tamaratran/jev-pruner

Review signals: 1 connection review, 16 known vulnerability, 1 outside write, 1 sensitive read.

Reviewed as expected for a test run: resolver address lookups that send no data.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 2 distinct locations. 15 attributed processes.

OSV reports a known vulnerability in this dependency version. 6 distinct locations. 16 findings.

Repository processes attempted these writes outside documented output/cache paths. 2 distinct locations. 1 attributed processes.

PID 9715: /usr/bin/node · npm lifecycle

A repository process attempted to read this sensitive path. <guest-path> 11 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

[
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "node",
        "dist/codex/run.js",
        "--",
        "node",
        "tests/fixtures/codex-noisy-build.mjs",
        "1",
        "once"
      ],
      "kind": "cli",
      "returncode": 0,
      "stdout": "nchanged unchanged \nprogress: stage 1 cache entry 882 already current; unchanged unchanged unchanged unchanged unchanged \nprogress: stage 1 cache entry 883 already current; unchanged unchanged unchanged unchanged unchanged \nprogress: stage 1 cache entry 884 already current; unchanged unchanged unchanged unchanged unchanged \nprogress: stage 1 cache entry 885 already current; unchanged unchanged unchanged unchanged unchanged \nprogress: stage 1 cache entry 886 already current; unchanged unchanged unchanged unchanged unchanged \nprogress: stage 1 cache entry 887 already current; unchanged unchanged unchanged unchanged unchanged \nprogress: stage 1 cache entry 888 already current; unchanged unchanged unchanged unchanged unchanged \nprogress: stage 1 cache entry 889 already current; unchanged unchanged unchanged unchanged unchanged \nprogress: stage 1 cache entry 890 already current; unchanged unchanged unchanged unchanged unchanged \nprogress: stage 1 cache entry 891 already current; unchanged unchanged unchanged unchanged unchanged \nprogress: stage 1 cache entry 892 already current; unchanged unchanged unchanged unchanged unchanged \n[excerpt truncated]",
      "stderr": "stderr: stage 1 diagnostic channel preserved",
      "needs_credentials": false,
      "needs_browser": false,
      "scope": "partial: install"
    },
    "check": "install",
    "optional": false
  }
]

• The wrapper passes the command's arguments and exit status through: Real input produced the expected result: Stage 1 finished; deployment remains blocked.

  Source: The executable and arguments after `--` are passed directly, preserving cwd,

  Input: node tests/fixtures/codex-noisy-build.mjs 1 once

  Expected: fixture stage output returned, exit 0

  Command: node dist/codex/run.js -- node tests/fixtures/codex-noisy-build.mjs 1 once

  Observed: Stage 1 finished; deployment remains blocked. stderr: stage 1 diagnostic channel preserved

• Pruning fails open when Jev access is unavailable, leaving output unchanged: Real input produced the expected result: Stage 1 finished; deployment remains blocked.

  Source: configuration; pruning fails open while access is unavailable.

  Input: same fixture run without TYPESAFE_API_KEY

  Expected: full fixture output returned unchanged

  Command: node dist/codex/run.js -- node tests/fixtures/codex-noisy-build.mjs 1 once

  Observed: Stage 1 finished; deployment remains blocked. stderr: stage 1 diagnostic channel preserved

• Jev pruning needs a TypeSafe API key: No TypeSafe API key is available in this guest and it must not be obtained; live Jev scoring also needs a Codex/Claude session with a recorded transcript pointer.

  Source: Make `TYPESAFE_API_KEY` available in the terminal where you will launch Codex.

  Observed: No TypeSafe API key is available in this guest and it must not be obtained; live Jev scoring also needs a Codex/Claude session with a recorded transcript pointer.

Examples

• Offline test suite passes: command completed successfully

  Source: README.md Tests section

  Input: npm test

  Expected: all offline tests pass

  Command: npm test

  Observed: test.ts (2 tests) 139ms ✓ tests/compact-markers.test.ts (7 tests) 161ms ✓ tests/compaction.test.ts (4 tests) 190ms ✓ tests/compaction-boundaries.test.ts (2 tests) 155ms ✓ tests/compaction-context.test.ts (2 tests) 102ms ✓ tests/eval-observer.test.ts (5 tests) 8ms ✓ tests/partial-chunks.test.ts (2 tests) 38ms ✓ tests/codex-session-utils.test.mjs (3 tests) 3ms ✓ tests/decisions.test.ts (6 tests) 59ms Test Files 21 passed (21) Tests 291 passed (291) Start at 02:24:32 Duration 26.57s (transform 570ms, setup 0ms, collect 1.11s, tests 16.81s, environment 3ms, prepare 1.55s)

