VictorTaelin/uniichat

Review signals: 3 download and execute.

Source contains download and execute; review its purpose. 2 distinct locations. 3 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The server serves the UniiChat page at the address it prints: Real input produced the expected result: <title>UniiChat</title>

  Source: Then open http://127.0.0.1:8788 and type your email. With no mail key

  Input: GET http://127.0.0.1:8788/

  Expected: the HTML page with the UniiChat title

  Command: <guest-path> Server.ts

  Observed: <title>UniiChat</title> <link rel="icon" href="/favicon.svg"> <link rel="stylesheet" href="/style.css"> <script type="module" src="/app.js"></script> </head> <!-- the page, as a guest sees it until signed in (web/src/main.ts) --> <body class="guest"> <header> <button class="brand" data-go="/" data-act='{"$":"Goto","name":null}'><i class="mark"></i><span>UniiChat</span></button> <span class="net">offline</span> <button class="imping" popovertarget="import" hidden><span></span><progress max="1" value="0"></progress></button> <button class="credits" data-go="/account"></button> <button

Examples

• The README's test command runs the repository's tests: command completed successfully

  Source: README.md Other commands: bun run test

  Input: bun run test

  Expected: all 37 tests pass

  Command: <guest-path> run test

  Observed: ts title [1.37ms] Server.test.ts: (pass) Server.ts alone serves the page [199.09ms] unii: worker 1 ended (143) unii: worker 0 ended (143) (pass) with workers, Server.ts routes to them [206.39ms] (pass) a free server bills nothing: it says so, and shows no prices or terms [580.79ms] (pass) a turn's wait names the model it runs on, not one picked since [198.24ms] Tools.test.ts: (pass) a call's MCP requests follow its chat past a process that ended [19.94ms] View.test.ts: (pass) a turn's wait names its model [1.28ms] 37 pass 0 fail 9654 expect() calls Ran 37 tests across 11 files. [28.06s]

• The README's terminal client prints its usage: command completed successfully

  Source: README.md The unii terminal / Run it: bun Term.ts help

  Input: help

  Expected: usage text for unii

  Command: <guest-path> Term.ts help

  Observed: s address too), on your ANTHROPIC_API_KEY and OPENAI_API_KEY; chat with it: unii http://127.0.0.1:8788 unii help this UNII_WORK: where the agent works on this computer (default ~/.unii/work). UNII_COMPUTER=1: it may use the screen. UNII_HOME: where it keeps its sign-in (default ~/.unii). Once a day, unii asks bend-lang.com for the latest version, sending only its version, OS and CPU type, and whether this computer ever ran its own server. UNII_NO_TELEMETRY=1 turns that off. In the chat, /help lists every command and key.

Local or hosted: both

Run the UniiChat server from source (bun Server.ts) and read a real endpoint, /api/hello, which returns the chat's greeting; plus the README's test suite (bun run test).

