MCP Observatory
5m ago Tracked 39,510 Last 5m ago 24h 3,139
npm JavaScript analyzed · update queued 1.2.0-beta.2 unconfirmed MCP

patchwork-os

v1.2.0-beta.2
npm

Your personal AI runtime, local-first. Patchwork OS gives any AI model a consistent set of tools, YAML recipes, a delegation policy with approval queue, and a durable trace memory — all on your machine, all under your policy.

maintainer
oolab-labs
license
MIT
first seen
2026-05-24
last seen
2026-08-14
releases · 30d
193
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged committed secret in patchwork-os
capabilities 0 tools
transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.2.0-beta.2 · analyzer v31 · 1d ago

skills & prompt files 4

danger signals3

code evidence v1.2.0-beta.2 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 530

filesystem 152

  • fs package/dist/activationMetrics.js :25 import fs from "node:fs";
  • fs package/dist/activityLog.js :1 import fs from "node:fs";
  • fs package/dist/analyticsConfig.js :17 import fs from "node:fs";
  • fs package/dist/analyticsPrefs.js :7 import fs from "node:fs";
  • fs package/dist/approvalKpi.js :23 import { readdirSync, readFileSync } from "node:fs";
  • fs package/dist/approvalPersistence.js :1 import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
  • fs package/dist/automation.js :2 import fs from "node:fs";
  • fs package/dist/bridge.js :2 import fs from "node:fs";
  • fs package/dist/bridgeLockDiscovery.js :1 import fs from "node:fs";
  • fs package/dist/bridgeToken.js :15 import fs from "node:fs";
  • fs package/dist/bridgeToolsRules.js :6 import { existsSync, mkdirSync, readFileSync } from "node:fs";
  • fs package/dist/butler/factStore.js :16 import { appendFileSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync, } from "node:fs";
  • fs package/dist/butler/permissionStore.js :26 import { appendFileSync, mkdirSync, readFileSync, statSync } from "node:fs";
  • fs package/dist/ccPermissions.js :1 import { existsSync, readFileSync } from "node:fs";
  • fs package/dist/claudeDriver.js :21 import { writeFileSync } from "node:fs";
  • fs package/dist/claudeMdPatch.js :8 import { existsSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
  • fs package/dist/claudeOrchestrator.js :2 import fs from "node:fs";
  • fs package/dist/commands/auditEnv.js :9 import { existsSync, readFileSync, statSync } from "node:fs";
  • fs package/dist/commands/codexDoctor.js :18 import fs from "node:fs";
  • fs package/dist/commands/dashboard.js :14 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, } from "node:fs";
  • fs package/dist/commands/install.js :2 import { existsSync, mkdirSync, readFileSync } from "node:fs";
  • fs package/dist/commands/launchd.js :2 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
  • fs package/dist/commands/patchworkInit.js :3 import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, } from "node:fs";
  • fs package/dist/commands/recipe.js :6 import { existsSync, mkdirSync, readFileSync, statSync, watch, writeFileSync, } from "node:fs";
  • fs package/dist/commands/recipeInstall.js :11 import { cpSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
  • fs package/dist/commands/shadowScan.js :9 import fs from "node:fs";
  • fs package/dist/commands/task.js :9 import { readFileSync } from "node:fs";
  • fs package/dist/commands/tokenEfficiency.js :9 import { existsSync, readFileSync } from "node:fs";
  • fs package/dist/commands/tools.js :10 import { readdirSync, readFileSync } from "node:fs";
  • fs package/dist/commands/tracesExport.js :27 import { createReadStream, createWriteStream, existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
  • fs package/dist/commands/tracesImport.js :27 import { appendFileSync, createReadStream, existsSync, mkdirSync, writeFileSync, } from "node:fs";
  • fs package/dist/commitIssueLinkLog.js :1 import { appendFileSync, mkdirSync, readFileSync, statSync } from "node:fs";
  • fs package/dist/config.js :2 import fs from "node:fs";
  • fs package/dist/connectors/caldiy.js :21 import { unlinkSync } from "node:fs";
  • fs package/dist/connectors/fixtureLibrary.js :1 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
  • fs package/dist/connectors/gmail.js :15 import { existsSync, readFileSync, unlinkSync } from "node:fs";
  • fs package/dist/connectors/googleCalendar.js :14 import { existsSync, readFileSync, unlinkSync } from "node:fs";
  • fs package/dist/connectors/googleDocs.js :2 import { existsSync, readFileSync, unlinkSync } from "node:fs";
  • fs package/dist/connectors/googleDrive.js :2 import { existsSync, readFileSync, unlinkSync } from "node:fs";
  • fs package/dist/connectors/jira.js :9 import { existsSync, readFileSync, unlinkSync } from "node:fs";
  • fs package/dist/connectors/mcpOAuth.js :20 import { existsSync, readFileSync, unlinkSync } from "node:fs";
  • fs package/dist/connectors/monday.js :13 import { existsSync, readFileSync, unlinkSync } from "node:fs";
