FyAgent

The security policy maps local storage, remote data, imports, sync, deep links, proxy traffic, and credential flows. CI uses read-only permissions, disables persisted checkout credentials, pins third-party Actions to commits, and schedules CodeQL. The README promises previews before writes and post-save checks, while the policy requires informed consent for imported executable integrations. Deductions apply because the application operates with the user's filesystem authority, its proxy may bind beyond loopback, and the supplied source does not show every confirmation UI, secret-storage implementation, or network control. Backup and recovery documentation is referenced but not included, so rollback is adequate rather than complete. Project ancestry, CC Switch derivation, authorship, and license attribution are concrete enough for full source-attribution credit.

The README, package metadata, security policy, CI, and tests consistently describe the product, supported platforms, toolchains, and architecture. CI specifies version-contract, type, formatting, unit, browser, Rust, native credential, and architectural checks. Dependency setup is disciplined through a fixed pnpm version, frozen-lockfile installation, and toolchain verification, but several npm declarations use version ranges and builds depend on external downloads plus mise, Rust, uv, and managed Python. CI aggregates failed-step diagnostics, although the supplied material does not demonstrate end-user error messages or recovery guidance, so failure messaging is not fully evidenced.

The intended audience and scenarios are explicit, and Provider, MCP, and Prompt concepts are translated into user-oriented language. The feature matrix names concrete compatibility differences across AI applications, while the security policy thoroughly defines trust boundaries, inclusions, exclusions, and invalidation triggers. Installation and CI cover macOS plus Windows x64 and ARM64. Trigger precision loses a point because scanning, importing, saving, deep-link, and proxy triggers are described without the corresponding implementation needed to confirm that every automatic action is narrowly gated.

The README provides strong navigation, quick-start instructions, a feature table, FAQ entries, community routes, development commands, and multilingual manual links. Naming is stable, with the VibeKey-to-FyAgent transition explained. Licensing clearly separates PolyForm Noncommercial code, inherited CC Switch MIT portions, third-party material, and commercial authorization. Limitations are candid, including active development, latest-release-only security support, unavailable Windows formats, and proxy exposure. Deductions reflect that the full FAQ, installation manual, and release-note contents were not supplied. Maintenance channels and security timelines are clear, but the unknown publisher identity and reliance on a named individual account leave organizational continuity underdocumented.

The documented installation, scan, configuration, preview, and verification workflow is directly usable, and screenshots plus the feature matrix support practical multi-tool management. Centralizing models, Skills, MCP services, prompts, and memory plausibly adds value, but comparative evidence and user outcomes are absent. Local storage, the lack of a project cloud backend, and consolidation improve the benefit side; the noncommercial license, substantial development toolchain, external integrations, and backup burden prevent full cost-benefit credit.

Major claims are tied to named files, configuration fields, source locations, version v3.18.0, asset hashes, and test contracts. The README, security policy, package configuration, CI, and architectural tests provide substantial cross-source corroboration. The security policy explicitly separates checkable facts from its renderer scoping decision and lists conditions that invalidate the inference, earning full fact/inference-separation credit. This was not executed, so declared CI and tests are not evidence that this revision actually passed them.