registry / typebulb / 0.19.0

typebulb@0.19.0

⚠ Under review

Typebulb CLI to run single-file markdown apps called bulbs, either as standalone web apps or embedded in agent responses.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 1.43 MB of source, external domains: api.anthropic.com, api.openai.com, api.typebulb.com, cdn.jsdelivr.net, cdn.skypack.dev, data.jsdelivr.com, esm.sh, generativelanguage.googleapis.com, openrouter.ai, registry.npmjs.org, unpkg.com

Oversized source lightweight scan

dist/agents/claude/client.js2.42 MB file, sampled 256 KB

NetworkChildProcessEvalObfuscatedHighEntropyStringsUrlStringscdn.skypack.devunpkg.com

dist/agents/pi/client.js2.41 MB file, sampled 256 KB

NetworkChildProcessEvalHighEntropyStringsUrlStringscdn.skypack.devunpkg.com

Source & flagged code

8 flagged

dist/servers.jsView file

Lines 119-149javascript

119\r `),_n=s=>!s||Jf.has(s),Bn=class{constructor(){this.atEnd=!1,this.blockScalarIndent=-1,this.blockScalarKeep=!1,this.buffer="",this.flowKey=!1,this.flowLevel=0,this.indentNext=0,this.indentValue=0,this.lineEndPos=null,this.next=null,this.pos=0}*lex(e,t=!1){if(e){if(typeof e!="string")throw TypeError("source is not a string");this.buffer=this.buffer?this.buffer+e:e,this.lineEndPos=null}this.atEnd=!t;let n=this.next??"stream";for(;n&&(t||this.hasChars(1));)n=yield*this.parseNext(n)}atLineEnd(){let e=this.pos,t=this.buffer[e];for(;t===" "||t===" ";)t=this.buffer[++e];return!t||t==="#"||t===`

120`?!0:t==="\r"?this.buffer[e+1]===`

121`:!1}charAt(e){return this.buffer[this.pos+e]}continueScalar(e){let t=this.buffer[e];if(this.indentNext>0){let n=0;for(;t===" ";)t=this.buffer[++n+e];if(t==="\r"){let i=this.buffer[n+e+1];if(i===`

122`||!i&&!this.atEnd)return e+n+1}return t===`

123`||n>=this.indentNext||!t&&!this.atEnd?e+n:-1}if(t==="-"||t==="."){let n=this.buffer.substr(e,3);if((n==="---"||n==="...")&&R(this.buffer[e+3]))return-1}return e}getLine(){let e=this.lineEndPos;return(typeof e!="number"||e!==-1&&e<this.pos)&&(e=this.buffer.indexOf(`

124`,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]==="\r"&&(e-=1),this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buffer.substring(this.pos),this.pos=0,this.lineEndPos=null,this.next=e,null}peek(e){return this.buffer.substr(this.pos,e)}*parseNext(e){switch(e){case"stream":return yield*this.parseStream();case"line-start":return yield*this.parseLineStart();case"block-start":return yield*this.parseBlockStart();case"doc":return yield*this.parseDocument();case"flow":return yi ...

125`,this.pos);if(i!==-1){for(;i!==-1;){let r=this.continueScalar(i+1);if(r===-1)break;i=n.indexOf(`

126`,r)}i!==-1&&(t=i-(n[i-1]==="\r"?2:1))}if(t===-1){if(!this.atEnd)return this.setNext("quoted-scalar");t=this.buffer.length}return yield*this.

127`:e=r,t=0;break;case"\r":{let o=this.buffer[r+1];if(!o&&!this.atEnd)return this.setNext("block-scalar");if(o===`

128`)break}default:break e}if(!n&&!this.atEnd)return this.setNext("block-scalar");if(t>=this.indentNext){this.blockScalarIndent===-1?this.indentNext=t:this.indentNext=this.blockScalarIndent+(this.indentNext

129`,r)}while(e!==-1);if(e===-1){if(!this.atEnd)return this.setNext("block-scalar");e=this.buffer.length}}let i=e+1;for(n=this.buffer[i];n===" ";)n=this.buffer[++i];

130`;)n=this.buffer[++i];e=i-1}else if(!this.blockScalarKeep)do{let r=e-1,o=this.buffer[r];o==="\r"&&(o=this.buffer[--r]);let a=r;for(;o===" "

