Impulse-Labs-SAS/brainstack

Review signals: 56 known vulnerability.

OSV reports a known vulnerability in this dependency version. 17 distinct locations. 56 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The MCP server lets assistants read notes that were written to the brain: Real input produced the expected result: coldpass-7f3a9c

  Source: Assistants read and write the same notes through the MCP server

  Input: {"tool": "get_note", "arguments": {"path": "coldpass/probe-note.md"}}

  Expected: the note body with the marker is returned

  Command: /tmp/node24/bin/pnpm --filter @brainstack/server dev tools/call {"tool": "get_note", "arguments": {"path": "coldpass/probe-note.md"}}

  Observed: coldpass-7f3a9c\",\n \"mtime\": 1792810848122,\n \"checksum\": \"be4cda40418c05f3c124cea5da40d44fd2f0c41a28df00aeebee2caa6a0725e1\"\n}"}]}

• The core package test suite runs on PGlite, in process, with no database: Real input produced the expected result: 211 passed

  Source: runs on PGlite, in process; no database needed

  Input: pnpm --filter @brainstack/core test

  Expected: all core test files pass

  Command: /tmp/node24/bin/pnpm --filter @brainstack/core test

  Observed: 211 passed (211) Start at 03:10:02 Duration 17.97s (transform 587ms, setup 0ms, collect 3.84s, tests 7.89s, environment 1ms, prepare 2.06s)

Examples

• Build the whole monorepo: command completed successfully

  Source: README.md Local development

  Input: pnpm build

  Expected: web app and server build

  Command: /tmp/node24/bin/pnpm build

  Observed: signup 5.42 kB 135 kB apps/web build: └ ○ /verify-email 3.46 kB 119 kB apps/web build: + First Load JS shared by all 103 kB apps/web build: ├ chunks/18-c858b3a70433e430.js 46.5 kB apps/web build: ├ chunks/87c73c54-dd8d81ac9604067c.js 54.2 kB apps/web build: └ other shared chunks (total) 2.08 kB apps/web build: ƒ Middleware 33.1 kB apps/web build: ○ (Static) prerendered as static content apps/web build: ƒ (Dynamic) server-rendered on demand apps/web build: Done

• Lint the workspace: command completed successfully

  Source: README.md Local development

  Input: pnpm lint

  Expected: no lint errors

  Command: /tmp/node24/bin/pnpm lint

  Observed: ace projects packages/core lint$ eslint "src/**/*.ts" packages/skill lint$ eslint . --ext .ts packages/skill lint: Done packages/core lint: Done apps/server lint$ eslint "src/**/*.ts" apps/server lint: Done apps/web lint$ next lint --dir src apps/web lint: `next lint` is deprecated and will be removed in Next.js 16. apps/web lint: For new projects, use create-next-app to choose your preferred linter. apps/web lint: For existing projects, migrate to the ESLint CLI: apps/web lint: npx @next/codemod@canary next-lint-to-eslint-cli . apps/web lint: ✔ No ESLint warnings or errors apps/web lint: Done

• Build the skill for every major client: command completed successfully

  Source: README.md Loading the skill

  Input: pnpm --filter @brainstack/skill build

  Expected: six client adapters built

  Command: /tmp/node24/bin/pnpm --filter @brainstack/skill build

  Observed: > @brainstack/[email protected] build <guest-path> > tsc -p tsconfig.build.json && node build/build.js [skill] built 6 adapters to <guest-path>

• Run the full test suite: Ran pnpm test: packages/core passed 211/211 and apps/server ran most test files, but a vitest worker in apps/server crashed ('Worker exited unexpectedly') on each run, so pnpm test exits 1. Substitute: the core package test example above.

  Source: README.md Local development

  Expected: documented command completes successfully

  Observed: Ran pnpm test: packages/core passed 211/211 and apps/server ran most test files, but a vitest worker in apps/server crashed ('Worker exited unexpectedly') on each run, so pnpm test exits 1. Substitute: the core package test example above.

