Your Claude Code buddy is waiting.
Gear it up. Fight.

Audit the npm package "buddybrawl" before I install it. Never run it against my real machine — sandbox everything. Work it out as you go; the steps below are what I want proved, not a script to follow literally.

1. `npm pack buddybrawl` to get the tarball without executing it. Check the shasum against the registry, then read every file it ships — especially cli/buddy-sync.mjs (runs after each Claude Code response) and cli/index.mjs (the installer). Check package.json for dependencies and any install scripts. Then check the published bytes against the public source mirror, so you are not taking "this is the source" on trust: `git clone https://github.com/igormiklos/buddybrawl-cli.git mirror` then `diff -r package mirror -x MIRROR.md -x SECURITY.md -x .gitattributes -x .git` — expect no output. A difference there matters more than anything else on this list.
2. Tell me everything it reads from my machine and every network request it makes, to which hosts.
3. Build a throwaway sandbox that cannot reach my real home folder. Point BOTH $HOME and $USERPROFILE at a temp dir — os.homedir() reads USERPROFILE on Windows and HOME elsewhere, so setting one silently falls through to my real files — then assert os.homedir() actually moved. Give it a fake .buddybrawl/config.json with all four values it needs (apiUrl, syncSecret, machineId, pathSalt — it refuses to sync without them), a fake .claude.json whose companion personality names one of the hook's species as a whole word (it only resolves a buddy when one is named, so step 5 has nothing to check otherwise), a fake git identity, and a fake session transcript seeded with obvious bait: a fake API key, password, secret file path, client name and MCP tool name.
4. Shim global fetch to record the request and fake the reply BEFORE the hook runs, not after. Feed it a fake Stop event — bait that too — and show me the exact payload it would have sent.
5. Prove the sandbox worked before trusting anything: the payload must contain my bait git email, bait machineId and bait companion name. If any real value of mine appears, stop. "Nothing leaked" proves nothing if no bait was ever loaded.
6. buddybrawl.xyz/privacy claims the file-path salt is "never transmitted" and the install ID is "not derived from your hostname, username, or any hardware identifier". Check both against the code. For the salt: don't just search the payload for it — work out which secret actually produced the file tokens. Absence proves nothing.
7. Re-run with machineId and pathSalt missing, together and separately. Does it refuse, or quietly derive a substitute and send that?
8. Test a hostile server: escapes, control bytes, newlines and huge strings in every field it prints — including the numeric-looking ones — plus a non-JSON body and an HTTP 500. Nothing should forge "[BuddyBrawl]" lines, render a clickable link, or hang it.
9. Run the installer in the sandbox too. /privacy says it "adds exactly three things, all inside your own home folder" — check. Confirm a pre-existing ~/.claude/settings.json survives, and a corrupt hook is refused without clobbering a working install.
10. Compare the payload to buddybrawl.xyz/privacy and the README, nested objects included. Flag mismatches in both directions — docs claiming more privacy than the code delivers, and data sent that no doc mentions — and say what you couldn't verify from the tarball alone.
11. Bottom line, no jargon: is it safe for me to install this? Yes or no, and why in one sentence.