131`&&r>=this.pos&&r+1+t>a)e=r;else break}while(!0);return yield ze.SCALAR,yield*this.pushToIndex(e+1,!0),yield*this.parseLineStart()}*parsePlainScalar(){

132`?(n+=1,i=`

133`,r=this.buffer[n+1]):t=n),r==="#"||e&&Zt.has(r))break;if(i===`

134`){let o=this.continueScalar(n+1);if(o===-1)break;n=Math.max(n,o-2)}}else{if(e&&Zt.has(i))break;t=n}return!i&&!this.atEnd?this.setNext("plain-scalar")

135`?yield*this.pushCount(1):e==="\r"&&this.charAt(1)===`

136`?yield*this.pushCount(2):0}*pushSpaces(e){let t=this.pos-1,n;do n=this.buffer[++t];while(n===" "||e&&n===" ");let i=t-this.pos;return i>0&&(yield this.buffer.substr(this.pos,i),this.pos=t),i}*pushUntil(e){let t=this.pos,n=this.buffer[t];for(;!e(n);)n=this.buffer[++t];return yield*this.pushToIndex(t,!1)}};Bo.Lexer=Bn});var Rn=g($o=>{"use strict";var Dn=class{constructor(){this.lineStarts=[],this.addNewLine=e=>this.lineStarts.push(e),this.linePos=e=>{let t=0,n=this.lineStarts.length;for(;t<n;){let r=t+n>>1;this.lineStarts[r]<e?t=r+1:n=r}if(this.lineStarts[t]===e)return{line:t+1,col:1};if(t===0) ...

137`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(`

138`,t)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(e){let t=e.items[e.items.length-1];switch(this.type){case"newline":if(this.onKeyLine=!1,t.value){let

139`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(`

140`,t)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":return this.flowScalar(this.type);case"block-scalar-header":return{type:"block-scalar",offset:this.offset,indent:this.indent,props:[this.sourceToken],source:""};case"flow-map-start":case"flow-seq-start":return{type:"flow-collection",offset:this.offset,indent:this.indent,start:this.sourceToken,items:[],end:[]};case"seq-item-ind":return{type:"block-seq",offset:this.offset,indent:this.indent,items:[{start ...

141`),t=0;if(e[t]?.trim()!=="---")return null;t++;let n=[];for(;t<e.length&&e[t]?.trim()!=="---";)n.push(e[t]),t++;if(e[t]?.trim()!=="---")return null;t++

142`)),a=t}else t++}return{frontmatter:i,files:r,warnings:o,bodyEndLine:a}}catch{return null}}function Ma(s,e,t){let n=[];for(let i=0;i<e.length;i++){let r=e[i]?.trim().match

143

144${o}${r}

145${i}

146${o}`});return["---",`format: ${Zn}`,`name: ${rs(s.name)}`,"---","",...e].join(`

147`)}var hd=oa(Go(),1);function Qo(s){return{...ni(s),server:s.files.get("server.ts")??""}}function Ho(s){if(s.server.trim())return"server-side code (server.ts)";let e=s.code;if(/\btb\s*\.\s*fs\b/.test(e)||e.includes("/__fs"))return"the filesystem";if(/\btb\s*\.\s*ai\b/.test(e)||e.includes("/__ai"))return"AI (your API keys)";if(/\btb\s*\.\s*server\s*\.\s*(?!log\b)\w/.test(e)||e.includes("/__api"))return"server-side code (server.ts)"}async function md(s){try{let e=rt(await pd(s,"utf-8"));return e?Ho(Qo(e)):void 0}catch{return}}var gd=[/\bimport\s+(?:[^'";]*?from\s*)?['"]([^'"]+)['"]/g,/\bexport\s ...

148`))for(let i of gd)for(let r of n.matchAll(i)){let o=yd(r[1]);o&&!t.has(o)&&(t.add(o),e.push(o))}return e}function bd(s){let e=rt(s);if(!e)

149

Long lines were clipped for display.

