@anthropic-ai/claude-agent-sdk

Spreading entire process.env into an object — may capture all secrets 53 | ]))`;continue}}if($.s&&Y[B]==="."){W+=G?`${Y[B]}\r 54 | `:`[${Y[B]}\r > 55 | ]`;continue}if(W+=Y[B],Y[B]==="\\")J=!0;else if(G&&Y[B]==="]")G=!1;else if(!G&&Y[B]==="[")G=!0}try{new RegExp(W)}catch{r 56 | `);else z7.streamInput(X);return z7}function l_(X){return V8(X)}function m_(X,Q){return zW(X,Q)}async function c_(X,Q){l

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 53 | ]))`;continue}}if($.s&&Y[B]==="."){W+=G?`${Y[B]}\r 54 | `:`[${Y[B]}\r > 55 | ]`;continue}if(W+=Y[B],Y[B]==="\\")J=!0;else if(G&&Y[B]==="]")G=!1;else if(!G&&Y[B]==="[")G=!0}try{new RegExp(W)}catch{r 56 | `);else z7.streamInput(X);return z7}function l_(X){return V8(X)}function m_(X,Q){return zW(X,Q)}async function c_(X,Q){l

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 53 | ]))`;continue}}if($.s&&Y[B]==="."){W+=G?`${Y[B]}\r 54 | `:`[${Y[B]}\r > 55 | ]`;continue}if(W+=Y[B],Y[B]==="\\")J=!0;else if(G&&Y[B]==="]")G=!1;else if(!G&&Y[B]==="[")G=!0}try{new RegExp(W)}catch{r 56 | `);else z7.streamInput(X);return z7}function l_(X){return V8(X)}function m_(X,Q){return zW(X,Q)}async function c_(X,Q){l

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 53 | ]))`;continue}}if($.s&&Y[B]==="."){W+=G?`${Y[B]}\r 54 | `:`[${Y[B]}\r > 55 | ]`;continue}if(W+=Y[B],Y[B]==="\\")J=!0;else if(G&&Y[B]==="]")G=!1;else if(!G&&Y[B]==="[")G=!0}try{new RegExp(W)}catch{r 56 | `);else z7.streamInput(X);return z7}function f_(X){return V8(X)}function u_(X,Q){return zW(X,Q)}async function l_(X,Q){l