Cycles

• The server runs housekeeping on its own every hour, after purging at boot: Triggered one cycle by hand (run-once wrapper: calls the same purgeExpired function once against the live DATABASE_URL, no source edits, no fake clock; normal trigger: every 60 minutes (60 * 60 * 1000 ms) in the long-running server; also once at boot): hourly purge ran once: deleted=0

  Source: apps/server/src/serve.ts

  Input: current database state and wall clock

  Expected: one purge pass completes and reports the rows it deleted

  Command: /tmp/node24/bin/node --env-file=<guest-path> --import tsx <guest-path>

  Observed: hourly purge ran once: deleted=0

Local or hosted: local

Run the BrainStack server locally (README 'Local development': pnpm install, then pnpm --filter @brainstack/server dev) and create and read back a note through its MCP endpoint

cd <guest-path> && pwd && ls -la && id -u && python3 --version && cat /etc/os-release | head -3 && ls /inputs 2>/dev/null; ls <guest-path> 2>/dev/null
cd <guest-path> && find . -maxdepth 2 -not -path './.git*' | head -100 && cat README.md 2>/dev/null | head -200
cd <guest-path> && cat .nvmrc; echo ---; grep -n '"packageManager"\|"engines"' -A3 package.json; echo ---; ls -la .git 2>&1 | head -2; echo ---; which node npm pnpm docker corepack 2>&1; node -v 2>&1; npm -v 2>&1; echo ---; ls -la .coldpass; echo ---; cat .npmrc; echo; cat .claude/settings.json | head -30
cd <guest-path> && git init -q && git remote add origin https://github.com/Impulse-Labs-SAS/brainstack && timeout 180 git fetch --depth 1 origin 6fd684d6e57429d21f2cfeb16183f74a628b41a9 2>&1 | tail -5; git reset --mixed FETCH_HEAD 2>&1 | tail -3; git log --oneline -1 2>&1; git status --short | head -20
env | grep -i proxy; cd /tmp && (timeout 120 curl -sSI https://nodejs.org/dist/index.json 2>&1 | head -3); (timeout 60 curl -sSI https://registry.npmjs.org/ 2>&1 | head -2); sudo -n true && echo SUDO_OK; apt-cache policy nodejs 2>/dev/null | head -3
set -e; export NODE_USE_ENV_PROXY=1; cd /tmp && V=$(curl -s https://nodejs.org/dist/index.json | python3 -c 'import json,sys; print([r["version"] for r in json.load(sys.stdin) if r["version"].startswith("v24.")][0])'); echo $V; mkdir -p /tmp/node24 && curl -sSfL https://nodejs.org/dist/$V/node-$V-linux-x64.tar.xz -o /tmp/node24/node.tar.xz && tar -xJf /tmp/node24/node.tar.xz -C /tmp/node24 --strip-components=1 && /tmp/node24/bin/node -v && /tmp/node24/bin/corepack enable --install-directory /tmp/node24/bin && PATH=/tmp/node24/bin:$PATH pnpm -v
export PATH=/tmp/node24/bin:$PATH NODE_USE_ENV_PROXY=1; node -v && npm -v && corepack enable --install-directory /tmp/node24/bin && pnpm -v && cd <guest-path> && grep -n '"version"' -m1 <(node -e 'console.log(JSON.stringify(require("./package.json")))' ) ; node -p 'require("./package.json").packageManager'
export PATH=/tmp/node24/bin:$PATH NODE_USE_ENV_PROXY=1; cd <guest-path> && timeout 900 pnpm install 2>&1 | tail -25; echo EXIT=${PIPESTATUS[0]}
export PATH=/tmp/node24/bin:$PATH NODE_USE_ENV_PROXY=1; cd <guest-path> && timeout 900 pnpm test > <guest-path> 2>&1; echo TEST_EXIT=$?; tail -25 <guest-path>
export PATH=/tmp/node24/bin:$PATH NODE_USE_ENV_PROXY=1; cd <guest-path> && timeout 900 pnpm build > <guest-path> 2>&1; echo BUILD_EXIT=$?; tail -25 <guest-path>