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);

3var qh=Object.create;var Ai=Object.defineProperty;var Uh=Object.getOwnPropertyDescriptor;var Jh=Object.getOwnPropertyNames;

dist/render.jsView file

Lines 255-295javascript

255 const result = await ASYNC_OPTIONAL_CHAIN_NAME(ops);

256 return result == null ? true : result;

257 }

258 `},Wr=class t{__init(){this.helperNames={}}__init2(){this.createRequireName=null}constructor(e){this.nameManager=e,t.prototype.__init.call(this),t.prototype.__init2.call(this)}getHelperName(e){let s=this.helperNames[e];return s||(s=this.nameManager.claimFreeName(`_${e}`),this.helperNames[e]=s,s)}emitHelpers(){let e="";this.helperNames.optionalChainDelete&&this.getHelperName("optionalChain"),this.helperNames.asyncOptionalChainDelete&&this.getHelperName("asyncOptionalChain");for(let[s,n]of Object.entries(Jd)){let o=this.helperNames[s],i=n;s==="optionalChainDelete"?i=i.replace("OPTIONAL_CHAIN_N ...

dist/agents/claude/client.jsView file

•path = dist/agents/claude/client.js kind = oversized_source_file sizeBytes = 2541026 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/agents/claude/client.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/servers.jsView file

High

Child Process

Package source references child process execution.

dist/servers.jsView on unpkg · L139

139`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(` L140: `,t)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-... L141: `),t=0;if(e[t]?.trim()!=="---")return null;t++;let n=[];for(;t<e.length&&e[t]?.trim()!=="---";)n.push(e[t]),t++;if(e[t]?.trim()!=="---")return null;t++;let i=Ba(n);if(!i)return nul... ... L147: `)}var hd=oa(Go(),1);function Qo(s){return{...ni(s),server:s.files.get("server.ts")??""}}function Ho(s){if(s.server.trim())return"server-side code (server.ts)";let e=s.code;if(/\bt... L148: `))for(let i of gd)for(let r of n.matchAll(i)){let o=yd(r[1]);o&&!t.has(o)&&(t.add(o),e.push(o))}return e}function bd(s){let e=rt(s);if(!e)return s;let t=e.files.get("code.tsx");if...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/servers.jsView on unpkg · L139

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = typebulb@0.18.7 matchedIdentity = npm:dHlwZWJ1bGI:0.18.7 similarity = 0.870 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.jsView on unpkg

354const child = spawn(command, { L355: shell: true, L356: stdio: ["ignore", "pipe", "ignore"],

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L354

1258})(); L1259: </script>`;function vv(r){let e={};for(let[t,n]of Object.entries(r))e[t]=n.startsWith("https://")?"/proxy/"+n:n;return e}import*as Rs from"fs/promises";import*as Cs from"path";impo... L1260: `,"utf8"),await Z.writeFile(Q.join(e,"code.tsx"),r.code,"utf8"),await Z.writeFile(Q.join(e,"tb.d.ts"),Aa,"utf8"),{dir:e}}function Uv(r,e,t=[]){return{compilerOptions:{target:"es202... L1261: `,"utf8"),{dir:e}}function zv(r){let e={target:"es2023",module:"esnext",moduleResolution:"bundler",lib:["ES2023"],types:["node"],strict:!0,noEmit:!0,skipLibCheck:!0,esModuleInterop... L1262: `))console.log(`${e} ${n}`);return r.length>0}function rS(r,e){return new Promise(t=>{let n=Xv(process.execPath,[r,"--noEmit"],{cwd:e}),s="";n.stdout?.on("data",i=>{s+=i.toString()...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1258

2import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L3: var qh=Object.create;var Ai=Object.defineProperty;var Uh=Object.getOwnPropertyDescriptor;var Jh=Object.getOwnPropertyNames;var Kh=Object.getPrototypeOf,Wh=Object.prototype.hasOwnPr... L4: `),t=0;if(e[t]?.trim()!=="---")return null;t++;let n=[];for(;t<e.length&&e[t]?.trim()!=="---";)n.push(e[t]),t++;if(e[t]?.trim()!=="---")return null;t++;let s=im(n);if(!s)return nul... ... L9: ${o}`});return["---",`format: ${Jc}`,`name: ${Ci(r.name)}`,"---","",...e].join(` L10: `)}var Qc=C(()=>{gn();yn()});function Xc(r){if(!r.trim())return{};try{return JSON.parse(r)}catch{return{}}}var Zc=C(()=>{});var el=C(()=>{});function Ni(r,e,t){let s=new RegExp(e).... L11: >/]`,i);if(n&&console.log("[xml-utils] start:",o),o===-1)return;let a=r.slice(o+e.length),c=er(a,"^[^<]*[ /]>",0),l=c!==-1&&a[c-1]==="/";if(n&&console.log("[xml-utils] selfClosing:... ... L181: \`\`\`typescript L182: import React from "https://esm.sh/react" L183: import _ from "https://cdn.skypack.dev/lodash" ... L295: L296: **CRITICAL**: \`window.location\` changes, \`window.open()\`, and page reloads will break the app. L297:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L2

