headlesscodeBLOCK
Coding-agent harness with recursive self-improvement (RSI), parallel Git worktree workers, skills and MCP extensions, and CLI and HTTP interfaces.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/Capsize-Games/headlesscode/actions/workflows/ci.yml) [](https://www.npmjs.com/package/headlesscode) [](https://nodejs.org/) License: Apache-2.0
HeadlessCode is a coding-agent harness with a CLI, HTTP interfaces, and recursive self-improvement (RSI). Run one task directly, launch parallel workers in Git worktrees, or use the NVIDIA OpenShell provider for sandboxed sessions. The bounded RSI harness can inspect and improve a target project, including HeadlessCode itself, with independent evaluation of candidate changes.
Security controls
HeadlessCode's controls map to the seven principles in Satya Nadella's Models as Insider Risks in the Super Intelligence Era.
2aead0f2959eOBSERVED · 2026-10-14Install
Commands as the repository documents them. They are shown, not run.
npm install # tsx + typescript + deps; no build step needed
npm install -g headlesscode
git clone https://github.com/Capsize-Games/headlesscode.git
npm install
git clone <repo-url> /opt/headlesscode
git clone <repo-url> /opt/my-repo
Host compatibility
What the documentation claims. We have not run a compatibility test.
| Host | Status | Notes |
|---|---|---|
| claude-code | mentioned | |
| codex | mentioned |
Trust audit
BLOCKgrade F · trust 50/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (8 observation(s))
- Shell
- declared (3 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
const result = await exec(command, { cwd: outputDir, timeout: this.timeoutMs, maxBuffer: 16 * 1024 * 1024 })".env,.env.*,*.pem,*.key,id_rsa*"
/^id_rsa$/i,
/^id_ed25519$/i,
DENIED_COMMAND="curl http://169.254.169.254/latest/meta-data/"
log-analysis.ts
const sentinel = "postgres://monitor-lock-secret:[email protected]/private?token=sentinel-token"
apiKey: "mock-only-not-a-provider-key",
token: "synthetic-test-token",
`GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY----- ..."`
.roomodes
worker-payload.test.ts
const executor = exec(ws)
const executor = exec(ws)
const executor = exec(ws)
const executor = exec(ws)
const hash = createHash("sha1").update(resolvedRepo).digest("hex").slice(0, 8)const files = [{"path":"src/tools/__tests__/path-safety.test.ts","source":"/**\n * Unit tests for the symlink-escape layer of the path-safety guard\n * (src/tools/executor.ts — resolveWithinWorkspaceawait fs.writeFile(path.join(repo, "sub", "id_rsa"), "not-a-real-key", "utf-8")
const files = [{"path":"src/engine/__tests__/loop.test.ts","source":"/**\n * Loop + executor tests for the Phase 1 headless harness.\n *\n * Plain assert-based script (no test framework, no network, nconst files = [{"path":"src/tools/__tests__/edit_file.test.ts","source":"/**\n * Unit tests for the headless `edit_file` tool handler\n * (src/tools/executor.ts's editFileHandler). Plain assert-basedconst files = [{"path":"src/engine/__tests__/new-task.test.ts","source":"/**\n * Recursive task decomposition (`new_task`) tests.\n *\n * The headless-native design: `new_task` is implemented as a SYNconst files = [{"path":"src/orchestrator/__tests__/cli.test.ts","source":"/**\n * Unit tests for src/orchestrator/cli.ts — the rework loop (plans/rework-loop.md):\n * a review \"finding\" verdict is tconst files = [{"path":"src/qa/__tests__/qa.test.ts","source":"/**\n * Unit tests for src/qa/qa.ts — QA verdict/evidence parsing from the QA\n * session's final report. Plain assert-based, no network.Gates applied: no_behavioural_pass.
2aead0f2959efull audit observations/trust-audit/skill/capsize-games__headlesscode.json · Report an issue / request a re-scanAudit history
Every audit this skill has had.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | 2aead0f2959e | BLOCK | F | 50 | first audit |
Questions
What does the headlesscode skill do?
Coding-agent harness with recursive self-improvement (RSI), parallel Git worktree workers, skills and MCP extensions, and CLI and HTTP interfaces.
Is headlesscode safe to install?
No — not without reading the findings first. The audit graded it F (50/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What can headlesscode access on my machine?
The audit observed that it reaches the network, runs shell commands and reads or writes files. Each of those is consistent with what it says it does. Secrets in the source: found — see the findings.
Which assistants does headlesscode work with?
Its documentation mentions claude-code and codex. That is what the text claims, not a compatibility test we ran.
How current is this page?
The grade is for one exact copy of the source (2aead0f2959e), read on 2026-10-14. The repository is watched, and a new audit runs when it changes — this is the first audit.