stablyai/orca

Review signals: 1 connection review, 1 encoded execution, 258 hardcoded secret, 7 known vulnerability, 1 outside write, 3 sensitive read. 48 static matches retained as context.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 22 distinct locations. 13 attributed processes.

Source contains encoded execution; review its purpose. src/main/wsl-bash-command.ts

Gitleaks found a possible hardcoded secret; value withheld. 70 distinct locations. 238 findings.

OSV reports a known vulnerability in this dependency version. 3 distinct locations. 7 findings.

Repository processes attempted these writes outside documented output/cache paths. 3 distinct locations. 8 attributed processes.

A repository process attempted to read this sensitive path. 3 distinct locations. 3 findings. 11 attributed processes.

2 download and execute matches retained as context; full list in the evidence.

2 encoded blob matches retained as context; full list in the evidence.

2 encoded execution matches retained as context; full list in the evidence.

41 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The documented pnpm install step prepares the workspace: Real input produced the expected result: Lockfile is up to date

  Source: pnpm install

  Input: pnpm install --frozen-lockfile

  Expected: pnpm reports the lockfile is up to date

  Command: <guest-path> install --frozen-lockfile

  Observed: Lockfile is up to date, resolution step is skipped Done in 674ms using pnpm v12.14.0

Examples

• Documented pnpm install step: command completed successfully

  Source: .github/CONTRIBUTING.md

  Input: pnpm install --frozen-lockfile

  Expected: Lockfile is up to date

  Command: <guest-path> install --frozen-lockfile

  Observed: Scope: all 4 workspace projects Agent skills awaiting approval: agent-browser. Run "pnpm approve" to review them. ✓ Lockfile passes supply-chain policies (verified 24m ago) Lockfile is up to date, resolution step is skipped Done in 582ms using pnpm v12.14.0

• Documented lint check before opening a PR: command output contains a crash diagnostic

  Source: .github/CONTRIBUTING.md

  Input: pnpm lint

  Expected: lint passes

  Command: <guest-path> lint

  Observed: dled-skill-guides && pnpm run verify:skill-bundle-manifest && pnpm run verify:localization-catalogs && pnpm run verify:localization-extraction && pnpm run verify:localization-coverage && pnpm run check:process-host-imports && pnpm run check:main-sync-spawn-ratchet && pnpm run check:compat-boundary-imports thread 'tokio-rt-worker' (15904) panicked at crates/oxc_allocator/src/pool/fixed_size.rs:112:67: called `Result::unwrap()` on an `Err` value: () note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace Aborted (core dumped) [ELIFECYCLE] Command failed with exit code 134.

• Documented typecheck before opening a PR: command exited with code 1

  Source: .github/CONTRIBUTING.md

  Input: pnpm typecheck

  Expected: typecheck passes

  Command: <guest-path> typecheck

  Observed: $ pnpm run build:packages && node config/scripts/run-typecheck-projects-in-parallel.mjs $ pnpm --filter @orca/process-host build $ tsx --conditions=orca-source scripts/build-dist.mjs tsrs config/tsconfig.node.json exited with signal SIGKILL [ELIFECYCLE] Command failed with exit code 1.

• Documented offline test suite (pnpm test): Not run in this session: the full Bun/Vitest suite was not completed; lint and typecheck already fail on this VM (4 GB RAM, 2 CPUs), so the suite was deferred to limit runtime.

  Source: .github/CONTRIBUTING.md

  Input: pnpm test

  Expected: Vitest suites pass

  Observed: Not run in this session: the full Bun/Vitest suite was not completed; lint and typecheck already fail on this VM (4 GB RAM, 2 CPUs), so the suite was deferred to limit runtime.

Cycles

• Orca runs scheduled automations: Needs an existing automation with a target project and an installed agent CLI; no automation was created in this session, so no cycle was triggered.

  Source: docs/site/content/docs/cli/automations.mdx

  Input: orca automations run <automationId> --json

  Expected: one automation run is triggered by hand

  Observed: Needs an existing automation with a target project and an installed agent CLI; no automation was created in this session, so no cycle was triggered.

