Mirafold

The evidence thoroughly describes loopback binding, per-launch authentication tokens, workspace path jails, read-only browsing, native engine permission prompts, pre-spawn folder trust confirmation, constrained project environment variables, sandboxed artifacts, and least-privilege CI permissions. External effects are distinguished through explicit !/!! syntax, pairing actions, and permission UI. Data flows for provider credentials, the remote relay, checkpoints, command-output handoff, and configured endpoints are unusually explicit. Sensitive-data handling loses a point because disclosed residuals remain: ! output is persisted verbatim, checkpoints may contain sensitive endpoint URLs, credentials can be sent to an operator-selected plaintext non-loopback endpoint after only a warning, and artifacts retain low-bandwidth ICE or preconnect leakage channels. Dependency and release controls include frozen installs, commit-pinned Actions, signed tags, hash checks, OIDC trusted publishing, and separation of install and publish credentials; however, runtime dependencies generally use version ranges and the supplied evidence shows no continuous vulnerability scan or audit result, so dependency_security is not full. Stop controls, atomic checkpoints, and validated recovery provide partial recovery, but there is no general rollback for filesystem or shell effects already performed by an agent. Authorship, licensing, third-party attribution, trademarks, and non-affiliation are clear; unknown enterprise publisher identity is not treated as suspicious.

The README, package metadata, security policy, and workflows are highly consistent about Node requirements, commands, ports, test tiers, and runtime architecture. They also specify visible failures for truncation, replay gaps, missing backends, unsafe configurations, and inconsistent releases. Dependency availability loses a point because normal operation relies on Node.js 22, separately installed agent binaries and authentication; remote functionality additionally depends on paid entitlement, relay availability, and a licensing backend, while one integration check deliberately tracks a sibling repository's moving default branch. The scripted demo mitigates the no-backend case but does not remove these dependencies.

The source covers terminal-agent users, parallel sessions, desktop and phone access, local and hosted open models, developers, and adapter authors. Boundaries clearly separate the Mirafold shell, native agents, sandboxed artifacts, file browsing, the real PTY, remote viewports, and the demo backend. Explicit ! and !! prefixes, the pairing control, first-use folder trust, and named environment settings give triggers precise semantics. Environment fit loses a point because Node.js 22 is mandatory, support is limited to the named agents and documented model interfaces, and some behavior depends on local binaries, browsers, OS folder pickers, or a paid remote service.

The README has strong installation, first-run, development, architecture, verification, and documentation sections. Product, protocol, session, and command naming is consistent and supported by references to a glossary and normative adapter specification. The full MIT text, package metadata, third-party licensing statement, and trademark notice are present. Known limitations and accepted trust decisions are exceptionally detailed. examples_and_faq loses a point because there are useful command examples and operational guidance but no structured FAQ or broad troubleshooting catalogue in the supplied material. versioning_changelog loses a point because version 0.10.0, a release process, and plan/archive references are visible, but no actual changelog or migration history is supplied. Maintenance responsibility is established through a named author, issue tracker, security contact and response target, supported-version policy, and documented release ownership; the unverified publisher identity limits identity assurance but does not erase those repository-level signals.

The described interface emphasizes readable streaming output, diffs, tables, charts, tasks, session overviews, expandable detail, honest truncation markers, and multi-viewport supervision, providing strong static support for output usability. It adds session management, generative UI, read-only review, and remote viewing while preserving existing terminal agents and permission models, giving clear marginal value. Cost_benefit loses a point because setup spans Node and multiple external backends, the product intentionally exposes full shell-level capability, its security boundary is complex, and remote access requires a Pro entitlement; the evidence does not quantify resource consumption or productivity gains.

Material claims are commonly tied to named files, symbols, test tiers, audit dates, failure conditions, or workflow steps. README verification commands are corroborated by package scripts and CI/release configuration, while licensing is independently supported by the license file and package metadata. The security policy expressly separates tested behavior, live probes, manual rechecks, design decisions, accepted residuals, and facts that specific test tiers cannot preserve, earning full fact-inference separation. Confidence nevertheless remains low because this assessment uses only the supplied static excerpts and did not execute commands or independently validate claimed test outcomes.