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -200
ls <guest-path> ; ls <guest-path> 2>&1; ls /inputs 2>&1
cd <guest-path> && ls -la .coldpass; which bun node npm curl unzip 2>&1; bun --version 2>&1; cat package.json; cat .gitignore; ls .github/*; echo; grep -n "cron\|--once\|--now\|setInterval\|schedule" Server.ts | head -20
cd /tmp && export NODE_USE_ENV_PROXY=1 && curl -fsSL https://bun.sh/install -o /tmp/bun-install.sh; echo "curl rc=$?"; (bash /tmp/bun-install.sh 2>&1 | tail -15); ls -la ~/.bun/bin 2>&1; ~/.bun/bin/bun --version 2>&1
sudo -n apt-get install -y unzip 2>&1 | tail -3 || true; (sudo -n apt-get update -qq 2>&1 | tail -2; sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq unzip 2>&1 | tail -3); which unzip
export NODE_USE_ENV_PROXY=1; bash /tmp/bun-install.sh 2>&1 | tail -8; ls -la $HOME/.bun/bin/bun 2>&1; $HOME/.bun/bin/bun --version 2>&1
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && git init -q && git remote add origin https://github.com/VictorTaelin/uniichat && timeout 120 git fetch --depth 1 origin 0500bf6a8ea4bf0ce047488562022b1b6532cc30 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1 2>&1; git status --short | head -5
cd <guest-path> && export PATH=<guest-path> && bun --version && timeout 900 bun run test 2>&1 | tail -40; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && sed -n 1,60p Server.ts | cut -c1-200; grep -n "url.pathname\|pathname ===\|startsWith(\"/" Server.ts | head -60
cd <guest-path> && export PATH=<guest-path> && export UNII_DIR=<guest-path> && (nohup bun Server.ts > <guest-path> 2>&1 &) ; sleep 5; cat <guest-path>; echo ---; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8788/; curl -s http://127.0.0.1:8788/ | head -c 400; echo; ls <guest-path> 2>&1
cd <guest-path> && grep -n '"/api/[a-z_/]*"\|"/[a-z]*"' Server.ts | cut -c1-220 | head -40; grep -n "sign\|email_ask\|link" Cloud.ts | head -20 | cut -c1-200
cd <guest-path> && sed -n 1500,1530p Server.ts | cut -c1-220; sed -n 1566,1572p Server.ts | cut -c1-200; grep -n "function act\|apply(" Server.ts | head; grep -n "\"/api/wait\"\|/api/wait\|/api/link\|/api/hello" Server.ts | head
curl -s -w "\nHTTP %{http_code}\n" http://127.0.0.1:8788/api/hello; echo; cd <guest-path> && grep -n "HELLO\s*=" Server.ts | cut -c1-250; grep -n "hello.md\|HELLO" Server.ts | head -5 | cut -c1-200; cat hello.md
cd <guest-path> && export PATH=<guest-path> && timeout 30 bun Term.ts help 2>&1 | head -40; echo "rc=$?"
cd <guest-path> && grep -n "isTTY\|stdin\|argv\[2\]\|process.argv" Term.ts | cut -c1-200 | head -30; grep -n "update_check\|NO_TELEMETRY" Term.ts | cut -c1-160 | head
cd <guest-path> && sed -n 60,140p Term.ts | cut -c1-200
pkill -f "bun Server.ts"; sleep 2; pgrep -fa "Server.ts" || echo "no server running"; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8788/ || echo "port closed"; cd <guest-path> && grep -n "Then open http://127.0.0.1:8788\|You need \[Bun\]\|bun run test\|Your chats live\|bun Term.ts http://127.0.0.1:8788" README.md
ps -eo pid,args | grep "[S]erver.ts" ; for p in $(ps -eo pid,args | grep "[b]un Server" | awk '{print $1}'); do kill $p; done; sleep 2; ps -eo pid,args | grep "[S]erver.ts" || echo "no server running"; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:8788/ || echo "port closed"; cd <guest-path> && grep -n "Then open http://127.0.0.1:8788\|You need \[Bun\]\|bun run test\|bun Term.ts http://127.0.0.1:8788" README.md
cd <guest-path> && grep -rn "cron\|--once\|--now\|TICK\b" --include=*.ts . | grep -v node_modules | cut -c1-200 | head -15; grep -n "const TICK" View.ts | cut -c1-200
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"http","argv":["<guest-path>","Server.ts"],"cwd":"<guest-path>","url":"http://127.0.0.1:8788/api/hello","env":{"UNII_DIR":"<guest-path>","UNII_NO_TELEMETRY":"1"},"expected_text":"This is UniiChat."}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"The server serves the UniiChat page at the address it prints","source":"Then open http://127.0.0.1:8788 and type your email. With no mail key","input":"GET http://127.0.0.1:8788/","expected":"the HTML page with the UniiChat title","probe_kind":"http","argv":["<guest-path>","Server.ts"],"url":"http://127.0.0.1:8788/","env":{"UNII_DIR":"<guest-path>","UNII_NO_TELEMETRY":"1"},"expected_text":"<title>UniiChat</title>","cwd":"<guest-path>"}]