Local or hosted: local

Start the Orca desktop dev app with the documented `pnpm dev` (CONTRIBUTING.md Local Setup) and verify the Vite renderer URL; verify the documented `pnpm install` step.

cd <guest-path> && pwd && ls -la && id -u && cat /etc/os-release | head -3 && python3 --version && git --version; node --version; npm --version; uv --version 2>/dev/null; echo done
cd <guest-path> && ls -la; test -f README.md && wc -l README.md && head -150 README.md
cd <guest-path> && sed -n 150,276p README.md
cd <guest-path> && ls -la .coldpass; ls <guest-path> 2>&1; ls /inputs 2>&1; git status 2>&1 | head -3
cd <guest-path> && cat .github/CONTRIBUTING.md 2>/dev/null | head -200; echo ----; node -e 1 2>/dev/null; python3 -c "import json;d=json.load(open('package.json'));print(d.get('engines'),d.get('packageManager'));print(json.dumps(d['scripts'],indent=1)[:3000])"
cd <guest-path> && git init -q 2>&1; git remote add origin https://github.com/stablyai/orca 2>&1; timeout 300 git fetch --depth 1 origin 2847bbe9e81ea8d94f0e42560aa981b3fccd4614 2>&1 | tail -5; git reset --mixed FETCH_HEAD 2>&1 | tail -3; git log --oneline -1 2>&1; git status --short | head -20; cat config/.bun-version 2>/dev/null; echo; ls .coldpass
sudo -n true && echo SUDO_OK; which docker && docker info >/dev/null 2>&1 && echo DOCKER_OK || echo DOCKER_NO; which curl wget xvfb-run; env | grep -i proxy | sed 's/=.*@/=***@/' ; curl -sS -m 15 -o /dev/null -w "%{http_code}\n" https://nodejs.org/dist/index.json; curl -sS -m 15 -o /dev/null -w "%{http_code}\n" https://registry.npmjs.org/pnpm
set -e; cd /tmp && V=$(curl -sS https://nodejs.org/dist/index.json | python3 -c "import json,sys;print([x['version'] for x in json.load(sys.stdin) if x['version'].startswith('v24.')][0])"); echo "Node $V"; mkdir -p $HOME/.local && curl -sSfL -o node.tar.xz https://nodejs.org/dist/$V/node-$V-linux-x64.tar.xz && rm -rf $HOME/.local/node24 && mkdir -p $HOME/.local/node24 && tar -xJf node.tar.xz -C $HOME/.local/node24 --strip-components=1 && rm node.tar.xz && export PATH=$HOME/.local/node24/bin:$PATH && node --version && npm --version && npm install -g <email> 2>&1 | tail -3 && pnpm --version
export PATH=$HOME/.local/node24/bin:$PATH; export BUN_INSTALL=$HOME/.local/bun; curl -fsSL https://bun.sh/install | bash -s "bun-v1.4.4" 2>&1 | tail -3; $BUN_INSTALL/bin/bun --version
sudo -n apt-get install -y unzip >/tmp/apt.log 2>&1 || (sudo -n apt-get update >/tmp/apt-up.log 2>&1 && sudo -n apt-get install -y unzip >>/tmp/apt.log 2>&1); echo rc=$?; tail -2 /tmp/apt.log; export PATH=$HOME/.local/node24/bin:$PATH; export BUN_INSTALL=$HOME/.local/bun; curl -fsSL https://bun.sh/install | bash -s "bun-v1.4.4" 2>&1 | tail -3; $BUN_INSTALL/bin/bun --version
cd <guest-path> && export PATH=$HOME/.local/node24/bin:$HOME/.local/bun/bin:$PATH NODE_USE_ENV_PROXY=1 CI=1; nohup pnpm install --frozen-lockfile > /tmp/pnpm-install.log 2>&1 &
echo started
cd <guest-path> && python3 -c "
import json;d=json.load(open('package.json'))
print(d.get('bin'))
for k,v in d['scripts'].items():
    if any(w in k for w in ['dev','start','build','test','cli','mcp','orca']): print(k,'=>',v[:200])
"; ls src; ls src/cli 2>/dev/null | head; ls docs | head -30; grep -ril "mcp" docs --include=*.md -l | head
sleep 120; tail -5 /tmp/pnpm-install.log; echo; cd <guest-path> && find docs -path '*cli*' -name '*.md*' | head; ls docs/site 2>/dev/null | head
grep -n -i "error\|gyp\|ERR" /tmp/pnpm-install.log | head -40; echo; cat /tmp/pnpm-install.log | head -30
sudo -n apt-get install -y build-essential python3 >/tmp/apt2.log 2>&1; echo rc=$?; tail -2 /tmp/apt2.log; which make g++ gcc
cd <guest-path> && export PATH=$HOME/.local/node24/bin:$HOME/.local/bun/bin:$PATH NODE_USE_ENV_PROXY=1 CI=1; timeout 3000 pnpm install --frozen-lockfile > /tmp/pnpm-install2.log 2>&1; echo rc=$?; tail -15 /tmp/pnpm-install2.log
cd <guest-path> && sed -n 1,120p docs/site/content/docs/cli/overview.mdx
cd <guest-path> && export PATH=$HOME/.local/node24/bin:$HOME/.local/bun/bin:$PATH NODE_USE_ENV_PROXY=1; timeout 1500 pnpm build:cli > /tmp/build-cli.log 2>&1; echo rc=$?; tail -12 /tmp/build-cli.log; ls -la out/cli 2>/dev/null | head
sudo -n apt-get install -y xvfb xauth libgtk-3-0t64 libnss3 libatk1.0-0t64 libatk-bridge2.0-0t64 libgbm1 libasound2t64 libxss1 libxtst6 libcups2t64 libdrm2 libxkbcommon0 libxcomposite1 libxdamage1 libxrandr2 libpango-1.0-0 libcairo2 libgdk-pixbuf-2.0-0 libxshmfence1 libsecret-1-0 libnotify4 >/tmp/apt3.log 2>&1; echo rc=$?; tail -3 /tmp/apt3.log; which xvfb-run Xvfb
cd <guest-path> && export PATH=$HOME/.local/node24/bin:$HOME/.local/bun/bin:$PATH; timeout 60 xvfb-run -a node_modules/electron/dist/electron --version 2>&1 | tail -5; echo rc=$?; grep -n "node-pty\|rebuild" /tmp/pnpm-install2.log | tail -5
cd <guest-path> && SB=$(readlink -f node_modules/electron/dist/chrome-sandbox); echo $SB; sudo -n chown root:root "$SB" && sudo -n chmod 4755 "$SB" && ls -l "$SB"; export PATH=$HOME/.local/node24/bin:$PATH; timeout 60 xvfb-run -a node_modules/electron/dist/electron --version 2>&1 | tail -3; echo; find node_modules/.pnpm -path '*node-pty*' -name 'pty.node' 2>/dev/null | head -3; node -e "require('$(find node_modules/.pnpm -maxdepth 1 -name 'node-pty@*' | head -1)/node_modules/node-pty')" 2>&1 | tail -2; echo ptyrc=$?
cd <guest-path> && export PATH=$HOME/.local/node24/bin:$PATH; D=$(readlink -f node_modules/node-pty); echo $D; cd $D && node -e "require('.')" 2>&1 | head -5; ls $D/build 2>/dev/null | head; ls $D/prebuilds 2>/dev/null; cd <guest-path> && grep -n "node-pty" -i /tmp/pnpm-install2.log | head; sed -n 1,40p config/scripts/rebuild-native-deps.mjs | head -60
cd <guest-path> && export PATH=$HOME/.local/node24/bin:$HOME/.local/bun/bin:$PATH NODE_USE_ENV_PROXY=1; timeout 1200 pnpm rebuild:electron > /tmp/rebuild-electron.log 2>&1; echo rc=$?; tail -8 /tmp/rebuild-electron.log
cd <guest-path> && export PATH=$HOME/.local/node24/bin:$HOME/.local/bun/bin:$PATH NODE_USE_ENV_PROXY=1 ORCA_DEV_MAIN_SOURCEMAPS=0; nohup xvfb-run -a pnpm dev > /tmp/orca-dev.log 2>&1 &
sleep 150; tail -30 /tmp/orca-dev.log | cut -c1-300
cd <guest-path> && export PATH=$HOME/.local/node24/bin:$PATH; timeout 60 node out/cli/index.js status --json 2>&1 | head -30; echo rc=$?; echo ---; sed -n 1,40p config/scripts/orca-dev.mjs | head -50
cd <guest-path> && export PATH=$HOME/.local/node24/bin:$PATH; timeout 60 node config/scripts/orca-dev.mjs status --json 2>&1 | head -40; echo; timeout 60 node config/scripts/orca-dev.mjs repo list --json 2>&1 | head -30; echo; timeout 60 node config/scripts/orca-dev.mjs --help 2>&1 | head -60
cd <guest-path> && export PATH=$HOME/.local/node24/bin:$PATH; timeout 60 node config/scripts/orca-dev.mjs --help 2>&1 | sed -n 60,140p; echo ---; timeout 60 node config/scripts/orca-dev.mjs repo add --help 2>&1 | head -30
set -e; mkdir -p <guest-path> && cd <guest-path> && git init -q -b main && git -c <email> -c user.name=t commit -q --allow-empty -m init && cd <guest-path> && export PATH=$HOME/.local/node24/bin:$PATH; timeout 120 node config/scripts/orca-dev.mjs repo add --path <guest-path> --json 2>&1 | head -40; echo ---; timeout 60 node config/scripts/orca-dev.mjs repo list --json 2>&1 | head -40
cd <guest-path> && wc -l check.py && grep -n "stays_running\|def \|expected_file\|Popen\|timeout" check.py | head -120
