Registro públicoModerado
Informe de salud del softwareesquema 0.27.0 · métricas 1.13.0 · 2026-07-27 14:16 UTC
bookedsolidtech / rea
Zero-trust governance layer for Claude Code. Policy-enforced MCP gateway with autonomy controls, middleware chain, audit log, HALT kill-switch, and prompt-injection defense.
bookedsolidtech/rea tiene un índice de salud de 64 sobre 100, lo que lo sitúa en la banda Moderado. Su puntuación más alta es Engineering Quality (89/100) y la más baja, Community & Adoption (44/100). Se actualizó por última vez hace 7 días. Una sola persona concentra la mayor parte del trabajo reciente.
64
global / 100Índice de salud del software
Las métricas se agrupan en categorías ponderadas sobre una escala de 1 a 100. El resultado global parte de su media; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe el límite 49 (En riesgo). Preparación para IA queda fuera.
64
Excelente85-100Ejemplar; cumple prácticamente todos los criterios evaluados
Bueno70-84Saludable; carencias menores
Moderado50-69Aceptable con carencias notables; se recomienda revisión
En riesgo30-49Debilidades significativas; su adopción exige cautela
Crítico1-29Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
Perfil de puntuación
Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.
Titularidad
bookedsolid.techOrganización
3 seguidores10 repositorios públicosdesde feb 2026
Este repositorio está respaldado por una organización: una custodia compartida y responsable que puede sobrevivir a cualquier mantenedor individual.
Ecosistemas de paquetes
| Registro | Paquete | Versión | Descargas / mes | Versiones | Última publicación | Etiquetas |
|---|---|---|---|---|---|---|
| npm | @bookedsolid/rea | 0.53.0 | 1950 | 79 | hace 7 días | claudeclaude-codemcpai-safetyai-governancehookszero-trustagenticgatewaycodexadversarial-review |
Métricas por categoría
Vitalidad
¿Está vivo el proyecto: se escribe código y se publican versiones?
82
Actividad de desarrollo
70Bueno
Cómo se puntúa
| 36/36 | Recencia de push — último push hace 7 días |
| 6.2/36 | Cadencia de commits — 9/52 semanas con commits |
| 18/18 | Volumen de commits — 186 commits en el último año |
| 10/10 | OpenSSF Scorecard: Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
Datos de entrada utilizados
| commits_last_year | 186 |
| human_commit_share | 1 |
| days_since_last_push | 7 |
| active_weeks_last_year | 9 |
Disciplina de publicación
100Excelente
Cómo se puntúa
| 27/27 | Publica versiones — 79 versiones publicadas |
| 36/36 | Recencia de las versiones — última versión hace 7 días |
| 27/27 | Cadencia de publicación — una versión cada ~7 días |
| 0/10 | OpenSSF Scorecard: Signed-Releases — sin datos |
Datos de entrada utilizados
| releases_count | 79 |
| latest_release_tag | v0.53.0 |
| releases_from_tags | no |
| days_since_latest_release | 7 |
| mean_days_between_releases | 7 |
Excluidos de la puntuación (sin datos o no aplicable): OpenSSF Scorecard: Signed-Releases. Los pesos restantes se han renormalizado.
Comunidad y Adopción
¿Tiene el proyecto usuarios, descargas, atención y unas condiciones acogedoras para quienes contribuyen?
44
Popularidad y adopción
1Crítico
Cómo se puntúa
| 0/60 | Estrellas — 0 estrellas |
| 0/25 | Forks — 1 forks |
| 0/15 | Observadores — 0 observadores |
Datos de entrada utilizados
| forks | 1 |
| stars | 0 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Salud de la comunidad
85Excelente
Cómo se puntúa
| 22.5/22.5 | README |
| 22.5/22.5 | Licencia — licencia reconocida (MIT) |
| 18/18 | Guía CONTRIBUTING |
| 13.5/13.5 | Código de conducta |
| 0/7.2 | Plantilla de issues |
| 0/6.3 | Plantilla de PR |
Datos de entrada utilizados
| has_readme | sí |
| has_license | sí |
| has_contributing | sí |
| has_issue_template | no |
| has_code_of_conduct | sí |
| has_pull_request_template | no |
Adopción en el ecosistema (descargas)
55Moderado
Cómo se puntúa
| 43.9/80 | Descargas mensuales — 1950 descargas/mes en npm |
| 0/20 | Dependientes en el registro — no lo informa este ecosistema |
Datos de entrada utilizados
| packages | @bookedsolid/rea |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 1950 |
Excluidos de la puntuación (sin datos o no aplicable): Dependientes en el registro. Los pesos restantes se han renormalizado.
Sostenibilidad y Gobernanza
¿Sobrevivirá el proyecto a sus personas: factor bus, capacidad de respuesta, quién lo respalda y mantenimiento del paquete?
45
Cómo se puntúa
| 9/54 | Factor bus — la mitad de los commits recae en 1 contribuyente(s) |
| 0/22.5 | Distribución de commits — el principal contribuyente firma el 100% de los commits |
| 1.4/13.5 | Amplitud de contribuyentes — 1 contribuyentes |
| 3/10 | OpenSSF Scorecard: Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
Datos de entrada utilizados
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Capacidad de respuesta a issues y PR
40En riesgo
Cómo se puntúa
| 4.7/46.8 | Resolución de issues — 10% de issues cerradas |
| 35/38.3 | Aceptación de PR — 185/202 PR decididos fusionados |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Datos de entrada utilizados
| merged_prs | 185 |
| open_issues | 9 |
| closed_issues | 1 |
| issue_closed_ratio | 0,1 |
| closed_unmerged_prs | 17 |
Propiedad y custodia
43En riesgo
Cómo se puntúa
| 30/30 | Respaldo de la propiedad — propiedad de una organización |
| 0/20 | Dominio verificado |
| 4.3/25 | Alcance del propietario — 3 seguidores de bookedsolidtech |
| 8.4/25 | Trayectoria — 10 repos públicos, cuenta de ~0 años |
Datos de entrada utilizados
| followers | 3 |
| owner_type | Organization |
| is_verified | — |
| owner_login | bookedsolidtech |
| public_repos | 10 |
| account_age_days | 149 |
Mantenimiento de paquetes
100Excelente
Cómo se puntúa
| 25/25 | Publicado y resoluble — 1 paquete(s) en npm |
| 35/35 | Recencia de publicación — última publicación hace 7 días |
| 20/20 | Historial de versiones — 79 versiones en el registro |
| 20/20 | No obsoleto — activo, ni obsoleto ni retirado |
Datos de entrada utilizados
| packages | @bookedsolid/rea |
| ecosystems | npm |
| any_deprecated | no |
| min_days_since_publish | 7 |
Calidad de Ingeniería
¿Existen unas prácticas mínimas de ingeniería y documentación?
89
Prácticas de ingeniería
82Bueno
Cómo se puntúa
| 24/24 | Flujos de trabajo de CI — 5 flujo(s) de trabajo |
| 24/24 | Pruebas presentes |
| 16/16 | Configuración de linter — eslint.config.js |
| 0/9.6 | Hooks de pre-commit |
| 0/6.4 | .editorconfig |
| 18/20 | OpenSSF Scorecard: CI-Tests — 28 out of 30 merged PRs checked by a CI test -- score normalized to 9 |
Datos de entrada utilizados
| has_ci | sí |
| has_tests | sí |
| has_editorconfig | no |
| has_linter_config | sí |
| has_precommit_config | no |
Documentación
100Excelente
Cómo se puntúa
| 30/30 | README |
| 25/25 | Directorio de documentación |
| 15/15 | Sitio de documentación / página del proyecto — https://github.com/bookedsolidtech/rea |
| 10/10 | Descripción del repositorio |
| 10/10 | Topics — 20 topics |
| 10/10 | Wiki |
Datos de entrada utilizados
| topics | ai-safety, claude-code, mcp, typescript, agentic-ai, ai-agents, ai-governance, anthropic, anthropic-claude, audit-log, developer-tools, guardrails, llm-guardrails, llm-security, mcp-gateway, mcp-server, model-context-protocol, policy-enforcement, prompt-injection, zero-trust |
| has_wiki | sí |
| homepage | https://github.com/bookedsolidtech/rea |
| has_readme | sí |
| has_docs_dir | sí |
| has_description | sí |
Seguridad
¿Son sólidas las prácticas visibles de seguridad y de cadena de suministro, sin exposición jurisdiccional de alto riesgo sin resolver?
59
Postura de seguridad
55Moderado
Cómo se puntúa
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — sin datos |
| 2.2/2.5 | CI-Tests — 28 out of 30 merged PRs checked by a CI test -- score normalized to 9 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0.8/2.5 | Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 7.5/7.5 | Dependency-Update-Tool — update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | Licencia — license file detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| 0/5 | Packaging — sin datos |
| 4/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 8 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 5/5 | Security-Policy — security policy file detected |
| 0/7.5 | Signed-Releases — sin datos |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 0/7.5 | Vulnerabilities — 37 existing vulnerabilities detected |
Datos de entrada utilizados
| source | openssf_scorecard |
| checks_evaluated | 15 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 3 |
| scorecard_aggregate | 5,5 |
Excluidos de la puntuación (sin datos o no aplicable): branch_protection, packaging, signed_releases. Los pesos restantes se han renormalizado.
Avisos de dependencias
76Bueno
Cómo se puntúa
| 22.7/35 | Dependencias directas libres de avisos conocidos — 1 afectados: @anthropic-ai/sdk 0.90.0 (moderate 4.4) |
| 13.2/25 | Dependencias indirectas libres de avisos conocidos — 1 afectados: @hono/node-server 1.19.15 (moderate 5.9) |
| 40/40 | Sin avisos pendientes — ningún aviso lleva público más de 90 días |
Datos de entrada utilizados
| source | osv |
| advisories | 2 |
| affected_packages | 2 |
| assessed_packages | 115 |
| unassessed_packages | 0 |
| affected_by_severity | moderate 2 |
| direct_affected_packages | 1 |
Se cotejó el cierre de dependencias en tiempo de ejecución de npm:@bookedsolid/rea@0.53.0 —lo que arrastra la instalación del paquete publicado—: 115 paquetes. No se analiza la alcanzabilidad.
Preparación para IA
¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Es una insignia independiente y experimental — peso 0,0, de modo que se presenta por separado y no afecta a la puntuación de salud global.
70
Contexto y guía para agentes
85Excelente
Cómo se puntúa
| 45/45 | Instrucciones para agentes — AGENTS.md, CLAUDE.md |
| 0/15 | Documentación legible por máquinas (llms.txt) |
| 40/40 | Historial de commits legible — 100 de 100 commits humanos declaran su intención (asunto estructurado o cuerpo explicativo) |
Datos de entrada utilizados
| has_llms_txt | no |
| legible_history_share | 1 |
| agent_instruction_files | AGENTS.md, CLAUDE.md |
| agent_instruction_max_bytes | 17.098 |
Cómo se puntúa
| 0/18 | Arranque con un solo comando |
| 22/22 | Pruebas automatizadas |
| 11/11 | Configuración de lint / formato — eslint.config.js |
| 11/11 | Verificación estática de tipos — tsconfig.json |
| 10/10 | Entorno reproducible — lockfile |
| 0/10 | Práctica demostrada con agentes — ningún commit con autoría de agente entre los últimos 100 |
| 5/8 | Mantenimiento automatizado — automatización de dependencias configurada, no observada en los commits muestreados |
| 8/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 8 |
Datos de entrada utilizados
| has_nix | no |
| has_tests | sí |
| lockfiles | pnpm-lock.yaml |
| has_dockerfile | no |
| typed_language | sí |
| bootstrap_files | — |
| has_devcontainer | no |
| has_linter_config | sí |
| typecheck_configs | tsconfig.json |
| agent_commit_share | 0 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
Legibilidad del código para modelos
98Excelente
Cómo se puntúa
| 45/45 | Código verificable por tipos — TypeScript (tipado estático) |
| 53/55 | Tamaños de archivo manejables — 13/355 archivos fuente de más de 60 KB |
Datos de entrada utilizados
| primary_language | TypeScript |
| largest_source_bytes | 358.052 |
| source_files_sampled | 355 |
| oversized_source_files | 13 |
Interfaces legibles por máquina
20Crítico
Cómo se puntúa
| 0/40 | Esquema de API (OpenAPI/GraphQL/proto) |
| 20/20 | Servidor MCP |
| 0/40 | Ejemplos ejecutables |
Datos de entrada utilizados
| example_dirs | — |
| has_mcp_signal | sí |
| api_schema_files | — |
Datos clave
0estrellas de GitHub
1contribuidores
186commits en los últimos 12 meses
7días desde el último push
79versiones publicadas
1factor bus
9issues abiertas
npmecosistemas de paquetes
Más detalle
OpenSSF Scorecard 5.5 / 10
5.5agregado
Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| n/d | Branch-Protection | internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md |
| 9 | CI-Tests | 28 out of 30 merged PRs checked by a CI test -- score normalized to 9 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 3 | Contributors | project has 1 contributing companies or organizations -- score normalized to 3 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 10 | Dependency-Update-Tool | update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 10 | Maintained | 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 |
| n/d | Packaging | packaging workflow not detected |
| 8 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 8 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 10 | Security-Policy | security policy file detected |
| n/d | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 0 | Vulnerabilities | 37 existing vulnerabilities detected |
Dependencias directas 10
| Registro | Paquete | Restricción de versión | Manifiesto |
|---|---|---|---|
| npm | @anthropic-ai/sdk | ^0.90.0 | package.json |
| npm | @clack/prompts | ^1.2.0 | package.json |
| npm | @modelcontextprotocol/sdk | ^1.29.0 | package.json |
| npm | commander | ^14.0.3 | package.json |
| npm | mvdan-sh | 0.10.1 | package.json |
| npm | proper-lockfile | ^4.1.2 | package.json |
| npm | safe-regex | ^2.1.1 | package.json |
| npm | semver | ^7.7.4 | package.json |
| npm | yaml | ^2.7.0 | package.json |
| npm | zod | ^3.23.0 | package.json |
Todas las dependencias 423
Conjunto completo de dependencias resueltas según el grafo de dependencias de GitHub: 10 paquetes directos y 413 indirectos (transitivos). El cierre transitivo es completo cuando el repositorio incluye un lockfile.
