Security News
Input Validation Vulnerabilities Dominate MITRE's 2024 CWE Top 25 List
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
sf-sketch-rpc
Advanced tools
RPC module based on `coscript` cli for running scripts in Sketch runtime on node.js platform
Provides helpful APIs for communicating with SketchApp runtimes in various ways within help of COScript CLI. This module mostly aimed to solve problems related to execution of plugins remotely outside of the Sketch runtime, but it also contains a bunch of helpful APIs to fetch misc info from Sketch and controlling it.
Install using npm
:
$ npm install --save sf-sketch-rpc
In order to start using RPC module, you have to define target application's name to tell COScript
CLI which SketchApp bundle should be used to communicate with.
By default, when we create SketchRPC
class instance without providing any arguments to the constructor - production version of Sketch will be used as a target:
import SketchRPC from 'sf-sketch-rpc'
const sketch = new SketchRPC();
// From this point all sketch.* calls will be addressed to `/Applications/Sketch.app` bundle.
sf-sketch-rpc
module contains a handy dictionary with standard Sketch targets(app names):
export const SketchAppVariant = {
Production: 'Sketch', // Default target
Beta: 'Sketch Beta',
Private: 'Sketch Private'
};
For example, here we create an instance of SketchRPC
class with Sketch Beta
target using this dictionary:
import SketchRPC, { SketchAppVariant } from 'sf-sketch-rpc'
const sketch = new SketchRPC(SketchAppVariant.Beta);
// All calls go to `/Application/Sketch Beta.app` bundle.
Alternatively, if you have multiple versions of Sketch with non-standard naming installed in Applications
folder you, can use any target by providing application's name as a string value:
import SketchRPC from 'sf-sketch-rpc'
// RPC module will communicate with application available at `/Applications/Sketch Beta 48.app` path.
const sketch = new SketchRPC("Sketch Beta 48");
NOTE:
SketchRPC
could work with target apps located at/Applications
folder only.
Reload:
import SketchRPC from 'sf-sketch-rpc'
const sketch = new SketchRPC();
sketch.bootstrapPluginBundleInstance({
bundlePath: 'path/to/plugin.sketchplugin', // A full path to the bundle outside of Sketch's `Plugins` folder
commandIdentifier: 'main'
},function(err,res) {
if(err) {
console.log(err);
return;
}
});
Existing bundles:
import SketchRPC from 'sf-sketch-rpc'
const sketch = new SketchRPC();
sketch.bootstrapPluginBundleInstance({
bundleIdentifier: 'com.example.my-plugin', // Identifier of the plugin bundle
commandIdentifier: 'main'
},function(err,res) {
if(err) {
console.log(err);
return;
}
});
RPC side:
import SketchRPC from 'sf-sketch-rpc'
const sketch = new SketchRPC();
sketch.bootstrapPluginBundleInstance({
bundleIdentifier: 'com.turbobabr.colorizer',
commandIdentifier: 'colorizeSelectedLayers',
// Any custom data to be passed to command's handler context
context: {
fillColor: '#f0dd76'
}
},function(err,res) {
if(err) {
console.log(err);
return;
}
});
Plugin command's handler:
function onRunColorizeSelectedLayers(context) {
function hexColorToMSColor(color) {
return MSColor.alloc().initWithImmutableObject(MSImmutableColor.colorWithSVGString(color);
}
var selection = context.selection;
var document = context.document;
// `context` object passed from RPC is available from handler's context as `remoteContext` property
var remoteContext = context.remoteContext;
if(!remoteContext) {
// This could happen if command was triggered by a user directly
document.showMessage('No remote context... ¯\_(ツ)_/¯');
return;
}
for(var i=0;i<selection.count();i++) {
var layer = selection.objectAtIndex(i);
layer.style().fill().color = hexColorToMSColor(remoteContext.fillColor);
}
}
text
import SketchRPC from 'sf-sketch-rpc'
const sketch = new SketchRPC();
sketch.bootstrapPluginBundleInstance({
bundlePath: "/path/to/bundle.sketchplugin"
},(err,res) => {
if(err) {
console.log(err);
return;
}
const { stderr, stdout } = res;
console.log(stderr);
console.log(stdout);
});
import SketchRPC from 'sf-sketch-rpc'
const sketch = new SketchRPC();
sketch.makeFirstResponder((err) => {
if(err) {
console.log(err);
return;
}
// At this point Sketch app should be activated and brought to the foreground
});
Module contains a bunch of helpful methods to get various Sketch paths:
import SketchRPC from 'sf-sketch-rpc'
const sketch = new SketchRPC();
// Target's app bundle path
console.log(sketch.appPath);
// > /Applications/Sketch.app
// Application Support folder path
console.log(sketch.appPath);
// > ~/Library/Application Support/com.bohemiancoding.sketch3
// Plugins folder path
console.log(sketch.appPath);
// > ~/Library/Application Support/com.bohemiancoding.sketch3/Plugins
// Templates folder path
console.log(sketch.appPath);
// > ~/Library/Application Support/com.bohemiancoding.sketch3/Templates
Info.plist
stored in target's app bundleText Info.plist Text
In order to fetch entire Info.plist
file as object, use plist
property:
const sketch = new SketchRPC();
console.log(sketch.plist);
Truncated log output:
{ BuildMachineOSBuild: '16D32',
CFBuildNumber: '109',
CFBundleDevelopmentRegion: 'English',
CFBundleDisplayName: 'Sketch',
CFBundleDocumentTypes:
[ { CFBundleTypeIconFile: 'doc.icns',
CFBundleTypeName: 'com.bohemiancoding.sketch.drawing',
CFBundleTypeRole: 'Viewer',
LSHandlerRank: 'Owner',
LSItemContentTypes: [Object],
LSTypeIsPackage: true,
NSDocumentClass: 'MSDocument' },
...
],
...
}
If you need to fetch only single property, there's a convenient plistProp(key)
method for that:
const sketch = new SketchRPC();
console.log(sketch.plistProp('CFBundleDisplayName'));
// > Sketch
console.log(sketch.plistProp('CHApplicationSupportFolderName'));
// > com.bohemiancoding.sketch3
Also, there's a handy property for bundle version:
const sketch = new SketchRPC();
console.log(sketch.version());
// > 41.1
The MIT License (MIT)
Copyright (c) 2017 Andrey Shakhmin
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
RPC module based on `coscript` cli for running scripts in Sketch runtime on node.js platform
The npm package sf-sketch-rpc receives a total of 2 weekly downloads. As such, sf-sketch-rpc popularity was classified as not popular.
We found that sf-sketch-rpc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.