soumatheusgomes/editonny

Review signals: 1 connection review, 41 known vulnerability. 1 static matches retained as context.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 12 distinct locations. 4 attributed processes.

OSV reports a known vulnerability in this dependency version. 2 distinct locations. 41 findings.

1 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The bundled visual catalog of motion scenes can be searched locally: Real input produced the expected result: mortgage-calculator

  Source: Scenes come from the bundled catalog of **145** motion scenes and **79** original clips

  Input: mortgage

  Expected: the mortgage-calculator scene is listed

  Command: python3 editonny.py catalog mortgage

  Observed: mortgage-calculator · Real estate · Mortgage calculator 1 scenes found.

Examples

• Diagnostics of the installed skill (README terminal install): command completed successfully

  Source: README.md#install (Prefer the terminal)

  Input: doctor

  Expected: visual catalog reports 145 scenes with no missing files

  Command: python3 <guest-path> doctor

  Observed: editonny 1.1.0 — local diagnostic Package: <guest-path> · code 67474f0f60be OK · Launcher Python: 3.12.3 OK · uv: <guest-path> OK · ffmpeg: /usr/bin/ffmpeg OK · ffprobe: /usr/bin/ffprobe OK · node: /opt/node24/bin/node OK · npx: /opt/node24/bin/npx OK · Python engine: 3.12.3 OK · Visual catalog: 145 scenes; 0 missing files OK · HyperFrames: Pinned in engine/project-template/package.json; the first render may download the package. This diagnostic does not replace a render test or final video review.

• Engine smoke test renders a sample: command completed successfully

  Source: README.md (Develop and validate)

  Input: scripts/smoke_engine.py

  Expected: a PASS line naming the rendered MP4

  Command: python3 scripts/smoke_engine.py

  Observed: HyperFrames: lint HyperFrames: check HyperFrames: snapshot --at 1,1.5,2 --no-end --describe false --output snapshots HyperFrames: render --quality draft --fps 24 --output renders/smoke.mp4 PASS: <guest-path> smoke r2rmshcc/project with spaces/renders/smoke.mp4 Frame: <guest-path> smoke r2rmshcc/frame-1.png

• Full repository check: lint, typecheck, unit tests, icon registry: command completed successfully

  Source: README.md (Develop and validate)

  Input: npm run check

  Expected: icon registry verifies 49 icons

  Command: npm run check

  Observed: a failed copy and names its visible state The current testing environment is not configured to support act(...) stderr | src/features/feedback/use-copy.test.tsx > useCopy > writes to the clipboard and shows the success toast The current testing environment is not configured to support act(...) stderr | src/features/feedback/use-copy.test.tsx > useCopy > selects the text and shows the fallback toast when the clipboard rejects The current testing environment is not configured to support act(...)

• Engine unit test suite: command completed successfully

  Source: README.md (Develop and validate)

  Input: npm run test:engine

  Expected: 100 engine tests pass

  Command: npm run test:engine

  Observed: gration -p 'test_*.py' ........................................s.............................<guest-path> ResourceWarning: unclosed file <_io.BufferedReader name='/tmp/tmpr3k8u9u2/f_00001.jpg'> w, h = Image.open(img).size ResourceWarning: Enable tracemalloc to get the object allocation traceback ..............ERROR: Encoded true peak remains above -1.0 dBTP after retries; output is not a validated final ................ ---------------------------------------------------------------------- Ran 100 tests in 262.979s OK (skipped=1)

• Local web guide development server: Long-running dev server (python3 editonny.py guide); not a finite example. Left out on purpose; the guide was built with npm run build instead.

  Source: README.md#open-the-guide

  Expected: documented command completes successfully

  Observed: Long-running dev server (python3 editonny.py guide); not a finite example. Left out on purpose; the guide was built with npm run build instead.