| Registro | Paquete | Versión | Relación |
|---|---|---|---|
| npm | @anthropic-ai/sdk | 0.90.0 | directa |
| npm | @clack/prompts | 1.2.0 | directa |
| npm | @modelcontextprotocol/sdk | 1.29.0 | directa |
| npm | commander | 14.0.3 | directa |
| npm | mvdan-sh | 0.10.1 | directa |
| npm | proper-lockfile | 4.1.2 | directa |
| npm | safe-regex | 2.1.1 | directa |
| npm | semver | 7.7.4 | directa |
| npm | yaml | 2.8.3 | directa |
| npm | zod | 3.25.76 | directa |
| npm | @ampproject/remapping | 2.3.0 | indirecta |
| npm | @babel/helper-string-parser | 7.27.1 | indirecta |
| npm | @babel/helper-validator-identifier | 7.28.5 | indirecta |
| npm | @babel/parser | 7.29.2 | indirecta |
| npm | @babel/runtime | 7.29.2 | indirecta |
| npm | @babel/types | 7.29.0 | indirecta |
| npm | @bcoe/v8-coverage | 1.0.2 | indirecta |
| npm | @bookedsolid/rea | ^0.49.0 | indirecta |
| npm | @changesets/apply-release-plan | 7.1.1 | indirecta |
| npm | @changesets/assemble-release-plan | 6.0.10 | indirecta |
| npm | @changesets/changelog-git | 0.2.1 | indirecta |
| npm | @changesets/cli | 2.31.0 | indirecta |
| npm | @changesets/config | 3.1.4 | indirecta |
| npm | @changesets/errors | 0.2.0 | indirecta |
| npm | @changesets/get-dependents-graph | 2.1.4 | indirecta |
| npm | @changesets/get-release-plan | 4.0.16 | indirecta |
| npm | @changesets/get-version-range-type | 0.4.0 | indirecta |
| npm | @changesets/git | 3.0.4 | indirecta |
| npm | @changesets/logger | 0.1.1 | indirecta |
| npm | @changesets/parse | 0.4.3 | indirecta |
| npm | @changesets/pre | 2.0.2 | indirecta |
| npm | @changesets/read | 0.6.7 | indirecta |
| npm | @changesets/should-skip-package | 0.1.2 | indirecta |
| npm | @changesets/types | 4.1.0 | indirecta |
| npm | @changesets/types | 6.1.0 | indirecta |
| npm | @changesets/write | 0.4.0 | indirecta |
| npm | @clack/core | 1.2.0 | indirecta |
| npm | @esbuild/aix-ppc64 | 0.27.7 | indirecta |
| npm | @esbuild/android-arm | 0.27.7 | indirecta |
| npm | @esbuild/android-arm64 | 0.27.7 | indirecta |
| npm | @esbuild/android-x64 | 0.27.7 | indirecta |
| npm | @esbuild/darwin-arm64 | 0.27.7 | indirecta |
| npm | @esbuild/darwin-x64 | 0.27.7 | indirecta |
| npm | @esbuild/freebsd-arm64 | 0.27.7 | indirecta |
| npm | @esbuild/freebsd-x64 | 0.27.7 | indirecta |
| npm | @esbuild/linux-arm | 0.27.7 | indirecta |
| npm | @esbuild/linux-arm64 | 0.27.7 | indirecta |
| npm | @esbuild/linux-ia32 | 0.27.7 | indirecta |
| npm | @esbuild/linux-loong64 | 0.27.7 | indirecta |
| npm | @esbuild/linux-mips64el | 0.27.7 | indirecta |
| npm | @esbuild/linux-ppc64 | 0.27.7 | indirecta |
| npm | @esbuild/linux-riscv64 | 0.27.7 | indirecta |
| npm | @esbuild/linux-s390x | 0.27.7 | indirecta |
| npm | @esbuild/linux-x64 | 0.27.7 | indirecta |
| npm | @esbuild/netbsd-arm64 | 0.27.7 | indirecta |
| npm | @esbuild/netbsd-x64 | 0.27.7 | indirecta |
| npm | @esbuild/openbsd-arm64 | 0.27.7 | indirecta |
| npm | @esbuild/openbsd-x64 | 0.27.7 | indirecta |
| npm | @esbuild/openharmony-arm64 | 0.27.7 | indirecta |
| npm | @esbuild/sunos-x64 | 0.27.7 | indirecta |
| npm | @esbuild/win32-arm64 | 0.27.7 | indirecta |
| npm | @esbuild/win32-ia32 | 0.27.7 | indirecta |
| npm | @esbuild/win32-x64 | 0.27.7 | indirecta |
| npm | @eslint-community/eslint-utils | 4.9.1 | indirecta |
| npm | @eslint-community/regexpp | 4.12.2 | indirecta |
| npm | @eslint/config-array | 0.23.5 | indirecta |
| npm | @eslint/config-helpers | 0.5.5 | indirecta |
| npm | @eslint/core | 1.2.1 | indirecta |
| npm | @eslint/object-schema | 3.0.5 | indirecta |
| npm | @eslint/plugin-kit | 0.7.1 | indirecta |
| npm | @hono/node-server | 1.19.14 | indirecta |
| npm | @humanfs/core | 0.19.2 | indirecta |
| npm | @humanfs/node | 0.16.8 | indirecta |
| npm | @humanfs/types | 0.15.0 | indirecta |
| npm | @humanwhocodes/module-importer | 1.0.1 | indirecta |
| npm | @humanwhocodes/retry | 0.4.3 | indirecta |
| npm | @inquirer/external-editor | 1.0.3 | indirecta |
| npm | @isaacs/cliui | 8.0.2 | indirecta |
| npm | @istanbuljs/schema | 0.1.6 | indirecta |
| npm | @jridgewell/gen-mapping | 0.3.13 | indirecta |
| npm | @jridgewell/resolve-uri | 3.1.2 | indirecta |
| npm | @jridgewell/sourcemap-codec | 1.5.5 | indirecta |
| npm | @jridgewell/trace-mapping | 0.3.31 | indirecta |
| npm | @manypkg/find-root | 1.1.0 | indirecta |
| npm | @manypkg/get-packages | 1.1.3 | indirecta |
| npm | @nodelib/fs.scandir | 2.1.5 | indirecta |
| npm | @nodelib/fs.stat | 2.0.5 | indirecta |
| npm | @nodelib/fs.walk | 1.2.8 | indirecta |
| npm | @pkgjs/parseargs | 0.11.0 | indirecta |
| npm | @rollup/rollup-android-arm-eabi | 4.60.1 | indirecta |
| npm | @rollup/rollup-android-arm64 | 4.60.1 | indirecta |
| npm | @rollup/rollup-darwin-arm64 | 4.60.1 | indirecta |
| npm | @rollup/rollup-darwin-x64 | 4.60.1 | indirecta |
| npm | @rollup/rollup-freebsd-arm64 | 4.60.1 | indirecta |
| npm | @rollup/rollup-freebsd-x64 | 4.60.1 | indirecta |
| npm | @rollup/rollup-linux-arm-gnueabihf | 4.60.1 | indirecta |
| npm | @rollup/rollup-linux-arm-musleabihf | 4.60.1 | indirecta |
| npm | @rollup/rollup-linux-arm64-gnu | 4.60.1 | indirecta |
| npm | @rollup/rollup-linux-arm64-musl | 4.60.1 | indirecta |
| npm | @rollup/rollup-linux-loong64-gnu | 4.60.1 | indirecta |
| npm | @rollup/rollup-linux-loong64-musl | 4.60.1 | indirecta |
| npm | @rollup/rollup-linux-ppc64-gnu | 4.60.1 | indirecta |
| npm | @rollup/rollup-linux-ppc64-musl | 4.60.1 | indirecta |
| npm | @rollup/rollup-linux-riscv64-gnu | 4.60.1 | indirecta |
| npm | @rollup/rollup-linux-riscv64-musl | 4.60.1 | indirecta |
| npm | @rollup/rollup-linux-s390x-gnu | 4.60.1 | indirecta |
| npm | @rollup/rollup-linux-x64-gnu | 4.60.1 | indirecta |
| npm | @rollup/rollup-linux-x64-musl | 4.60.1 | indirecta |
| npm | @rollup/rollup-openbsd-x64 | 4.60.1 | indirecta |
| npm | @rollup/rollup-openharmony-arm64 | 4.60.1 | indirecta |
| npm | @rollup/rollup-win32-arm64-msvc | 4.60.1 | indirecta |
| npm | @rollup/rollup-win32-ia32-msvc | 4.60.1 | indirecta |
| npm | @rollup/rollup-win32-x64-gnu | 4.60.1 | indirecta |
| npm | @rollup/rollup-win32-x64-msvc | 4.60.1 | indirecta |
| npm | @types/chai | 5.2.3 | indirecta |
| npm | @types/deep-eql | 4.0.2 | indirecta |
| npm | @types/esrecurse | 4.3.1 | indirecta |
| npm | @types/estree | 1.0.8 | indirecta |
| npm | @types/json-schema | 7.0.15 | indirecta |
| npm | @types/node | 12.20.55 | indirecta |
| npm | @types/node | 25.6.0 | indirecta |
| npm | @types/proper-lockfile | 4.1.4 | indirecta |
| npm | @types/retry | 0.12.5 | indirecta |
| npm | @types/safe-regex | 1.1.6 | indirecta |
| npm | @types/semver | 7.7.1 | indirecta |
| npm | @typescript-eslint/eslint-plugin | 8.58.2 | indirecta |
| npm | @typescript-eslint/parser | 8.58.2 | indirecta |
| npm | @typescript-eslint/project-service | 8.58.2 | indirecta |
| npm | @typescript-eslint/scope-manager | 8.58.2 | indirecta |
| npm | @typescript-eslint/tsconfig-utils | 8.58.2 | indirecta |
| npm | @typescript-eslint/type-utils | 8.58.2 | indirecta |
| npm | @typescript-eslint/types | 8.58.2 | indirecta |
| npm | @typescript-eslint/typescript-estree | 8.58.2 | indirecta |
| npm | @typescript-eslint/utils | 8.58.2 | indirecta |
| npm | @typescript-eslint/visitor-keys | 8.58.2 | indirecta |
| npm | @vitest/coverage-v8 | 3.2.4 | indirecta |
| npm | @vitest/expect | 3.2.4 | indirecta |
| npm | @vitest/mocker | 3.2.4 | indirecta |
| npm | @vitest/pretty-format | 3.2.4 | indirecta |
| npm | @vitest/runner | 3.2.4 | indirecta |
| npm | @vitest/snapshot | 3.2.4 | indirecta |
| npm | @vitest/spy | 3.2.4 | indirecta |
| npm | @vitest/utils | 3.2.4 | indirecta |
| npm | accepts | 2.0.0 | indirecta |
| npm | acorn | 8.16.0 | indirecta |
| npm | acorn-jsx | 5.3.2 | indirecta |
| npm | ajv | 6.14.0 | indirecta |
| npm | ajv | 8.18.0 | indirecta |
| npm | ajv-formats | 3.0.1 | indirecta |
| npm | ansi-colors | 4.1.3 | indirecta |
| npm | ansi-regex | 5.0.1 | indirecta |
| npm | ansi-regex | 6.2.2 | indirecta |
| npm | ansi-styles | 4.3.0 | indirecta |
| npm | ansi-styles | 6.2.3 | indirecta |
| npm | argparse | 1.0.10 | indirecta |
| npm | argparse | 2.0.1 | indirecta |
| npm | array-union | 2.1.0 | indirecta |
| npm | assertion-error | 2.0.1 | indirecta |
| npm | ast-v8-to-istanbul | 0.3.12 | indirecta |
| npm | balanced-match | 1.0.2 | indirecta |
| npm | balanced-match | 4.0.4 | indirecta |
| npm | better-path-resolve | 1.0.0 | indirecta |
| npm | body-parser | 2.2.2 | indirecta |
| npm | brace-expansion | 2.1.0 | indirecta |
| npm | brace-expansion | 5.0.5 | indirecta |
| npm | braces | 3.0.3 | indirecta |
| npm | bytes | 3.1.2 | indirecta |
| npm | cac | 6.7.14 | indirecta |
| npm | call-bind-apply-helpers | 1.0.2 | indirecta |
| npm | call-bound | 1.0.4 | indirecta |
| npm | chai | 5.3.3 | indirecta |
| npm | chardet | 2.1.1 | indirecta |
| npm | check-error | 2.1.3 | indirecta |
| npm | color-convert | 2.0.1 | indirecta |
| npm | color-name | 1.1.4 | indirecta |
| npm | content-disposition | 1.1.0 | indirecta |
| npm | content-type | 1.0.5 | indirecta |
| npm | cookie | 0.7.2 | indirecta |
| npm | cookie-signature | 1.2.2 | indirecta |
| npm | cors | 2.8.6 | indirecta |
| npm | cross-spawn | 7.0.6 | indirecta |
| npm | debug | 4.4.3 | indirecta |
| npm | deep-eql | 5.0.2 | indirecta |
| npm | deep-is | 0.1.4 | indirecta |
| npm | depd | 2.0.0 | indirecta |
| npm | detect-indent | 6.1.0 | indirecta |
| npm | dir-glob | 3.0.1 | indirecta |
| npm | dunder-proto | 1.0.1 | indirecta |
| npm | eastasianwidth | 0.2.0 | indirecta |
| npm | ee-first | 1.1.1 | indirecta |
| npm | emoji-regex | 8.0.0 | indirecta |
| npm | emoji-regex | 9.2.2 | indirecta |
| npm | encodeurl | 2.0.0 | indirecta |
| npm | enquirer | 2.4.1 | indirecta |
| npm | es-define-property | 1.0.1 | indirecta |
| npm | es-errors | 1.3.0 | indirecta |
| npm | es-module-lexer | 1.7.0 | indirecta |
