Shoberman2/openWorld

Review signals: 1 connection review, 2 download and execute.

Reviewed as expected for a test run: resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 3 distinct locations. 6 attributed processes.

Source contains download and execute; review its purpose. server/providers/grok.ts 2 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The character rigs can be re-downloaded with npm run models: Real input produced the expected result: node scripts/fetch-models.mjs

  Source: `npm run models` to retry

  Input: npm run models

  Expected: the documented fetch script runs and exits 0 (rigs already present, so no re-download)

  Command: npm run models

  Observed: node scripts/fetch-models.mjs

Examples

• Typecheck the TypeScript project before a pull request: command completed successfully

  Source: CONTRIBUTING.md: Before you open a pull request

  Input: npm run typecheck

  Expected: tsc completes with no errors

  Command: npm run typecheck

  Observed: > [email protected] typecheck > tsc --noEmit

• Build the client before a pull request: command completed successfully

  Source: CONTRIBUTING.md: Before you open a pull request

  Input: npm run build

  Expected: Vite builds the client bundle

  Command: npm run build

  Observed: l 1.61 kB │ gzip: 0.70 kB client/dist/assets/tilemap.worker-B0geajbE.js 21.76 kB client/dist/assets/worker-BYabsMYE.js 221.42 kB client/dist/assets/index-BTWetR7H.css 92.39 kB │ gzip: 19.50 kB client/dist/assets/index-iDACb_V9.js 1,947.01 kB │ gzip: 632.66 kB ✓ built in 896ms [INEFFECTIVE_DYNAMIC_IMPORT] client/src/ui/settings.ts is dynamically imported by client/src/ui/agentPick.ts but also statically imported by client/src/landing/index.ts, client/src/main.ts, dynamic import will not move module into another chunk.

• Retry downloading the character rigs: command completed successfully

  Source: README.md: Credits

  Input: npm run models

  Expected: exits 0; rigs already present and checksum-verified so silent output

  Command: npm run models

  Observed: > [email protected] models > node scripts/fetch-models.mjs

Cycles

• Project-lead schedules run a worker agent on their daily or weekly hour: Prerequisite missing: no GitHub account connected in this guest (no GITHUB_TOKEN, no gh login). createSchedule() calls findRepo() first, and /api/talk returned {"error":"GitHub is not connected"} on this VM. Without a repo there is no schedule and no agent run, so no manual cycle was triggered.

  Source: server/schedules.ts

  Observed: Prerequisite missing: no GitHub account connected in this guest (no GITHUB_TOKEN, no gh login). createSchedule() calls findRepo() first, and /api/talk returned {"error":"GitHub is not connected"} on this VM. Without a repo there is no schedule and no agent run, so no manual cycle was triggered.

Local or hosted: local

Run OpenWorld locally with the README's npm start, then use its place-search API to find a real place (Eiffel Tower) and get back its coordinates