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7635 | extraArgs = {}, 7636 | pathToClaudeCodeExecutable, > 7637 | env = { ...process.env }, 7638 | maxThinkingTokens, 7639 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21367 | let processEnv = env; 21368 | if (!processEnv) { > 21369 | processEnv = { ...process.env }; 21370 | } 21371 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7635 | extraArgs = {}, 7636 | pathToClaudeCodeExecutable, > 7637 | env = { ...process.env }, 7638 | maxThinkingTokens, 7639 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21367 | let processEnv = env; 21368 | if (!processEnv) { > 21369 | processEnv = { ...process.env }; 21370 | } 21371 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7635 | extraArgs = {}, 7636 | pathToClaudeCodeExecutable, > 7637 | env = { ...process.env }, 7638 | maxThinkingTokens, 7639 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21367 | let processEnv = env; 21368 | if (!processEnv) { > 21369 | processEnv = { ...process.env }; 21370 | } 21371 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7635 | extraArgs = {}, 7636 | pathToClaudeCodeExecutable, > 7637 | env = { ...process.env }, 7638 | maxThinkingTokens, 7639 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21367 | let processEnv = env; 21368 | if (!processEnv) { > 21369 | processEnv = { ...process.env }; 21370 | } 21371 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7634 | extraArgs = {}, 7635 | pathToClaudeCodeExecutable, > 7636 | env = { ...process.env }, 7637 | maxThinkingTokens, 7638 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21366 | let processEnv = env; 21367 | if (!processEnv) { > 21368 | processEnv = { ...process.env }; 21369 | } 21370 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7633 | extraArgs = {}, 7634 | pathToClaudeCodeExecutable, > 7635 | env = { ...process.env }, 7636 | maxThinkingTokens, 7637 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21362 | let processEnv = env; 21363 | if (!processEnv) { > 21364 | processEnv = { ...process.env }; 21365 | } 21366 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7632 | extraArgs = {}, 7633 | pathToClaudeCodeExecutable, > 7634 | env = { ...process.env }, 7635 | maxThinkingTokens, 7636 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21356 | let processEnv = env; 21357 | if (!processEnv) { > 21358 | processEnv = { ...process.env }; 21359 | } 21360 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7632 | extraArgs = {}, 7633 | pathToClaudeCodeExecutable, > 7634 | env = { ...process.env }, 7635 | maxThinkingTokens, 7636 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21356 | let processEnv = env; 21357 | if (!processEnv) { > 21358 | processEnv = { ...process.env }; 21359 | } 21360 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7631 | extraArgs = {}, 7632 | pathToClaudeCodeExecutable, > 7633 | env = { ...process.env }, 7634 | maxThinkingTokens, 7635 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21355 | let processEnv = env; 21356 | if (!processEnv) { > 21357 | processEnv = { ...process.env }; 21358 | } 21359 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7631 | extraArgs = {}, 7632 | pathToClaudeCodeExecutable, > 7633 | env = { ...process.env }, 7634 | maxThinkingTokens, 7635 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21355 | let processEnv = env; 21356 | if (!processEnv) { > 21357 | processEnv = { ...process.env }; 21358 | } 21359 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7631 | extraArgs = {}, 7632 | pathToClaudeCodeExecutable, > 7633 | env = { ...process.env }, 7634 | maxThinkingTokens, 7635 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21355 | let processEnv = env; 21356 | if (!processEnv) { > 21357 | processEnv = { ...process.env }; 21358 | } 21359 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7647 | extraArgs = {}, 7648 | pathToClaudeCodeExecutable, > 7649 | env = { ...process.env }, 7650 | maxThinkingTokens, 7651 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21371 | let processEnv = env; 21372 | if (!processEnv) { > 21373 | processEnv = { ...process.env }; 21374 | } 21375 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7646 | extraArgs = {}, 7647 | pathToClaudeCodeExecutable, > 7648 | env = { ...process.env }, 7649 | maxThinkingTokens, 7650 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21370 | let processEnv = env; 21371 | if (!processEnv) { > 21372 | processEnv = { ...process.env }; 21373 | } 21374 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7646 | extraArgs = {}, 7647 | pathToClaudeCodeExecutable, > 7648 | env = { ...process.env }, 7649 | maxThinkingTokens, 7650 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21370 | let processEnv = env; 21371 | if (!processEnv) { > 21372 | processEnv = { ...process.env }; 21373 | } 21374 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7646 | extraArgs = {}, 7647 | pathToClaudeCodeExecutable, > 7648 | env = { ...process.env }, 7649 | maxThinkingTokens, 7650 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 21370 | let processEnv = env; 21371 | if (!processEnv) { > 21372 | processEnv = { ...process.env }; 21373 | } 21374 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 13044 | extraArgs = {}, 13045 | pathToClaudeCodeExecutable, > 13046 | env = { ...process.env }, 13047 | maxThinkingTokens, 13048 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 26766 | let processEnv = env; 26767 | if (!processEnv) { > 26768 | processEnv = { ...process.env }; 26769 | } 26770 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 13044 | extraArgs = {}, 13045 | pathToClaudeCodeExecutable, > 13046 | env = { ...process.env }, 13047 | maxThinkingTokens, 13048 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 26766 | let processEnv = env; 26767 | if (!processEnv) { > 26768 | processEnv = { ...process.env }; 26769 | } 26770 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 13044 | extraArgs = {}, 13045 | pathToClaudeCodeExecutable, > 13046 | env = { ...process.env }, 13047 | maxThinkingTokens, 13048 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 26766 | let processEnv = env; 26767 | if (!processEnv) { > 26768 | processEnv = { ...process.env }; 26769 | } 26770 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 13043 | extraArgs = {}, 13044 | pathToClaudeCodeExecutable, > 13045 | env = { ...process.env }, 13046 | maxThinkingTokens, 13047 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 26727 | let processEnv = env; 26728 | if (!processEnv) { > 26729 | processEnv = { ...process.env }; 26730 | } 26731 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 13043 | extraArgs = {}, 13044 | pathToClaudeCodeExecutable, > 13045 | env = { ...process.env }, 13046 | maxThinkingTokens, 13047 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 26749 | let processEnv = env; 26750 | if (!processEnv) { > 26751 | processEnv = { ...process.env }; 26752 | } 26753 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 13042 | extraArgs = {}, 13043 | pathToClaudeCodeExecutable, > 13044 | env = { ...process.env }, 13045 | maxThinkingTokens, 13046 | maxTurns,