  • fs package/dist/connectors/notion.js :12 import { unlinkSync } from "node:fs";
  • fs package/dist/connectors/oauthStateStore.js :31 import { existsSync, mkdirSync, readFileSync } from "node:fs";
  • fs package/dist/connectors/obsidian.js :16 import { unlinkSync } from "node:fs";
  • fs package/dist/connectors/salesforce.js :23 import { existsSync, readFileSync, unlinkSync } from "node:fs";
  • fs package/dist/connectors/secrets.js :36 import { readFileSync } from "node:fs";
  • fs package/dist/connectors/slack.js :15 import { existsSync, mkdirSync, readFileSync, unlinkSync } from "node:fs";
  • fs package/dist/connectors/tokenStorage.js :13 import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, unlinkSync, writeFileSync, } from "node:fs";
  • fs package/dist/decisionTraceLog.js :1 import { appendFileSync, closeSync, mkdirSync, openSync, readFileSync, readSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
  • fs package/dist/drivers/claude/subprocess.js :2 import { mkdtempSync, writeFileSync } from "node:fs";
  • fs package/dist/drivers/claude/subprocessSettings.js :1 import { writeFileSync } from "node:fs";
  • fs package/dist/drivers/gemini/index.js :2 import { chmodSync, existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync, } from "node:fs";
  • fs package/dist/featureFlags.js :10 import { existsSync, mkdirSync, readFileSync } from "node:fs";
  • fs package/dist/fileLockSync.js :1 import { closeSync, openSync, statSync, unlinkSync } from "node:fs";
  • fs package/dist/fsWatchWithFallback.js :1 import fs from "node:fs";
  • fs package/dist/identity/roster.js :31 import { existsSync, readFileSync } from "node:fs";
  • fs package/dist/inboxRoutes.js :16 import { existsSync } from "node:fs";
  • fs package/dist/index.js :49 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
  • fs package/dist/installGuard.js :2 import { lstatSync, realpathSync } from "node:fs";
  • fs package/dist/lockfile.js :2 import fs from "node:fs";
  • fs package/dist/oauth.js :23 import fs from "node:fs";
  • fs package/dist/orchestrator/childBridgeRegistry.js :1 import fs from "node:fs";
  • fs package/dist/patchworkConfig.js :1 import { existsSync, mkdirSync, readFileSync } from "node:fs";
  • fs package/dist/patchworkHome.js :26 import { existsSync } from "node:fs";
  • fs package/dist/pluginLoader.js :14 import fs from "node:fs";
  • fs package/dist/policy.js :17 import { existsSync, readFileSync } from "node:fs";
  • fs package/dist/preToolUseHook.js :1 import { existsSync, readFileSync } from "node:fs";
  • fs package/dist/probe.js :2 import fs from "node:fs";
  • fs package/dist/prompts.js :3 import { readFileSync } from "node:fs";
  • fs package/dist/recipeOrchestration.js :5 import { mkdirSync, readFileSync } from "node:fs";
  • fs package/dist/recipes/disabledMarkers.js :21 import { existsSync } from "node:fs";
  • fs package/dist/recipes/eventTriggerPrograms.js :1 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
  • fs package/dist/recipes/fileRollback.js :26 import { appendFileSync, existsSync, lstatSync, mkdirSync, readFileSync, statSync, unlinkSync, } from "node:fs";
  • fs package/dist/recipes/idempotencyKey.js :49 import { appendFileSync, lstatSync, mkdirSync, readFileSync, statSync, } from "node:fs";
  • fs package/dist/recipes/installer.js :1 import { mkdirSync, readFileSync } from "node:fs";
  • fs package/dist/recipes/manifest.js :8 import { existsSync, readFileSync } from "node:fs";
  • fs package/dist/recipes/migrationWarnings.js :1 import { readdirSync } from "node:fs";
  • fs package/dist/recipes/pricing/priceTable.js :22 import { existsSync, readFileSync } from "node:fs";
  • fs package/dist/recipes/resolveRecipePath.js :32 import fs from "node:fs";
  • fs package/dist/recipes/scheduler.js :1 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
  • fs package/dist/recipes/tools/file.js :12 import { existsSync, mkdirSync } from "node:fs";
  • fs package/dist/recipes/triggerVars.js :1 import { readFileSync } from "node:fs";
  • fs package/dist/recipes/workspaceRoot.js :25 import { statSync } from "node:fs";
  • fs package/dist/recipes/yamlRunner.js :27 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, } from "node:fs";
  • fs package/dist/recipesHttp.js :2 import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
  • fs package/dist/resources.js :8 import fs from "node:fs";
  • fs package/dist/runLog.js :1 import { appendFileSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
  • fs package/dist/server.js :3 import { unlinkSync } from "node:fs";
  • fs package/dist/sessionCheckpoint.js :1 import fs from "node:fs";
  • fs package/dist/settingsEnv.js :1 import { existsSync, readFileSync } from "node:fs";
  • fs package/dist/tokenUsageTracker.js :1 import fs from "node:fs";
  • fs package/dist/tools/auditDependencies.js :1 import { existsSync } from "node:fs";