cd <guest-path> && sed -n 202,225p check.py; sed -n 612,652p check.py; sed -n 674,746p check.py
cd <guest-path> && pkill -f "run-electron-vite-dev" ; pkill -f "electron-vite" ; pkill -f "config/scripts/orca-dev" ; sleep 5; pkill -f "node_modules/electron/dist/electron"; pkill -f "vite"; sleep 3; pgrep -fa "electron|vite|pnpm dev" | grep -v pgrep | head -5; echo cleaned; export PATH=$HOME/.local/node24/bin:$PATH; timeout 60 node config/scripts/orca-dev.mjs repo list --json 2>&1 | head -12; echo rc=$?
cd <guest-path> && echo ok; git status --short | head; ls $HOME/.local/node24/bin | head -3; (ss -ltnp 2>/dev/null | grep 5173) ; echo done
cd <guest-path> && export PATH=$HOME/.local/node24/bin:$PATH && timeout 60 node config/scripts/orca-dev.mjs status --json; echo rc=$?; grep -n "run-cli\|stays_running\|def cli_details" <guest-path> | head -20
sed -n 640,740p <guest-path>
cd <guest-path> && grep -n "orca open\|orca serve\|orca start\|dev\b" docs/site/content/docs/cli/overview.mdx | head; export PATH=$HOME/.local/node24/bin:$PATH; timeout 20 node out/cli/index.js --help 2>&1 | head -40
cd <guest-path> && export PATH=$HOME/.local/node24/bin:$PATH && echo "DISPLAY=$DISPLAY" && timeout 200 xvfb-run -a node config/scripts/orca-dev.mjs open --json > /tmp/open.out 2>/tmp/open.err; echo rc=$?; head -c 1500 /tmp/open.out; echo ---; tail -c 600 /tmp/open.err
cd <guest-path> && grep -n "probe_kind\|cycles\|examples.json\|'checks'\|fault_owner\|cycle" check.py | head -60; grep -n "Agents drive Orca\|any CLI agent" <guest-path> | cat -A | cut -c1-200
cd <guest-path> && sed -n 955,1010p check.py; sed -n 1150,1185p check.py
cd <guest-path> && grep -n "orca automations\|schedule\|cron" docs/site/content/docs/cli/automations.mdx | head -20; grep -n "\"automations\"\|automations " out/cli/index.js 2>/dev/null | head -3; export PATH=$HOME/.local/node24/bin:$PATH; timeout 30 node config/scripts/orca-dev.mjs automations --help 2>&1 | head -20
cd <guest-path> && NODE=<guest-path>; ls -l $NODE && $NODE -v && timeout 60 $NODE config/scripts/orca-dev.mjs repo list --json | grep -n "demo-repo\|displayName" ; grep -n "Agents drive Orca too" README.md | head -2
cd <guest-path> && NODE=<guest-path>; timeout 60 $NODE config/scripts/orca-dev.mjs repo list --json; echo rc=$?
cd <guest-path> && mkdir -p .coldpass && NODE=<guest-path> && cat > .coldpass/probe.json <<EOF
{"kind":"cli","argv":["$NODE","config/scripts/orca-dev.mjs","open","--json"],"cwd":"<guest-path>","expected_text":"\"reachable\": true"}
EOF
cat > .coldpass/claims.json <<EOF
[{"kind":"claim","claim":"Agents can drive Orca from the orca CLI","source":"README.md","quote":"Agents drive Orca too — script every workflow with \`orca worktree create\`, \`snapshot\`, \`click\`, and \`fill\`.","source_quote":"Agents drive Orca too — script every workflow with \`orca worktree create\`, \`snapshot\`, \`click\`, and \`fill\`.","input":"node config/scripts/orca-dev.mjs open --json","expected":"the orca CLI launches Orca and reports the runtime reachable","probe_kind":"cli","argv":["$NODE","config/scripts/orca-dev.mjs","open","--json"],"cwd":"<guest-path>","expected_text":"\"reachable\": true"}]
EOF
python3 -c "import json;print(json.load(open('.coldpass/probe.json')));print(json.load(open('.coldpass/claims.json'))[0]['claim'])"; sed -n 1,40p <guest-path> | grep -n "source_file\|quote" ; grep -n "'source'\|\"source\"\|source_file" <guest-path> | head
cd <guest-path> && NODE=<guest-path> && python3 - <<'EOF'
import json
node="<guest-path>"
q="Agents drive Orca too — script every workflow with `orca worktree create`, `snapshot`, `click`, and `fill`."
