP ${t}`,type:n.error.type}:n.message?{message:n.message}:{message:e}}catch{return{message:e}}}checkAndThrowError(e){if(typeof e!="object"||e===null)return;let t=e;if(t.type==="error"&&"message"in t){let n=t.code||"unknown";throw new pe(t.message,n,!!t.retryable)}if(t.error)throw new pe(this.extractE ...

327`)),!t&&s.type==="message"&&s.content&&(t=s.content.filter(i=>i.type==="output_text").map(i=>i.text).join(""));return{text:t,reasoning:n}}parseProviderStreamChunk(e){if(!this.isResponsesApiEvent(e))return null;switch(e.type){case"response.failed":{let n=e.response?.error,s=n?.message||"Response failed",i=n?.code

328

329`)}isResponsesApiEvent(e){return typeof e=="object"&&e!==null&&"type"in e&&typeof e.type=="string"}isResponsesApiResponse(e){return typeof e=="object"&&e!==null&&e.object==="response"}}});var Xt,Zs=R(()=>{Qt();Xt=class extends me{parseNonStreamingResponse(e){if(!this.hasChoices(e))return{text:""};let t=e,n=t.choices[0],s=n?.message,i=s?.content??n?.text??"",o=s?.reasoning??s?.reasoning_content??t.reasoning;return{text:i,reasoning:o}}parseProviderStreamChunk(e){if(!this.hasChoices(e))return null;let t=e.choices[0];if(!t)return null;let n=t.delta||t.message;if(!n)return null;let s=n.content||voi ...

330

331`);return{text:t,reasoning:n||void 0}}parseProviderStreamChunk(e){return this.isAnthropicEvent(e)&&e.type==="content_block_delta"?e.delta.type==="text_delta"?{text:e.delta.text||""}:e.delta.type==="thinking_delta"?{reasoning:e.delta.thinking||""}:null:null}withLastMessageCached(e){let t=e.length-1;return e.map((n,s)

332`),c={contents:o.map(f=>({role:f.role==="assistant"?"model":"user",parts:[{text:f.content}]}))};n?.webSearch!==!1&&(c.tools=[{google_search:{}}]),i&&(c.systemInstruction={role:"system",parts:[{text:i}]});let l=n?.effort;if(l!==void 0){let u={0:0,1:1024,2:8192,3:-1}[l];c.generationConfig={thinkingConfig:u===0?{thinkingBudget:0}:{includeThoughts:!0,thinkingBudget:u}}}return c}parseError(e,t){if(!e)return{message:`HTTP ${t}`};try{let n=JSON.parse(e),s=Array.isArray(n)?n[0]?.error:n?.error;return s&&typeof s=="object"?{message:(s.message||`HTTP ${t}`).split(`

333`)[0],type:s.status,code:s.code?.toString()}:n.message?{message:n.message}:{message:e}}catch{return{message:e}}}parseNonStreamingResponse(e){if(this.checkAndThrowError(e),this.checkGeminiError(e),!this.isGeminiResponse(e))return{text:"",status:"failed",error:"Invalid response format"};let t=this.extractParts(e).text||"",n=e.candidates?.[0]?.finishReason,s="complete";return n==="MAX_TOKENS"?s="interrupted":(n==="SAFETY"||n==="RECITATION")&&(s="failed"),{text:t,status:s}}parseProviderStreamChunk(e){if(this.checkGeminiError(e),!this.isGeminiResponse(e))return null;let t=this.extractParts(e);retur ...

334\r

335`),t=r.indexOf(`

336

337`);return e!==-1&&(t===-1||e<t)?{pos:e,len:4}:t!==-1?{pos:t,len:2}:{pos:-1,len:0}}function ic(r){let t=r.split(/\r?\n/).filter(

338`).trim();if(!n)return null;if(n==="[DONE]")return"done";try{return JSON.parse(n)}catch{return null}}async function*fp(r,e,t){let n=new TextDecoder,s=

339`)}var rr,US,JS,KS,tr,si,nr=R(()=>{rr={anthropic:"ANTHROPIC_API_KEY",openai:"OPENAI_API_KEY",gemini:"GOOGLE_API_KEY",openrouter:"OPENROUTER_API_KEY"};US="https://api.typebulb.com/api/models",JS=1440*60*1e3,KS=60*1e3,tr=null,si=null});function wt(r,e){let t=r??process.env.TB_AI_PROVIDER,n=e??process.env.TB_AI_MODEL;if(!t)return"No provider specified. Set TB_AI_PROVIDER in your .env file or pass provider in the tb.ai() call.";if(!n)return"No model specified. Set TB_AI_MODEL in your .env file or pass model in the tb.ai() call.";let s;try{s=yt(t)}catch{return`Unknown provider '${t}'.`}if(t==="olla ...