• Type check passes: command completed successfully

  Source: README.md Tests section

  Input: npm run typecheck

  Expected: exit 0

  Command: npm run typecheck

  Observed: > [email protected] typecheck > tsc --noEmit && npm run typecheck:hooks > [email protected] typecheck:hooks > tsc -p tsconfig.hooks.json

• Build succeeds: command completed successfully

  Source: README.md Tests section

  Input: npm run build

  Expected: exit 0

  Command: npm run build

  Observed: > [email protected] build > tsc

• Plugin validates with the installed Claude Code CLI: command completed successfully

  Source: README.md Tests section

  Input: npm run validate:plugin

  Expected: validation passes with warnings

  Command: npm run validate:plugin

  Observed: y the plugin in this folder. To check another plugin that the marketplace lists, run validate on that plugin's folder. ❯ hooks/hooks.json names a hooks module (a code file listed under `modules`). The plugin directory has rules of its own for such code, and these checks apply none of them, so passing here does not mean the directory accepts the plugin. The developer portal's own validation applies those rules. These plugin directory checks do not change the result below. The directory also runs a safety scan and a policy review that this command does not. ✔ Validation passed with warnings

Local or hosted: local

Trim large command output through Jev via the documented wrapper: node dist/codex/run.js -- <command>

cd <guest-path> && pwd && ls -la && id -u && (git status 2>&1 | head -3); python3 --version; cat README.md 2>/dev/null | head -200
cd <guest-path> && sed -n 200,600p README.md
cd <guest-path> && sed -n 600,800p README.md | head -120; echo ----; cat package.json; echo ----; which node npm claude codex uv 2>&1; node --version 2>&1; npm --version 2>&1; ls .coldpass; echo ---; env | grep -i -E 'proxy|typesafe' | sed 's/=.*/=<set>/'
sudo -n true && echo SUDO_OK; cat /etc/os-release | head -2; (sudo -n apt-get update -qq 2>&1 | tail -3; sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq nodejs npm 2>&1 | tail -5); node --version; npm --version
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm ci 2>&1 | tail -15; echo "CI_RC=$?"; npm run build 2>&1 | tail -10; echo BUILD_DONE; ls dist | head
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm test 2>&1 | tail -25; echo TEST_RC=${PIPESTATUS[0]}; npm run typecheck 2>&1 | tail -5; echo TC_RC=${PIPESTATUS[0]}
cd <guest-path> && ls src src/* | head -40; echo ---; sed -n 1,80p src/codex/run.ts 2>/dev/null; echo ---; grep -rn "TYPESAFE_API_KEY" src | head; grep -rn "api.typesafe.ai\|JEV_BASE\|baseUrl" src | head -5
cd <guest-path> && ls tests/fixtures/ 2>&1 | head; export NODE_USE_ENV_PROXY=1; node tests/fixtures/codex-noisy-build.mjs 1 once > /tmp/fixture_raw.txt 2>/tmp/fixture_err.txt; echo rc=$?; wc -c /tmp/fixture_raw.txt; tail -3 /tmp/fixture_raw.txt; echo ---WRAP; env -u TYPESAFE_API_KEY node dist/codex/run.js -- node tests/fixtures/codex-noisy-build.mjs 1 once > /tmp/wrap_out.txt 2>/tmp/wrap_err.txt; echo rc=$?; wc -c /tmp/wrap_out.txt; grep -c "fast-jev-output\|omitted" /tmp/wrap_out.txt; head -c 300 /tmp/wrap_err.txt; echo; curl -sS -m 10 -o /dev/null -w "%{http_code}\n" https://api.typesafe.ai/v1/systemone 2>&1 | tail -1
ls -la <guest-path> /inputs 2>&1; wc -l <guest-path>; grep -n "checks\|credentials_error\|expected_returncode\|def \|stays_running" <guest-path> | head -120
cd <guest-path> && sed -n 325,350p check.py; sed -n 653,760p check.py; sed -n 1273,1285p check.py
cd <guest-path> && grep -n "apiKey" src/codex/prune.ts src/jev.ts src/index.ts | head -20; echo ---; export NODE_USE_ENV_PROXY=1; TYPESAFE_API_KEY=invalid-dummy-key node dist/codex/run.js -- node tests/fixtures/codex-noisy-build.mjs 1 once > /tmp/wrap_bad.txt 2>/tmp/wrap_bad_err.txt; echo rc=$?; wc -c < /tmp/wrap_bad.txt; grep -c "omitted\|fast-jev" /tmp/wrap_bad.txt; cat /tmp/wrap_bad_err.txt | head -3
cd <guest-path> && grep -rn "setInterval\|setTimeout\|cron\|--once\|--now\|webhook" src hooks dist/codex 2>/dev/null | grep -v "\.map" | head; echo ---; export NODE_USE_ENV_PROXY=1; (npm install -g @anthropic-ai/claude-code 2>&1 | tail -3); which claude; claude --version 2>&1 | head -2