dist/render.jsView file

275`);return a===-1&&(a=i.length,i+=` L276: `),{code:i.slice(0,a+1)+s+i.slice(a+1)+n,mappings:this.shiftMappings(o.mappings,s.length)}}else return{code:s+i+n,mappings:this.shiftMappings(o.mappings,s.length)}}processBalancedC... L277: `);for(let a=0;a<i.length;a++){let l=i[a],u=a+1;for(let f of zy)f.targets.includes(s)&&f.pattern.test(l)&&o.push({type:f.type,severity:"error",message:nk(f.type,u),lineNumber:u,lin...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/render.jsView on unpkg · L275

dist/agents/claude/client.jsView file

•path = dist/agents/claude/client.js kind = oversized_source_file sizeBytes = 2541026 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/agents/claude/client.jsView on unpkg

Findings

1 Critical5 High3 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/servers.js

HighShelldist/index.js

HighSame File Env Network Executiondist/servers.js

HighCommand Output Exfiltrationdist/index.js

HighOversized Source Filedist/agents/claude/client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/render.js

LowWeak Cryptodist/index.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

dist/servers.jsView file

Lines 119-149javascript

120`?!0:t==="\r"?this.buffer[e+1]===`

121`:!1}charAt(e){return this.buffer[this.pos+e]}continueScalar(e){let t=this.buffer[e];if(this.indentNext>0){let n=0;for(;t===" ";)t=this.buffer[++n+e];if(t==="\r"){let i=this.buffer[n+e+1];if(i===`

122`||!i&&!this.atEnd)return e+n+1}return t===`

125`,this.pos);if(i!==-1){for(;i!==-1;){let r=this.continueScalar(i+1);if(r===-1)break;i=n.indexOf(`

126`,r)}i!==-1&&(t=i-(n[i-1]==="\r"?2:1))}if(t===-1){if(!this.atEnd)return this.setNext("quoted-scalar");t=this.buffer.length}return yield*this.

127`:e=r,t=0;break;case"\r":{let o=this.buffer[r+1];if(!o&&!this.atEnd)return this.setNext("block-scalar");if(o===`

129`,r)}while(e!==-1);if(e===-1){if(!this.atEnd)return this.setNext("block-scalar");e=this.buffer.length}}let i=e+1;for(n=this.buffer[i];n===" ";)n=this.buffer[++i];

130`;)n=this.buffer[++i];e=i-1}else if(!this.blockScalarKeep)do{let r=e-1,o=this.buffer[r];o==="\r"&&(o=this.buffer[--r]);let a=r;for(;o===" "

131`&&r>=this.pos&&r+1+t>a)e=r;else break}while(!0);return yield ze.SCALAR,yield*this.pushToIndex(e+1,!0),yield*this.parseLineStart()}*parsePlainScalar(){

132`?(n+=1,i=`

133`,r=this.buffer[n+1]):t=n),r==="#"||e&&Zt.has(r))break;if(i===`

134`){let o=this.continueScalar(n+1);if(o===-1)break;n=Math.max(n,o-2)}}else{if(e&&Zt.has(i))break;t=n}return!i&&!this.atEnd?this.setNext("plain-scalar")

135`?yield*this.pushCount(1):e==="\r"&&this.charAt(1)===`

137`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(`

138`,t)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(e){let t=e.items[e.items.length-1];switch(this.type){case"newline":if(this.onKeyLine=!1,t.value){let

139`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(`

141`),t=0;if(e[t]?.trim()!=="---")return null;t++;let n=[];for(;t<e.length&&e[t]?.trim()!=="---";)n.push(e[t]),t++;if(e[t]?.trim()!=="---")return null;t++

142`)),a=t}else t++}return{frontmatter:i,files:r,warnings:o,bodyEndLine:a}}catch{return null}}function Ma(s,e,t){let n=[];for(let i=0;i<e.length;i++){let r=e[i]?.trim().match

143

144${o}${r}

145${i}

146${o}`});return["---",`format: ${Zn}`,`name: ${rs(s.name)}`,"---","",...e].join(`

148`))for(let i of gd)for(let r of n.matchAll(i)){let o=yd(r[1]);o&&!t.has(o)&&(t.add(o),e.push(o))}return e}function bd(s){let e=rt(s);if(!e)

149

Long lines were clipped for display.

