chenglou/handwired

Review signals: 1 connection review, 11 hardcoded secret, 1 sensitive read.

Reviewed as expected for a test run: read only test files inside the test workspace or its temporary folders.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 24 distinct locations. 8 attributed processes.

Gitleaks found a possible hardcoded secret; value withheld. 7 distinct locations. 11 findings.

A repository process attempted to read this sensitive path. <guest-path> 7 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• bun install sets up the repo's dependencies so bun start can run: Real input produced the expected result: Checked 37 installs across 119 packages

  Source: `git clone && bun install`, then `bun start` to run them locally.

  Input: existing checkout with dependencies installed

  Expected: dependencies are present and checked

  Command: <guest-path> install

  Observed: Checked 37 installs across 119 packages (no changes) [30.00ms]

Examples

• Type-check and lint the repo: command completed successfully

  Source: README.md Running section (bun run check)

  Input: none

  Expected: 0 warnings and 0 errors

  Command: <guest-path> run check

  Observed: ab/ui-exploration/text-tabulated bunx tsc -p lab/ui-exploration/text-walker bunx tsc -p lab/ui-exploration/user-population bunx oxlint --type-aware knip.config.ts src tests scripts template lab/candidate-gallery lab/cascade-argmax lab/data-adapter lab/event-window lab/generative-fields lab/hard-attend lab/json-search lab/knuth-plass lab/learned-interpreter lab/recovery-lr lab/recovery-parser lab/recovery-toml lab/reusable-layout lab/runtime-cost lab/trace-compiler lab/user-effort Found 0 warnings and 0 errors. Finished in 5.4s on 618 files with 110 rules using 2 threads. $ bun scripts/check.ts

• Run one folder's tests: command completed successfully

  Source: README.md Running section (bun test tests/runtime)

  Input: tests/runtime

  Expected: 0 fail

  Command: <guest-path> test tests/runtime

  Observed: exactly Math.min, Math.max and the clamp, including mixed magnitudes and subnormal values [11.01ms] tests/runtime/prefix-networks.test.ts: (pass) prefix networks > every prefix is the ordered combination of its items, for 1 to 70 items [8.09ms] (pass) prefix networks > combines and longest chains follow the formulas for powers of two [0.72ms] (pass) prefix networks > a state machine scan gives the loop's states, in S × (k + combines) + k live operations, or k + S × combines from a constant initial state [12.99ms] 174 pass 0 fail 155853 expect() calls Ran 174 tests across 11 files. [4.23s]

• Build the demo site as static files: Writes a site/ output directory into the checkout; left out on purpose to keep the source tree clean. The local site was instead checked live via bun start (see probe).

  Source: README.md Running section (bun run site:build)

  Expected: documented command completes successfully

  Observed: Writes a site/ output directory into the checkout; left out on purpose to keep the source tree clean. The local site was instead checked live via bun start (see probe).

• Run the full test suite: README says it takes about 3 minutes; not run in this pass. A folder-level test run (tests/runtime) and the template test were run instead.

  Source: README.md Running section (bun run test)

  Expected: documented command completes successfully

  Observed: README says it takes about 3 minutes; not run in this pass. A folder-level test run (tests/runtime) and the template test were run instead.

Local or hosted: local

Run the handwired demo site with bun start and load the JSON search demo page; run the documented tests and checks