  • fs package/dist/tools/blame-utils.js :2 import { existsSync } from "node:fs";
  • fs package/dist/tools/bridgeDoctor.js :2 import fs from "node:fs";
  • fs package/dist/tools/checkDocumentDirty.js :1 import fs from "node:fs";
  • fs package/dist/tools/detectUnusedCode.js :1 import { existsSync } from "node:fs";
  • fs package/dist/tools/editText.js :1 import fs from "node:fs";
  • fs package/dist/tools/explainDiagnostic.js :1 import fs from "node:fs";
  • fs package/dist/tools/fileOperations.js :1 import fs from "node:fs";
  • fs package/dist/tools/findRelatedTests.js :149 const content = await fs.readFile(candidate, "utf-8");
  • fs package/dist/tools/fixAllLintErrors.js :1 import fs from "node:fs";
  • fs package/dist/tools/formatDocument.js :1 import fs from "node:fs";
  • fs package/dist/tools/generateAPIDocumentation.js :1 import fs from "node:fs";
  • fs package/dist/tools/generateTests.js :1 import { existsSync, promises as fsPromises, readFileSync } from "node:fs";
  • fs package/dist/tools/getBufferContent.js :1 import { createReadStream } from "node:fs";
  • fs package/dist/tools/getCodeCoverage.js :1 import { existsSync, promises as fsPromises } from "node:fs";
  • fs package/dist/tools/getDependencyTree.js :1 import { existsSync } from "node:fs";
  • fs package/dist/tools/getDocumentSymbols.js :1 import fs from "node:fs";
  • fs package/dist/tools/getFileTree.js :1 import fs from "node:fs";
  • fs package/dist/tools/getImportTree.js :1 import fs from "node:fs";
  • fs package/dist/tools/getImportedSignatures.js :1 import fs from "node:fs";
  • fs package/dist/tools/getOpenEditors.js :1 import fs from "node:fs";
  • fs package/dist/tools/getProjectContext.js :2 import fs from "node:fs";
  • fs package/dist/tools/getProjectInfo.js :1 import fs from "node:fs";
  • fs package/dist/tools/getSecurityAdvisories.js :1 import { existsSync } from "node:fs";
  • fs package/dist/tools/handoffNote.js :2 import fs from "node:fs";
  • fs package/dist/tools/headless/lspFallback.js :8 import fs from "node:fs";
  • fs package/dist/tools/httpClient.js :2 import fs from "node:fs/promises";
  • fs package/dist/tools/linters/biome.js :1 import fs from "node:fs";
  • fs package/dist/tools/linters/cargo.js :1 import fs from "node:fs";
  • fs package/dist/tools/linters/eslint.js :1 import fs from "node:fs";
  • fs package/dist/tools/linters/govet.js :1 import fs from "node:fs";
  • fs package/dist/tools/linters/typescript.js :1 import fs from "node:fs";
  • fs package/dist/tools/openDiff.js :2 import fs from "node:fs";
  • fs package/dist/tools/openFile.js :2 import fs from "node:fs";
  • fs package/dist/tools/openInBrowser.js :1 import fs from "node:fs/promises";
  • fs package/dist/tools/organizeImports.js :1 import fs from "node:fs";
  • fs package/dist/tools/planPersistence.js :1 import fsp from "node:fs/promises";
  • fs package/dist/tools/previewEdit.js :1 import fs from "node:fs";
  • fs package/dist/tools/refactorExtractFunction.js :1 import fs from "node:fs";
  • fs package/dist/tools/replaceBlock.js :1 import fs from "node:fs/promises";
  • fs package/dist/tools/searchAndReplace.js :1 import fs from "node:fs";
  • fs package/dist/tools/spawnWorkspace.js :2 import fs from "node:fs/promises";
  • fs package/dist/tools/testRunners/cargoTest.js :1 import fs from "node:fs";
  • fs package/dist/tools/testRunners/goTest.js :1 import fs from "node:fs";
  • fs package/dist/tools/testRunners/pytest.js :1 import fs from "node:fs";
  • fs package/dist/tools/testRunners/vitestJest.js :1 import fs from "node:fs";
  • fs package/dist/tools/testTraceToSource.js :1 import { existsSync, promises as fsPromises } from "node:fs";
  • fs package/dist/tools/transaction.js :2 import fs from "node:fs";
  • fs package/dist/tools/utils.js :2 import fs from "node:fs";
  • fs package/dist/workerGateDecisionLog.js :1 import { appendFileSync, closeSync, mkdirSync, openSync, readFileSync, readSync, renameSync, statSync, unlinkSync, writeFileSync, } from "node:fs";
  • fs package/dist/workers/outcomeStore.js :1 import { appendFileSync, existsSync, readFileSync, statSync } from "node:fs";
  • fs package/dist/workers/runWorkerShadow.js :1 import { readdirSync, readFileSync, statSync } from "node:fs";
  • fs package/dist/workers/trustCheckpoint.js :1 import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
  • fs package/dist/workers/workerLoader.js :1 import { readdirSync, readFileSync } from "node:fs";
  • fs package/dist/workersHttp.js :10 import { existsSync, mkdirSync, readdirSync, readFileSync } from "node:fs";
  • fs package/dist/writeFileAtomic.js :2 import fs from "node:fs";
  • fs (weak) package/scripts/mcp-stdio-shim.cjs :25 const fs = require("node:fs");
  • fs (weak) package/scripts/postinstall.mjs :19 } from "node:fs";
  • fs (weak) package/scripts/smoke/run-all.mjs :5 import fs from "node:fs";
  • fs (weak) package/scripts/start-all.mjs :23 import fs from "node:fs";