Spreading entire process.env into an object — may capture all secrets 26744 | let processEnv = env; 26745 | if (!processEnv) { > 26746 | processEnv = { ...process.env }; 26747 | } 26748 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7305 | extraArgs = {}, 7306 | pathToClaudeCodeExecutable, > 7307 | env = { ...process.env }, 7308 | stderr, 7309 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 15259 | let processEnv = env; 15260 | if (!processEnv) { > 15261 | processEnv = { ...process.env }; 15262 | } 15263 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7303 | extraArgs = {}, 7304 | pathToClaudeCodeExecutable, > 7305 | env = { ...process.env }, 7306 | stderr, 7307 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 15250 | let processEnv = env; 15251 | if (!processEnv) { > 15252 | processEnv = { ...process.env }; 15253 | } 15254 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7303 | extraArgs = {}, 7304 | pathToClaudeCodeExecutable, > 7305 | env = { ...process.env }, 7306 | stderr, 7307 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 15250 | let processEnv = env; 15251 | if (!processEnv) { > 15252 | processEnv = { ...process.env }; 15253 | } 15254 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7303 | extraArgs = {}, 7304 | pathToClaudeCodeExecutable, > 7305 | env = { ...process.env }, 7306 | stderr, 7307 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 15250 | let processEnv = env; 15251 | if (!processEnv) { > 15252 | processEnv = { ...process.env }; 15253 | } 15254 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7303 | extraArgs = {}, 7304 | pathToClaudeCodeExecutable, > 7305 | env = { ...process.env }, 7306 | stderr, 7307 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 15250 | let processEnv = env; 15251 | if (!processEnv) { > 15252 | processEnv = { ...process.env }; 15253 | } 15254 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7303 | extraArgs = {}, 7304 | pathToClaudeCodeExecutable, > 7305 | env = { ...process.env }, 7306 | stderr, 7307 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 15250 | let processEnv = env; 15251 | if (!processEnv) { > 15252 | processEnv = { ...process.env }; 15253 | } 15254 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 7263 | extraArgs = {}, 7264 | pathToClaudeCodeExecutable, > 7265 | env = { ...process.env }, 7266 | stderr, 7267 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 8176 | pathToClaudeCodeExecutable = join4(dirname2, "cli.js"); 8177 | } > 8178 | const processEnv = { ...process.env }; 8179 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) { 8180 | processEnv.CLAUDE_CODE_ENTRYPOINT = "sdk-ts";

Spreading entire process.env into an object — may capture all secrets 15200 | let processEnv = env; 15201 | if (!processEnv) { > 15202 | processEnv = { ...process.env }; 15203 | } 15204 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6502 | extraArgs = {}, 6503 | pathToClaudeCodeExecutable, > 6504 | env = { ...process.env }, 6505 | stderr, 6506 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 8130 | pathToClaudeCodeExecutable = join4(dirname2, "cli.js"); 8131 | } > 8132 | const processEnv = { ...process.env }; 8133 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) { 8134 | processEnv.CLAUDE_CODE_ENTRYPOINT = "sdk-ts";

