trailhq/Trail-Code

Review signals: 1 connection review, 1 download and execute, 1 outside write. 56 static matches retained as context.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 13 distinct locations. 10 attributed processes.

Source contains download and execute; review its purpose. src/skills/compile.ts

Repository processes attempted these writes outside documented output/cache paths. 2272 distinct locations. 40 attributed processes.

35 download and execute matches retained as context; full list in the evidence.

21 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• trail_trace_calls returns who depends on a symbol: Real input produced the expected result: buildGraph

  Source: Who depends on it, or what it depends on with `direction: out`, N levels deep for blast radius.

  Input: {"tool": "trail_trace_calls", "arguments": {"symbol": "wiringPath"}}

  Expected: lists buildGraph as a caller

  Command: trail mcp . tools/call {"tool": "trail_trace_calls", "arguments": {"symbol": "wiringPath"}}

  Observed: buildGraph (src/graph/build.ts:L204-L472)\n calls ← checkGraph (src/graph/check.ts:L59-L159)\n calls ← invalidateGraphCaches (src/graph/load.ts:L112-L115)\n calls ← loadGraphCached (src/graph/load.ts:L86-L91)\n calls ← ensureFreshGraph (src/graph/refresh.ts:L151-L228)\n calls ← hasGraftIndex (src/graph/root.ts:L23-L25)\n calls ← seedGraph (src/graph/seed.ts:L211-L228)\n calls ← hasMegaGraph (src/graph/workspace.ts:L106-L108)\n calls ← writeGraph (src/graph/write.ts:L36-L67)\n calls ← ask-index.test.ts (test/ask-index.test.ts:L1-L408)\n calls ← reinjectBodyText (test/ask-index.test.ts

• trail map gives a token-budgeted repo orientation: Real input produced the expected result: hotspots: join

  Source: `trail map` is a token-budgeted first look at a repo: directory clusters

  Input: repo root

  Expected: repo map with hotspots

  Command: trail map .

  Observed: hotspots: join · function · src/trace/codex.ts:L237-L244 · 1128← tmpRepo · function · test/helpers.ts:L30-L32 · 152← flatLine · function · src/notes/flatten.ts:L36-L48 · 101← repoPlace · function · src/notes/home.ts:L240-L256 · 64← wiringPath · function · src/graph/write.ts:L20-L22 · 49← buildGraph · function · src/graph/build.ts:L204-L472 · 44← brand · function · src/brand.ts:L34-L36 · 43← renderSkillMd · function · src/skills/skillmd.ts:L63-L111 · 39← T · function · test/skills-consent-fixtures.ts:L33-L33 · 39← contextDirFor · function · src/context/node-file.ts:L113-L116 · 38← rea

Examples

• build the graft map of the repo with no LLM key: command completed successfully

  Source: README.md CLI section: trail build [dir]

  Input: repo root

  Expected: wiring graph of 7390 nodes

  Command: trail build .

  Observed: parsing 841/849: test/viz-export.test.ts parsing 842/849: test/viz-serve.test.ts parsing 843/849: test/workspace-sync-skills.test.ts parsing 844/849: test/workspace.test.ts parsing 845/849: viewer/data.ts parsing 846/849: viewer/detail.ts parsing 847/849: viewer/graph.ts parsing 848/849: viewer/main.ts parsing 849/849: viewer/tree.ts

• find who calls a symbol: command completed successfully

  Source: README.md CLI section: trail callers <symbol> [dir]

  Input: wiringPath

  Expected: caller list including buildGraph

  Command: trail callers wiringPath .

  Observed: wiringPath } from "../src/graph/write.js"; calls ← regression-single-repo.test.ts (test/regression-single-repo.test.ts:L1-L135) 16: import { readGraph, wiringPath } from "../src/graph/write.js"; calls ← loadBuiltGraph (test/search-grep.test.ts:L87-L91) 88: const g = readGraph(wiringPath(join(repo, 'graft'))); calls ← utf16-source.test.ts (test/utf16-source.test.ts:L1-L195) 30: import { readGraph, wiringPath } from "../src/graph/write.js"; calls ← workspace.test.ts (test/workspace.test.ts:L1-L536) 7: import { writeGraph, wiringPath } from "../src/graph/write.js";

• repo test suite from the Development section: Full npm test takes about 27 minutes here and reports 4011 tests, 3986 pass, 16 fail, 9 skipped (output in /tmp/npmtest.out). Left out of replay on purpose; failures are in teammate, git-history and hook tests that need go, colima or gh, or a full git history, which this VM lacks.

