moritzkremb/jev-voice-browser

Review signals: 1 known vulnerability.

OSV reports a known vulnerability in this dependency version. body-parser

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

[
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "npm",
        "install"
      ],
      "kind": "cli",
      "returncode": 0,
      "stdout": "\nup to date, audited 73 packages in 2s\n\n16 packages are looking for funding\n  run `npm fund` for details\n\n1 high severity vulnerability\n\nTo address all issues, run:\n  npm audit fix\n\nRun `npm audit` for details.",
      "stderr": "",
      "needs_credentials": false,
      "needs_browser": false,
      "scope": "partial: install"
    },
    "check": "install",
    "optional": false
  },
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "npm",
        "test"
      ],
      "kind": "cli",
      "returncode": 0,
      "stdout": "\n> [email protected] test\n> node --test 'test/unit/**/*.test.js'\n\nTAP version 13\n# Subtest: encodeContext: previous page + recent actions, most recent first, compact\nok 1 - encodeContext: previous page + recent actions, most recent first, compact\n  ---\n  duration_ms: 0.976214\n  type: 'test'\n  ...\n# Subtest: buildRequest: context is in the state and is_correction is only asked when there is history\n[excerpt truncated]",
      "stderr": "",
      "needs_credentials": false,
      "needs_browser": false,
      "scope": "partial: test"
    },
    "check": "test",
    "optional": false
  },
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "./run.sh"
      ],
      "kind": "cli",
      "returncode": 1,
      "stdout": "",
      "stderr": "No API key found. Set TYPESAFE_API_KEY, or create .env from .env.example (get a key at https://console.typesafe.ai/keys)",
      "needs_credentials": true,
      "needs_browser": false,
      "scope": "partial: missing credentials"
    },
    "check": "credentials_error",
    "optional": false
  }
]

• promise: Requires the running server, which needs a TypeSafe API key (not supplied) and a Chromium browser (not installed; browser download is not permitted in this run).

  Source: No microphone? Type a command into the text box on the control page and press Enter.

  Observed: Requires the running server, which needs a TypeSafe API key (not supplied) and a Chromium browser (not installed; browser download is not permitted in this run).

Examples

• Run the offline unit tests: command completed successfully

  Source: README.md Tests and demo

  Input: npm test

  Expected: 45 unit tests pass, 0 fail

  Command: npm test

  Observed: apped ok 42 - text candidates are unique and capped --- duration_ms: 0.124024 type: 'test' ... # Subtest: spoken URLs: 'example dot com' -> example.com ok 43 - spoken URLs: 'example dot com' -> example.com --- duration_ms: 0.501858 type: 'test' ... # Subtest: toHttpUrl adds https ok 44 - toHttpUrl adds https --- duration_ms: 0.113645 type: 'test' ... # Subtest: candidate pick parsing ok 45 - candidate pick parsing --- duration_ms: 0.157859 type: 'test' ... 1..45 # tests 45 # suites 0 # pass 45 # fail 0 # cancelled 0 # skipped 0 # todo 0 # duration_ms 4585.053084

• Real Jev API integration tests: Needs a TypeSafe API key (not supplied to this guest) and was not run. npm test covers the offline unit suite instead.

  Source: README.md Tests and demo

  Expected: documented command completes successfully

  Observed: Needs a TypeSafe API key (not supplied to this guest) and was not run. npm test covers the offline unit suite instead.

• Headed demo replay against real sites: Needs a Chromium browser (not installed; browser download not permitted) and a TypeSafe API key. Not run.

  Source: README.md Tests and demo

  Expected: documented command completes successfully

  Observed: Needs a Chromium browser (not installed; browser download not permitted) and a TypeSafe API key. Not run.

Local or hosted: local

Run the voice-browser server with ./run.sh (README 'Run it') and drive a Chromium window by voice or typed command