| npm | es-object-atoms | 1.1.1 | indirecta |
| npm | esbuild | 0.27.7 | indirecta |
| npm | escape-html | 1.0.3 | indirecta |
| npm | escape-string-regexp | 4.0.0 | indirecta |
| npm | eslint | 10.2.1 | indirecta |
| npm | eslint-scope | 9.1.2 | indirecta |
| npm | eslint-visitor-keys | 3.4.3 | indirecta |
| npm | eslint-visitor-keys | 5.0.1 | indirecta |
| npm | espree | 11.2.0 | indirecta |
| npm | esprima | 4.0.1 | indirecta |
| npm | esquery | 1.7.0 | indirecta |
| npm | esrecurse | 4.3.0 | indirecta |
| npm | estraverse | 5.3.0 | indirecta |
| npm | estree-walker | 3.0.3 | indirecta |
| npm | esutils | 2.0.3 | indirecta |
| npm | etag | 1.8.1 | indirecta |
| npm | eventsource | 3.0.7 | indirecta |
| npm | eventsource-parser | 3.0.7 | indirecta |
| npm | expect-type | 1.3.0 | indirecta |
| npm | express | 5.2.1 | indirecta |
| npm | express-rate-limit | 8.3.2 | indirecta |
| npm | extendable-error | 0.1.7 | indirecta |
| npm | fast-deep-equal | 3.1.3 | indirecta |
| npm | fast-glob | 3.3.3 | indirecta |
| npm | fast-json-stable-stringify | 2.1.0 | indirecta |
| npm | fast-levenshtein | 2.0.6 | indirecta |
| npm | fast-string-truncated-width | 1.2.1 | indirecta |
| npm | fast-string-width | 1.1.0 | indirecta |
| npm | fast-uri | 3.1.0 | indirecta |
| npm | fast-wrap-ansi | 0.1.6 | indirecta |
| npm | fastq | 1.20.1 | indirecta |
| npm | fdir | 6.5.0 | indirecta |
| npm | file-entry-cache | 8.0.0 | indirecta |
| npm | fill-range | 7.1.1 | indirecta |
| npm | finalhandler | 2.1.1 | indirecta |
| npm | find-up | 4.1.0 | indirecta |
| npm | find-up | 5.0.0 | indirecta |
| npm | flat-cache | 4.0.1 | indirecta |
| npm | flatted | 3.4.2 | indirecta |
| npm | foreground-child | 3.3.1 | indirecta |
| npm | forwarded | 0.2.0 | indirecta |
| npm | fresh | 2.0.0 | indirecta |
| npm | fs-extra | 7.0.1 | indirecta |
| npm | fs-extra | 8.1.0 | indirecta |
| npm | fsevents | 2.3.3 | indirecta |
| npm | function-bind | 1.1.2 | indirecta |
| npm | get-intrinsic | 1.3.0 | indirecta |
| npm | get-proto | 1.0.1 | indirecta |
| npm | glob | 10.5.0 | indirecta |
| npm | glob-parent | 5.1.2 | indirecta |
| npm | glob-parent | 6.0.2 | indirecta |
| npm | globby | 11.1.0 | indirecta |
| npm | gopd | 1.2.0 | indirecta |
| npm | graceful-fs | 4.2.11 | indirecta |
| npm | has-flag | 4.0.0 | indirecta |
| npm | has-symbols | 1.1.0 | indirecta |
| npm | hasown | 2.0.3 | indirecta |
| npm | hono | 4.12.14 | indirecta |
| npm | html-escaper | 2.0.2 | indirecta |
| npm | http-errors | 2.0.1 | indirecta |
| npm | human-id | 4.1.3 | indirecta |
| npm | iconv-lite | 0.7.2 | indirecta |
| npm | ignore | 5.3.2 | indirecta |
| npm | ignore | 7.0.5 | indirecta |
| npm | imurmurhash | 0.1.4 | indirecta |
| npm | inherits | 2.0.4 | indirecta |
| npm | ip-address | 10.1.0 | indirecta |
| npm | ipaddr.js | 1.9.1 | indirecta |
| npm | is-extglob | 2.1.1 | indirecta |
| npm | is-fullwidth-code-point | 3.0.0 | indirecta |
| npm | is-glob | 4.0.3 | indirecta |
| npm | is-number | 7.0.0 | indirecta |
| npm | is-promise | 4.0.0 | indirecta |
| npm | is-subdir | 1.2.0 | indirecta |
| npm | is-windows | 1.0.2 | indirecta |
| npm | isexe | 2.0.0 | indirecta |
| npm | istanbul-lib-coverage | 3.2.2 | indirecta |
| npm | istanbul-lib-report | 3.0.1 | indirecta |
| npm | istanbul-lib-source-maps | 5.0.6 | indirecta |
| npm | istanbul-reports | 3.2.0 | indirecta |
| npm | jackspeak | 3.4.3 | indirecta |
| npm | jose | 6.2.2 | indirecta |
| npm | js-tokens | 10.0.0 | indirecta |
| npm | js-tokens | 9.0.1 | indirecta |
| npm | js-yaml | 3.14.2 | indirecta |
| npm | js-yaml | 4.1.1 | indirecta |
| npm | json-buffer | 3.0.1 | indirecta |
| npm | json-schema-to-ts | 3.1.1 | indirecta |
| npm | json-schema-traverse | 0.4.1 | indirecta |
| npm | json-schema-traverse | 1.0.0 | indirecta |
| npm | json-schema-typed | 8.0.2 | indirecta |
| npm | json-stable-stringify-without-jsonify | 1.0.1 | indirecta |
| npm | jsonfile | 4.0.0 | indirecta |
| npm | keyv | 4.5.4 | indirecta |
| npm | levn | 0.4.1 | indirecta |
| npm | locate-path | 5.0.0 | indirecta |
| npm | locate-path | 6.0.0 | indirecta |
| npm | lodash.startcase | 4.4.0 | indirecta |
| npm | loupe | 3.2.1 | indirecta |
| npm | lru-cache | 10.4.3 | indirecta |
| npm | magic-string | 0.30.21 | indirecta |
| npm | magicast | 0.3.5 | indirecta |
| npm | make-dir | 4.0.0 | indirecta |
| npm | math-intrinsics | 1.1.0 | indirecta |
| npm | media-typer | 1.1.0 | indirecta |
| npm | merge-descriptors | 2.0.0 | indirecta |
| npm | merge2 | 1.4.1 | indirecta |
| npm | micromatch | 4.0.8 | indirecta |
| npm | mime-db | 1.54.0 | indirecta |
| npm | mime-types | 3.0.2 | indirecta |
| npm | minimatch | 10.2.5 | indirecta |
| npm | minimatch | 9.0.9 | indirecta |
| npm | minipass | 7.1.3 | indirecta |
| npm | mri | 1.2.0 | indirecta |
| npm | ms | 2.1.3 | indirecta |
| npm | nanoid | 3.3.11 | indirecta |
| npm | natural-compare | 1.4.0 | indirecta |
| npm | negotiator | 1.0.0 | indirecta |
| npm | object-assign | 4.1.1 | indirecta |
| npm | object-inspect | 1.13.4 | indirecta |
| npm | on-finished | 2.4.1 | indirecta |
| npm | once | 1.4.0 | indirecta |
| npm | optionator | 0.9.4 | indirecta |
| npm | outdent | 0.5.0 | indirecta |
| npm | p-filter | 2.1.0 | indirecta |
| npm | p-limit | 2.3.0 | indirecta |
| npm | p-limit | 3.1.0 | indirecta |
| npm | p-locate | 4.1.0 | indirecta |
| npm | p-locate | 5.0.0 | indirecta |
| npm | p-map | 2.1.0 | indirecta |
| npm | p-try | 2.2.0 | indirecta |
| npm | package-json-from-dist | 1.0.1 | indirecta |
| npm | package-manager-detector | 0.2.11 | indirecta |
| npm | parseurl | 1.3.3 | indirecta |
| npm | path-exists | 4.0.0 | indirecta |
| npm | path-key | 3.1.1 | indirecta |
| npm | path-scurry | 1.11.1 | indirecta |
| npm | path-to-regexp | 8.4.2 | indirecta |
| npm | path-type | 4.0.0 | indirecta |
| npm | pathe | 2.0.3 | indirecta |
| npm | pathval | 2.0.1 | indirecta |
| npm | picocolors | 1.1.1 | indirecta |
| npm | picomatch | 2.3.2 | indirecta |
| npm | picomatch | 4.0.4 | indirecta |
| npm | pify | 4.0.1 | indirecta |
| npm | pkce-challenge | 5.0.1 | indirecta |
| npm | postcss | 8.5.10 | indirecta |
| npm | prelude-ls | 1.2.1 | indirecta |
| npm | prettier | 2.8.8 | indirecta |
| npm | prettier | 3.8.3 | indirecta |
| npm | proxy-addr | 2.0.7 | indirecta |
| npm | punycode | 2.3.1 | indirecta |
| npm | qs | 6.15.1 | indirecta |
| npm | quansync | 0.2.11 | indirecta |
| npm | queue-microtask | 1.2.3 | indirecta |
| npm | range-parser | 1.2.1 | indirecta |
| npm | raw-body | 3.0.2 | indirecta |
| npm | read-yaml-file | 1.1.0 | indirecta |
| npm | regexp-tree | 0.1.27 | indirecta |
| npm | require-from-string | 2.0.2 | indirecta |
| npm | resolve-from | 5.0.0 | indirecta |
| npm | retry | 0.12.0 | indirecta |
| npm | reusify | 1.1.0 | indirecta |
| npm | rollup | 4.60.1 | indirecta |
| npm | router | 2.2.0 | indirecta |
| npm | run-parallel | 1.2.0 | indirecta |
| npm | safer-buffer | 2.1.2 | indirecta |
| npm | send | 1.2.1 | indirecta |
| npm | serve-static | 2.2.1 | indirecta |
| npm | setprototypeof | 1.2.0 | indirecta |
| npm | shebang-command | 2.0.0 | indirecta |
| npm | shebang-regex | 3.0.0 | indirecta |
| npm | side-channel | 1.1.0 | indirecta |
| npm | side-channel-list | 1.0.1 | indirecta |
| npm | side-channel-map | 1.0.1 | indirecta |
| npm | side-channel-weakmap | 1.0.2 | indirecta |
| npm | siginfo | 2.0.0 | indirecta |
| npm | signal-exit | 3.0.7 | indirecta |
| npm | signal-exit | 4.1.0 | indirecta |
| npm | sisteransi | 1.0.5 | indirecta |
| npm | slash | 3.0.0 | indirecta |
| npm | source-map-js | 1.2.1 | indirecta |
| npm | spawndamnit | 3.0.1 | indirecta |
| npm | sprintf-js | 1.0.3 | indirecta |
| npm | stackback | 0.0.2 | indirecta |
| npm | statuses | 2.0.2 | indirecta |
| npm | std-env | 3.10.0 | indirecta |
| npm | string-width | 4.2.3 | indirecta |
| npm | string-width | 5.1.2 | indirecta |
| npm | strip-ansi | 6.0.1 | indirecta |
| npm | strip-ansi | 7.2.0 | indirecta |
| npm | strip-bom | 3.0.0 | indirecta |
| npm | strip-literal | 3.1.0 | indirecta |
| npm | supports-color | 7.2.0 | indirecta |
| npm | term-size | 2.2.1 | indirecta |
| npm | test-exclude | 7.0.2 | indirecta |
| npm | tinybench | 2.9.0 | indirecta |
| npm | tinyexec | 0.3.2 | indirecta |
| npm | tinyglobby | 0.2.16 | indirecta |
| npm | tinypool | 1.1.1 | indirecta |
| npm | tinyrainbow | 2.0.0 | indirecta |
| npm | tinyspy | 4.0.4 | indirecta |
| npm | to-regex-range | 5.0.1 | indirecta |
| npm | toidentifier | 1.0.1 | indirecta |
| npm | ts-algebra | 2.0.0 | indirecta |
| npm | ts-api-utils | 2.5.0 | indirecta |
| npm | type-check | 0.4.0 | indirecta |
| npm | type-is | 2.0.1 | indirecta |
| npm | typescript | 5.9.3 | indirecta |
| npm | typescript | ^5.4.0 | indirecta |
| npm | undici-types | 7.19.2 | indirecta |
| npm | universalify | 0.1.2 | indirecta |
| npm | unpipe | 1.0.0 | indirecta |
| npm | uri-js | 4.4.1 | indirecta |
| npm | vary | 1.1.2 | indirecta |
| npm | vite | 7.3.2 | indirecta |
| npm | vite-node | 3.2.4 | indirecta |
| npm | vitest | 3.2.4 | indirecta |
| npm | which | 2.0.2 | indirecta |
| npm | why-is-node-running | 2.3.0 | indirecta |
| npm | word-wrap | 1.2.5 | indirecta |
| npm | wrap-ansi | 7.0.0 | indirecta |
| npm | wrap-ansi | 8.1.0 | indirecta |
| npm | wrappy | 1.0.2 | indirecta |
| npm | yocto-queue | 0.1.0 | indirecta |
| npm | zod-to-json-schema | 3.25.2 | indirecta |
Avisos de dependencias 2
Instalar npm:@bookedsolid/rea@0.53.0 arrastra 115 paquetes, directos y transitivos: 2 tienen avisos conocidos, de los cuales 1 son dependencias directas.
| Paquete | Versión | Relación | Gravedad | Avisos | Corregido en |
|---|---|---|---|---|---|
| @anthropic-ai/sdk | 0.90.0 | directa | moderada | 1 | 0.91.1 |
| @hono/node-server | 1.19.15 | indirecta | moderada | 1 | 2.0.5 |
Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.
