# Evobrew Audit — Public Release Readiness

**Date:** 2026-04-09
**Scope:** /Users/jtr/_JTR23_/Home23/evobrew/
**Disk:** ~234MB total, ~2.7MB source, ~230MB node_modules

---

## 1. Source Directories

| Directory | Size | File Count | Notes |
|-----------|------|------------|-------|
| server/ | 784K | 19 files | Core server, providers, terminal, tools |
| lib/ | 592K | 30 files | Config, clients, brain, encryption, setup wizard |
| public/ | 1.0M | 17 files | HTML, CSS, JS frontend |
| scripts/ | 36K | 6 files | Audit, migration, security, config testing |
| bin/ | 36K | 2 files | CLI entrypoint + OAuth helper |
| prisma/ | 44K | 5 files (incl. migrations) | Schema + migrations |
| docs/ | 240K | 17 files | Config, OAuth, daemon, plans, specs |
| storage/ | 8K | 1 file (.DS_Store only) | Empty directory |

**Total source files:** 116 (including .DS_Store files and docs)

---

## 2. Artifact Directories (MUST NOT ship)

| Path | Size | Status | In .gitignore? |
|------|------|--------|----------------|
| node_modules/ | 230MB | Runtime artifact | YES |
| conversations/ | 92K (8 chat logs) | User data | YES |
| snapshots/ | 116K | Contains base64-encoded paths revealing `/Users/jtr/` | YES |
| .evobrew-config.json | 4K | **CONTAINS API KEYS** | NO — MISSING |
| config.json | 4K | **CONTAINS API KEYS** (Home23-generated) | NO — MISSING |
| .playwright-mcp/ | 312K | Playwright logs/snapshots | YES |
| .superpowers/ | 16K | Brainstorm artifacts | NO — MISSING |
| database.db | 12K | SQLite (may contain OAuth tokens) | YES (via *.db) |
| prisma/studio.db | 12K | Prisma studio data | YES (via *.db) |
| server.log | 1.4K | Runtime log | YES (via *.log) |
| model-catalog-cache.json | 2K | Runtime model cache | NO — MISSING |
| REFERENCE-v1.html | 246K | Old reference file, not source | NO — MISSING |
| .env | N/A (not present) | — | YES |
| .evobrew-workspaces/ | N/A (not present) | — | YES |

---

## 3. Personal Data Findings

### CRITICAL — Exposed API Keys

Both `config.json` and `.evobrew-config.json` contain plaintext API keys:

| File | Key Type | Example Prefix |
|------|----------|---------------|
| config.json:6 | Anthropic API key | `sk-ant-REDACTED
| config.json:10 | OpenAI API key | `sk-proj-REDACTED
| config.json:13 | xAI API key | `xai-REDACTED
| .evobrew-config.json:6 | Anthropic API key | (same) |
| .evobrew-config.json:9 | OpenAI API key | (same) |
| .evobrew-config.json:12 | xAI API key | (same) |

**These files are NOT in .gitignore.** If evobrew/ were committed as-is, keys would ship.

### Hardcoded Paths (/Users/jtr/)

**In source files (must fix):**

| File | Line | Content |
|------|------|---------|
| server/ai-handler.js | 491 | `// /Users/jtr/_JTR23_/Cosmo_Unified_dev/engine/src/ide/ai-handler.js` |
| server/ai-handler.js | 2055 | `// Reference: /Users/jtr/_JTR23_/Cosmo_Unified_dev/engine/src/ide/ai-handler.js` |

These are comments — low risk, but should be removed for cleanliness.

**In generated config files (won't ship if .gitignore fixed):**

- config.json: lines 46-60 (brain paths, instance paths)
- .evobrew-config.json: lines 45-48 (brain paths)

**In documentation/markdown files (see Section 5):**

- OAUTH-TOKEN-SINK.md: lines 7, 226-228
- AGENT-NOTES.md: lines 78, 85, 102, 121, 128, 180
- LAUNCH_CHECKLIST.md: lines 11, 25
- verify-clean.sh: line 11
- PORTABILITY-FIXES-APPLIED.md: lines 93, 110, 127-128, 145, 148, 165, 169, 190
- docs/superpowers/plans/*.md: multiple files with absolute paths
- docs/superpowers/specs/*.md: multiple files with absolute paths

### Username/Handle References

**notforyou23 (GitHub handle — acceptable for public repo URL):**

| File | Context |
|------|---------|
| CLAUDE.md:26 | Repo URL |
| package.json:49,53 | Repository + bugs URL |
| QUICKSTART.md:9 | Clone URL |
| INSTALL.md:16 | Clone URL |
| README.md:20 | Clone URL |
| bin/evobrew:72 | Issues URL |

These are the correct public repo URL and are fine to ship.

