cli

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Concern

  dependencies are not pinned.

  INSTALL_UNPINNED

  package.json, line 76

  hash-wasm

• Network

  Serious

  accepts a host from input, with no fixed list in this file.

  NETWORK_HOST_FROM_INPUT

  scripts/mg-registry-snapshot.mjs, line 51

  const r = await fetch(url, { signal: ac.signal });

  src/commands/doctor.ts, line 95

  const res = await fetch(`${apiBase}/user/get_user_info`, {

  src/commands/mg-text.ts, line 700

  const r = await fetch(url);

  Show more

  src/lib/chunk-upload.ts, line 186

  const res = await fetch(`${cfg.base}/base/file/upload/chunk/init`, {

  src/lib/chunk-upload.ts, line 223

  const res = await fetch(

  src/lib/chunk-upload.ts, line 245

  const res = await fetch(`${cfg.base}/base/file/upload/chunk/${uploadId}`, {

  src/lib/chunk-upload.ts, line 305

  const res = await fetch(

  src/lib/cloud.ts, line 120

  const res = await fetch(`${cfg.base}/task/${taskType}`, {

  src/lib/matrix.ts, line 884

  const res = await fetch(`${cfg.base}/user/get_user_info`, {

  src/lib/matrix.ts, line 922

  const res = await fetch(`${cfg.base}${ENDPOINTS[tier]}`, {

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/index.ts, line 60

  // 兼容 node：bun 会自动加载 .env，node 用 loadEnvFile 补上（无 .env 就忽略）。

  src/index.ts, line 61

  // 配置主源是 ~/.gitruck/config.json（gtrk init 写），.env 仅作可选覆盖。

  src/index.ts, line 65

  /* 没有 .env 文件，忽略 */

  Show more

  src/commands/doctor.ts, line 76

  const apiKey = (process.env.GITRUCK_API_KEY ?? uc.apiKey ?? "").trim();

  src/commands/doctor.ts, line 84

  ? `已配（${apiKey.slice(0, 6)}…，来源 ${process.env.GITRUCK_API_KEY ? "环境变量" : "gtrk init"}）`

  src/lib/composite-browser.ts, line 86

  return browserCandidates(process.platform, { ...env, GTRK_CHROME: undefined }).find((p) => existsSync(p)) ?? null;

  src/lib/config.ts, line 3

  /** 云端连接配置。优先级：环境变量 / .env（bun 自动加载）> `gtrk init` 写的持久配置 > 默认根地址。 */

  src/lib/config.ts, line 29

  const apiKey = (process.env.GITRUCK_API_KEY ?? readUserConfig().apiKey ?? "").trim();

  .env.example, line 1

  # 复制为 .env 后填写。bun 会自动加载 .env（无需 dotenv）。

  .gitignore, line 1

  node_modules/

  docs/reference.en.md, line 116

  `gtrk init` writes config to `~/.gitruck/config.json` (a unified user-level directory - config, caches, ffmpeg and show configs all live under `~/.gitruck/`). Resolution order: **e

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  src/commands/matrix.ts, line 1

  import { searchOnlineBroll, onlineSearchOutcome, type OnlineSearchRequest, type OnlineSearchSubmission } from "../lib/online-broll-client";

  src/data/mg-registry-catalog.json, line 1

  {

  src/lib/matrix-lay.ts, line 1

  /**

  Show more

  src/lib/convert/nv_templates.json, line 1

  {"meta":{"generatedBy":"tools/harvest_nv_templates.py","sources":{"nodes":{"NodeMediaAudio":"未命名 (2).nv","NodeGroup":"未命名 (2).nv","NodeMediaImage":"未命名 (2).nv","NodeMediaVideo":"未命

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 66399b082d16. dependencies are not pinned. accepts a host from input, with no fixed list in this file. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 27 Oct 2026

Read how this letter is chosen