registry / typebulb / 0.19.3

typebulb@0.19.3

⚠ Under review

Typebulb CLI to run single-file markdown apps called bulbs, either as standalone web apps or embedded in agent responses.

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 50 file(s), 1.43 MB of source, external domains: api.anthropic.com, api.openai.com, api.typebulb.com, cdn.jsdelivr.net, cdn.skypack.dev, data.jsdelivr.com, esm.sh, generativelanguage.googleapis.com, openrouter.ai, registry.npmjs.org, unpkg.com

Oversized source lightweight scan

dist/agents/claude/client.js2.42 MB file, sampled 256 KB

NetworkChildProcessEvalObfuscatedHighEntropyStringsUrlStringscdn.skypack.devunpkg.com

dist/agents/pi/client.js2.41 MB file, sampled 256 KB

NetworkChildProcessEvalHighEntropyStringsUrlStringscdn.skypack.devunpkg.com

Source & flagged code

8 flagged

dist/servers.jsView file

Lines 119-149javascript

119\r `),Bn=s=>!s||xf.has(s),$n=class{constructor(){this.atEnd=!1,this.blockScalarIndent=-1,this.blockScalarKeep=!1,this.buffer="",this.flowKey=!1,this.flowLevel=0,this.indentNext=0,this.indentValue=0,this.lineEndPos=null,this.next=null,this.pos=0}*lex(e,t=!1){if(e){if(typeof e!="string")throw TypeError("source is not a string");this.buffer=this.buffer?this.buffer+e:e,this.lineEndPos=null}this.atEnd=!t;let n=this.next??"stream";for(;n&&(t||this.hasChars(1));)n=yield*this.parseNext(n)}atLineEnd(){let e=this.pos,t=this.buffer[e];for(;t===" "||t===" ";)t=this.buffer[++e];return!t||t==="#"||t===`

120`?!0:t==="\r"?this.buffer[e+1]===`

121`:!1}charAt(e){return this.buffer[this.pos+e]}continueScalar(e){let t=this.buffer[e];if(this.indentNext>0){let n=0;for(;t===" ";)t=this.buffer[++n+e];if(t==="\r"){let i=this.buffer[n+e+1];if(i===`

122`||!i&&!this.atEnd)return e+n+1}return t===`

123`||n>=this.indentNext||!t&&!this.atEnd?e+n:-1}if(t==="-"||t==="."){let n=this.buffer.substr(e,3);if((n==="---"||n==="...")&&R(this.buffer[e+3]))return-1}return e}getLine(){let e=this.lineEndPos;return(typeof e!="number"||e!==-1&&e<this.pos)&&(e=this.buffer.indexOf(`

124`,this.pos),this.lineEndPos=e),e===-1?this.atEnd?this.buffer.substring(this.pos):null:(this.buffer[e-1]==="\r"&&(e-=1),this.buffer.substring(this.pos,e))}hasChars(e){return this.pos+e<=this.buffer.length}setNext(e){return this.buffer=this.buffer.substring(this.pos),this.pos=0,this.lineEndPos=null,this.next=e,null}peek(e){return this.buffer.substr(this.pos,e)}*parseNext(e){switch(e){case"stream":return yield*this.parseStream();case"line-start":return yield*this.parseLineStart();case"block-start":return yield*this.parseBlockStart();case"doc":return yield*this.parseDocument();case"flow":return yi ...

125`,this.pos);if(i!==-1){for(;i!==-1;){let r=this.continueScalar(i+1);if(r===-1)break;i=n.indexOf(`

126`,r)}i!==-1&&(t=i-(n[i-1]==="\r"?2:1))}if(t===-1){if(!this.atEnd)return this.setNext("quoted-scalar");t=this.buffer.length}return yield*this.