grep -n 'Test Files\|Tests \|FAIL\|failed\|packages/' <guest-path> | grep -v '✓' | head -40; free -m | head -2; nproc
export PATH=/tmp/node24/bin:$PATH NODE_USE_ENV_PROXY=1; cd <guest-path> && timeout 900 pnpm --filter @brainstack/server test > <guest-path> 2>&1; echo EXIT=$?; grep -n 'FAIL\|Test Files\|Tests  \|Errors\|Worker exited' <guest-path> | head -20
sed -n 60,90p <guest-path> | cut -c1-300
(dmesg 2>/dev/null | grep -i 'out of memory\|oom' | tail -3) || true; cd <guest-path> && cat package.json | head -40; echo ---; cat .env.example 2>/dev/null | grep -v '^#' | grep -v '^$' | head -30; echo ---; ls src | head -40; grep -rn 'stdio' src --include=*.ts -l | head
cd <guest-path> && cat src/serve.ts | head -80; echo ----CLI; cat src/cli.ts | head -120; echo ----CONFIG; ls src/config; grep -rn 'DATABASE_URL\|pglite\|PGlite' src --include=*.ts | grep -v test | head -20
sudo -n apt-get update -qq 2>&1 | tail -2; sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq postgresql > <guest-path> 2>&1; echo APT_EXIT=$?; tail -3 <guest-path>; ls /usr/lib/postgresql/ 2>/dev/null; (sudo -n service postgresql start 2>&1 || sudo -n pg_ctlcluster 16 main start 2>&1) | tail -2; sudo -n -u postgres psql -tAc 'select version()' 2>&1 | cut -c1-80
cd <guest-path> && PW=$(python3 -c 'import secrets;print(secrets.token_hex(16))') && sudo -n -u postgres psql -qc "CREATE ROLE brainstack LOGIN PASSWORD '$PW'" && sudo -n -u postgres psql -qc "CREATE DATABASE brainstack OWNER brainstack" && cp apps/server/.env.example apps/server/.env && sed -i "s|^DATABASE_URL=.*|DATABASE_URL=postgres://<secret>:5432/brainstack|" apps/server/.env && grep -n '^DATABASE_URL\|^PUBLIC_ORIGIN\|^PORT\|^CORS' apps/server/.env | sed 's/:\/\/brainstack:[^@]*@/:\/\/brainstack:***@/'; git check-ignore -q apps/server/.env && echo IGNORED_OK
export PATH=/tmp/node24/bin:$PATH NODE_USE_ENV_PROXY=1; cd <guest-path> && mkdir -p <guest-path> && (setsid nohup pnpm --filter @brainstack/server dev > <guest-path> 2>&1 &) ; sleep 25; tail -c 1500 <guest-path>; echo; curl -s -m 5 -o /dev/null -w 'HTTP %{http_code}\n' http://localhost:3000/api/health 2>&1; curl -s -m 5 -w '\nHTTP %{http_code}\n' http://localhost:3000/api/mcp -X POST -H 'content-type: application/json' -d '{}' | head -c 400
cd <guest-path> && cat src/config/api.ts | head -20; ls src/trpc src/trpc/* | head -40; grep -rn "signUp\|apiKey\|createKey\|createApiKey" src/trpc --include=*.ts | grep -v test | head -20
cd <guest-path> && grep -n 'auth: <secret>' -A60 src/trpc/router.ts | grep -n 'z\.\|mutation\|query\|: sessionProcedure\|: publicProcedure' | head -40; sed -n 697,712p src/trpc/router.ts; grep -n 'Procedure = \|publicProcedure\|sessionProcedure' src/trpc/router.ts | head -5; grep -rn 'mcp' src/http/app.ts | head
cd <guest-path> && grep -n 'auth: <secret>' src/trpc/router.ts | head -40; grep -n 'signup\|signUp\|register' -i src/trpc/router.ts | head; grep -rn 'signup\|signUp' -i src/http/routes/*.ts | grep -v test | head -5; grep -n 'sign\|register' -i ../../README.md | head -3
cd <guest-path> && sed -n 60,100p src/http/routes/auth.ts; grep -n "router.post('/login'" -A25 src/http/routes/auth.ts | head -40; grep -rn "mount\|route(" src/http/app.ts | grep -i 'auth\|api' | head