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat /etc/os-release | head -3; ls /inputs 2>/dev/null
cd <guest-path> && find . -maxdepth 2 -not -path './.git*' | head -100; echo ---; cat README.md 2>/dev/null | head -200
cd <guest-path> && sed -n '200,400p' README.md; echo ---; node --version 2>&1; npm --version 2>&1; which git curl; cat package.json
apt-cache policy nodejs 2>&1 | head -5; sudo -n true && echo SUDO_OK; env | grep -i proxy | sed 's/=.*@/=***@/' ; curl -sI https://nodejs.org/dist/index.json | head -1
cd /tmp && curl -fsSL https://deb.nodesource.com/setup_22.x -o /tmp/ns_setup.sh && echo DL_OK; sudo -n bash /tmp/ns_setup.sh 2>&1 | tail -5; sudo -n apt-get install -y nodejs 2>&1 | tail -3; node --version; npm --version
cd <guest-path> && git init -q && git remote add origin https://github.com/Shoberman2/openWorld.git && timeout 120 git fetch --depth 1 origin 969b75b698359477a96c81d3277aa2752c199ab1 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1 2>&1; git status --short | head -20
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm install 2>&1 | tail -25; echo "EXIT=${PIPESTATUS[0]}"; ls -la client/public/models 2>/dev/null | head
cd <guest-path> && ls -a; ls .github/workflows 2>/dev/null; grep -n "app\.\(get\|post\|put\)(" server/*.ts | head -60; grep -n "PORT\|listen(" server/index.ts | head
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm run typecheck 2>&1 | tail -5; echo "TC=${PIPESTATUS[0]}"; npm run build 2>&1 | tail -6; echo "BUILD=${PIPESTATUS[0]}"
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && (nohup npm start > /tmp/ow-server.log 2>&1 & echo $! > /tmp/ow-server.pid); for i in $(seq 1 40); do curl -s -o /dev/null http://localhost:4317/api/me && break; sleep 1; done; tail -15 /tmp/ow-server.log; echo ---; curl -s http://localhost:4317/api/me; echo; curl -s http://localhost:4317/api/stats | head -c 600; echo; curl -s http://localhost:4317/api/schedules | head -c 400
cd <guest-path> && cat server/schedules.ts | head -200
cd <guest-path> && sed -n 125,150p server/index.ts; echo ---; grep -n "DRY_GITHUB" server/*.ts | head; echo ---; curl -s -X POST http://localhost:4317/api/talk -H 'content-type: application/json' -d '{"message":"hello"}' | head -c 800; echo
cd <guest-path> && curl -s 'http://localhost:4317/api/geo/search?q=Eiffel%20Tower' | head -c 500; echo; echo ---; curl -s -X POST http://localhost:4317/api/office/message -H 'content-type: application/json' -d '{"text":"hello HQ"}' | head -c 700; echo; echo ---; curl -s http://localhost:4317/api/briefing | head -c 400; echo; echo ---; sed -n 183,200p server/office.ts
cd <guest-path> && kill $(cat /tmp/ow-server.pid) 2>/dev/null; pkill -f "server/index.ts" 2>/dev/null; sleep 2; curl -s -o /dev/null -w "%{http_code}\n" http://localhost:4317/api/me || echo "port 4317 free"; echo ---; cat CONTRIBUTING.md | head -60; echo ---; grep -n "npm run\|test" docs/experiments.md | head; echo ---; cat scripts/fetch-models.mjs | head -40
curl -s -o /dev/null -w "%{http_code}\n" http://localhost:4317/api/me; echo "rc=$?"; ps aux | grep -c "[t]sx" 
cd <guest-path> && cat CONTRIBUTING.md | head -60; echo ---; grep -n "npm run\|test" docs/experiments.md | head; echo ---; sed -n 1,40p scripts/fetch-models.mjs
cd <guest-path> && grep -n "npm start\` builds" README.md; grep -n "Eiffel\|Search any place" README.md | head -3; ls <guest-path> 2>&1; ls /inputs 2>&1; mkdir -p .coldpass && ls -la .coldpass
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"http","argv":["npm","start"],"cwd":"<guest-path>","url":"http://localhost:4317/api/geo/search?q=Eiffel%20Tower","env":{"NODE_USE_ENV_PROXY":"1"},"expected_text":"Eiffel Tower, Paris, France"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"Prefer one process? npm start builds the client once and serves everything on the local port 4317","source":"`npm start` builds the client once and serves everything on http://localhost:4317.","input":"npm start","expected":"server starts and reports it is serving on http://localhost:4317","probe_kind":"cli","argv":["npm","start"],"stays_running":true,"expected_text":"OpenWorld server on http://localhost:4317","cwd":"<guest-path>","env":{"NODE_USE_ENV_PROXY":"1"}}]
EOF
cat > examples.json <<'EOF'
