Agentbox

README states the default sessionArgs grant only the store tools and that code editing/command execution require explicit opt-in, with the app never escalating on its own — positive least-privilege evidence (2). User confirmation is supported by an approval server, worker-permissions.json, and SECURITY.md naming 'an agent getting past an approval' as a threat, but no approval UI implementation is in evidence, so 2. Data-flow transparency is the strongest area: README enumerates all 19 PostHog events, the eight-field cap, the off switch, and the separate update check, pointing at shared/analytics-events.mts and crash-scrub — 3. Sensitive data handling has crash scrubbing and a no-contents/no-prompts claim, but package.json pulls @aws-sdk, @supabase/supabase-js and web-push while README never explains their role in a local-first design, deducted to 2. Dependency security: README admits residual Vite/Vitest/Tiptap advisories after npm audit, allowScripts approves node-pty and esbuild by name rather than version, and while security.yml adds semgrep and audit gates, the residual advisories and broad script approval are visible weaknesses — 1. External effects: the app spawns real coding agents, creates git worktrees and merges branches; README mentions Z undo and '1 merges' but no code evidence of a mandatory diff confirmation before merge or worktree cleanup — 1. Rollback: only Z undo and branch isolation are described; no store migration/rollback or failure-recovery mechanism is documented — 1. Source attribution: full GPL-3.0 LICENSE and author/repo in package.json, but publish target agentboxhq/agentbox-releases differs from savannahfeder/agentbox and the publisher is unverified — 1.

Self-consistency: README architecture (single write path in main/store, supervisor, mcp, briefs, tests) broadly matches package.json files/scripts, but README calls tests 'the documentation of record' while only a handful of test files appear here, including a sample fixture under .claude/skills, so suite scale cannot be confirmed — 2. Dependency availability: node-pty is optional and compiled, the terminal is dropped on Linux without make/C++, and the Electron binary downloads on first launcher start; README acknowledges these, which are real availability risks — 1. Failure messages: README mentions install success criteria, eighteen fixed reasons an agent could not start, and a per-start notice when the terminal is missing, but no concrete error copy or diagnostic implementation is in evidence — 1.

Audience and scenarios: README targets developers running many parallel agents, with inbox, priority and keyboard scenarios well described — 2. Capability boundaries: clearly states it drives Claude Code/Codex, requires them installed and signed in, no server and no account — 2. Trigger precision: when an agent returns to the inbox and how priority ordering works are described in prose, but rules like 'an agent cannot promote its own work' lack code corroboration and the done/stuck determination is not detailed — 1. Environment fit: covers signed/notarised macOS, Linux browser mode via xdg-open, and Node 22.18, but Windows is explicitly unsupported (electron-winstaller denied) — 2.

Information architecture: README is well structured (install, how it works, priorities, keys, config, privacy, build) but much content is folded into details blocks — 2. Install notes: three paths (Mac download, source build, npx browser) plus Linux dependency notes, fairly complete — 2. Naming stability: README admits zero/ZERO_ prefixes remain in code as 'load-bearing' legacy names, with the product name centralized in shared/product-name.mjs — 1. Examples and FAQ: screenshots and a key table exist, but no FAQ or troubleshooting section — 1. Known limitations: Linux terminal build deps, residual audit advisories and the macOS local-network prompt are mentioned, but limitations are not systematically listed — 1. License: full GPL-3.0 text in LICENSE and GPL-3.0-or-later in package.json, consistent — 3. Versioning/changelog: version 0.1.19 in package.json but no CHANGELOG — 1. Maintenance responsibility: SECURITY.md gives a private reporting channel and a one-week response promise, but the publisher is unverified and the release repo differs from the source repo, leaving the maintaining party unclear — 1.

Output usability: the inbox card, single-key answering and side-by-side diff are clearly aimed at reviewing agent output — 2. Marginal value: worktree isolation and a priority queue add real value over juggling terminals, but the core is still a wrapper over Claude Code/Codex, so the increment is bounded — 2. Cost benefit: free, open source and reusing an existing subscription helps, but Node 22.18, compiling node-pty, Electron footprint, residual dependency advisories and GPL copyleft are adoption costs — 1.

Claim traceability: README points at concrete files (shared/analytics-events.mts, crash-scrub.mts, main/store/work-items.mjs), but the evidence here is only README, LICENSE, SECURITY.md, package.json and two workflows, so those claims cannot be checked — 1. Cross-source corroboration: security.yml's semgrep/audit gates corroborate the README's dependency-advisory narrative, and publish-phone.yml reveals a phone-site and cloud directory the README never mentions, a narrative gap — 1. Fact/inference separation: the privacy event enumeration is specific and checkable, but assertions like 'tests are the documentation of record' and 'signed and notarised' lack supporting evidence, and package.json sets notarize to false, which sits in tension with the README's notarisation claim — 1.