collectiveai-team/botica

Review signals: 2 hardcoded secret, 4 known vulnerability.

Reviewed as expected for a test run: read only test files inside the test workspace or its temporary folders.

Gitleaks found a possible hardcoded secret; value withheld. 2 distinct locations. 2 findings.

OSV reports a known vulnerability in this dependency version. 4 distinct locations. 4 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• botica lint exits 1 when a finding is an error: Real input produced the expected result: error [no-utils] src/utils.py is a catch-all module

  Source: `botica lint` exits with 1 when a finding is an error and with 2 when the run fails.

  Input: sample project with src/utils.py

  Expected: exit 1 and the no-utils error

  Command: <guest-path> lint

  Observed: error [no-utils] src/utils.py is a catch-all module — name modules for what they hold, not utils/helpers/aux/misc/common. src/utils.py:2:5: warning [log-no-print] Libraries log, they don't print: use the house get_logger (`botica refs show structured-logging`) instead of print() or sys.stdout/stderr.write in library code. `__main__.py`, `cli.py`, `cli/`, the tests and `if __name__ == "__main__":` blocks are exempt; another entry point goes in `extend-ignores`.

• botica explain says what a rule asks and how it is configured: Real input produced the expected result: no-utils (BTSTRUC002): No catch-all modules

  Source: # what a rule asks, and how it is configured here

  Input: no-utils

  Expected: the rule description

  Command: <guest-path> explain no-utils

  Observed: no-utils (BTSTRUC002): No catch-all modules state: active, selected by `no-utils` severity: error status: stable (since 0.7.0) family: structure standard: CES-63 languages: go, javascript, python, rust, typescript kind: native (python, typescript, javascript, go, rust) aliases: none tags: naming options: none config: /tmp/sample_proj/botica.toml ignores: none ## Directive Don't create catch-all modules. A module named `utils`, `helpers`, `aux`, `misc` or `common` is an error, anywhere except under `tests/`. It applies to the files of Python (`.py`), TypeScript (

Examples

• list every rule with whether it is active: command completed successfully

  Source: README.md

  Input: rules --all in sample project

  Expected: rule list including no-utils

  Command: <guest-path> rules --all

  Observed: TTOOL002 ruff-selection inactive not selected BTTOOL003 pyrefly-strict inactive not selected BTTOOL004 no-type-cast inactive not selected BTTOOL005 ruff-heavy-imports-in-function inactive not selected BTTOOL006 ruff-imports-at-top inactive not selected BTWRIT001 plain-writing inactive not selected; judged outside lint BTWRIT002 minimal-comments inactive not selected; judged outside lint BTWRIT003 ubiquitous-language inactive not selected; judged outside lint BTWRIT004 agents-md-refs-exist inactive not selected

• read the reference page of a topic: command completed successfully

  Source: README.md

  Input: refs show structured-logging

  Expected: topic text

  Command: <guest-path> refs show structured-logging

  Observed: es and render your event dictionary to JSON that is picked up by a log aggregation system like ELK or Graylog, structlog comes with batteries included - you just have to tell it to use its JSONRenderer. ## https://www.structlog.org/en/stable/api.html#structlog.dev.ConsoleRenderer the console renderer formats exceptions itself, so the processor that turns them into data goes only before `JSONRenderer` > Changed in version 21.2.0: ConsoleRenderer now handles the exc_info event dict key itself. Do not use the structlog.processors.format_exc_info processor together with ConsoleRenderer anymore!

Local or hosted: local

Install botica and run its linter (botica lint) plus explain on a project with a botica.toml