shell / exec 36

  • shell package/dist/claudeDriver.js :20 import { spawn } from "node:child_process";
  • shell package/dist/commands/dashboard.js :13 import { spawnSync } from "node:child_process";
  • shell package/dist/commands/install.js :1 import { execFileSync } from "node:child_process";
  • shell package/dist/commands/launchd.js :1 import { spawnSync } from "node:child_process";
  • shell package/dist/commands/patchworkInit.js :1 import { spawnSync } from "node:child_process";
  • shell package/dist/commands/tokenEfficiency.js :8 import { spawn } from "node:child_process";
  • shell package/dist/config.js :1 import { execFileSync } from "node:child_process";
  • shell package/dist/connectors/mcpOAuth.js :98 * → spawnSync('security'|'pwsh'…), spawning 1-2 blocking keychain processes
  • shell package/dist/connectors/tokenStorage.js :11 import { spawnSync } from "node:child_process";
  • shell package/dist/drivers/claude/subprocess.js :1 import { spawn } from "node:child_process";
  • shell package/dist/drivers/codex/subprocess.js :1 import { spawn } from "node:child_process";
  • shell package/dist/drivers/gemini/index.js :1 import { spawn } from "node:child_process";
  • shell package/dist/index.js :47 import { execFileSync, spawn, spawnSync } from "node:child_process";
  • shell package/dist/installGuard.js :1 import { spawnSync } from "node:child_process";
  • shell package/dist/probe.js :1 import { execFile } from "node:child_process";
  • shell package/dist/processTree.js :1 import { execFileSync } from "node:child_process";
  • shell package/dist/recipes/schemaGenerator.js :15 * RECIPE_NAME_RE is the bare kebab slug (`^[a-z0-9][a-z0-9-]{0,63}$`).
  • shell package/dist/recipes/tools/meetingNotes.js :78 const inlineHeader = new RegExp(`^(\\s*(?:#+\\s*)?(?:${HEADER_NAMES}))[\\s:]+(.+)$`, "i");
  • shell package/dist/recipes/yamlRunner.js :26 import { spawnSync } from "node:child_process";
  • shell package/dist/riskSignals.js :21 * the catalog can never fork (the repo's recurring "incomplete-fix-one-path"
  • shell package/dist/tools/blame-utils.js :1 import { execFile } from "node:child_process";
  • shell package/dist/tools/bridgeDoctor.js :1 import { execFile } from "node:child_process";
  • shell package/dist/tools/clipboard.js :1 import { execFile } from "node:child_process";
  • shell package/dist/tools/findFiles.js :77 const regex = new RegExp(`(^|/)${regexPattern}$`, "i");
  • shell package/dist/tools/headless/lspClient.js :15 import { spawn } from "node:child_process";
  • shell package/dist/tools/navigateToSymbolByName.js :21 import { execFile } from "node:child_process";
  • shell package/dist/tools/openDiff.js :1 import { spawn } from "node:child_process";
  • shell package/dist/tools/openFile.js :1 import { spawn } from "node:child_process";
  • shell package/dist/tools/spawnWorkspace.js :1 import { spawn } from "node:child_process";
  • shell package/dist/tools/utils.js :1 import { execFile, spawn } from "node:child_process";
  • shell package/dist/winShim.js :6 * (or under `%APPDATA%\npm` for `-g` installs). Node's `child_process.spawn`
  • shell package/dist/workers/contextRiskScorer.js :57 const numstat = await exec("git", ["diff", "HEAD", "--numstat"]);
  • shell (weak) package/scripts/postinstall.mjs :11 import { execFileSync } from "node:child_process";
  • shell (weak) package/scripts/smoke/run-all.mjs :4 import { execFileSync, spawn } from "node:child_process";
  • shell (weak) package/scripts/start-all.mjs :22 import { execFileSync, spawn } from "node:child_process";
  • shell (weak) package/scripts/start-remote.mjs :14 import { spawn } from "node:child_process";