cd <guest-path> && pwd && ls -la && id -u && python3 --version && (git -C . rev-parse HEAD 2>&1 | head -1) && cat README.md 2>/dev/null | head -200
ls /inputs 2>&1; ls <guest-path> 2>&1; cat /etc/os-release | head -3
cd <guest-path> && cat package.json && ls -la .coldpass && ls scripts template docs tests && which bun node npm; bun --version 2>&1; node --version 2>&1; sudo -n true && echo SUDO_OK
cd <guest-path> && git init -q && git remote add origin https://github.com/chenglou/handwired && git fetch --depth 1 origin 257856e3b221140acb4cc4460626b850c0bd4ff1 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git rev-parse HEAD; git status --short | head; curl -fsSL https://bun.sh/install -o /tmp/bun-install.sh && bash /tmp/bun-install.sh 2>&1 | tail -5; ls ~/.bun/bin 2>&1
sudo apt-get update -qq 2>&1 | tail -2; sudo apt-get install -y -qq unzip 2>&1 | tail -2; curl -fsSL https://bun.sh/install | bash 2>&1 | tail -4; export BUN_INSTALL=$HOME/.bun; $BUN_INSTALL/bin/bun --version
export BUN_INSTALL=$HOME/.bun; export PATH=$BUN_INSTALL/bin:$PATH; export NODE_USE_ENV_PROXY=1; cd <guest-path> && bun install 2>&1 | tail -8; echo EXIT=$?; cat scripts/serve-demo-site.ts | head -60
cd <guest-path> && cat template/README.md; echo ----; head -60 docs/README.md; echo ----; ls src src/* | head -50; echo ----; cat template/main.ts | head -60
export BUN_INSTALL=$HOME/.bun; export PATH=$BUN_INSTALL/bin:$PATH; cd <guest-path> && (nohup bun start > /tmp/bunstart.log 2>&1 &) ; sleep 6; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:3000/; curl -s http://127.0.0.1:3000/ | grep -o '<title>[^<]*</title>'; curl -s http://127.0.0.1:3000/os/ | grep -o '<title>[^<]*</title>'; cat /tmp/bunstart.log | tail -5
export BUN_INSTALL=$HOME/.bun; export PATH=$BUN_INSTALL/bin:$PATH; cd <guest-path> && bun test template 2>&1 | tail -6; echo EXIT=$?; bun lab/runtime-cost/report.ts 2>&1 | head -20
export BUN_INSTALL=$HOME/.bun; export PATH=$BUN_INSTALL/bin:$PATH; cd <guest-path> && echo HOME=$HOME; bun test tests/runtime 2>&1 | tail -3; echo EXIT=$?; bun run check 2>&1 | tail -4; echo CHECK_EXIT=${PIPESTATUS[0]}; grep -rnE "setInterval|setTimeout|cron|schedule|--once|--now|webhook" --include=*.ts --include=*.md src scripts template README.md docs 2>/dev/null | grep -v node_modules | head -20
pkill -f serve-demo-site.ts; sleep 1; curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:3000/ || true; mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import json, os
W = "<guest-path>"
BUN = "<guest-path>"
readme = open(os.path.join(W, "README.md"), encoding="utf-8").read()
tpl = open(os.path.join(W, "template/README.md"), encoding="utf-8").read()
q1 = "bun lab/runtime-cost/report.ts"
q2 = "bun test tests/runtime"
q3 = "bun test template        # its test"
assert q1 in readme and q2 in readme, "README quote missing"
assert q3 in tpl, "template quote missing"
claims = [
 {"kind":"claim","claim":"The lab runtime-cost report prints per-program sizes and timings","source":q1,
  "input":"no arguments","expected":"JSON report that includes the coordinate transform program",
  "probe_kind":"cli","argv":[BUN,"lab/runtime-cost/report.ts"],"expected_text":"\"name\": \"coordinate transform\"","cwd":W},
 {"kind":"claim","claim":"The runtime test folder runs and passes","source":q2,
  "input":"tests/runtime","expected":"all runtime tests pass",
  "probe_kind":"cli","argv":[BUN,"test","tests/runtime"],"expected_text":"Ran 174 tests across 11 files","cwd":W},
 {"kind":"claim","claim":"The template's own test runs and passes","source":q3,
  "input":"template","expected":"3 tests pass",
  "probe_kind":"cli","argv":[BUN,"test","template"],"expected_text":"3 pass","cwd":W},
]
examples = [
 {"kind":"example","claim":"Type-check and lint the repo","source":"README.md Running section (bun run check)",
  "input":"none","expected":"0 warnings and 0 errors","argv":[BUN,"run","check"],"cwd":W,"env":{},
  "expected_text":"Found 0 warnings and 0 errors."},
 {"kind":"example","claim":"Run one folder's tests","source":"README.md Running section (bun test tests/runtime)",
