Cubicle Crew

least_privilege: server binds 127.0.0.1 with Host/Origin checks, but the installed app auto-starts at login and the optional phone view opens a LAN port, widening the surface — scored 1. user_confirmation: Allow/Deny prompts require explicit opt-in with a 45s fallback to terminal, and update install requires a click — 2. data_flow_transparency: docs/security.md enumerates read fields, written files and network calls in detail — 3. sensitive_data_handling: only truncated 60-char fields are kept and prompts/outputs are not read, but bubbles still show commands/paths unless hidden manually — 2. dependency_security: only ws and electron, but no lockfile evidence, audit or signing — 1. external_effects: weather and update checks are off by default, yet auto-start at login is a default external effect — 2. rollback: settings.json is backed up before edits and save.json is atomic with .bak, but no version rollback guidance — 2. source_attribution: MIT and author are clear, but publisher is unverified and builds are unsigned — 1.

self_consistency: README and security.md agree on ports, read paths and the permission hook — 2. dependency_availability: engines declares Node>=18 but no lockfile evidence and Electron 44 is not pinned — 1. failure_messages: only port fallback and npm run debug are mentioned; no systematic error-handling description — 1.

audience_and_scenarios: targets users running many Claude Code/Codex/Gemini/OpenCode sessions; scenario is clear — 2. capability_boundaries: read-only local logs, view-only phone mode, no permission prompts for non-Claude sessions — boundaries are explicit — 2. trigger_precision: state mapping relies on an 8-second silence heuristic and an unofficial JSONL format — 1. environment_fit: Windows/macOS/Linux/WSL and browser supported, but Linux lacks jump-to-terminal and login start — 2.

information_architecture: README is well-structured with clear sections and doc links — 3. install_notes: npx, source, per-platform installs and unsigned warnings are covered — 3. naming_stability: package and bin names are stable, but internal pixel-office paths diverge from the product name — 2. examples_and_faq: demo URLs, curl examples and a comparison exist, but no formal FAQ — 2. known_limitations: a dedicated section lists limitations — 2. license: full MIT text matches package.json — 3. versioning_changelog: semver version present but no CHANGELOG — 1. maintenance_responsibility: personal side project, unverified publisher, no governance statement — 1.

output_usability: visual state, stats export and snapshot sharing are practical, but depend on canvas and local setup — 2. marginal_value: addresses multi-session observability, though it is an enhancement rather than core tooling — 2. cost_benefit: single dependency, offline, zero-config, but Electron footprint and gamification are redundant for some users — 2.

claim_traceability: most README claims map to security.md and package.json — 2. cross_source_corroboration: README, security.md, package.json and the workflow corroborate ports, dependencies and builds — 2. fact_inference_separation: some behaviour claims (token economy, heuristic linking) lack code evidence and read as inference — 1.