  Source: README.md Development section: npm test

  Expected: documented command completes successfully

  Observed: Full npm test takes about 27 minutes here and reports 4011 tests, 3986 pass, 16 fail, 9 skipped (output in /tmp/npmtest.out). Left out of replay on purpose; failures are in teammate, git-history and hook tests that need go, colima or gh, or a full git history, which this VM lacks.

Local or hosted: local

Build the repo's context map with the trail CLI (trail build, trail map, trail callers) and query it over MCP (trail_trace_calls) from the pinned source at 257672ae8bb404e55af16a6d0076741ee2d7a6f8.

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat /etc/os-release | head -2; ls /inputs 2>&1
cd <guest-path> && cat README.md 2>/dev/null | head -200
cd <guest-path> && grep -n -i "^#\|npm \|node \|mcp\|--once\|cron\|schedule\|webhook" README.md | head -150; echo ---; node -v; npm -v; cat package.json | head -60
cd <guest-path> && git --version && git init -q && git remote add origin https://github.com/trailhq/Trail-Code && git fetch --depth 1 origin 257672ae8bb404e55af16a6d0076741ee2d7a6f8 2>&1 | tail -3; git reset -q --mixed FETCH_HEAD && git log --oneline -1 && git status --short | head -5
sudo -n true && echo SUDO_OK; (curl -fsSL https://deb.nodesource.com/setup_22.x -o /tmp/ns.sh && sudo -n bash /tmp/ns.sh >/tmp/ns.log 2>&1 && sudo -n apt-get install -y nodejs >>/tmp/ns.log 2>&1); echo rc=$?; tail -3 /tmp/ns.log; node -v; npm -v
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm install 2>&1 | tail -15; echo rc=${PIPESTATUS[0]}
cd <guest-path> && grep -n -i "error\|not found\|gyp info\|make" <guest-path> | grep -v "npm error gyp ERR! stack" | head -30; which make g++ gcc python3
cd <guest-path> && sudo -n apt-get update -qq >/tmp/apt.log 2>&1; sudo -n DEBIAN_FRONTEND=noninteractive apt-get install -y -qq build-essential >>/tmp/apt.log 2>&1; echo apt_rc=$?; which make g++; export NODE_USE_ENV_PROXY=1 && npm install 2>&1 | tail -5; echo rc=${PIPESTATUS[0]}
cd <guest-path> && export NODE_USE_ENV_PROXY=1 && npm run build 2>&1 | tail -8; echo rc=${PIPESTATUS[0]}; ls dist/bin/ 2>&1
cd <guest-path> && sed -n 585,720p README.md
cd <guest-path> && sed -n 721,760p README.md; echo ----; sed -n 826,840p README.md; echo ----; grep -n '"trail"\|"graft"\|bin' package.json
cd <guest-path> && export NODE_USE_ENV_PROXY=1 DO_NOT_TRACK=1 && npm run cli -- build . 2>&1 | tail -8; echo rc=${PIPESTATUS[0]}; ls graft 2>&1 | head; echo ---; npm run cli -- map . 2>&1 | tail -12
cd <guest-path> && export NODE_USE_ENV_PROXY=1 DO_NOT_TRACK=1 && (npm run cli -- build . > /tmp/build.out 2>&1; echo rc=$? ); wc -c /tmp/build.out; head -c 1500 /tmp/build.out; echo; echo ---; ls graft 2>&1 | head -5; ls graft | wc -l
cd <guest-path> && tail -c 1200 /tmp/build.out | tr '\r' '\n' | tail -15; echo ---; ls -la .trail .coldpass; ls -d graft* .graft* 2>&1
cd <guest-path> && export NODE_USE_ENV_PROXY=1 DO_NOT_TRACK=1 && npm run cli -- map . > /tmp/map.out 2>&1; echo rc=$?; wc -c /tmp/map.out; tr '\r' '\n' < /tmp/map.out | grep -v "^\s*$" | tail -12 | cut -c1-220
cd <guest-path> && export NODE_USE_ENV_PROXY=1 DO_NOT_TRACK=1 && npm run cli -- callers wiringPath . > /tmp/callers.out 2>&1; echo rc=$?; wc -c /tmp/callers.out; tr '\r' '\n' < /tmp/callers.out | grep -v "^\s*$" | head -20 | cut -c1-220
cd <guest-path> && node dist/bin/trail.js --version 2>&1 | head -3; grep -rn "trail_trace_calls\|trail_find_code" src --include=*.ts | head -8
