smartago/tvboxtools

Review signals: 46 known vulnerability.

OSV reports a known vulnerability in this dependency version. 15 distinct locations. 46 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The read-only Device job reports the box model (mock box returns MIBOX4): Real input produced the expected result: MIBOX4

  Source: | **Device** | Model, Android version, storage, clock — with a clock fix when TLS downloads fail | read-only |

  Input: tvlm check --json --mock happy

  Expected: JSON facts including model MIBOX4

  Command: node apps/cli/bin/tvlm.mjs check --json --mock happy

  Observed: MIBOX4","manufacturer":"Xiaomi","brand":"launcher","device":"once","serial":"7F3A9C12B04E","androidVersion":"9","sdk":28,"platform":"androidtv","isTv":true,"accounts":[],"freeBytes":3661856768,"totalBytes":5946216448,"hasPlay":false,"launcherInstalled":false,"launcherVersionCode":null,"installedPackages":["com.google.android.tvlauncher","com.android.settings","com.google.android.youtube.tv","com.google.android.katniss","com.google.android.apps.mediashell","com.google.android.tvrecommendations","com.google.android.backdrop","com.google.android.tts","com.google.android.videos","com.google.androi

• The MCP server exposes a discover tool for finding boxes: Real input produced the expected result: Chromecast with Google TV

  Source: | **AI agent** | The same engine as a CLI and an MCP server: discover, pair, connect, check, install, provision, link, test, screenshot, report, shell | gated |

  Input: {"tool": "discover", "arguments": {}}

  Expected: device list including Chromecast with Google TV

  Command: node apps/cli/bin/tvlm.mjs --mcp --mock happy --no-shell tools/call {"tool": "discover", "arguments": {}}

  Observed: Chromecast with Google TV\",\n \"addr\": \"<internal-ip>:5555\",\n \"method\": \"wireless\",\n \"tls\": true\n }\n ],\n \"next\": \"call connect with a device id\"\n}"}]}

Examples

• Find boxes from the terminal (documented CLI discover, run against the simulated box): command completed successfully

  Source: README.md / docs/ai-agents.md CLI section

  Input: tvlm discover --json --mock happy

  Expected: JSON list of boxes including the Chromecast with Google TV

  Command: node apps/cli/bin/tvlm.mjs discover --json --mock happy

  Observed: [{"id":"7F3A9C12B04E","name":"Xiaomi Mi Box S","addr":"USB · 7F3A9C12B04E","method":"usb"},{"id":"<internal-ip>:5555","name":"Xiaomi Mi Box S · MIBOX4","addr":"<internal-ip>:5555","method":"tcp"},{"id":"<internal-ip>:5555","name":"Chromecast with Google TV","addr":"<internal-ip>:5555","method":"wireless","tls":true}]

• Repository unit tests for the CLI and MCP server (documented pnpm test): command completed successfully

  Source: README.md Build from source

  Input: pnpm --filter @tvlm/cli test

  Expected: vitest run passes

  Command: pnpm --filter @tvlm/cli test

  Observed: m src/cli.test.ts (9 tests) 7ms  Test Files  3 passed (3)  Tests  26 passed (26)  Start at  23:55:32  Duration  3.17s (import 68%, transform 29%, tests 3%, worker 1%)  Isolate  3 workers spawned · ~204ms startup each (spawn + environment, per file)   at least ~408ms faster with isolate: false — reuses workers across files instead of one per file $ vitest run

Local or hosted: local

Install TV Box Tools from source and run the tvlm CLI and MCP server against the simulated (--mock) Android TV box: read box facts with check, and list boxes with the MCP discover tool.

