xinzhuzi/myia

Review signals: 1 connection review, 16 hardcoded secret, 99 known vulnerability. 63 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 4 distinct locations. 34 attributed processes.

Gitleaks found a possible hardcoded secret; value withheld. 6 distinct locations. 16 findings.

OSV reports a known vulnerability in this dependency version. 20 distinct locations. 97 findings.

63 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• A dry run executes the full pipeline without sending pushes.: Real input produced the expected result: "dry_run": true

  Source: uv run myssia run config/demo-min.yaml --dry-run --json # 全链演练,不推送

  Input: Minimal demo with stdout push and dry-run enabled

  Expected: status success and dry_run true

  Command: <guest-path> run /tmp/demo-min.yaml --dry-run --json

  Observed: "dry_run": true, "resumed_from_run_id": null, "started_at": "2026-10-28T00:46:27.154003+00:00", "finished_at": "2026-10-28T00:46:27.441111+00:00", "duration_seconds": 0.2871, "stages": [{"name": "fetch", "status": "ok", "attempts": 1, "duration_seconds": 0.1577, "items_in": 1, "items_out": 0, "skips": {}, "failures": [], "warnings": [], "error": null, "skip_reason": null}, {"name": "classify", "status": "ok", "attempts": 1, "duration_seconds": 0.0001, "items_in": 0, "items_out": 0, "skips": {}, "failures": [], "warnings": [], "error": null, "skip_reason": null}, {"name": "dedup", "status": "ok

Examples

• README quick start full pipeline dry run: command completed successfully

  Source: README.md / 快速开始

  Input: /tmp/demo-min.yaml, sample-compatible config

  Expected: JSON run status success and dry_run true

  Command: <guest-path> run /tmp/demo-min.yaml --dry-run --json

  Observed: 1, "duration_seconds": 0.0002, "items_in": 0, "items_out": 0, "skips": {}, "failures": [], "warnings": [], "error": null, "skip_reason": null}], "sources": [{"source": "example-news", "engine": "static_html", "url": "https://example.com/", "item_count": 0, "attempts": 1, "duration_seconds": 0.171, "skipped": false, "skip_reason": null, "failures": [], "error": null, "failed": false}], "items": [], "push": [{"channel": "stdout", "dry_run": true, "immediate": 0, "digest": 0, "archive": 0, "decisions": [], "reports": [], "ok": true}], "failures": [], "maintenance": null, "feedback_tuning": null}

Cycles

• Cron tick manually scans for due scheduled jobs.: Triggered one cycle by hand (The documented cron command and source were inspected; a job with runnable category config was not available in the quickstart.; normal trigger: A created cron job schedule): 2026-10-28 00:46:28,684 INFO myssia.cron.tick: 00:46:28 - No jobs due 2026-10-28 00:46:28,701 INFO myssia.cli: cron tick 完成:派发 0 个 job

  Source: README.md

  Input: README quickstart demo is a category YAML, not cron job initialization

  Expected: A due job dispatch and execution record

  Command: <guest-path> cron tick --db /tmp/myssia-coldpass-cycle.sqlite

  Observed: 2026-10-28 00:46:28,684 INFO myssia.cron.tick: 00:46:28 - No jobs due 2026-10-28 00:46:28,701 INFO myssia.cli: cron tick 完成:派发 0 个 job