127`:e=r,t=0;break;case"\r":{let o=this.buffer[r+1];if(!o&&!this.atEnd)return this.setNext("block-scalar");if(o===`

128`)break}default:break e}if(!n&&!this.atEnd)return this.setNext("block-scalar");if(t>=this.indentNext){this.blockScalarIndent===-1?this.indentNext=t:this.indentNext=this.blockScalarIndent+(this.indentNext

129`,r)}while(e!==-1);if(e===-1){if(!this.atEnd)return this.setNext("block-scalar");e=this.buffer.length}}let i=e+1;for(n=this.buffer[i];n===" ";)n=this.buffer[++i];

130`;)n=this.buffer[++i];e=i-1}else if(!this.blockScalarKeep)do{let r=e-1,o=this.buffer[r];o==="\r"&&(o=this.buffer[--r]);let a=r;for(;o===" "

131`&&r>=this.pos&&r+1+t>a)e=r;else break}while(!0);return yield Ze.SCALAR,yield*this.pushToIndex(e+1,!0),yield*this.parseLineStart()}*parsePlainScalar(){

132`?(n+=1,i=`

133`,r=this.buffer[n+1]):t=n),r==="#"||e&&zt.has(r))break;if(i===`

134`){let o=this.continueScalar(n+1);if(o===-1)break;n=Math.max(n,o-2)}}else{if(e&&zt.has(i))break;t=n}return!i&&!this.atEnd?this.setNext("plain-scalar")

135`?yield*this.pushCount(1):e==="\r"&&this.charAt(1)===`

136`?yield*this.pushCount(2):0}*pushSpaces(e){let t=this.pos-1,n;do n=this.buffer[++t];while(n===" "||e&&n===" ");let i=t-this.pos;return i>0&&(yield this.buffer.substr(this.pos,i),this.pos=t),i}*pushUntil(e){let t=this.pos,n=this.buffer[t];for(;!e(n);)n=this.buffer[++t];return yield*this.pushToIndex(t,!1)}};_o.Lexer=$n});var xn=g(Bo=>{"use strict";var Rn=class{constructor(){this.lineStarts=[],this.addNewLine=e=>this.lineStarts.push(e),this.linePos=e=>{let t=0,n=this.lineStarts.length;for(;t<n;){let r=t+n>>1;this.lineStarts[r]<e?t=r+1:n=r}if(this.lineStarts[t]===e)return{line:t+1,col:1};if(t===0) ...

137`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(`

138`,t)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(e){let t=e.items[e.items.length-1];switch(this.type){case"newline":if(this.onKeyLine=!1,t.value){let

139`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(`

140`,t)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-quoted-scalar":return this.flowScalar(this.type);case"block-scalar-header":return{type:"block-scalar",offset:this.offset,indent:this.indent,props:[this.sourceToken],source:""};case"flow-map-start":case"flow-seq-start":return{type:"flow-collection",offset:this.offset,indent:this.indent,start:this.sourceToken,items:[],end:[]};case"seq-item-ind":return{type:"block-seq",offset:this.offset,indent:this.indent,items:[{start ...

141`),t=0;if(e[t]?.trim()!=="---")return null;t++;let n=[];for(;t<e.length&&e[t]?.trim()!=="---";)n.push(e[t]),t++;if(e[t]?.trim()!=="---")return null;t++

142`)),a=t}else t++}return{frontmatter:i,files:r,warnings:o,bodyEndLine:a}}catch{return null}}function Ta(s,e,t){let n=[];for(let i=0;i<e.length;i++){let r=e[i]?.trim().match

143

144${o}${r}

145${i}

146${o}`});return["---",`format: ${zn}`,`name: ${os(s.name)}`,"---","",...e].join(`

147`)}var ad=aa(Wo(),1);function ts(s){return{...si(s),server:s.files.get("server.ts")??""}}function Go(s){return!!s.server&&!s.code}function ss(s){let e=/^---[^\n]*\n([\s\S]*?)\n---/.exec(s),t=e?/^\s*name:\s*(.+?)\s*$/m.exec(e[1]):null;return t?t[1].replace(/^["']|["']$/g,""):void 0}function ld(s){return(ss(s)??"bulb").toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"")||"bulb"}function cd(s){return s.replace(/^---[^\n]*\r?\n[\s\S]*?\r?\n---[^\n]*\r?\n?/,"").replace(/^\r?\n+/,"")}function Ho(s,e,t){if(e>8)return t;let n;try{n=ud(s,{withFileTypes:!0})}catch{return t}for(let i of n)if( ...

