3x-haust/oh-my-design

No problems traced to this repository code in these checks. 2 static matches retained as context.

1 download and execute matches retained as context; full list in the evidence.

1 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• omd check reports design-lint findings and exits 1 when any are found, so it works as a CI gate: Real input produced the expected result: [warn] CONTRAST-001 Screen/Checkout/PayNow

  Source: Any finding exits 1, so it is usable in CI.

  Input: test/fixtures/ir.raw.json (prebuilt IR, no browser)

  Expected: findings printed and exit code 1

  Command: node bin/omd.ts check --ir test/fixtures/ir.raw.json

  Observed: [warn] CONTRAST-001 Screen/Checkout/PayNow: Text contrast ratio 3.03 is below the WCAG AA minimum for its rendered size and weight (3:1 for large text; 4.5:1 otherwise). [warn] TOKEN-003 Screen/Checkout/PayNow: Fill is not tokenised (got null) [warn] TOKEN-004 Screen/Grid/CardOffGrid1: Corner radius is not tokenised (got null). A one-off radius is a decision made outside the system; map it to a radius token so the corner scale stays coherent. [warn] TOKEN-004 Screen/Grid/CardOffGrid2: Corner radius is not tokenised (got null). A one-off radius is a decision made outside the system; map it to a

• omd slop scan reads supported source files without writing them: Real input produced the expected result: "filesScanned":28

  Source: `omd slop scan [root] [--json]` reads supported production source without writing it.

  Input: test/fixtures directory

  Expected: JSON scan report with 28 files scanned

  Command: node bin/omd.ts slop scan test/fixtures --json

  Observed: "filesScanned":28,"candidates":[]}

Examples

• read-only source candidate scan (CLI reference): command completed successfully

  Source: README.md CLI reference: omd slop scan [root] [--json]

  Input: test/fixtures --json

  Expected: JSON scan report

  Command: node bin/omd.ts slop scan test/fixtures --json

  Observed: {"schemaVersion":"1.0","root":"<guest-path>","filesScanned":28,"candidates":[]}

• stack routing reports existing toolchain for this repo (CLI reference: omd stack): command completed successfully

  Source: README.md CLI reference: omd stack [--json]

  Input: --json in repo root

  Expected: stack reported as existing

  Command: node bin/omd.ts stack --json

  Observed: {"stack":"existing","framework":null,"greenfield":false,"reason":"existing toolchain (package.json) — preserve and investigate it, never replace it with a different stack","shell":{"kind":"browser","evidence":[],"devUrl":null,"builtEntry":null,"builtEntryExists":false,"buildCommand":null,"devCommand":null,"inapplicableChecks":[]}}

• documented offline unit test tier: npm run test:unit ran 986 tests: 985 passed, 1 failed (test/ci-coverage-merge.test.ts 'raw V8 coverage keeps opposite hits...': TypeError from node:path in node test coverage merge under Node 22.23.4). Not hidden; test run exit code 1. Not replayed as a passing example.

  Source: README.md Testing: npm test / test:unit

  Expected: documented command completes successfully

  Observed: npm run test:unit ran 986 tests: 985 passed, 1 failed (test/ci-coverage-merge.test.ts 'raw V8 coverage keeps opposite hits...': TypeError from node:path in node test coverage merge under Node 22.23.4). Not hidden; test run exit code 1. Not replayed as a passing example.

• browser-dependent README commands (omd render / omd ir / omd check <page> / omd probe): Chromium not present (omd doctor: playwright chromium not found). The README browser download step was not run because the task forbids browser downloads, and no CDP endpoint is supplied (OMD_BROWSER_CDP_URL unset). Ran browser-free substitutes: omd check --ir and omd slop scan.

  Source: README.md CLI reference

  Expected: documented command completes successfully

  Observed: Chromium not present (omd doctor: playwright chromium not found). The README browser download step was not run because the task forbids browser downloads, and no CDP endpoint is supplied (OMD_BROWSER_CDP_URL unset). Ran browser-free substitutes: omd check --ir and omd slop scan.

