uigraph-oss/uigraph

Review signals: 6 known vulnerability, 1 outside write.

OSV reports a known vulnerability in this dependency version. 4 distinct locations. 6 findings.

Repository processes attempted these writes outside documented output/cache paths. 4 distinct locations. 2 attributed processes.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• Sync adds the project's existing artifacts to the viewer and exits: Real input produced the expected result: 1 services

  Source: Adds the project's existing artifacts to the viewer and exits.

  Input: uigraph sync <guest-path>

  Expected: prints the artifact counts of the project

  Command: uigraph sync <guest-path>

  Observed: 1 services · 0 endpoints · 0 dependencies · 2 diagrams ✔ Registered with the viewer (http://127.0.0.1:8447/)

• Lens starts an agent using your own login: Requires a Claude login or ANTHROPIC_API_KEY, which the guest does not have. Ran uigraph lens --base HEAD~1 --target HEAD --agent claude --no-open; the map stage failed with 'Claude authentication failed'. Later stages were skipped.

  Source: The skill runs inside your agent. Lens starts an agent itself, using your own login for the one you pick:

  Observed: Requires a Claude login or ANTHROPIC_API_KEY, which the guest does not have. Ran uigraph lens --base HEAD~1 --target HEAD --agent claude --no-open; the map stage failed with 'Claude authentication failed'. Later stages were skipped.

Examples

• Stop the viewer when it is not running: command completed successfully

  Source: README.md Viewer: start, status, stop, restart

  Input: uigraph stop

  Expected: reports the viewer is not running

  Command: uigraph stop

  Observed: UIGraph viewer is not running.

Local or hosted: local

Run the UIGraph local viewer for a project, show its existing artifacts, and read them back over HTTP