[{"kind":"example","claim":"Typecheck the TypeScript project before a pull request","source":"CONTRIBUTING.md: Before you open a pull request","input":"npm run typecheck","expected":"tsc completes with no errors","argv":["npm","run","typecheck"],"cwd":"<guest-path>","env":{},"expected_text":"tsc --noEmit"},{"kind":"example","claim":"Build the client before a pull request","source":"CONTRIBUTING.md: Before you open a pull request","input":"npm run build","expected":"Vite builds the client bundle","argv":["npm","run","build"],"cwd":"<guest-path>","env":{},"expected_text":"built in"},{"kind":"example","claim":"Retry downloading the character rigs","source":"README.md: Credits","input":"npm run models","expected":"exits 0; rigs already present and checksum-verified so silent output","argv":["npm","run","models"],"cwd":"<guest-path>","env":{"NODE_USE_ENV_PROXY":"1"}}]
EOF
cat > cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"Project-lead schedules run a worker agent on their daily or weekly hour","source":"server/schedules.ts","quote":"setInterval(() => void tick(), 60_000).unref();","schedule":"every 60 seconds, runs schedules whose nextRunAt is due","method":"blocked: needs a connected GitHub account to create a schedule (findRepo) and an agent run","reason":"Prerequisite missing: no GitHub token or gh login in this guest; POST /api/schedules returns 'GitHub is not connected' path. No substitute trigger was run.","kind":"none"}]}
EOF
for f in probe claims examples cycles; do python3 -I -c "import json,sys;json.load(open('$f.json'));print('$f ok')"; done
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo "RC=${PIPESTATUS[0]}"
ps -eo pid,args | grep -E "[n]pm|[t]sx|[n]ode " | head; curl -s -o /dev/null -w "%{http_code}\n" http://localhost:4317/api/me; echo ---; grep -n "stays_running\|staysRunning\|window\|120" <guest-path> | head -40
kill 9007 8996 8964 2>/dev/null; sleep 3; curl -s -o /dev/null -w "%{http_code}\n" http://localhost:4317/api/me; ps -eo pid,args | grep -E "[s]erver/index.ts" || echo "no server processes"
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/validate2.json 2>&1; echo "RC=$?"; python3 -I -c "
import json
d=json.load(open('/tmp/validate2.json'))
print('valid:',d.get('valid')); print('problems:',d.get('problems'))
r=d.get('replay',{}); print('replay status:',r.get('status'))
for c in r.get('claims',[]): print('CLAIM',c.get('verdict'),c.get('outcome'))
for c in r.get('example_checks',[]): print('EX',c.get('verdict'),c.get('outcome'))
for c in r.get('cycle_checks',[]): print('CYC',c.get('verdict'))
print('probe:', r.get('details',{}).get('working'), r.get('details',{}).get('status'))
" 2>&1 | tail -30
grep -n "def run_until_text" -A40 <guest-path> | head -70; sed -n 900,915p <guest-path>
grep -n "PRODUCT_SECONDS\s*=\|START_GRACE_SECONDS\s*=\|def product_env" -A6 <guest-path> | head -40; grep -n "def stop_server" -A8 <guest-path>
sed -n 668,690p <guest-path>
cd <guest-path> && cat > claims.json <<'EOF'
[{"kind":"claim","claim":"The character rigs can be re-downloaded with npm run models","source":"`npm run models` to retry","input":"npm run models","expected":"the documented fetch script runs and exits 0 (rigs already present, so no re-download)","probe_kind":"cli","argv":["npm","run","models"],"expected_text":"node scripts/fetch-models.mjs","cwd":"<guest-path>","env":{"NODE_USE_ENV_PROXY":"1"}}]
EOF
cat > cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"Project-lead schedules run a worker agent on their daily or weekly hour","source":"server/schedules.ts","quote":"setInterval(() => void tick(), 60_000).unref();","schedule":"every 60 seconds, runs schedules whose nextRunAt is due","method":"blocked: no substitute run","reason":"Prerequisite missing: no GitHub account connected in this guest (no GITHUB_TOKEN, no gh login). createSchedule() calls findRepo() first, and /api/talk returned {\"error\":\"GitHub is not connected\"} on this VM. Without a repo there is no schedule and no agent run, so no manual cycle was triggered.","kind":"none"}]}
EOF
python3 -I -c "import json;[json.load(open(f)) for f in ['claims.json','cycles.json']];print('ok')"; cd .. && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/validate3.json 2>&1; echo "RC=$?"; python3 -I -c "