network 70

  • net package/dist/analyticsSend.js :78 const res = await fetch(endpoint, {
  • net package/dist/approvalHttp.js :359 const res = await fetch(webhookUrl, {
  • net package/dist/claudeAuthHttp.js :164 tokenRes = await fetch(CLAUDE_OAUTH_TOKEN_URL, {
  • net package/dist/commands/analytics.js :108 const res = await fetch(target.endpoint, {
  • net package/dist/commands/patchworkInit.js :163 const res = await fetch("http://localhost:11434/api/tags", {
  • net package/dist/commands/recipeInstall.js :12 import https from "node:https";
  • net package/dist/commands/task.js :147 const resp = await fetch(`http://127.0.0.1:${lock.port}/launch-quick-task`, {
  • net package/dist/commands/tokenEfficiency.js :60 fetch(`http://127.0.0.1:${port}/health`, {
  • net package/dist/connectors/airtable.js :112 response = await fetch(OAUTH_TOKEN_ENDPOINT, {
  • net package/dist/connectors/asana.js :160 const res = await fetch(`${ASANA_API_BASE}/users/me`, {
  • net package/dist/connectors/baseConnector.js :144 response = await fetch(config.tokenEndpoint, {
  • net package/dist/connectors/caldiy.js :115 const res = await fetch(`${baseUrl}/me`, {
  • net package/dist/connectors/circleci.js :48 const res = await fetch(`${BASE_URL}/me`, {
  • net package/dist/connectors/cloudflare.js :47 const res = await fetch(`${BASE_URL}/user/tokens/verify`, {
  • net package/dist/connectors/confluence.js :57 const res = await fetch(url, {
  • net package/dist/connectors/datadog.js :49 const res = await fetch(`${this.baseUrl()}/api/v1/validate`, {
  • net package/dist/connectors/discord.js :156 const res = await fetch(`${DISCORD_API_BASE}/users/@me`, {
  • net package/dist/connectors/figma.js :43 const res = await fetch(`${BASE_URL}/v1/me`, {
  • net package/dist/connectors/github.js :114 const res = await fetch(url.toString(), {
  • net package/dist/connectors/gitlab.js :171 const res = await fetch(`${apiBase()}/user`, {
  • net package/dist/connectors/gmail.js :90 const res = await fetch("https://oauth2.googleapis.com/token", {
  • net package/dist/connectors/googleCalendar.js :105 const res = await fetch("https://oauth2.googleapis.com/token", {
  • net package/dist/connectors/googleDocs.js :139 const res = await fetch("https://oauth2.googleapis.com/token", {
  • net package/dist/connectors/googleDrive.js :90 const res = await fetch("https://oauth2.googleapis.com/token", {
  • net package/dist/connectors/grafana.js :41 const res = await fetch(`${this.baseUrl()}/api/org`, {
  • net package/dist/connectors/hubspot.js :33 const res = await fetch(`${HUBSPOT_BASE}/account-info/v3/details`, {
  • net package/dist/connectors/intercom.js :35 const res = await fetch(`${BASE_URL}/me`, {
  • net package/dist/connectors/jira.js :61 const res = await fetch(url, {
  • net package/dist/connectors/mcpClient.js :138 const res = await fetch(this.endpoint, {
  • net package/dist/connectors/mcpOAuth.js :172 const res = await fetch(config.registrationEndpoint, {
  • net package/dist/connectors/monday.js :189 const res = await fetch(MONDAY_TOKEN_URL, {
  • net package/dist/connectors/notion.js :70 const res = await fetch(`${NOTION_API}/users/me`, {
  • net package/dist/connectors/obsidian.js :19 import { Agent, fetch as undiciFetch } from "undici";
  • net package/dist/connectors/pagerduty.js :41 const res = await fetch(`${PAGERDUTY_BASE}/users/me`, {
  • net package/dist/connectors/paystack.js :41 const res = await fetch(`${BASE_URL}/bank`, {