Spreading entire process.env into an object — may capture all secrets 15152 | let processEnv = env; 15153 | if (!processEnv) { > 15154 | processEnv = { ...process.env }; 15155 | } 15156 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6502 | extraArgs = {}, 6503 | pathToClaudeCodeExecutable, > 6504 | env = { ...process.env }, 6505 | stderr, 6506 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 8121 | pathToClaudeCodeExecutable = join4(dirname2, "cli.js"); 8122 | } > 8123 | const processEnv = { ...process.env }; 8124 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) { 8125 | processEnv.CLAUDE_CODE_ENTRYPOINT = "sdk-ts";

Spreading entire process.env into an object — may capture all secrets 15143 | let processEnv = env; 15144 | if (!processEnv) { > 15145 | processEnv = { ...process.env }; 15146 | } 15147 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6502 | extraArgs = {}, 6503 | pathToClaudeCodeExecutable, > 6504 | env = { ...process.env }, 6505 | stderr, 6506 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 8121 | pathToClaudeCodeExecutable = join4(dirname2, "cli.js"); 8122 | } > 8123 | const processEnv = { ...process.env }; 8124 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) { 8125 | processEnv.CLAUDE_CODE_ENTRYPOINT = "sdk-ts";

Spreading entire process.env into an object — may capture all secrets 15143 | let processEnv = env; 15144 | if (!processEnv) { > 15145 | processEnv = { ...process.env }; 15146 | } 15147 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6502 | extraArgs = {}, 6503 | pathToClaudeCodeExecutable, > 6504 | env = { ...process.env }, 6505 | stderr, 6506 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 8121 | pathToClaudeCodeExecutable = join4(dirname2, "cli.js"); 8122 | } > 8123 | const processEnv = { ...process.env }; 8124 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) { 8125 | processEnv.CLAUDE_CODE_ENTRYPOINT = "sdk-ts";

Spreading entire process.env into an object — may capture all secrets 15143 | let processEnv = env; 15144 | if (!processEnv) { > 15145 | processEnv = { ...process.env }; 15146 | } 15147 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6502 | extraArgs = {}, 6503 | pathToClaudeCodeExecutable, > 6504 | env = { ...process.env }, 6505 | stderr, 6506 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 8121 | pathToClaudeCodeExecutable = join4(dirname2, "cli.js"); 8122 | } > 8123 | const processEnv = { ...process.env }; 8124 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) { 8125 | processEnv.CLAUDE_CODE_ENTRYPOINT = "sdk-ts";

Spreading entire process.env into an object — may capture all secrets 15143 | let processEnv = env; 15144 | if (!processEnv) { > 15145 | processEnv = { ...process.env }; 15146 | } 15147 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6501 | extraArgs = {}, 6502 | pathToClaudeCodeExecutable, > 6503 | env = { ...process.env }, 6504 | stderr, 6505 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 8117 | pathToClaudeCodeExecutable = join4(dirname2, "cli.js"); 8118 | } > 8119 | const processEnv = { ...process.env }; 8120 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) { 8121 | processEnv.CLAUDE_CODE_ENTRYPOINT = "sdk-ts";

Spreading entire process.env into an object — may capture all secrets 15138 | let processEnv = env; 15139 | if (!processEnv) { > 15140 | processEnv = { ...process.env }; 15141 | } 15142 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6485 | extraArgs = {}, 6486 | pathToClaudeCodeExecutable, > 6487 | env = { ...process.env }, 6488 | stderr, 6489 | maxThinkingTokens,

Spreading entire process.env into an object — may capture all secrets 8087 | pathToClaudeCodeExecutable = join4(dirname2, "cli.js"); 8088 | } > 8089 | const processEnv = { ...process.env }; 8090 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) { 8091 | processEnv.CLAUDE_CODE_ENTRYPOINT = "sdk-ts";

Spreading entire process.env into an object — may capture all secrets 15107 | let processEnv = env; 15108 | if (!processEnv) { > 15109 | processEnv = { ...process.env }; 15110 | } 15111 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6485 | extraArgs = {}, 6486 | pathToClaudeCodeExecutable, > 6487 | env = { ...process.env }, 6488 | stderr, 6489 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 8091 | pathToClaudeCodeExecutable = join4(dirname2, "cli.js"); 8092 | } > 8093 | const processEnv = { ...process.env }; 8094 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) { 8095 | processEnv.CLAUDE_CODE_ENTRYPOINT = "sdk-ts";