148`))for(let i of yd)for(let r of n.matchAll(i)){let o=bd(r[1]);o&&!t.has(o)&&(t.add(o),e.push(o))}return e}function Sd(s){let e=de(s);if(!e)

149

Long lines were clipped for display.

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);

3var Km=Object.create;var Ni=Object.defineProperty;var Wm=Object.getOwnPropertyDescriptor;var Hm=Object.getOwnPropertyNames;

dist/render.jsView file

Lines 255-295javascript

255 const result = await ASYNC_OPTIONAL_CHAIN_NAME(ops);

256 return result == null ? true : result;

257 }

258 `},Wr=class t{__init(){this.helperNames={}}__init2(){this.createRequireName=null}constructor(e){this.nameManager=e,t.prototype.__init.call(this),t.prototype.__init2.call(this)}getHelperName(e){let s=this.helperNames[e];return s||(s=this.nameManager.claimFreeName(`_${e}`),this.helperNames[e]=s,s)}emitHelpers(){let e="";this.helperNames.optionalChainDelete&&this.getHelperName("optionalChain"),this.helperNames.asyncOptionalChainDelete&&this.getHelperName("asyncOptionalChain");for(let[s,n]of Object.entries(Jd)){let o=this.helperNames[s],i=n;s==="optionalChainDelete"?i=i.replace("OPTIONAL_CHAIN_N ...

dist/agents/claude/client.jsView file

•path = dist/agents/claude/client.js kind = oversized_source_file sizeBytes = 2540846 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/agents/claude/client.jsView on unpkg

Source & flagged code

8 flagged · loading source

dist/servers.jsView file

High

Child Process

Package source references child process execution.

dist/servers.jsView on unpkg · L139

139`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(` L140: `,t)+1}return{type:e,offset:this.offset,indent:this.indent,source:this.source}}startBlockValue(e){switch(this.type){case"alias":case"scalar":case"single-quoted-scalar":case"double-... L141: `),t=0;if(e[t]?.trim()!=="---")return null;t++;let n=[];for(;t<e.length&&e[t]?.trim()!=="---";)n.push(e[t]),t++;if(e[t]?.trim()!=="---")return null;t++;let i=Ca(n);if(!i)return nul... ... L147: `)}var ad=aa(Wo(),1);function ts(s){return{...si(s),server:s.files.get("server.ts")??""}}function Go(s){return!!s.server&&!s.code}function ss(s){let e=/^---[^\n]*\n([\s\S]*?)\n---/... L148: `))for(let i of yd)for(let r of n.matchAll(i)){let o=bd(r[1]);o&&!t.has(o)&&(t.add(o),e.push(o))}return e}function Sd(s){let e=de(s);if(!e)return s;let t=e.files.get("code.tsx");if...

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/servers.jsView on unpkg · L139

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = typebulb@0.18.7 matchedIdentity = npm:dHlwZWJ1bGI:0.18.7 similarity = 0.848 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/index.jsView on unpkg

355const child = spawn(command, { L356: shell: true, L357: stdio: ["ignore", "pipe", "ignore"],