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat README.md 2>/dev/null | head -c 6000
ls <guest-path> ; ls /inputs 2>/dev/null; echo "CDP=$CDP_URL"; curl -s -m 10 -i $CDP_URL/json/version; echo "rc=$?"
cd <guest-path> && tail -c 4200 README.md; echo ----; ls docs; sed -n 1,80p docs/ai-agents.md | head -c 5000
cd <guest-path> && cat package.json; echo ----; cat apps/cli/package.json | head -60; echo ----; grep -n '"engines"' -A3 packages/*/package.json apps/*/package.json; echo ----; which node npm pnpm corepack; node -v 2>&1; npm -v 2>&1; cat .npmrc; cat pnpm-workspace.yaml | head -30
cd <guest-path> && pnpm -v; echo "NODE_USE_ENV_PROXY=$NODE_USE_ENV_PROXY"; (timeout 900 pnpm install 2>&1 | tail -40); echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && ls; cat bin/tvlm.mjs | head -40; echo ----; ls src | head -50; echo; grep -rn "mock" src/main.ts | head -20
cd <guest-path> && node apps/cli/bin/tvlm.mjs --help 2>&1 | head -60; echo "rc=$?"
cd <guest-path> && timeout 120 node apps/cli/bin/tvlm.mjs check --json --mock happy 2><guest-path>; echo "rc=$?"; head -c 300 <guest-path>
cd <guest-path> && grep -n "registerTool\|name: '" src/mcp.ts | head -40; echo ----; sed -n 200,215p src/main.ts
cd <guest-path> && grep -rn "name: '\(discover\|check\|screenshot\|report\|test\)'" src/*.ts | head; grep -rln "inputSchema" src ../../packages/core/src | head; grep -n "tools\b" src/mcp.ts | head -20
cd <guest-path> && sed -n 93,112p src/mcp.ts | cut -c1-260; grep -n "^  [a-z]*: {" src/mcp.ts | head -30
cd <guest-path> && grep -n "    check: tool" -A12 src/mcp.ts | cut -c1-300; grep -n "function ok\|const ok" -A4 src/mcp.ts | head -12
cd <guest-path> && grep -n "mock\|MCP server exposes\|discover\|tvlm --mcp\|read-only box\|command gate\|No root" README.md | cut -c1-220; echo ----; ls <guest-path>; sed -n 1,60p <guest-path> | head -c 3000
cd <guest-path> && timeout 120 node apps/cli/bin/tvlm.mjs discover --json --mock happy 2><guest-path>; echo "rc=$?"; head -c 400 <guest-path>
cd <guest-path> && grep -rn "setInterval\|cron\|schedule\|--once\|--now" apps/cli/src packages/core/src 2>/dev/null | grep -v test | cut -c1-200 | head -20; echo ----; grep -n "| \*\*Device\*\*" README.md | cat -A | cut -c1-200
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
[
  {
    "kind": "claim",
    "claim": "The read-only Device job reports the box model (mock box returns MIBOX4)",
    "source": "| **Device** | Model, Android version, storage, clock — with a clock fix when TLS downloads fail | read-only |",
    "input": "tvlm check --json --mock happy",
    "expected": "JSON facts including model MIBOX4",
    "probe_kind": "cli",
    "argv": ["node", "apps/cli/bin/tvlm.mjs", "check", "--json", "--mock", "happy"],
    "cwd": "<guest-path>",
    "expected_text": "MIBOX4"
  },
  {
    "kind": "claim",
    "claim": "The MCP server exposes a discover tool for finding boxes",
    "source": "| **AI agent** | The same engine as a CLI and an MCP server: discover, pair, connect, check, install, provision, link, test, screenshot, report, shell | gated |",
    "input": "discover with no arguments, mock happy box set",
    "expected": "device list including Chromecast with Google TV",
    "probe_kind": "mcp",
    "argv": ["node", "apps/cli/bin/tvlm.mjs", "--mcp", "--mock", "happy", "--no-shell"],
    "tool": "discover",
    "arguments": {},
    "cwd": "<guest-path>",
    "expected_text": "Chromecast with Google TV"
  }
]
EOF
python3 -I -c "import json;d=json.load(open('<guest-path>'));print(len(d),'claims ok')"
cd <guest-path> && cat > probe.json <<'EOF'
{
  "kind": "mcp",
  "argv": ["node", "apps/cli/bin/tvlm.mjs", "--mcp", "--mock", "happy", "--no-shell"],
  "cwd": "<guest-path>",
  "tool": "discover",
  "arguments": {},
  "expected_text": "Chromecast with Google TV"
}
EOF
cat > examples.json <<'EOF'
[
  {
    "kind": "example",
    "claim": "Find boxes from the terminal (documented CLI discover, run against the simulated box)",
    "source": "README.md / docs/ai-agents.md CLI section",
    "input": "tvlm discover --json --mock happy",
    "expected": "JSON list of boxes including the Chromecast with Google TV",
    "argv": ["node", "apps/cli/bin/tvlm.mjs", "discover", "--json", "--mock", "happy"],