  • net package/dist/connectors/pipedrive.js :46 const res = await fetch(url, { headers: this.buildHeaders() });
  • net package/dist/connectors/posthog.js :38 const res = await fetch(`${this.baseUrl()}/api/projects/`, {
  • net package/dist/connectors/resend.js :71 const res = await fetch(`${BASE_URL}/api-keys`, {
  • net package/dist/connectors/salesforce.js :225 const res = await fetch(`https://${host}/services/oauth2/token`, {
  • net package/dist/connectors/sendgrid.js :40 const res = await fetch(`${BASE_URL}/v3/scopes`, {
  • net package/dist/connectors/shopify.js :65 const res = await fetch(`${base}/shop.json`, {
  • net package/dist/connectors/slack.js :163 const res = await fetch(url.toString(), {
  • net package/dist/connectors/snowflake.js :259 const res = await fetch(url, {
  • net package/dist/connectors/stripe.js :35 const res = await fetch(`${BASE_URL}/v1/balance`, {
  • net package/dist/connectors/supabase.js :110 const res = await fetch(`${tokens.url}/rest/v1/`, {
  • net package/dist/connectors/telegram.js :43 const res = await fetch(this.buildUrl(token, "getMe"));
  • net package/dist/connectors/todoist.js :103 const res = await fetch(`${TODOIST_BASE}/projects`, {
  • net package/dist/connectors/twilio.js :48 const res = await fetch(`${BASE_URL}/2010-04-01/Accounts/${tokens.accountSid}.json`, { headers: this.buildHeaders() });
  • net package/dist/connectors/vercel.js :54 const res = await fetch(`${BASE_URL}/v2/user`, {
  • net package/dist/connectors/webflow.js :37 const res = await fetch(`${BASE_URL}/token/authorized_by`, {
  • net package/dist/connectors/woocommerce.js :100 const res = await fetch(this.baseUrl("/system_status"), {
  • net package/dist/connectors/zendesk.js :35 const res = await fetch(`${this.baseUrl()}/api/v2/users/me`, {
  • net package/dist/dashboard.js :84 const r = await fetch('/dashboard/data');
  • net package/dist/fp/interpreterContext.js :99 // the resolved IP so the subsequent fetch() cannot be redirected to a
  • net package/dist/haltPushDispatch.js :66 const res = await fetch(`${pushServiceUrl}/halt`, {
  • net package/dist/index.js :134 const metaRes = await fetch(metaUrl);
  • net package/dist/oauth.js :27 import { Agent, fetch as undiciFetch } from "undici";
  • net package/dist/orchestrator/childBridgeClient.js :2 import http from "node:http";
  • net package/dist/recipeRoutes.js :429 // bare `fetch(url, { redirect: "follow" })` therefore lets a 302 → private
  • net package/dist/recipes/githubInstallSource.js :179 rawResponse = await fetch(rawUrl, {
  • net package/dist/recipes/tools/gmail.js :40 const listRes = await fetch(listUrl, {
  • net package/dist/recipes/tools/http.js :9 import { Agent, fetch as undiciFetch } from "undici";
  • net package/dist/recipes/yamlRunner.js :2750 const res = await fetch("https://api.anthropic.com/v1/messages", {
  • net package/dist/server.js :4 import http from "node:http";
  • net package/dist/tools/fetchCalendarEvents.js :14 description: "Number of days ahead to fetch (default: 7, max: 30).",
  • net package/dist/tools/httpClient.js :218 resp = await fetch(currentUrl, {
  • net package/dist/tools/openInBrowser.js :2 import http from "node:http";
  • net package/dist/tools/spawnWorkspace.js :11 const res = await fetch(url, {
  • net (weak) package/scripts/start-all.mjs :24 import http from "node:http";
  • net (weak) package/scripts/start-remote.mjs :38 fetch(`https://ntfy.sh/${NTFY_TOPIC}`, {