import json
d=json.load(open('/tmp/validate3.json'))
print('valid:',d.get('valid')); print('problems:',d.get('problems'))
r=d.get('replay',{}); print('replay status:',r.get('status'))
for c in r.get('claims',[]): print('CLAIM',c.get('verdict'),c.get('outcome'),c.get('evidence','')[:120])
for c in r.get('example_checks',[]): print('EX',c.get('verdict'),c.get('outcome'))
for c in r.get('cycle_checks',[]): print('CYC',c.get('verdict'))
" 2>&1 | tail -20
cd <guest-path> && curl -s -o /dev/null -w "4317:%{http_code}\n" http://localhost:4317/api/me; ps -eo pid,args | grep -E "[s]erver/index.ts" || echo "no server processes left"; mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": null,
  "operation": "Run OpenWorld locally with the README's npm start, then use its place-search API to find a real place (Eiffel Tower) and get back its coordinates",
  "operation_scope": "Local only, no accounts. Needs Node.js 22.9+ and git. GitHub is not connected, so repo buildings, schedules and agent runs were not exercised; those need a GitHub token or gh login. No AI key was set, so HQ replies only with a setup message.",
  "steps": [
    "git clone is replaced by the pinned fetch: git init; git remote add origin https://github.com/Shoberman2/openWorld.git; git fetch --depth 1 origin 969b75b698359477a96c81d3277aa2752c199ab1; git reset --mixed FETCH_HEAD",
    "Install Node.js 22 (NodeSource setup_22.x script, then apt-get install nodejs): node v22.23.4, npm 10.9.9",
    "npm install (also runs postinstall scripts/fetch-models.mjs, which fetched Xbot.glb and Soldier.glb)",
    "npm run typecheck (passes)",
    "npm run build (passes)",
    "npm start (builds client, serves http://localhost:4317)",
    "GET http://localhost:4317/api/geo/search?q=Eiffel%20Tower returns Eiffel Tower, Paris, France (lat 48.858, lon 2.295)",
    "npm run models (documented retry; exits 0)"
  ],
  "deviations": [
    "Node.js and npm were not installed in the guest; installed Node 22 via NodeSource (curl -fsSL https://deb.nodesource.com/setup_22.x then sudo bash, then sudo apt-get install -y nodejs). The README requires Node 22.9+ but gives no install command.",
    "The workspace was not a git checkout; ran the pinned git init/fetch/reset steps from the task instructions.",
    "The claim for 'npm start ... serves everything on http://localhost:4317' could not be replayed: the checker's claim path does not honor stays_running and waits for the process to exit, so it timed out after 120 s. Replaced with the README's 'npm run models to retry' command, which exits on its own. The server itself is covered by the HTTP probe.",
    "After the first replay, the HTTP probe's npm start server (pids 8964, 8996, 9007) was still running and held port 4317. I stopped those PIDs by hand and re-ran the checker.",
    "/inputs/coldpass-preflight.py does not exist in this guest; ran <guest-path> with the same flags instead.",
    "The scheduler cycle was not triggered: schedules need a connected GitHub repo, and none is available here. Recorded as detected:true with a blocked check and its reason."
  ],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": "For a full test, connect a GitHub account (gh auth login or GITHUB_TOKEN in .env) and an AI key, then exercise repo buildings, desk talk, agent runs and scheduled runs. The README's 'npm start' claim should be replayed with a server-capable checker, or documented as a probe only."
}
EOF
python3 -I -c "import json;d=json.load(open('.coldpass/report.json'));print('report ok:',d['outcome'])"; ls -la .coldpass
kill 9437 9426 9394 2>/dev/null; sleep 3; curl -s -o /dev/null -w "4317:%{http_code}\n" http://localhost:4317/api/me; ps -eo pid,args | grep -E "[s]erver/index.ts" || echo "no server processes left"
cd <guest-path> && python3 -I -c "
import json
p='.coldpass/report.json'
d=json.load(open(p))
d['deviations'].append('The checker replay of the HTTP probe (npm start) left its server running on port 4317 after the run; I stopped it by PID after each replay. The final server state is stopped.')
json.dump(d,open(p,'w'),indent=2); print('report updated')
"; python3 -I -c "import json;json.load(open('.coldpass/report.json'));print('valid json')"