Informe JSON sin procesar legible por máquina
{
"data": {
"repo": {
"topics": [
"ai-safety",
"claude-code",
"mcp",
"typescript",
"agentic-ai",
"ai-agents",
"ai-governance",
"anthropic",
"anthropic-claude",
"audit-log",
"developer-tools",
"guardrails",
"llm-guardrails",
"llm-security",
"mcp-gateway",
"mcp-server",
"model-context-protocol",
"policy-enforcement",
"prompt-injection",
"zero-trust"
],
"is_fork": false,
"size_kb": 6137,
"has_wiki": true,
"homepage": "https://github.com/bookedsolidtech/rea",
"languages": {
"Shell": 1150201,
"JavaScript": 115739,
"TypeScript": 6300156
},
"pushed_at": "2026-07-20T04:44:53Z",
"created_at": "2026-04-18T13:25:28Z",
"owner_type": "Organization",
"updated_at": "2026-07-19T16:19:31Z",
"description": "Zero-trust governance layer for Claude Code. Policy-enforced MCP gateway with autonomy controls, middleware chain, audit log, HALT kill-switch, and prompt-injection defense.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript",
"Shell"
]
},
"owner": {
"blog": "https://bookedsolid.tech",
"name": "bookedsolid.tech",
"type": "Organization",
"login": "bookedsolidtech",
"company": null,
"location": "United States",
"followers": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/264567912?v=4",
"created_at": "2026-02-28T05:35:56Z",
"is_verified": null,
"public_repos": 10,
"account_age_days": 149
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.53.0",
"kind": "minor",
"published_at": "2026-07-19T16:20:25Z"
},
{
"tag": "v0.52.0",
"kind": "minor",
"published_at": "2026-07-19T11:20:56Z"
},
{
"tag": "v0.51.0",
"kind": "minor",
"published_at": "2026-07-05T21:10:06Z"
},
{
"tag": "v0.50.0",
"kind": "minor",
"published_at": "2026-07-01T12:03:25Z"
},
{
"tag": "v0.49.1",
"kind": "patch",
"published_at": "2026-05-20T03:28:57Z"
},
{
"tag": "v0.49.0",
"kind": "minor",
"published_at": "2026-05-19T18:49:15Z"
},
{
"tag": "v0.48.1",
"kind": "patch",
"published_at": "2026-05-18T02:51:15Z"
},
{
"tag": "v0.48.0",
"kind": "minor",
"published_at": "2026-05-18T01:27:10Z"
},
{
"tag": "v0.47.0",
"kind": "minor",
"published_at": "2026-05-17T21:19:45Z"
},
{
"tag": "v0.46.0",
"kind": "minor",
"published_at": "2026-05-17T18:42:48Z"
},
{
"tag": "v0.45.0",
"kind": "minor",
"published_at": "2026-05-17T17:51:10Z"
},
{
"tag": "v0.44.0",
"kind": "minor",
"published_at": "2026-05-17T13:36:02Z"
},
{
"tag": "v0.43.0",
"kind": "minor",
"published_at": "2026-05-17T12:49:53Z"
},
{
"tag": "v0.42.0",
"kind": "minor",
"published_at": "2026-05-17T04:01:26Z"
},
{
"tag": "v0.41.0",
"kind": "minor",
"published_at": "2026-05-17T01:35:45Z"
},
{
"tag": "v0.40.0",
"kind": "minor",
"published_at": "2026-05-17T00:13:31Z"
},
{
"tag": "v0.39.0",
"kind": "minor",
"published_at": "2026-05-16T23:32:55Z"
},
{
"tag": "v0.38.1",
"kind": "patch",
"published_at": "2026-05-16T21:52:00Z"
},
{
"tag": "v0.38.0",
"kind": "minor",
"published_at": "2026-05-16T21:30:08Z"
},
{
"tag": "v0.37.0",
"kind": "minor",
"published_at": "2026-05-16T20:24:49Z"
},
{
"tag": "v0.36.0",
"kind": "minor",
"published_at": "2026-05-16T18:03:06Z"
},
{
"tag": "v0.35.0",
"kind": "minor",
"published_at": "2026-05-16T14:35:46Z"
},
{
"tag": "v0.34.0",
"kind": "minor",
"published_at": "2026-05-16T12:59:14Z"
},
{
"tag": "v0.33.0",
"kind": "minor",
"published_at": "2026-05-15T22:13:01Z"
},
{
"tag": "v0.32.0",
"kind": "minor",
"published_at": "2026-05-15T18:16:16Z"
},
{
"tag": "v0.31.0",
"kind": "minor",
"published_at": "2026-05-15T03:31:13Z"
},
{
"tag": "v0.30.1",
"kind": "patch",
"published_at": "2026-05-15T01:21:26Z"
},
{
"tag": "v0.30.0",
"kind": "minor",
"published_at": "2026-05-13T12:43:34Z"
},
{
"tag": "v0.29.0",
"kind": "minor",
"published_at": "2026-05-13T03:38:45Z"
},
{
"tag": "v0.28.2",
"kind": "patch",
"published_at": "2026-05-13T01:21:47Z"
},
{
"tag": "v0.28.1",
"kind": "patch",
"published_at": "2026-05-09T21:29:17Z"
},
{
"tag": "v0.28.0",
"kind": "minor",
"published_at": "2026-05-05T21:28:06Z"
},
{
"tag": "v0.27.0",
"kind": "minor",
"published_at": "2026-05-05T18:58:01Z"
},
{
"tag": "v0.26.1",
"kind": "patch",
"published_at": "2026-05-05T16:11:24Z"
},
{
"tag": "v0.26.0",
"kind": "minor",
"published_at": "2026-05-05T14:46:29Z"
},
{
"tag": "v0.25.0",
"kind": "minor",
"published_at": "2026-05-05T03:13:17Z"
},
{
"tag": "v0.24.0",
"kind": "minor",
"published_at": "2026-05-05T02:15:17Z"
},
{
"tag": "v0.23.1",
"kind": "patch",
"published_at": "2026-05-05T01:48:01Z"
},
{
"tag": "v0.23.0",
"kind": "minor",
"published_at": "2026-05-04T23:07:43Z"
},
{
"tag": "v0.22.0",
"kind": "minor",
"published_at": "2026-05-04T03:46:08Z"
},
{
"tag": "v0.21.1",
"kind": "patch",
"published_at": "2026-05-04T03:17:33Z"
},
{
"tag": "v0.21.0",
"kind": "minor",
"published_at": "2026-05-04T03:01:21Z"
},
{
"tag": "v0.20.0",
"kind": "minor",
"published_at": "2026-05-04T02:35:01Z"
},
{
"tag": "v0.19.0",
"kind": "minor",
"published_at": "2026-05-04T02:03:44Z"
},
{
"tag": "v0.18.0",
"kind": "minor",
"published_at": "2026-05-04T01:49:49Z"
},
{
"tag": "v0.17.0",
"kind": "minor",
"published_at": "2026-05-03T23:53:16Z"
},
{
"tag": "v0.16.4",
"kind": "patch",
"published_at": "2026-05-03T23:17:37Z"
},
{
"tag": "v0.16.3",
"kind": "patch",
"published_at": "2026-05-03T23:09:28Z"
},
{
"tag": "v0.16.2",
"kind": "patch",
"published_at": "2026-05-03T22:20:47Z"
},
{
"tag": "v0.16.1",
"kind": "patch",
"published_at": "2026-05-03T22:08:54Z"
},
{
"tag": "v0.16.0",
"kind": "minor",
"published_at": "2026-05-03T21:14:58Z"
},
{
"tag": "v0.15.0",
"kind": "minor",
"published_at": "2026-05-03T20:32:20Z"
},
{
"tag": "v0.14.0",
"kind": "minor",
"published_at": "2026-05-03T19:08:04Z"
},
{
"tag": "v0.13.3",
"kind": "patch",
"published_at": "2026-05-03T16:31:12Z"
},
{
"tag": "v0.13.2",
"kind": "patch",
"published_at": "2026-05-03T16:24:58Z"
},
{
"tag": "v0.13.1",
"kind": "patch",
"published_at": "2026-05-03T15:59:10Z"
},
{
"tag": "v0.13.0",
"kind": "minor",
"published_at": "2026-04-29T18:11:50Z"
},
{
"tag": "v0.12.0",
"kind": "minor",
"published_at": "2026-04-29T14:22:57Z"
},
{
"tag": "v0.11.0",
"kind": "minor",
"published_at": "2026-04-23T02:19:25Z"
},
{
"tag": "v0.10.3",
"kind": "patch",
"published_at": "2026-04-22T19:53:04Z"
},
{
"tag": "v0.10.2",
"kind": "patch",
"published_at": "2026-04-22T19:13:47Z"
},
{
"tag": "v0.10.1",
"kind": "patch",
"published_at": "2026-04-22T16:35:08Z"
},
{
"tag": "v0.10.0",
"kind": "minor",
"published_at": "2026-04-21T22:21:09Z"
},
{
"tag": "v0.9.4",
"kind": "patch",
"published_at": "2026-04-21T19:22:16Z"
},
{
"tag": "v0.9.3",
"kind": "patch",
"published_at": "2026-04-21T18:10:54Z"
},
{
"tag": "v0.9.2",
"kind": "patch",
"published_at": "2026-04-21T11:29:20Z"
},
{
"tag": "v0.9.1",
"kind": "patch",
"published_at": "2026-04-21T03:53:04Z"
},
{
"tag": "v0.9.0",
"kind": "minor",
"published_at": "2026-04-21T02:03:49Z"
},
{
"tag": "v0.8.0",
"kind": "minor",
"published_at": "2026-04-21T00:13:02Z"
},
{
"tag": "v0.7.0",
"kind": "minor",
"published_at": "2026-04-20T23:02:05Z"
},
{
"tag": "v0.6.2",
"kind": "patch",
"published_at": "2026-04-20T16:51:32Z"
},
{
"tag": "v0.6.1",
"kind": "patch",
"published_at": "2026-04-20T14:03:22Z"
},
{
"tag": "v0.6.0",
"kind": "minor",
"published_at": "2026-04-20T00:13:31Z"
},
{
"tag": "v0.5.0",
"kind": "minor",
"published_at": "2026-04-19T21:19:26Z"
},
{
"tag": "v0.4.0",
"kind": "minor",
"published_at": "2026-04-19T12:17:41Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2026-04-18T23:35:53Z"
},
{
"tag": "v0.2.1",
"kind": "patch",
"published_at": "2026-04-18T22:38:28Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-04-18T22:32:26Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-04-18T15:35:35Z"
}
],
"recent_commits": [
{
"oid": "0d2206b56efb80d788aa292630371c9abeb45891",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#222)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-07-19T16:19:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a406c0140ddbd80ed112226183c54926c2dda540",
"body": "…LI, no node_modules pin (0.53.0) (#221)\n\nFOUNDATIONAL: global-first is now THE install model. Projects run rea via the\nglobal CLI / npx and own their .rea/ + command files (commit or ignore); the\nnode_modules pin is opt-in only. Closes the gap BST hit — a dep-free global-tier\ncheckout can now `rea \n[…]\nnd\nglobal-first. Full suite 16138 green; two adversarial review rounds resolved\n(data-loss on removed-upstream; brick-safety on the no-pin default).\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>",
"is_bot": false,
"headline": "feat(install): global-first model — projects run rea via the global C…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-07-19T16:18:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f4ab22d2f3a4ccb134a6c10e20184b2a1db441e2",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#219)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-07-19T11:19:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2caf7a83477a5bb13f3df4f3ef4171bdc7e4cf40",
"body": "…ate fail-open hardening (#220)\n\n* feat(worktree): dual-root resolver + payload cwd + repo-wide HALT probe\n\nFoundation for worktree-aware .rea state (fixes multi-stream clobbering\nof the review file and split-brain gate reads):\n\n- src/lib/worktree-roots.ts: resolveLocalRoot (git toplevel → nearest-\n\n[…]\n requires statSync().isFile() AND 'git cat-file -t' == blob.\n- 4 tests (blank-evidence detect + CLI, no-deadlock transition, dir-spec block).\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>\n\n* f…",
"is_bot": false,
"headline": "feat: Artifact Gates G1–G3 + Spine Distribution, rea dash, and full g…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-07-19T11:18:13Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f59fce48f3e033e5ad32a8a70b4598ed83b7e07d",
"body": "PRs #215 (denial-of-wallet) and #210 (OpenRouter provider) both claimed\nTHREAT_MODEL §5.25 — a collision flagged in #215's own numbering note and\nrealized when both merged. The OpenRouter lane is now §5.26/§5.26a; the\ndenial-of-wallet section keeps §5.25. Cross-references updated in the\nthreat-model\n[…]\nbase_url contract, types.ts data-policy doc,\nreview-openrouter.ts egress disclosure). Denial-of-wallet §5.25 refs are\nuntouched. No behavior change.\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>",
"is_bot": false,
"headline": "docs(threat-model): renumber OpenRouter sections to 5.26/5.26a (#218)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-07-10T05:05:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "18770ae0469798a64f8461beb64be134a843c7ab",
"body": "* feat(review): codex model ladder + errored-run silent-pass fix\n\nTwo coupled review-quality fixes (0.52.0):\n\nSILENT-PASS FIX. codex exits 0 even when the run FAILED via a streamed\n{\"type\":\"error\",...} event — observed live: an unsupported model returns a\n400 invalid_request_error event and still ex\n[…]\nts late error listener nulls only itself\n (identity-checked), never the replacement.\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>\n\n---------\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>",
"is_bot": false,
"headline": "feat(review): codex model ladder + errored-run silent-pass fix (#217)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-07-10T04:51:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "46a6b42f6d52ab67653dd462e3c316f039bdbd7b",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#214)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-07-05T21:09:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e86fdc1d62074a9b01302a57cb0a4154f854c07",
"body": "…guard) (#210)\n\n* docs(migrating): add reagent->rea package transition section\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\n\n* feat(policy): review provider selection + openrouter schema\n\nAdds policy.review.provider ('codex' | 'openrouter' | 'both'),\nreview_granularity ('auto' | 'pe\n[…]\nawn@gmail.com>\n\n---------\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(review): OpenRouter review provider (shadow lane, external-send …",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-07-05T20:53:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "39b70ff984f978b47d95c4cefa207a71ac09a270",
"body": "…registry read (#216)\n\nTwo degraded-path gaps in the 0.50.0 opt-in global-CLI tier (codex #211):\n\n- P1 (hooks/_lib/shim-runtime.sh): shim_global_tier_vetoed treated any\n valid-object runtime block as veto-clean, but the strict loader also\n rejects a runtime block carrying keys outside RuntimePolic\n[…]\nly, BEFORE reading.\n\nTests: veto strict-shape (extra-key/unknown-key/array → VETOED; valid /\nempty object → ALLOWED); trust unsafe-registry refusal.\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>",
"is_bot": false,
"headline": "fix(global-cli): fail-closed on schema-invalid runtime + guard trust …",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-07-05T01:20:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "395884c9528c4de960d371352ca6fb70faeb1c77",
"body": "…7-04) (#215)\n\n* feat(policy): spend_governance axis + denial-of-wallet threat class\n\nFirst slice of the spend-governance work responding to INCIDENT-2026-07-04\n(denial-of-wallet on a metered TTS lane): rea had no concept of money in\nits policy schema, hooks, or threat model, so no control could fir\n[…]\nload beyond 32 MiB is treated as malformed\n(no-op, fail-safe), the accepted residual.\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>\n\n---------\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>",
"is_bot": false,
"headline": "feat(spend-governance): billing→HALT reflex (E1 seed, INCIDENT-2026-0…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-07-05T01:11:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1f0ace8035766b625cd4c75ebc9947e5f558671b",
"body": "checkCommitMsgHook hardcoded .git/hooks/commit-msg while its sibling\nchecks (prepare-commit-msg, pre-push) resolve the active hooks dir via\ncore.hooksPath -> git rev-parse --git-path hooks -> .git/hooks. A repo\nwired through core.hooksPath=.husky — where git actually runs\n.husky/commit-msg and the a\n[…]\n the hook git actually\nexecutes. A commit-msg left at the default location while hooksPath\npoints elsewhere now correctly warns (git never runs it).\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>",
"is_bot": false,
"headline": "fix(doctor): resolve active hooks dir in commit-msg hook check (#213)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-07-05T00:40:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "54466162d69a9186cc7a4b17cab8a0a692a6fd3c",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#212)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-07-01T12:02:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1c25bb831aeff51a95df38749c0da8296b6c3c3a",
"body": "Add a passwd-derived, registry-gated global CLI tier so a developer can\n`rea install --global` once and govern a checkout WITHOUT adding\n@bookedsolid/rea to a shared package.json. Off by default; in-project\nresolution always wins; an un-blessed project is byte-identical to\nfeature-absent.\n\nResolver \n[…]\nal sibling-class sweep;\ncodex review laddered to non-blocking over 6 rounds.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(global-cli): opt-in global rea CLI resolution tier (#211)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-07-01T11:49:15Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "41bddc15096937f8c02a94f6a95d22df445b5eb1",
"body": "Signed-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "docs(migrating): add reagent->rea package transition section (#203)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-20T04:35:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "67ae3b3dda15f39f3a8d3be9b3b234f0960bef7d",
"body": "…shing (#202)\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "fix(release): pin npm to 11.5.1 in publish job for OIDC trusted publi…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-20T03:27:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b2859087addca0dfcee52d1bb5b130177cb850e3",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#201)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-20T01:44:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "70c2396672284d1c16e16fe6698414c14c6ac0ea",
"body": "Signed-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "chore: migrate publish to npm Trusted Publishing (OIDC) (#200)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-20T01:42:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bed5107a5aefa2f40b0f5230fe03e8a0d283d324",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#199)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-19T18:48:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8a980bbab867e0aa1b845659be8e7e8034c47f1f",