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L355

323L324: **Fix:** Replace all \`require()\` calls with ES6 \`import\` statements at the top of the file.`}var it,ot,Ww,rd,xs=C(()=>{it=["client"],ot=["client","server"],Ww=[{type:"DYNAMIC_I... L325: `)}var Jt,$v,Mv,Dv,Ut,Ks,Kt=C(()=>{Jt={anthropic:"ANTHROPIC_API_KEY",openai:"OPENAI_API_KEY",gemini:"GOOGLE_API_KEY",openrouter:"OPENROUTER_API_KEY"};$v="https://api.typebulb.com/a... L326: `),n=[];if(t.forEach((o,a)=>{let c=AS(o);c!==void 0&&n.push({id:c,idx:a})}),!n.length)return e==="latest"?r:"";let s=e==="latest"?n[n.length-1]:n.find(o=>o.id===e);if(!s)return"";l... L327: `)}function za(r){try{return process.kill(r,0),!0}catch(e){return e.code==="EPERM"}}async function ni(r){await SS(Ne(),{recursive:!0}),await np(Va(r.pid),JSON.stringify(r))}async f... L328: \u2026[${r.length-5e4} more characters truncated]`:r}var oi,ai=C(()=>{oi=(r,e)=>`![pasted image](data:${e||"image/png"};base64,${r})`});import{existsSync as RS,readdirSync as NS,st... L329: `):r==null?"":ke(JSON.stringify(r))}function US(r){let e=r.trim();return!!e&&hp.some(t=>t.test(e))}function JS(r){let e=r.trim();return e?hp.some(t=>{let n=t.exec(e);return!!n&&n.i...

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L323

2import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url); L3: var Km=Object.create;var Ni=Object.defineProperty;var Wm=Object.getOwnPropertyDescriptor;var Hm=Object.getOwnPropertyNames;var Vm=Object.getPrototypeOf,Ym=Object.prototype.hasOwnPr... L4: `),t=0;if(e[t]?.trim()!=="---")return null;t++;let n=[];for(;t<e.length&&e[t]?.trim()!=="---";)n.push(e[t]),t++;if(e[t]?.trim()!=="---")return null;t++;let s=ch(n);if(!s)return nul... ... L9: ${o}`});return["---",`format: ${Hc}`,`name: ${$i(r.name)}`,"---","",...e].join(` L10: `)}var el=C(()=>{xn();kn()});function tl(r){if(!r.trim())return{};try{return JSON.parse(r)}catch{return{}}}var rl=C(()=>{});var nl=C(()=>{});function Di(r,e,t){let s=new RegExp(e).... L11: >/]`,i);if(n&&console.log("[xml-utils] start:",o),o===-1)return;let a=r.slice(o+e.length),c=sr(a,"^[^<]*[ /]>",0),l=c!==-1&&a[c-1]==="/";if(n&&console.log("[xml-utils] selfClosing:... ... L181: \`\`\`typescript L182: import React from "https://esm.sh/react" L183: import _ from "https://cdn.skypack.dev/lodash" ... L295: L296: **CRITICAL**: \`window.location\` changes, \`window.open()\`, and page reloads will break the app. L297:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L2

dist/render.jsView file

275`);return a===-1&&(a=i.length,i+=` L276: `),{code:i.slice(0,a+1)+s+i.slice(a+1)+n,mappings:this.shiftMappings(o.mappings,s.length)}}else return{code:s+i+n,mappings:this.shiftMappings(o.mappings,s.length)}}processBalancedC... L277: `);for(let a=0;a<i.length;a++){let l=i[a],u=a+1;for(let f of zy)f.targets.includes(s)&&f.pattern.test(l)&&o.push({type:f.type,severity:"error",message:nk(f.type,u),lineNumber:u,lin...