cd <guest-path> && PW=$(python3 -c 'import secrets;print(secrets.token_urlsafe(18))'); echo "$PW" > <guest-path>; chmod 600 <guest-path>; curl -s -m 10 -w '\nHTTP %{http_code}\n' -X POST http://localhost:3000/api/auth/signup -H 'content-type: application/json' -d "{\"email\":\"<email>\",\"password\":\"<secret>\",\"displayName\":\"Guest\"}"; curl -s -m 10 -c <guest-path> -w '\nHTTP %{http_code}\n' -X POST http://localhost:3000/api/auth/login -H 'content-type: application/json' -d "{\"email\":\"<email>\",\"password\":\"<secret>\"}" | cut -c1-300; grep -c . <guest-path>
cd <guest-path> && curl -s -m 10 -b <guest-path> -X POST http://localhost:3000/api/trpc/apiKeys.create -H 'content-type: application/json' -d '{"json":{"name":"guest-probe","scopes":["notes:read","notes:write"]}}' | head -c 600; echo; curl -s -m 10 -b <guest-path> -X POST http://localhost:3000/api/trpc/apiKeys.create -H 'content-type: application/json' -d '{"name":"guest-probe","scopes":["notes:read","notes:write"]}' | head -c 600; echo; grep -n 'API_KEY_SCOPES =' -A3 -r <guest-path> <guest-path> | head -6
cd <guest-path> && cat .mcp.json; echo; grep -rn 'StdioServerTransport\|streamable\|StreamableHTTP' apps/server/src --include=*.ts | grep -v test | head -5; ls apps/server/src/mcp; grep -n 'name:\|registerTool\|tool(' apps/server/src/mcp/server.ts | head -30
cd <guest-path> && grep -n "registerTool(" -A1 apps/server/src/mcp/server.ts | grep "'" | sed 's/^ *//' | head -60; ls apps/server/node_modules/@modelcontextprotocol/sdk/package.json && grep '"version"' apps/server/node_modules/@modelcontextprotocol/sdk/package.json
cd <guest-path> && sed -n 436,470p apps/server/src/mcp/server.ts; sed -n 340,360p apps/server/src/mcp/server.ts
cd <guest-path> && ls node_modules/@modelcontextprotocol/sdk/dist/esm/client/index.js node_modules/@modelcontextprotocol/sdk/dist/esm/client/streamableHttp.js && grep '"version"' node_modules/@modelcontextprotocol/sdk/package.json && cat > <guest-path> <<'EOF'
// Usage: node mcpcall.mjs <tool> <jsonArgs>   (reads BRAINSTACK_API_KEY from env)
const SDK = '<guest-path>';
const { Client } = await import(`${SDK}/index.js`);
const { StreamableHTTPClientTransport } = await import(`${SDK}/streamableHttp.js`);
const url = new URL(process.env.BRAINSTACK_URL ?? 'http://localhost:3000/api/mcp');
const transport = new StreamableHTTPClientTransport(url, {
  requestInit: { headers: { Authorization: <secret>
});
const client = new Client({ name: 'coldpass-probe', version: '0.0.1' });
await client.connect(transport);
const res = await client.callTool({ name: process.argv[2], arguments: JSON.parse(process.argv[3] ?? '{}') });
console.log(JSON.stringify(res, null, 1));
await client.close();
EOF
echo written
cd <guest-path> && curl -s -m 10 -b cj -X POST http://localhost:3000/api/trpc/apiKeys.create -H 'content-type: application/json' -d '{"json":{"name":"coldpass-probe","scopes":["notes:read","notes:write"]}}' | python3 -c 'import json,sys; print(json.load(sys.stdin)["result"]["data"]["json"]["token"])' > apikey && chmod 600 apikey && wc -c apikey && export PATH=/tmp/node24/bin:$PATH BRAINSTACK_API_KEY=$(cat apikey) && node mcpcall.mjs create_note '{"path":"coldpass/probe-note.md","content":"# Coldpass probe\n\nMarker: coldpass-7f3a9c"}' 2>&1 | head -40
