shannhk/llm-wikid

No problems traced to this repository code in these checks.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• qmd exposes the wiki to an agent through a built-in MCP server: Real input produced the expected result: Append-only timeline of all wiki operations

  Source: qmd has a built-in MCP server so your agent can use it as a native tool:

  Input: {"tool": "get", "arguments": {"file": "qmd://my-wiki/log.md"}}

  Expected: the wiki log page text is returned

  Command: qmd mcp tools/call {"tool": "get", "arguments": {"file": "qmd://my-wiki/log.md"}}

  Observed: Append-only timeline of all wiki operations\"\n4: date_created: {{date}}\n5: date_modified: {{date}}\n6: explored: false\n7: confidence: medium\n8: ---\n9: \n10: # Wiki Log\n11: \n12: | Date | Operation | Pages Touched | Notes |\n13: |------|-----------|---------------|-------|\n14: "}}]}

• qmd search runs BM25 keyword search over the wiki: Real input produced the expected result: Wiki Log

  Source: qmd search "query" # BM25 keyword search (fast)

  Input: Append-only

  Expected: the Wiki Log page is listed as a match

  Command: qmd search Append-only

  Observed: Wiki Log Score: 61% @@ -2,4 @@ (1 before, 9 after) title: "Wiki Log" tldr: "Append-only timeline of all wiki operations" date_created: {{date}} date_modified: {{date}}

• qmd vsearch runs vector semantic search over the wiki: Real input produced the expected result: Append-only timeline of all wiki operations

  Source: qmd vsearch "query" # vector semantic search

  Input: append-only timeline

  Expected: the Wiki Log page is returned by vector search

  Command: qmd vsearch 'append-only timeline'

  Observed: Append-only timeline of all wiki operations" date_created: {{date}} date_modified: {{date}} ├─ append-only timeline ├─ vec: definition of append-only and its applications ├─ vec: importance of append-only for data integrity └─ hyde: Understanding append-only timeline is essential for modern developmen... Searching 4 vector queries... QMD Warning: no GPU acceleration, running on CPU (slow). Run 'qmd doctor' for device diagnostics.

Examples

• hybrid query with LLM re-ranking returns wiki pages: command completed successfully

  Source: README.md ## Search (qmd)

  Input: append-only timeline

  Expected: wiki pages are listed, including the Wiki Dashboard

  Command: qmd query 'append-only timeline'

  Observed: fore, 66 after) --- title: "Wiki Dashboard" tldr: "Dataview dashboard for browsing wiki stats and recent activity" Expanding query... (0ms) ├─ append-only timeline ├─ lex: definition of append-only ├─ lex: importance of append-only ├─ vec: definition of append-only and its applications ├─ vec: importance of append-only for data integrity └─ hyde: Understanding append-only timeline is essential for modern developmen... Searching 6 queries... Embedding 4 queries...QMD Warning: no GPU acceleration, running on CPU (slow). Run 'qmd doctor' for device diagnostics. (8.1s) Reranking 5 chunks... (2ms)

• /wiki-ingest, /wiki-query, /wiki-lint and other slash commands run inside Claude Code: Missing prerequisite: the commands are Claude Code slash commands that need an interactive Claude Code agent with LLM credentials. Claude Code is not installed in this guest and no API credentials were supplied, so these were not run. Inspected .claude/commands/*.md instead.

  Source: README.md ## Commands

  Expected: documented command completes successfully

  Observed: Missing prerequisite: the commands are Claude Code slash commands that need an interactive Claude Code agent with LLM credentials. Claude Code is not installed in this guest and no API credentials were supplied, so these were not run. Inspected .claude/commands/*.md instead.

• optional Obsidian and X API ingest tools: Missing prerequisites: yt-dlp, scrapling, summarize and X API OAuth keys are not installed or configured here; the ingest pipeline that uses them runs only inside the agent, so they were not run.

  Source: README.md ## Optional Tools

  Expected: documented command completes successfully

  Observed: Missing prerequisites: yt-dlp, scrapling, summarize and X API OAuth keys are not installed or configured here; the ingest pipeline that uses them runs only inside the agent, so they were not run.

