github TypeScript re-analysis due

hjqcan/tachikoma

A research-alpha multi-agent coding runtime with orchestrator-worker planning, checkpoint/resume, MCP tools, isolated execution, and observability.

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools

transport — counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit dcef606 · analyzer v31 · 2w ago

code evidence vHEAD · github-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 29

fs (weak) hjqcan-tachikoma-dcef606/packages/cli/tests/package/cli-dist.test.ts :2 import { mkdtemp, rm } from 'node:fs/promises';
fs hjqcan-tachikoma-dcef606/packages/core/evals/chat-quality.ts :16 import { existsSync } from 'node:fs';
fs hjqcan-tachikoma-dcef606/packages/core/src/chat/chat-engine.ts :12 import { mkdir, readdir, realpath, stat, unlink } from 'node:fs/promises';
fs hjqcan-tachikoma-dcef606/packages/core/src/chat/workspace-guard.ts :11 import { realpathSync } from 'node:fs';
fs (weak) hjqcan-tachikoma-dcef606/packages/core/tests/chat-approvals.test.ts :10 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
fs (weak) hjqcan-tachikoma-dcef606/packages/core/tests/chat-tools.test.ts :11 import { mkdtemp, realpath, rm, symlink, writeFile } from 'node:fs/promises';
fs (weak) hjqcan-tachikoma-dcef606/packages/core/tests/helpers.ts :4 import { mkdtemp, rm } from 'node:fs/promises';
fs (weak) hjqcan-tachikoma-dcef606/packages/core/tests/live/chat-live.test.ts :2 import { copyFile, mkdtemp, rm, writeFile } from 'node:fs/promises';
fs (weak) hjqcan-tachikoma-dcef606/packages/core/tests/models-config.test.ts :2 import { mkdtemp, rm, writeFile } from 'node:fs/promises';
fs (weak) hjqcan-tachikoma-dcef606/packages/core/tests/session-manager.test.ts :3 import { readdir, readFile, writeFile } from 'node:fs/promises';

shell (weak) hjqcan-tachikoma-dcef606/packages/cli/tests/package/cli-dist.test.ts :44 const child = Bun.spawn(command, {
shell (weak) hjqcan-tachikoma-dcef606/packages/cli/tests/process.test.ts :10 const process = Bun.spawn([Bun.which('bun') ?? 'bun', entrypoint, ...args], {

net (weak) hjqcan-tachikoma-dcef606/packages/core/tests/offline-boundary.test.ts :11 await expect(globalThis.fetch('https://network-access-is-forbidden.invalid')).rejects.toThrow(

secrets (weak) hjqcan-tachikoma-dcef606/packages/core/tests/chat-session.test.ts :99 const previousKey = process.env.OPENAI_API_KEY;
secrets (weak) hjqcan-tachikoma-dcef606/packages/core/tests/memory.test.ts :27 const previousOpenAiKey = process.env.OPENAI_API_KEY;
secrets (weak) hjqcan-tachikoma-dcef606/packages/core/tests/models-config.test.ts :11 const previousKey = process.env.CUSTOM_GATEWAY_KEY;
secrets (weak) hjqcan-tachikoma-dcef606/packages/core/tests/offline-boundary.test.ts :6 expect(process.env.OPENAI_API_KEY).toBe('poison-offline-credential');
secrets (weak) hjqcan-tachikoma-dcef606/packages/core/tests/offline-guard.ts :3 process.env.OPENAI_API_KEY = 'poison-offline-credential';