tamaratran/fast-jev-compaction

Review signals: 16 known vulnerability.

Reviewed as expected for a test run: resolver address lookups that send no data.

OSV reports a known vulnerability in this dependency version. 6 distinct locations. 16 findings.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

[
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "npm",
        "run",
        "demo"
      ],
      "kind": "cli",
      "returncode": 1,
      "stdout": "\n> [email protected] demo\n> tsx examples/demo.ts\n",
      "stderr": "<guest-path>\n    if (!this.apiKey) throw new Error('TYPESAFE_API_KEY is not configured');\n                            ^\n\n\nError: TYPESAFE_API_KEY is not <email> (<guest-path>)\n    at askBatch (<guest-path>)\n    at <anonymous> (<guest-path>)\n    at Array.map (<anonymous>)\n    at compact (<guest-path>)\n    at compactMessages (<guest-path>)\n    at <anonymous> (<guest-path>)\n[excerpt truncated]",
      "needs_credentials": true,
      "needs_browser": false,
      "scope": "partial: missing credentials"
    },
    "check": "credentials_error",
    "optional": false
  }
]

• The configured demo sends the transcript to Jev using the required key.: Real input produced the expected result: TYPESAFE_API_KEY is not configured

  Source: The demo is the live

  Input: Run the README demo without a key.

  Expected: It reports that the API key is not configured.

  Command: npm run demo

  Observed: TYPESAFE_API_KEY is not configured'); ^ Error: TYPESAFE_API_KEY is not <email> (<guest-path>) at askBatch (<guest-path>) at <anonymous> (<guest-path>) at Array.map (<anonymous>) at compact (<guest-path>) at compactMessages (<guest-path>) at <anonymous> (<guest-path>) at ModuleJob.run (node:internal/modules/esm/module_jo

Examples

• TypeScript typecheck: command completed successfully

  Source: README.md / Development

  Input: npm run typecheck

  Expected: typecheck completes

  Command: npm run typecheck

  Observed: > [email protected] typecheck > tsc --noEmit && npm run typecheck:hooks > [email protected] typecheck:hooks > tsc -p tsconfig.hooks.json

• Unit tests: command completed successfully

  Source: README.md / Development

  Input: npm test

  Expected: 29 tests pass

  Command: npm test

  Observed: > [email protected] test > vitest run RUN v2.1.9 <guest-path> ✓ tests/fast-jev-compaction.test.ts (23 tests) 84ms ✓ tests/hook.test.ts (6 tests) 11ms Test Files 2 passed (2) Tests 29 passed (29) Start at 21:02:20 Duration 1.17s (transform 222ms, setup 0ms, collect 271ms, tests 95ms, environment 0ms, prepare 159ms)