**"jerry" — no matches found in source files.**

---

## 4. Home23 Integration Points

### Code Added for Home23 (in evobrew source)

**server/server.js lines 76-90 — Home23 config loader:**
```
let home23Config = null;
const home23ConfigPath = path.join(__dirname, '..', 'config.json');
if (fsSync.existsSync(home23ConfigPath)) {
  home23Config = JSON.parse(fsSync.readFileSync(home23ConfigPath, 'utf8'));
```
Loads `config.json` (auto-generated by Home23) for brain paths and agent config. This is **graceful** — if the file doesn't exist or lacks `_generated`, it's a no-op.

**server/server.js lines 4369-4376 — Home23 brain dirs:**
Adds Home23 agent brain paths to BRAIN_DIRS allowlist from `home23Config.brain.agentBrains`.

**server/server.js lines 5369-5376 — Auto-load default brain:**
Auto-loads default brain from Home23 config if no brain is loaded yet.

**server/server.js lines 3684, 3698, 4414 — Agent brain info in API responses:**
Exposes `agentBrains` from home23Config in brain/status API endpoints.

### Base Evobrew Features (not Home23-specific)

**server/providers/adapters/local-agent.js (192 lines):**
Full LocalAgentAdapter for connecting to local agent processes via HTTP+SSE. This is base evobrew functionality — it works with any HTTP agent, not just Home23 agents.

**server/server.js lines 4908-4942, 4991-5127 — Agent discovery + setup routes:**
`/api/setup/scan-agents`, `/api/setup/local-agent/save`, `/api/setup/local-agent/test`, `/api/setup/local-agent/remove` — generic local agent setup, not Home23-specific.

**public/index.html line 14947 — ?agent= query param:**
Handles `?agent=` URL parameter for Home23 dashboard integration (agent selector pre-fill). Minimal, graceful.

### Assessment

The Home23 integration is clean and minimal. It's a ~30-line config loader that gracefully degrades when not running under Home23. No evobrew functionality breaks without it. The `local-agent` system is generic. **No changes needed for standalone operation.**

---

## 5. Root-Level Files — Ship vs Don't Ship

### Ship (documentation)

| File | Reason |
|------|--------|
| README.md | Primary project docs |
| INSTALL.md | Installation guide |
| QUICKSTART.md | Quick start guide |
| CLAUDE.md | AI assistant context (useful for contributors) |
| AGENTS.md | Agent system docs |
| LICENSE | Legal requirement |
| package.json | Package manifest |
| index.js | Entry point |

### Don't Ship (dev notes / personal artifacts)

| File | Reason |
|------|--------|
| AGENT-NOTES.md | Personal dev notes with hardcoded paths |
| CONVERSATION-MANAGEMENT.md | Internal implementation notes |
| DUAL_BRAIN_ARCHITECTURE.md | Internal architecture notes |
| EVOBREW_SETUP_REDESIGN.md | Internal redesign notes |
| HTTPS-SETUP.md | Internal SSL setup notes |
| IMAGE-SUPPORT.md | Internal feature notes |
| LAUNCH_CHECKLIST.md | Personal launch checklist with paths |
| OAUTH-TOKEN-SINK.md | Internal OAuth design with paths |
| OPENCLAW-INTEGRATION.md | Internal integration notes |
| PI-DEPLOYMENT.md | Personal Pi deployment notes |
| PORTABILITY-AUDIT.md | Internal audit |
| PORTABILITY-FIXES-APPLIED.md | Internal fix log with paths |
| SNAPSHOT-SYSTEM.md | Internal feature notes |
| SURGICAL-EDITS.md | Internal notes |
| anthropic-oauth-flow.md | Internal OAuth flow notes |
| REFERENCE-v1.html | Old reference HTML (246K) |

**Note:** All 15 "Don't Ship" markdown files are already in .gitignore. The existing .gitignore is well-maintained in this regard. REFERENCE-v1.html is NOT in .gitignore.

### Don't Ship (root scripts)

| File | Reason |
|------|--------|
| cleanup-git-history.sh | Dev tool with destructive git ops |
| verify-clean.sh | Contains `/Users/jtr/` hardcoded path |
| verify-security.sh | Dev security verification |
| install-git-hooks.sh | Dev setup |
| regenerate-ssl-certs.sh | Dev SSL tool |
| import-oauth-token.js | Dev OAuth import tool |
| import-oauth.js | Dev OAuth import tool |

These root scripts are NOT in .gitignore (some should be for the Home23 bundle).