"body": "Fixes the consumer self-brick scenario where `rea init` writes hook\nshims that depend on `@bookedsolid/rea` but doesn't add the dep to\n`package.json`. Any fresh clone + `pnpm install` produces a repo\nwhere the shims refuse 100% of Bash calls including the very `pnpm\nadd -D @bookedsolid/rea` that wou\n[…]\nnch, NOT replacing it.\n\nSee THREAT_MODEL.md §5.23 for the full threat model.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.49.0): rea init self-pin + bash-gate bootstrap allowlist (#198)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-19T18:35:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f6f6f5a96ede9a70feb2fb262febeae3c0e4697b",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#196)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-18T02:50:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e0d6147ca8a1474786b23b706862388920a31dea",
"body": "Patch follow-up to 0.48.0's per-session shim cache. Closes the\nsoundness gap, two parser gaps, and the pre-sandbox traversal\nregression — plus two P2s codex flagged on the first cut.\n\n1. SOUNDNESS — skip cache writes when version probe was bypassed.\n The cache-write block now also gates on SHIM_SK\n[…]\nfood mirror + template-\nstaged copies updated for both files. Tests +412/-0.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "fix(0.48.1): close four shim-cache deferrals from 0.48.0 (#195)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-18T02:38:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ffc841ca41577b4c241101f660becad53cd23d82",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#194)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-18T01:26:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "261a0b318982625db80a7341b1e3572d3de87f2b",
"body": "…e (#193)\n\nCaches the result of the realpath sandbox check + CLI version probe across\nmultiple shim invocations within a single Claude Code session. Each shim\ncurrently re-runs both on every hook fire; in steady state this caches them\nto ~80-150ms warm-hit vs cold sandbox+probe.\n\nCache contract (ful\n[…]\nrites when SHIM_SKIP_VERSION_PROBE bypassed probe\n\n48th release of marathon.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.48.0): per-session shim cache for sandbox check + version prob…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-18T01:15:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "565055200cc977651418a97a474c5790f37ac157",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#192)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T21:18:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4c7a0792d5fe25f8ef31557ab12ead9287c4639c",
"body": "…ergonomics (#191)\n\nThree items close out the audit observability surface 0.46.0 opened:\n\n1. `rea audit timeline` helpful MAX_BUCKETS errors (0.46.0 round-2 P2 #1).\n The 2000-bucket overflow guard now computes concrete remediation\n inline — wider-bucket and narrower-since suggestions — instead o\n[…]\nseline 14,601 + 35 new tests across timeline overflow + clamp +\ntop-blocks).\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.47.0): audit observability completion — top-blocks + timeline …",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T21:08:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0a9968d78fb63097547cad8cdc6f59858f222c32",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#190)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T18:41:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5649a66d7a7b3788c8769c033c301a89520abdf3",
"body": "…ofile-hooks fidelity (#189)\n\nCharter:\n\n1. `rea audit by-tool [--top=N] [--since=DUR] [--json]` — higher-fidelity\n tool_name distribution than `audit summary` (which caps at 12 +\n `(other)`). `--top=N` (default 20, max 1000) controls the visible\n cut; long-tail summarized inline. Stable JSON s\n[…]\nound 1: verdict concerns → all 3 findings (2× P2 + 1× P3)\naddressed in-tree.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.46.0): audit observability expansion (by-tool + timeline) + pr…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T18:33:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9542b138fc4eb5e15feff10836be7c99783ef8ad",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#188)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T17:50:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "53124b68ceb5e0b20b8b5062ea42825f291cd68c",
"body": "Adds the measurement harness for hook latency, closes two polish\nitems deferred from 0.44.0, and absorbs codex round-1 (P1 + 2x P2)\nand round-2 (3x P2) in-tree before commit.\n\nHook hot-path profiling pass\n- scripts/profile-hooks.mjs measures per-shim wall-clock latency\n under a synthetic non-blocki\n[…]\nntrols, active probe cleanup, conservative-on-failure, and\n umask immunity.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.45.0): hook hot-path profiling + 0.44 round-2 polish (#187)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T17:40:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2327a0d9776a1c775649053f2e5fdaf17c138188",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#186)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T13:35:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "109460ffbfdc40354410d6754ba016dee7fcc8da",
"body": "…185)\n\nThree deliverables:\n\n1. Install summary derives its hook listing from the canonical\n resolvers (EXPECTED_HOOKS + defaultDesiredHooks) via the new\n canonicalInstalledHooks() helper in src/cli/init.ts. Pre-fix the\n summary hard-coded the listing, so adding a hook to either source\n silen\n[…]\nnot apply there.\n\nAll 4 gates green. Vitest 14,534 passed (was 14,501; +33).\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.44.0): init polish completion + hook playbook reference doc (#…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T13:27:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "99cc24011b570afae53309e526065bc0d4b365ef",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#184)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T12:49:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "613cb2a3c80d8d38ed24cf936cf8102ad65f63da",
"body": "UX pass on `rea init` — the first-impression surface every consumer hits:\n\n- Re-run banner at top of wizard distinguishes \"Re-running init\"\n (preserves your edits) from \"Fresh install\" so operators see upfront\n what mode they're in instead of inferring from a single prompt label.\n- Prompt copy ref\n[…]\n no new policy keys, no behavioral change to the hook\nladder or audit shape.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.43.0): rea init clack flow polish + round-7 P3 (#183)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T12:38:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "34503c74682c4aeaaf5e3ce61489b21a01a7f71a",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#182)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T04:00:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8d0d858929381566ed35473d5948f898be7dfc8f",
"body": "Closes 3 P2 deferrals from 0.40.0 + 0.41.0 and refreshes MIGRATING.md\nto cover the 9-release drift accumulated during the hook-port\nmarathon (0.32→0.41).\n\n1. Tier-3 list-walker uses Tier 2's full reachability (0.40.0 round-2 P2)\n - `checkPolicyReaderTier3` now requires `python3 + PyYAML` (Tier 2\n \n[…]\n +50 tests (143 total in the targeted\nsuites). All 14,489 vitest tests pass.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.42.0): deferred P2 sweep + MIGRATING.md cumulative refresh (#181)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T03:50:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "39d18df74222b34b0c5d6505a41545aa5ef32a7a",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#180)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T01:34:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f0c7d53cd672d0908db3a754b55fad07ee6b2e38",
"body": "…README refresh (#179)\n\nThree consumer-facing items after the hook-port marathon (0.32→0.35)\nand five hardening/polish releases (0.36→0.40):\n\n1. `rea upgrade --check` (dry-run preview)\n New non-interactive preview mode for `rea upgrade`:\n rea upgrade --check # text summary + unifi\n[…]\nleanly; `rea\nupgrade --check` correctly reports 0 changes against canonical.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.41.0): consumer-UX bundle — upgrade --check + audit summary + …",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T01:25:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1597e22ebec8429d78e0ab292c91af40cfc6017d",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#178)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T00:12:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3a7a08538aeefe8c6fc6eec88a04904419808571",
"body": "Three deferred fixes bundled into one minor.\n\n1. Race fix in `sessionHasRealDelegation` poll-and-backoff.\n `delegation-capture.sh` fire-and-forgets `rea hook\n delegation-signal --detach &` for sub-50ms PreToolUse latency.\n Pre-fix, a write-class call landing in the narrow window before\n the \n[…]\n test for the python3 probe.\n\nGates: type-check + lint clean; build clean.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.40.0): delegation-telemetry race + doctor polish (#177)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-17T00:02:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "23e4a5346f1b4697bda2220e8af4a5023206ed66",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#176)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T23:32:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f68bcae5d84ca680918c543a59c6f03be0bb94a1",
"body": "…chability (#175)\n\nAdds five new `rea doctor` checks that report which tiers of the\n0.37.0 `hooks/_lib/policy-reader.sh` ladder are reachable in the\noperator's environment. Pre-0.39.0 operators had no way to see\nwhether their shims would silently no-op flow-form policy\n(`local_review: { mode: off }`\n[…]\n bash-vs-Node parity guarantees still need\nthe original bash bodies present.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.39.0): policy-reader doctor checks — surface 4-tier ladder rea…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T23:22:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7d491b8b4c460e5a812c729824036a90cf809354",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#174)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T21:51:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58fc565cdc58b18b02bb4b212c5c0fa8b685af95",
"body": "…sent (#173)\n\nRound-2 P2 from 0.38.0 codex review.\n\nPre-fix, when `node` was absent on the consumer's PATH, the shim-runtime\nexited 2 (blocking-tier) or 0 (advisory-tier) IMMEDIATELY without ever\ncalling shim_policy_short_circuit. A blocking-tier shim whose policy\nsaid \"disabled\" still refused — con\n[…]\ner + exit 2\n- advisory + disabled + no node → exit 0\n\n14,380 vitest passing.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "fix(0.38.1): preserve disabled-policy short-circuit when `node` is ab…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T21:41:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8beaddde59b2377edcdb347d00f7b079fdaf601d",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#172)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T21:29:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4516d703c92d738644bf6317943bcd9983269de1",
"body": "…runtime (#171)\n\nReleases 0.32.0 to 0.35.0 ported all 14 PreToolUse/PostToolUse hooks\nfrom bash to Node-binary CLIs. Each port left a ~120-LOC shell shim\nthat did the same five things: HALT check, stdin capture, 2-tier\nsandboxed CLI resolution, realpath sandbox check, version probe +\nforward. The du\n[…]\n_lib_shim-runtime.dogfood-staged.sh for the operator to\napply via git apply.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.38.0): extract _lib/shim-runtime.sh — shared Node-binary shim …",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T21:21:40Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b2f1a0af38483483d07439cf0de0148fa9b21ca0",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#170)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T20:23:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "657e93540d7726175993631eb1dcb56357133882",
"body": "…on reader) (#169)\n\nNew shared helper `hooks/_lib/policy-reader.sh` consolidates per-shim\nYAML parsers that grew ad-hoc across 0.34.0/0.35.0 into a single\n4-tier ladder:\n\n 1. `rea hook policy-get` (canonical TS loader — all forms)\n 2. python3 with PyYAML (flow + block form, YAML-1.2 boolean\n s\n[…]\nt:regex`,\n`lint:awk-quotes`, `tsc`, and `vitest` (14332 pass) are all green.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.37.0): unified shim policy-fallback (4-tier graceful-degradati…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T20:14:55Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "234e3a1e901343dff740cedc2d423e03302f7ef7",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#168)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T18:02:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c44bd439a125cdebf45ef6ff11b52655dadc40c0",
"body": "Closes deferred 0.31.0 charter follow-throughs, the static-analysis\nlint that would have caught 0.34.0 round-4 + round-6 at build time,\nand the two P2 findings from 0.34.0 codex round-7.\n\n# Item 1: delegation-advisory.sh promoted to EXPECTED_HOOKS\n\nCharter follow-through from 0.31.0. After 4 release\n[…]\n)\n - pnpm build PASS\n\n# Deferrals\n\nNone. All 5 charter items shipped.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.36.0): marathon follow-up hardening — 5 charter items (#167)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T17:55:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "34317434476a51f09f1a5233d505322a491956a2",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#166)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T14:34:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e09459a23113e67d3f627975ca1258983f011c34",
"body": "…ed ports (MARATHON COMPLETE) (#165)\n\nThis release closes out the bash-hook port marathon. After 0.35.0 lands,\nall 14 hooks are Node-binary:\n- 0.32.0: 3 pilots (pr-issue-link-gate, security-disclosure-gate, attribution-advisory)\n- 0.33.0: 4 advisory ports (env-file-protection, dependency-audit-gate,\n[…]\nipline. The hook playbook\nis fully proven and reusable for any future hooks.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.35.0): Node-binary hook playbook — final 4 paired scanner-back…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T14:25:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8e203b8e2dad72e866e83f4fa31395c1dc520e10",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#164)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T12:58:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "adb347bfa8d26f5e96916ea0c89410f225771e9c",
"body": "…ports (#163)\n\nContinues the 0.32.0 / 0.33.0 playbook with the tier-2 batch:\ndangerous-bash-interceptor, local-review-gate, secret-scanner.\nThese three are the highest-stakes ports per-hook (security-critical\nenforcer logic with extensive bypass corpora pinned across the\n0.13–0.27 cycle). The migrat\n[…]\ncked-paths-enforcer,\n blocked-paths-bash-gate, protected-paths-bash-gate.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.34.0): Node-binary hook playbook — 3 tier-2 medium-complexity …",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-16T12:49:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d78a4ea6db40de8a897c831505becc21031407c2",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#162)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-15T22:12:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "527df24858eeb2b5a8fbf14a6d8836249e869f97",
"body": "…rpose ports (#161)\n\nContinues the 0.32.0 Phase 1 playbook with the lowest-risk batch:\nenv-file-protection, dependency-audit-gate, changeset-security-gate,\narchitecture-review-gate. Pure mechanical application of the\nplaybook — archive bash baseline, port body to src/hooks/<name>/\nindex.ts using the\n[…]\nes) passes against the new shims\n\n13,901 vitest passing (+~144 from 0.32.0).\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.33.0): Node-binary hook playbook — 4 tier-1 advisory/single-pu…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-15T22:02:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f2feafaba7eecfc189b775dc54fd3c93ac8c05e5",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#160)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-15T18:15:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "75abfe352fabf02802a31c17eeccb660e873d62e",
"body": "…ion surface (#159)\n\nPhase 0: shared hook primitives under src/hooks/_lib/ — halt-check.ts\n(checkHalt + formatHaltBanner, fail-CLOSED on read errors), payload.ts\n(parseHookPayload with fail-closed type guards, readStdinWithTimeout\nwith 1 MiB cap + 5s timeout), segments.ts (quote-aware splitter with\n\n[…]\nCK_TESTS=1 for inner-loop speed; CI runs without.\n\n13,788 tests pass (+392).\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.32.0): Node-binary hook playbook — Phase 0 + 3 pilots + extens…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-15T18:06:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ff59bcc73f7785a325adecba531673d11ff007e4",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#158)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-15T03:30:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a29fcf2be5ace80551df25c70b1a63a83b9f31b0",