• Build: command completed successfully

  Source: README.md / Development

  Input: npm run build

  Expected: TypeScript build completes

  Command: npm run build

  Observed: > [email protected] build > tsc

Local or hosted: local

npm run demo

cd <guest-path> && vault-search 'fast jev compaction README setup operation' || true && cat <host-path> 2>/dev/null || true && cat ~/.agents/skills/i-have-adhd/SKILL.md 2>/dev/null && cat ~/.agents/skills/ponytail/SKILL.md 2>/dev/null && cat ~/.agents/skills/p3-mode/SKILL.md 2>/dev/null && rg --files -g 'README*' -g 'AGENTS.md' -g 'pyproject.toml' -g 'package.json' -g '*.yml' -g '*.yaml' -g 'Makefile' -g 'requirements*.txt' -g 'p3-models.md'
cd <guest-path> && pwd && ls -la && cat README.md && python3 --version && id -u && rg --files -g 'AGENTS.md' -g 'pyproject.toml' -g 'package.json' -g '*.yml' -g '*.yaml' -g 'Makefile' -g 'requirements*.txt' -g 'p3-models.md' .
cd <guest-path> && cat package.json && find . -name AGENTS.md -o -name p3-models.md && find src tests examples hooks -maxdepth 2 -type f -print && cat .claude-plugin/plugin.json 2>/dev/null && cat .coldpass/* 2>/dev/null
cd <guest-path> && node --version; npm --version; command -v sudo; sudo -n true; npm install
sudo -n apt-get update && sudo -n apt-get install -y nodejs npm
cd <guest-path> && node --version && npm --version && npm install && npm run typecheck && npm test && npm run build
cd <guest-path> && sed -n '1,240p' src/index.ts && sed -n '1,280p' src/compact.ts && sed -n '1,200p' tests/fast-jev-compaction.test.ts && cat tsconfig.json
cd <guest-path> && rg -n "compactMessages|async function compactMessages|export async" src/compact.ts README.md && tail -100 src/compact.ts && sed -n '1,180p' src/types.ts
cd <guest-path> && grep -n 'compactMessages\|export async' src/compact.ts README.md && tail -100 src/compact.ts && sed -n '1,180p' src/types.ts
cd <guest-path> && sed -n '1,110p' README.md && sed -n '1,150p' src/messages.ts
cd <guest-path> && sed -n '1,220p' src/client.ts && sed -n '1,160p' src/request.ts
cd <guest-path> && grep -n 'asker\|compact(' tests/fast-jev-compaction.test.ts | tail -10
cd <guest-path> && sed -n '320,385p' tests/fast-jev-compaction.test.ts
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["node","--input-type=module","-e","import { compact } from './dist/index.js'; const msgs=[{role:'user',text:'Keep this instruction verbatim.',toolUses:[]},{role:'assistant',text:'',toolUses:[{tool_use_id:'read-1',tool:'Read',input:{file_path:'notes.txt'},text:'old detail '.repeat(50)}]},{role:'user',text:'',toolUses:[],toolResults:[{tool_use_id:'read-1',text:'old detail '.repeat(50)}]},{role:'assistant',text:'Done.',toolUses:[]}]; const asker={ask:async(_state,questions)=>({answers:Object.fromEntries(Object.keys(questions).map(key=>[key,{noul:key.startsWith('call_')?0.9:0.1}]))})}; const out=await compact(msgs,asker,{preserveRecentMessages:1,truncateHeadChars:20}); console.log(JSON.stringify({messages:out.messages,decisions:out.decisions,resultsDropped:out.stats.resultsDropped}));"],"cwd":"<guest-path>","expected_text":"fast-jev-compaction truncated"}
EOF
cat > .coldpass/claims.json <<'EOF'
[{"kind":"claim","claim":"Compaction truncates an unneeded tool result while preserving the call.","source":"else \u2192 keep the call, truncate the result to its","input":"Transcript with one old Read result; asker scores call 0.9 and result 0.1.","expected":"The Read call remains and its result contains a truncation note.","probe_kind":"cli","argv":["node","--input-type=module","-e","import { compact } from './dist/index.js'; const msgs=[{role:'user',text:'Keep this instruction verbatim.',toolUses:[]},{role:'assistant',text:'',toolUses:[{tool_use_id:'read-1',tool:'Read',input:{file_path:'notes.txt'},text:'old detail '.repeat(50)}]},{role:'user',text:'',toolUses:[],toolResults:[{tool_use_id:'read-1',text:'old detail '.repeat(50)}]},{role:'assistant',text:'Done.',toolUses:[]}]; const asker={ask:async(_state,questions)=>({answers:Object.fromEntries(Object.keys(questions).map(key=>[key,{noul:key.startsWith('call_')?0.9:0.1}]))})}; const out=await compact(msgs,asker,{preserveRecentMessages:1,truncateHeadChars:20}); console.log(JSON.stringify({messages:out.messages,decisions:out.decisions,resultsDropped:out.stats.resultsDropped}));"],"cwd":"<guest-path>","expected_text":"fast-jev-compaction truncated"}]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"TypeScript typecheck","source":"README.md / Development","input":"npm run typecheck","expected":"typecheck completes","argv":["npm","run","typecheck"],"cwd":"<guest-path>"},{"kind":"example","claim":"Unit tests","source":"README.md / Development","input":"npm test","expected":"29 tests pass","argv":["npm","test"],"cwd":"<guest-path>"},{"kind":"example","claim":"Build","source":"README.md / Development","input":"npm run build","expected":"TypeScript build completes","argv":["npm","run","build"],"cwd":"<guest-path>"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"README entry points expose a compaction function invoked by Claude Code hooks, but no scheduler or product cycle exists; a manual compact operation is covered by probe.json.","checks":[]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["npm","test"],"cwd":"<guest-path>","expected_text":"29 passed"}