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/render.jsView on unpkg · L275

dist/agents/claude/client.jsView file

•path = dist/agents/claude/client.js kind = oversized_source_file sizeBytes = 2540846 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/agents/claude/client.jsView on unpkg

Findings

1 Critical5 High3 Medium8 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/servers.js

HighShelldist/index.js

HighSame File Env Network Executiondist/servers.js

HighCommand Output Exfiltrationdist/index.js

HighOversized Source Filedist/agents/claude/client.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/render.js

LowWeak Cryptodist/index.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

dist/servers.jsView file

Lines 119-149javascript

120`?!0:t==="\r"?this.buffer[e+1]===`

121`:!1}charAt(e){return this.buffer[this.pos+e]}continueScalar(e){let t=this.buffer[e];if(this.indentNext>0){let n=0;for(;t===" ";)t=this.buffer[++n+e];if(t==="\r"){let i=this.buffer[n+e+1];if(i===`

122`||!i&&!this.atEnd)return e+n+1}return t===`

125`,this.pos);if(i!==-1){for(;i!==-1;){let r=this.continueScalar(i+1);if(r===-1)break;i=n.indexOf(`

126`,r)}i!==-1&&(t=i-(n[i-1]==="\r"?2:1))}if(t===-1){if(!this.atEnd)return this.setNext("quoted-scalar");t=this.buffer.length}return yield*this.

127`:e=r,t=0;break;case"\r":{let o=this.buffer[r+1];if(!o&&!this.atEnd)return this.setNext("block-scalar");if(o===`

129`,r)}while(e!==-1);if(e===-1){if(!this.atEnd)return this.setNext("block-scalar");e=this.buffer.length}}let i=e+1;for(n=this.buffer[i];n===" ";)n=this.buffer[++i];

130`;)n=this.buffer[++i];e=i-1}else if(!this.blockScalarKeep)do{let r=e-1,o=this.buffer[r];o==="\r"&&(o=this.buffer[--r]);let a=r;for(;o===" "

131`&&r>=this.pos&&r+1+t>a)e=r;else break}while(!0);return yield Ze.SCALAR,yield*this.pushToIndex(e+1,!0),yield*this.parseLineStart()}*parsePlainScalar(){

132`?(n+=1,i=`

133`,r=this.buffer[n+1]):t=n),r==="#"||e&&zt.has(r))break;if(i===`

134`){let o=this.continueScalar(n+1);if(o===-1)break;n=Math.max(n,o-2)}}else{if(e&&zt.has(i))break;t=n}return!i&&!this.atEnd?this.setNext("plain-scalar")

135`?yield*this.pushCount(1):e==="\r"&&this.charAt(1)===`

137`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(`

138`,t)+1}yield*this.pop();break;default:yield*this.pop(),yield*this.step()}}*blockMap(e){let t=e.items[e.items.length-1];switch(this.type){case"newline":if(this.onKeyLine=!1,t.value){let

139`)+1;for(;t!==0;)this.onNewLine(this.offset+t),t=this.source.indexOf(`

141`),t=0;if(e[t]?.trim()!=="---")return null;t++;let n=[];for(;t<e.length&&e[t]?.trim()!=="---";)n.push(e[t]),t++;if(e[t]?.trim()!=="---")return null;t++

142`)),a=t}else t++}return{frontmatter:i,files:r,warnings:o,bodyEndLine:a}}catch{return null}}function Ta(s,e,t){let n=[];for(let i=0;i<e.length;i++){let r=e[i]?.trim().match

143

144${o}${r}

145${i}

146${o}`});return["---",`format: ${zn}`,`name: ${os(s.name)}`,"---","",...e].join(`

148`))for(let i of yd)for(let r of n.matchAll(i)){let o=bd(r[1]);o&&!t.has(o)&&(t.add(o),e.push(o))}return e}function Sd(s){let e=de(s);if(!e)

149

Long lines were clipped for display.

dist/index.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import { createRequire as __cr } from 'module'; const require = __cr(import.meta.url);

3var Km=Object.create;var Ni=Object.defineProperty;var Wm=Object.getOwnPropertyDescriptor;var Hm=Object.getOwnPropertyNames;

dist/render.jsView file

Lines 255-295javascript

255 const result = await ASYNC_OPTIONAL_CHAIN_NAME(ops);

256 return result == null ? true : result;

257 }

dist/agents/claude/client.jsView file

•path = dist/agents/claude/client.js kind = oversized_source_file sizeBytes = 2540846 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/agents/claude/client.jsView on unpkg

Lines 303-375javascript

303\u274C WRONG - Browser navigation:

304\`\`\`typescript

305window.location.reload()

306window.location.href = "..."

