io.github.Yuuqq/jules-dispatch

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  requests shell access. No manifest field names shell or command execution.

  PERMISSION_SHELL_UNDECLARED

  .planning/milestones/v2-phases/phase-15/15-01-PLAN.md, line 158

  Use `vi.stubGlobal('fetch', ...)` pattern from client.test.ts. For npm check, mock `child_process.execSync`. For task file, use a temp file or mock `readFileSync`.

  tasks/resume-i18n/11-playwright-e2e.yaml, line 32

  proc = subprocess.Popen(

  tasks/slide-skill-uat/v23-uat.yaml, line 383

  result = subprocess.run(['python', '-c', '''

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address. can reach www.roots.gov.sg. The description does not name that host.

  NETWORK_NO_FIXED_HOST NETWORK_UNNAMED_HOST

  src/client.ts, line 54

  res = await timed(`${method} ${path}`, () => fetch(url, {

  src/planner.ts, line 245

  resp = await fetch(`${cfg.baseUrl}/chat/completions`, {

  .planning/codebase/CONCERNS.md, line 37

  - **Location:** `client.ts:34` - `fetch()` call

  Show more

  .planning/codebase/CONCERNS.md, line 38

  - **Description:** Retry logic only triggers on HTTP 429/5xx status codes. Network-level failures (DNS errors, connection refused, timeouts) cause `fetch()` to throw, which bypasse

  .planning/codebase/INTEGRATIONS.md, line 16

  - Native `fetch()` - no HTTP library dependency

  .planning/milestones/v1-MILESTONE-AUDIT.md, line 54

  | MCP-07 | 6 | satisfied | jules_interact parallel fetch (session + plan + activities) |

  .planning/milestones/v1-phases/phase-02/02-PLAN.md, line 39

  const res = await timed(`${method} ${path}`, () => fetch(url, { ...options, headers }));

  .planning/milestones/v1-phases/phase-02/02-PLAN.md, line 52

  res = await timed(`${method} ${path}`, () => fetch(url, { ...options, headers }));

  tasks/resume-i18n/20-dockerfile.yaml, line 59

  CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8080/_stcore/health')" || exit 1

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_ENV_READ SECRETS_PATH_DOTENV

  src/cli.ts, line 39

  .option('-p, --project <dir>', 'project directory with .env', '.')

  src/cli.ts, line 567

  console.log(chalk.yellow(`Backed up existing .env to ${result.backupPath ?? '.env.backup'}`));

  src/config.ts, line 14

  const envPath = resolve(projectDir, '.env');

  Show more

  src/config.ts, line 27

  const apiKey = (options.apiKeyOverride ?? process.env.JULES_API_KEY ?? '').trim();

  src/config.ts, line 29

  const msg = 'JULES_API_KEY is required. Set it in .env, pass --api-key, or set the JULES_API_KEY environment variable.';

  src/config.ts, line 34

  console.error('Fix: run `jules-dispatch init`, or set JULES_API_KEY in .env / the environment.');

  src/dispatcher.ts, line 45

  error: 'No source configured. Set JULES_DEFAULT_SOURCE in .env or add "source" to the task file.',

  src/doctor.ts, line 41

  const apiKey = (apiKeyOverride ?? process.env.JULES_API_KEY ?? '').trim();

  src/doctor.ts, line 45

  return { name: 'api_key', status: 'fail', message: 'JULES_API_KEY not set (set in .env, environment, or pass --api-key)' };

  src/errors.ts, line 41

  fix: 'Run `jules-dispatch init` or check `JULES_API_KEY` in `.env`',

  src/planner.ts, line 52

  process.env.LLM_API_KEY,

  src/planner.ts, line 53

  process.env.OPENAI_API_KEY,

  src/planner.ts, line 54

  process.env.OPENROUTER_API_KEY,

  src/planner.ts, line 55

  process.env.AI_INTEGRATIONS_OPENROUTER_API_KEY,

  src/planner.ts, line 101

  process.env.LLM_API_KEY,

  src/planner.ts, line 102

  process.env.OPENAI_API_KEY,

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Pass

  No encoded or minified payload found.

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 0bb49cb59a00. requests shell access. No manifest field names shell or command execution. can reach a host that is not written as a fixed address. can reach www.roots.gov.sg. The description does not name that host. reads a credential or environment file.

Date and source

Date checked: 20 Oct 2026

Read how this letter is chosen