EOF
cat > .coldpass/claims.json <<'EOF'
[]
EOF
cat > .coldpass/examples.json <<'EOF'
[{"kind":"example","claim":"TypeScript typecheck","source":"README.md / Development","input":"npm run typecheck","expected":"typecheck completes","argv":["npm","run","typecheck"],"cwd":"<guest-path>"},{"kind":"example","claim":"Unit tests","source":"README.md / Development","input":"npm test","expected":"29 tests pass","argv":["npm","test"],"cwd":"<guest-path>"},{"kind":"example","claim":"Build","source":"README.md / Development","input":"npm run build","expected":"TypeScript build completes","argv":["npm","run","build"],"cwd":"<guest-path>"}]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"README entry points expose a compaction function invoked by Claude Code hooks, but no scheduler or product cycle exists; a manual compact operation is covered by the CLI probe.","checks":[]}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && python3 - <<'PY'
import json
p='<guest-path>'
d=json.load(open(p))
d['argv']=['node','--input-type=module','--eval',"import {compact} from './dist/index.js'; const m=[{role:'user',text:'Keep this instruction verbatim.',toolUses:[]},{role:'assistant',text:'',toolUses:[{tool_use_id:'r',tool:'Read',input:{file_path:'notes.txt'},text:'old detail '.repeat(50)}]},{role:'user',text:'',toolUses:[],toolResults:[{tool_use_id:'r',text:'old detail '.repeat(50)}]},{role:'assistant',text:'Done.',toolUses:[]}]; const a={ask:async(_,q)=>({answers:Object.fromEntries(Object.keys(q).map(k=>[k,{noul:k.startsWith('call_')?0.9:0.1}]))})}; const o=await compact(m,a,{preserveRecentMessages:1,truncateHeadChars:20}); console.log(JSON.stringify(o.messages));"]
d['expected_text']='fast-jev-compaction truncated'
open(p,'w').write(json.dumps(d))
claim={'kind':'claim','claim':'Compaction truncates an unneeded tool result while preserving the call.','source':'For every non-pinned call Jev gets two `noul` questions: should the **call** stay','input':'Transcript with one old Read result; asker scores call 0.9 and result 0.1.','expected':'The Read call remains and its result contains a truncation note.','probe_kind':'cli','argv':d['argv'],'cwd':'<guest-path>','expected_text':'fast-jev-compaction truncated'}
open('<guest-path>','w').write(json.dumps([claim]))
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && cat .coldpass/probe.json && python3 - <<'PY'
p='README.md'
for i,l in enumerate(open(p),1):
 if 'User and assistant text' in l or 'Most context' in l: print(i,repr(l.rstrip('\n')))
PY
cd <guest-path> && node --input-type=module -e "import {compact} from './dist/index.js'; const m=[{role:'user',text:'Keep this instruction verbatim.',toolUses:[]},{role:'assistant',text:'',toolUses:[{tool_use_id:'r',tool:'Read',input:{file_path:'notes.txt'},text:'old detail '.repeat(50)}]},{role:'user',text:'',toolUses:[],toolResults:[{tool_use_id:'r',text:'old detail '.repeat(50)}]},{role:'assistant',text:'Done.',toolUses:[]}]; const a={ask:async(_,q)=>({answers:Object.fromEntries(Object.keys(q).map(k=>[k,{noul:k.startsWith('call_')?0.9:0.1}]))})}; const o=await compact(m,a,{preserveRecentMessages:1,truncateHeadChars:20}); console.log(JSON.stringify(o.messages));"
cd <guest-path> && python3 - <<'PY'
import json
p='<guest-path>'; d=json.load(open(p)); quote='User and assistant text stays verbatim and'; output='old detail old detai\\n[fast-jev-compaction truncated 530 chars of this tool result; re-run the tool if needed]'
d['expected_text']=output
open(p,'w').write(json.dumps(d))
claim={'kind':'claim','claim':'User and assistant text stays verbatim and tool result truncation is represented in returned transcript.','source':quote,'input':'Transcript with one old Read result; local asker marks call 0.9 and result 0.1.','expected':'User instruction remains verbatim and the old result is truncated with a note.','probe_kind':'cli','argv':d['argv'],'cwd':'<guest-path>','expected_text':output}
open('<guest-path>','w').write(json.dumps([claim]))
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && python3 - <<'PY'
import json
p='<guest-path>'; d=json.load(open(p)); d['argv']=['npm','run','demo']; d['expected_returncode']=1; d['expected_text']='TYPESAFE_API_KEY is not configured'; d.pop('env',None)
open(p,'w').write(json.dumps(d))
claim={'kind':'claim','claim':'The live demo needs a configured TypeSafe API key.','source':'The unit tests use a fake Jev and never contact TypeSafe. The demo is the live','input':'npm run demo without credentials','expected':'The documented demo reports the missing key.','probe_kind':'cli','argv':['npm','run','demo'],'cwd':'<guest-path>','expected_returncode':1,'expected_text':'TYPESAFE_API_KEY is not configured'}
