vg-coder-cli
Advanced tools
+1
-1
| { | ||
| "name": "vg-coder-cli", | ||
| "version": "2.0.89", | ||
| "version": "2.0.90", | ||
| "description": "🚀 CLI tool to analyze projects, concatenate source files, count tokens, and export HTML with syntax highlighting and copy functionality", | ||
@@ -5,0 +5,0 @@ "main": "src/index.js", |
@@ -227,35 +227,16 @@ // Task Worker — runs inside the AI Studio page (shadow-DOM bundled). | ||
| // Bring this tab to the foreground + focus its window before copying. | ||
| // Concurrent profiles share the macOS WindowServer; whoever called | ||
| // tabs.create({active:true}) most recently owns OS focus. CDP | ||
| // Input.dispatchMouseEvent on a tab whose document.visibilityState is | ||
| // "hidden" silently drops the click — the Material menu opens (More | ||
| // click is a real DOM click via JS), but the second click on | ||
| // "Copy as markdown" via CDP lands in a non-rendered viewport and | ||
| // never triggers the handler. | ||
| // | ||
| // Fix: ask the launcher to activate this tab, then POLL | ||
| // visibilityState until it actually flips to "visible" — the ack of | ||
| // worker:activate-tab is delivered as soon as chrome.windows.update | ||
| // returns, but the OS focus change is asynchronous (~50-300ms). | ||
| try { | ||
| await new Promise((resolve) => { | ||
| let done = false; | ||
| const t = setTimeout(() => { if (!done) { done = true; resolve(); } }, 3000); | ||
| socket.emit('worker:activate-tab', {}, () => { | ||
| if (done) return; | ||
| done = true; | ||
| clearTimeout(t); | ||
| resolve(); | ||
| }); | ||
| }); | ||
| } catch (_) { /* non-fatal */ } | ||
| // NOTE: previously emitted worker:activate-tab + polled | ||
| // visibilityState here (commit 4ef493b fix D). Removed because: | ||
| // 1. CDP Input.dispatchMouseEvent works on hidden tabs — no | ||
| // activation actually needed for the click to land. | ||
| // 2. The server handler calls chrome.windows.update {focused: | ||
| // true}, which on macOS triggers Mission Control to switch | ||
| // Spaces if the Chromium window lives on a non-current | ||
| // desktop. Disruptive UX for the user, and the test that | ||
| // proved 2-parallel works ran with this code path NOT | ||
| // executed (engine baseline + auto-btn-bash IIFE guard | ||
| // was sufficient). | ||
| // The server's worker:activate-tab handler is now dead code; left | ||
| // in place in case a future debugging session needs it. | ||
| // Poll visibilityState up to 2s — give the OS focus change time to | ||
| // propagate. Don't block forever; if it never flips, try copy anyway. | ||
| const visStart = Date.now(); | ||
| while (document.visibilityState !== 'visible' && Date.now() - visStart < 2000) { | ||
| await new Promise(r => setTimeout(r, 50)); | ||
| } | ||
| const markdown = await window.AIChat.copyLastTurnAsMarkdown(); | ||
@@ -262,0 +243,0 @@ const chatId = window.AIChat.getChatIdFromUrl?.() || null; |
Sorry, the diff of this file is too big to display
AI-detected potential malware
Supply chain riskAI has identified this package as malware. This is a strong signal that the package may be malicious.
Found 2 instances in 1 package
Network access
Supply chain riskThis module accesses the network.
Found 2 instances in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Uses eval
Supply chain riskPackage uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.
Found 1 instance in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 5 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 2 instances in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
AI-detected potential malware
Supply chain riskAI has identified this package as malware. This is a strong signal that the package may be malicious.
Found 2 instances in 1 package
Network access
Supply chain riskThis module accesses the network.
Found 2 instances in 1 package
Shell access
Supply chain riskThis module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.
Found 1 instance in 1 package
Uses eval
Supply chain riskPackage uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.
Found 1 instance in 1 package
Dynamic require
Supply chain riskDynamic require can indicate the package is performing dangerous or unsafe dynamic code execution.
Found 1 instance in 1 package
Environment variable access
Supply chain riskPackage accesses environment variables, which may be a sign of credential stuffing or data theft.
Found 5 instances in 1 package
Filesystem access
Supply chain riskAccesses the file system, and could potentially read sensitive data.
Found 2 instances in 1 package
Long strings
Supply chain riskContains long string literals, which may be a sign of obfuscated or packed code.
Found 1 instance in 1 package
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Found 1 instance in 1 package
11049505
-0.01%19089
-0.09%