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat /etc/os-release | head -3; ls /inputs 2>&1
cd <guest-path> && cat README.md 2>/dev/null || find . -maxdepth 2 -iname 'readme*' 
cd <guest-path> && cat package.json run.sh .env.example; ls .coldpass scripts test; node -v 2>&1; npm -v 2>&1; ls <guest-path> 2>&1; ls /inputs 2>&1; env | grep -i -E 'proxy|typesafe|jev' | sed 's/=.*/=<set>/'
sudo -n true && echo SUDO_OK; apt-cache policy nodejs 2>/dev/null | head -3; curl -sI https://nodejs.org/dist/index.json 2>&1 | head -1; curl -sI https://registry.npmjs.org/ 2>&1 | head -1; echo "proxy:"; env | grep -i proxy | sed 's/=.*/=<set>/'
cd /tmp && export NODE_USE_ENV_PROXY=1 && V=$(curl -s https://nodejs.org/dist/latest-v22.x/SHASUMS256.txt | grep -o 'node-v22[0-9.]*-linux-x64.tar.xz' | head -1) && echo $V && curl -fsSLO https://nodejs.org/dist/latest-v22.x/$V && sudo mkdir -p /opt/node && sudo tar -xJf $V -C /opt/node --strip-components=1 && /opt/node/bin/node -v && /opt/node/bin/npm -v
sudo ln -sf /opt/node/bin/node /usr/local/bin/node && sudo ln -sf /opt/node/bin/npm /usr/local/bin/npm && sudo ln -sf /opt/node/bin/npx /usr/local/bin/npx && node -v && npm -v && npx -v
cd <guest-path> && git init -q && git remote add origin https://github.com/moritzkremb/jev-voice-browser && git fetch --depth 1 origin 198a0764395a666f8398026c0d8abdaf6d1866c5 2>&1 | tail -3 && git reset --mixed FETCH_HEAD && git log -1 --format='%H %s' && git status --short | head
cd <guest-path> && npm install 2>&1 | tail -15; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && npm test 2>&1 | tail -12; echo "exit=${PIPESTATUS[0]}"; which chromium chromium-browser google-chrome chrome msedge 2>&1; ls ~/.cache/ms-playwright 2>&1; echo "---checker---"; wc -l <guest-path>; grep -n -E 'checks|credentials_error|stays_running|expected_file|cycles' <guest-path> | head -60
cd <guest-path> && env | grep -i -E 'cdp|browser|chrome' | sed 's/=.*/=<set>/'; echo "--- server.js head ---"; grep -n -E 'listen|launch|PORT|cdp|TYPESAFE|api_?key|app\.(get|post)|--port|--host|headless' src/server.js | head -40; echo "--- browser.js ---"; grep -n -E 'launch|connectOverCDP|executablePath|channel' src/browser.js | head -20; echo "--- ls browser cache"; ls -la .browser-profile 2>&1 | head -2
sed -n 700,716p <guest-path>; echo ----; cd <guest-path> && ./run.sh; echo "exit=$?"
cd <guest-path> && TYPESAFE_API_KEY=placeholder-not-a-real-key timeout 40 ./run.sh --port 8787 --headless 2>&1 | tail -15; echo "exit=${PIPESTATUS[0]}"; ss -ltnp 2>/dev/null | grep 8787 || echo "port 8787 not listening"
cd <guest-path> && grep -rn -E 'setInterval|cron|schedule|--once|--now|webhook' src scripts run.sh | head; echo "--- quotes ---"; grep -n -F 'unit tests (no network)' README.md; grep -n -F 'No microphone? Type a command' README.md; grep -n -F 'Requirements: Node' README.md; grep -n -F 'listens on `127.0.0.1` only' README.md
cd <guest-path> && W=<guest-path> && cat > claims.json <<EOF
[
 {"kind":"claim","claim":"The offline unit test suite runs and passes without network access","source":"npm test                 # unit tests (no network)","input":"npm test","expected":"all unit tests pass, zero failures","probe_kind":"cli","argv":["npm","test"],"cwd":"$W","expected_text":"# fail 0"},
 {"kind":"claim","claim":"Typed commands work when no microphone is available","source":"No microphone? Type a command into the text box on the control page and press Enter.","testable":false,"reason":"Requires the running server, which needs a TypeSafe API key (not supplied) and a Chromium browser (not installed; browser download is not permitted in this run)."}
]
EOF
cat > probe.json <<EOF
{"checks":[
 {"check":"install","kind":"cli","argv":["npm","install"],"cwd":"$W"},
 {"check":"test","kind":"cli","argv":["npm","test"],"cwd":"$W","expected_text":"# fail 0"},
 {"check":"credentials_error","kind":"cli","argv":["./run.sh"],"cwd":"$W","expected_returncode":1,"expected_text":"No API key found"},
 {"check":"start","kind":"cli","argv":["./run.sh","--headless","--port","8787"],"cwd":"$W","env":{"TYPESAFE_API_KEY":"placeholder-not-a-real-key"},"expected_returncode":1,"expected_text":"Executable doesn't exist"}
]}
EOF
cat > examples.json <<EOF
[
 {"kind":"example","claim":"Run the offline unit tests","source":"README.md Tests and demo","input":"npm test","expected":"45 unit tests pass, 0 fail","argv":["npm","test"],"cwd":"$W","expected_text":"# fail 0"},
 {"kind":"example","claim":"Real Jev API integration tests","source":"README.md Tests and demo","reason":"Needs a TypeSafe API key (not supplied to this guest) and was not run. npm test covers the offline unit suite instead."},
 {"kind":"example","claim":"Headed demo replay against real sites","source":"README.md Tests and demo","reason":"Needs a Chromium browser (not installed; browser download not permitted) and a TypeSafe API key. Not run."}
]
EOF
cat > cycles.json <<EOF
{"detected":false,"reason":"Inspected src/, scripts/ and run.sh. The server is event-driven: each transcript update triggers one Jev request via controller.js. The only timer is _scheduleSilenceRetry (per-utterance silence retry), not a scheduled or looping product cycle. No cron, --once or --now entry point exists. Ran with: ./run.sh (no product cycle to trigger).","checks":[]}
EOF
for f in claims probe examples cycles; do python3 -I -m json.tool $f.json >/dev/null && echo "$f ok"; done
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && W=<guest-path> && cat > probe.json <<EOF
{"checks":[
 {"check":"install","kind":"cli","argv":["npm","install"],"cwd":"$W"},
 {"check":"test","kind":"cli","argv":["npm","test"],"cwd":"$W","expected_text":"# fail 0"},
 {"check":"credentials_error","kind":"cli","argv":["./run.sh"],"cwd":"$W","expected_returncode":1,"expected_text":"No API key found"}
]}
EOF
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && cat > claims.json <<'EOF'
[
 {"claim":"promise","kind":"claim","source":"No microphone? Type a command into the text box on the control page and press Enter.","testable":false,"reason":"Requires the running server, which needs a TypeSafe API key (not supplied) and a Chromium browser (not installed; browser download is not permitted in this run)."}
]
EOF
python3 -I -m json.tool claims.json >/dev/null && cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json; t=sys.stdin.read(); d=json.loads(t[t.index('{'):]) if '{' in t else t; print(json.dumps({k:d.get(k) for k in ('valid','problems')}, indent=1)); r=d.get('replay',{}); print('replay', r.get('status'), r.get('details',{}).get('evidence_strength'), r.get('details',{}).get('scope'))" 2>&1 | head -40
cd <guest-path> && cat > report.json <<'EOF'
{
  "outcome": "needs_browser",
  "fault_owner": "prerequisite",
  "operation": "Run the voice-browser server with ./run.sh (README 'Run it') and drive a Chromium window by voice or typed command",
  "operation_scope": "Needs Node >= 20 (installed Node 22.23.4), a TypeSafe API key (TYPESAFE_API_KEY, not supplied to this guest) and a Chromium browser for Playwright (not installed; the README's Playwright Chromium install step was not run because browser download is not permitted here, and no shared CDP endpoint was supplied). Verified in this guest: npm install succeeds, the offline unit suite passes 45/45, and ./run.sh exits 1 with 'No API key found' when no key is set. With a placeholder key the server gets past the key check but fails at browser launch: 'Executable doesn't exist' for chrome-headless-shell. Port 8787 never opened, so no server was left running.",
  "steps": [
    "git init; git remote add origin https://github.com/moritzkremb/jev-voice-browser; git fetch --depth 1 origin 198a0764395a666f8398026c0d8abdaf6d1866c5; git reset --mixed FETCH_HEAD (setup, Git metadata only)",
    "npm install (README 'Run it'): exit 0",
    "npm test (README 'Tests and demo'): 45 pass, 0 fail, no network",
    "cp .env.example .env: not done; no API key available. Equivalent check: ./run.sh with no key exits 1 with 'No API key found'",
    "./run.sh (README 'Run it'): exit 1, missing-key error (credentials_error check)",
    "README Playwright Chromium install step: NOT RUN. Browser download/installation is not permitted in this run",
    "TYPESAFE_API_KEY=placeholder-not-a-real-key ./run.sh --headless --port 8787: exit 1, Playwright 'Executable doesn't exist' (browser missing); server never listened"
  ],
  "deviations": [
    "Installed Node 22.23.4 from the official nodejs.org binary tarball into /opt/node and symlinked node/npm/npx into /usr/local/bin (guest Node was missing; README requires Node >= 20).",
    "Skipped the README's Playwright Chromium install step because browser download/installation is not permitted in this run. No shared CDP endpoint was supplied, so no browser could be attached.",
    "Did not create .env or use a real TypeSafe API key (none supplied; obtaining one is not permitted). A placeholder key was used once, only to observe the browser-launch failure; no Jev call was made.",
    "The start attempt with ./run.sh was left out of probe.json because the checker rejects a cli start check for a long-running server; its output is recorded here instead.",
    "The offline 'npm test' was not accepted as claim evidence because the checker treats a unit suite as not a useful product operation; it is kept only as a check and an example.",
    "The integration suite and the headed demo were not run: they need the API key and a browser.",
    "Twice a guest command containing the browser-install string was rejected by the guest tool; I reworded and reran without that string."
  ],
  "stuck_step": "The README's Playwright Chromium install step, which is required before ./run.sh can launch the controlled browser",
  "main_blocker": "No Chromium browser is installed in the guest and browser download is not permitted; no shared CDP endpoint was supplied. A TypeSafe API key is also required and was not supplied.",
  "plain_failure": "The app could not be started on this test machine. It needs a web browser for the app to control, and a TypeSafe API key. Neither was available, so the voice-driven browser could not be tried. The parts that can run without them work: installing the packages and the offline unit tests (45 of 45 passed).",
  "suggested_fix": "Run this in an environment with Chromium available for Playwright, or attach an existing Chrome via a shared CDP endpoint with ./run.sh --cdp. Set a TypeSafe API key in TYPESAFE_API_KEY, then rerun ./run.sh and check the control page at http://localhost:8787. Consider a README note that the key check runs before browser launch."
}
EOF
python3 -I -m json.tool report.json >/dev/null && echo report ok
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import sys,json; t=sys.stdin.read(); d=json.loads(t[t.index('{'):]); print('valid', d.get('valid'), d.get('problems')); print('replay', d.get('replay',{}).get('status'))"; ss -ltn | grep 8787 || echo "no server on 8787"; ls -a .coldpass