farion1231/cc-switch

Review signals: 1 download and execute, 12 hardcoded secret, 136 known vulnerability. 6 static matches retained as context.

Source contains download and execute; review its purpose. src/utils/deeplinkRisk.ts

Gitleaks found a possible hardcoded secret; value withheld. 4 distinct locations. 12 findings.

OSV reports a known vulnerability in this dependency version. 49 distinct locations. 136 findings.

6 download and execute matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• CC Switch provides a native desktop app for Windows, macOS, and Linux.: Real input produced the expected result: built in

  Source: Native desktop app for Windows, macOS, and Linux, built with Tauri 2

  Input: Linux renderer build

  Expected: dist/index.html

  Command: /opt/node22/bin/pnpm build:renderer

  Observed: built in 33.05s [baseline-browser-mapping] The data in this module is over two months old. To ensure accurate Baseline data, please update: `npm i baseline-browser-mapping@latest -D` Browserslist: browsers data (caniuse-lite) is 11 months old. Please run: npx update-browserslist-db@latest Why you should do it regularly: https://github.com/browserslist/update-db#readme warn - The class `duration-[120ms]` is ambiguous and matches multiple utilities. warn - If this is content and not a class, replace it with `duration-[120ms]` to silence this warning. [plugin vite:reporter] (!) /

Examples

• Build the frontend renderer to dist/: command completed successfully

  Source: CONTRIBUTING.md, Development Setup > Useful Commands

  Input: pnpm build:renderer

  Expected: Vite production renderer output

  Command: /opt/node22/bin/pnpm build:renderer

  Observed: geScriptModal.tsx, <guest-path> but also statically imported by <guest-path>, <guest-path>, dynamic import will not move module into another chunk. (!) Some chunks are larger than 500 kB after minification. Consider: - Using dynamic import() to code-split the application - Use build.rollupOptions.output.manualChunks to improve chunking: https://rollupjs.org/configuration-options/#output-manualchunks - Adjust chunk size limit for this warning via build.chunkSizeWarningLimit.

Local or hosted: local

Build the CC Switch frontend renderer with the documented pnpm build:renderer command