cd <guest-path> && ls src/mcp/; grep -n "name: \|symbol\|question\|inputSchema\|properties" src/mcp/*.ts | grep -v test | head -60 | cut -c1-200
cd <guest-path> && (printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"probe","version":"0"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/list"}'; sleep 3) | timeout 20 node dist/bin/trail.js mcp . > /tmp/tools.out 2>/tmp/tools.err; echo rc=$?; wc -c /tmp/tools.out; grep -o '"name":"[^"]*"' /tmp/tools.out | sort -u; head -c 300 /tmp/tools.err
cd <guest-path> && (printf '%s\n' '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"probe","version":"0"}}}' '{"jsonrpc":"2.0","method":"notifications/initialized"}' '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"trail_trace_calls","arguments":{"symbol":"wiringPath"}}}'; sleep 3) | timeout 20 node dist/bin/trail.js mcp . 2>/dev/null | grep '"id":2' | head -c 700; echo; echo ---; ls -la .mcp.json .claude 2>&1 | head; cat .mcp.json 2>/dev/null | head -c 400
cd <guest-path> && git status --short | head -20; echo ---; git diff --stat; git diff -- .mcp.json | head -30; git diff -- .claude/settings.json | head -40
export NODE_USE_ENV_PROXY=1 DO_NOT_TRACK=1; sudo -n npm install -g @trailhq/trail-code > /tmp/globalinstall.out 2>&1; echo rc=$?; tail -c 600 /tmp/globalinstall.out; which trail && trail --version
cd <guest-path> && export DO_NOT_TRACK=1 && trail init --agents claude --no-global --no-statusline > /tmp/init.out 2>&1 </dev/null; echo rc=$?; tr '\r' '\n' < /tmp/init.out | grep -v '^\s*$' | tail -15 | cut -c1-200
cd <guest-path> && export NODE_USE_ENV_PROXY=1 DO_NOT_TRACK=1 && nohup npm test > /tmp/npmtest.out 2>&1 &
sleep 2; echo started; grep -n "Who depends on it, or what it depends on" <guest-path> | cut -c1-200; grep -n "token-budgeted first look at a repo" README.md | cut -c1-200; grep -n "schedul\|cron\|webhook\|--once\|--now" README.md | head
R=<guest-path>; grep -n "token-budgeted first look at a repo" $R | cut -c1-200; grep -n -i "schedul\|cron\|webhook\|--once\|--now\|end of a turn\|end-of-turn" $R | cut -c1-260
cd <guest-path> && grep -rln "Stop\b\|PostToolUse\|end-of-turn\|endOfTurn" src | head; grep -rn "'Stop'\|\"Stop\"\|PostToolUse" src --include=*.ts | head -8 | cut -c1-220
cd <guest-path> && grep -rn "event: 'Stop'\|sub: '" src/hosts/claude-global.ts src/hosts/codex-hooks.ts | head -12 | cut -c1-240; grep -n "Stop" .claude/settings.json | head -5
cd <guest-path> && grep -rln "'stop'" src | head; f=$(grep -rln "case 'stop'\|'stop':" src | head -1); echo "FILE $f"; grep -n "'stop'" $f | head -5 | cut -c1-200; grep -rn "export.*function.*[Ss]top\|async function stop" src --include=*.ts | head -5 | cut -c1-200
cd <guest-path> && python3 -I -c 'import json;d=json.load(open(".claude/settings.json"));print(json.dumps(d.get("hooks",{}),indent=1)[:1500])'; echo; grep -n "stop" .claude/helpers/graft-hooks.cjs | head -10 | cut -c1-200
cd <guest-path> && ls -la .trail/ | head -20; ls .trail/*.cjs 2>/dev/null; grep -n "stop" .trail/hook.cjs 2>/dev/null | head -10 | cut -c1-220; wc -c .trail/hook.cjs 2>/dev/null
cd <guest-path> && head -c 1200 .trail/hook.cjs; echo; echo ...; grep -n "argv\|session-start\|post-edit\|case '" .trail/hook.cjs | head -20 | cut -c1-200
cd <guest-path> && echo '{"session_id":"manual-cycle","cwd":"<guest-path>","hook_event_name":"Stop"}' | CLAUDE_PROJECT_DIR=<guest-path> DO_NOT_TRACK=1 timeout 60 node .trail/hook.cjs stop > /tmp/stop.out 2>/tmp/stop.err; echo rc=$?; head -c 600 /tmp/stop.out; echo; head -c 300 /tmp/stop.err; echo; echo --- test:; tail -c 400 /tmp/npmtest.out