Local or hosted: both

Index the wiki/ folder with qmd and search it (keyword, vector, and hybrid), and read a page back over qmd's MCP server

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat README.md 2>/dev/null | head -200
cd <guest-path> && sed -n 200,400p README.md; echo ---; ls -la scripts templates .coldpass .claude raw wiki; echo ---; cat .env.example; echo ---; cat .gitignore; echo ---; head -c 1500 scripts/* 2>/dev/null | head -150
cd <guest-path> && ls .claude/commands; cat .claude/settings.json; echo ---; head -40 CLAUDE.md; echo ---; which git node npm npx uv claude qmd jq 2>&1; node --version 2>&1; npm --version 2>&1; git --version 2>&1; cat /etc/os-release | head -2
cd <guest-path> && git init -q && git remote add origin https://github.com/shannhk/llm-wikid && timeout 120 git fetch --depth 1 origin c01485f096d0b62644fdf165d5221c20f2b615f7 2>&1 | tail -5; echo "fetch rc=$?"; git reset --mixed FETCH_HEAD 2>&1 | tail -3; git log --oneline -1 2>&1; git status --short | head -20
sudo -n true && echo SUDO_OK; apt-cache policy nodejs npm 2>/dev/null | head -8; env | grep -i proxy | sed 's/=.*@/=***@/' 
(sudo apt-get update -qq 2>&1 | tail -3); apt-cache policy nodejs npm 2>&1 | head -8
export NODE_USE_ENV_PROXY=1; curl -s -m 30 https://registry.npmjs.org/@tobilu%2fqmd/latest | python3 -c 'import json,sys; d=json.load(sys.stdin); print(d.get("version"), d.get("engines"), d.get("bin"))' 2>&1 | head -5
export NODE_USE_ENV_PROXY=1; cd /tmp && curl -sS -m 60 -o /tmp/SHASUMS256.txt https://nodejs.org/dist/latest-v22.x/SHASUMS256.txt && grep 'linux-x64.tar.xz' /tmp/SHASUMS256.txt
cd /tmp && curl -sS -m 300 -o node22.tar.xz https://nodejs.org/dist/latest-v22.x/node-v22.23.4-linux-x64.tar.xz && echo "1805bcd35e6815559bd2eb97db438d3fdb0eb3a5e6a977b7c1badca76337e9ce  node22.tar.xz" | sha256sum -c && sudo mkdir -p /opt/node22 && sudo tar -xJf node22.tar.xz -C /opt/node22 --strip-components=1 && /opt/node22/bin/node --version && /opt/node22/bin/npm --version
export PATH=/opt/node22/bin:$PATH NODE_USE_ENV_PROXY=1 NPM_CONFIG_PREFIX=$HOME/.local/npm; mkdir -p $HOME/.local; node --version && npm --version && timeout 600 npm install -g @tobilu/qmd 2>&1 | tail -15; echo "rc=${PIPESTATUS[0]}"; ls $HOME/.local/npm/bin 2>&1
export PATH=/opt/node22/bin:$HOME/.local/npm/bin:$PATH; cd <guest-path> && timeout 300 qmd collection add wiki --name my-wiki 2>&1 | tail -20; echo "rc=${PIPESTATUS[0]}"
export PATH=/opt/node22/bin:$HOME/.local/npm/bin:$PATH; cd <guest-path> && timeout 900 qmd embed 2>&1 | tail -25; echo "rc=${PIPESTATUS[0]}"
export PATH=/opt/node22/bin:$HOME/.local/npm/bin:$PATH; cd <guest-path> && find wiki -name '*.md' | head -30; echo ---; cat wiki/index.md; echo ---; timeout 300 qmd search "wiki" 2>&1 | head -40; echo "rc=${PIPESTATUS[0]}"
export PATH=/opt/node22/bin:$HOME/.local/npm/bin:$PATH; cd /tmp && { printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"probe","version":"0"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'; sleep 3; } | timeout 60 qmd mcp 2>/dev/null | python3 -I -c 'import sys,json
for l in sys.stdin:
    try: d=json.loads(l)
    except Exception: continue
    if d.get("id")==2:
        for t in d["result"]["tools"]: print(t["name"], json.dumps(t.get("inputSchema",{}).get("properties",{}))[:300])
    else: print(str(d)[:200])'
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import json, subprocess, sys, os
argv = json.loads(sys.argv[1]); tool = sys.argv[2]; args = json.loads(sys.argv[3])
msgs = [
 {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"probe","version":"0"}}},
 {"jsonrpc":"2.0","method":"notifications/initialized"},
 {"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":tool,"arguments":args}}]
inp = "\n".join(json.dumps(m) for m in msgs) + "\n"
out = subprocess.run(argv, input=inp, capture_output=True, text=True, cwd="<guest-path>", timeout=240)
for l in out.stdout.splitlines():
    try: d = json.loads(l)
    except Exception: continue
    if d.get("id") == 2: print(json.dumps(d.get("result") or d.get("error"), indent=1)[:3000])