claims=[{"kind":"claim","claim":"Agents can drive Orca through the orca CLI","source":q,"source_file":"README.md","input":"node config/scripts/orca-dev.mjs open --json","expected":"the orca CLI launches Orca and reports the runtime reachable","probe_kind":"cli","argv":[node,"config/scripts/orca-dev.mjs","open","--json"],"cwd":"<guest-path>","expected_text":"\"reachable\": true"}]
json.dump(claims,open('.coldpass/claims.json','w'),indent=2,ensure_ascii=False)
EOF
<env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -60
ps -eo pid,etimes,args | grep -i "electron\|Xvfb\|orca" | grep -v grep | cut -c1-180 | head -20; ls -la <guest-path> 2>/dev/null | head; find <guest-path> -maxdepth 6 \( -name "SingletonLock" -o -name "*.lock" \) 2>/dev/null | head
cd <guest-path> && NODE=<guest-path>; timeout 200 xvfb-run -a $NODE config/scripts/orca-dev.mjs open --json > /tmp/open2.out 2>/tmp/open2.err; echo rc=$?; grep -n "reachable\|code\|desktopWindow" /tmp/open2.out | head; tail -c 800 /tmp/open2.err
cd <guest-path> && ls; find . -name "*.log" -newer /tmp/open.out 2>/dev/null | head; for f in $(find . -name "*.log" 2>/dev/null | head -3); do echo "== $f"; tail -n 15 "$f" | cut -c1-260; done
cd <guest-path> && ls -la; tail -n 30 daemon.log 2>/dev/null | cut -c1-300 | tail -20; grep -il "error\|fail" * 2>/dev/null | head
cd <guest-path> && NODE=<guest-path>; rm -rf <guest-path> <guest-path> && timeout 240 xvfb-run -a $NODE config/scripts/orca-dev.mjs open --json > /tmp/open3.out 2>/tmp/open3.err; echo rc=$?; grep -n "reachable\|\"code\"\|desktopWindowStatus" /tmp/open3.out | head -5
tail -n 6 <guest-path> | cut -c1-240; echo ---; tail -n 12 <guest-path> | cut -c1-240
cd <guest-path> && ls out 2>/dev/null; ls out/main 2>/dev/null | head -3; grep -n "electron\|spawn\|out/" config/scripts/orca-dev.mjs | head -20; sed -n 1,30p config/scripts/orca-dev.mjs | cut -c1-160
grep -n "Local:\|ready in\|VITE\|localhost:5173\|Electron\|window" /tmp/orca-dev.log | head -12 | cut -c1-200
cd <guest-path> && grep -n "pnpm dev" .github/CONTRIBUTING.md | cut -c1-200; ls -l <guest-path> | grep pnpm; <guest-path> --version 2>&1 | tail -1
cd <guest-path> && sed -n 18,28p .github/CONTRIBUTING.md | cat -A | cut -c1-180
cd <guest-path> && python3 - <<'EOF'
import json
pnpm="<guest-path>"
probe={"kind":"cli","argv":[pnpm,"dev"],"cwd":"<guest-path>","stays_running":True,"expected_text":"http://localhost:5173/"}
json.dump(probe,open('.coldpass/probe.json','w'),indent=2)
claims=[{"kind":"claim","claim":"The documented dev command starts the Orca desktop app","source":"pnpm dev","source_file":".github/CONTRIBUTING.md","input":"pnpm dev","expected":"Vite serves the renderer at http://localhost:5173/ and the app starts","probe_kind":"cli","argv":[pnpm,"dev"],"cwd":"<guest-path>","stays_running":True,"expected_text":"http://localhost:5173/"}]
json.dump(claims,open('.coldpass/claims.json','w'),indent=2,ensure_ascii=False)
EOF
<env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/check1.json 2>&1; python3 -c "
import json;d=json.load(open('/tmp/check1.json'));print(d.get('valid'));[print('-',p[:400]) for p in d.get('problems',[])]" 2>/dev/null || tail -c 2000 /tmp/check1.json
env -i PATH=/usr/local/bin:/usr/bin:/bin sh -c 'command -v node; command -v pnpm; echo none-check'; sudo -n ln -sf <guest-path> /usr/local/bin/node && sudo -n ln -sf <guest-path> /usr/local/bin/npm && env -i PATH=/usr/local/bin:/usr/bin:/bin sh -c 'node -v; command -v pnpm || echo no-pnpm-on-clean-path'
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/check2.json 2>&1; python3 -c "
import json;d=json.load(open('/tmp/check2.json'));print(d.get('valid'));[print('-',p[:500]) for p in d.get('problems',[])]" 2>/dev/null || tail -c 1500 /tmp/check2.json
sudo -n ln -sf <guest-path> /usr/local/bin/pnpm && env -i PATH=/usr/local/bin:/usr/bin:/bin pnpm --version && cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/check3.json 2>&1; python3 -c "
import json;d=json.load(open('/tmp/check3.json'));print(d.get('valid'));[print('-',p[:500]) for p in d.get('problems',[])]" 2>/dev/null || tail -c 1500 /tmp/check3.json
ps -eo pid,ppid,etimes,args | grep -E "vite|electron|run-electron|pnpm|Xvfb|xvfb" | grep -v grep | cut -c1-150 | head; (ss -ltnp | grep 5173) || echo port-free; grep -n "Probe did not finish" <guest-path> | head -3
kill -INT 11134 11162 11295 2>/dev/null; sleep 6; for p in 11134 11295 11131 11303; do kill -0 $p 2>/dev/null && kill -9 $p; done; sleep 2; (ss -ltnp | grep 5173) || echo port-free; ps -eo pid,args | grep -E "electron|vite|Xvfb" | grep -v grep | cut -c1-120 | head -3; echo cleaned
cd <guest-path> && P=<guest-path>; start=$(date +%s); (timeout 150 xvfb-run -a $P dev > /tmp/devtime.log 2>&1 &); for i in $(seq 1 140); do if grep -q "localhost:5173" /tmp/devtime.log 2>/dev/null; then echo "ready after $(( $(date +%s)-start ))s"; break; fi; sleep 1; done; grep -c "" /tmp/devtime.log; grep -n "localhost:5173" /tmp/devtime.log | head -2
for p in $(pgrep -f "run-electron-vite-dev|electron-vite|pnpm dev" 2>/dev/null); do kill -9 $p 2>/dev/null; done; sleep 2; (ss -ltnp | grep -E "5173|5174") || echo port-free; cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/check4.json 2>&1; python3 -c "
import json;d=json.load(open('/tmp/check4.json'));print(d.get('valid'));[print('-',p[:400]) for p in d.get('problems',[])]" 2>/dev/null || tail -c 1200 /tmp/check4.json; (ss -ltnp | grep -E "5173|5174") || echo port-free-after
(ss -ltnp | grep -E "5173|5174") || echo port-free; cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/check4.json 2>&1; python3 -c "
import json;d=json.load(open('/tmp/check4.json'));print(d.get('valid'));[print('-',p[:400]) for p in d.get('problems',[])]" 2>/dev/null || tail -c 1200 /tmp/check4.json; (ss -ltnp | grep -E "5173|5174") || echo port-free-after
grep -n "def stop_server\|def run_until_text" <guest-path>; sed -n "$(grep -n 'def stop_server' <guest-path> | cut -d: -f1),+14p" <guest-path>; sed -n "$(grep -n 'def run_until_text' <guest-path> | cut -d: -f1),+22p" <guest-path>
cd <guest-path> && P=<guest-path>; start=$(date +%s); timeout 300 $P install --frozen-lockfile > /tmp/inst.log 2>&1; echo rc=$? t=$(( $(date +%s)-start ))s; tail -n 6 /tmp/inst.log | cut -c1-160
cd <guest-path> && P=<guest-path>; ss -ltnp | grep 5173 | grep -o "pid=[0-9]*" | cut -d= -f2 | sort -u | while read pid; do kill -TERM $pid; done; sleep 3; ss -ltnp | grep 5173 | grep -o "pid=[0-9]*" | cut -d= -f2 | sort -u | while read pid; do kill -9 $pid; done; sleep 1; (ss -ltnp | grep -E "5173|5174") || echo port-free; python3 - <<'EOF'
import json
pnpm="<guest-path>"
probe={"kind":"cli","argv":[pnpm,"dev"],"cwd":"<guest-path>","stays_running":True,"expected_text":"http://localhost:5173/"}
json.dump(probe,open('.coldpass/probe.json','w'),indent=2)
claims=[{"kind":"claim","claim":"The documented pnpm install step prepares the workspace","source":"pnpm install","source_file":".github/CONTRIBUTING.md","input":"pnpm install --frozen-lockfile","expected":"pnpm reports the lockfile is up to date","probe_kind":"cli","argv":[pnpm,"install","--frozen-lockfile"],"cwd":"<guest-path>","expected_text":"Lockfile is up to date"}]
json.dump(claims,open('.coldpass/claims.json','w'),indent=2,ensure_ascii=False)