cd <guest-path> && export PATH=/tmp/node24/bin:$PATH BRAINSTACK_API_KEY=$(cat apikey) && node mcpcall.mjs get_note '{"path":"coldpass/probe-note.md"}' 2>&1 | head -40
export PATH=/tmp/node24/bin:$PATH NODE_USE_ENV_PROXY=1; cd <guest-path> && grep -rln 'pglite' packages/core/src | head -3; grep -n '"test"' packages/core/package.json; timeout 600 pnpm lint > <guest-path> 2>&1; echo LINT=$?; tail -3 <guest-path> | cut -c1-200; timeout 900 pnpm typecheck > <guest-path> 2>&1; echo TYPECHECK=$?; tail -3 <guest-path> | cut -c1-200
export PATH=/tmp/node24/bin:$PATH NODE_USE_ENV_PROXY=1; cd <guest-path> && sed -n 1,40p packages/skill/package.json | grep -n 'scripts' -A6; timeout 600 pnpm --filter @brainstack/skill build > <guest-path> 2>&1; echo SKILL=$?; tail -8 <guest-path> | cut -c1-200; ls packages/skill/dist 2>/dev/null | head; git -C <guest-path> status --short | head
cd <guest-path> && grep -rn 'setInterval\|cron\|schedule' apps/server/src packages/core/src --include=*.ts | grep -v test | head; sed -n 1,40p apps/server/src/services/Maintenance.ts | head -50
cd <guest-path> && grep -n 'export async function purgeExpired' -A12 apps/server/src/services/Maintenance.ts; grep -n 'return' apps/server/src/services/Maintenance.ts | tail -3; grep -n 'export function openPgDatabase\|export async function ensurePgSchema' -A3 packages/core/src/pg/*.ts | head -12
cat > <guest-path> <<'EOF'
// Runs ONE cycle of the server's hourly housekeeping (serve.ts: purgeExpired every 60 min),
// by hand, with the same database and logger the server uses. No source edits.
import { ensurePgSchema, openPgDatabase } from '@brainstack/core/pg';
import { purgeExpired } from '<guest-path>';
const { db, close } = openPgDatabase(process.env.DATABASE_URL);
try {
  await ensurePgSchema(db);
  const r = await purgeExpired(db, {});
  console.log(`hourly purge ran once: deleted=${r.deleted}`);
} finally {
  await close();
}
EOF
cd <guest-path> && export PATH=/tmp/node24/bin:$PATH && timeout 120 node --env-file=<guest-path> --import tsx <guest-path>; echo EXIT=$?
cd <guest-path> && ls packages/core/src/pg/ | head; grep -n '"./pg"' -A3 packages/core/package.json | head -6
cd <guest-path> && sed -i "s|from '@brainstack/core/pg';|from '<guest-path>';|" purge-once.mjs && head -4 purge-once.mjs && cd <guest-path> && export PATH=/tmp/node24/bin:$PATH && timeout 120 node --env-file=<guest-path> --import tsx <guest-path> 2>&1 | tail -5; echo EXIT=${PIPESTATUS[0]}
pkill -f 'tsx watch src/serve.ts' ; pkill -f 'brainstack/server dev'; sleep 3; (curl -s -m 3 -o /dev/null -w 'port3000=%{http_code}\n' http://localhost:3000/api/health || echo 'port3000 free'); pgrep -fa 'serve.ts' | head -3; echo done
(curl -s -m 3 -o /dev/null -w 'port3000=%{http_code}\n' http://localhost:3000/api/health || echo 'port3000 free'); ps -eo pid,args | grep -E 'serve.ts|server dev|tsx' | grep -v grep | head -5
cd <guest-path> && mkdir -p .coldpass && python3 -I - <<'EOF'
import json
key = open('<guest-path>').read().strip()
PNPM = '/tmp/node24/bin/pnpm'
PATH = '/tmp/node24/bin:/usr/local/bin:/usr/bin:/bin'
W = '<guest-path>'
SERVER = [PNPM, '--filter', '@brainstack/server', 'dev']
URL = 'http://localhost:3000/api/mcp'
HDR = {'Authorization': '<secret>' + key}
ENV = {'PATH': PATH, 'NODE_USE_ENV_PROXY': '1'}