secrets 51

  • secrets package/dist/adapters/claude.js :33 const key = this.opts.apiKey ?? process.env.ANTHROPIC_API_KEY;
  • secrets package/dist/adapters/gemini.js :15 const key = this.opts.apiKey ?? process.env.GOOGLE_API_KEY;
  • secrets package/dist/adapters/grok.js :14 const apiKey = opts.apiKey ?? process.env.XAI_API_KEY;
  • secrets package/dist/adapters/openai.js :19 const key = this.opts.apiKey ?? process.env.OPENAI_API_KEY;
  • secrets package/dist/analyticsSend.js :33 const envKey = process.env.PATCHWORK_ANALYTICS_KEY;
  • secrets package/dist/claudeDriver.js :466 if (!process.env.ANTHROPIC_API_KEY) {
  • secrets package/dist/commands/analytics.js :58 ` PATCHWORK_ANALYTICS_KEY: ${maskKey(process.env.PATCHWORK_ANALYTICS_KEY)}\n`);
  • secrets package/dist/config.js :471 if (pw.apiKeys.openai && !process.env.OPENAI_API_KEY)
  • secrets package/dist/connectors/airtable.js :40 clientSecret: process.env.AIRTABLE_CLIENT_SECRET,
  • secrets package/dist/connectors/caldiy.js :31 const envKey = process.env.CALCOM_API_KEY;
  • secrets package/dist/connectors/circleci.js :436 const envToken = process.env.CIRCLECI_API_TOKEN;
  • secrets package/dist/connectors/cloudflare.js :421 const envToken = process.env.CLOUDFLARE_API_TOKEN;
  • secrets package/dist/connectors/confluence.js :261 const envToken = process.env.CONFLUENCE_API_TOKEN;
  • secrets package/dist/connectors/datadog.js :236 const envApiKey = process.env.DATADOG_API_KEY;
  • secrets package/dist/connectors/elasticsearch.js :56 const apiKey = process.env.ELASTICSEARCH_API_KEY;
  • secrets package/dist/connectors/figma.js :240 const envToken = process.env.FIGMA_ACCESS_TOKEN;
  • secrets package/dist/connectors/grafana.js :333 const envApiKey = process.env.GRAFANA_API_KEY;
  • secrets package/dist/connectors/hubspot.js :261 const envToken = process.env.HUBSPOT_ACCESS_TOKEN;
  • secrets package/dist/connectors/intercom.js :255 const envToken = process.env.INTERCOM_ACCESS_TOKEN;
  • secrets package/dist/connectors/jira.js :385 const envToken = process.env.JIRA_API_TOKEN;
  • secrets package/dist/connectors/linear.js :25 const envKey = process.env.LINEAR_API_KEY;
  • secrets package/dist/connectors/monday.js :119 return process.env.MONDAY_CLIENT_SECRET ?? "";
  • secrets package/dist/connectors/notion.js :21 const envToken = process.env.NOTION_TOKEN;
  • secrets package/dist/connectors/obsidian.js :27 const envKey = process.env.OBSIDIAN_API_KEY;
  • secrets package/dist/connectors/pagerduty.js :317 const envToken = process.env.PAGERDUTY_TOKEN;
  • secrets package/dist/connectors/paystack.js :461 const envKey = process.env.PAYSTACK_SECRET_KEY;
  • secrets package/dist/connectors/pipedrive.js :420 const envToken = process.env.PIPEDRIVE_API_TOKEN;
  • secrets package/dist/connectors/posthog.js :305 const envApiKey = process.env.POSTHOG_API_KEY;
  • secrets package/dist/connectors/resend.js :21 const envKey = process.env.RESEND_API_KEY;
  • secrets package/dist/connectors/salesforce.js :149 return process.env.SALESFORCE_CLIENT_SECRET ?? "";
  • secrets package/dist/connectors/sendgrid.js :259 const envKey = process.env.SENDGRID_API_KEY;
  • secrets package/dist/connectors/shopify.js :318 const envToken = process.env.SHOPIFY_ACCESS_TOKEN;
  • secrets package/dist/connectors/stripe.js :236 const envKey = process.env.STRIPE_SECRET_KEY;
  • secrets package/dist/connectors/supabase.js :20 const envKey = process.env.SUPABASE_SERVICE_ROLE_KEY;
  • secrets package/dist/connectors/telegram.js :181 const envToken = process.env.TELEGRAM_BOT_TOKEN;
  • secrets package/dist/connectors/todoist.js :33 const envToken = process.env.TODOIST_API_KEY;
  • secrets package/dist/connectors/twilio.js :288 const envTok = process.env.TWILIO_AUTH_TOKEN;
  • secrets package/dist/connectors/vercel.js :342 const envToken = process.env.VERCEL_ACCESS_TOKEN;
  • secrets package/dist/connectors/webflow.js :240 const envToken = process.env.WEBFLOW_API_TOKEN;
  • secrets package/dist/connectors/woocommerce.js :20 const key = process.env.WOOCOMMERCE_CONSUMER_KEY;
  • secrets package/dist/connectors/zendesk.js :257 const envToken = process.env.ZENDESK_API_TOKEN;
  • secrets package/dist/drivers/claude/api.js :12 if (!process.env.ANTHROPIC_API_KEY) {
  • secrets package/dist/drivers/gemini/api.js :17 if (!process.env.GEMINI_API_KEY) {
  • secrets package/dist/drivers/grok/index.js :10 if (!process.env.XAI_API_KEY) {
  • secrets package/dist/drivers/local/index.js :50 return process.env.LOCAL_API_KEY ?? "ollama";
  • secrets package/dist/drivers/openai/index.js :18 if (!process.env.OPENAI_API_KEY && !opts.baseURL) {
  • secrets package/dist/embeddings/localEmbeddings.js :31 this.apiKey = opts.apiKey ?? process.env.LOCAL_API_KEY ?? "ollama";
  • secrets package/dist/recipes/agentExecutor.js :29 if (process.env.ANTHROPIC_API_KEY)
  • secrets package/dist/recipes/validation.js :305 !process.env.ANTHROPIC_API_KEY) {
  • secrets package/dist/recipes/yamlRunner.js :2385 (liveModelGuardActive() && process.env.ANTHROPIC_API_KEY
  • secrets (weak) package/scripts/start-all.mjs :482 ...(process.env.DASHBOARD_PASSWORD

