Safety and privacy

What a detector can do#

• It runs in a QuickJS WebAssembly isolate. It gets one event as JSON and returns findings as JSON.
• It has no network and no process. It cannot start a program or open a connection.
• It can read text files on your machine, and cannot change any. Without a network there is nowhere to send them.
• It has 100 ms and 32 MB for each event. One that exceeds either is stopped and reported, and your agent carries on.
• One that throws is reported in the plugin's words, never its own. What it threw is kept in the hook log for its author, and your agent never sees it.
• A finding names a line, and a match that must occur word for word in its event. A match that does not is left out, and the finding still fires.
• A finding can name another file, which must exist or occur word for word in its event. Any other file is left out, and the finding still fires. So a detector cannot compose sentences for your agent while it runs.
• Each download is checked against its content hash before it is stored.

The code that does all this is public, in passsy/wellactually: packages/core/src/detector/sandbox.ts is the isolate and packages/cli/src/board/board.ts runs an advisory board.

What the advice can do#

The detector is contained. The advice is not: its whole purpose is to be read by your agent.

That is why you choose experts and not just principles, and why the plugin frames all advice as advice from an expert you chose, never as an order and never as part of the task. The registry also checks every revision's advice and shows a warning on its page when the advice:

• tells the reader to ignore other instructions,
• contains a command that talks to the network or pipes into a shell,
• mentions credential files or asks for secrets,
• asks the reader to hide something from the user, or orders it to run something,
• contains invisible characters, or links to other sites.

Read the advice of a principle before you trust its expert with your agent.

What leaves your machine#

• How often each principle fired: a day, a hash and a count.
• A rating, when your agent gives one: the principle's hash and up, down or not_applicable.

No path, file content, prompt, command or finding is sent.

Once a day the plugin also reads the version of the newest release from github.com/passsy/wellactually, to tell you when there is a newer one. It is a plain download that sends nothing about you or your work, and it works without signing in. WELLACTUALLY_UPDATE_CHECK=0 turns it off. The hook log records those on your machine for a day, and never leaves it. Ask your agent to switch reporting off, and it turns both off with set_stats. Ratings and counts says more.

Private principles#

A principle is private until its expert makes it public. A private principle is seen by its expert and by the members of the private collections it is in, and nobody else.