zarazhangrui/beautiful-html-templates

No problems traced to this repository code in these checks.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The library contains 34 templates, and the documented index build reports that count: Real input produced the expected result: with 34 templates.

  Source: All 34 templates.

  Input: templates/ folder with one template.json per template (run: node scripts/build-index.mjs)

  Expected: Build prints 'Wrote ... with 34 templates.' and writes index.json

  Command: node scripts/build-index.mjs

  Observed: with 34 templates.

Examples

• Rebuild the library-wide index.json from every templates/<slug>/template.json (documented in scripts/build-index.mjs and AGENTS.md step 5): command completed successfully

  Source: scripts/build-index.mjs

  Input: no arguments; reads templates/*/template.json

  Expected: Wrote index.json with 34 templates

  Command: node scripts/build-index.mjs

  Observed: Wrote <guest-path> with 34 templates.

• Run the template verifier before publishing a new template: Not runnable: step 4 requires 'bun run .tools/verify.ts', but .tools/ is gitignored and absent from the snapshot, and bun is not installed. No documented tests exist (no package.json, no test script).

  Source: scripts/new-template.mjs

  Expected: documented command completes successfully

  Observed: Not runnable: step 4 requires 'bun run .tools/verify.ts', but .tools/ is gitignored and absent from the snapshot, and bun is not installed. No documented tests exist (no package.json, no test script).

• Open the three candidate previews in a browser for the user to compare: Requires macOS 'open' and a local browser for an interactive user choice; not part of the library build. Deferred, no browser was used.

  Source: AGENTS.md section 1, Step 4

  Expected: documented command completes successfully

  Observed: Requires macOS 'open' and a local browser for an interactive user choice; not part of the library build. Deferred, no browser was used.

Local or hosted: local

Rebuild the library index (index.json) from the 34 template.json files, as documented in scripts/build-index.mjs and AGENTS.md step 5