pwd; rg --files -g 'README*' -g 'AGENTS.md' -g 'pyproject.toml' -g 'package.json' -g 'Cargo.toml' -g 'go.mod' -g 'requirements*.txt' -g 'Makefile' -g '.github/workflows/**'; python3 --version; id -u; git status --short --branch
ls -la; find .. -name AGENTS.md -o -iname 'README*'; python3 --version; sudo -n true; echo sudo_status:$?
sed -n '1,220p' README.md; cat package.json; cat .node-version; cat rust-toolchain.toml
grep -nE '^## |^### |pnpm|Linux|Ubuntu|Quick Start|quick start|tauri dev|build:renderer' README.md | tail -100; find .coldpass -maxdepth 2 -type f -print; find src-tauri -maxdepth 2 -type f | head
sed -n '268,344p' README.md; sed -n '581,593p' README.md; find .github/workflows -type f -maxdepth 2 -print
sed -n '1,220p' CONTRIBUTING.md; sed -n '1,180p' .github/workflows/ci.yml; node --version; pnpm --version; cargo --version; rustc --version; cat /etc/os-release; ls -la <guest-path>
sudo -n apt-get update && sudo -n apt-get install -y nodejs npm && sudo -n npm install -g corepack && sudo -n corepack enable && corepack prepare [email protected] --activate && node --version && pnpm --version
curl -fsSL https://nodejs.org/dist/v22.12.0/node-v22.12.0-linux-x64.tar.xz -o /tmp/node22.tar.xz && sudo -n mkdir -p /opt/node22 && sudo -n tar -xJf /tmp/node22.tar.xz -C /opt/node22 --strip-components=1 && /opt/node22/bin/node --version && sudo -n /opt/node22/bin/npm install -g [email protected] && sudo -n /opt/node22/bin/corepack enable && COREPACK_HOME=/tmp/corepack /opt/node22/bin/corepack prepare [email protected] --activate && /opt/node22/bin/pnpm --version
sudo -n /opt/node22/bin/npm install -g [email protected] && /opt/node22/bin/pnpm --version && /opt/node22/bin/pnpm install --frozen-lockfile
sudo -n /opt/node22/bin/npm install --global --force --prefix /opt/node22 [email protected] && /opt/node22/bin/pnpm --version && /opt/node22/bin/pnpm install --frozen-lockfile
PATH=/opt/node22/bin:$PATH pnpm build:renderer
env | sort | grep -Ei 'cdp|browser|playwright|chrome|display|coldpass'; ls -la <guest-path>; find <guest-path> -maxdepth 2 -type f | head -50; find src-tauri -maxdepth 2 -type f \( -name '*.rs' -o -name 'tauri.conf.json' \)
<env-var>=<guest-path> python3 -I <guest-path> --help; sed -n '1,120p' vite.config.ts; sed -n '1,100p' src-tauri/tauri.conf.json
ls -la .coldpass;
mkdir -p .coldpass; cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"CC Switch provides a native desktop app for Windows, macOS, and Linux.","source":"Native desktop app for Windows, macOS, and Linux, built with Tauri 2","input":"Linux renderer build","expected":"dist/index.html","probe_kind":"cli","argv":["/opt/node22/bin/pnpm","build:renderer"],"cwd":"<guest-path>","expected_text":"built in"}]
EOF
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/opt/node22/bin/pnpm","build:renderer"],"cwd":"<guest-path>","expected_text":"built in"}
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Build the frontend renderer to dist/","source":"CONTRIBUTING.md, Development Setup > Useful Commands","input":"pnpm build:renderer","expected":"Vite production renderer output","argv":["/opt/node22/bin/pnpm","build:renderer"],"cwd":"<guest-path>","expected_text":"built in"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README Quick Start and entry points. The documented product workflows are interactive desktop UI actions; there is no product scheduler or cycle trigger to invoke headlessly." ,"checks":[]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
python3 - <<'PY'
import json
from pathlib import Path
for fname in ['probe.json','claims.json','examples.json']:
 p=Path('.coldpass')/fname
 data=json.loads(p.read_text())
 records=data if isinstance(data,list) else [data]
 for rec in records:
  rec['env']={'PATH':'/opt/node22/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin'}
 p.write_text(json.dumps(data,indent=2)+'\n')
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'EOF'
{
  "outcome": "needs_browser",
  "fault_owner": "prerequisite",
  "operation": "Build the CC Switch frontend renderer with the documented pnpm build:renderer command",
  "operation_scope": "Frontend production assets built successfully under Node.js 22.12.0 and pnpm 10.12.3. The README describes app workflows through an interactive Tauri desktop window; this headless guest provides no browser/CDP endpoint or display for a live UI operation.",
  "steps": [
    "Read README.md, CONTRIBUTING.md, package.json, and .node-version.",
    "Installed Node.js 22.12.0 in /opt/node22 and pnpm 10.12.3; pnpm install --frozen-lockfile completed.",
    "Ran pnpm build:renderer; Vite produced dist/index.html and dist/tray-panel.html.",
    "Saved and replayed probe, README claim, example, and cycle evidence; checker validation and replay passed."
  ],
  "deviations": [
    "Initial system Node.js was 18.19.1 and did not meet CONTRIBUTING.md's Node.js 20.19+ or 22.12+ requirement.",
    "Corepack could not verify pnpm metadata (Cannot find matching keyid), so installed the package.json-pinned pnpm 10.12.3 directly with npm.",
    "Tauri desktop launch and Quick Start UI interactions could not be exercised without a browser/display runtime."
  ],
  "stuck_step": "Open the desktop app and verify an interactive Quick Start action",
  "main_blocker": "No graphical display or supplied shared CDP endpoint is available in this VM, so the desktop UI cannot be launched and inspected.",
  "plain_failure": "The documented frontend build works, but this headless environment cannot open the desktop window needed to try the app's UI features.",
  "suggested_fix": "Run the Tauri desktop app in a Linux environment with WebKitGTK 4.1 and a graphical display, or provide the shared CDP endpoint for browser-based verification."
}
EOF
cat .coldpass/report.json; cat .coldpass/probe.json