"body": "…scovery + audit-specialists flags (#157)\n\n0.29.0 shipped the delegation-telemetry observability layer (the\nAgent|Skill PreToolUse capture hook + `rea audit specialists` reader).\n0.31.0 closes the loop with the nudge plus five supporting surfaces.\n\n1. delegation-advisory.sh PostToolUse hook + `rea h\n[…]\nip + advisory-registration checks. All 4 gates green; 13,647\nvitest passing.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.31.0): delegation-telemetry completion — the nudge + roster di…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-15T03:15:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cd2a6413437aaf49970fdc06187cdd5b863b492c",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#156)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-15T01:20:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a09f94f9b67302e799085848ae0d8f7521d28806",
"body": "…solution, fail-closed augmenter, control-char name guard (#155)\n\nCloses the four CONCERNS-level P2 findings from 0.30.0's codex round 5.\n\n1. rea doctor --strict now selects SettingsSchemaStrict via\n validateSettings(input, { strict: true }). The strict schema shipped\n in 0.30.0 but validateSett\n[…]\nmsg-augmenter, and doctor test suites. 13,569 vitest\npassing. 4 gates green.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "fix(0.30.1): round-5 P2 hardening sweep — strict schema, hooks-dir re…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-15T00:05:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4ac78ee98a7ddc3f5ed578a0883becdaf3ef1d0a",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#154)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-13T12:42:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a0bab9e296509578b79b2bfe816ce8fbc7356796",
"body": "…M settings schema + 0.29.0 dogfood drift closure (#153)\n\nBundles three workstreams under one theme: attribution surface modernization.\n\n# A — Husky prepare-commit-msg augmenter\n\nNew .husky/prepare-commit-msg hook (rea-marker v1) adds a configurable\n trailer to every commit when\npolicy.attribution.c\n[…]\n- Schema migration safety timestamp >= installed_at for delegation\n signals\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.30.0): attribution surface — Co-Authored-By augmenter + Class …",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-13T12:33:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "57b531b5b016711bcfc78408ac8a2be22804c595",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#152)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-13T03:37:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a764af1cbcb941f3bf11cd915641dc5459ffc175",
"body": "…es (#151)\n\nAdds a new PreToolUse hook on matcher Agent|Skill that records every\nsubagent dispatch and skill invocation into the existing .rea/audit.jsonl\nhash chain. The signal is observational only — never gates tool\ndispatch and never fails the hook. Six surfaces ship together:\n\n1. Event schema (\n[…]\nflag. Deferred to 0.30.0:\nschema-migration safety, doctor promotion to fail.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.29.0): delegation-telemetry MVP — observe Agent/Skill dispatch…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-13T03:28:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "00b7db2b6b90b888c08b3e29d0cf763db06a4c19",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#150)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-13T01:21:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c7d9ebb563b673c2ba9a5c3472cb33ab96b06e96",
"body": "…or self-review (#149)\n\nBundle release: security hotfix for the Write-tier /./ bypass class,\nrelease-pipeline hardening for npm CDN propagation lag, and a brief\namendment to the orchestrator self-review brief. Bundled with the\ndefect-V finding-text gap from 0.28.1.\n\nA — /./ Write-tier bypass closure\n[…]\nest 13,435\npass, build). Codex local review at gpt-5.4/high PASS 0 findings.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "fix(0.28.2): close /./ Write-tier bypass + npm CDN retry + orchestrat…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-13T01:19:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2b1a8913ba10eca7c051f412f3db1cc99e7d150a",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#146)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-09T21:28:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b79ae5d181e5562b2eb629d9adc406689d68f403",
"body": "rea review now exposes finding bodies through three documented surfaces:\n\n1. .rea/last-review.json is written on every successful codex run\n (pass/concerns/blocking) via the push-gate's canonical atomic writer,\n inheriting redaction. Stale snapshots from prior push-gate runs are\n eliminated; e\n[…]\nno file, and\nsecret redaction verified end-to-end through the review writer.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "fix(review): close defect-V agent-blocking finding-text gap (#145)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-09T21:17:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d36379428351d173801e7d8949f899ed16566c3c",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#144)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T21:27:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "07c5eb062cb25b9ca03cd8dba57b44ea82a273cb",
"body": "…lter (#143)\n\nPrincipal-engineer trimmed an 11-item plate to 6 surgical items.\nverify-claim is the centerpiece — the 4th structural pivot, closing\nhelix's recurring SHA-of-shims methodology error class permanently.\n\nverify-claim CLI (centerpiece, 4th pivot)\n- New `rea verify-claim <claim-id> [--inst\n[…]\n string seam working),\nsmart-test-cycle pattern, orchestrator hard-refusal).\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.28.0): verify-claim CLI + 5 helix closures + helix-029 path fi…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T21:18:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e5f1f63d649035c2215719982869129197faea60",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#142)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T18:57:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "756a6b963f0ed2a3136c706df555597b0f38c0c0",
"body": "…w pattern (#141)\n\nRoster expansion + helix-031 P3 + structural codex-invocation fix.\n\nWave 3 specialists (5 agents per CTO eval 2026-05-04):\n- ast-parser-specialist — mvdan-sh AST + walker patterns\n- shell-scripting-specialist — POSIX + bash 3.2 + awk portability\n- adversarial-test-specialist — byp\n[…]\nnts/, hooks/_lib/\n<-> .claude/hooks/_lib/, commands/ <-> .claude/commands/).\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.27.0): Wave 3 specialists + figma-dx + helix-031 + codex-revie…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T18:50:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "13d37cba1174f3118a98fb5119e2a9408ac24997",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#140)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T16:10:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5de5bd2268a4afbf4c9aa069566b6fc91fe7bd4f",
"body": "…139)\n\nhelix-028 reopened the nested-shell bypass class for protected-paths,\nblocked-paths, and force-push gates by exploiting two related defects:\n\n1. cmd-segments.sh _rea_unwrap_nested_shells passed wrapped command +\n masked form through awk -v, which fails (newline-in-string) on any\n multilin\n[…]\n3,288 in 0.26.0 -> +50). All 6\nquality gates green. Mirror discipline clean.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "fix(0.26.1): close helix-028 multiline awk + ANSI-C bypass classes (#…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T16:03:37Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "59fd22c031c2a9f3946598665da1f5b0969cfde6",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#138)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T14:45:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d3a3520dfc766d0857ea397dee86f70117bccd61",
"body": "… (#137)\n\nThree-layer enforcement of the local-first codex-review pattern, codifying\nthe soft contract (memory rule + orchestrator routing) as hard refusals at\nthe Bash, husky, and CLI tiers. Per-team off-switch via policy. Per-invocation\noverride via env-var. Light provider seam in the audit-record\n[…]\ns green. Mirror discipline\nclean (hooks/ <-> .claude/hooks/ byte-identical).\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.26.0): forceful local-first review enforcement (CTO directive)…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T13:42:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c8ffc1a29f7fb4afa6a0c47ed734fb93b1f85972",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#136)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T03:12:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5f863c6a2168e87fc952d16dfa3e4d9aba330209",
"body": "… devex) (#135)\n\nAdds 3 new architect agents to the default rea kit per CTO eval (Wave 2\nof 3). Pure markdown + smoke test, propagated to consumer .claude/agents/\nvia existing rea init/upgrade mirror. Same shape as Wave 1 (0.24.0).\n\nNew agents (Architects tier completes; Wave 1 shipped security-arch\n[…]\nfiled in\nbst-cto-kb 2026-05-05 — applies to ALL rea work, OSS + enterprise).\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.25.0): roster expansion Wave 2 — 3 Architects (data, platform,…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T03:11:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c148ef25704523a1de3fe2decc7c365fd255ca5a",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#134)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T02:14:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0a933c1ab8ee68df37bca3798097ed444b2eb391",
"body": "…tect (#133)\n\nAdds 4 new specialist agents to the default rea kit per CTO eval. Pure\nmarkdown + smoke test, propagated to consumer .claude/agents/ via the\nexisting rea init/upgrade mirror (no new wiring needed).\n\nNew agents (Principals + 1 Architect — security-architect front-loaded\nbecause rea is i\n[…]\nates\ngreen. Working tree → green-first-try PR per the local-first guardrail.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.24.0): roster expansion Wave 1 — 3 Principals + security-archi…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T02:13:42Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "74052f78685f794312c8fe382dd1ba7f496fb23f",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#132)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T01:47:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7906407f132f588f2b3fec30bc10a8fde50f539a",
"body": "…(#131)\n\nCloses 3 P1 Bash-tier kill-switch bypasses against the 0.23.0 static AST\nscanner reported in helix-024:\n\n- F1 [P1] cd-into-protected + relative-write — `cd .rea && echo > HALT`\n and 8 sibling shapes (subshell, pushd, pipe-to-tee, dynamic cd, mixed\n protected dirs). New `detectCwdChangeInt\n[…]\nntaining cmdsubst.\nmvdan-sh@0.10.1 deprecation tracked in THREAT_MODEL §8.3.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "fix(0.23.1): security hotfix — helix-024 kill-switch bypass closures …",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-05T01:46:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5ac68535c68374c5ca99dff8cbce1021975a18ff",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#130)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T23:06:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cc02d502282963add98a2619cb3a59bb7e1b874b",
"body": "…er (#129)\n\n* feat(0.23.0): bash hooks rewritten as parser-backed Node binary scanner\n\nReplaces the regex-and-segmenter pipeline in protected-paths-bash-gate\nand blocked-paths-bash-gate with a real bash AST parser (mvdan-sh)\nbehind a thin Node-binary CLI (rea hook scan-bash). The two\nparser-backed h\n[…]\n=0.\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\n\n---------\n\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.23.0): bash hooks rewritten as parser-backed Node binary scann…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T23:05:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "58338233d6dd6bc704bd2238d5e5595777e14f0e",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#123)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T03:45:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "69d6ed895711b9563be4e9aa888bf944dc8012c4",
"body": "…#122)\n\nhelix confirmed helix-021 fix is sound. These 5 are independent\nadjacent bypass classes sharing the same root-cause family\n(Bash-tier syntactic detection without semantic shell-execution-\nequivalent resolution).\n\nF1 [P1] parent-doesn't-exist symlink walk-up\n- rea_resolved_relative_form retur\n[…]\nh-tier-bypass-classes.md.\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.22.0): close helix-022 — 5 adjacent Bash-tier bypass classes (…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T03:43:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "db313edf4693af184d300f88fdfda198fefa2dbd",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#121)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T03:16:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5b814ef8489c738bdfd032ee3a0f63692a71a320",
"body": "…re-runs (#120)\n\nPre-fix `rea init --yes` (and the wizard prompt defaults) seeded\nevery field from the layered profile, ignoring any existing\n.rea/policy.yaml on disk. An operator who manually edited\n`autonomy_level: L2` would lose it on the next init.\n\nSame idempotency class as the 0.17.0 installed\n[…]\nnomy\nlevel each install?\"\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "fix(0.21.1): rea init preserves manually-edited policy values across …",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T03:14:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "91d36dda4f5adbd4a9c69d26f968978d42f122db",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#119)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T03:00:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ffb750ba6759fa68260261876521830d34a1d587",
"body": "…s (#118)\n\n* fix(0.20.1): close 5 deferred P3 items from 0.19.0 3-agent review\n\nThe user's directive was clear: do EVERYTHING. 0.19.0 shipped\nCritical + P1 + P2 findings closed in-tree but punted five P3-tier\nitems. Closing them now.\n\nP3-3 (code-reviewer)\n- Cache-hit branch emits BOTH EVT_CACHE_HIT \n[…]\ntyhouse.press>\n\n---------\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.21.0): close helix-021 + round-N findings + deferred 0.19.0 P3…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T02:58:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4716333000c7b4d3698c5639f45e14e060827e73",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#117)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T02:34:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d432d6d54921de2325459f01956ce4a06469d646",
"body": "…ixes (#116)\n\n* feat(0.19.0): Class G + Class M long-tracked contract tests + npm CDN verify-step (manual)\n\nCloses long-tracked items from the 0.15.0 / 0.16.0 audit backlog.\n\nClass G — Cross-file audit-emission contract test\nhelixir flagged across rounds 65/66/73 that commands/codex-review.md\nsaid a\n[…]\ntyhouse.press>\n\n---------\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.19.0): Class G + Class M long-tracked tests + 3-agent review f…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T02:31:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7ba4eb815ff74d281d70ecb4bef519a165f1d547",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#115)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T02:03:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "945b40e26e4f7083e698c35fe7478cf4fdeac16c",
"body": "…t rotation + postinstall auto-upgrade (#114)\n\nThe 0.18.0 changeset deferred three architectural items from\nhelixir's audit. They're closed now.\n\nG7 — Durable verdict cache (helixir #1, #4, #7, #8)\nStateless codex exec review produces non-deterministic verdicts on\nidentical SHA. helixir round 82 rep\n[…]\nosed in earlier releases.\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.18.1): close helixir architectural trio — verdict cache + audi…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T02:01:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "87e3959b9f2d4b6a997def6d67cabaee6759dfa6",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#113)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T01:49:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "653a560dc3bb790c8ba9061fe5b35721c0d083d7",