cd <guest-path> && grep -m5 -i "error" <guest-path> | head -8; echo; npm config get prefix
cd <guest-path> && export NODE_USE_ENV_PROXY=1; sudo -n env NODE_USE_ENV_PROXY=1 npm install -g @anthropic-ai/claude-code 2>&1 | tail -3; which claude && claude --version 2>&1 | head -2
cd <guest-path> && export NODE_USE_ENV_PROXY=1; timeout 120 npm run validate:plugin 2>&1 | tail -15; echo RC=${PIPESTATUS[0]}
cd <guest-path> && grep -n "passed directly\|fails open\|Stdout is buffered\|Nonzero exits\|Unavailable, malformed\|TYPESAFE_API_KEY\` available\|Build before installing" README.md; echo; grep -n "^Stdout of \|passes through untouched" README.md; ls -la .coldpass
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"checks":[{"check":"install","kind":"cli","argv":["node","dist/codex/run.js","--","node","tests/fixtures/codex-noisy-build.mjs","1","once"],"cwd":"<guest-path>","expected_text":"Stage 1 finished; deployment remains blocked."}]}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"The wrapper passes the command's arguments and exit status through","source":"The executable and arguments after `--` are passed directly, preserving cwd,","input":"node tests/fixtures/codex-noisy-build.mjs 1 once","expected":"fixture stage output returned, exit 0","probe_kind":"cli","argv":["node","dist/codex/run.js","--","node","tests/fixtures/codex-noisy-build.mjs","1","once"],"cwd":"<guest-path>","expected_text":"Stage 1 finished; deployment remains blocked."},
{"kind":"claim","claim":"Pruning fails open when Jev access is unavailable, leaving output unchanged","source":"configuration; pruning fails open while access is unavailable.","input":"same fixture run without TYPESAFE_API_KEY","expected":"full fixture output returned unchanged","probe_kind":"cli","argv":["node","dist/codex/run.js","--","node","tests/fixtures/codex-noisy-build.mjs","1","once"],"cwd":"<guest-path>","expected_text":"Stage 1 finished; deployment remains blocked."},
{"kind":"claim","claim":"Jev pruning needs a TypeSafe API key","source":"Make `TYPESAFE_API_KEY` available in the terminal where you will launch Codex.","testable":false,"reason":"No TypeSafe API key is available in this guest and it must not be obtained; live Jev scoring also needs a Codex/Claude session with a recorded transcript pointer."}
]
EOF
cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"Offline test suite passes","source":"README.md Tests section","input":"npm test","expected":"all offline tests pass","argv":["npm","test"],"cwd":"<guest-path>","expected_text":"291 passed (291)"},
{"kind":"example","claim":"Type check passes","source":"README.md Tests section","input":"npm run typecheck","expected":"exit 0","argv":["npm","run","typecheck"],"cwd":"<guest-path>"},
{"kind":"example","claim":"Build succeeds","source":"README.md Tests section","input":"npm run build","expected":"exit 0","argv":["npm","run","build"],"cwd":"<guest-path>"},
{"kind":"example","claim":"Plugin validates with the installed Claude Code CLI","source":"README.md Tests section","input":"npm run validate:plugin","expected":"validation passes with warnings","argv":["npm","run","validate:plugin"],"cwd":"<guest-path>","expected_text":"Validation passed with warnings"}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Inspected src/index.ts, src/codex/run.ts, src/codex/prune.ts, hooks/ and README. The plugin has no cron, scheduler, loop, --once/--now trigger or webhook. It runs once per Bash command through the hook or wrapper; the only timer is a 30-second API request timeout in src/codex/prune.ts.","checks":[]}
EOF
mkdir -p .coldpass && python3 -I -c "import json;[json.load(open('<guest-path>'+f)) for f in ['probe.json','claims.json','examples.json','cycles.json']];print('json ok')"; ls -la .coldpass
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay 2>&1 | tail -c 4000; echo; echo RC=${PIPESTATUS[0]}
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/validate_out.json 2>/tmp/validate_err.txt; echo RC=$?; python3 -I -c "
import json
d=json.load(open('/tmp/validate_out.json'))
print('valid:',d.get('valid'))
print('keys:',list(d.keys()))
for k,v in d.items():
    if k!='valid' and k!='report' and not isinstance(v,(dict,list)): print(k,':',v)