Local or hosted: local

Run oh-my-design (omd) CLI design checks from source at pin 7618cc4

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; cat /etc/os-release | head -2; python3 --version; ls /inputs 2>&1
cd <guest-path> && cat README.md 2>/dev/null | head -300
cd <guest-path> && sed -n 300,700p README.md | grep -n -i -E "^#|omd |npm|node |npx|test|cycle|cron|webhook|--once|--now|schedule|mcp" | head -150; echo ---; node -v 2>&1; npm -v 2>&1; which pi codex claude 2>&1; grep -n '"engines"' -A3 package.json; grep -n '"scripts"' -A30 package.json
cd <guest-path> && (git init -q 2>&1; git remote add origin https://github.com/3x-haust/oh-my-design 2>&1; timeout 120 git fetch --depth 1 origin 7618cc4b6bdd92ed43a7fa62b6be12789f94aca6 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1 2>&1); echo ---; sudo -n true && echo SUDO_OK; env | grep -i proxy | sed 's/=.*@/=***@/'; curl -sI -m 20 https://nodejs.org/dist/index.json | head -1
cd /tmp && V=$(curl -s -m 30 https://nodejs.org/dist/index.json | python3 -c 'import json,sys; print([r["version"] for r in json.load(sys.stdin) if r["version"].startswith("v22.")][0])') && echo $V && curl -sfL -m 300 -o node.tar.xz https://nodejs.org/dist/$V/node-$V-linux-x64.tar.xz && sudo tar -xJf node.tar.xz -C /usr/local --strip-components=1 && node -v && npm -v && which node npm
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && timeout 900 npm install 2>&1 | tail -25; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && node bin/omd.ts doctor 2>&1 | tail -40; echo "exit=${PIPESTATUS[0]}"; echo ---; node bin/omd-install.ts --help 2>&1 | head -30
cd <guest-path> && env | grep -i -E "cdp|browser|chrom" | sed 's/=.*/=<set>/'; echo ---; timeout 300 node bin/omd-install.ts install 2>&1 | tail -30; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && node bin/omd.ts --help 2>&1 | head -60; echo ---; ls test/fixtures | head -40; echo ---; ls bin
cd <guest-path> && node bin/omd.ts stack --json 2>&1 | head -20; echo "exit=$?"; echo ---; node bin/omd.ts slop scan test/fixtures --json 2>&1 | head -30; echo "exit=${PIPESTATUS[0]}"; echo ---; timeout 120 node bin/omd.ts check test/fixtures/slop.html 2>&1 | head -30; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && timeout 120 node bin/omd.ts check --ir test/fixtures/ir.raw.json 2>&1 | head -40; echo "exit=${PIPESTATUS[0]}"; echo ---; timeout 120 node bin/omd.ts check --ir test/fixtures/ir.raw.json --json 2>&1 | head -c 1500; echo; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && grep -n -E "Any finding exits 1|usable in CI|Hard-wrapped|omd check --ir|omd slop scan" README.md | cut -c1-220; echo ---; grep -rn -i -E "cron|setInterval|webhook|--once|--now|schedul" README.md bin/omd.ts core/cli 2>/dev/null | cut -c1-200 | head -20; ls core | head -80 | tr '\n' ' '; echo; echo ---; grep -n -i "test" scripts/test-all.sh | head -10
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && (timeout 1500 npm run test:unit > /tmp/omd-unit.log 2>&1; echo "exit=$?" >> /tmp/omd-unit.log); tail -15 /tmp/omd-unit.log; grep -c -E "^not ok|✖| fail " /tmp/omd-unit.log
cd <guest-path> && grep -E "^# (tests|pass|fail|skipped)" /tmp/omd-unit.log; grep -E "^not ok|^    not ok|^  not ok" /tmp/omd-unit.log | head -20; grep -n -i -E "ENOENT|Error:|error" /tmp/omd-unit.log | head -15 | cut -c1-250
cd <guest-path> && grep -n -E "^✖|✖ " /tmp/omd-unit.log | cut -c1-220 | head -20; echo ---; grep -E "^ℹ (tests|pass|fail)" /tmp/omd-unit.log; sed -n 1015,1030p /tmp/omd-unit.log | cut -c1-200
cd <guest-path> && ls -la .coldpass; ls <guest-path>; ls -la <guest-path> 2>&1 | head; ls -la .coldpass/report.json .coldpass/probe.json .coldpass/claims.json 2>&1
ls -la <guest-path>; ls <guest-path> 2>&1
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import json, os
W = "<guest-path>"
C = os.path.join(W, ".coldpass")
readme = open(os.path.join(W, "README.md"), encoding="utf-8").read()
q1 = "Any finding exits 1, so it is usable in CI."
q2 = "`omd slop scan [root] [--json]` reads supported production source without writing it."
for q in (q1, q2):
    assert readme.count(q) == 1, q
CHECK = ["node", "bin/omd.ts", "check", "--ir", "test/fixtures/ir.raw.json"]
CHECK_TXT = "[warn] CONTRAST-001 Screen/Checkout/PayNow"
SCAN = ["node", "bin/omd.ts", "slop", "scan", "test/fixtures", "--json"]
SCAN_TXT = '"filesScanned":28'
probe = {"kind": "cli", "argv": CHECK, "cwd": W, "expected_returncode": 1, "expected_text": CHECK_TXT}
claims = [
  {"kind": "claim", "claim": "omd check reports design-lint findings and exits 1 when any are found, so it works as a CI gate",
   "source": q1, "input": "test/fixtures/ir.raw.json (prebuilt IR, no browser)",
   "expected": "findings printed and exit code 1", "probe_kind": "cli", "argv": CHECK,
   "expected_returncode": 1, "expected_text": CHECK_TXT, "cwd": W},
  {"kind": "claim", "claim": "omd slop scan reads supported source files without writing them",
   "source": q2, "input": "test/fixtures directory", "expected": "JSON scan report with 28 files scanned",