EOF
<env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/check5.json 2>&1; python3 -c "
import json;d=json.load(open('/tmp/check5.json'));print(d.get('valid'));[print('-',p[:400]) for p in d.get('problems',[])]" 2>/dev/null || tail -c 1200 /tmp/check5.json
cd <guest-path> && sed -n "$(grep -n 'def example_result' check.py | cut -d: -f1),+22p" check.py | cut -c1-260; ss -ltnp | grep -E "5173|5174" || echo no-orphan
cd <guest-path> && P=<guest-path>; for c in lint typecheck; do s=$(date +%s); timeout 900 $P $c > /tmp/ex_$c.log 2>&1; echo "$c rc=$? t=$(( $(date +%s)-s ))s"; tail -n 3 /tmp/ex_$c.log | cut -c1-200; done
head -n 15 /tmp/ex_lint.log | cut -c1-220; echo ---; head -n 12 /tmp/ex_typecheck.log | cut -c1-220; free -m | head -2; nproc
cd <guest-path> && python3 - <<'EOF'
import json
P="<guest-path>"
ex=[
 {"claim":"Documented pnpm install step","source":".github/CONTRIBUTING.md","input":"pnpm install --frozen-lockfile","expected":"Lockfile is up to date","argv":[P,"install","--frozen-lockfile"],"cwd":"<guest-path>"},
 {"claim":"Documented lint check before opening a PR","source":".github/CONTRIBUTING.md","input":"pnpm lint","expected":"lint passes","argv":[P,"lint"],"cwd":"<guest-path>"},
 {"claim":"Documented typecheck before opening a PR","source":".github/CONTRIBUTING.md","input":"pnpm typecheck","expected":"typecheck passes","argv":[P,"typecheck"],"cwd":"<guest-path>"},
 {"claim":"Documented offline test suite (pnpm test)","source":".github/CONTRIBUTING.md","input":"pnpm test","expected":"Vitest suites pass","deferred":True,"reason":"Not run in this session: the full Bun/Vitest suite was not completed; lint and typecheck already fail on this VM (4 GB RAM, 2 CPUs), so the suite was deferred to limit runtime."},
]
json.dump(ex,open('.coldpass/examples.json','w'),indent=2,ensure_ascii=False)
cy={"detected":True,"checks":[{"claim":"Orca runs scheduled automations","source":"docs/site/content/docs/cli/automations.mdx","quote":"orca automations run <automationId> --json","input":"orca automations run <automationId> --json","expected":"one automation run is triggered by hand","schedule":"presets such as hourly/daily or cron/RRULE","method":"manual trigger via orca automations run","reason":"Needs an existing automation with a target project and an installed agent CLI; no automation was created in this session, so no cycle was triggered."}]}
json.dump(cy,open('.coldpass/cycles.json','w'),indent=2)
EOF
<env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/check6.json 2>&1; python3 -c "
import json;d=json.load(open('/tmp/check6.json'));print(d.get('valid'));[print('-',p[:400]) for p in d.get('problems',[])]" 2>/dev/null || tail -c 1500 /tmp/check6.json
cd <guest-path> && grep -n "fault_owner\|'partial'\|'working'" check.py | head -12 | cut -c1-240; grep -n "report.json" check.py | head -5 | cut -c1-200
cd <guest-path> && python3 - <<'EOF'
import json
report={
 "outcome":"partial",
 "fault_owner":"unknown",
 "operation":"Start the Orca desktop dev app with the documented `pnpm dev` (CONTRIBUTING.md Local Setup) and verify the Vite renderer URL; verify the documented `pnpm install` step.",
 "operation_scope":"partial: the probe and claim replay prove the dev app starts and serves http://localhost:5173/, and that pnpm install reports the lockfile up to date. Examples lint and typecheck fail on this VM; pnpm test was deferred; cycle check blocked; the orca CLI repo add/list operations were observed earlier but are not replayable in this checker because the app only stays up while pnpm dev runs.",
 "steps":[