for i in $(seq 1 50); do if grep -q "^# fail" /tmp/npmtest.out; then break; fi; sleep 10; done; grep -n "^# \(tests\|pass\|fail\|cancelled\|todo\|skipped\)" /tmp/npmtest.out; pgrep -f "run-tests" >/dev/null && echo STILL_RUNNING || echo DONE
for i in $(seq 1 25); do if ! pgrep -f "run-tests" >/dev/null; then break; fi; sleep 10; done; grep -n "^# \(tests\|pass\|fail\|cancelled\|todo\|skipped\)" /tmp/npmtest.out; grep -c "^not ok" /tmp/npmtest.out; pgrep -f "run-tests" >/dev/null && echo STILL_RUNNING || echo DONE; tail -c 200 /tmp/npmtest.out
for i in $(seq 1 28); do if ! pgrep -f "run-tests" >/dev/null; then break; fi; sleep 10; done; grep -n "^# \(tests\|pass\|fail\|cancelled\|todo\|skipped\)" /tmp/npmtest.out; pgrep -f "run-tests" >/dev/null && echo STILL_RUNNING || echo DONE; grep -n "^not ok" /tmp/npmtest.out | cut -c1-250
for i in $(seq 1 28); do if ! pgrep -f "run-tests" >/dev/null; then break; fi; sleep 10; done; grep -n "^# \(tests\|pass\|fail\|cancelled\|todo\|skipped\)" /tmp/npmtest.out; pgrep -f "run-tests" >/dev/null && echo STILL_RUNNING || echo DONE; grep -c "^not ok" /tmp/npmtest.out
sed -n 1556,1575p /tmp/npmtest.out | cut -c1-260
for i in $(seq 1 28); do if ! pgrep -f "run-tests" >/dev/null; then break; fi; sleep 10; done; grep -n "^# \(tests\|pass\|fail\|cancelled\|todo\|skipped\)" /tmp/npmtest.out; pgrep -f "run-tests" >/dev/null && echo STILL_RUNNING || echo DONE; grep -c "^not ok" /tmp/npmtest.out; tail -c 300 /tmp/npmtest.out
grep "^not ok" /tmp/npmtest.out | cut -c1-200; echo; grep -n "^# \(tests\|fail\)" /tmp/npmtest.out | tail -2; grep -n "which go\|colima\|gh" /dev/null; which go colima gh 2>&1 | head -3
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/probe.json <<'EOF'
{"kind":"mcp","argv":["trail","mcp","."],"cwd":"<guest-path>","tool":"trail_trace_calls","arguments":{"symbol":"wiringPath"},"expected_text":"buildGraph"}
EOF
cat > .coldpass/claims.json <<'EOF'
[
{"kind":"claim","claim":"trail_trace_calls returns who depends on a symbol","source":"Who depends on it, or what it depends on with `direction: out`, N levels deep for blast radius.","input":"symbol wiringPath","expected":"lists buildGraph as a caller","probe_kind":"mcp","argv":["trail","mcp","."],"tool":"trail_trace_calls","arguments":{"symbol":"wiringPath"},"expected_text":"buildGraph","cwd":"<guest-path>"},
{"kind":"claim","claim":"trail map gives a token-budgeted repo orientation","source":"`trail map` is a token-budgeted first look at a repo: directory clusters","input":"repo root","expected":"repo map with hotspots","probe_kind":"cli","argv":["trail","map","."],"stdin":"","expected_text":"hotspots: join","cwd":"<guest-path>"}
]
EOF
cat > .coldpass/examples.json <<'EOF'
[
{"kind":"example","claim":"build the graft map of the repo with no LLM key","source":"README.md CLI section: trail build [dir]","input":"repo root","expected":"wiring graph of 7390 nodes","argv":["trail","build","."],"cwd":"<guest-path>","env":{"DO_NOT_TRACK":"1"},"expected_text":"7390 nodes"},
{"kind":"example","claim":"find who calls a symbol","source":"README.md CLI section: trail callers <symbol> [dir]","input":"wiringPath","expected":"caller list including buildGraph","argv":["trail","callers","wiringPath","."],"cwd":"<guest-path>","env":{"DO_NOT_TRACK":"1"},"expected_text":"buildGraph (src/graph/build.ts:L204-L472)"},