Cycles

• Preview watcher reports a new user action in one pass: Triggered one cycle by hand (run-once via the documented --once flag, using a fixture edit folder outside the checkout whose preview_cache is read-only so seen-state does not suppress the event on replay; normal trigger: normal trigger: the watcher loops, polling every --interval seconds (default 1.0) until Ctrl+C; --once checks once and exits): [preview] cut APPROVED · note: "cut looks good"; saved at 10:00:00 [preview] attention: approval refers to an earlier version of cut (None that has since changed. Review the current export before treating it as approved Notice: could not write <guest-path> [Errno 13] Permission denied: '<guest-path>'

  Source: skills/editonny/engine/helpers/watch_preview.py

  Input: <guest-path> containing preview_approval.json with phase cut, saved_at 2026-10-23T10:00:00, note cut looks good

  Expected: one line announcing the cut approval with its saved time

  Command: uv run --locked --directory skills/editonny/engine python helpers/watch_preview.py --edit-dir <guest-path> --once

  Observed: [preview] cut APPROVED · note: "cut looks good"; saved at 10:00:00 [preview] attention: approval refers to an earlier version of cut (None that has since changed. Review the current export before treating it as approved Notice: could not write <guest-path> [Errno 13] Permission denied: '<guest-path>'

Local or hosted: local

Install editonny with its README terminal installer, verify it with doctor, then search the bundled visual scene catalog (python3 editonny.py catalog mortgage) and get mortgage-calculator back; also run the README development checks (npm ci, uv sync, npm run build, npm run check, npm run test:engine, scripts/smoke_engine.py).