  "Installed Node v24.22.1 user-local at <guest-path> (nodejs.org dist tarball) and pnpm 12.14.0 via npm.",
  "Installed Bun 1.4.4 via the official bun.sh installer after apt-get installed unzip.",
  "Installed build-essential and python3 via apt for node-pty/cpu-features native builds; pnpm install --frozen-lockfile then succeeded.",
  "Fixed Electron Linux prerequisites: chrome-sandbox setuid root (chown root:root, chmod 4755) and GTK/ATK/NSS/Xvfb libraries via apt.",
  "Ran pnpm build:cli (out/cli/index.js built; optional /usr/local/bin/orca-dev symlink skipped, permission denied).",
  "Ran pnpm dev under Xvfb; Vite printed Local: http://localhost:5173/ and Electron loaded.",
  "Used config/scripts/orca-dev.mjs to register a throwaway repo and list it through the CLI while the app was running.",
  "Checker replay of `orca open --json` and of `pnpm dev` exposed that the Electron app and its Xvfb session exit with the command, and that the checker's stop_server leaves Vite on 5173 orphaned; the probe is pnpm dev and the claim is pnpm install.",
  "Symlinked node, npm and pnpm into /usr/local/bin so the checker's clean PATH can run pnpm dev.",
  "Ran pnpm lint and pnpm typecheck; both failed (see examples.json)."
 ],
 "deviations":[
  "Used sudo apt-get for unzip, build-essential, python3, xvfb, xauth, and Electron GTK/ATK/NSS/ALSA libraries; these are system prerequisites not installed by the README.",
  "Set chrome-sandbox to setuid root in the pnpm store (required for Electron on Linux).",
  "Created /usr/local/bin symlinks for node, npm and pnpm so the checker's clean PATH resolves them.",
  "pnpm build and build:native (Linux) require a Docker daemon per CONTRIBUTING.md; Docker is not installed, so the Linux packaging build was not run.",
  "orca-dev optional /usr/local/bin symlink was skipped (permission denied); the wrapper was invoked by path.",
  "pnpm lint failed with an oxlint allocator panic on this VM; pnpm typecheck was SIGKILLed (4 GB RAM, 2 CPUs).",
  "pnpm test (Bun/Vitest) was deferred and not run.",
  "Cycle check: the product has scheduled automations; the manual trigger was not exercised because no automation was created.",
  "Probe/claim for the Orca CLI open command was dropped: the app exits with xvfb-run and the checker's 120 s claim window and orphaned Vite process made it unreliable."
 ],
 "stuck_step":"pnpm lint and pnpm typecheck (examples) fail; orphaned Vite/Electron processes from checker stop_server",
 "main_blocker":"lint oxlint panic and typecheck SIGKILL on this 4 GB / 2 CPU VM; Docker absent for Linux build",
 "plain_failure":"`pnpm lint` aborts with an oxc allocator panic; `pnpm typecheck` is killed by SIGKILL during tsrs; `pnpm build` needs Docker.",
 "suggested_fix":"Run lint and typecheck on a machine with more RAM (typecheck), and report the oxlint panic upstream; install Docker for the Linux build; make the checker stop the whole process tree for stays_running dev servers."
}
json.dump(report,open('.coldpass/report.json','w'),indent=2,ensure_ascii=False)
print("written")
EOF
<env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/check7.json 2>&1; python3 -c "
import json;d=json.load(open('/tmp/check7.json'));print('valid=',d.get('valid'));[print('-',p[:300]) for p in d.get('problems',[])]" 2>/dev/null || tail -c 800 /tmp/check7.json; ss -ltnp | grep -E "5173|5174" || echo no-listeners
ps -eo pid,args | grep -E "Xvfb|electron|vite|pnpm dev|xvfb-run" | grep -v grep | cut -c1-120 | head -5; echo check-done; cd <guest-path> && git status --short | head
kill -TERM 11753 12504 2>/dev/null; sleep 2; ps -eo pid,args | grep -E "Xvfb" | grep -v grep | cut -c1-80 | head -3; echo ok