  "input":"tests/runtime","expected":"0 fail","argv":[BUN,"test","tests/runtime"],"cwd":W,"env":{},
  "expected_text":"0 fail"},
 {"kind":"example","claim":"Build the demo site as static files","source":"README.md Running section (bun run site:build)",
  "deferred":True,"reason":"Writes a site/ output directory into the checkout; left out on purpose to keep the source tree clean. The local site was instead checked live via bun start (see probe)."},
 {"kind":"example","claim":"Run the full test suite","source":"README.md Running section (bun run test)",
  "deferred":True,"reason":"README says it takes about 3 minutes; not run in this pass. A folder-level test run (tests/runtime) and the template test were run instead."},
]
probe = {"kind":"http","argv":[BUN,"start"],"cwd":W,"url":"http://127.0.0.1:3000/os/","expected_text":"HandwiredOS"}
cycles = {"detected":False,"reason":"Entry points inspected: package.json scripts, scripts/serve-demo-site.ts, scripts/check.ts, README Running section, template/README.md. No cron, scheduler, --once or --now trigger exists. The only repeating behavior is browser requestAnimationFrame and setTimeout in src/json-search/demo.ts and src/json-search/demo-worker.ts, which run per user interaction in a browser, so they cannot be run here without a browser.","checks":[]}
os.makedirs(os.path.join(W, ".coldpass"), exist_ok=True)
for name, obj in [("claims.json", claims), ("examples.json", examples), ("probe.json", probe), ("cycles.json", cycles)]:
    with open(os.path.join(W, ".coldpass", name), "w", encoding="utf-8") as f:
        json.dump(obj, f, indent=2, ensure_ascii=False); f.write("\n")
print("ok")
EOF
python3 -I <guest-path> && ls -la <guest-path>
ps aux | grep -c "[s]erve-demo-site" ; ls -la <guest-path> <guest-path> 2>&1 | head
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import json, os
W = "<guest-path>"
BUN = "<guest-path>"
readme = open(os.path.join(W, "README.md"), encoding="utf-8").read()
tpl = open(os.path.join(W, "template/README.md"), encoding="utf-8").read()
q1 = "bun lab/runtime-cost/report.ts"
q2 = "bun test tests/runtime"
q3 = "bun test template        # its test"
assert q1 in readme and q2 in readme, "README quote missing"
assert q3 in tpl, "template quote missing"
claims = [
 {"kind":"claim","claim":"The lab runtime-cost report prints per-program sizes and timings","source":q1,
  "input":"no arguments","expected":"JSON report that includes the coordinate transform program",
  "probe_kind":"cli","argv":[BUN,"lab/runtime-cost/report.ts"],"expected_text":"\"name\": \"coordinate transform\"","cwd":W},
 {"kind":"claim","claim":"The runtime test folder runs and passes","source":q2,
  "input":"tests/runtime","expected":"all runtime tests pass",
  "probe_kind":"cli","argv":[BUN,"test","tests/runtime"],"expected_text":"Ran 174 tests across 11 files","cwd":W},
 {"kind":"claim","claim":"The template's own test runs and passes","source":q3,
  "input":"template","expected":"3 tests pass",
  "probe_kind":"cli","argv":[BUN,"test","template"],"expected_text":"3 pass","cwd":W},
]
examples = [
 {"kind":"example","claim":"Type-check and lint the repo","source":"README.md Running section (bun run check)",
  "input":"none","expected":"0 warnings and 0 errors","argv":[BUN,"run","check"],"cwd":W,"env":{},
  "expected_text":"Found 0 warnings and 0 errors."},
 {"kind":"example","claim":"Run one folder's tests","source":"README.md Running section (bun test tests/runtime)",
  "input":"tests/runtime","expected":"0 fail","argv":[BUN,"test","tests/runtime"],"cwd":W,"env":{},
  "expected_text":"0 fail"},
 {"kind":"example","claim":"Build the demo site as static files","source":"README.md Running section (bun run site:build)",
  "deferred":True,"reason":"Writes a site/ output directory into the checkout; left out on purpose to keep the source tree clean. The local site was instead checked live via bun start (see probe)."},
 {"kind":"example","claim":"Run the full test suite","source":"README.md Running section (bun run test)",