print('problems:',json.dumps(d.get('problems'),indent=1)[:3000])
"; head -c 500 /tmp/validate_err.txt
cd <guest-path> && python3 -I -c "
import json
d=json.load(open('/tmp/validate_out.json'))['replay']
print(list(d.keys()))
for k in d:
    v=d[k]
    if isinstance(v,dict): print(k, {x:(v[x] if not isinstance(v[x],(dict,list)) else '...') for x in v})
    elif isinstance(v,list):
        for i in v: print(k, json.dumps({x:i.get(x) for x in ('claim','verdict','outcome','working','scope','kind') if isinstance(i,dict)})[:400])
    else: print(k,v)
"; ls -la .coldpass; ls -la <guest-path> | head -3
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{"outcome":"needs_credentials","fault_owner":"prerequisite","operation":"Trim large command output through Jev via the documented wrapper: node dist/codex/run.js -- <command>","operation_scope":"Offline build, type check and test suite, plugin validation, and pass-through of the wrapper all ran. Live Jev pruning was NOT exercised: it needs a TypeSafe API key (TYPESAFE_API_KEY), which this guest does not have and must not obtain, plus a Codex or Claude Code session that records a transcript pointer (CODEX_THREAD_ID). Requires Node 18+ (guest: Node 18.19.1, npm 9.2.0).","steps":["sudo -n apt-get install -y nodejs npm (guest had no node; installed Node 18.19.1 / npm 9.2.0, meets engines >=18)","export NODE_USE_ENV_PROXY=1; npm ci","npm run build","npm test (291 tests passed)","npm run typecheck","sudo -n npm install -g @anthropic-ai/claude-code (for npm run validate:plugin; claude 2.1.310)","npm run validate:plugin (passed with warnings: missing icon, hooks module)","node tests/fixtures/codex-noisy-build.mjs 1 once (fixture, 101,632 bytes, exit 0)","node dist/codex/run.js -- node tests/fixtures/codex-noisy-build.mjs 1 once (wrapper with no key: output returned unchanged, exit 0)","TYPESAFE_API_KEY=invalid-dummy-key node dist/codex/run.js -- ... (dummy value only: still output unchanged, exit 0; no API call is made without a session ID)"],"deviations":["Global npm install of @anthropic-ai/claude-code failed with EACCES on /usr/local/lib/node_modules; retried with sudo -n and it succeeded.","Did not git init or fetch the pinned commit: no documented command needed Git metadata, and the source snapshot was used as delivered.","No credentials_error check was recorded: the wrapper exits 0 and prints no credential message when the key is missing, so a real credential error cannot be captured. The checker would therefore report a failed credential check for this documented call, not a true one.","Pruning could not be observed end to end: with no key and no session the wrapper returns output unchanged before any Jev request.","Used the dummy value invalid-dummy-key only to confirm the no-call path; no real key was used."],"stuck_step":"Live Jev pruning step (README 'Codex install' sections 2 and 4, and 'How the Codex wrapper works')","main_blocker":"No TYPESAFE_API_KEY and no Codex/Claude Code session with a recorded transcript pointer in this disposable guest.","plain_failure":"The product's main job, shrinking long command output, could not be tested here. It needs a TypeSafe account key and a live Codex or Claude Code session, which this sandbox does not provide. Everything else worked: the build, the 291 offline tests, the type check and the plugin validation all pass, and the wrapper passes commands through unchanged when it cannot prune.","suggested_fix":"Run the live check in an environment with TYPESAFE_API_KEY and an authenticated Codex or Claude Code session: JEV_CODEX_STAGES=2 npm run test:codex-session, then npm run test:live. Also consider having the wrapper print a clear message when the key is missing, so the fallback is not silent."}
EOF
python3 -I -c "import json;json.load(open('<guest-path>'));print('report ok')"; ps -eo pid,cmd | grep -E "run.js|fixture|vitest|claude" | grep -v grep | head
cd <guest-path> && <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/validate_out2.json 2>/dev/null; echo RC=$?; python3 -I -c "
import json;d=json.load(open('/tmp/validate_out2.json'));print('valid:',d['valid'],'problems:',d['problems'],'status:',d['replay']['status'])"