"body": "…-gate runtime defaults (#112)\n\nSix P1/P2 active-blocking findings closed across helix-020 (cycle 7\npush-gate findings against 0.17.0) and discord-ops Round 10. Plus\nhelixir #6 cross-release docs/agents contradiction reconciled, plus\niron-gate runtime model-pin enforcement so codex always runs at\ngp\n[…]\n3-95 audit (chat-relayed)\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.18.0): close cycle 7 — helix-020 + discord-ops Round 10 + iron…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-04T01:46:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8b7f0ae048d4b3910c2d8ccfb7c28db2117f96f7",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#111)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-03T23:52:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3dbb63867261c2d2606799ce7358417e1dc0476b",
"body": "…ll idempotency (#110)\n\nComprehensive Bash-tier hardening that resolves three full-cycle\nroot-cause classes plus a long-standing install-idempotency defect.\n\nhelix-017 — Nested-shell wrapper bypass closed (3 P1/P2)\n- New _rea_unwrap_nested_shells in _lib/cmd-segments.sh extracts\n payloads from `(ba\n[…]\nsure-and-audit-gates}.md.\n\nSigned-off-by: Jake Strawn <jake.strawn@gmail.com>\nSigned-off-by: Jake Strawn <bandy.strawn@clarityhouse.press>\nCo-authored-by: Jake Strawn <bandy.strawn@clarityhouse.press>",
"is_bot": false,
"headline": "feat(0.17.0): close helix-017 + helix-018 Option A + helix-019; insta…",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-03T23:50:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a04e5c378b478005d7b69e4b00d531088ef6b9c1",
"body": "Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>",
"is_bot": false,
"headline": "chore: release (#109)",
"author_name": "Jake Strawn",
"author_login": "himerus",
"committed_at": "2026-05-03T23:16:52Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 79,
"commits_last_year": 186,
"latest_release_at": "2026-07-19T16:20:25Z",
"latest_release_tag": "v0.53.0",
"releases_from_tags": false,
"days_since_last_push": 7,
"active_weeks_last_year": 9,
"days_since_latest_release": 7,
"mean_days_between_releases": 7
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 87,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "@bookedsolid/rea",
"exists": true,
"license": "MIT",
"keywords": [
"claude",
"claude-code",
"mcp",
"ai-safety",
"ai-governance",
"hooks",
"zero-trust",
"agentic",
"gateway",
"codex",
"adversarial-review"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@bookedsolid/rea",
"is_deprecated": false,
"latest_version": "0.53.0",
"repository_url": "https://github.com/bookedsolidtech/rea",
"versions_count": 79,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 1950,
"first_published_at": "2026-04-18T15:35:32.638000Z",
"latest_published_at": "2026-07-19T16:20:23.070000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 7
}
]
},
"popularity": {
"forks": 1,
"stars": 0,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-04-21",
"count": 1
}
],
"complete": true,
"collected": 1,
"total_forks": 1
},
"star_history": {
"days": [],
"complete": true,
"collected": 0,
"total_stars": 0,
"collected_at": null
},
"open_issues_and_prs": 20
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": true,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 358052,
"source_files_sampled": 355,
"oversized_source_files": 13,
"agent_instruction_files": [
"AGENTS.md",
"CLAUDE.md"
],
"agent_instruction_max_bytes": 17098
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [
{
"name": "@anthropic-ai/sdk",
"direct": true,
"version": "0.90.0",
"severity": "moderate",
"ecosystem": "npm",
"cvss_score": 4.4,
"advisory_ids": [
"GHSA-p7fg-763f-g4gf"
],
"fixed_version": "0.91.1",
"advisory_count": 1,
"oldest_advisory_days": 88
},
{
"name": "@hono/node-server",
"direct": false,
"version": "1.19.15",
"severity": "moderate",
"ecosystem": "npm",
"cvss_score": 5.9,
"advisory_ids": [
"GHSA-frvp-7c67-39w9"
],
"fixed_version": "2.0.5",
"advisory_count": 1,
"oldest_advisory_days": 5
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"moderate": 2
},
"advisory_count": 2,
"affected_count": 2,
"assessed_count": 115,
"malicious_count": 0,
"assessed_package": "npm:@bookedsolid/rea@0.53.0",
"unassessed_count": 0,
"direct_affected_count": 1
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "@anthropic-ai/sdk",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^0.90.0"
},
{
"name": "@clack/prompts",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.2.0"
},
{
"name": "@modelcontextprotocol/sdk",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.29.0"
},
{
"name": "commander",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^14.0.3"
},
{
"name": "mvdan-sh",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "0.10.1"
},
{
"name": "proper-lockfile",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^4.1.2"
},
{
"name": "safe-regex",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^2.1.1"
},
{
"name": "semver",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^7.7.4"
},
{
"name": "yaml",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^2.7.0"
},
{
"name": "zod",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^3.23.0"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "@anthropic-ai/sdk",
"direct": true,
"version": "0.90.0",
"ecosystem": "npm"
},
{
"name": "@clack/prompts",
"direct": true,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "@modelcontextprotocol/sdk",
"direct": true,
"version": "1.29.0",
"ecosystem": "npm"
},
{
"name": "commander",
"direct": true,
"version": "14.0.3",
"ecosystem": "npm"
},
{
"name": "mvdan-sh",
"direct": true,
"version": "0.10.1",
"ecosystem": "npm"
},
{
"name": "proper-lockfile",
"direct": true,
"version": "4.1.2",
"ecosystem": "npm"
},
{
"name": "safe-regex",
"direct": true,
"version": "2.1.1",
"ecosystem": "npm"
},
{
"name": "semver",
"direct": true,
"version": "7.7.4",
"ecosystem": "npm"
},
{
"name": "yaml",
"direct": true,
"version": "2.8.3",
"ecosystem": "npm"
},
{
"name": "zod",
"direct": true,
"version": "3.25.76",
"ecosystem": "npm"
},
{
"name": "@ampproject/remapping",
"direct": false,
"version": "2.3.0",
"ecosystem": "npm"
},
{
"name": "@babel/helper-string-parser",
"direct": false,
"version": "7.27.1",
"ecosystem": "npm"
},
{
"name": "@babel/helper-validator-identifier",
"direct": false,
"version": "7.28.5",
"ecosystem": "npm"
},
{
"name": "@babel/parser",
"direct": false,
"version": "7.29.2",
"ecosystem": "npm"
},
{
"name": "@babel/runtime",
"direct": false,
"version": "7.29.2",
"ecosystem": "npm"
},
{
"name": "@babel/types",
"direct": false,
"version": "7.29.0",
"ecosystem": "npm"
},
{
"name": "@bcoe/v8-coverage",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "@bookedsolid/rea",
"direct": false,
"version": "^0.49.0",
"ecosystem": "npm"
},
{
"name": "@changesets/apply-release-plan",
"direct": false,
"version": "7.1.1",
"ecosystem": "npm"
},
{
"name": "@changesets/assemble-release-plan",
"direct": false,
"version": "6.0.10",
"ecosystem": "npm"
},
{
"name": "@changesets/changelog-git",
"direct": false,
"version": "0.2.1",
"ecosystem": "npm"
},
{
"name": "@changesets/cli",
"direct": false,
"version": "2.31.0",
"ecosystem": "npm"
},
{
"name": "@changesets/config",
"direct": false,
"version": "3.1.4",
"ecosystem": "npm"
},
{
"name": "@changesets/errors",
"direct": false,
"version": "0.2.0",
"ecosystem": "npm"
},
{
"name": "@changesets/get-dependents-graph",
"direct": false,
"version": "2.1.4",
"ecosystem": "npm"
},
{
"name": "@changesets/get-release-plan",
"direct": false,
"version": "4.0.16",
"ecosystem": "npm"
},
{
"name": "@changesets/get-version-range-type",
"direct": false,
"version": "0.4.0",
"ecosystem": "npm"
},
{
"name": "@changesets/git",
"direct": false,
"version": "3.0.4",
"ecosystem": "npm"
},
{
"name": "@changesets/logger",
"direct": false,
"version": "0.1.1",
"ecosystem": "npm"
},
{
"name": "@changesets/parse",
"direct": false,
"version": "0.4.3",
"ecosystem": "npm"
},
{
"name": "@changesets/pre",
"direct": false,
"version": "2.0.2",
"ecosystem": "npm"
},
{
"name": "@changesets/read",
"direct": false,
"version": "0.6.7",
"ecosystem": "npm"
},
{
"name": "@changesets/should-skip-package",
"direct": false,
"version": "0.1.2",
"ecosystem": "npm"
},
{
"name": "@changesets/types",
"direct": false,
"version": "4.1.0",
"ecosystem": "npm"
},
{
"name": "@changesets/types",
"direct": false,
"version": "6.1.0",
"ecosystem": "npm"
},
{
"name": "@changesets/write",
"direct": false,
"version": "0.4.0",
"ecosystem": "npm"
},
{
"name": "@clack/core",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "@esbuild/aix-ppc64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/android-arm",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/android-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/android-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/darwin-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/darwin-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/freebsd-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/freebsd-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-arm",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-ia32",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-loong64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-mips64el",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-ppc64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-riscv64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-s390x",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/linux-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/netbsd-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/netbsd-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/openbsd-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/openbsd-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/openharmony-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/sunos-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/win32-arm64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/win32-ia32",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@esbuild/win32-x64",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "@eslint-community/eslint-utils",
"direct": false,
"version": "4.9.1",
"ecosystem": "npm"
},
{
"name": "@eslint-community/regexpp",
"direct": false,
"version": "4.12.2",
"ecosystem": "npm"
},
{
"name": "@eslint/config-array",
"direct": false,
"version": "0.23.5",
"ecosystem": "npm"
},
{
"name": "@eslint/config-helpers",
"direct": false,
"version": "0.5.5",
"ecosystem": "npm"
},
{
"name": "@eslint/core",
"direct": false,
"version": "1.2.1",
"ecosystem": "npm"
},
{
"name": "@eslint/object-schema",
"direct": false,
"version": "3.0.5",
"ecosystem": "npm"
},
{
"name": "@eslint/plugin-kit",
"direct": false,
"version": "0.7.1",
"ecosystem": "npm"
},
{
"name": "@hono/node-server",
"direct": false,
"version": "1.19.14",
"ecosystem": "npm"
},
{
"name": "@humanfs/core",
"direct": false,
"version": "0.19.2",
"ecosystem": "npm"
},
{
"name": "@humanfs/node",
"direct": false,
"version": "0.16.8",
"ecosystem": "npm"
},
{
"name": "@humanfs/types",
"direct": false,
"version": "0.15.0",
"ecosystem": "npm"
},
{
"name": "@humanwhocodes/module-importer",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "@humanwhocodes/retry",
"direct": false,
"version": "0.4.3",
"ecosystem": "npm"
},
{
"name": "@inquirer/external-editor",
"direct": false,
"version": "1.0.3",
"ecosystem": "npm"
},
{
"name": "@isaacs/cliui",
"direct": false,
"version": "8.0.2",
"ecosystem": "npm"
},
{
"name": "@istanbuljs/schema",
"direct": false,
"version": "0.1.6",
"ecosystem": "npm"
},
{
"name": "@jridgewell/gen-mapping",
"direct": false,
"version": "0.3.13",
"ecosystem": "npm"
},
{
"name": "@jridgewell/resolve-uri",
"direct": false,
"version": "3.1.2",
"ecosystem": "npm"
},
{
"name": "@jridgewell/sourcemap-codec",
"direct": false,
"version": "1.5.5",
"ecosystem": "npm"
},
{
"name": "@jridgewell/trace-mapping",
"direct": false,
"version": "0.3.31",
"ecosystem": "npm"
},
{
"name": "@manypkg/find-root",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "@manypkg/get-packages",
"direct": false,
"version": "1.1.3",
"ecosystem": "npm"
},
{
"name": "@nodelib/fs.scandir",
"direct": false,
"version": "2.1.5",
"ecosystem": "npm"
},
{
"name": "@nodelib/fs.stat",
"direct": false,
"version": "2.0.5",
"ecosystem": "npm"
},
{
"name": "@nodelib/fs.walk",
"direct": false,
"version": "1.2.8",
"ecosystem": "npm"
},
{
"name": "@pkgjs/parseargs",
"direct": false,
"version": "0.11.0",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-android-arm-eabi",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-android-arm64",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-darwin-arm64",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-darwin-x64",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-freebsd-arm64",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-freebsd-x64",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-arm-gnueabihf",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-arm-musleabihf",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-arm64-gnu",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-arm64-musl",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-loong64-gnu",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-loong64-musl",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-ppc64-gnu",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-ppc64-musl",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-riscv64-gnu",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-riscv64-musl",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-s390x-gnu",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-x64-gnu",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-linux-x64-musl",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-openbsd-x64",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-openharmony-arm64",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-win32-arm64-msvc",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-win32-ia32-msvc",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-win32-x64-gnu",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@rollup/rollup-win32-x64-msvc",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "@types/chai",
"direct": false,
"version": "5.2.3",
"ecosystem": "npm"
},
{
"name": "@types/deep-eql",
"direct": false,
"version": "4.0.2",
"ecosystem": "npm"
},
{
"name": "@types/esrecurse",
"direct": false,
"version": "4.3.1",
"ecosystem": "npm"
},
{
"name": "@types/estree",
"direct": false,
"version": "1.0.8",
"ecosystem": "npm"
},
{
"name": "@types/json-schema",
"direct": false,
"version": "7.0.15",
"ecosystem": "npm"
},
{
"name": "@types/node",
"direct": false,
"version": "12.20.55",
"ecosystem": "npm"
},
{
"name": "@types/node",
"direct": false,
"version": "25.6.0",
"ecosystem": "npm"
},
{
"name": "@types/proper-lockfile",
"direct": false,
"version": "4.1.4",
"ecosystem": "npm"
},
{
"name": "@types/retry",
"direct": false,
"version": "0.12.5",
"ecosystem": "npm"
},
{
"name": "@types/safe-regex",
"direct": false,
"version": "1.1.6",
"ecosystem": "npm"
},
{
"name": "@types/semver",
"direct": false,
"version": "7.7.1",
"ecosystem": "npm"
},
{
"name": "@typescript-eslint/eslint-plugin",
"direct": false,
"version": "8.58.2",
"ecosystem": "npm"
},
{
"name": "@typescript-eslint/parser",
"direct": false,
"version": "8.58.2",
"ecosystem": "npm"
},
{
"name": "@typescript-eslint/project-service",
"direct": false,
"version": "8.58.2",
"ecosystem": "npm"
},
{
"name": "@typescript-eslint/scope-manager",
"direct": false,
"version": "8.58.2",
"ecosystem": "npm"
},
{
"name": "@typescript-eslint/tsconfig-utils",
"direct": false,
"version": "8.58.2",
"ecosystem": "npm"
},
{
"name": "@typescript-eslint/type-utils",
"direct": false,
"version": "8.58.2",
"ecosystem": "npm"
},
{
"name": "@typescript-eslint/types",
"direct": false,
"version": "8.58.2",
"ecosystem": "npm"
},
{
"name": "@typescript-eslint/typescript-estree",
"direct": false,
"version": "8.58.2",
"ecosystem": "npm"
},
{
"name": "@typescript-eslint/utils",
"direct": false,
"version": "8.58.2",
"ecosystem": "npm"
},
{
"name": "@typescript-eslint/visitor-keys",
"direct": false,
"version": "8.58.2",
"ecosystem": "npm"
},
{
"name": "@vitest/coverage-v8",
"direct": false,
"version": "3.2.4",
"ecosystem": "npm"
},
{
"name": "@vitest/expect",
"direct": false,
"version": "3.2.4",
"ecosystem": "npm"
},
{
"name": "@vitest/mocker",
"direct": false,
"version": "3.2.4",
"ecosystem": "npm"
},
{
"name": "@vitest/pretty-format",
"direct": false,
"version": "3.2.4",
"ecosystem": "npm"
},
{
"name": "@vitest/runner",
"direct": false,
"version": "3.2.4",
"ecosystem": "npm"
},
{
"name": "@vitest/snapshot",
"direct": false,
"version": "3.2.4",
"ecosystem": "npm"
},
{
"name": "@vitest/spy",
"direct": false,
"version": "3.2.4",
"ecosystem": "npm"
},
{
"name": "@vitest/utils",
"direct": false,
"version": "3.2.4",
"ecosystem": "npm"
},
{
"name": "accepts",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "acorn",
"direct": false,
"version": "8.16.0",
"ecosystem": "npm"
},
{
"name": "acorn-jsx",
"direct": false,
"version": "5.3.2",
"ecosystem": "npm"
},
{
"name": "ajv",
"direct": false,
"version": "6.14.0",
"ecosystem": "npm"
},
{
"name": "ajv",
"direct": false,
"version": "8.18.0",
"ecosystem": "npm"
},
{
"name": "ajv-formats",
"direct": false,
"version": "3.0.1",
"ecosystem": "npm"
},
{
"name": "ansi-colors",