probe = {
  "kind": "mcp_http",
  "argv": SERVER,
  "cwd": W,
  "url": URL,
  "env": ENV,
  "headers": HDR,
  "tool": "get_note",
  "arguments": {"path": "coldpass/probe-note.md"},
  "expected_text": "coldpass-7f3a9c",
}
claims = [
  {
    "kind": "claim",
    "claim": "The MCP server lets assistants read notes that were written to the brain",
    "source": "Assistants read and write the same notes through the MCP server",
    "input": "coldpass/probe-note.md",
    "expected": "the note body with the marker is returned",
    "probe_kind": "mcp_http",
    "argv": SERVER,
    "url": URL,
    "env": ENV,
    "headers": HDR,
    "tool": "get_note",
    "arguments": {"path": "coldpass/probe-note.md"},
    "expected_text": "coldpass-7f3a9c",
    "cwd": W,
  },
  {
    "kind": "claim",
    "claim": "The core package test suite runs on PGlite, in process, with no database",
    "source": "runs on PGlite, in process; no database needed",
    "input": "pnpm --filter @brainstack/core test",
    "expected": "all core test files pass",
    "probe_kind": "cli",
    "argv": [PNPM, '--filter', '@brainstack/core', 'test'],
    "env": ENV,
    "expected_text": "211 passed",
    "cwd": W,
  },
]
examples = [
  {"kind": "example", "claim": "Build the whole monorepo", "source": "README.md Local development",
   "input": "pnpm build", "expected": "web app and server build", "argv": [PNPM, 'build'],
   "cwd": W, "env": ENV, "expected_text": "apps/web build: Done"},
  {"kind": "example", "claim": "Lint the workspace", "source": "README.md Local development",
   "input": "pnpm lint", "expected": "no lint errors", "argv": [PNPM, 'lint'],
   "cwd": W, "env": ENV, "expected_text": "No ESLint warnings or errors"},
  {"kind": "example", "claim": "Build the skill for every major client", "source": "README.md Loading the skill",
   "input": "pnpm --filter @brainstack/skill build", "expected": "six client adapters built",
   "argv": [PNPM, '--filter', '@brainstack/skill', 'build'], "cwd": W, "env": ENV,
   "expected_text": "built 6 adapters"},
  {"kind": "example", "claim": "Run the full test suite", "source": "README.md Local development",
   "reason": "Ran pnpm test: packages/core passed 211/211 and apps/server passed 456-484 of 515 tests, but a vitest worker in apps/server crashed ('Worker exited unexpectedly') on each run, so pnpm test exits 1. Substitute: the core package test example above."},
]
cycles = {
  "detected": True,
  "checks": [{
    "claim": "The server runs housekeeping on its own every hour, after purging at boot",
    "source": "apps/server/src/serve.ts",
    "quote": "const purge = setInterval(() => {",
    "schedule": "every 60 minutes (60 * 60 * 1000 ms) in the long-running server; also once at boot",
    "method": "run-once wrapper: calls the same purgeExpired function once against the live DATABASE_URL, no source edits, no fake clock",
    "input": "current database state and wall clock",
    "expected": "one purge pass completes and reports the rows it deleted",
    "kind": "cli",
    "argv": ['/tmp/node24/bin/node', '--env-file=<guest-path>', '--import', 'tsx', '<guest-path>'],
    "cwd": W + '/apps/server',
    "env": ENV,
    "expected_text": "hourly purge ran once: deleted=",
  }],
}
json.dump(probe, open('.coldpass/probe.json','w'), indent=2)
json.dump(claims, open('.coldpass/claims.json','w'), indent=2)
json.dump(examples, open('.coldpass/examples.json','w'), indent=2)
json.dump(cycles, open('.coldpass/cycles.json','w'), indent=2)
print('ok')
EOF
ls -la .coldpass
cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo CHECK_EXIT=$?; tail -c 4000 <guest-path>
cd <guest-path> && python3 -I -c '
import json,sys
t=open("validate1.log").read()
i=t.find("{")
print(t[:600].replace("\\n","\n")[:600])
print("----")
for k in ("problems","errors","status","ok","valid"):
    print(k, k in t)
' ; grep -o '"problems": \[[^]]*\]' validate1.log | head -3; grep -o '"verdict": "[a-z]*"' validate1.log | sort | uniq -c; grep -o '"probe_check[^}]*' validate1.log | head -c 600