    "cwd": "<guest-path>",
    "expected_text": "Chromecast with Google TV"
  },
  {
    "kind": "example",
    "claim": "Repository unit tests for the CLI and MCP server (documented pnpm test)",
    "source": "README.md Build from source",
    "input": "pnpm --filter @tvlm/cli test",
    "expected": "vitest run passes",
    "argv": ["pnpm", "--filter", "@tvlm/cli", "test"],
    "cwd": "<guest-path>"
  }
]
EOF
cat > cycles.json <<'EOF'
{"detected": false, "reason": "Inspected apps/cli/src and packages/core/src (grep for setInterval, cron, schedule, --once, --now): none found. The CLI runs one command per invocation, and the MCP server and bridge run only while a client is attached; there is no product scheduler or loop.", "checks": []}
EOF
for f in probe.json examples.json cycles.json claims.json; do python3 -I -m json.tool $f >/dev/null && echo "$f ok"; done
ls -la /inputs/coldpass-preflight.py 2>&1; cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -c 5000; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "rc=$?"; wc -c <guest-path>; python3 -I -c "
import json,sys
t=open('<guest-path>').read()
i=t.find('{')
try:
  d=json.loads(t[i:])
  print({k:(v if not isinstance(v,(list,dict)) else type(v).__name__) for k,v in d.items()})
  print('problems:', d.get('problems') or d.get('errors'))
except Exception as e:
  print('parse fail',e); print(t[:1500])
"
cd <guest-path> && python3 -I -c "
import json
t=open('<guest-path>').read()
d=json.loads(t[t.find('{'):])
print('problems=',d['problems'])
r=d['replay']
print({k:(type(v).__name__) for k,v in r.items()})
for k in r:
  if isinstance(r[k],dict) and 'probe' in str(k).lower(): print(k, str(r[k])[:600])
print('probe_checks:', str(r.get('probe', r.get('product')))[:500])
"; pgrep -fa "tvlm.mjs" || echo "no leftover tvlm processes"
cd <guest-path> && python3 -I -c "
import json
d=json.loads(open('<guest-path>').read()[open('<guest-path>').read().find('{'):])
r=d['replay']; print('status=',r['status']); print('claims=',[c.get('verdict') for c in r['claims']]); print('examples=',[e.get('verdict') for e in r['example_checks']]); print('cycles=',[c.get('verdict') for c in r['cycle_checks']])
"
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": null,
  "operation": "Install TV Box Tools from source and run the tvlm CLI and MCP server against the simulated (--mock) Android TV box: read box facts with check, and list boxes with the MCP discover tool.",
  "operation_scope": "Linux guest, Node v22.23.4 (engines >=22), pnpm 12.4.2 (from packageManager field). No real TV box was connected; all device operations ran against the built-in --mock happy simulator. No browser was needed; CDP_URL returned HTTP 200 but was not used. Pinned commit dbcc3e7 was not separately fetched: the source snapshot in the workspace was used as provided.",
  "steps": [
    "pnpm install (README Build from source)",
    "node apps/cli/bin/tvlm.mjs check --json --mock happy  (repo CLI entry for tvlm; README/docs CLI section)",
    "node apps/cli/bin/tvlm.mjs discover --json --mock happy",
    "node apps/cli/bin/tvlm.mjs --mcp --mock happy --no-shell, then tools/call discover (README AI agent section)",
    "pnpm --filter @tvlm/cli test (repo unit tests, 26 passed)",
    "<env-var>=<guest-path> python3 -I <guest-path> --validate --replay (status PASS, problems [])"
  ],
  "deviations": [
    "The README's `tvlm` command is not installed on PATH; I ran the repo's own dev entry apps/cli/bin/tvlm.mjs with node instead (it runs the TypeScript sources through tsx, so no build step was needed).",
    "The task named /inputs/coldpass-preflight.py, which does not exist in this guest; I used <guest-path> as the task's checker path.",
    "pnpm install printed a notice that a newer pnpm (12.15.0) exists; I kept the pinned packageManager 12.4.2.",
    "Hardware paths (USB, Wi-Fi, pairing, screenshot of a real TV) were not exercised because no physical box is attached to this VM; only the documented --mock simulator was used."
  ],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": null
}
EOF
python3 -I -m json.tool .coldpass/report.json >/dev/null && echo report ok; ls -la .coldpass