340`),n=[];if(t.forEach((o,a)=>{let c=_k(o);c!==void 0&&n.push({id:c,idx:a})}),!n.length)return e==="latest"?r:"";let s=e==="latest"?n[n.length-1]:n.find

341`)}function vc(r){try{return process.kill(r,0),!0}catch(e){return e.code==="EPERM"}}async function yi(r){await Tk(Ie(),{recursive:!0}),await Lp(gc(r.pid),JSON

342\u2026[${r.length-5e4} more characters truncated]`:r}function Me(r){let e=r.replace($k,"").split(`

343`).map(i=>i.trim()).filter(Boolean),t=e[0];if(!t)return"";let n=t.length>300?t.slice(0,300).trimEnd()+"\u2026":t,s=e.length-1;return s>0?`${n} (+${s} line${s===1?"":"s"})`:n}var $k,wi,vi=R(()=>{$k=/\u001b\[[0-9;]*m/g;wi=(r,e)=>`![pasted image](data:${e||"image/png"};base64,${r})`});import{existsSync as Mk,readdirSync as Dk,statSync as Bk}from"fs";import{join as jk}from"path";function Si(r){if(!Mk(r))return[];let e;try{e=Dk(r)}catch{return[]}let t=[];for(let n of e){if(!n.endsWith(".jsonl"))continue;let s=jk(r,n);try{let i=Bk(s);i.isFile()&&t.push({sessionId:n.slice(0,-6),file:s,mtime:i.mtimeMs ...

344`):r==null?"":Se(JSON.stringify(r))}function Gk(r){let e=r.trim();return!!e&&Hp.some(t=>t.test(e))}function zk(r){let e=r.trim();return e?

345`).length,"line")}`;if(t.mode==="content")return ge(t.numLines??0,"line");if(t.mode==="count")return`${ge(t.numMatches??0,"match","matches")} (${ge(t.numFiles??0,"file")})`;if(t.mode==="files_with_matches"

346`)){if(!p.includes(`"${f}"`))continue;let b;try{b=JSON.parse(p)}catch{continue}let m=b?.[u];b?.type===f&&typeof m=="string"&&m&&(d=m)}return d},o=s(0,Math.min(65536,n)),a=n>65536?s(n-65536,65536):"",c=i(a,"custom-title","customTitle")||i(o,"custom-title","customTitle")||i(a,"ai-title","aiTitle")||i(o,"ai-title","aiTitle");if(c)return c.replace(/\s+/g," ").trim().slice(0,200);for(let l of o.split(`

347`)){if(!l.trim())continue;let f;try{f=JSON.parse(l)}catch{continue}if(!f||mn(f)||f.type!=="user")continue;let u=f.message?.content,d="";typeof u=="string"?d=rt(u):Array.isArray(u)&&(d=u.map(Tc).filter(Boolean).join(" "));let p=d.replace(/\s+/g," ").trim();if(p)return(p.replace(/^Continuing from a prior session\. Here is the summary of our work so far:\s*/i,"").trim()||p).slice(0,200)}return""}finally{Uk(e)}}function tx(r){let e;try{e=Kk(Wp)}catch{return!1}for(let t of e)if(t.endsWith(".json"))try{let n=JSON.parse(Wk(hn(Wp,t),"utf8"));if(n?.sessionId!==r)continue;return process.kill(n.pid,0),!0 ...

348`),c=i.filter(u=>u.type==="tool_use").map(u=>({id:u.id??"",name:u.name??"",input:u.input??{}}));if(o||a||c.length){let u=Date.parse(e.timestamp??""),d=!isNaN(u)&&u>=t;n.push({type:"assistant"

349name: typebulb

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L347

350description: ${JSON.stringify(e)}

351version: ${r}

352---`}function gx(r){return`> Generated from typebulb v${r}. If \`npx typebulb --version\` reports a newer version, re-run \`npx typebulb skill\` to refresh this file.`}function tm(r,e){return`${hx(e)}

353

354${gx(e)}

355

356${r.trim()}

357`}var Ti=R(()=>{});var gn=R(()=>{$e();Gp();zp();_c();Qp();Zp();fn();nr();oi();Ti()});import{copyFileSync as yx,existsSync as rm,mkdirSync as nm,rmSync as bx,writeFileSync as wx}from"fs"

358import { spawn } from "node:child_process";

359

360function logErr(...a) { try { console.error("[typebulb]", ...a); } catch (e) {} }

361

362// Matches "typebulb wait", "npx typebulb wait", "/path/to/typebulb wait", "pnpm exec typebulb wait", etc.

363function isWaitCommand(command) { return /\btypebulb\s+wait\b/.test(String(command || "")); }

364

365// Resolved at shim-write time to this install's absolute skill-part paths (same files

366// commands/agent.ts prints — readable without a permission prompt, unlike the npx command).

367var TB_DESCRIPTION_PATH = "__TB_DESCRIPTION_PATH__";

Long lines were clipped for display.