{"kind":"example","claim":"repo test suite from the Development section","source":"README.md Development section: npm test","deferred":true,"reason":"Full npm test takes about 27 minutes here and reports 4011 tests, 3986 pass, 16 fail, 9 skipped (output in /tmp/npmtest.out). Left out of replay on purpose; failures are in teammate, git-history and hook tests that need go, colima or gh, or a full git history, which this VM lacks."}
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: README has no cron, scheduler, loop, webhook, --once or --now option. Only agent hook events run per turn: the Stop hook (src/hosts/codex-hooks.ts, src/hosts/claude-global.ts) and PostToolUse post-edit re-sync. In this repo the Claude settings only register SessionStart (trail init --no-global), so no Stop hook is wired. Manual run of .trail/hook.cjs stop with a fake Stop payload exited 0 with no output, so no observable cycle was confirmed.","checks":[]}
EOF
for f in probe claims examples cycles; do python3 -I -c "import json,sys;json.load(open('.coldpass/$f.json'));print('$f ok')"; done
cd <guest-path> && pkill -f "trail.js mcp" 2>/dev/null; pkill -f "trail mcp" 2>/dev/null; <env-var>=<guest-path> timeout 900 python3 -I <guest-path> --validate --replay > /tmp/check.out 2>&1; echo rc=$?; tail -c 2500 /tmp/check.out
ls -la <guest-path> <guest-path> 2>&1 | head -20; cat /tmp/check.out 2>&1 | head -c 1500; ls /inputs 2>&1
cd <guest-path> && pgrep -fa "trail.js mcp|graft.js mcp" | grep -v pgrep | head -3; <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > /tmp/check.out 2>&1; echo rc=$?; tail -c 2500 /tmp/check.out
cd <guest-path> && wc -c /tmp/check.out; grep -o '"problems[^]]*\]' /tmp/check.out | head -3 | cut -c1-300; grep -o '"verdict": "[a-z]*"' /tmp/check.out | sort | uniq -c; grep -o 'verdict[^,]*' /tmp/check.out | sort | uniq -c | head; grep -io "problem[s]*[^,]\{0,120\}" /tmp/check.out | head -5 | cut -c1-200; pgrep -fa "trail.js mcp" | grep -v pgrep | head -2
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": null,
  "operation": "Build the repo's context map with the trail CLI (trail build, trail map, trail callers) and query it over MCP (trail_trace_calls) from the pinned source at 257672ae8bb404e55af16a6d0076741ee2d7a6f8.",
  "operation_scope": "Linux Ubuntu 24.04 guest, Node 22.23.4, npm 10.9.9, Python 3.12.3 (Python is not used by the product). No LLM key, no telemetry (DO_NOT_TRACK=1), no browser. Covers the structural (no-LLM) features only; the --deep LLM summaries were not run.",
  "steps": [
    "git init; git remote add origin https://github.com/trailhq/Trail-Code; git fetch --depth 1 origin 257672ae8bb404e55af16a6d0076741ee2d7a6f8; git reset --mixed FETCH_HEAD",
    "sudo apt-get install -y nodejs (NodeSource setup_22.x) -- Node 22.23.4 / npm 10.9.9, satisfies engines node >=20",
    "sudo apt-get install -y build-essential (required for the native tree-sitter grammars)",
    "NODE_USE_ENV_PROXY=1 npm install",
    "npm run build",
    "npm run cli -- build .  (Development section: run the CLI from source)",
    "npm run cli -- map .",
    "npm run cli -- callers wiringPath .",
    "sudo npm install -g @trailhq/trail-code  (Quick start installer; published 0.25.0, same version as the pin)",
    "DO_NOT_TRACK=1 trail init --agents claude --no-global --no-statusline  (Quick start; telemetry off, no writes outside the repo)",
    "trail mcp .  (MCP stdio server) -> tools/call trail_trace_calls {symbol: wiringPath} returned buildGraph as a caller",
    "<env-var>=<guest-path> python3 -I <guest-path> --validate --replay  -> problems: []"
  ],
  "deviations": [