### Don't Ship (backup/WIP files)

| File | Size | Reason |
|------|------|--------|
| server/ai-handler.js.backup | 61K | Backup of ai-handler.js |
| server/server.js.oauth-fixed | 39K | Old version of server.js |
| public/index-modular.html.INCOMPLETE | 6K | Incomplete refactor attempt |

None of these are in .gitignore.

---

## 6. .gitignore Gaps

The evobrew .gitignore is mostly comprehensive but has these gaps:

| Missing Entry | Risk |
|---------------|------|
| `config.json` | **CRITICAL** — contains plaintext API keys |
| `.evobrew-config.json` | **CRITICAL** — contains plaintext API keys |
| `model-catalog-cache.json` | Low — runtime cache, no secrets |
| `REFERENCE-v1.html` | Low — large file, not source |
| `.superpowers/` | Low — brainstorm artifacts |
| `*.backup` | Low — backup files |
| `*.INCOMPLETE` | Low — WIP files |
| `import-oauth*.js` | Low — dev tools |
| `verify-clean.sh` | Low — contains hardcoded path |
| `cleanup-git-history.sh` | Low — dev tool |
| `install-git-hooks.sh` | Low — dev tool |
| `regenerate-ssl-certs.sh` | Low — dev tool |

---

## 7. .github/ Directory

Contains `.github/workflows/ci.yml`:
- Runs on push/PR to main
- Syntax checks server/, lib/, bin/
- Runs `scripts/audit-release-gate.js`
- Uses Node 18, ubuntu-latest

Clean and appropriate for a public repo. No secrets in the workflow file.

---

## 8. Required Fixes (Priority Order)

### CRITICAL

1. **Add `config.json` and `.evobrew-config.json` to .gitignore** — These contain plaintext API keys (Anthropic, OpenAI, xAI). If evobrew is committed to the public monorepo without this fix, keys ship.

2. **Rotate all exposed API keys** — Even though these files haven't been pushed to a public repo, they exist in the Home23 working tree. After ensuring .gitignore coverage, rotate:
   - Anthropic key: `sk-ant-REDACTED
   - OpenAI key: `sk-proj-REDACTED
   - xAI key: `xai-REDACTED

### HIGH

3. **Remove hardcoded paths from source comments** — server/ai-handler.js lines 491 and 2055 contain `/Users/jtr/` in comments. Remove or generalize.

4. **Add remaining .gitignore entries** — `model-catalog-cache.json`, `REFERENCE-v1.html`, `.superpowers/`, `*.backup`, `*.INCOMPLETE`.

5. **Exclude backup/WIP files from release bundle** — `server/ai-handler.js.backup`, `server/server.js.oauth-fixed`, `public/index-modular.html.INCOMPLETE`.

### MEDIUM

6. **Exclude root dev scripts from release bundle** — `cleanup-git-history.sh`, `verify-clean.sh`, `verify-security.sh`, `install-git-hooks.sh`, `regenerate-ssl-certs.sh`, `import-oauth-token.js`, `import-oauth.js`. These are dev tools, not user-facing.

7. **Clean .DS_Store files** — Found in: `docs/`, `prisma/`, `prisma/migrations/`, `public/`, `server/`, `storage/`. Already gitignored but present on disk.

### LOW

8. **Remove docs/superpowers/ from release** — Contains plans/specs with hardcoded paths (`/Users/jtr/`) referencing the old cosmo-home_2.3 codebase. Not relevant to evobrew users.

9. **Consider docs/plans/ cleanup** — Contains `PHASE2_WORKING_TREE_CLEANUP.sh` and `PHASE3_GIT_HISTORY_REWRITE.sh` which are dev scripts, not documentation. Already in .gitignore (`docs/plans/`).

---

## 9. Standalone Functionality Assessment

Evobrew works standalone. The Home23 integration is purely additive:
- `config.json` loader gracefully degrades (no file = no-op)
- All core features (AI chat, brain loading, terminal, file ops) work without Home23
- Local agent system is generic HTTP/SSE, not Home23-coupled
- Setup wizard handles all provider configuration independently
- `~/.evobrew/config.json` is the primary config path when not under Home23

The `?agent=` URL parameter handling is the only Home23-specific UI code, and it's a harmless no-op without the parameter.

---

## Summary

Evobrew is well-structured for bundling. The main concerns are:

1. **Two config files with plaintext API keys not in .gitignore** (critical, easy fix)
2. **Two source comments with hardcoded paths** (easy fix)
3. **Several backup/WIP/dev files that should be excluded** (easy fix)
4. **Home23 integration is clean and graceful** (no changes needed)
5. **Standalone functionality is intact** (no changes needed)