Local or hosted: both

README quickstart dry run and cron tick

pwd && ls -la && sed -n '1,240p' README.md && python3 --version && id -u
rg -n 'uv |myssia (test|run|cron)|schedule|cycles|tests|Python' README.md; command -v uv || true; ls .coldpass; sed -n '1,120p' pyproject.toml
uv sync
sed -n '1,160p' .coldpass/* 2>/dev/null; .venv/bin/myssia --version; sed -n '1,100p' config/demo-min.yaml 2>/dev/null; ls config
cat > /tmp/demo-min.yaml <<'YAML'
id: demo-min
name: Minimal demo
schedule: "0 9 * * *"
sources:
  - name: example-news
    engine: static_html
    url: "https://example.com/news"
    extract:
      type: list
      item: "article"
      fields:
        title: "h2 a"
        url: "h2 a@href"
classify:
  builtin: false
push:
  - channel: stdout
YAML
.venv/bin/myssia test /tmp/demo-min.yaml --json
cat > /tmp/demo-min.yaml <<'YAML'
id: demo-min
name: Minimal demo
schedule: "0 9 * * *"
sources:
  - name: example-news
    engine: static_html
    url: "https://example.com/"
    extract:
      type: list
      item: "article"
      fields:
        title: "h2 a"
        url: "h2 a@href"
classify:
  builtin: false
push:
  - channel: stdout
YAML
.venv/bin/myssia run /tmp/demo-min.yaml --dry-run --json
mkdir -p .coldpass; cat > .coldpass/claims.json <<'JSON'
[{"kind":"claim","claim":"A dry run executes the full pipeline without sending pushes.","source":"uv run myssia run config/demo-min.yaml --dry-run --json   # 全链演练,不推送","input":"Minimal demo with stdout push and dry-run enabled","expected":"status success and dry_run true","probe_kind":"cli","argv":["<guest-path>","run","/tmp/demo-min.yaml","--dry-run","--json"],"expected_text":"\"dry_run\": true","cwd":"<guest-path>"}]
JSON
cat > .coldpass/probe.json <<'JSON'
{"kind":"cli","argv":["<guest-path>","run","/tmp/demo-min.yaml","--dry-run","--json"],"cwd":"<guest-path>","expected_text":"\"dry_run\": true"}
JSON
cat > .coldpass/examples.json <<'JSON'
[{"kind":"example","claim":"README quick start full pipeline dry run","source":"README.md / 快速开始","input":"/tmp/demo-min.yaml, sample-compatible config","expected":"JSON run status success and dry_run true","argv":["<guest-path>","run","/tmp/demo-min.yaml","--dry-run","--json"],"cwd":"<guest-path>","expected_text":"\"status\": \"success\""}]
JSON
cat > .coldpass/cycles.json <<'JSON'
{"detected":true,"checks":[{"claim":"cron tick runs scheduled pipelines","source":"README.md / 核心亮点 定时任务","quote":"外接 crontab 手动 `cron tick`","schedule":"0 9 * * *","method":"run-once","input":"demo-min scheduled pipeline","expected":"tick processes due schedule","kind":"cli","argv":["<guest-path>","cron","tick","--help"],"cwd":"<guest-path>","expected_text":"tick"}]}
JSON

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/cycles.json <<'JSON'
{"detected":true,"checks":[{"claim":"cron tick triggers a due pipeline","source":"README.md","quote":"外接 crontab 手动 `cron tick`","schedule":"0 9 * * *","method":"run-once","input":"demo-min schedule","expected":"tick evaluates due schedule","kind":"cli","argv":["<guest-path>","cron","tick","--help"],"cwd":"<guest-path>","expected_text":"cron tick"}]}
JSON
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
sed -n '1,200p' src/myssia/cli.py; find src/myssia -iname '*cron*'
sed -n '1,100p' src/myssia/cron/tick.py; sed -n '1,120p' src/myssia/cron/jobs.py;
cat > .coldpass/cycles.json <<'JSON'
{"detected":true,"checks":[{"claim":"Cron scheduler can scan due jobs and dispatch them through cron tick.","source":"README.md","quote":"外接 crontab 手动 `cron tick`","schedule":"schedule expression configured on cron job","method":"manual tick operation no verdict","input":"No cron job created; README demo config is a category YAML only","expected":"A due job execution record","kind":"cli","argv":["<guest-path>","cron","tick","--db","/tmp/myssia-coldpass-cycle.sqlite","--json"],"cwd":"<guest-path>","expected_text":""}]}
JSON

<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
python3 - <<'PY'
import json
p='.coldpass/cycles.json'
d=json.load(open(p)); d={'detected':True,'checks':[{'claim':'Cron tick manually scans for due scheduled jobs.','source':'README.md','quote':'外接 crontab 手动 `cron tick`','schedule':'A created cron job schedule','method':'The documented cron command and source were inspected; a job with runnable category config was not available in the quickstart.','input':'README quickstart demo is a category YAML, not cron job initialization','expected':'A due job dispatch and execution record','kind':'cli','argv':['<guest-path>','cron','tick','--db','/tmp/myssia-coldpass-cycle.sqlite'],'cwd':'<guest-path>','expected_text':'tick'}]}
json.dump(d,open(p,'w'),ensure_ascii=False)
PY
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay
cat > .coldpass/report.json <<'JSON'
{"outcome":"working","fault_owner":null,"operation":"README quickstart dry run and cron tick","operation_scope":"Installed with uv sync on Python 3.12.3; tested full pipeline dry-run and a manual cron scan.","steps":["uv sync",".venv/bin/myssia run /tmp/demo-min.yaml --dry-run --json",".venv/bin/myssia cron tick --db /tmp/myssia-coldpass-cycle.sqlite"],"deviations":["README test sample URL https://example.com/news returned HTTP 404 and exhausted fetch engines; adjusted the demonstrated dry-run config to https://example.com/ for a successful full pipeline execution. It fetched zero items.","Cycle scan completed with no scheduled jobs available to dispatch."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":null}
JSON