    "node and npm were not installed in the guest; installed Node 22 via NodeSource setup_22.x and apt (sudo). Succeeded.",
    "First npm install failed building the native tree-sitter-kotlin module: make and g++ were missing (node-gyp error). Installed build-essential with apt; the second npm install succeeded.",
    "The workspace was not a git repository; ran the git init / remote / fetch --depth 1 / reset sequence from the task to pin the commit.",
    "Running trail mcp and trail init inside the repo, the product rewrote tracked files .claude/helpers/graft-hooks.cjs, .claude/helpers/graft-statusline.cjs, .claude/skills/graft/SKILL.md, and created untracked .mcp.json and .trail/.gitignore. This was the product's own agent-wiring refresh, not a hand edit; left in place.",
    "npm test (README Development section) ran to completion: 4011 tests, 3986 pass, 16 fail, 9 skipped. The 16 failures are in teammate, git-history, and hook tests. Some need go, colima or gh, which are not installed; some expect git history that a depth-1 clone does not have (likely cause, not established). The full run takes about 27 minutes, so it was recorded as a deferred example and not replayed.",
    "The published global trail (0.25.0) was used for the probe and claims, as the README Quick start documents; the from-source build was used for build/map/callers via npm run cli.",
    "Cycles: no cron, scheduler, webhook, --once or --now in the README or entry points. Only agent hook events exist. A manual run of .trail/hook.cjs stop exited 0 with no output, so no cycle was confirmed; cycles.json has detected:false with the reason.",
    "A first checker run appeared to fail with exit 255; it was my own pkill pattern killing my shell, not the checker. The rerun returned 0."
  ],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": "None needed for the core operation. Optional: document the build-essential requirement for source builds, and make the git-history-dependent teammate tests tolerate shallow clones or skip them when no history is present. Install go, colima and gh, or skip those tests, to get a clean npm test run."
}
EOF
python3 -I -c "import json;d=json.load(open('<guest-path>'));print(d['outcome'], d['fault_owner'], len(d['steps']))"; ls -la <guest-path> 2>&1 | head -1
cd <guest-path> && python3 --version; grep -l DO_NOT_TRACK /tmp/init.out /tmp/globalinstall.out 2>/dev/null; pgrep -fa "trail.js mcp|graft.js mcp|trail mcp|graft mcp" | grep -v pgrep || echo "no servers"; <env-var>=<guest-path> timeout 1500 python3 -I <guest-path> --validate --replay > /tmp/check2.out 2>&1; echo rc=$?; tail -c 600 /tmp/check2.out
cd <guest-path> && python3 -I - <<'EOF'
import json
p='.coldpass/report.json'
d=json.load(open(p))
d['operation_scope']=d['operation_scope'].replace('No LLM key, no telemetry (DO_NOT_TRACK=1), no browser.','No LLM key, no browser. Telemetry setting was not explicitly controlled.')
d['steps']=[s.replace('DO_NOT_TRACK=1 trail init','trail init').replace(' (Quick start; telemetry off, no writes outside the repo)',' (Quick start)') for s in d['steps']]
json.dump(d,open(p,'w'),indent=2)
print(d['outcome'], d['operation_scope'][:120])
EOF
grep -o '"problems": \[[^]]*\]' /tmp/check2.out
cd <guest-path> && . /etc/os-release && echo "$PRETTY_NAME" && python3 -I -c "
import json;p='.coldpass/report.json';d=json.load(open(p))
d['operation_scope']=d['operation_scope'].replace('Ubuntu 24.04','$PRETTY_NAME'.replace('\"',''))
json.dump(d,open(p,'w'),indent=2);print(d['operation_scope'][:90])"