headroom

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  src/completion.ts, line 228

  "# Add to your profile: Invoke-Expression (headroom completion pwsh | Out-String)",

  src/engine/codexbar/install.ts, line 109

  await fs.rm(staging, { recursive: true, force: true });

  src/engine/codexbar/install.ts, line 120

  await fs.rm(archive, { force: true });

  Show more

  src/engine/codexbar/install.ts, line 126

  await fs.rm(root, { recursive: true, force: true });

  src/engine/codexbar/install.ts, line 129

  await fs.rm(staging, { recursive: true, force: true });

  src/engine/codexbar/install.ts, line 157

  await fs.rm(staging, { recursive: true, force: true });

  src/engine/codexbar/install.ts, line 167

  await fs.rm(archive, { force: true });

  src/engine/codexbar/install.ts, line 174

  await fs.rm(root, { recursive: true, force: true });

  src/engine/codexbar/install.ts, line 177

  await fs.rm(staging, { recursive: true, force: true });

  docs/quickstart.md, line 463

  Invoke-Expression (headroom completion pwsh | Out-String)

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  bin/headroom.js, line 68

  * dispatcher for the global fetch() from the *initial* process environment,

  src/security.ts, line 76

  * global fetch (or a test double standing in for it): it re-checks the

  src/adapters/codex.ts, line 63

  // one window after this fetch (rounded to seconds). This is useful provider

  Show more

  src/engine/codexbar/install.ts, line 70

  const response = await fetch(`https://api.github.com/repos/${lock.repository}/releases/tags/${lock.tag}`, {

  src/engine/codexbar/install.ts, line 99

  const response = await fetch(upstream.browser_download_url, { headers: { "User-Agent": "headroomq" } });

  src/engine/codexbar/install.ts, line 150

  const response = await fetch(url, { headers: { "User-Agent": "headroomq" } });

  engine/Sources/HeadroomEngine/AntigravityRecord.swift, line 372

  let status = try await AntigravityStatusProbe(timeout: min(8, remaining)).fetch()

  engine/Sources/HeadroomEngine/AntigravityRecord.swift, line 397

  // here. Record mode only calls `AntigravityStatusProbe.fetch()`, which

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  bin/headroom.js, line 78

  const output = { ...env };

  scripts/release-check.sh, line 48

  -iname '*.env' -o -iname '.env.*' -o -iname '*.pem' -o -iname '*.key' \

  src/cli.ts, line 2106

  console.log("Nothing to grant on this platform: the Claude login is read from <config dir>/.credentials.json. Run `headroom doctor` to check it, or `claude` to log in.");

  Show more

  src/paths.ts, line 185

  const filename = vendor === "claude" ? ".credentials.json"

  src/security.ts, line 33

  const output = { ...env };

  src/update.ts, line 363

  const serviceEnv = { ...env, HEADROOM_HOME: home };

  src/adapters/google-code-assist.ts, line 194

  const envClientSecret = asString(process.env.GEMINI_OAUTH_CLIENT_SECRET);

  .gitignore, line 12

  # Local secrets and keys: never committed, read from the OS secret store at runtime

  .gitignore, line 13

  .env

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Concern

  contains an encoded blob in a file that should be readable.

  OBFUSCATION_ENCODED_BLOB

  src/browser-report-fonts.ts, line 7

  port const SOURCE_SERIF_WOFF2_BASE64 = "d09GMgABAAAAACnYABEAAAAAZgAAACl1AAQBBgAAAAAAAAAAAAAAAAAAAAAAAAAAGUYaFhvFKhyBKgZgP1NUQVReAIF+EQgK8TjbNAE2AiQDhBALggoABCAFhWoHIAwHG8JYRQdixjgA

  src/browser-report-fonts.ts, line 9

  xport const SPLINE_MONO_WOFF2_BASE64 = "d09GMgABAAAAAD1IABMAAAAAYpAAADzhAAEBBgAAAAAAAAAAAAAAAAAAAAAAAAAAGhwbIBwqP0hWQVIvBmA/U1RBVGQnGgCBbi9CEQgKyGy6WzDpAAE2AiQDgWQLgWQABCAFhk4HIBtR

  src/store.ts, line 1

  import { antigravityModelCatalog, antigravityPayloadFromEngineRows, classifyAntigravityLanes } from "./antigravity-lanes.js";

  Show more

  test/fixtures/json-contract/cli-fill.json, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 538dd668ff8f. can delete files. can reach a host that is not written as a fixed address. can reach api.github.com. The description does not name that host. reads a credential or environment file. contains an encoded blob in a file that should be readable.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen