s0undt3ch/ToolR

Review signals: 2 download and execute.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Source contains download and execute; review its purpose. installation/install.sh 2 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Run the generated hello example with a supplied name.: Real input produced the expected result: hello, Coldpass

  Source: toolr example hello # run the generated example

  Input: --name Coldpass

  Expected: hello, Coldpass

  Command: /tmp/toolr-venv/bin/toolr example hello --name Coldpass

  Observed: hello, Coldpass

Examples

• Scaffold a project and run its generated hello command.: command completed successfully

  Source: README.md / Scaffold your repo

  Input: toolr project init; toolr example hello

  Expected: hello, world

  Command: /tmp/toolr-venv/bin/toolr example hello

  Observed: hello, world

Local or hosted: both

toolr project init and generated example hello

pwd && ls -la && sed -n '1,240p' README.md && python3 --version
which toolr || true; which uv || true; python3 -m pip --version; rg -n "toolr|python" .github/workflows pyproject.toml Cargo.toml | head -60; ls -la .coldpass
python3 -m pip install --user toolr
python3 -m venv /tmp/toolr-venv && /tmp/toolr-venv/bin/pip install toolr
mkdir -p .coldpass && /tmp/toolr-venv/bin/toolr project init
find tools -maxdepth 2 -type f -print; sed -n '1,200p' tools/pyproject.toml; /tmp/toolr-venv/bin/toolr --help
mkdir -p /tmp/toolr-probe; cd /tmp/toolr-probe && /tmp/toolr-venv/bin/toolr project init && /tmp/toolr-venv/bin/toolr example hello
cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["/tmp/toolr-venv/bin/toolr","example","hello","--name","Coldpass"],"cwd":"/tmp/toolr-probe","expected_text":"hello, Coldpass"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Run the generated hello example with a supplied name.","source":"toolr example hello                 # run the generated example","input":"--name Coldpass","expected":"hello, Coldpass","probe_kind":"cli","argv":["/tmp/toolr-venv/bin/toolr","example","hello","--name","Coldpass"],"expected_text":"hello, Coldpass","cwd":"/tmp/toolr-probe"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"Scaffold a project and run its generated hello command.","source":"README.md / Scaffold your repo","input":"toolr project init; toolr example hello","expected":"hello, world","argv":["/tmp/toolr-venv/bin/toolr","example","hello"],"cwd":"/tmp/toolr-probe","expected_text":"hello, world"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README and CLI overview; ToolR runs explicitly invoked task commands and documents no scheduler or recurring product cycle.","checks":[]}
EOF
python3 - <<'PY'
import json
p='.coldpass/report.json'
d={'outcome':'working','fault_owner':None,'operation':'toolr project init and generated example hello','operation_scope':'Installed ToolR 0.35.1 in a Python 3.12.3 virtual environment; scaffolded a fresh project and invoked its hello command.','steps':['Read README install and scaffold instructions.','Installed toolr with pip in /tmp/toolr-venv.','Ran toolr project init in /tmp/toolr-probe.','Ran toolr example hello; output was hello, world.'],'deviations':['Initial pip --user install failed with externally-managed-environment; retried successfully in a venv.','Init in repository could not proceed because tools/pyproject.toml already exists; used a fresh temporary project directory.'],'stuck_step':None,'main_blocker':None,'plain_failure':None,'suggested_fix':None}
open(p,'w').write(json.dumps(d,indent=2)+'\n')
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay