corpunum/unumsearch

Review signals: 1 download and execute.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; wrote only to its own open file handles.

Source contains download and execute; review its purpose. install.sh

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Search code using a regular expression and return matching lines with --text.: Real input produced the expected result: <guest-path> main() { println!("hello"); }

  Source: unumsearch search 'fn\s+main' ~/src/myrepo --text

  Input: fn main() { println!("hello"); }

  Expected: The matching main.rs line is returned with its path and line number.

  Command: <guest-path> --root <guest-path> --index-dir <guest-path> search 'fn\s+main' <guest-path> --text

  Observed: <guest-path> main() { println!("hello"); }

Examples

• Build from source as documented in the reference install instructions.: command completed successfully

  Source: docs/REFERENCE.md#install

  Input: cargo build --release

  Expected: The release executable is built.

  Command: cargo build --release

  Observed: Finished `release` profile [optimized] target(s) in 0.42s

Build unumsearch from source, index a directory, then search its contents using a regular expression and --text.

pwd && ls -la && sed -n '1,240p' README.md && python3 --version && id -u
sed -n '1,260p' docs/REFERENCE.md && cat Cargo.toml && ls -la .coldpass && rg -n "cargo|install|index|search|test|cycle|schedule|cron|serve|mcp" .github README.md docs/REFERENCE.md Cargo.toml
which cargo rustc rustup curl; cargo --version; rustc --version; git status --short; git log -1 --oneline 2>&1
curl -fsSL https://sh.rustup.rs -o /tmp/rustup-init.sh && sh /tmp/rustup-init.sh -y --profile minimal --default-toolchain 1.89.0
export PATH=/var<guest-path>; rustc --version; cargo build --release
mkdir -p /tmp/unumsearch-sample <guest-path> && printf 'fn main() { println!("hello"); }\n' > /tmp/unumsearch-sample/main.rs && target/release/unumsearch --root /tmp/unumsearch-sample --index-dir /tmp/unumsearch-index index && target/release/unumsearch --root /tmp/unumsearch-sample --index-dir /tmp/unumsearch-index search 'fn\s+main' /tmp/unumsearch-sample --text
mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{
  "kind": "cli",
  "argv": ["<guest-path>", "--root", "<guest-path>", "--index-dir", "<guest-path>", "search", "fn\\s+main", "<guest-path>", "--text"],
  "cwd": "<guest-path>",
  "expected_file": "<guest-path>",
  "expected_text": "<guest-path> main() { println!(\"hello\"); }"
}
EOF
cat > .coldpass/claims.json <<'EOF'
[
  {
    "kind": "claim",
    "claim": "Search code using a regular expression and return matching lines with --text.",
    "source": "unumsearch search 'fn\\s+main' ~/src/myrepo --text",
    "input": "fn main() { println!(\"hello\"); }",
    "expected": "The matching main.rs line is returned with its path and line number.",
    "probe_kind": "cli",
    "argv": ["<guest-path>", "--root", "<guest-path>", "--index-dir", "<guest-path>", "search", "fn\\s+main", "<guest-path>", "--text"],
    "cwd": "<guest-path>",
    "expected_file": "<guest-path>",
    "expected_text": "<guest-path> main() { println!(\"hello\"); }"
  }
]
EOF
cat > .coldpass/examples.json <<'EOF'
[
  {
    "kind": "example",
    "claim": "Build from source as documented in the reference install instructions.",
    "source": "docs/REFERENCE.md#install",
    "input": "cargo build --release",
    "expected": "The release executable is built.",
    "argv": ["cargo", "build", "--release"],
    "cwd": "<guest-path>",
    "env": {"PATH": "/var<guest-path>"}
  }
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README, docs/REFERENCE.md CLI and API entry points, and repository source. The product provides one-shot indexing and searches plus a foreground watcher/daemon; it does not document a scheduled cycle or one-shot scheduler trigger." ,"checks":[]}
EOF
mkdir -p <guest-path> <guest-path> && printf 'fn main() { println!("hello"); }\n' > <guest-path> && printf 'fn main() { println!("hello"); }\n' > <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay
target/release/unumsearch --root <guest-path> --index-dir <guest-path> search 'fn\s+main' <guest-path> --text > <guest-path> && target/release/unumsearch --root <guest-path> --index-dir <guest-path> search 'fn\s+main' <guest-path> --text > <guest-path> && cat <guest-path> && cat <guest-path>
python3 - <<'PY'
import json
from pathlib import Path
p=Path('.coldpass/probe.json'); d=json.loads(p.read_text()); d.pop('expected_file'); d['expected_text']='<guest-path> main() { println!("hello"); }'; p.write_text(json.dumps(d,indent=2)+'\n')
p=Path('.coldpass/claims.json'); d=json.loads(p.read_text()); d[0].pop('expected_file'); p.write_text(json.dumps(d,indent=2)+'\n')
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": null,
  "operation": "Build unumsearch from source, index a directory, then search its contents using a regular expression and --text.",
  "operation_scope": "Local CLI operation on the checked out source snapshot; requires Rust 1.89 or newer.",
  "steps": [
    "Read README.md and docs/REFERENCE.md.",
    "Installed Rust 1.89.0 with rustup because the system toolchain was 1.75.0 and the reference requires Rust 1.89 or newer.",
    "Ran cargo build --release.",
    "Ran the documented index operation on a sample directory and observed one indexed file.",
    "Ran the documented regex search with --text and observed the expected path, line, and matching content.",
    "Replayed .coldpass/probe.json and claims.json successfully with the coldpass checker."
  ],
  "deviations": ["The README's latest-release installer was not used; the reference's documented cargo build --release path was used against the supplied source snapshot."],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": null
}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay