cuuush/memcal

No problems traced to this repository code in these checks. 4 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

4 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Memcal prints a brief of upcoming events.: Real input produced the expected result: nothing known

  Source: Memcal prepares a brief of the next 30 days so an agent can answer common questions without a separate lookup.

  Input: empty initialized store

  Expected: brief identifies upcoming window and says nothing known

  Command: <guest-path> --home /tmp/memcal-claim-fresh brief

  Observed: nothing known) [complete for 2026-10-24 – 2026-11-26; look up anything outside that] [calendar: memcal_list_month(month='2026-10'); year: memcal_list_days(when='2026-01-01', days=365)]

Examples

• Print the current brief: command completed successfully

  Source: README.md / Get started

  Input: memcal brief on fresh store

  Expected: brief text for upcoming window

  Command: <guest-path> --home /tmp/memcal-example-fresh brief

  Observed: [〔E#〕〔T#〕〔Q#〕 handles open with `memcal open E258`. Pages open with `memcal open <name>`; the names in parentheses after a page are the facts it holds] ## Upcoming (today is Tuesday 27 October 2026) (nothing known) [complete for 2026-10-24 – 2026-11-26; look up anything outside that] [calendar: memcal_list_month(month='2026-10'); year: memcal_list_days(when='2026-01-01', days=365)]

Local or hosted: local

Print an upcoming calendar brief

pwd; git rev-parse --is-inside-work-tree; git rev-parse HEAD; python3 --version; sed -n '1,240p' README.md; rg --files -g '!*lock*' | head -80
ls -la; git init; git remote add origin https://github.com/cuuush/memcal.git; git fetch --depth 1 origin 97985b6d82dc2d4e78c626d622412e779fd92a1e; git reset --mixed FETCH_HEAD; sed -n '1,240p' install.sh; find . -maxdepth 2 -type f | head -100
./install.sh --no-init; ~/.local/bin/memcal --help
~/.local/bin/memcal --home /tmp/memcal-coldpass brief; ls -la /tmp/memcal-coldpass; sed -n '1,160p' docs/clients/mcp.md; find memcal -maxdepth 1 -type f
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","--home","/tmp/memcal-probe-fresh","brief"],"cwd":"<guest-path>","expected_text":"nothing known"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Memcal prints a brief of upcoming events.","source":"Memcal prepares a brief of the next 30 days so an agent can answer common questions without a separate lookup.","input":"empty initialized store","expected":"brief identifies upcoming window and says nothing known","probe_kind":"cli","argv":["<guest-path>","--home","/tmp/memcal-claim-fresh","brief"],"expected_text":"nothing known","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Print the current brief","source":"README.md / Get started","input":"memcal brief on fresh store","expected":"brief text for upcoming window","argv":["<guest-path>","--home","/tmp/memcal-example-fresh","brief"],"cwd":"<guest-path>","expected_text":"Upcoming"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"Nightly Dream pass processes updates","source":"README.md / Using Memcal","quote":"Memcal dream collects and processes updates, then shows a summary.","schedule":"nightly Dream pass","method":"run-once","input":"No configured sources or model backend; not triggered","expected":"Not available without configured provider","kind":"cli","argv":["<guest-path>","--home","/tmp/memcal-cycle","dream","--dry-run"],"cwd":"<guest-path>","expected_text":""}]}
EOF
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Print an upcoming calendar brief","operation_scope":"README checkout install and local brief command; no model credentials required","steps":["./install.sh --no-init","memcal brief"],"deviations":[],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/cycles.json <<'EOF'
{"detected":true,"checks":[{"claim":"Nightly Dream pass processes updates","source":"README.md","quote":"Memcal dream collects and processes updates, then shows a summary.","schedule":"nightly Dream pass","method":"run-once","input":"No configured sources or model backend; dry-run available","expected":"Dry-run cost estimate","kind":"cli","argv":["<guest-path>","--home","/tmp/memcal-cycle","dream","--dry-run"],"cwd":"<guest-path>","expected_text":"dry run"}]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README; Dream is an explicit command and scheduled on macOS through launchd. No general product cron loop runs in this Linux probe; configured source and model credentials are absent.","checks":[]}
EOF
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Print an upcoming calendar brief","operation_scope":"Pinned checkout install and local CLI brief using an empty store","steps":["./install.sh --no-init","memcal brief"],"deviations":["Ran installer with --no-init to avoid interactive provider setup; ran brief against a fresh local store."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay