kklemon/vibegit

Review signals: 1 connection review, 1 hardcoded secret, 6 known vulnerability.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written; package managers (rustup-init) downloaded dependencies over HTTPS; resolver address lookups that send no data; wrote only to its own open file handles.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 8 distinct locations. 2 attributed processes.

Gitleaks found a possible hardcoded secret; value withheld. src/config.rs

OSV reports a known vulnerability in this dependency version. 4 distinct locations. 6 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Init can write its bundled static template.: Claim needs an exact quote from source_file (default README.md).

  Source: "--template" writes the bundled template.

  Input: vibegit init --template

  Expected: Creates .vibegitrules

Examples

• Write bundled project rules template: command completed successfully

  Source: README.md, Commands

  Input: vibegit init --template --force

  Expected: Writes bundled template into .vibegitrules

  Command: /var<guest-path> init --template --force

  Observed: Created <guest-path>

Local or hosted: local

vibegit config show

pwd; git status --short --branch; python3 --version; rg --files -g 'README*' -g 'pyproject.toml' -g 'package.json' -g 'Makefile' -g '.github/**' -g 'AGENTS.md' | head -80
ls -la; find . -maxdepth 3 -type f | head -100
cat README.md
git init; git remote add origin https://github.com/kklemon/vibegit; git fetch --depth 1 origin 7faa1a875da85683fbc28a6e9b4a5c2a4dec7940; git reset --mixed FETCH_HEAD; id -u; rustc --version; cargo --version; git --version; cat Cargo.toml; cat pyproject.toml
sudo -n apt-get -o DPkg::Lock::Timeout=300 update && sudo -n apt-get -o DPkg::Lock::Timeout=300 install -y rustc cargo; cargo install --path .
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal; . "$HOME/.cargo/env"; rustc --version; cargo --version; cargo install --path .
export PATH=/var<guest-path>; rustc --version; cargo --version; cargo install --path .
export PATH=/var<guest-path>; vibegit config show
mkdir -p .coldpass; cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/var<guest-path>","config","show"],"cwd":"<guest-path>","env":{},"expected_text":"google:gemini-3.8-flash"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Shows configuration settings and defaults.","source":"Run `vibegit config show` to see every setting with its current value.","input":"vibegit config show","expected":"Displays model and settings","probe_kind":"cli","argv":["/var<guest-path>","config","show"],"expected_text":"google:gemini-3.8-flash","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Show current configuration defaults","source":"README.md, Commands","input":"vibegit config show","expected":"Shows configuration defaults","argv":["/var<guest-path>","config","show"],"cwd":"<guest-path>","expected_text":"google:gemini-3.8-flash"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"README product entry points are interactive commit review and configuration/rules setup; no scheduler, webhook, or recurring cycle is documented.","checks":[]}
EOF
cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"vibegit config show","operation_scope":"Built from source using Rust 1.99.1 and exercised configuration display without API credentials.","steps":["Read README.md","Installed Rust stable with rustup after system Cargo 1.75 could not parse edition2024 dependency","cargo install --path .","vibegit config show"],"deviations":["Initial cargo install with system Cargo 1.75 failed parsing time-core edition2024; retried successfully with rustup Cargo 1.99.1."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat src/cli.rs | head -100; sed -n '55,145p' README.md
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/var<guest-path>","init","--template"],"cwd":"<guest-path>","output_directory":"<guest-path>","expected_text":"VibeGit"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Init can write its bundled static template.","source":"--template writes the bundled template.","input":"vibegit init --template","expected":"Creates .vibegitrules","probe_kind":"cli","argv":["/var<guest-path>","init","--template"],"expected_text":"VibeGit","cwd":"<guest-path>","output_directory":"<guest-path>"}]
EOF
cat .vibegitrules; /var<guest-path> init --template; cat .vibegitrules
python3 - <<'PY'
import json
p='.coldpass/probe.json'; d=json.load(open(p)); d['argv'][-1]='--force'; open(p,'w').write(json.dumps(d))
p='.coldpass/claims.json'; d=json.load(open(p)); d[0]['argv'][-1]='--force'; open(p,'w').write(json.dumps(d))
PY
mkdir -p .coldpass; cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Write bundled project rules template","source":"README.md, Commands","input":"vibegit init --template --force","expected":"Writes bundled template into .vibegitrules","argv":["/var<guest-path>","init","--template","--force"],"cwd":"<guest-path>","expected_text":"Write all commit subject lines entirely in lowercase."}]
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
python3 - <<'PY'
import json
p='.coldpass/claims.json'; a=json.load(open(p)); a[0]['source']='`--template` writes the bundled template.'; open(p,'w').write(json.dumps(a))
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
python3 - <<'PY'
import json
p='.coldpass/claims.json'; a=json.load(open(p)); a[0]['source']='"--template" writes the bundled template.'; open(p,'w').write(json.dumps(a))
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay; cat .coldpass/report.json