cd <guest-path> && pwd && ls -la && id -u && cat /etc/os-release | head -3 && python3 --version && (git -C . status 2>&1 | head -2)
cd <guest-path> && cat README.md 2>/dev/null || ls
cd <guest-path> && ls -la .coldpass; for c in node npm npx uv ffmpeg ffprobe tesseract git curl; do printf "%s: " $c; command -v $c || echo MISSING; done; node -v 2>/dev/null; npm -v 2>/dev/null; cat editonny.py; ls /inputs 2>/dev/null; ls <guest-path> 2>/dev/null; sed -n 1,80p package.json
cd <guest-path> && (git init -q 2>&1; git remote add origin https://github.com/soumatheusgomes/editonny.git 2>&1; timeout 120 git fetch --depth 1 origin 49714f2fba6eafb76b903376e1fe9f50b685506a 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1 2>&1); ls /inputs 2>&1; echo ---; sudo -n true && echo SUDO_OK; sudo apt-get update -qq 2>&1 | tail -2; sudo DEBIAN_FRONTEND=noninteractive apt-get install -y -qq ffmpeg tesseract-ocr 2>&1 | tail -3; command -v ffmpeg ffprobe tesseract
cd /tmp && export NODE_USE_ENV_PROXY=1; curl -fsSL https://astral.sh/uv/install.sh -o /tmp/uv-install.sh && sh /tmp/uv-install.sh 2>&1 | tail -2; export PATH="$HOME/.local/bin:$PATH"; uv --version; mkdir -p /tmp/node-dl && cd /tmp/node-dl && curl -fsSL https://nodejs.org/dist/latest-v24.x/SHASUMS256.txt -o SHASUMS.txt 2>&1; grep -o 'node-v[0-9.]*-linux-x64.tar.xz' SHASUMS.txt | head -1
cd /tmp/node-dl && curl -fsSL -O https://nodejs.org/dist/latest-v24.x/node-v24.22.1-linux-x64.tar.xz && grep 'node-v24.22.1-linux-x64.tar.xz$' SHASUMS.txt | sha256sum -c - && sudo mkdir -p /opt/node24 && sudo tar -xJf node-v24.22.1-linux-x64.tar.xz -C /opt/node24 --strip-components=1 && export PATH=/opt/node24/bin:$HOME/.local/bin:$PATH && node -v && npm -v && npx -v
cd <guest-path> && python3 install.py --help 2>&1 | head -30; grep -niE 'telemetry|consent|input\(|prompt' install.py skills/editonny/scripts/editonny.py | head -20; ls skills/editonny/scripts/ | head; 
export PATH=/opt/node24/bin:$HOME/.local/bin:$PATH NODE_USE_ENV_PROXY=1; cd <guest-path> && timeout 900 python3 install.py --target both 2>&1 | tail -25; echo "exit=$?"
export PATH=/opt/node24/bin:$HOME/.local/bin:$PATH; cd <guest-path> && timeout 300 python3 ~/.local/share/editonny/scripts/editonny.py doctor 2>&1 | tail -40; echo "exit=${PIPESTATUS[0]}"; timeout 120 python3 ~/.local/share/editonny/scripts/editonny.py media status 2>&1 | tail -15
export PATH=/opt/node24/bin:$HOME/.local/bin:$PATH NODE_USE_ENV_PROXY=1; cd <guest-path> && timeout 1200 npm ci --ignore-scripts 2>&1 | tail -5; echo "npm_ci=${PIPESTATUS[0]}"; timeout 900 uv sync --locked --directory skills/editonny/engine 2>&1 | tail -3; echo "uv_sync=${PIPESTATUS[0]}"; timeout 900 npm run build 2>&1 | tail -8; echo "build=${PIPESTATUS[0]}"
export PATH=/opt/node24/bin:$HOME/.local/bin:$PATH NODE_USE_ENV_PROXY=1; cd <guest-path> && timeout 1500 npm run check > /tmp/check.log 2>&1; echo "check=$?"; tail -25 /tmp/check.log
export PATH=/opt/node24/bin:$HOME/.local/bin:$PATH NODE_USE_ENV_PROXY=1; cd <guest-path> && timeout 1200 npm run test:engine > /tmp/engine.log 2>&1; echo "test_engine=$?"; tail -4 /tmp/engine.log; timeout 1200 python3 scripts/smoke_engine.py > /tmp/smoke.log 2>&1; echo "smoke=$?"; tail -8 /tmp/smoke.log; echo ---; python3 editonny.py --help 2>&1 | head -60
export PATH=/opt/node24/bin:$HOME/.local/bin:$PATH; cd <guest-path> && python3 editonny.py catalog --help 2>&1; echo ---; python3 editonny.py catalog caption 2>&1 | head -20; echo "exit=$?"; echo ---; python3 editonny.py guide --help 2>&1 | head -20
cd <guest-path> && grep -rniE 'cron|schedul|webhook|--once|--now|watch loop|while True' --include=*.py --include=*.md skills/editonny/scripts skills/editonny/engine scripts install.py editonny.py 2>/dev/null | grep -v '\.venv' | head -20; echo ---; ls -la <guest-path>; ls /inputs/coldpass-preflight.py 2>&1; ls -la .coldpass; ls -d .work 2>/dev/null && ls .work | head
cd <guest-path> && sed -n 300,360p skills/editonny/engine/helpers/watch_preview.py; ls skills/editonny/engine/.venv/bin/python 2>&1
cd <guest-path> && sed -n 1,30p skills/editonny/engine/helpers/watch_preview.py | cut -c1-220; grep -n 'def \|preview_marks\|preview_approval\|preview_style\|preview_trims\|saved_at\|print(' skills/editonny/engine/helpers/watch_preview.py | head -60
