registry / unsnooze / 1.0.0

unsnooze@1.0.0

Wakes every limit-stopped AI coding session (Claude Code, Codex CLI, Grok) in tmux the moment the usage limit resets.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 23 file(s), 89.7 KB of source, external domains: github.com, learn.microsoft.com

Source & flagged code

2 flagged

src/install.jsView file

Lines 1-25javascript

1// Install / uninstall: wires unsnooze into the shell and the agent CLIs, and

2// migrates off claude-auto-retry / the pre-release csg.

3// - ~/.claude/settings.json: StopFailure hook → unsnooze _hook-stopfailure

4// (removes legacy hook entries; preserves everything else; backs up first;

5// atomic write)

6// - ~/.zshrc + ~/.bashrc: one fence-marked block with a wrapper function per

7// enabled agent (claude/codex/grok), routed through `unsnooze _run`

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/install.jsView on unpkg · L5

8// - ~/.grok/hooks/unsnooze.json when the grok agent is enabled

9// --settings <path> / --zshrc <path> override targets (used by tests).

11import { readFileSync, writeFileSync, renameSync, existsSync, copyFileSync, rmSync } from 'node:fs';

12import { homedir } from 'node:os';

13import { join, dirname } from 'node:path';

14import { CLAUDE_SETTINGS, STATE_DIR } from './config.js';

15import { getConfig, configFileExists } from './settings.js';

16import { installGrokHooks, uninstallGrokHooks } from './agents/grok.js';

17import { UNSNOOZE_BIN } from './spawn.js';

19const FENCE_OPEN = '# >>> unsnooze >>>';

20const FENCE_CLOSE = '# <<< unsnooze <<<';

21// Fenced blocks left by tools this one replaces: claude-auto-retry, and the

22// pre-release "claude-session-guard" (csg) incarnation of unsnooze itself.

23const LEGACY_FENCES = [

24 { open: '# >>> claude-auto-retry >>>', close: '# <<< claude-auto-retry <<<' },

25 { open: '# >>> claude-session-guard >>>', close: '# <<< claude-session-guard <<<' },

src/wizard.jsView file

Lines 1-24javascript

1// `unsnooze setup` — first-run interactive wizard (also invoked by a bare

2// `unsnooze install` in a TTY with no saved config). Detects installed agent

3// CLIs, asks for toggles, writes config.json, then wires wrappers + hooks.

5import { execFileSync } from 'node:child_process';

6import * as p from '@clack/prompts';

7import { listAgents } from './agents/index.js';

Source & flagged code

2 flagged · loading source

src/install.jsView file

5// atomic write) L6: // - ~/.zshrc + ~/.bashrc: one fence-marked block with a wrapper function per L7: // enabled agent (claude/codex/grok), routed through `unsnooze _run` ... L29: function parseArgs(rest) { L30: const opts = { yes: false, settings: CLAUDE_SETTINGS, zshrc: join(homedir(), '.zshrc'), purge: false }; L31: for (let i = 0; i < rest.length; i++) { ... L55: export function mergeHookIntoSettings(settingsJson) { L56: const settings = JSON.parse(settingsJson); L57: settings.hooks = settings.hooks || {}; ... L146: // interactive setup wizard (it calls back here with --yes afterwards). L147: if (!opts.yes && !configFileExists() && process.stdout.isTTY && process.stdin.isTTY) { L148: return import('./wizard.js').then(({ runWizard }) => runWizard());

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/install.jsView on unpkg · L5

src/wizard.jsView file

4L5: import { execFileSync } from 'node:child_process'; L6: import * as p from '@clack/prompts'; ... L16: try { L17: execFileSync(process.platform === 'win32' ? 'where' : 'which', [bin], { stdio: 'pipe' }); L18: return true; ... L29: p.log.warn(process.platform === 'win32' L30: ? 'tmux not found — unsnooze does not support native Windows.\nRun it inside WSL (https://learn.microsoft.com/windows/wsl/install), where tmux and the wrappers work normally.' L31: : 'tmux not found — unsnooze needs tmux to watch and revive sessions.\nInstall it first (brew install tmux / apt install tmux), then re-run `unsnooze setup`.'); ... L79: if (customizeMsg) { L80: const msg = await p.text({ L81: message: 'Resume message:',

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/wizard.jsView on unpkg · L4

Findings

1 High3 Medium4 Low

HighSandbox Evasion Gated Capabilitysrc/wizard.js

MediumEnvironment Vars

MediumInstall Persistencesrc/install.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/install.jsView file

Lines 1-25javascript

1// Install / uninstall: wires unsnooze into the shell and the agent CLIs, and

2// migrates off claude-auto-retry / the pre-release csg.

3// - ~/.claude/settings.json: StopFailure hook → unsnooze _hook-stopfailure

4// (removes legacy hook entries; preserves everything else; backs up first;

5// atomic write)

6// - ~/.zshrc + ~/.bashrc: one fence-marked block with a wrapper function per

7// enabled agent (claude/codex/grok), routed through `unsnooze _run`

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/install.jsView on unpkg · L5

8// - ~/.grok/hooks/unsnooze.json when the grok agent is enabled

9// --settings <path> / --zshrc <path> override targets (used by tests).

11import { readFileSync, writeFileSync, renameSync, existsSync, copyFileSync, rmSync } from 'node:fs';

12import { homedir } from 'node:os';

13import { join, dirname } from 'node:path';

14import { CLAUDE_SETTINGS, STATE_DIR } from './config.js';

15import { getConfig, configFileExists } from './settings.js';

16import { installGrokHooks, uninstallGrokHooks } from './agents/grok.js';

17import { UNSNOOZE_BIN } from './spawn.js';

19const FENCE_OPEN = '# >>> unsnooze >>>';

20const FENCE_CLOSE = '# <<< unsnooze <<<';

21// Fenced blocks left by tools this one replaces: claude-auto-retry, and the

22// pre-release "claude-session-guard" (csg) incarnation of unsnooze itself.

23const LEGACY_FENCES = [

24 { open: '# >>> claude-auto-retry >>>', close: '# <<< claude-auto-retry <<<' },

25 { open: '# >>> claude-session-guard >>>', close: '# <<< claude-session-guard <<<' },

src/wizard.jsView file

Lines 1-24javascript

1// `unsnooze setup` — first-run interactive wizard (also invoked by a bare

2// `unsnooze install` in a TTY with no saved config). Detects installed agent

3// CLIs, asks for toggles, writes config.json, then wires wrappers + hooks.

5import { execFileSync } from 'node:child_process';

6import * as p from '@clack/prompts';

7import { listAgents } from './agents/index.js';