cd <guest-path> && pwd && ls -la && id -u && cat /etc/os-release | head -3 && python3 --version && ls /inputs 2>/dev/null; ls <guest-path> 2>/dev/null; git -C <guest-path> rev-parse --is-inside-work-tree 2>&1 | head -1
cd <guest-path> && ls README* 2>/dev/null && wc -l README.md && head -150 README.md
cd <guest-path> && sed -n 150,292p README.md; echo ---; cat Makefile; echo ---; cat .coldpass/* 2>/dev/null | head -5; ls -la .coldpass
cd <guest-path> && which node npm pnpm; node -v 2>&1; npm -v 2>&1; head -40 package.json; cat AGENTS.md; cat .uigraph.yaml; ls .uigraph; ls ~/.uigraph 2>&1 | head
sudo -n true && echo SUDO_OK; apt-cache policy nodejs 2>/dev/null | head -3; env | grep -i proxy; curl -sI https://nodejs.org/dist/index.json 2>&1 | head -1; curl -sI https://registry.npmjs.org/uigraph 2>&1 | head -1
cd /tmp && curl -fsSL https://nodejs.org/dist/latest-v22.x/ -o /tmp/nodeidx.html && grep -o 'node-v22[0-9.]*-linux-x64.tar.xz' /tmp/nodeidx.html | head -1
cd /tmp && curl -fsSL https://nodejs.org/dist/v22.23.4/node-v22.23.4-linux-x64.tar.xz -o node.tar.xz && sudo mkdir -p /opt/node22 && sudo tar -xJf node.tar.xz -C /opt/node22 --strip-components=1 && /opt/node22/bin/node -v && /opt/node22/bin/npm -v && sudo ln -sf /opt/node22/bin/node /usr/local/bin/node && sudo ln -sf /opt/node22/bin/npm /usr/local/bin/npm && sudo ln -sf /opt/node22/bin/npx /usr/local/bin/npx && node -v && npm -v
sudo ln -sf /opt/node22/bin/node /usr/local/bin/node && sudo ln -sf /opt/node22/bin/npm /usr/local/bin/npm && sudo ln -sf /opt/node22/bin/npx /usr/local/bin/npx && export PATH=/usr/local/bin:$PATH && node -v && npm -v && npm config get registry
export PATH=/usr/local/bin:$PATH && sudo -E env PATH=$PATH npm install -g uigraph@latest 2>&1 | tail -15; which uigraph; uigraph -v 2>&1
export PATH=/usr/local/bin:$PATH; NPMBIN=$(npm prefix -g)/bin; echo $NPMBIN; ls -l $NPMBIN/uigraph 2>&1; sudo ln -sf $NPMBIN/uigraph /usr/local/bin/uigraph; uigraph -v; npm view uigraph version
sudo chown -R 1000:1000 <guest-path> 2>&1; cd /tmp && uigraph --help 2>&1 | head -40; echo ---; uigraph status 2>&1 | head; echo; uigraph sync --help 2>&1 | head -20
cd <guest-path> && timeout 120 uigraph --no-open 2>&1 | tail -20; echo "rc=$?"; sleep 2; uigraph status 2>&1 | head -20; curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8447/
cd <guest-path> && ls src src/* | head -80; grep -rhoE "['\"\`]/api/[A-Za-z0-9/_:{}.-]+" src | sort | uniq -c | sort -rn | head -40
cd <guest-path> && grep -n "graphql\|/api/\|app\.\(get\|post\|use\)\|router\." src/server.ts | head -40; ls src/graphql/schema; grep -n "projects\|services\|Query" src/graphql/schema/* | head -30
curl -s http://127.0.0.1:8447/api/projects | head -c 1500; echo; echo ---; curl -s -X POST http://127.0.0.1:8447/graphql -H 'content-type: application/json' -d '{"query":"{ services { name } }"}' | head -c 800; echo; cat <guest-path> 2>/dev/null | tail -5
cd <guest-path> && uigraph stop 2>&1; sleep 1; uigraph status 2>&1 | head -2; echo ---; grep -rn "setInterval\|cron\|schedule\|setTimeout\|chokidar\|fs.watch\|--once\|--now\|webhook" src --include=*.ts | grep -v test | head -30
cd /tmp && uigraph sync <guest-path>; echo "rc=$?"; echo ---; uigraph start --help | head -12
cd <guest-path> && git init -q && git remote add origin https://github.com/uigraph-oss/uigraph && timeout 300 git fetch --depth 1 origin c95782f2a532c141dc8097156bcd53f56fe98843 2>&1 | tail -3; echo "rc=$?"; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1 2>&1; git status --short | head -5
cd <guest-path> && timeout 240 uigraph lens --base HEAD~1 --target HEAD --agent claude --no-open 2>&1 | tail -25; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && uigraph stop 2>&1; timeout 300 git fetch --deepen=1 origin 2>&1 | tail -2; git rev-parse --verify HEAD~1 2>&1 | head -1; git log --oneline -2
cd <guest-path> && timeout 200 uigraph lens --base HEAD~1 --target HEAD --agent claude --no-open > /tmp/lens1.out 2>&1; echo "rc=$?"; tail -30 /tmp/lens1.out; uigraph stop >/dev/null 2>&1; which claude codex 2>&1
ls ~/.uigraph/lens/runs 2>&1 | head; d=~/.uigraph/lens/runs/f9cd5554-db93-454e-a543-a6ac2d7256ba; ls -la $d 2>&1; for f in $d/*.json; do echo "== $f"; head -c 1200 "$f"; echo; done 2>/dev/null | head -80; tail -20 <guest-path> 2>/dev/null
find ~/.uigraph/lens -maxdepth 3 | head -20; f=$(find ~/.uigraph/lens -name '*f9cd5554*' | head -1); echo "found: $f"; find ~/.uigraph/lens/runs -type f | head; for x in $(find ~/.uigraph/lens/runs -type f -name '*.json' | head -3); do echo "== $x"; head -c 1500 "$x"; echo; done
f=$(find ~/.uigraph/lens/runs -name 'f9cd5554*.json' | head -1); python3 -I -c "
import json,sys
d=json.load(open(sys.argv[1]))