cd <guest-path> && grep -o '"status": "[A-Z]*"' validate1.log | sort | uniq -c; grep -o '"claim_checks"\|"probe"\|"claims"\|"cycles"\|"examples"' validate1.log | sort | uniq -c; grep -o '"outcome": "[^"]\{0,160\}' validate1.log | head -4; (curl -s -m 3 -o /dev/null -w 'port3000=%{http_code}\n' http://localhost:3000/api/health || echo 'port3000 free')
cd <guest-path> && python3 -I - <<'EOF'
import json
report = {
  "outcome": "working",
  "fault_owner": None,
  "operation": "Run the BrainStack server locally (README 'Local development': pnpm install, then pnpm --filter @brainstack/server dev) and create and read back a note through its MCP endpoint",
  "operation_scope": "Local development on one Linux VM (Ubuntu 24.04, 2 CPU, 4 GB) with a local PostgreSQL 16 database. Not the Docker quickstart (Docker not installed; not run). Not email, OAuth, or a hosted https domain. The MCP check uses a local API key created through the web API.",
  "steps": [
    "git init; git remote add origin https://github.com/Impulse-Labs-SAS/brainstack; git fetch --depth 1 origin 6fd684d6e57429d21f2cfeb16183f74a628b41a9; git reset --mixed FETCH_HEAD",
    "Install Node 24.22.1 (README engines >=24; .nvmrc = 24) from nodejs.org tarball into /tmp/node24; corepack enable (pnpm 10.30.3 from packageManager)",
    "pnpm install",
    "pnpm test (README Local development)",
    "pnpm build (README Local development)",
    "sudo apt-get install -y postgresql (PostgreSQL 16; README says 'Storage is any Postgres')",
    "cp apps/server/.env.example apps/server/.env; DATABASE_URL set to the local postgres",
    "pnpm --filter @brainstack/server dev (README: server on :3000, HTTP + MCP)",
    "POST /api/auth/signup and /api/auth/login (first account is owner); POST /api/trpc/apiKeys.create for a notes:read+notes:write key",
    "MCP streamable HTTP at /api/mcp: create_note then get_note (marker coldpass-7f3a9c returned)",
    "pnpm lint; pnpm typecheck; pnpm --filter @brainstack/skill build (README 'Loading the skill')",
    "pnpm --filter @brainstack/core test (the core part of pnpm test)"
  ],
  "deviations": [
    "The pinned snapshot had no .git; ran the git init/fetch/reset sequence from the task first.",
    "Node was not installed. Installed Node 24.22.1 from the official nodejs.org tarball into /tmp/node24 (no sudo needed). Running corepack first failed with 'env: node: No such file' only because PATH lacked node; fixed by setting PATH.",
    "Docker is not available in the VM, so the README's docker compose quickstart was not run. Used the README's local development path with a local PostgreSQL 16 from apt (sudo apt-get install -y postgresql).",
    "pnpm test exits 1 on every run I made. packages/core passes 211/211. apps/server finished 35-36 of 37 test files with 456-484 of 515 tests passing; one or two vitest workers died with 'Worker exited unexpectedly' (unhandled error). The worker crashes did not reproduce with a clear cause (no OOM line found). Probably a resource or flaky worker issue on this small VM, not a product logic failure, but it is unconfirmed.",
    "No browser or web UI was used. The first account and API key were created through the same HTTP API the web app calls, not the Settings UI.",
    "The MCP probe reads back a note created in setup (coldpass/probe-note.md) rather than creating it again, because create_note refuses existing paths and replay would fail.",
    "The cycle is a hand-run wrapper (<guest-path>, outside the repo) that calls the product's purgeExpired once. It did not wait an hour and used the real clock; it deleted 0 rows (nothing had expired)."
  ],
  "stuck_step": None,
  "main_blocker": None,
  "plain_failure": None,
  "suggested_fix": "Investigate the apps/server vitest worker crash ('Worker exited unexpectedly') that makes pnpm test exit 1 on small machines, e.g. by checking memory use of PGlite-heavy test files or capping test workers, so pnpm test passes on a clean 2 CPU, 4 GB VM."
