calame

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files. requests shell access. No manifest field names shell or command execution.

  PERMISSION_SHELL_UNDECLARED PERMISSION_DELETE_FILES

  ee/rag-core/src/routes/rag-upload.ts, line 217

  await fs.unlink(file.filepath).catch(() => undefined);

  packages/cli/src/tunnel/manager.ts, line 66

  /** Injectable child-process spawn - defaults to `child_process.spawn`. Tests supply a fake. */

• Install and update

  Concern

  runs a script at install time.

  INSTALL_LIFECYCLE_HOOK

  package.json, line 24

  prepare

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  ee/rag-connectors/src/http.ts, line 254

  const response = await globalThis.fetch(url, {

  ee/rag-core/src/embeddings/openai-client.ts, line 144

  response = await fetch(url, {

  ee/rag-core/src/search/hybrid-search.ts, line 227

  // We over-fetch (candidates * 3) when folder/fileType filters are active

  Show more

  ee/rag-core/src/search/hybrid-search.ts, line 440

  // The over-fetch (caller passed candidatesPerMethod * 3 when filters

  ee/rag-core/src/search/reranker.ts, line 190

  response = await fetch(this.#baseUrl, {

  ee/rag-core/src/web/api.ts, line 131

  const res = await fetch(url, withTenantHeader(init));

  ee/rag-core/src/web/api.ts, line 137

  const res = await fetch(url, withTenantHeader({ ...init, signal: controller.signal }));

  ee/rag-core/src/web/api.ts, line 180

  const res = await fetch(url, withTenantHeader({ method: 'DELETE' }));

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  apps/desktop/src-tauri/src/server.rs, line 114

  .env("CALAME_PACKAGED", "1")

  apps/desktop/src-tauri/src/server.rs, line 115

  .env("CALAME_WEB_DIST", web_dist)

  ee/rag-core/src/fs-write.ts, line 164

  /^(\.env.*|.*credentials?.*|.*secrets?.*|.*\.(pem|key|p12|pfx|keystore)|id_(rsa|dsa|ecdsa|ed25519).*|\.npmrc|\.netrc|authorized_keys|passwd|shadow)$/i;

  Show more

  apps/desktop/src-tauri/src/server.rs, line 116

  .env("CALAME_VERSION", version)

  apps/desktop/src-tauri/src/server.rs, line 117

  .env("CALAME_CLOUDFLARED_PATH", cloudflared_path)

  apps/desktop/src-tauri/src/server.rs, line 118

  .env("CALAME_LOCAL_EMBEDDING_MODEL_DIR", local_embedding_model_dir);

  ee/rag-connectors/src/local-folder.ts, line 75

  * Default `false`: dotfiles are noise for a knowledge base (`.env`,

  ee/rag-core/src/web/onboarding-strings.ts, line 170

  'Fichiers et dossiers commençant par un point (.env, .cache…), exclus par défaut. Les ' +

  packages/cli/src/crypto.ts, line 81

  return process.env.CALAME_SECRET_KEY ?? null;

  packages/cli/src/crypto.ts, line 196

  * Derive a 32-byte AES key from `process.env.CALAME_ENCRYPTION_KEY`.

  packages/cli/src/crypto.ts, line 208

  const raw = process.env.CALAME_ENCRYPTION_KEY;

  packages/cli/src/index.ts, line 82

  process.env.CALAME_SECRET_KEY = secret;

  packages/cli/src/rag-runtime.ts, line 178

  const monthlyTokenCap = ragCore.parseMonthlyCapEnv(process.env['CALAME_RAG_MONTHLY_TOKEN_CAP']);

  packages/cli/src/secrets.ts, line 54

  const accessKey = process.env.AWS_ACCESS_KEY_ID;

  packages/cli/src/secrets.ts, line 55

  const secretKey = process.env.AWS_SECRET_ACCESS_KEY;

  packages/cli/src/session.ts, line 95

  return process.env.CALAME_ADMIN_PASSWORD ?? null;

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read. the file cap was reached before every file was read.

  OBFUSCATION_FILE_OVER_READ_CAP OBFUSCATION_FILE_CAP_REACHED

  pnpm-lock.yaml, line 1

  lockfileVersion: '9.0'

  apps/desktop/src-tauri/icons/icon.icns, line 1

  icns�Eic10��PNG

  ee/rag-core/src/embeddings/__tests__/fixtures/embeddinggemma-reference-vectors.json, line 1

  {"repo": "onnx-community/embeddinggemma-300m-ONNX", "revision": "5090578d9565bb06545b4552f76e6bc2c93e4a66", "output_tensor_used": "sentence_embedding", "dimensions": 768, "docs": [

  Show more

  packages/cli/src/rag/__tests__/embeddings.test.ts, line 1

  import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit bc847933d150. can delete files. requests shell access. No manifest field names shell or command execution. runs a script at install time. can reach a host that is not written as a fixed address. reads a credential or environment file. a file was over the read cap and was not fully read. the file cap was reached before every file was read.

Date and source

Date checked: 23 Oct 2026

Read how this letter is chosen