cd <guest-path> && sed -n 51,84p skills/editonny/engine/helpers/watch_preview.py | cut -c1-200
export PATH=/opt/node24/bin:$HOME/.local/bin:$PATH; mkdir -p <guest-path> && printf '%s\n' '{"phase": "cut", "saved_at": "2026-10-23T10:00:00", "note": "cut looks good"}' > <guest-path> && cd <guest-path> && for i in 1 2; do uv run --locked --directory skills/editonny/engine python helpers/watch_preview.py --edit-dir <guest-path> --once; echo "exit=$?"; done; ls -la <guest-path> <guest-path> 2>&1
export PATH=/opt/node24/bin:$HOME/.local/bin:$PATH; E=<guest-path>; rm -f $E/preview_cache/watch_seen.json && chmod 555 $E/preview_cache && cd <guest-path> && for i in 1 2; do uv run --locked --directory skills/editonny/engine python helpers/watch_preview.py --edit-dir $E --once 2>/tmp/err$i.txt; echo "exit=$?"; cat /tmp/err$i.txt; done
cd <guest-path> && grep -c 'Scenes come from the bundled catalog of \*\*145\*\* motion scenes and \*\*79\*\* original clips' README.md; grep -n '^    if args.once:$' skills/editonny/engine/helpers/watch_preview.py; grep -c 'python3 scripts/smoke_engine.py' README.md; grep -n 'Local transcription and rendering' README.md | head -2; grep -n 'icons verified' -r scripts design-system/scripts 2>/dev/null | head -2; grep -n 'Visual catalog' skills/editonny/scripts/*.py skills/editonny/engine/*.py 2>/dev/null | head -2
cd <guest-path> && mkdir -p .coldpass && NODEENV='{"PATH":"/opt/node24/bin:<guest-path>","NODE_USE_ENV_PROXY":"1"}' && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["python3","editonny.py","catalog","mortgage"],"cwd":"<guest-path>","expected_text":"mortgage-calculator"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"The bundled visual catalog of motion scenes can be searched locally","source":"Scenes come from the bundled catalog of **145** motion scenes and **79** original clips","input":"mortgage","expected":"the mortgage-calculator scene is listed","probe_kind":"cli","argv":["python3","editonny.py","catalog","mortgage"],"expected_text":"mortgage-calculator","cwd":"<guest-path>"}]
EOF
cat > .coldpass/examples.json <<EOF
[
{"kind":"example","claim":"Diagnostics of the installed skill (README terminal install)","source":"README.md#install (Prefer the terminal)","input":"doctor","expected":"visual catalog reports 145 scenes with no missing files","argv":["python3","<guest-path>","doctor"],"cwd":"<guest-path>","env":$NODEENV,"expected_text":"145 scenes; 0 missing files"},
{"kind":"example","claim":"Engine smoke test renders a sample","source":"README.md (Develop and validate)","input":"scripts/smoke_engine.py","expected":"a PASS line naming the rendered MP4","argv":["python3","scripts/smoke_engine.py"],"cwd":"<guest-path>","env":$NODEENV,"expected_text":"PASS:"},
{"kind":"example","claim":"Full repository check: lint, typecheck, unit tests, icon registry","source":"README.md (Develop and validate)","input":"npm run check","expected":"icon registry verifies 49 icons","argv":["npm","run","check"],"cwd":"<guest-path>","env":$NODEENV,"expected_text":"49 icons verified."},
{"kind":"example","claim":"Engine unit test suite","source":"README.md (Develop and validate)","input":"npm run test:engine","expected":"100 engine tests pass","argv":["npm","run","test:engine"],"cwd":"<guest-path>","env":$NODEENV,"expected_text":"OK (skipped=1)"},
{"kind":"example","claim":"Local web guide development server","source":"README.md#open-the-guide","reason":"Long-running dev server (python3 editonny.py guide); not a finite example. Left out on purpose; the guide was built with npm run build instead.","deferred":true}
]
EOF
cat > .coldpass/cycles.json <<EOF
{"detected":true,"checks":[{"claim":"Preview watcher reports a new user action in one pass","source":"skills/editonny/engine/helpers/watch_preview.py","quote":"    if args.once:","schedule":"normal trigger: the watcher loops, polling every --interval seconds (default 1.0) until Ctrl+C; --once checks once and exits","method":"run-once via the documented --once flag, using a fixture edit folder outside the checkout whose preview_cache is read-only so seen-state does not suppress the event on replay","input":"<guest-path> containing preview_approval.json with phase cut, saved_at 2026-10-23T10:00:00, note cut looks good","expected":"one line announcing the cut approval with its saved time","kind":"cli","argv":["uv","run","--locked","--directory","skills/editonny/engine","python","helpers/watch_preview.py","--edit-dir","<guest-path>","--once"],"cwd":"<guest-path>","env":$NODEENV,"expected_text":"[preview] cut APPROVED"}]}
