Publish section-marker-rev@2.0.2

[Golevka2001]

Submitted by the publish action from Golevka2001/section-marker-rev. The artifact is downloaded and re-hashed by the validator.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[pullfrog]

✅ No new issues found.

Reviewed changes Reviewed the section-marker-rev@2.0.2 publish entry in this run.

• Vault version entry — adds 2.0.2 artifact URL, checksum, and timestamp to vault/section-marker-rev.json.

  ^{｜ View workflow run ｜ Using muse-spark-1.3-contributor (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

Verdict: no concerns

Provenance: verified at Golevka2001/section-marker-rev@bc6fc560aa886d9e2299fceab5a76ab2777ee0b2 (built by spicetify/actions build-module, run). Reviewed the source at that commit: index.ts, mod.ts, app.ts, analysis-loader.ts, analysis-cache.ts, interface.ts, logic.ts, dom-watcher.ts, metadata.json, package.json, bun.lock.

Findings: none.

• Network: no fetch/XHR/WebSocket/sendBeacon/remote URLs. The only data call is Spicetify.getAudioData(uri) (analysis-loader.ts), the client's local audio-analysis entry point, disclosed in metadata.json stdlibBoundary.exceptions. No hosts contacted, nothing to explain in the description.
• Remote/dynamic code: none. No eval/new Function/remote import()/script injection/innerHTML. DOM is built with createElement + classList/dataset/style.setProperty; the pinned <style> copies the module's own rules filtered by signature (interface.ts), not remote content.
• Credentials/sessions: no tokens, cookies, AuthorizationAPI, daemon token, 127.0.0.1:7967, CORSProxy, or localStorage writes. player.origin.getState() and Spicetify.Queue are read locally for the current/next track URI (app.ts); nothing leaves the machine.
• Loader hang (delta vs 2.0.0): fixed, not introduced. The default export is sync and main() runs fire-and-forget (mod.ts), waitForElm resolves null after 5s (dom-watcher.ts), and analysis requests time out after 8s (analysis-cache.ts).
• Supply chain: package.json has dev-only deps (kit, types, oxfmt/oxlint, typescript), no install scripts; bun.lock uses integrity hashes with no off-registry resolved URLs.

Not reviewed: the built zip bytes (attestation + CI checksum trusted instead); test stubs beyond noting their dynamic import() is test-harness-only.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using muse-spark-1.3-contributor (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

Verdict: no concerns

Provenance: verified at Golevka2001/section-marker-rev@bc6fc56 (built by spicetify/actions build-module, run 38505495417). Reviewed the source at that commit: index.ts, mod.ts, app.ts, interface.ts, analysis-loader.ts, analysis-cache.ts, logic.ts, dom-watcher.ts, metadata.json, package.json, bun.lock, and the release workflow.

Findings: none.

• Network: no fetch, XMLHttpRequest, WebSocket, EventSource, sendBeacon, or remote URLs. The only data source is Spicetify.getAudioData(uri), the in-client audio-analysis entry point, which is disclosed in metadata.json stdlibBoundary.exceptions. No hosts contacted, nothing leaves the machine.
• Remote/dynamic code: none. Only a static local import("./mod.js"); DOM is built with createElement/classList/style.setProperty/dataset, and textContent is set only from the module's own stylesheet rules. No eval, new Function, string setTimeout, remote import(), injected <script>, innerHTML, or atob/fromCharCode.
• Credentials/sessions: none touched. Reads player state and queue URIs for display/preload only; no tokens, cookies, daemon token, 127.0.0.1:7967, CORSProxy, or localStorage writes.
• Concealment: none. Plain readable TypeScript matching the description (section markers on the playbar).
• Supply chain: package.json has dev-only tooling deps plus stdlib ^1.10.4, no install scripts; bun.lock carries integrity hashes with no off-registry resolved URLs; the release workflow uses the standard spicetify/actions build + publish path.
• Loader hang: the default export in mod.ts is synchronous (async startup runs detached via void main().then(...)), the client-readiness poll is off the loader promise and abort-aware, waitForElm resolves null after a 5s timeout, and analysis requests are bounded by an 8s timeout with a 10s retry gap. The 2.0.2 changelog entries describe exactly these hang fixes, consistent with the code.

Not reviewed: the built zip bytes themselves (trusted via attestation + the validator's re-hash rather than re-downloaded), and no code was run, installed, or built — read-only review.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using muse-spark-1.3-contributor (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

Verdict: no concerns

Provenance: verified at Golevka2001/section-marker-rev@bc6fc560aa886d9e2299fceab5a76ab2777ee0b2 (built by spicetify/actions build-module, run). Reviewed the source, metadata.json, package.json, and bun.lock at that commit.

Findings: none. Checked the full source at the attested commit:

• Network: no fetch, XHR, WebSocket, EventSource, sendBeacon, or remote URLs. The only data call is the client's built-in Spicetify.getAudioData(uri) (client-local audio analysis, matches the "song's highlighted sections" description). Queue peek at app.ts is disclosed in metadata.json stdlibBoundary.exceptions.
• Remote/dynamic code: only a local relative import("./mod.js"); no eval, new Function, remote import(), or innerHTML. Created <style>/<div> elements use the module's own stylesheet rules (filtered by section-marker signature) and local DOM only.
• Credentials/sessions: reads only the current track URI and queue URIs; no tokens, cookies, or off-machine sends.
• Spicetify internals: no daemon token, no 127.0.0.1:7967, no CORSProxy/CosmosAsync, no localStorage writes.
• Concealment: plain readable TypeScript; no minification, atob/fromCharCode, or encoded blobs.
• Supply chain: devDependencies only (@spicetify/kit, @types/*, oxfmt, oxlint, typescript), no install scripts, no runtime deps; bun.lock carries integrity hashes with no off-registry resolved URLs; release workflow delegates to spicetify/actions build/publish with nothing fetching code.
• Loader hang: fixed, not introduced, in this version. The default export is now synchronous and returns teardown immediately, with startup detached via void main(...); the client-ready wait is abortable and off the loader promise, waitForElm resolves null after 5s, and analysis requests are bounded by an 8s timeout.
• Diff vs 2.0.1: the changes are the hang fixes, bounded waits/retries, and teardown handling; no new network, credential, or persistence surface.

Did not review: the built zip bytes (source at the attested commit reviewed instead; checksum and zip-entry safety left to the CI validator). Nothing was run, installed, or built.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using muse-spark-1.3-contributor (free via Pullfrog for OSS) ｜ 𝕏}