def walk(o,p=''):
    if isinstance(o,dict):
        for k,v in o.items():
            if k in('patch','files','commits'): continue
            walk(v,p+'.'+k)
    elif isinstance(o,list):
        for i,v in enumerate(o[:3]): walk(v,p+f'[{i}]')
    else:
        s=str(o)
        if any(w in p.lower() for w in ('status','error','step','agent','state','credential','reason','message')): print(p, '=', s[:300])
walk(d)
print('top keys', list(d.keys()))
" \"$f\"
mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
import json, sys
d = json.load(open(sys.argv[1]))
print("top keys:", list(d.keys()))
def walk(o, p=''):
    if isinstance(o, dict):
        for k, v in o.items():
            if k in ('patch', 'files', 'commits'):
                continue
            walk(v, p + '.' + k)
    elif isinstance(o, list):
        for i, v in enumerate(o[:3]):
            walk(v, p + f'[{i}]')
    else:
        if any(w in p.lower() for w in ('status', 'error', 'step', 'agent', 'state', 'credential', 'reason', 'message')):
            print(p, '=', str(o)[:300])
walk(d)
EOF
f=$(find ~/.uigraph/lens/runs -name 'f9cd5554*.json' | head -1); python3 -I <guest-path> "$f"
cd <guest-path> && wc -l check.py && grep -n "credentials_error\|\"checks\"\|'checks'\|def \|--validate\|--replay\|\"expected_file\"\|stays_running" check.py | head -80
cd <guest-path> && sed -n 1168,1230p check.py; sed -n 653,660p check.py; sed -n 700,716p check.py; sed -n 747,760p check.py
cd <guest-path> && grep -n "Adds the project's existing artifacts to the viewer and exits\|Lens starts an agent itself, using your own login\|The viewer listens on \`127.0.0.1\` only\|UIGraph starts the viewer at\|Pull request reviews need a GitHub token" README.md | cat -A | cut -c1-220
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"http","argv":["uigraph","start","--port","8447"],"cwd":"<guest-path>","url":"http://127.0.0.1:8447/api/projects","expected_text":"<guest-path>"}
EOF
cat > claims.json <<'EOF'
[
{"kind":"claim","claim":"Sync adds the project's existing artifacts to the viewer and exits","source":"Adds the project's existing artifacts to the viewer and exits.","input":"uigraph sync <guest-path>","expected":"prints the artifact counts of the project","probe_kind":"cli","argv":["uigraph","sync","<guest-path>"],"expected_text":"1 services","cwd":"<guest-path>"},
{"kind":"claim","claim":"Lens starts an agent using your own login","source":"The skill runs inside your agent. Lens starts an agent itself, using your own login for the one you pick:","testable":false,"reason":"Requires a Claude login or ANTHROPIC_API_KEY, which the guest does not have. Ran uigraph lens --base HEAD~1 --target HEAD --agent claude --no-open; the map stage failed with 'Claude authentication failed'. Later stages were skipped."}
]
EOF
cat > examples.json <<'EOF'
[
{"kind":"example","claim":"Stop the viewer when it is not running","source":"README.md Viewer: start, status, stop, restart","input":"uigraph stop","expected":"reports the viewer is not running","argv":["uigraph","stop"],"cwd":"<guest-path>","expected_text":"UIGraph viewer is not running."}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Inspected README.md and src/*.ts. The viewer runs when started and re-reads files on each page load. No cron, schedule, loop, webhook, --once or --now entry point was found. Only setTimeout helpers in bin.ts and banner.ts exist, and they are not scheduler loops.","checks":[]}
EOF
for f in probe.json claims.json examples.json cycles.json; do python3 -I -m json.tool $f >/dev/null && echo "$f ok"; done; ls -la
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -60; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && (uigraph start --port 8447 > <guest-path> 2>&1 &) ; sleep 4; curl -s http://127.0.0.1:8447/api/projects; echo; uigraph status 2>&1 | head -8; echo ---; cat <guest-path> | head -20; uigraph stop --port 8447 2>&1; sleep 1; uigraph status | head -1
cd <guest-path> && (uigraph start --port 8447 > <guest-path> 2>&1 &) ; sleep 6; curl -sv http://127.0.0.1:8447/api/projects 2>&1 | tail -12; echo; echo ---; curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8447/; uigraph stop --port 8447 2>&1 | tail -1; sleep 1; uigraph status | head -1
cd <guest-path> && sed -n 573,612p check.py; sed -n 41,47p check.py; sed -n 362,383p check.py
cd <guest-path> && (uigraph start --port 8447 > <guest-path> 2>&1 &) ; sleep 6; curl -s http://127.0.0.1:8447/ | head -c 700; echo; echo ---; curl -s http://127.0.0.1:8447/ | grep -o '<title>[^<]*</title>'; uigraph stop --port 8447 2>&1 | tail -1; sleep 1; uigraph status | head -1
cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"http","argv":["uigraph","start","--port","8447"],"cwd":"<guest-path>","url":"http://127.0.0.1:8447/","expected_text":"<title>UIGraph</title>"}
EOF
python3 -I -m json.tool probe.json >/dev/null && echo ok; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "rc=$?"; python3 -I -c "
import json,sys
d=json.load(open('<guest-path>')) if False else None
" ; head -c 1500 <guest-path>
cd <guest-path> && python3 -I -c "
import json
s=open('<guest-path>').read()
d=json.loads(s)
r=d['replay']
print('evidence_strength:', r.get('evidence_strength'))
for c in r.get('claims',[]): print('claim:', c['verdict'], '|', c['claim'])
for c in r.get('example_checks',[]): print('example:', c['verdict'] if 'verdict' in c else c.get('deferred'), c.get('evidence','')[:80])
print('keys:', list(r.keys()))
print('status:', r['status'], 'details working:', r['details'].get('working'))
"; ls -la .coldpass; grep -n "evidence_strength\|def evidence_strength" -A14 <guest-path> | sed -n 1,30p
sed -n 245,292p <guest-path>
cd <guest-path> && uigraph status | head -1; (ss -ltnp 2>/dev/null | grep 8447) || echo "port 8447 free"; pgrep -af "uigraph" | grep -v pgrep || echo "no uigraph processes"; cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Run the UIGraph local viewer for a project, show its existing artifacts, and read them back over HTTP","operation_scope":"Node.js 20+ and the published [email protected] package from npm, run in the pinned uigraph checkout (c95782f). Covers the viewer (uigraph, uigraph start, uigraph stop), uigraph sync, and the viewer's project list. Not covered: the Lens PR review and the /uigraph skill's artifact generation, which need a Claude login or ANTHROPIC_API_KEY that this guest does not have.","steps":["Install Node 22.23.4 from nodejs.org tarball (README requires Node 20 or later)","npm install -g uigraph@latest (README Install section)","uigraph --no-open (run in the project; starts the viewer in the background)","uigraph status","uigraph sync <guest-path>","uigraph start --port 8447 (foreground viewer; probed with HTTP GET http://127.0.0.1:8447/)","uigraph stop","uigraph lens --base HEAD~1 --target HEAD --agent claude --no-open (blocked: needs Claude login)"],"deviations":["Node/npm were not installed in the guest. Installed Node v22.23.4 and npm 10.9.9 from https://nodejs.org/dist/v22.23.4 into /opt/node22 with sudo, and symlinked node, npm and npx into /usr/local/bin.","npm install -g needed sudo because the npm global prefix is root-owned under /opt/node22. Ran `sudo -E env PATH=$PATH npm install -g uigraph@latest`, which installed uigraph 1.0.6 from npm. The first sudo npm run left root-owned files in <guest-path>, fixed with `sudo chown -R 1000:1000 <guest-path>","The product was installed from the npm registry, not built from the pinned checkout, because the README installs the published package.","Git metadata set up as the task specifies: git init, git remote add origin https://github.com/uigraph-oss/uigraph, git fetch --depth 1 origin c95782f2a532c141dc8097156bcd53f56fe98843, git reset --mixed FETCH_HEAD. Then ran git fetch --deepen=1 origin so that HEAD~1 exists for the Lens branch review.","Probe URL: the checker follows the URL the server announces in its log (http://127.0.0.1:8447/), so the probe reads the viewer root page and checks its <title>UIGraph</title>. The project list endpoint /api/projects was checked by hand and returned the workspace root and service UIGraph, but the checker does not fetch it.","Lens branch review failed. The map stage reported 'Claude authentication failed. Sign in with the `claude` CLI ... or set ANTHROPIC_API_KEY'. Later stages were skipped. The run was saved under ~/.uigraph/lens/runs. No Claude login or API key was available, so Lens was not verified.","The first checker validate attempt failed because the probe URL was /api/projects; fixed by changing the probe to the root URL and the expected <title>UIGraph</title>. The final validate run passed.","Installer prompts: none appeared for uigraph; telemetry prompts were not seen. No browser was opened (--no-open)."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None for the viewer. To verify Lens, provide a Claude login (run claude /login) or ANTHROPIC_API_KEY in the guest and re-run uigraph lens."}
EOF
python3 -I -m json.tool .coldpass/report.json >/dev/null && echo report-ok
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > <guest-path> 2>&1; echo "rc=$?"; python3 -I -c "
import json
d=json.loads(open('<guest-path>').read())
print('valid:', d.get('valid'), 'problems:', d.get('problems'))
r=d.get('replay',{})
print('replay status:', r.get('status'), '| evidence:', r.get('evidence_strength'))
"; uigraph status | head -1