   "probe_kind": "cli", "argv": SCAN, "expected_text": SCAN_TXT, "cwd": W},
]
examples = [
  {"kind": "example", "claim": "read-only source candidate scan (CLI reference)", "source": "README.md CLI reference: omd slop scan [root] [--json]",
   "input": "test/fixtures --json", "expected": "JSON scan report", "argv": SCAN, "cwd": W, "expected_text": SCAN_TXT},
  {"kind": "example", "claim": "stack routing reports existing toolchain for this repo (CLI reference: omd stack)", "source": "README.md CLI reference: omd stack [--json]",
   "input": "--json in repo root", "expected": "stack reported as existing", "argv": ["node", "bin/omd.ts", "stack", "--json"], "cwd": W, "expected_text": '"stack":"existing"'},
  {"kind": "example", "claim": "documented offline unit test tier", "source": "README.md Testing: npm test / test:unit",
   "reason": "npm run test:unit ran 986 tests: 985 passed, 1 failed (test/ci-coverage-merge.test.ts 'raw V8 coverage keeps opposite hits...': TypeError from node:path in node test coverage merge under Node 22.23.4). Not hidden; test run exit code 1. Not replayed as a passing example."},
  {"kind": "example", "claim": "browser-dependent README commands (omd render / omd ir / omd check <page> / omd probe)", "source": "README.md CLI reference",
   "reason": "Chromium not present (omd doctor: playwright chromium not found). The README browser download step was not run because the task forbids browser downloads, and no CDP endpoint is supplied (OMD_BROWSER_CDP_URL unset). Ran browser-free substitutes: omd check --ir and omd slop scan."},
]
cycles = {"detected": False,
  "reason": "Entry points inspected (README CLI reference, bin/omd.ts, core/cli, package.json scripts): no cron/scheduler/loop/webhook/--once/--now product trigger. Repeating behaviour lives in host hooks (Pi/Codex/Claude Code) and CI schedules, not in the product CLI.",
  "checks": []}
report = {
  "outcome": "needs_browser", "fault_owner": "prerequisite",
  "operation": "Run oh-my-design (omd) CLI design checks from source at pin 7618cc4",
  "operation_scope": "Browser-free CLI checks (omd check --ir, omd slop scan, omd stack) work on Ubuntu 24.04 with Node 22.23.4. Page rendering, page checks, probe and reference capture need a local Chromium or a supplied CDP endpoint, neither available in this guest. Host install needs Claude Code or Codex (not present).",
  "steps": [
    "git init; git remote add origin https://github.com/3x-haust/oh-my-design; git fetch --depth 1 origin 7618cc4b6bdd92ed43a7fa62b6be12789f94aca6; git reset --mixed FETCH_HEAD",
    "Install Node 22 (official nodejs.org linux-x64 tarball, v22.23.4) into /usr/local (README requires Node >=22.19)",
    "npm install (README: From source (contributors))",
    "node bin/omd.ts doctor",
    "node bin/omd-install.ts install",
    "node bin/omd.ts check --ir test/fixtures/ir.raw.json",
    "node bin/omd.ts slop scan test/fixtures --json",
    "npm run test:unit"],
  "deviations": [
    "Node/npm were absent; installed Node v22.23.4 from nodejs.org tarball (README needs >=22.19).",
    "node bin/omd.ts doctor fails on 'playwright chromium (not found)'. The README's browser download step was not run: the task forbids browser downloads and no CDP endpoint was supplied.",
    "node bin/omd-install.ts install exits 1: 'No supported host found: neither ~/.claude nor ~/.codex exists'. Host install not done.",
    "omd check <page>, omd ir, omd render, omd probe, omd slop checkpoint not run: they need Chromium (browserType.launch failed).",
    "npm run test:unit: 985/986 pass; 1 failure in test/ci-coverage-merge.test.ts (node:path TypeError in coverage merge under Node 22.23.4).",
    "Ran npm install (lifecycle scripts) with NODE_USE_ENV_PROXY=1; no telemetry prompt appeared."],
  "stuck_step": "A local Chromium is required for rendering and page checks; it is not present, browser downloads are forbidden here, and no CDP endpoint was supplied.",
  "main_blocker": "No local Chromium and no supplied CDP endpoint.",
  "plain_failure": "The design tool's core page-rendering features cannot run on this test machine because its web browser is missing and this task does not allow downloading one. The parts that work without a browser (design-rule checks on prebuilt layouts, source scanning, and stack detection) were run and produced their documented output.",
  "suggested_fix": "Provide a shared CDP endpoint via OMD_BROWSER_CDP_URL or allow the README's Chromium setup in the guest; install Claude Code or Codex to test host install; investigate the ci-coverage-merge test under Node 22.23.4."}
for name, obj in [("probe.json", probe), ("claims.json", claims), ("examples.json", examples), ("cycles.json", cycles), ("report.json", report)]:
    with open(os.path.join(C, name), "w", encoding="utf-8") as f: json.dump(obj, f, indent=2, ensure_ascii=False); f.write("\n")
print("written")
EOF
python3 -I <guest-path> && cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "exit=${PIPESTATUS[0]}"