PandaCode

approvals.md maps permission modes per harness in detail and states unsupported modes fail the turn rather than silently downgrading, which is a plus; however new tasks default to Full access (bypassPermissions / danger-full-access / yolo), a permissive default, so least_privilege is 1. User confirmation exists (approval bar, Approve all, structured questions still require answers), scoring 2. The README privacy section enumerates network requests, frequency and payloads, so data_flow_transparency is 3. Sensitive data handling documents 0600 secrets.json, Secret Service/Credential Manager, and log parsing that discards prompt/reply text, but plaintext macOS storage and copying logins to cloud machines leave residual risk, scoring 2. Dependencies include caret-ranged packages and an xlsx tarball fetched from a third-party CDN, and SBOM scanning is continue-on-error and non-blocking in release.yml, so dependency_security is 1. External effects (deploys, cloud sandboxes, bots, remote relay) are described as approval-gated, but Full access defaults and auto-update restarts are real external impact, scoring 1. Rollback has turn changes, worktrees, Merge into main and rewind, but no described undo for executed external actions (deploys, cloud machines), scoring 1. Source attribution: the LICENSE requires forks to state provenance and docs cite upstream projects and protocol docs, but publisher identity is unverified, scoring 2.

Internal consistency is decent (approvals, agent-usage and README corroborate each other), but the README is truncated mid-file and some behavior descriptions depend on source not provided, so self_consistency is 2. Dependency availability: heavy reliance on external CLIs, cloud vendors, a relay service and a CDN, any of which can break features, with no lock/verification description, scoring 1. Failure messages: docs repeatedly describe explicit failure states (unsupported mode fails, unavailable quota shown as unavailable not zero, download verification failure), scoring 2.

Audience and scenarios are very broad (many harnesses, teams, bots, mobile, headless server, cloud sandboxes), scoring 3. Capability boundaries are documented (which harness supports which modes, platforms without ONNX routing, Cline lacking a unified telemetry switch) but scattered across docs without a consolidated statement, scoring 2. Trigger precision: global shortcut, schedules, bot triggers and automatic teams create a wide trigger surface with no systematic conflict/priority documentation, scoring 1. Environment fit lists minimum platform versions and Wayland/FUSE caveats, but unsigned builds and platform differences add friction, scoring 2.

Information architecture: the README is long and sectioned with a rich docs directory, but the README is truncated in the provided file so structural completeness cannot be fully confirmed, scoring 2. Install notes are very thorough (per-platform files, checksums, Homebrew, npx, Gatekeeper/SmartScreen handling), scoring 3. Naming stability: version 0.3.98 is pre-1.0 with rapidly expanding features, so naming/behavior stability evidence is thin, scoring 1. Examples and FAQ: screenshots, doc links and some operational guidance exist, but there is no consolidated FAQ, scoring 2. Known limitations have dedicated coverage (unsigned builds, platform differences, telemetry switch scope), scoring 2. License: a custom PandaCode License (MIT plus attribution clause) marked SEE LICENSE in package.json, non-standard, consistent with NOASSERTION metadata, scoring 2. Versioning/changelog: a releases/X.Y.Z.md mechanism and release workflow exist, but no CHANGELOG content is provided in the repository, scoring 1. Maintenance responsibility: SECURITY.md states only the latest release gets fixes and offers a private reporting channel, but publisher identity is unverified and there is no governance or maintainer statement, scoring 1.

Output usability: turn cards, diffs, approval bar and cost panel are designed for real use, but all are documentation claims without execution verification, scoring 2. Marginal value: consolidating many harnesses with review/deploy flows is genuinely useful, but the space is crowded and feature stacking may add complexity, scoring 2. Cost benefit: the very broad feature surface implies a large attack surface and maintenance burden, and Full access defaults raise risk cost, scoring 1.

claim_traceability: docs cite upstream protocols, source paths and specific files (e.g. providers.rs, usage_ledger/), giving decent traceability, but key claims lack reproducible steps, scoring 2. cross_source_corroboration: README, approvals, agent-usage, CI workflows and test files corroborate each other (e.g. crypto tests matching the Rust implementation byte-for-byte, CI pinned SHAs), scoring 2. fact_inference_separation: docs distinguish verified behavior from inference (e.g. Kimi mode descriptions lagging, Codex dedup based on one check), but some performance numbers and security claims lack method detail, scoring 2.