  "deferred":True,"reason":"README says it takes about 3 minutes; not run in this pass. A folder-level test run (tests/runtime) and the template test were run instead."},
]
probe = {"kind":"http","argv":[BUN,"start"],"cwd":W,"url":"http://127.0.0.1:3000/os/","expected_text":"HandwiredOS"}
cycles = {"detected":False,"reason":"Entry points inspected: package.json scripts, scripts/serve-demo-site.ts, scripts/check.ts, README Running section, template/README.md. No cron, scheduler, --once or --now trigger exists. The only repeating behavior is browser requestAnimationFrame and setTimeout in src/json-search/demo.ts and src/json-search/demo-worker.ts, which run per user interaction in a browser, so they cannot be run here without a browser.","checks":[]}
os.makedirs(os.path.join(W, ".coldpass"), exist_ok=True)
for name, obj in [("claims.json", claims), ("examples.json", examples), ("probe.json", probe), ("cycles.json", cycles)]:
    with open(os.path.join(W, ".coldpass", name), "w", encoding="utf-8") as f:
        json.dump(obj, f, indent=2, ensure_ascii=False); f.write("\n")
print("ok")
EOF
python3 -I <guest-path> && ls -la <guest-path> && ls -d <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
export BUN_INSTALL=$HOME/.bun; cd <guest-path> && <guest-path> install 2>&1 | tail -3; echo EXIT=$?; grep -n "bun install" README.md; grep -c "" README.md; ls -la .coldpass
cd <guest-path> && python3 - <<'EOF'
import re
src = open("write.py", encoding="utf-8").read()
start = src.index("readme = open")
end = src.index("examples = [")
new_claims = '''readme = open(os.path.join(W, "README.md"), encoding="utf-8").read()
q1 = "`git clone && bun install`, then `bun start` to run them locally."
assert q1 in readme, "README quote missing"
claims = [
 {"kind":"claim","claim":"bun install sets up the repo's dependencies so bun start can run",
  "source":q1,"input":"existing checkout with dependencies installed",
  "expected":"dependencies are present and checked",
  "probe_kind":"cli","argv":[BUN,"install"],"expected_text":"Checked 37 installs across 119 packages","cwd":W},
]
'''
src = src[:start] + new_claims + src[end:]
open("write.py", "w", encoding="utf-8").write(src)
EOF
python3 -I <guest-path> && ls -la <guest-path> && cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60
cd <guest-path> && wc -l check.py && grep -n -i "def .*http\|urlopen\|expected_text\|sleep\|timeout\|env\b\|environ\|PATH" check.py | head -60
cd <guest-path> && sed -n 573,612p check.py; grep -n "USER_BIN\s*=" check.py
cd <guest-path> && grep -n "'env'" check.py | head; export BUN_INSTALL=<guest-path>; cd <guest-path> && (<guest-path> start > /tmp/bunstart2.log 2>&1 &); sleep 6; curl -s http://127.0.0.1:3000/json-search/ | grep -o '<title>[^<]*</title>'; curl -s http://127.0.0.1:3000/json-search/ | grep -o -i 'json search' | head -2; cat /tmp/bunstart2.log | tail -4
cd <guest-path> && python3 - <<'EOF'
src = open("write.py", encoding="utf-8").read()
src = src.replace('"argv":[BUN,"run","check"],"cwd":W,"env":{},', '"argv":[BUN,"run","check"],"cwd":W,"env":{"PATH":"<guest-path>"},')
src = src.replace('"argv":[BUN,"test","tests/runtime"],"cwd":W,"env":{},', '"argv":[BUN,"test","tests/runtime"],"cwd":W,"env":{"PATH":"<guest-path>"},')
src = src.replace('probe = {"kind":"http","argv":[BUN,"start"],"cwd":W,"url":"http://127.0.0.1:3000/os/","expected_text":"HandwiredOS"}',
 'probe = {"kind":"http","argv":[BUN,"start"],"cwd":W,"url":"http://127.0.0.1:3000/json-search/","expected_text":"Search 100,000 JSON documents"}')
open("write.py", "w", encoding="utf-8").write(src)
EOF
grep -c PATH write.py; grep -n "probe = " write.py | cut -c1-150; pkill -f "[s]erve-demo-site" ; sleep 1; python3 -I <guest-path> && cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -c 3000
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo RC=$?; python3 -I -c "
import json,sys
t=open('<guest-path>').read()
i=t.find('{')
d=json.loads(t[i:])
print('valid=',d.get('valid'))
print('problems=',d.get('problems'))
r=d.get('replay',{})
print('replay status=',r.get('status'),'details=',r.get('details'))
print('evidence_strength=',r.get('evidence_strength'))
" 2>&1 | head -30; ps aux | grep -c "[s]erve-demo-site"
cd <guest-path> && python3 -I - <<'EOF'
import json
report = {
 "outcome": "working",
 "fault_owner": None,
 "operation": "Run the handwired demo site with bun start and load the JSON search demo page; run the documented tests and checks",
 "operation_scope": "Linux Ubuntu 24.04 guest, Bun 1.4.4 (README says tested with 1.4.3), pinned commit 257856e3b221140acb4cc4460626b850c0bd4ff1. Local-only: no browser; site:check, the full test suite and site:build were not run.",
 "steps": [
  "git init; git remote add origin https://github.com/chenglou/handwired; git fetch --depth 1 origin 257856e3b221140acb4cc4460626b850c0bd4ff1; git reset --mixed FETCH_HEAD",
  "Install Bun (README prerequisite; not preinstalled): curl -fsSL https://bun.sh/install | bash (after apt-get install unzip)",
  "bun install (README: git clone && bun install)",
  "bun start (README: serves the demo site at http://127.0.0.1:3000/)",
  "bun test tests/runtime (docs/README.md: one folder's tests)",
  "bun run check (docs/README.md: type-checks and lints)",
  "bun lab/runtime-cost/report.ts (docs/README.md: lab report)",
  "bun test template (template/README.md)"
 ],
 "deviations": [
  "Bun was not installed in the guest. Installed it with the official bun.sh installer, which first needed unzip (installed with sudo apt-get install -y unzip). Installed to <guest-path>, so the absolute path <guest-path> is used in saved argv.",
  "The root README.md has no Running section; the documented commands are in docs/README.md and template/README.md. Claims therefore quote only the root README line about bun install / bun start; the other commands are recorded as examples.",
  "First replay of the bun run check example failed because the checker's PATH lacks Bun's bin directory (scripts/check.ts spawns bunx). Fixed by setting env PATH to include <guest-path> in the example. Not a product fault.",
  "First HTTP probe pointed at /os/ failed: the checker reads the last http://127.0.0.1:3000/ URL printed by the server, which is /json-search/, so the expected text was never fetched. Probe changed to /json-search/ with its page title text. Not a product fault.",
  "The full suite (bun run test, ~3 minutes), site:build and site:check (needs Chrome) were deferred.",
  "The checker path /inputs/coldpass-preflight.py does not exist in this guest; the validation used <guest-path> as the task's checker location.",
  "No product cycle detected: the repo has no cron, scheduler, --once or --now. Only browser animation-frame loops exist, which need a browser."
 ],
 "stuck_step": None,
 "main_blocker": None,
 "plain_failure": None,
 "suggested_fix": "None needed for the operations run. Optionally, the README could point to docs/README.md for the Running commands, and state that Bun must be installed first."
}
import os
os.makedirs(".coldpass", exist_ok=True)
json.dump(report, open(".coldpass/report.json", "w", encoding="utf-8"), indent=2, ensure_ascii=False)
print("report written")
EOF
ls -la .coldpass; python3 -I -c "
import json
for f in ['claims','examples','probe','cycles']:
    json.load(open('<guest-path>'%f)); print(f,'ok')
"; ls -la <guest-path> | grep -i report; ps aux | grep -c "[b]un start"
ps -eo pid,ppid,etime,args | grep "[b]un" | cut -c1-160; curl -s -o /dev/null -w "port3000=%{http_code}\n" http://127.0.0.1:3000/ || echo "port3000 closed"
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo RC=$?; python3 -I -c "
import json
t=open('<guest-path>').read(); d=json.loads(t[t.find('{'):])
print('valid=',d.get('valid'),'problems=',d.get('problems'))
r=d.get('replay',{}); print('status=',r.get('status'),'strength=',r.get('evidence_strength'))
print('claims=',[c.get('verdict') for c in r.get('claims',[])])
print('examples=',[c.get('verdict') for c in r.get('example_checks',[])])
print('cycles=',[c.get('verdict') for c in r.get('cycle_checks',[])])
"; ps -eo args | grep -c "[s]erve-demo-site"