Spreading entire process.env into an object — may capture all secrets 15112 | let processEnv = env; 15113 | if (!processEnv) { > 15114 | processEnv = { ...process.env }; 15115 | } 15116 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6485 | extraArgs = {}, 6486 | pathToClaudeCodeExecutable, > 6487 | env = { ...process.env }, 6488 | stderr, 6489 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 8091 | pathToClaudeCodeExecutable = join4(dirname2, "cli.js"); 8092 | } > 8093 | const processEnv = { ...process.env }; 8094 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) { 8095 | processEnv.CLAUDE_CODE_ENTRYPOINT = "sdk-ts";

Spreading entire process.env into an object — may capture all secrets 15112 | let processEnv = env; 15113 | if (!processEnv) { > 15114 | processEnv = { ...process.env }; 15115 | } 15116 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6485 | extraArgs = {}, 6486 | pathToClaudeCodeExecutable, > 6487 | env = { ...process.env }, 6488 | stderr, 6489 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 8091 | pathToClaudeCodeExecutable = join4(dirname2, "cli.js"); 8092 | } > 8093 | const processEnv = { ...process.env }; 8094 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) { 8095 | processEnv.CLAUDE_CODE_ENTRYPOINT = "sdk-ts";

Spreading entire process.env into an object — may capture all secrets 15112 | let processEnv = env; 15113 | if (!processEnv) { > 15114 | processEnv = { ...process.env }; 15115 | } 15116 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6485 | extraArgs = {}, 6486 | pathToClaudeCodeExecutable, > 6487 | env = { ...process.env }, 6488 | stderr, 6489 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 8091 | pathToClaudeCodeExecutable = join4(dirname2, "cli.js"); 8092 | } > 8093 | const processEnv = { ...process.env }; 8094 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) { 8095 | processEnv.CLAUDE_CODE_ENTRYPOINT = "sdk-ts";

