github JavaScript re-analysis due

new-256/codebuddy-bridge

codebuddy-first bridge for DeepSeek Harness (DSH): dispatch real work to the local codebuddy CLI first in every mode, with fallback dialog, live status light, token usage accounting, and a zero-dependency MCP server

maintainer: new-256
licence: MIT
first seen: 2026-09-01
last seen: 2026-09-18
releases · 30d: 13
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 3 tools

transport stdio counts 3 tools · 0 res · 0 prompts permission surface via code analysis

tools

codebuddy_continue
codebuddy_run
codebuddy_status

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 96dc252 · analyzer v33 · 3d ago

danger signals2

dynamic code execution new Function() new-256-codebuddy-bridge-96dc252/test/build-sync.test.mjs :23 const fn = new Function('harness', buildDynamic())
dynamic code execution new Function() new-256-codebuddy-bridge-96dc252/test/dynamic-sim.test.mjs :17 const fn = new Function('harness', source)

code evidence vv1.1.10 · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 22

filesystem 6

fs new-256-codebuddy-bridge-96dc252/mcp/codebuddy-mcp-server.mjs :34 import { existsSync, writeFileSync, renameSync, mkdirSync } from 'node:fs'
fs (weak) new-256-codebuddy-bridge-96dc252/scripts/audit-npm-sync.mjs :22 import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, existsSync, writeFileSync } from 'node:fs'
fs (weak) new-256-codebuddy-bridge-96dc252/scripts/build.mjs :16 import { readFileSync, writeFileSync } from 'node:fs'
fs (weak) new-256-codebuddy-bridge-96dc252/scripts/dsh-compat.mjs :29 import { mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, existsSync, writeFileSync } from 'node:fs'
fs (weak) new-256-codebuddy-bridge-96dc252/scripts/verify.mjs :7 import { readFileSync } from 'node:fs'
fs (weak) new-256-codebuddy-bridge-96dc252/test/build-sync.test.mjs :8 import { readFileSync } from 'node:fs'

shell / exec 5

shell new-256-codebuddy-bridge-96dc252/mcp/codebuddy-mcp-server.mjs :32 import { spawn } from 'node:child_process'
shell (weak) new-256-codebuddy-bridge-96dc252/scripts/audit-npm-sync.mjs :21 import { execFileSync } from 'node:child_process'
shell (weak) new-256-codebuddy-bridge-96dc252/scripts/dsh-compat.mjs :28 import { execFileSync } from 'node:child_process'
shell (weak) new-256-codebuddy-bridge-96dc252/test/helpers/mockdsh.mjs :57 spawn(spec) {
shell (weak) new-256-codebuddy-bridge-96dc252/test/mcp.test.mjs :8 import { spawn } from 'node:child_process'

network 1

net new-256-codebuddy-bridge-96dc252/home-plugin/codebuddy-indicator/lib/client.js :230 fetch("/codebuddy-indicator/status", { cache: "no-store" })

tool registrations 3

codebuddy_run new-256-codebuddy-bridge-96dc252/mcp/codebuddy-mcp-server.mjs :302
codebuddy_continue new-256-codebuddy-bridge-96dc252/mcp/codebuddy-mcp-server.mjs :321
codebuddy_status new-256-codebuddy-bridge-96dc252/mcp/codebuddy-mcp-server.mjs :341

install hooks 1

prepack new-256-codebuddy-bridge-96dc252/package.json :30 node scripts/verify.mjs && npm test