zerostack

The permission system provides five modes (restrictive/readonly/guarded/standard/yolo) with per-tool patterns, session allowlists, and prompts for destructive commands, but the default standard mode auto-allows some bash commands and there is a --dangerously-skip-permissions flag that bypasses all checks, so points deducted. User confirmation exists (prompts, session allowlist, doom-loop detection) but not all operation confirmation flows are shown. Data flow transparency: docs state tool results are sent to the model provider, but not all data flow paths are detailed, so points deducted. Sensitive data handling: sandbox masks nine credential directories by default, but docs explicitly list gaps (e.g., ~/.netrc not masked, secret service reachable), so points deducted. Dependency security: Cargo.toml lists dependencies but no lockfile or audit evidence, so points deducted. External effects: sandbox and permission system limit bash tool, but docs explicitly state only the bash tool is sandboxed; other tools and MCP servers are not, so points deducted. Rollback: session save/resume and git worktree integration provide some rollback, but no file-level rollback mechanism, so points deducted. Source attribution: author and repo info clear, but publisher unverified, so points deducted.

Self-consistency: README, SECURITY.md, and Cargo.toml descriptions align, feature list matches docs, but some features marked experimental, so points deducted. Dependency availability: dependency versions specified in Cargo.toml, but no lockfile or audit evidence, so points deducted. Failure messages: docs describe error handling (e.g., sandbox-required refuses bash commands), but no concrete error message examples, so points deducted.

Audience and scenarios: targets developers, provides multiple usage scenarios (interactive, one-shot, loop, parallel), docs detailed, but target user group not explicit, so points deducted. Capability boundaries: permission modes and prompt system clearly define capabilities, but some features (loop, worktree) marked experimental, so points deducted. Trigger precision: slash commands and permission modes provide precise control, but not all commands documented in detail, so points deducted. Environment fit: supports multiple platforms (Linux, macOS, Windows untested), provides multiple install methods, but Windows support untested, so points deducted.

Information architecture: README structure clear with TOC and links, but some docs in docs/ not provided in this review, so points deducted. Install notes: multiple install methods (script, Cargo, Homebrew, Nix) detailed, but no Windows install instructions, so points deducted. Naming stability: version number clear (1.7.2), but no naming convention doc, so points deducted. Examples and FAQ: quick start and example commands provided, but no FAQ, so points deducted. Known limitations: SECURITY.md details sandbox limitations, but other feature limitations not explicit, so points deducted. License: GPL-3.0-only, file present, but no license compliance notes, so points deducted. Versioning/changelog: version number exists, but no CHANGELOG file, so points deducted. Maintenance responsibility: author and repo info clear, but no maintenance plan or contribution guide, so points deducted.

Output usability: TUI and one-shot mode provided, output format not detailed but basically usable, so points deducted. Marginal value: multi-provider support, permission system, sandbox etc. provide clear value, but no comparison with other tools, so points deducted. Cost-benefit: performance data (memory, CPU) provided, but no benchmark methodology, so points deducted.

Claim traceability: performance claims in README (e.g., memory footprint) lack measurement method or reproduction steps, so points deducted. Cross-source corroboration: blog post links provided, but not verified in this review, so points deducted. Fact/inference separation: docs distinguish facts and inferences (e.g., sandbox limitations), but some claims (e.g., performance) not clearly separated, so points deducted.