Lody

CI explicitly uses read-only contents permission and disables credential persistence. The README says machines remain private until shared, supports configured permission modes, and exposes permission requests, transcripts, status, files, and diffs across clients. Archive/restore, Git worktrees, and session forks provide partial isolation and recovery. Deductions apply because destinations, retention, encryption, and deletion behavior for cloud/CRDT synchronization, attachments, transcripts, repository content, and credentials are not specified; SECURITY.md governs vulnerability reports rather than providing a complete runtime-data policy. Dependency installation uses a pinned pnpm release, integrity digest, and frozen lockfile, but no audit, SBOM, or vulnerability-remediation evidence is supplied. The author label, project site, repository identity, and Apache-2.0 terms provide attribution, though the publisher is unverified and the license appendix does not identify a concrete copyright holder.

The README, package scripts, CI workflows, and ACP tests consistently describe the product structure, model capabilities, session history, and steering protocol. Tests also cover malformed metadata and fail-closed configuration mismatch behavior, supporting full self-consistency. Dependencies have version constraints, a locked installation path, and an explicit Node range, but the product relies on external agents, ACP, app stores, and optional cloud services without documented degradation strategies. CI preserves failure artifacts and reconciles regression issues, while evidence for end-user runtime error messages, retries, and offline failure handling remains limited.

The sources clearly address team sharing, remote dispatch, parallel development, review, and visual-feedback scenarios across desktop, mobile, web, CLI, multiple machines, and several ACP agents. Agent Roles, model/permission/instruction presets, and capability-normalization tests show meaningful configurability. Deductions apply because compatibility remains constrained by ACP and specific adapters, with no complete support matrix, unavailable-capability behavior, or comprehensive permission boundaries. Dispatch and steering have explicit session/configuration semantics, but automatic triggers, scheduling conflicts, and false-trigger prevention are not comprehensively documented.

The README clearly organizes capabilities, connection, CLI use, coordination, repository layout, and releases, with stable workspace/session/ACP terminology. It provides an npx quick start and concrete CLI examples plus links to fuller documentation and CONTRIBUTING, but the supplied evidence lacks complete development-install instructions and an FAQ. It candidly states that full local-first operation is unfinished and documents release/CI constraints, though there is no systematic limitations catalog. The complete Apache-2.0 text earns full license credit. Stable tags and generated release notes establish a versioning process, but no actual changelog is included. Security reporting, community channels, and maintainer actions are identified, while named maintainers and support commitments are absent.

Complete conversations, runtime state, files, diffs, permission requests, terminal access, previews, and cross-device controls make agent output directly usable in collaboration and code review. Multi-session coordination, worktree isolation, and reuse of existing agents add clear value over exchanging screenshots or logs. Cost-benefit is deducted because the source only mentions reusing subscriptions and viewing token, quota, and resource usage; it does not quantify deployment, cloud synchronization, always-online machine, mobile, maintenance, or scale costs.

Core structure and selected behaviors are traceable across the README, package manifest, CI configuration, and tests for history merging, capability normalization, and steering. Roadmap language is generally separated from current behavior with terms such as “plan,” “goal,” and “moving toward.” Deductions apply because many product-experience, security, and cross-device synchronization claims remain README assertions; the supplied code does not cover authentication, storage, network transfer, permission execution, or recovery implementation, and no independent source or release artifact corroborates them.