EOF
for f in probe claims examples cycles; do python3 -I -c "import json,sys;json.load(open(sys.argv[1]));print('ok',sys.argv[1])" .coldpass/$f.json; done
cd <guest-path> && <env-var>=<guest-path> timeout 1700 python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "exit=${PIPESTATUS[0]}"
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install editonny with its README terminal installer, verify it with doctor, then search the bundled visual scene catalog (python3 editonny.py catalog mortgage) and get mortgage-calculator back; also run the README development checks (npm ci, uv sync, npm run build, npm run check, npm run test:engine, scripts/smoke_engine.py).","operation_scope":"Local Linux (Ubuntu 24.04, x86_64) guest. Prerequisites installed here: Node 24.22.1 (tarball from nodejs.org, checksum verified), uv 0.13.5 (astral.sh installer), ffmpeg/ffprobe and tesseract (apt). Python 3.12.3 used for the launcher and engine. Not covered: the interactive guide server (long-running), the Playwright browser tests, and the agent-browser preview tests, which need a browser download and were not run.","steps":["git init; git remote add origin https://github.com/soumatheusgomes/editonny.git; git fetch --depth 1 origin 49714f2fba6eafb76b903376e1fe9f50b685506a; git reset --mixed FETCH_HEAD","sudo apt-get install -y ffmpeg tesseract-ocr","curl -fsSL https://astral.sh/uv/install.sh | sh","Node 24.22.1 tarball from nodejs.org, SHA-256 checked, extracted to /opt/node24","python3 install.py --target both","python3 ~/.local/share/editonny/scripts/editonny.py doctor","python3 ~/.local/share/editonny/scripts/editonny.py media status","npm ci --ignore-scripts","uv sync --locked --directory skills/editonny/engine","npm run build","npm run check","npm run test:engine","python3 scripts/smoke_engine.py","python3 editonny.py catalog mortgage"],"deviations":["Ubuntu apt does not provide Node 22.13+/24, so Node was installed from the official nodejs.org tarball instead of apt; uv was installed with its astral.sh script; both are prerequisite installs, not product changes.","README says to clone the repo; the workspace snapshot was used instead, with the pinned commit fetched via the git steps from the task, so the working tree matches commit 49714f2.","The task's /inputs/coldpass-preflight.py does not exist in this guest; the checker at <guest-path> was run instead with the documented flags.","Replay of the cycle uses a fixture edit folder outside the checkout (<guest-path>) with a read-only preview_cache, so seen-state does not suppress the event on repeated runs. The cycle is the documented --once mode of helpers/watch_preview.py, which the README does not describe; it is a manual single pass, not a product scheduler.","The local guide (python3 editonny.py guide) was not started: it is a long-running dev server, so it is recorded as a deferred example.","npm run test:browser, npm run test:preview and npm run test:three were not run: they need a Chromium or agent-browser download, which the task forbids. No browser was installed.","npm run check and npm run test:engine print noisy warnings (act() warnings, a ResourceWarning and a true-peak ERROR line from a test fixture) but exit 0 and report all tests passed."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for this run. Optional: the README could say that Ubuntu's apt Node is too old so readers should install Node 22.13+ explicitly, and that the preview helper's --once mode is a documented way to check approvals."}
EOF
python3 -I -c "import json;json.load(open('.coldpass/report.json'));print('report ok')"; ls .coldpass; pgrep -af 'editonny.py guide|next|vite' | grep -v pgrep || echo "no servers running"; <env-var>=<guest-path> timeout 1700 python3 -I <guest-path> --validate --replay > /tmp/final-check.json 2>&1; echo "checker_exit=$?"; python3 -I -c "import json;d=json.load(open('/tmp/final-check.json'));print('valid=',d['valid'],'problems=',d['problems'],'replay=',d['replay']['status'])"