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);

3var qh=Object.create;var Ai=Object.defineProperty;var Uh=Object.getOwnPropertyDescriptor;var Jh=Object.getOwnPropertyNames;

dist/render.jsView file

Lines 255-295javascript

255 const result = await ASYNC_OPTIONAL_CHAIN_NAME(ops);

256 return result == null ? true : result;

257 }

dist/agents/claude/client.jsView file

•path = dist/agents/claude/client.js kind = oversized_source_file sizeBytes = 2541026 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/agents/claude/client.jsView on unpkg

Lines 1238-1278javascript

1238 if (de.style.overflowX !== ox) de.style.overflowX = ox;

1239 if (de.scrollHeight > de.clientHeight + 1) {

1240 if (de.style.overflowY !== 'auto' && !confirm) confirm = setTimeout(showYScroll, 100);

1241 } else {

1242 if (confirm) { clearTimeout(confirm); confirm = 0; }

1243 if (de.style.overflowY !== 'hidden') de.style.overflowY = 'hidden';

1244 }

1245 post({ __typebulbEmbed: true, kind: 'height', height: Math.ceil(document.body.scrollHeight) });

1246 };

1247 var update = function () { if (!raf) raf = requestAnimationFrame(apply); };

1248 de.style.overflow = 'hidden';

1249 // Run at load (module mounted \u2192 real content, not the empty pre-mount body that would

1250 // collapse the frame and snap back). Observe BOTH body (content growth) and the root

1251 // element (the viewport \u2014 so a host resize/cap re-syncs overflow on the next frame).

1252 window.addEventListener('load', function () {

1253 update();

1254 if (window.ResizeObserver) {

1255 try { var ro = new ResizeObserver(update); ro.observe(document.body); ro.observe(de); } catch (e) {}

1256 }

1257 });

1258})();

1259</script>`;function vv(r){let e={};for(let[t,n]of Object.entries(r))e[t]=n.startsWith("https://")?"/proxy/"+n:n;return e}import*as Rs from"fs/promises";import*as Cs from"path";import{existsSync as Rd,readFileSync as Sv}from"fs";import{execFile as xv}from"child_process";import{promisify as kv}from"util";import{satisfies as Ev}from"semver";var Av=kv(xv);async function Ns(r,e,t){let s=r.map(o=>Tv(o,t)).filter(o=>!Pv(o,e));if(s.length===0)return;await Rs.mkdir(e,{recursive:!0});let i=Cs.join(e,"package.json");Rd(i)||await Rs.writeFile(i,JSON.stringify({name:"typebulb-server",private:!0})),console. ...

1260`,"utf8"),await Z.writeFile(Q.join(e,"code.tsx"),r.code,"utf8"),await Z.writeFile(Q.join(e,"tb.d.ts"),Aa,"utf8"),{dir:e}}function Uv(r,e,t=[]){return{compilerOptions:{target:"es2023",module:"esnext",moduleResolution:

1261`,"utf8"),{dir:e}}function zv(r){let e={target:"es2023",module:"esnext",moduleResolution:"bundler",lib:["ES2023"],types:["node"],strict:!0,noEmit:!0,skipLibCheck:!0,esModuleInterop:!0,allowSyntheticDefaultImports:!0,forceConsistentCasingInFileNames:!0};if(r?.typesAbs){let t=i=>i.replace(/\\/g,"/"),n=t(Re.dirname(r.typesAbs)),s=t(r.typesAbs).replace(/\.d\.ts$/,"");e.paths={[r.name]:[s],[`${r.name}/*`]:[`${n}/*`]}}return{compilerOptions:e,include:["server.ts","tb.d.ts"]}}async function Qv(r,e){if(!Yv(r)){await le.mkdir(e,{recursive:!0});return}await le.rm(e,{recursive:!0,force:!0});let t=process ...

