bangyen/esolangs

Review signals: 77 known vulnerability. 3 static matches retained as context.

OSV reports a known vulnerability in this dependency version. 5 distinct locations. 77 findings.

3 encoded blob matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• generate writes an 11-character XOR program for the truth table 0110: Real input produced the expected result: ))>>~>~<<<(

  Source: `esolangs generate 'bit~' 0110` emits 11 characters computing XOR:

  Input: bit~ 0110

  Expected: ))>>~>~<<<(

  Command: <guest-path> generate 'bit~' 0110

  Observed: ))>>~>~<<<(

• run feeds the program one input row at a time and prints the answer bit: Real input produced the expected result: 1

  Source: `run` fed it one input row at a time.

  Input: brainfuck xor.bf with stdin 01

  Expected: 1

  Command: <guest-path> run --timeout 5 brainfuck <guest-path>

  Observed: 1

Examples

• list shows every language: command completed successfully

  Source: README.md ## Command line

  Input: list

  Expected: brainfuck listed

  Command: <guest-path> list

  Observed: rement Cyclic tag Deadfish Decleq Dig Dimensional EGL Eval FALSE FRACTRAN Fackward Fargo Fish Flowchart Forbin Forþ Freestajlo Grapheme HQ9+ Home Row Hot INTERCAL Inject Interprogck8 Kiss LaserFuck Line Malbolge Minifuck Minsky Swap Modulous NOR machine Nope. Object disoriented Packlang Painfuck Piet Pilas Pointless Polynomial Qoibl Quassaunt RAM0 ROTfuck Rubic S*bleq SLOW ACV MAMMALIAN SStack SendStuff Smallfuck Smu Sonata Stisp Streetcode Subleq Suffolk Super SNUSP SwitchCase Taglate Thue Tiangou Unary Underload Unlambda Unsquare What!? bit~ brainfuck lol waht i cant edit talk pages thisthat

• generate and run the Try-it brainfuck XOR program: command completed successfully

  Source: README.md ## Try it

  Input: generate brainfuck 0110

  Expected: brainfuck XOR program

  Command: <guest-path> generate brainfuck 0110

  Observed: ,------------------------------------------------[->>+<[->-<]>[-<+>]<<],------------------------------------------------[->>+<[->-<]>[-<+>]<<]>++++++++++++++++++++++++++++++++++++++++++++++++.

Local or hosted: local

Install the esolangs package from the pinned source and generate a brainfuck XOR program from a truth table, then run it on input rows (README 'Try it' and 'Command line').

