Skip to content

fix: replace clipboardy with native clipboard commands (#162) - #180

Merged
davideast merged 1 commit into
mainfrom
worktree-structured-wibbling-knuth
Apr 26, 2026
Merged

fix: replace clipboardy with native clipboard commands (#162)#180
davideast merged 1 commit into
mainfrom
worktree-structured-wibbling-knuth

Conversation

@davideast

Copy link
Copy Markdown
Owner

Summary

  • Removes clipboardy (and @types/clipboardy) from dependencies. It bundles clipboard_x86_64.exe and clipboard_i686.exe as Windows fallbacks, which enterprise Threat Intelligence systems flag as malicious binaries and block stitch-mcp installation in managed environments (clipboard_x86_64.exe in clipboardy fallbacks flagged as Malicious Binary by Threat Intelligence #162).
  • Replaces it with a small in-house module that pipes text to platform-native clipboard commands: pbcopy on darwin, clip.exe on win32, and wl-copy/xclip/xsel (in that order) on linux.
  • Exported API (copyText, copyJson, downloadAndCopyText, downloadAndCopyImage) is unchanged; callers in checklist.ts, AuthStep.ts, and ScreensView.tsx swap imports without further changes.

Fixes #162.

Test plan

  • bun test — 485 pass, 6 skip, 0 fail (no new skips)
  • npx tsc --noEmit — zero new errors in touched files (only pre-existing test-file errors)
  • bun scripts/verify-pack.ts — clean
  • npm pack tarball contains zero .exe files
  • darwin smoke test: copyTextpbpaste round-trip works
  • Windows smoke test (manual, post-merge): clip.exe round-trip
  • Linux smoke test (manual, post-merge): xclip / wl-copy round-trip

clipboardy bundles clipboard_x86_64.exe and clipboard_i686.exe as Windows
fallbacks, which enterprise Threat Intelligence systems flag as malicious
binaries and block stitch-mcp installation in managed environments.

Replace clipboardy with a small in-house module that pipes text to
platform-native clipboard commands:
  - darwin: pbcopy
  - win32:  clip.exe / clip
  - linux:  wl-copy / xclip / xsel (in that order)

The exported API (copyText, copyJson, downloadAndCopyText) is unchanged,
so all callers swap their imports without further changes. clipboardy
and @types/clipboardy are removed from package.json.

npm pack confirms zero .exe files in the published tarball.
@davideast
davideast merged commit 5efbf3a into main Apr 26, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

clipboard_x86_64.exe in clipboardy fallbacks flagged as Malicious Binary by Threat Intelligence

1 participant