1262`))console.log(`${e} ${n}`);return r.length>0}function rS(r,e){return new Promise(t=>{let n=Xv(process.execPath,[r,"--noEmit"],{cwd:e}),s="";n.stdout?.on("data",i=>{s+=i.toString()}),n.stderr?.on("data",i=>{s+=i.toString()}),n.on("close",i=>t({stdout:s,exitCode:i??1}))})}var nS=eS(import.meta.url);function sS(r){let e=n=>{try{let s=nS.resolve("typescript/package.json",{paths:n}),i=Ve.join(Ve.dirname(s),"lib","tsc.js");return tS(i)?i:void 0}catch{return}},t=e(r);if(t)return t;try{let n=Zv("npm root -g",{encoding:"utf8"}).trim();return e([n])}catch{return}}Bs();Xr();async function Wd(r,e){let{bu ...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L1258

1263name: typebulb

1264description: ${YS(za(),"utf8").trim().replace(/\s+/g," ")}

1265version: ${r}

1266---`}function XS(r){return`> Generated from typebulb v${r}. If \`npx typebulb --version\` reports a newer version, re-run \`npx typebulb skill\` to refresh this file.`}function yp(r,e){return`${QS(e)}

1267

1268${XS(e)}

1269

1270${r.trim()}

1271`}function Qa(r){let e=t=>n=>r?`\x1B[${t}m${n}\x1B[0m`:n;return{lit:e("38;5;70"),litLink:e("4;38;5;70"),brand:e("38;5;135")}}async function vp(r){let e=mp(process.cwd());if("ambiguous"in e){let t=await ZS(r,e.ambiguous);return t?bp(r,t):ex(r,e.ambiguous)}return bp(r,e.name)}async function bp(r,e){let t,n;try{t=await sp(e)}catch(f){n=f instanceof Error?f.message:String(f)}let{lit:s,litLink:i,brand:o}=Qa(process.stdout.isTTY===!0),a=[" Read the authoring skill before writing a bulb:",` \u2022 ${s("npx typebulb skill")} \u2014 assembles one SKILL.md`," \u2022 or, open its parts:",` ...

1272`)+`

1273`)}async function ZS(r,e){if(!process.stdin.isTTY||!process.stdout.isTTY)return;let{lit:t,brand:n}=Qa(!0),s=[` ${n(`typebulb v${r}`)}`," This project has sessions for more than one agent harness.",...e.map((o,a)=>` ${t(String(a+1))}) ${o}`),""];process.stdout.write(s.join(`

1274`)+`

1275`);let i=wp.createInterface({input:process.stdin,output:process.stdout});try{let o=(await new Promise(c=>i.question(" Open which? [1]: ",c))).trim();if(o==="")return e[0];let a=Number(o);return Number.isInteger(a)&&a>=1&&a<=e.length?e[a-1]:e.find(c=>c===o.toLowerCase())}finally{i.close()}}function ex(r,e){let{lit:t,brand:n}=Qa(process.stdout.isTTY===!0),s=[` ${n(`typebulb v${r}`)}`," This project has sessions for more than one agent harness."," Open the mirror for the one you want:",...e.map(i=>` \u2022 ${t(`npx typebulb agent:${i}`)}`),""];process.stdout.write(s.join(`

1276`)+`

1277`)}import{readFileSync as tx,existsSync as rx}from"fs";import*as Ne from"path";function nx(r){return[...r?[`.env.${r}.local`,`.env.${r}`]:[],".env.local",".env"]}function Ee(r,e=process.cwd()){let t={},n=[];for(let s of nx(r)){let i;try{i=tx(Ne.resolve(e,s),"utf-8")}catch{continue}n.push(s);for(let[o,a]of sx(i))process.env[o]===void 0&&(process.env[o]=a,t[o]=s)}return{mode:r,sources:t,loaded:n}}function*sx(r){for(let e of r.split(`

1278`)){let t=e.trim();if(!t||t.startsWith("#"))continue;let n=t.indexOf("=");if(n===-1)continue;let s=t.slice(0,n).trim(),i=t.slice(n+1).trim();(i.startsWith('"')&&i.endsWith('"')||i.startsWith("'")&&i.endsWith("'"))&&(i=i.slice(1,-1)),yield[s,i]}}function ix(r){let e=new Set,t=/process\.env\.([A-Za-z_$][\w$]*)|process\.env\[\s*['"]([^'"]+)['"]\s*\]/g;for(let n;n=t.exec(r);)e.add(n[1]??n[2]);return[...e]}function Ge(r,e,t){let{sources:n,mode:s,loaded:i}=r,o=process.cwd(),a=Ne.dirname(e),c=`(mode: ${s??"none"})`,l=t?ix(t):[],f=l.filter(p=>n[p]).map(p=>`${p} \u2190 ${n[p]}`);f.length?console.log(`e ...

Long lines were clipped for display.