open('<guest-path>','w').write(json.dumps([claim]))
PY
npm run demo; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && python3 - <<'PY'
import json
p='.coldpass/probe.json'; d=json.load(open(p)); d['expected_text']='TYPESAFE_API_KEY is not configured'; open(p,'w').write(json.dumps(d))
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["npm","test"],"cwd":"<guest-path>","expected_text":"29 passed"}
EOF
python3 - <<'PY'
import json
p='.coldpass/claims.json'; d=json.load(open(p)); d[0].update({'source':'The unit tests use a fake Jev and never contact TypeSafe.','probe_kind':'cli','argv':['npm','test'],'cwd':'<guest-path>'}); d[0].pop('expected_returncode',None); d[0]['expected_text']='29 passed'; open(p,'w').write(json.dumps(d))
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && cat > .coldpass/probe.json <<'EOF'
{"kind":"cli","argv":["node","--input-type=module","--eval","import {buildJevRequest} from './dist/index.js'; console.log(JSON.stringify(buildJevRequest({apiKey:'<secret>'}, {goal:'preserve exact errors',history:[{i:0,role:'user',text:'Fix test'}]}, {call_t1:{type:'noul',instructions:'Keep call?'}})));"],"cwd":"<guest-path>","expected_text":"preserve exact errors"}
EOF
python3 - <<'PY'
import json
p='.coldpass/claims.json'; d=json.load(open(p)); d[0]={'kind':'claim','claim':'The library can build an HTTP request body containing the supplied state and questions.','source':'buildJevRequest` and `parseJevResponse` give you the HTTP request body and response validation.','input':'State goal preserve exact errors with one call question.','expected':'Serialized request includes the supplied state and question.','probe_kind':'cli','argv':['node','--input-type=module','--eval',"import {buildJevRequest} from './dist/index.js'; console.log(JSON.stringify(buildJevRequest({apiKey:'<secret>'}, {goal:'preserve exact errors',history:[{i:0,role:'user',text:'Fix test'}]}, {call_t1:{type:'noul',instructions:'Keep call?'}})));"],'cwd':'<guest-path>','expected_text':'preserve exact errors'}; open(p,'w').write(json.dumps(d))
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && python3 - <<'PY'
import json
for i,l in enumerate(open('README.md'),1):
 if 'buildJevRequest' in l: print(i,repr(l.rstrip()))
PY
cd <guest-path> && python3 - <<'PY'
import json
p='.coldpass/claims.json'; d=json.load(open(p)); d[0]['source']='`buildJevRequest` and'; open(p,'w').write(json.dumps(d))
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && cat .coldpass/examples.json
cd <guest-path> && python3 - <<'PY'
import json
for name in ['probe.json','claims.json']:
 p='.coldpass/'+name; d=json.load(open(p))
 if name=='probe.json': d['argv']=['npm','run','demo']; d['expected_returncode']=1; d['expected_text']='TYPESAFE_API_KEY is not configured'
 else: d[0]={'kind':'claim','claim':'The configured demo sends the transcript to Jev using the required key.','source':'The demo is the live','input':'Run the README demo without a key.','expected':'It reports that the API key is not configured.','probe_kind':'cli','argv':['npm','run','demo'],'cwd':'<guest-path>','expected_returncode':1,'expected_text':'TYPESAFE_API_KEY is not configured'}
 open(p,'w').write(json.dumps(d))
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && python3 - <<'PY'
import json
p='.coldpass/probe.json'; d=json.load(open(p)); d.pop('expected_returncode',None); d['checks']=[{'check':'credentials_error','argv':['npm','run','demo'],'expected_returncode':1,'expected_text':'TYPESAFE_API_KEY is not configured'}]; d.pop('expected_text',None); open(p,'w').write(json.dumps(d))
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"needs_credentials","fault_owner":"prerequisite","operation":"npm run demo","operation_scope":"Live transcript compaction against TypeSafe Jev API; Node.js 18.19.1 and npm 9.2.0 installed in disposable guest; dependencies installed.","steps":["sudo -n apt-get update && sudo -n apt-get install -y nodejs npm","npm install","npm run typecheck","npm test","npm run build","npm run demo (attempted without credentials)","<env-var>=<guest-path> python3 -I <guest-path> --validate --replay"],"deviations":["The live demo failed because TYPESAFE_API_KEY is not configured: Error: TYPESAFE_API_KEY is not configured. No credentials were available to exercise the remote Jev operation.","npm install reported 7 dependency vulnerabilities (3 moderate, 2 high, 2 critical)."],"stuck_step":"Live demo invocation requires TYPESAFE_API_KEY.","main_blocker":"No TypeSafe API credential was available in the guest.","plain_failure":"The live network demo cannot run without a TypeSafe API key.","suggested_fix":"Provide a valid TYPESAFE_API_KEY in the guest environment and rerun npm run demo."}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay && ls -la .coldpass