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -200
ls <guest-path>; ls /inputs 2>&1; echo "CDP=$CDP_URL $<env-var>"; uname -a; cat /etc/os-release | head -3
which uv uvx cargo node npm git curl 2>&1; cd <guest-path> && git init -q 2>&1 && git remote add origin https://github.com/collectiveai-team/botica 2>&1; timeout 120 git fetch --depth 1 origin 49f2459e260b08e62648f901de8aa910a1b54bad 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1 2>&1
cd /tmp && uv --version && timeout 600 uv tool install botica 2>&1 | tail -5; which botica; botica --version 2>&1
export PATH="<guest-path>"; botica --version; cd <guest-path> && timeout 600 botica lint; echo "EXIT=$?"
export PATH="<guest-path>"; mkdir -p /tmp/sample_proj/src && cd /tmp/sample_proj && printf 'select = ["file-size-guard", "no-utils", "log-no-print"]\n\n[rules.file-size-guard]\nwarn = 500\nmax = 900\n' > botica.toml && printf 'def f():\n    print("hi")\n' > src/utils.py && botica lint; echo "EXIT=$?"; botica explain no-utils | head -20; echo; botica rules --all 2>&1 | head -5
export PATH="<guest-path>"; rm -rf /tmp/rules_demo && mkdir -p /tmp/rules_demo && cd /tmp/rules_demo && botica rules new structure/no-eval --kind ast-grep --language python --catalog .botica/rules/acme; echo "EXIT=$?"; find .botica | head -20; botica rules conform .botica/rules/acme; echo "CONF=$?"; cd <guest-path>; grep -rniE "cron|--once|--now|webhook|watch mode|schedule" --include=*.md docs website/src 2>/dev/null | grep -v node_modules | head -10; ls docs
export PATH="<guest-path>"; botica rules new --help; echo ---; botica --help | head -40; echo ---; grep -rn "rules new" <guest-path> --include=*.md* 2>/dev/null | head -5
cd <guest-path> && ls extend; sed -n 1,60p extend/catalogs.md
export PATH="<guest-path>"; rm -rf /tmp/rules_demo && mkdir -p /tmp/rules_demo && cd /tmp/rules_demo && mkdir -p .botica/rules/acme/structure && printf 'code = "ACME"\n' > .botica/rules/acme/catalog.toml && printf 'code = "STRUC"\ndescription = "The layout of the project"\nextends = "structure"\n' > .botica/rules/acme/structure/family.toml && botica rules new structure/no-blobs --kind ast-grep --language python --catalog .botica/rules/acme; echo "NEW=$?"; botica rules conform .botica/rules/acme; echo "CONF=$?"; find .botica -type f | sort
export PATH="<guest-path>"; cd <guest-path> && grep -rniE "cron|interval|watch|--once|--now|webhook|sleep\(|tokio::time" crates --include=*.rs | grep -v test | head -10; echo ---; cd /tmp/sample_proj && botica explain no-utils | grep -E "^(no-utils|state)"; botica refs show structured-logging | head -5; echo "REFS=$?"; cd /tmp/sample_proj && botica rules --all | grep -c "" 
cd <guest-path> && mkdir -p .coldpass && B=<guest-path> && cat > .coldpass/probe.json <<EOF
{"kind":"cli","argv":["$B","lint"],"cwd":"/tmp/sample_proj","expected_returncode":1,"expected_text":"error [no-utils] src/utils.py is a catch-all module"}
EOF
cat > .coldpass/claims.json <<EOF
[
{"kind":"claim","claim":"botica lint exits 1 when a finding is an error","source":"\`botica lint\` exits with 1 when a finding is an error and with 2 when the run fails.","input":"sample project with src/utils.py","expected":"exit 1 and the no-utils error","probe_kind":"cli","argv":["$B","lint"],"cwd":"/tmp/sample_proj","expected_returncode":1,"expected_text":"error [no-utils] src/utils.py is a catch-all module"},
{"kind":"claim","claim":"botica explain says what a rule asks and how it is configured","source":"# what a rule asks, and how it is configured here","input":"no-utils","expected":"the rule description","probe_kind":"cli","argv":["$B","explain","no-utils"],"cwd":"/tmp/sample_proj","expected_text":"no-utils (BTSTRUC002): No catch-all modules"}
]
EOF
cat > .coldpass/examples.json <<EOF
[
{"kind":"example","claim":"list every rule with whether it is active","source":"README.md","input":"rules --all in sample project","expected":"rule list including no-utils","argv":["$B","rules","--all"],"cwd":"/tmp/sample_proj","expected_text":"no-utils"},
{"kind":"example","claim":"read the reference page of a topic","source":"README.md","input":"refs show structured-logging","expected":"topic text","argv":["$B","refs","show","structured-logging"],"cwd":"/tmp/sample_proj","expected_text":"Structured logging with structlog"}
]
EOF
cat > .coldpass/cycles.json <<EOF
{"detected":false,"reason":"Inspected README.md and crates/ entry points: botica lint, rules, explain, refs, recipe and rules new are one-shot commands; the only long-running entry point is botica server (LSP over stdio), started by an editor, not a schedule. No cron, --once, --now or webhook in the product.","checks":[]}
EOF
for f in probe claims examples cycles; do python3 -I -m json.tool .coldpass/$f.json >/dev/null && echo "$f ok"; done; cat .coldpass/claims.json | head -3
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install botica and run its linter (botica lint) plus explain on a project with a botica.toml","operation_scope":"Linux x86_64 Ubuntu 24.04, uv 0.13.5, botica 0.17.0 from PyPI; no browser, network or credentials needed for lint","steps":["git init; git remote add origin https://github.com/collectiveai-team/botica; git fetch --depth 1 origin 49f2459e260b08e62648f901de8aa910a1b54bad; git reset --mixed FETCH_HEAD","uv tool install botica","botica lint (in repo: exit 0 with file-size-guard warnings)","botica.toml with select = [file-size-guard, no-utils, log-no-print]; botica lint on src/utils.py -> exit 1 with error [no-utils]","botica explain no-utils","botica rules --all","botica refs show structured-logging"],"deviations":["uv tool install put botica in <guest-path>, which is not on PATH; used the absolute path <guest-path> in all evidence","The /inputs/coldpass-preflight.py path given in the task does not exist; ran <guest-path> as instructed","botica rules new + rules conform on a scaffolded rule fails with 'fixtures/expected.json lists nothing' because the generated fixtures are TODO templates; this is the documented scaffold state, not a product failure, and was not used as evidence"],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"none required"}
EOF
python3 -I -m json.tool .coldpass/report.json >/dev/null && echo report ok; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -40; echo "CHECK=$?"