}
json.dump(report, open('.coldpass/report.json','w'), indent=2)
print('report written')
EOF
<env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo CHECK_EXIT=$?; python3 -I -c 'import json;d=json.load(open("<guest-path>"))' 2>/dev/null; grep -o '"valid": [a-z]*, "problems": [^]]*\]' <guest-path>; grep -o '"status": "[A-Z]*"' <guest-path> | sort | uniq -c
cd <guest-path> && python3 -I - <<'EOF'
import json
p='.coldpass/report.json'
r=json.load(open(p))
r['operation_scope']="Local development on one Linux VM with a local PostgreSQL 16 database (apt). Docker was not available, so the docker compose quickstart was not run."
r['deviations']=[
 "The pinned snapshot had no .git; ran the git init/remote/fetch --depth 1/reset --mixed sequence from the task first.",
 "Node was not installed. Installed Node v24.22.1 from the official tarball into /tmp/node24 and put it on PATH (required for corepack's shebang).",
 "Docker is absent, so the README's docker compose quickstart was not run. Used the README local-development path with PostgreSQL 16 from apt as the 'any Postgres' store.",
 "pnpm test exited 1. The apps/server vitest run had a worker die with 'Worker exited unexpectedly' (an unhandled error) on two runs; 35-36 of 37 test files passed. The cause is unconfirmed (possibly memory on this small VM, possibly a repo test issue). packages/core tests passed (211), and that was used as the core-test claim.",
 "The owner account and API key were created through the same HTTP API the web app uses (signup, login, tRPC apiKeys.create), not through the web UI.",
 "The hourly purge was run once by a hand-written wrapper outside the repo (<guest-path>) calling purgeExpired, not by waiting an hour. It deleted 0 rows."
]
r['steps']=[
 "git init; git remote add origin https://github.com/Impulse-Labs-SAS/brainstack; git fetch --depth 1 origin 6fd684d6e57429d21f2cfeb16183f74a628b41a9; git reset --mixed FETCH_HEAD",
 "Install Node 24 (.nvmrc 24, engines >=24); corepack enable (pnpm 10.30.3)",
 "pnpm install",
 "pnpm build; pnpm lint; pnpm typecheck; pnpm test (exit 1, see deviations); pnpm --filter @brainstack/core test",
 "apt-get install postgresql (16); cp apps/server/.env.example apps/server/.env with DATABASE_URL pointing at the local DB",
 "pnpm --filter @brainstack/server dev (server on :3000 with HTTP and MCP at /api/mcp)",
 "POST /api/auth/signup, POST /api/auth/login, POST /api/trpc/apiKeys.create",
 "MCP streamable HTTP: create_note then get_note; get_note returned coldpass-7f3a9c",
 "pnpm --filter @brainstack/skill build"
]
r['suggested_fix']="Investigate the apps/server vitest 'Worker exited unexpectedly' crash that makes pnpm test exit 1 on a small (2 CPU) VM, for example by checking memory use of the PGlite-heavy test files or limiting test workers, and confirm it passes on a clean machine."
json.dump(r,open(p,'w'),indent=2); print("ok")
EOF
<env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo CHECK_EXIT=$?; tail -c 600 <guest-path>; echo; (ss -ltnp 2>/dev/null | grep -c ':3000 ')
cd <guest-path> && grep -o '"valid": [a-z]*, "problems": [^]]*\]' <guest-path>; ls <guest-path> | head -50; grep -l "Tests " <guest-path> 2>/dev/null | head; grep -h "Tests \|Test Files" <guest-path> 2>/dev/null | tail -8
cd <guest-path> && python3 -I - <<'EOF'
import re
p='.coldpass/examples.json'
s=open(p).read()
s=s.replace("apps/server passed 456-484 of 515 tests, but a vitest worker in apps/server crashed","apps/server ran most test files, but a vitest worker in apps/server crashed")
s=s.replace("35-36 of 37","most of the 37")
open(p,'w').write(s)
import json; json.loads(s); print("json ok", "515" in s, "456" in s)
p2='.coldpass/report.json'
r=open(p2).read().replace("35-36 of 37 test files passed","most test files passed")
open(p2,'w').write(r)
EOF
<env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo CHECK_EXIT=$?; grep -o '"valid": [a-z]*, "problems": [^]]*\]' <guest-path>; (ss -ltnp | grep -c ':3000 ')