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -150
cd <guest-path> && cat .python-version; ls .coldpass; ls docs scripts checks; grep -n -A5 "^\[project" pyproject.toml | head -30; sed -n 1,60p docs/CONTRIBUTING.md 2>/dev/null | head -60; which uv pip3 python3.12
cd /tmp && python3.12 -m venv <guest-path> && <guest-path> install -q --upgrade pip && <guest-path> install esolangs 2>&1 | tail -5; <guest-path> --help | head -30
cd /tmp && <guest-path> uninstall -y -q esolangs && <guest-path> install <guest-path> 2>&1 | tail -3; <guest-path> --version; cd <guest-path> && git status 2>/dev/null; ls
rm -rf <guest-path>; mkdir -p <guest-path> && cd <guest-path> && E=<guest-path>; $E generate brainfuck 0110 > xor.bf; echo "gen rc=$?"; cat xor.bf; echo; for i in 00 01 10 11; do printf $i | $E run --timeout 5 brainfuck xor.bf; echo " <- $i"; done; $E generate 'bit~' 0110; echo; $E list --details | head -5
cd <guest-path> && grep -rniE "cron|schedul|--once|--now|webhook|while True|daemon" src/esolangs/*.py scripts/*.py 2>/dev/null | head -10; ls src/esolangs | head -40; <guest-path> run --help | head -12
cd <guest-path> && head -12 src/esolangs/_cycles.py; grep -n "README" -r tests/*.py | head -3; grep -n "Try it" -A2 README.md | head -3
cd <guest-path> && E=<guest-path> && cat > .coldpass/claims.json <<'EOF'
[
 {"kind":"claim","claim":"generate writes an 11-character XOR program for the truth table 0110","source":"`esolangs generate 'bit~' 0110` emits 11 characters computing XOR:","input":"bit~ 0110","expected":"))>>~>~<<<(","probe_kind":"cli","argv":["<guest-path>","generate","bit~","0110"],"expected_text":"))>>~>~<<<(","cwd":"<guest-path>"},
 {"kind":"claim","claim":"run feeds the program one input row at a time and prints the answer bit","source":"`run` fed it one input row at a time.","input":"brainfuck xor.bf with stdin 01","expected":"1","probe_kind":"cli","argv":["<guest-path>","run","--timeout","5","brainfuck","<guest-path>"],"stdin":"01","expected_text":"1","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","generate","brainfuck","0110"],"cwd":"<guest-path>","expected_text":"[->>+<[->-<]>[-<+>]<<]"}
EOF
cat > .coldpass/examples.json <<'EOF'
[
 {"kind":"example","claim":"list shows every language","source":"README.md ## Command line","input":"list","expected":"brainfuck listed","argv":["<guest-path>","list"],"cwd":"<guest-path>","expected_text":"brainfuck"},
 {"kind":"example","claim":"generate and run the Try-it brainfuck XOR program","source":"README.md ## Try it","input":"generate brainfuck 0110","expected":"brainfuck XOR program","argv":["<guest-path>","generate","brainfuck","0110"],"cwd":"<guest-path>","expected_text":"[->>+<[->-<]>[-<+>]<<]"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected (pyproject [project.scripts] esolangs=esolangs.cli:main, README CLI and Python API). No cron, scheduler, daemon, --once/--now or webhook is documented; src/esolangs/_cycles.py is an interpreter halt/cycle detector for program state, not a product loop. Product runs as one-shot CLI commands.","checks":[]}
EOF
for f in .coldpass/*.json; do <guest-path> -m json.tool $f >/dev/null 2>&1 || python3 -c "import json,sys;json.load(open('$f'))" && echo "ok $f"; done
ls -la <guest-path> /inputs/ 2>&1 | head; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install the esolangs package from the pinned source and generate a brainfuck XOR program from a truth table, then run it on input rows (README 'Try it' and 'Command line').","operation_scope":"Linux guest, Python 3.12.3 venv at <guest-path> (README requires 3.12+; repo .python-version says 3.14 but the 3.12 venv works), esolangs 1.4.0 installed from <guest-path>, no network services or credentials needed.","steps":["python3.12 -m venv <guest-path>","pip install <guest-path> (pinned snapshot; README shows 'pip install esolangs')","esolangs generate brainfuck 0110 > xor.bf","printf $i | esolangs run --timeout 5 brainfuck xor.bf for 00,01,10,11 -> 0,1,1,0","esolangs generate 'bit~' 0110 -> ))>>~>~<<<(","esolangs list --details"],"deviations":["README's 'pip install esolangs' installs PyPI 1.3.0; I installed the pinned repo snapshot (1.4.0) instead so the probes test the source under review.","The Try-it shell loop was not run as a shell loop (sh -c is disallowed); each run was replayed as a single esolangs run call with a stdin row.","The task's /inputs/coldpass-preflight.py path does not exist in this guest; used <guest-path> instead.","pip install created a build/ directory in the workspace; removed it after install.","Repo tests (just test-quick, CONTRIBUTING.md) were not run: the README does not document them and they need just and the dev toolchain."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the README quickstart."}
EOF
python3 -c "import json;json.load(open('.coldpass/report.json'));print('ok')"; ls -la .coldpass; ls <guest-path> | grep -c build
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json; d=json.loads(sys.stdin.read()); print(d['valid'], d['problems'], d['replay']['status'])"