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat /etc/os-release | head -2; ls /inputs 2>&1
cd <guest-path> && cat README.md 2>/dev/null | head -300
cd <guest-path> && tail -c 4000 README.md; echo ----; ls -la scripts runtime .coldpass; echo ----; grep -n -i "python\|node\|npm\|run\|script\|\`\`\`" AGENTS.md | head -80
cd <guest-path> && cat scripts/build-index.mjs; echo ----; cat scripts/new-template.mjs; echo ----; sed -n 1,60p AGENTS.md; echo; cat .gitignore; echo ----; which node npm; node --version 2>&1; npm --version 2>&1; ls templates | head -50
sudo -n true && echo SUDO_OK; env | grep -i proxy | sed 's/=.*@/=***@/'; apt-cache policy nodejs 2>/dev/null | head -3; cd <guest-path> && grep -n -i "node\|bun\|install" AGENTS.md | head -30
(sudo apt-get update -y && sudo apt-get install -y nodejs npm) > /tmp/apt-node.log 2>&1; echo "exit=$?"; tail -5 /tmp/apt-node.log; node --version; npm --version
cd <guest-path> && mkdir -p <guest-path> && cp index.json <guest-path> && node scripts/build-index.mjs; echo "exit=$?"; python3 -I -c "import json;d=json.load(open('index.json'));print(d['template_count'], d['generated_at'])"; diff <(python3 -I -c "import json;d=json.load(open('<guest-path>'));d.pop('generated_at');print(json.dumps(d,sort_keys=True,indent=1))") <(python3 -I -c "import json;d=json.load(open('index.json'));d.pop('generated_at');print(json.dumps(d,sort_keys=True,indent=1))") && echo SAME_CONTENT
ls -la <guest-path> && cd <guest-path> && grep -c "All 34 templates. Three slides per template" README.md && grep -o "DM Serif Display[^\"]*" templates/*/template.json | head -2; grep -o '"tagline": "[^"]*Instrument[^"]*"' templates/*/template.json | head
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/claims.json <<'EOF'
[
  {
    "kind": "claim",
    "claim": "The library contains 34 templates, and the documented index build reports that count",
    "source": "All 34 templates.",
    "input": "templates/ folder with one template.json per template (run: node scripts/build-index.mjs)",
    "expected": "Build prints 'Wrote ... with 34 templates.' and writes index.json",
    "probe_kind": "cli",
    "argv": ["node", "scripts/build-index.mjs"],
    "expected_text": "with 34 templates.",
    "cwd": "<guest-path>"
  }
]
EOF
cat > .coldpass/probe.json <<'EOF'
{
  "kind": "cli",
  "argv": ["node", "scripts/build-index.mjs"],
  "cwd": "<guest-path>",
  "expected_text": "with 34 templates."
}
EOF
cat > .coldpass/examples.json <<'EOF'
[
  {
    "kind": "example",
    "claim": "Rebuild the library-wide index.json from every templates/<slug>/template.json (documented in scripts/build-index.mjs and AGENTS.md step 5)",
    "source": "scripts/build-index.mjs",
    "input": "no arguments; reads templates/*/template.json",
    "expected": "Wrote index.json with 34 templates",
    "argv": ["node", "scripts/build-index.mjs"],
    "cwd": "<guest-path>",
    "env": {},
    "expected_text": "with 34 templates."
  },
  {
    "kind": "example",
    "claim": "Run the template verifier before publishing a new template",
    "source": "scripts/new-template.mjs",
    "reason": "Not runnable: step 4 requires 'bun run .tools/verify.ts', but .tools/ is gitignored and absent from the snapshot, and bun is not installed. No documented tests exist (no package.json, no test script)."
  },
  {
    "kind": "example",
    "claim": "Open the three candidate previews in a browser for the user to compare",
    "source": "AGENTS.md section 1, Step 4",
    "reason": "Requires macOS 'open' and a local browser for an interactive user choice; not part of the library build. Deferred, no browser was used."
  }
]
EOF
cat > .coldpass/cycles.json <<'EOF'
{
  "detected": false,
  "reason": "Inspected README.md, AGENTS.md, scripts/build-index.mjs and scripts/new-template.mjs. No cron, scheduler, loop, webhook, --once or --now entry point exists. The library is run by hand (node scripts/build-index.mjs) and by the agent following AGENTS.md; nothing runs on a schedule.",
  "checks": []
}
EOF
python3 -I -c "import json,glob;[json.load(open(f)) for f in glob.glob('.coldpass/*.json')];print('json ok')"
cd <guest-path> && cat > .coldpass/report.json <<'EOF'
{
  "outcome": "working",
  "fault_owner": null,
  "operation": "Rebuild the library index (index.json) from the 34 template.json files, as documented in scripts/build-index.mjs and AGENTS.md step 5",
  "operation_scope": "Linux Ubuntu 24.04, Node 18.19.1 from apt (no version is pinned by the repo; the script is plain ESM and runs on it). No browser, no network, no Bun. Pinned source e5e204fb1f3b06290846e7dcd7aceddabeceec8c; the workspace was not git-verified against the pin because the build needs no Git metadata.",
  "steps": [
    "sudo apt-get update -y && sudo apt-get install -y nodejs npm (installed Node v18.19.1, npm 9.2.0)",
    "node scripts/build-index.mjs (prints: Wrote <guest-path> with 34 templates.)"
  ],
  "deviations": [
    "README.md has no install or run command. Its only operations are the Get-started prompt and the gallery, so the runnable operation came from scripts/build-index.mjs and AGENTS.md step 5.",
    "Node was not installed in the guest; installed from Ubuntu apt (v18.19.1) with sudo. No README-specified version exists.",
    "The regenerated index.json differs from the shipped one in one tagline: editorial/pink-script shows 'DM Serif Display' in the fresh build (matching templates/pink-script/template.json) where the shipped index.json said 'Instrument Serif'. The shipped index was stale; the build was not hand-edited.",
    "AGENTS.md step 4 (open previews in a browser, macOS 'open') and step 4 of new-template output (bun run .tools/verify.ts) were not run: no browser was used, and .tools/ is absent and gitignored with bun not installed.",
    "No Git init/fetch was done; the build does not need Git metadata. The pinned commit was therefore not verified against the snapshot."
  ],
  "stuck_step": null,
  "main_blocker": null,
  "plain_failure": null,
  "suggested_fix": "Regenerate and commit index.json whenever a template.json changes, so the shipped index matches the templates. Consider documenting 'node scripts/build-index.mjs' in README.md, and a Node version requirement."
}
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay; echo "exit=$?"
cd <guest-path> && python3 -I - <<'EOF'
import json
p='.coldpass/report.json'
r=json.load(open(p))
r['deviations'][2]="The regenerated index.json differs from the shipped one in one tagline: templates/pink-script now shows 'DM Serif Display' (matching its template.json) where the shipped index.json said 'Instrument Serif'. The shipped index was stale; the build was not hand-edited."
json.dump(r,open(p,'w'),indent=2,ensure_ascii=False); open(p,'a').write('\n')
EOF
<env-var>=<guest-path> python3 -I <guest-path> --validate --replay | python3 -c "import json,sys;d=json.load(sys.stdin);print(d['valid'],d['problems'],d['replay']['status'])"; echo "exit=${PIPESTATUS[0]}"; ls -la .coldpass