EOF
cat > examples.json <<'EOF'
[{"kind":"example","claim":"The README's test command runs the repository's tests","source":"README.md Other commands: bun run test","input":"bun run test","expected":"all 37 tests pass","argv":["<guest-path>","run","test"],"cwd":"<guest-path>","env":{},"expected_text":" 37 pass"},
{"kind":"example","claim":"The README's terminal client prints its usage","source":"README.md The unii terminal / Run it: bun Term.ts help","input":"help","expected":"usage text for unii","argv":["<guest-path>","Term.ts","help"],"cwd":"<guest-path>","env":{"UNII_NO_TELEMETRY":"1"},"expected_text":"Usage: unii [url]"}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: README.md (bun Server.ts, bun Term.ts, bun run test, bun run web, bun build --compile); Server.ts and Term.ts have no cron, --once, --now or scheduled job. The only setInterval/TICK in the source are a rate-limit cleanup and a WebSocket keepalive, not product cycles. Chats are driven by user messages and turns.","checks":[]}
EOF
for f in probe claims examples cycles; do python3 -m json.tool $f.json >/dev/null && echo "$f ok"; done; python3 -c "import json;print(json.load(open('<guest-path>')))" | head -c 300
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "rc=${PIPESTATUS[0]}"
ps -eo pid,args | grep "[S]erver.ts" || echo "no server running"; cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the UniiChat server from source (bun Server.ts) and read a real endpoint, /api/hello, which returns the chat's greeting; plus the README's test suite (bun run test).","operation_scope":"Linux guest, Bun 1.4.4, no Anthropic/OpenAI API key, no mail key. Server on 127.0.0.1:8788. Sign-in, chatting and the unii terminal chat were not exercised: they need a model API key or an interactive terminal. The test suite passed 37 of 37 tests.","steps":["git init; git remote add origin https://github.com/VictorTaelin/uniichat; git fetch --depth 1 origin 0500bf6a8ea4bf0ce047488562022b1b6532cc30; git reset --mixed FETCH_HEAD","curl -fsSL https://bun.sh/install | bash (README prerequisite: Bun), after installing unzip","bun run test (README: Other commands)","bun Server.ts (README: Run it), with UNII_DIR=<guest-path> and UNII_NO_TELEMETRY=1","curl http://127.0.0.1:8788/api/hello returned the greeting 'This is UniiChat.'","bun Term.ts help (README: The unii terminal)"],"deviations":["Bun was not installed in the guest. First run of the official bun.sh installer failed: 'error: unzip is required to install bun'. Fixed with: sudo apt-get update, then sudo apt-get install -y unzip (the first apt-get install without update failed with 'Unable to locate package unzip'). Then re-ran the same bun.sh installer, which installed Bun 1.4.4 to <guest-path> (HOME in this guest).","Bun is invoked by absolute path <guest-path> because the installer's PATH change was not applied to the shell.","UNII_DIR set to <guest-path> (README default is ~/.unii) so the run stays in a disposable location; UNII_NO_TELEMETRY=1 set so the terminal client makes no daily call to bend-lang.com.","No Anthropic or OpenAI key was available, so no chat or model call was made; the README's sign-in flow was not completed. The server runs without a key and serves its pages.","The workspace had no .git; git init and the pinned fetch/reset were run as instructed. Working tree files were not modified."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None needed for the tested path. For a full run, the README could list unzip as a prerequisite for the bun.sh installer, and the server's model-call path needs an ANTHROPIC_API_KEY (or OPENAI_API_KEY) which was not tested."}
EOF
python3 -m json.tool .coldpass/report.json >/dev/null && echo "report ok"; ls -la .coldpass
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json; d=json.loads(sys.stdin.read()); print('valid:',d['valid'],'problems:',d['problems'],'replay:',d['replay']['status'])"; curl -s -o /dev/null -w "port8788 %{http_code}\n" http://127.0.0.1:8788/ || echo "port 8788 closed"