io.github.briangaoo/totem

What was checked

Plain notes from the hygiene checks.

• Permissions

  Pass

  No shell or command execution found, and no extra permission was declared.

• Install and update

  Serious

  install fetches a script from the network.

  INSTALL_REMOTE_SCRIPT

  src/cli/setup.ts, line 158

  ensure: () => ensureCli("flyctl", { brewPkg: "flyctl", scriptUrl: "https://fly.io/install.sh", manualHint: "brew install flyctl (or: curl -L https://fly.io/install.sh | sh)" }),

  src/cli/setup.ts, line 190

  le's official script instead?", { cmd: "curl https://sdk.cloud.google.com | bash", detail: "runs a remote install script

  src/cli/setup.ts, line 191

  await run("sh", ["-c", "curl https://sdk.cloud.google.com | bash"]);

  Show more

  src/cli/ui.ts, line 235

  if (opts.scriptUrl) methods.push(["sh", ["-c", `curl -fsSL ${opts.scriptUrl} | sh`]]);

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach api.prod.whoop.com. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  src/cli/update.ts, line 241

  if (d.url) console.log(` ${c.violet("4")} Verify: ${c.gray(`curl ${cleanUrl(d.url)}/health`)}`);

  src/scripts/cognito_bootstrap.ts, line 98

  if (r.status === 0) { console.log(` → done. Test: curl https://${t.app}.fly.dev/health`); return true; }

  src/scripts/cognito_bootstrap.ts, line 197

  const r = await fetch("https://api.prod.whoop.com/users-service/v2/bootstrap?apiVersion=7", {

  Show more

  src/whoop/client.ts, line 281

  response = await fetch(url.toString(), init);

  src/whoop/cognito.ts, line 61

  response = await fetch(ENDPOINT, {

  CONTRIBUTING.md, line 104

  - When changing the HTTP transport (`src/server-http.ts`) or auth model, add coverage to `tests/whoop/http_auth.test.ts`. The pattern is: boot a real server on an ephemeral port wi

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/server-http.ts, line 44

  const password = process.env.AUTH_PASSWORD ?? "";

  src/server.ts, line 21

  const ENV_PATH = resolve(__dirname, "../.env");

  src/server.ts, line 31

  const mode = (process.env.WHOOP_TOKEN_STORE ?? "envfile").toLowerCase();

  Show more

  src/cli/index.ts, line 289

  const envExists = existsSync(resolve(ROOT, ".env"));

  src/cli/index.ts, line 298

  row(".env", envExists ? c.green("present") : c.red("missing"));

  src/cli/setup.ts, line 21

  // ── .env helpers ────────────────────────────────────────────────────────────

  src/cli/setup.ts, line 23

  return resolve(root, ".env");

  src/cli/setup.ts, line 78

  const reuse = await promptYesNo("Found existing Whoop tokens in .env. Reuse them?", true);

  src/cli/setup.ts, line 81

  // Need email + password in .env for the auth (cognito_bootstrap) script.

  src/cli/setup.ts, line 89

  const pw = await promptRequired("Your Whoop account password (stored only in local .env, used once)", { hidden: true });

  src/scripts/cognito_bootstrap.ts, line 145

  let password = process.env.WHOOP_PASSWORD || readEnv("WHOOP_PASSWORD");

  src/scripts/cognito_bootstrap.ts, line 149

  const tokensOnly = process.env.WHOOP_AUTH_TOKENS_ONLY === "1";

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  a file was over the read cap and was not fully read.

  OBFUSCATION_FILE_OVER_READ_CAP

  tests/fixtures/cardio_details.json, line 1

  {"metadata":{"ai_context_metadata":{"is_wce_prefetch":true,"is_wce_enabled":true,"destination":{"screen":"AI_CHAT","parameters":{"fingerprint":"CHAT_WITH_AGENTCARDIO_DETAILS_5364dc

  tests/fixtures/cardio_details_nonstrength.json, line 1

  {

  tests/fixtures/deep_dive_sleep.json, line 1

  {"header_section":{"id":null,"title":"Last Night's Sleep","subtitle":"EDIT","subtitle_end":null,"cta":null,"cta_state":null,"icon":"PENCIL","style":"LARGE","destination":{"screen":

  Show more

  tests/fixtures/stress_bff.json, line 1

  {

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit f9ac7f18198c. install fetches a script from the network. can reach a host that is not written as a fixed address. can reach api.prod.whoop.com. The description does not name that host. reads a credential or environment file. a file was over the read cap and was not fully read.

Date and source

Date checked: 21 Oct 2026

Read how this letter is chosen