install hooks 3

  • postinstall package/package.json :116 node scripts/postinstall.mjs || true
  • prepublishOnly (suspicious) package/package.json :117 npm run build && node -e "const h=require('child_process').execFileSync('node',['dist/index.js','--workspace','.','--help'],{encoding:'utf8'});if(!h.includes('issuer-url'))process.exit(1)" && node scr
  • prepare package/package.json :130 husky

declared dependencies 24

  • @opentelemetry/api@^1.9.0
  • @opentelemetry/exporter-trace-otlp-http@^0.219.0
  • @opentelemetry/resources@^2.6.0
  • @opentelemetry/sdk-trace-node@^2.7.1
  • @opentelemetry/semantic-conventions@^1.40.0
  • ajv@^8.18.0
  • ipaddr.js@^2.3.0
  • minimatch@^10.0.0
  • node-cron@^4.2.1
  • undici@^6.27.0
  • ws@^8.18.0
  • yaml@^2.8.3
  • @biomejs/biome@^2.4.10
  • @types/node@^22.0.0
  • @types/node-cron@^3.0.11
  • @types/ws@^8.5.0
  • @vitest/coverage-v8@^4.1.8
  • @vscode/ripgrep@^1.17.1
  • fast-check@^4.6.0
  • husky@^9.1.7
  • lint-staged@^16.4.0
  • tsx@^4.0.0
  • typescript@^5.7.0
  • vitest@^4.1.8

clipboard 1

  • clipboard shell call package/dist/tools/clipboard.js :30 const { stdout } = await execFileAsync("pbpaste");