Spreading entire process.env into an object — may capture all secrets 15112 | let processEnv = env; 15113 | if (!processEnv) { > 15114 | processEnv = { ...process.env }; 15115 | } 15116 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6397 | extraArgs = {}, 6398 | pathToClaudeCodeExecutable, > 6399 | env = { ...process.env }, 6400 | stderr, 6401 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14866 | let processEnv = env; 14867 | if (!processEnv) { > 14868 | processEnv = { ...process.env }; 14869 | } 14870 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6397 | extraArgs = {}, 6398 | pathToClaudeCodeExecutable, > 6399 | env = { ...process.env }, 6400 | stderr, 6401 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14866 | let processEnv = env; 14867 | if (!processEnv) { > 14868 | processEnv = { ...process.env }; 14869 | } 14870 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6397 | extraArgs = {}, 6398 | pathToClaudeCodeExecutable, > 6399 | env = { ...process.env }, 6400 | stderr, 6401 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14860 | let processEnv = env; 14861 | if (!processEnv) { > 14862 | processEnv = { ...process.env }; 14863 | } 14864 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6397 | extraArgs = {}, 6398 | pathToClaudeCodeExecutable, > 6399 | env = { ...process.env }, 6400 | stderr, 6401 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14860 | let processEnv = env; 14861 | if (!processEnv) { > 14862 | processEnv = { ...process.env }; 14863 | } 14864 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6397 | extraArgs = {}, 6398 | pathToClaudeCodeExecutable, > 6399 | env = { ...process.env }, 6400 | stderr, 6401 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14859 | let processEnv = env; 14860 | if (!processEnv) { > 14861 | processEnv = { ...process.env }; 14862 | } 14863 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6397 | extraArgs = {}, 6398 | pathToClaudeCodeExecutable, > 6399 | env = { ...process.env }, 6400 | stderr, 6401 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14859 | let processEnv = env; 14860 | if (!processEnv) { > 14861 | processEnv = { ...process.env }; 14862 | } 14863 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6396 | extraArgs = {}, 6397 | pathToClaudeCodeExecutable, > 6398 | env = { ...process.env }, 6399 | stderr, 6400 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14856 | let processEnv = env; 14857 | if (!processEnv) { > 14858 | processEnv = { ...process.env }; 14859 | } 14860 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6396 | extraArgs = {}, 6397 | pathToClaudeCodeExecutable, > 6398 | env = { ...process.env }, 6399 | stderr, 6400 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14856 | let processEnv = env; 14857 | if (!processEnv) { > 14858 | processEnv = { ...process.env }; 14859 | } 14860 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6395 | extraArgs = {}, 6396 | pathToClaudeCodeExecutable, > 6397 | env = { ...process.env }, 6398 | stderr, 6399 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14837 | let processEnv = env; 14838 | if (!processEnv) { > 14839 | processEnv = { ...process.env }; 14840 | } 14841 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6395 | extraArgs = {}, 6396 | pathToClaudeCodeExecutable, > 6397 | env = { ...process.env }, 6398 | stderr, 6399 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14837 | let processEnv = env; 14838 | if (!processEnv) { > 14839 | processEnv = { ...process.env }; 14840 | } 14841 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6382 | extraArgs = {}, 6383 | pathToClaudeCodeExecutable, > 6384 | env = { ...process.env }, 6385 | stderr, 6386 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14811 | let processEnv = env; 14812 | if (!processEnv) { > 14813 | processEnv = { ...process.env }; 14814 | } 14815 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6382 | extraArgs = {}, 6383 | pathToClaudeCodeExecutable, > 6384 | env = { ...process.env }, 6385 | stderr, 6386 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14811 | let processEnv = env; 14812 | if (!processEnv) { > 14813 | processEnv = { ...process.env }; 14814 | } 14815 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6382 | extraArgs = {}, 6383 | pathToClaudeCodeExecutable, > 6384 | env = { ...process.env }, 6385 | stderr, 6386 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14811 | let processEnv = env; 14812 | if (!processEnv) { > 14813 | processEnv = { ...process.env }; 14814 | } 14815 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6382 | extraArgs = {}, 6383 | pathToClaudeCodeExecutable, > 6384 | env = { ...process.env }, 6385 | stderr, 6386 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14811 | let processEnv = env; 14812 | if (!processEnv) { > 14813 | processEnv = { ...process.env }; 14814 | } 14815 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6382 | extraArgs = {}, 6383 | pathToClaudeCodeExecutable, > 6384 | env = { ...process.env }, 6385 | stderr, 6386 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14805 | let processEnv = env; 14806 | if (!processEnv) { > 14807 | processEnv = { ...process.env }; 14808 | } 14809 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6382 | extraArgs = {}, 6383 | pathToClaudeCodeExecutable, > 6384 | env = { ...process.env }, 6385 | stderr, 6386 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14805 | let processEnv = env; 14806 | if (!processEnv) { > 14807 | processEnv = { ...process.env }; 14808 | } 14809 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6382 | extraArgs = {}, 6383 | pathToClaudeCodeExecutable, > 6384 | env = { ...process.env }, 6385 | stderr, 6386 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14805 | let processEnv = env; 14806 | if (!processEnv) { > 14807 | processEnv = { ...process.env }; 14808 | } 14809 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6382 | extraArgs = {}, 6383 | pathToClaudeCodeExecutable, > 6384 | env = { ...process.env }, 6385 | stderr, 6386 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14797 | let processEnv = env; 14798 | if (!processEnv) { > 14799 | processEnv = { ...process.env }; 14800 | } 14801 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Spreading entire process.env into an object — may capture all secrets 6382 | extraArgs = {}, 6383 | pathToClaudeCodeExecutable, > 6384 | env = { ...process.env }, 6385 | stderr, 6386 | customSystemPrompt,

Spreading entire process.env into an object — may capture all secrets 14797 | let processEnv = env; 14798 | if (!processEnv) { > 14799 | processEnv = { ...process.env }; 14800 | } 14801 | if (!processEnv.CLAUDE_CODE_ENTRYPOINT) {

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

[Accepted risk] Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.