EOF
export PATH=/opt/node22/bin:$HOME/.local/npm/bin:$PATH; python3 -I <guest-path> '["qmd","mcp"]' get '{"file":"qmd://my-wiki/log.md"}'; echo "rc=$?"
cd <guest-path> && sed -n 40,80p scripts/update-hot-cache.sh; echo ---; grep -il 'schedule\|cron\|--once\|loop' .claude/commands/* scripts/* README.md CLAUDE.md; echo ---; grep -n -i 'schedule\|cron' README.md CLAUDE.md | head; echo; echo HOME=$HOME; ls -la ~/.cache 2>/dev/null | head -3
export PATH=/opt/node22/bin:$HOME/.local/npm/bin:$PATH; cd <guest-path> && timeout 300 qmd search "Append-only" 2>&1 | head -6; echo "rc=$?"; echo ---; timeout 600 qmd vsearch "append-only timeline" 2>&1 | tail -12; echo "vrc=${PIPESTATUS[0]}"; echo ---; timeout 900 qmd query "append-only timeline" 2>&1 | tail -12; echo "qrc=${PIPESTATUS[0]}"
cd <guest-path> && grep -n 'built-in MCP server\|BM25 keyword search\|vector semantic search\|npm install -g @tobilu/qmd' README.md | cat -A | cut -c1-200
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import json, sys
W = "<guest-path>"
ENV = {"PATH": "/opt/node22/bin:<guest-path>", "HOME": "<guest-path>"}
CWD = W
probe = {"kind": "mcp", "argv": ["qmd", "mcp"], "cwd": CWD, "env": ENV,
         "tool": "get", "arguments": {"file": "qmd://my-wiki/log.md"},
         "expected_text": "Append-only timeline of all wiki operations"}
claims = [
 {"kind": "claim", "claim": "qmd exposes the wiki to an agent through a built-in MCP server",
  "source": "qmd has a built-in MCP server so your agent can use it as a native tool:",
  "input": "qmd://my-wiki/log.md", "expected": "the wiki log page text is returned",
  "probe_kind": "mcp", "argv": ["qmd", "mcp"], "env": ENV, "tool": "get",
  "arguments": {"file": "qmd://my-wiki/log.md"},
  "expected_text": "Append-only timeline of all wiki operations", "cwd": CWD},
 {"kind": "claim", "claim": "qmd search runs BM25 keyword search over the wiki",
  "source": "qmd search \"query\"        # BM25 keyword search (fast)",
  "input": "Append-only", "expected": "the Wiki Log page is listed as a match",
  "probe_kind": "cli", "argv": ["qmd", "search", "Append-only"], "env": ENV,
  "expected_text": "Wiki Log", "cwd": CWD},
 {"kind": "claim", "claim": "qmd vsearch runs vector semantic search over the wiki",
  "source": "qmd vsearch \"query\"       # vector semantic search",
  "input": "append-only timeline", "expected": "the Wiki Log page is returned by vector search",
  "probe_kind": "cli", "argv": ["qmd", "vsearch", "append-only timeline"], "env": ENV,
  "expected_text": "Append-only timeline of all wiki operations", "cwd": CWD},
]
examples = [
 {"kind": "example", "claim": "hybrid query with LLM re-ranking returns wiki pages",
  "source": "README.md ## Search (qmd)", "input": "append-only timeline",
  "expected": "wiki pages are listed, including the Wiki Dashboard", "argv": ["qmd", "query", "append-only timeline"],
  "cwd": CWD, "env": ENV, "expected_text": "Wiki Dashboard"},
 {"kind": "example", "claim": "/wiki-ingest, /wiki-query, /wiki-lint and other slash commands run inside Claude Code",
  "source": "README.md ## Commands",
  "reason": "Missing prerequisite: the commands are Claude Code slash commands that need an interactive Claude Code agent with LLM credentials. Claude Code is not installed in this guest and no API credentials were supplied, so these were not run. Inspected .claude/commands/*.md instead."},
 {"kind": "example", "claim": "optional Obsidian and X API ingest tools",
  "source": "README.md ## Optional Tools",
  "reason": "Missing prerequisites: yt-dlp, scrapling, summarize and X API OAuth keys are not installed or configured here; the ingest pipeline that uses them runs only inside the agent, so they were not run."},
]
cycles = {"detected": False,
  "reason": "Entry points inspected: README.md (no cron/loop/--once product command; 'Claude Dispatch' /schedule and cron are remote Claude Code scheduling, not a product command), scripts/update-hot-cache.sh (Stop hook run by Claude Code, which calls 'claude -p' in a background subshell and writes wiki/hot.md asynchronously; Claude Code is not installed and its output is not on stdout), and .claude/commands/*.md (manual slash commands). No runnable product cycle could be triggered and observed here, so no cycle check was recorded.",
  "checks": []}
def dump(name, obj):
    with open(f"{W}/.coldpass/{name}", "w", encoding="utf-8") as f:
        json.dump(obj, f, indent=2, ensure_ascii=False); f.write("\n")
dump("probe.json", probe); dump("claims.json", claims); dump("examples.json", examples); dump("cycles.json", cycles)
print("written")
EOF
python3 -I <guest-path> && ls -la <guest-path> && ls <guest-path> 2>&1
export PATH=/opt/node22/bin:$HOME/.local/npm/bin:/usr/bin:/bin; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -80; echo "rc=${PIPESTATUS[0]}"
pgrep -af 'qmd' | grep -v pgrep || echo "no qmd processes running"; cat > <guest-path> <<'EOF'
import json
report = {
 "outcome": "working",
 "fault_owner": None,
 "operation": "Index the wiki/ folder with qmd and search it (keyword, vector, and hybrid), and read a page back over qmd's MCP server",
 "operation_scope": "Local qmd search layer only (qmd 2.8.3, Node 22, CPU embeddings with embeddinggemma). The README's agent workflows (/wiki-ingest, /wiki-query, /wiki-lint, /autoresearch, /save, /wiki-explore) were NOT run: they are Claude Code slash commands that need an interactive Claude Code agent and LLM credentials, neither available in this guest.",
 "steps": [
  "git init; git remote add origin https://github.com/shannhk/llm-wikid; git fetch --depth 1 origin c01485f096d0b62644fdf165d5221c20f2b615f7; git reset --mixed FETCH_HEAD (tree verified clean at the pin)",
  "sudo apt-get update; apt-cache policy nodejs (Ubuntu offers Node 18 only; qmd needs >=22)",
  "curl https://nodejs.org/dist/latest-v22.x/node-v22.23.4-linux-x64.tar.xz, sha256 verified, extracted to /opt/node22",
  "npm install -g @tobilu/qmd (run with PATH=/opt/node22/bin and NPM_CONFIG_PREFIX=$HOME/.local/npm) -> added 159 packages, qmd 2.8.3",
  "qmd collection add wiki --name my-wiki -> Indexed: 5 new",
  "qmd embed -> Embedded 5 chunks from 5 documents",
  "qmd search \"Append-only\" / qmd vsearch \"append-only timeline\" / qmd query \"append-only timeline\" -> returned Wiki Log / Wiki Dashboard pages",
  "qmd mcp (stdio) -> tools/list shows query, get, multi_get, status; tools/call get on qmd://my-wiki/log.md returned the Wiki Log page"
 ],
 "deviations": [
  "Ubuntu apt nodejs is 18.19.1, below qmd's required node >=22; installed Node 22.23.4 from the official nodejs.org tarball (checksum verified) instead, a substitute for the README's bare 'npm install -g'.",
  "npm global prefix set to a user-local directory ($HOME/.local/npm) instead of the system prefix; the README command itself is unchanged.",
  "qmd embed ran on CPU (no GPU), so it was slow but completed.",
  "Claude Code slash commands and the Stop-hook script (scripts/update-hot-cache.sh, which calls 'claude -p') were not run: Claude Code is not installed and no LLM credentials were supplied. Recorded as blocked examples, not as failures of the repo.",
  "Optional tools yt-dlp, scrapling, summarize and X API keys were not installed/configured; not exercised.",
  "No cycle check recorded: no runnable product cycle exists outside Claude Code; the only trigger is the Claude Code Stop hook."
 ],
 "stuck_step": None,
 "main_blocker": None,
 "plain_failure": None,
 "suggested_fix": "Document that qmd needs Node 22 or newer (Ubuntu 24.04 apt ships Node 18), and state clearly in the README which parts need a Claude Code agent and API credentials."
}
with open("<guest-path>", "w", encoding="utf-8") as f:
    json.dump(report, f, indent=2, ensure_ascii=False); f.write("\n")
print("report written")
EOF
python3 -I <guest-path> && export PATH=/usr/bin:/bin && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -I -c 'import json,sys; d=json.load(sys.stdin); print("valid", d["valid"], "problems", d["problems"], "replay", d["replay"]["status"])'