init-co-jp/diff-tour

Review signals: 1 download and execute.

Source contains download and execute; review its purpose. install.sh

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• --dump prints every step of a saved tour at a fixed screen size: Real input produced the expected result: Two commits, one new feature

  Source: `--dump` prints every step at a fixed screen size, which is handy for checking layouts without a terminal.

  Input: tours/example-coupons.en.json against the diff-tour-example repo

  Expected: the tour steps are printed to stdout, including the first step title

  Command: <guest-path> tours/example-coupons.en.json --repo <guest-path> --dump --cols 140 --rows 44 --plain

  Observed: Two commits, one new feature feature/coupons (branched from main) 2 commits · 14 files changed (+241 −13)

Examples

• Development: the repository test suite passes: command completed successfully

  Source: README.md ## Development: go test ./...

  Input: repository checkout at the pinned commit

  Expected: all packages report ok

  Command: <guest-path> test ./...

  Observed: -jp/diff-tour/internal/config [no test files] ok github.com/init-co-jp/diff-tour/internal/generate (cached) ok github.com/init-co-jp/diff-tour/internal/git (cached) ? github.com/init-co-jp/diff-tour/internal/highlight [no test files] ok github.com/init-co-jp/diff-tour/internal/i18n 0.080s ok github.com/init-co-jp/diff-tour/internal/render (cached) ok github.com/init-co-jp/diff-tour/internal/schema (cached) ok github.com/init-co-jp/diff-tour/internal/text (cached) ok github.com/init-co-jp/diff-tour/internal/tour (cached) ok github.com/init-co-jp/diff-tour/internal/ui (cached)

• Development: a saved tour is dumped with go run: command completed successfully

  Source: README.md ## Development: go run ./cmd/tour tours/example-coupons.en.json --repo path/to/diff-tour-example --dump --cols 140 --rows 44 --plain

  Input: tours/example-coupons.en.json and <guest-path>

  Expected: steps are printed

  Command: <guest-path> run ./cmd/tour tours/example-coupons.en.json --repo <guest-path> --dump --cols 140 --rows 44 --plain

  Observed: ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 16/16 ← Back Last step q Quit

• Quick start: tour a branch with an LLM that writes the tour: Not runnable here: tour needs an interactive terminal (it exited 1 with 'tour needs to run in a terminal' when run with stdin from /dev/null) and a signed-in LLM CLI (Claude Code, Codex CLI, Gemini CLI, OpenCode or Copilot CLI). None of these is installed in the guest and sign-in cannot be done without credentials.

  Source: README.md ## Quick start: cd your-repo; tour

  Input: tour feature/coupons in the example repo

  Expected: an LLM writes the tour after sign-in

  Observed: Not runnable here: tour needs an interactive terminal (it exited 1 with 'tour needs to run in a terminal' when run with stdin from /dev/null) and a signed-in LLM CLI (Claude Code, Codex CLI, Gemini CLI, OpenCode or Copilot CLI). None of these is installed in the guest and sign-in cannot be done without credentials.

Local or hosted: local

Play a saved tour file step by step with `tour tours/example-coupons.en.json --repo <example repo> --dump --cols 140 --rows 44 --plain` (README ## Development / ## Choosing what to tour)

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -200
cd <guest-path> && git init -q && git remote add origin https://github.com/init-co-jp/diff-tour && git fetch --depth 1 origin eeaf897ce18e37018540d6b425accbed4945389c 2>&1 | tail -5; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1; ls -la .coldpass; sed -n 200,400p README.md
cd <guest-path> && cat install.sh; echo ---; cat mise.toml; echo ---; which go claude codex gemini opencode copilot curl git 2>&1; go version 2>&1; echo; ls tours demo cmd/tour | head -40; echo; env | grep -i proxy | sed 's/=.*@/=***@/' 
export NODE_USE_ENV_PROXY=1; curl -fsSL https://raw.githubusercontent.com/init-co-jp/diff-tour/main/install.sh | sh; echo "exit=$?"; ls -la ~/.local/bin 2>&1; ~/.local/bin/tour --version 2>&1; echo "exit=$?"
cd <guest-path> && export PATH=<guest-path>; tour --help 2>&1 | head -40; echo ---; git clone -q https://github.com/init-co-jp/diff-tour-example <guest-path> 2>&1; echo "clone exit=$?"; cd <guest-path> 2>/dev/null && git checkout -q feature/coupons 2>&1; git branch -a 2>&1 | head; 
cd <guest-path> && export PATH=<guest-path>; tour tours/example-coupons.en.json --repo <guest-path> --dump --cols 140 --rows 44 --plain > <guest-path> 2><guest-path>; echo "exit=$?"; wc -l <guest-path>; head -60 <guest-path>; echo ---ERR; head -5 <guest-path>
cd <guest-path> && grep -rniE "cron|schedule|ticker|--once|--now|webhook|time\.Tick|for \{" --include=*.go cmd internal | grep -v _test | head -20; echo ---; grep -n "go 1\|toolchain" go.mod; echo ---; cd <guest-path> && (curl -fsSL -o go.tgz https://go.dev/dl/go1.27.linux-amd64.tar.gz && echo DL_OK || echo DL_FAIL) ; ls -la go.tgz 2>&1
cd <guest-path> && curl -fsSL -o go.tgz https://go.dev/dl/go1.27.2.linux-amd64.tar.gz; echo "dl=$?"; ls -la go.tgz 2>&1; sed -n 70,90p <guest-path>
cd <guest-path> && mkdir -p <guest-path> && tar -C <guest-path> -xzf go.tgz && export PATH=<guest-path> && go version && cd <guest-path> && GOFLAGS=-mod=mod timeout 900 go test ./... 2>&1 | tail -25; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && git status --short | head; echo "---"; git diff --stat | tail -2; echo done
cd <guest-path> && export PATH=<guest-path>; timeout 60 tour feature/coupons --dump --cols 140 --rows 44 --plain </dev/null > <guest-path> 2><guest-path>; echo "exit=$?"; head -c 800 <guest-path>; echo ---ERR; head -c 1000 <guest-path>; echo; ls ~/.config/tour 2>&1; cat ~/.config/tour/config.json 2>/dev/null | head -20
cd <guest-path> && grep -cF '`--dump` prints every step at a fixed screen size, which is handy for checking layouts without a terminal.' README.md; ls -la <guest-path> 2>&1 | head; mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","tours/example-coupons.en.json","--repo","<guest-path>","--dump","--cols","140","--rows","44","--plain"],"cwd":"<guest-path>","expected_text":"Two commits, one new feature"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"--dump prints every step of a saved tour at a fixed screen size","source":"`--dump` prints every step at a fixed screen size, which is handy for checking layouts without a terminal.","input":"tours/example-coupons.en.json against the diff-tour-example repo","expected":"the tour steps are printed to stdout, including the first step title","probe_kind":"cli","argv":["<guest-path>","tours/example-coupons.en.json","--repo","<guest-path>","--dump","--cols","140","--rows","44","--plain"],"expected_text":"Two commits, one new feature","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Development: the repository test suite passes","source":"README.md ## Development: go test ./...","input":"repository checkout at the pinned commit","expected":"all packages report ok","argv":["<guest-path>","test","./..."],"cwd":"<guest-path>","env":{"PATH":"<guest-path>"},"expected_text":"github.com/init-co-jp/diff-tour/internal/tour"},
{"kind":"example","claim":"Development: a saved tour is dumped with go run","source":"README.md ## Development: go run ./cmd/tour tours/example-coupons.en.json --repo path/to/diff-tour-example --dump --cols 140 --rows 44 --plain","input":"tours/example-coupons.en.json and <guest-path>","expected":"steps are printed","argv":["<guest-path>","run","./cmd/tour","tours/example-coupons.en.json","--repo","<guest-path>","--dump","--cols","140","--rows","44","--plain"],"cwd":"<guest-path>","env":{"PATH":"<guest-path>","HOME":"<guest-path>"},"expected_text":"Two commits, one new feature"},
{"kind":"example","claim":"Quick start: tour a branch with an LLM that writes the tour","source":"README.md ## Quick start: cd your-repo; tour","input":"tour feature/coupons in the example repo","expected":"an LLM writes the tour after sign-in","reason":"Not runnable here: tour needs an interactive terminal (it exited 1 with 'tour needs to run in a terminal' when run with stdin from /dev/null) and a signed-in LLM CLI (Claude Code, Codex CLI, Gemini CLI, OpenCode or Copilot CLI). None of these is installed in the guest and sign-in cannot be done without credentials."}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected cmd/tour/main.go and internal/generate/workspace.go; the only for-loops are flag/argument parsing and workspace file handling. The README documents no cron, schedule, --once, --now, loop or webhook; tour is a one-shot command or interactive TUI that exits after a tour is shown or written.","checks":[]}
EOF
python3 -I -c "import json;[json.load(open('.coldpass/'+f)) for f in ['probe.json','claims.json','examples.json','cycles.json']];print('json ok')"
cd <guest-path> && <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Play a saved tour file step by step with `tour tours/example-coupons.en.json --repo <example repo> --dump --cols 140 --rows 44 --plain` (README ## Development / ## Choosing what to tour)","operation_scope":"Linux x86_64 guest, user-local install. Covers viewing a saved tour against the diff-tour-example repo, plus go test ./... from the pinned checkout. NOT covered: generating a new tour with `tour <branch>` or plain `tour`, which needs an interactive terminal and a signed-in LLM CLI (Claude Code, Codex, Gemini, OpenCode or Copilot). None is installed here and sign-in needs credentials we do not have.","steps":["git init; git remote add origin https://github.com/init-co-jp/diff-tour; git fetch --depth 1 origin eeaf897ce18e37018540d6b425accbed4945389c; git reset --mixed FETCH_HEAD","curl -fsSL https://raw.githubusercontent.com/init-co-jp/diff-tour/main/install.sh | sh  (installed tour v0.5.0 to <guest-path>)","tour --version (0.5.0)","git clone https://github.com/init-co-jp/diff-tour-example; git checkout feature/coupons","tour tours/example-coupons.en.json --repo <guest-path> --dump --cols 140 --rows 44 --plain (16 steps printed, exit 0)","go test ./... (Go 1.27.2 from go.dev tarball, user-local at <guest-path>; all packages ok)","go run ./cmd/tour ... --dump (README Development command; exit 0)"],"deviations":["The README installer pulled the latest release (tour v0.5.0), not a build of the pinned commit eeaf897. Not verified that v0.5.0 matches the pinned source.","Go was not installed; downloaded go1.27.2 from go.dev into <guest-path> (user-local, no sudo). The first go test run used GOFLAGS=-mod=mod; git status stayed clean afterward, and the examples run without it.","PATH was not updated by the installer; probes use the absolute path <guest-path>","The LLM-driven tour generation (README Quick start, tour <branch>) was not run: it needs a terminal and a signed-in LLM CLI. Running it with stdin from /dev/null exits 1 with 'tour needs to run in a terminal'."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"For full coverage, install and sign in to one supported LLM CLI in the guest and run `tour feature/coupons` in an interactive terminal with the example repo. Pin the installer to the pinned release or build from the commit to confirm the same version."}
EOF
python3 -I -c "import json;d=json.load(open('.coldpass/report.json'));print(d['outcome'])"; ls -la .coldpass; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json;t=sys.stdin.read();d=json.loads(t[t.find('{'):]) if '{' in t else {};print(d.get('valid'),d.get('problems'),d.get('replay',{}).get('status'))" 2>/dev/null || echo "recheck output not parsed"