307window.open("...")

308\`\`\`

309

310**Fix:** Remove the navigation call. To "restart", reset your state variables instead.`:`CommonJS \`require()\` is not supported! Found on line ${e}.

311

312**CRITICAL**: Use ES6 \`import\` statements at the TOP of the file:

313

314\u2705 CORRECT - ES6 import:

315\`\`\`typescript

316import { something } from 'module-name'

317\`\`\`

318

319\u274C WRONG - CommonJS require:

320\`\`\`typescript

321const something = require('module-name') // NOT SUPPORTED!

322\`\`\`

323

324**Fix:** Replace all \`require()\` calls with ES6 \`import\` statements at the top of the file.`}var it,ot,Ww,rd,xs=C(()=>{it=["client"],ot=["client","server"],Ww=[{type:"DYNAMIC_IMPORT",pattern:/\bimport\s*\(\s*['"`]/,targets:it},{type:"COMMONJS_REQUIRE",pattern:/\brequire\s

325`)}var Jt,$v,Mv,Dv,Ut,Ks,Kt=C(()=>{Jt={anthropic:"ANTHROPIC_API_KEY",openai:"OPENAI_API_KEY",gemini:"GOOGLE_API_KEY",openrouter:"OPENROUTER_API_KEY"};$v="https://api.typebulb.com/api/models",Mv=1440*60*1e3,Dv=60*1e3,Ut=null,Ks=null});import{realpathSync as Kv}from"fs";import{join as Ua,resolve as Wv}from"path";import{homedir as Hv}from"os";function Ys(){let r=process.env.TYPEBULB_SERVERS_DIR;return r?Ua(r,".."):Ua(Hv(),".typebulb")}function Ne(){return process.env.TYPEBULB_SERVERS_DIR||Ua(Ys(),"servers")}function J(r){let e=Wv(r),t=e;try{t=Kv.native(e)}catch{}return(process.platform==="win32"? ...

326`),n=[];if(t.forEach((o,a)=>{let c=AS(o);c!==void 0&&n.push({id:c,idx:a})}),!n.length)return e==="latest"?r:"";let s=e==="latest"?n[n.length-1]:n.find

327`)}function za(r){try{return process.kill(r,0),!0}catch(e){return e.code==="EPERM"}}async function ni(r){await SS(Ne(),{recursive:!0}),await np(Va(r.pid),JSON

328\u2026[${r.length-5e4} more characters truncated]`:r}var oi,ai=C(()=>{oi=(r,e)=>`![pasted image](data:${e||"image/png"};base64,${r})`});import{existsSync as RS,readdirSync as NS,statSync as _S}from"fs";import{join as IS}from"path";function ci(r){if(!RS(r))return[];let e;try{e=NS(r)}catch{return[]}let t=[];for(let n of e){if(!n.endsWith(".jsonl"))continue;let s=IS(r,n);try{let i=_S(s);i.isFile()&&t.push({sessionId:n.slice(0,-6),file:s,mtime:i.mtimeMs})}catch{}}return t}var Za=C(()=>{});var zt,ec=C(()=>{zt=class{ensureWaitSupport(){}}});import{openSync as LS,readSync as $S,closeSync as MS,statSy ...

329`):r==null?"":ke(JSON.stringify(r))}function US(r){let e=r.trim();return!!e&&hp.some(t=>t.test(e))}function JS(r){let e=r.trim();return e

330`)){if(!p.includes(`"${f}"`))continue;let h;try{h=JSON.parse(p)}catch{continue}let m=h?.[u];h?.type===f&&typeof m=="string"&&m&&(d=m)}return d},o=s(0,Math.min(65536,n)),a=n>65536?s(n-65536,65536):"",c=i(a,"custom-title","customTitle")||i(o,"custom-title","customTitle")||i(a,"ai-title","aiTitle")||i(o,"ai-title","aiTitle");if(c)return c.replace(/\s+/g," ").trim().slice(0,200);for(let l of o.split(`

331`)){if(!l.trim())continue;let f;try{f=JSON.parse(l)}catch{continue}if(!f||ln(f)||f.type!=="user")continue;let u=f.message?.content,d="";typeof u=="string"?d=ze(u):Array.isArray(u)&&(d=u.map(rc).filter(Boolean).join(" "));let p=d.replace(/\s+/g," ").trim();if(p)return(p.replace(/^Continuing from a prior session\. Here is the summary of our work so far:\s*/i,"").trim()||p).slice(0,200)}return""}finally{MS(e)}}function YS(r){let e;try{e=BS(pp)}catch{return!1}for(let t of e)if(t.endsWith(".json"))try{let n=JSON.parse(jS(li(pp,t),"utf8"));if(n?.sessionId!==r)continue;return process.kill(n.pid,0),!0 ...

332`),c=i.filter(u=>u.type==="tool_use").map(u=>({id:u.id??"",name:u.name??"",input:u.input??{}}));if(o||a||c.length){let u=Date.parse(e.timestamp??""),d=!isNaN(u)&&u>=t;n.push

333import { spawn } from "node:child_process";

334

335function logErr(...a) { try { console.error("[typebulb-wait]", ...a); } catch (e) {} }

336

337// Matches "typebulb wait", "npx typebulb wait", "/path/to/typebulb wait", "pnpm exec typebulb wait", etc.

338function isWaitCommand(command) { return /\btypebulb\s+wait\b/.test(String(command || "")); }

339

340export default function (pi) {

341 try {

342 const pending = new Set();

343

344 pi.on("tool_call", (event, ctx) => {

345 try {

346 if (!event || event.toolName !== "bash") return undefined;

347 const command = event.input && event.input.command;

348 if (!isWaitCommand(command)) return undefined;

349

350 // Run the REAL typebulb wait in the background instead of foreground (which would deadlock the

351 // turn). It does the mirror/registry lookup, --match and offsets itself. The marker tells it this

352 // is a shim-backgrounded (non-blocking) wait, so it runs as a pure subscription: no give-up clock,

353 // it waits for the event however long (bounded by the session-shutdown reap below) — an embed's

354 // first paint OR a running bulb's next event line alike.

355 const child = spawn(command, {

356 shell: true,

357 stdio: ["ignore", "pipe", "ignore"],

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L355

358 env: { ...process.env, TYPEBULB_WAIT_SHIM: "1" },

359 });

360 pending.add(child);

361 let out = "";

362 if (child.stdout) child.stdout.on("data", (b) => { out += b.toString(); });

363 child.on("error", (e) => { pending.delete(child); logErr("spawn", e && e.message); });

364 child.on("exit", (code) => {

365 pending.delete(child);

366 try {

367 const text = out.trim();

368 // Exit 0 with output is a real outcome (embed ok/error, a turn-based move) -> wake the

369 // agent (followUp delivers immediately when idle and queues when streaming — the same call

370 // git-merge-and-resolve.ts makes from agent_end). A late wake is fine; it just reports

371 // something true. Exit 2/3 (no render yet / server gone) surface passively, no turn.

372 if (code === 0 && text) {

373 pi.sendUserMessage("typebulb wait result:\n" + text, { deliverAs: "followUp" });

374 } else if (ctx.ui && typeof ctx.ui.notify === "function") {

375 ctx.ui.notify("typebulb wait: " + (code === 2 ? "timed out, nothing to report" : "ended (code " + code + ")"), "info");

Long lines were clipped for display.