"direct": false,
"version": "4.1.3",
"ecosystem": "npm"
},
{
"name": "ansi-regex",
"direct": false,
"version": "5.0.1",
"ecosystem": "npm"
},
{
"name": "ansi-regex",
"direct": false,
"version": "6.2.2",
"ecosystem": "npm"
},
{
"name": "ansi-styles",
"direct": false,
"version": "4.3.0",
"ecosystem": "npm"
},
{
"name": "ansi-styles",
"direct": false,
"version": "6.2.3",
"ecosystem": "npm"
},
{
"name": "argparse",
"direct": false,
"version": "1.0.10",
"ecosystem": "npm"
},
{
"name": "argparse",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "array-union",
"direct": false,
"version": "2.1.0",
"ecosystem": "npm"
},
{
"name": "assertion-error",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "ast-v8-to-istanbul",
"direct": false,
"version": "0.3.12",
"ecosystem": "npm"
},
{
"name": "balanced-match",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "balanced-match",
"direct": false,
"version": "4.0.4",
"ecosystem": "npm"
},
{
"name": "better-path-resolve",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "body-parser",
"direct": false,
"version": "2.2.2",
"ecosystem": "npm"
},
{
"name": "brace-expansion",
"direct": false,
"version": "2.1.0",
"ecosystem": "npm"
},
{
"name": "brace-expansion",
"direct": false,
"version": "5.0.5",
"ecosystem": "npm"
},
{
"name": "braces",
"direct": false,
"version": "3.0.3",
"ecosystem": "npm"
},
{
"name": "bytes",
"direct": false,
"version": "3.1.2",
"ecosystem": "npm"
},
{
"name": "cac",
"direct": false,
"version": "6.7.14",
"ecosystem": "npm"
},
{
"name": "call-bind-apply-helpers",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "call-bound",
"direct": false,
"version": "1.0.4",
"ecosystem": "npm"
},
{
"name": "chai",
"direct": false,
"version": "5.3.3",
"ecosystem": "npm"
},
{
"name": "chardet",
"direct": false,
"version": "2.1.1",
"ecosystem": "npm"
},
{
"name": "check-error",
"direct": false,
"version": "2.1.3",
"ecosystem": "npm"
},
{
"name": "color-convert",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "color-name",
"direct": false,
"version": "1.1.4",
"ecosystem": "npm"
},
{
"name": "content-disposition",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "content-type",
"direct": false,
"version": "1.0.5",
"ecosystem": "npm"
},
{
"name": "cookie",
"direct": false,
"version": "0.7.2",
"ecosystem": "npm"
},
{
"name": "cookie-signature",
"direct": false,
"version": "1.2.2",
"ecosystem": "npm"
},
{
"name": "cors",
"direct": false,
"version": "2.8.6",
"ecosystem": "npm"
},
{
"name": "cross-spawn",
"direct": false,
"version": "7.0.6",
"ecosystem": "npm"
},
{
"name": "debug",
"direct": false,
"version": "4.4.3",
"ecosystem": "npm"
},
{
"name": "deep-eql",
"direct": false,
"version": "5.0.2",
"ecosystem": "npm"
},
{
"name": "deep-is",
"direct": false,
"version": "0.1.4",
"ecosystem": "npm"
},
{
"name": "depd",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "detect-indent",
"direct": false,
"version": "6.1.0",
"ecosystem": "npm"
},
{
"name": "dir-glob",
"direct": false,
"version": "3.0.1",
"ecosystem": "npm"
},
{
"name": "dunder-proto",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "eastasianwidth",
"direct": false,
"version": "0.2.0",
"ecosystem": "npm"
},
{
"name": "ee-first",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "emoji-regex",
"direct": false,
"version": "8.0.0",
"ecosystem": "npm"
},
{
"name": "emoji-regex",
"direct": false,
"version": "9.2.2",
"ecosystem": "npm"
},
{
"name": "encodeurl",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "enquirer",
"direct": false,
"version": "2.4.1",
"ecosystem": "npm"
},
{
"name": "es-define-property",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "es-errors",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "es-module-lexer",
"direct": false,
"version": "1.7.0",
"ecosystem": "npm"
},
{
"name": "es-object-atoms",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "esbuild",
"direct": false,
"version": "0.27.7",
"ecosystem": "npm"
},
{
"name": "escape-html",
"direct": false,
"version": "1.0.3",
"ecosystem": "npm"
},
{
"name": "escape-string-regexp",
"direct": false,
"version": "4.0.0",
"ecosystem": "npm"
},
{
"name": "eslint",
"direct": false,
"version": "10.2.1",
"ecosystem": "npm"
},
{
"name": "eslint-scope",
"direct": false,
"version": "9.1.2",
"ecosystem": "npm"
},
{
"name": "eslint-visitor-keys",
"direct": false,
"version": "3.4.3",
"ecosystem": "npm"
},
{
"name": "eslint-visitor-keys",
"direct": false,
"version": "5.0.1",
"ecosystem": "npm"
},
{
"name": "espree",
"direct": false,
"version": "11.2.0",
"ecosystem": "npm"
},
{
"name": "esprima",
"direct": false,
"version": "4.0.1",
"ecosystem": "npm"
},
{
"name": "esquery",
"direct": false,
"version": "1.7.0",
"ecosystem": "npm"
},
{
"name": "esrecurse",
"direct": false,
"version": "4.3.0",
"ecosystem": "npm"
},
{
"name": "estraverse",
"direct": false,
"version": "5.3.0",
"ecosystem": "npm"
},
{
"name": "estree-walker",
"direct": false,
"version": "3.0.3",
"ecosystem": "npm"
},
{
"name": "esutils",
"direct": false,
"version": "2.0.3",
"ecosystem": "npm"
},
{
"name": "etag",
"direct": false,
"version": "1.8.1",
"ecosystem": "npm"
},
{
"name": "eventsource",
"direct": false,
"version": "3.0.7",
"ecosystem": "npm"
},
{
"name": "eventsource-parser",
"direct": false,
"version": "3.0.7",
"ecosystem": "npm"
},
{
"name": "expect-type",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "express",
"direct": false,
"version": "5.2.1",
"ecosystem": "npm"
},
{
"name": "express-rate-limit",
"direct": false,
"version": "8.3.2",
"ecosystem": "npm"
},
{
"name": "extendable-error",
"direct": false,
"version": "0.1.7",
"ecosystem": "npm"
},
{
"name": "fast-deep-equal",
"direct": false,
"version": "3.1.3",
"ecosystem": "npm"
},
{
"name": "fast-glob",
"direct": false,
"version": "3.3.3",
"ecosystem": "npm"
},
{
"name": "fast-json-stable-stringify",
"direct": false,
"version": "2.1.0",
"ecosystem": "npm"
},
{
"name": "fast-levenshtein",
"direct": false,
"version": "2.0.6",
"ecosystem": "npm"
},
{
"name": "fast-string-truncated-width",
"direct": false,
"version": "1.2.1",
"ecosystem": "npm"
},
{
"name": "fast-string-width",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "fast-uri",
"direct": false,
"version": "3.1.0",
"ecosystem": "npm"
},
{
"name": "fast-wrap-ansi",
"direct": false,
"version": "0.1.6",
"ecosystem": "npm"
},
{
"name": "fastq",
"direct": false,
"version": "1.20.1",
"ecosystem": "npm"
},
{
"name": "fdir",
"direct": false,
"version": "6.5.0",
"ecosystem": "npm"
},
{
"name": "file-entry-cache",
"direct": false,
"version": "8.0.0",
"ecosystem": "npm"
},
{
"name": "fill-range",
"direct": false,
"version": "7.1.1",
"ecosystem": "npm"
},
{
"name": "finalhandler",
"direct": false,
"version": "2.1.1",
"ecosystem": "npm"
},
{
"name": "find-up",
"direct": false,
"version": "4.1.0",
"ecosystem": "npm"
},
{
"name": "find-up",
"direct": false,
"version": "5.0.0",
"ecosystem": "npm"
},
{
"name": "flat-cache",
"direct": false,
"version": "4.0.1",
"ecosystem": "npm"
},
{
"name": "flatted",
"direct": false,
"version": "3.4.2",
"ecosystem": "npm"
},
{
"name": "foreground-child",
"direct": false,
"version": "3.3.1",
"ecosystem": "npm"
},
{
"name": "forwarded",
"direct": false,
"version": "0.2.0",
"ecosystem": "npm"
},
{
"name": "fresh",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "fs-extra",
"direct": false,
"version": "7.0.1",
"ecosystem": "npm"
},
{
"name": "fs-extra",
"direct": false,
"version": "8.1.0",
"ecosystem": "npm"
},
{
"name": "fsevents",
"direct": false,
"version": "2.3.3",
"ecosystem": "npm"
},
{
"name": "function-bind",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "get-intrinsic",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "get-proto",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "glob",
"direct": false,
"version": "10.5.0",
"ecosystem": "npm"
},
{
"name": "glob-parent",
"direct": false,
"version": "5.1.2",
"ecosystem": "npm"
},
{
"name": "glob-parent",
"direct": false,
"version": "6.0.2",
"ecosystem": "npm"
},
{
"name": "globby",
"direct": false,
"version": "11.1.0",
"ecosystem": "npm"
},
{
"name": "gopd",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "graceful-fs",
"direct": false,
"version": "4.2.11",
"ecosystem": "npm"
},
{
"name": "has-flag",
"direct": false,
"version": "4.0.0",
"ecosystem": "npm"
},
{
"name": "has-symbols",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "hasown",
"direct": false,
"version": "2.0.3",
"ecosystem": "npm"
},
{
"name": "hono",
"direct": false,
"version": "4.12.14",
"ecosystem": "npm"
},
{
"name": "html-escaper",
"direct": false,
"version": "2.0.2",
"ecosystem": "npm"
},
{
"name": "http-errors",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "human-id",
"direct": false,
"version": "4.1.3",
"ecosystem": "npm"
},
{
"name": "iconv-lite",
"direct": false,
"version": "0.7.2",
"ecosystem": "npm"
},
{
"name": "ignore",
"direct": false,
"version": "5.3.2",
"ecosystem": "npm"
},
{
"name": "ignore",
"direct": false,
"version": "7.0.5",
"ecosystem": "npm"
},
{
"name": "imurmurhash",
"direct": false,
"version": "0.1.4",
"ecosystem": "npm"
},
{
"name": "inherits",
"direct": false,
"version": "2.0.4",
"ecosystem": "npm"
},
{
"name": "ip-address",
"direct": false,
"version": "10.1.0",
"ecosystem": "npm"
},
{
"name": "ipaddr.js",
"direct": false,
"version": "1.9.1",
"ecosystem": "npm"
},
{
"name": "is-extglob",
"direct": false,
"version": "2.1.1",
"ecosystem": "npm"
},
{
"name": "is-fullwidth-code-point",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "is-glob",
"direct": false,
"version": "4.0.3",
"ecosystem": "npm"
},
{
"name": "is-number",
"direct": false,
"version": "7.0.0",
"ecosystem": "npm"
},
{
"name": "is-promise",
"direct": false,
"version": "4.0.0",
"ecosystem": "npm"
},
{
"name": "is-subdir",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "is-windows",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "isexe",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "istanbul-lib-coverage",
"direct": false,
"version": "3.2.2",
"ecosystem": "npm"
},
{
"name": "istanbul-lib-report",
"direct": false,
"version": "3.0.1",
"ecosystem": "npm"
},
{
"name": "istanbul-lib-source-maps",
"direct": false,
"version": "5.0.6",
"ecosystem": "npm"
},
{
"name": "istanbul-reports",
"direct": false,
"version": "3.2.0",
"ecosystem": "npm"
},
{
"name": "jackspeak",
"direct": false,
"version": "3.4.3",
"ecosystem": "npm"
},
{
"name": "jose",
"direct": false,
"version": "6.2.2",
"ecosystem": "npm"
},
{
"name": "js-tokens",
"direct": false,
"version": "10.0.0",
"ecosystem": "npm"
},
{
"name": "js-tokens",
"direct": false,
"version": "9.0.1",
"ecosystem": "npm"
},
{
"name": "js-yaml",
"direct": false,
"version": "3.14.2",
"ecosystem": "npm"
},
{
"name": "js-yaml",
"direct": false,
"version": "4.1.1",
"ecosystem": "npm"
},
{
"name": "json-buffer",
"direct": false,
"version": "3.0.1",
"ecosystem": "npm"
},
{
"name": "json-schema-to-ts",
"direct": false,
"version": "3.1.1",
"ecosystem": "npm"
},
{
"name": "json-schema-traverse",
"direct": false,
"version": "0.4.1",
"ecosystem": "npm"
},
{
"name": "json-schema-traverse",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "json-schema-typed",
"direct": false,
"version": "8.0.2",
"ecosystem": "npm"
},
{
"name": "json-stable-stringify-without-jsonify",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "jsonfile",
"direct": false,
"version": "4.0.0",
"ecosystem": "npm"
},
{
"name": "keyv",
"direct": false,
"version": "4.5.4",
"ecosystem": "npm"
},
{
"name": "levn",
"direct": false,
"version": "0.4.1",
"ecosystem": "npm"
},
{
"name": "locate-path",
"direct": false,
"version": "5.0.0",
"ecosystem": "npm"
},
{
"name": "locate-path",
"direct": false,
"version": "6.0.0",
"ecosystem": "npm"
},
{
"name": "lodash.startcase",
"direct": false,
"version": "4.4.0",
"ecosystem": "npm"
},
{
"name": "loupe",
"direct": false,
"version": "3.2.1",
"ecosystem": "npm"
},
{
"name": "lru-cache",
"direct": false,
"version": "10.4.3",
"ecosystem": "npm"
},
{
"name": "magic-string",
"direct": false,
"version": "0.30.21",
"ecosystem": "npm"
},
{
"name": "magicast",
"direct": false,
"version": "0.3.5",
"ecosystem": "npm"
},
{
"name": "make-dir",
"direct": false,
"version": "4.0.0",
"ecosystem": "npm"
},
{
"name": "math-intrinsics",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "media-typer",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "merge-descriptors",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "merge2",
"direct": false,
"version": "1.4.1",
"ecosystem": "npm"
},
{
"name": "micromatch",
"direct": false,
"version": "4.0.8",
"ecosystem": "npm"
},
{
"name": "mime-db",
"direct": false,
"version": "1.54.0",
"ecosystem": "npm"
},
{
"name": "mime-types",
"direct": false,
"version": "3.0.2",
"ecosystem": "npm"
},
{
"name": "minimatch",
"direct": false,
"version": "10.2.5",
"ecosystem": "npm"
},
{
"name": "minimatch",
"direct": false,
"version": "9.0.9",
"ecosystem": "npm"
},
{
"name": "minipass",
"direct": false,
"version": "7.1.3",
"ecosystem": "npm"
},
{
"name": "mri",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "ms",
"direct": false,
"version": "2.1.3",
"ecosystem": "npm"
},
{
"name": "nanoid",
"direct": false,
"version": "3.3.11",
"ecosystem": "npm"
},
{
"name": "natural-compare",
"direct": false,
"version": "1.4.0",
"ecosystem": "npm"
},
{
"name": "negotiator",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "object-assign",
"direct": false,
"version": "4.1.1",
"ecosystem": "npm"
},
{
"name": "object-inspect",
"direct": false,
"version": "1.13.4",
"ecosystem": "npm"
},
{
"name": "on-finished",
"direct": false,
"version": "2.4.1",
"ecosystem": "npm"
},
{
"name": "once",
"direct": false,
"version": "1.4.0",
"ecosystem": "npm"
},
{
"name": "optionator",
"direct": false,
"version": "0.9.4",
"ecosystem": "npm"
},
{
"name": "outdent",
"direct": false,
"version": "0.5.0",
"ecosystem": "npm"
},
{
"name": "p-filter",
"direct": false,
"version": "2.1.0",
"ecosystem": "npm"
},
{
"name": "p-limit",
"direct": false,
"version": "2.3.0",
"ecosystem": "npm"
},
{
"name": "p-limit",
"direct": false,
"version": "3.1.0",
"ecosystem": "npm"
},
{
"name": "p-locate",
"direct": false,
"version": "4.1.0",
"ecosystem": "npm"
},
{
"name": "p-locate",
"direct": false,
"version": "5.0.0",
"ecosystem": "npm"
},
{
"name": "p-map",
"direct": false,
"version": "2.1.0",
"ecosystem": "npm"
},
{
"name": "p-try",
"direct": false,
"version": "2.2.0",
"ecosystem": "npm"
},
{
"name": "package-json-from-dist",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "package-manager-detector",
"direct": false,
"version": "0.2.11",
"ecosystem": "npm"
},
{
"name": "parseurl",
"direct": false,
"version": "1.3.3",
"ecosystem": "npm"
},
{
"name": "path-exists",
"direct": false,
"version": "4.0.0",
"ecosystem": "npm"
},
{
"name": "path-key",
"direct": false,
"version": "3.1.1",
"ecosystem": "npm"
},
{
"name": "path-scurry",
"direct": false,
"version": "1.11.1",
"ecosystem": "npm"
},
{
"name": "path-to-regexp",
"direct": false,
"version": "8.4.2",
"ecosystem": "npm"
},
{
"name": "path-type",
"direct": false,
"version": "4.0.0",
"ecosystem": "npm"
},
{
"name": "pathe",
"direct": false,
"version": "2.0.3",
"ecosystem": "npm"
},
{
"name": "pathval",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "picocolors",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "picomatch",
"direct": false,
"version": "2.3.2",
"ecosystem": "npm"
},
{
"name": "picomatch",
"direct": false,
"version": "4.0.4",
"ecosystem": "npm"
},
{
"name": "pify",
"direct": false,
"version": "4.0.1",
"ecosystem": "npm"
},
{
"name": "pkce-challenge",
"direct": false,
"version": "5.0.1",
"ecosystem": "npm"
},
{
"name": "postcss",
"direct": false,
"version": "8.5.10",
"ecosystem": "npm"
},
{
"name": "prelude-ls",
"direct": false,
"version": "1.2.1",
"ecosystem": "npm"
},
{
"name": "prettier",
"direct": false,
"version": "2.8.8",
"ecosystem": "npm"
},
{
"name": "prettier",
"direct": false,
"version": "3.8.3",
"ecosystem": "npm"
},
{
"name": "proxy-addr",
"direct": false,
"version": "2.0.7",
"ecosystem": "npm"
},
{
"name": "punycode",
"direct": false,
"version": "2.3.1",
"ecosystem": "npm"
},
{
"name": "qs",
"direct": false,
"version": "6.15.1",
"ecosystem": "npm"
},
{
"name": "quansync",
"direct": false,
"version": "0.2.11",
"ecosystem": "npm"
},
{
"name": "queue-microtask",
"direct": false,
"version": "1.2.3",
"ecosystem": "npm"
},
{
"name": "range-parser",
"direct": false,
"version": "1.2.1",
"ecosystem": "npm"
},
{
"name": "raw-body",
"direct": false,
"version": "3.0.2",
"ecosystem": "npm"
},
{
"name": "read-yaml-file",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "regexp-tree",
"direct": false,
"version": "0.1.27",
"ecosystem": "npm"
},
{
"name": "require-from-string",
"direct": false,
"version": "2.0.2",
"ecosystem": "npm"
},
{
"name": "resolve-from",
"direct": false,
"version": "5.0.0",
"ecosystem": "npm"
},
{
"name": "retry",
"direct": false,
"version": "0.12.0",
"ecosystem": "npm"
},
{
"name": "reusify",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "rollup",
"direct": false,
"version": "4.60.1",
"ecosystem": "npm"
},
{
"name": "router",
"direct": false,
"version": "2.2.0",
"ecosystem": "npm"
},
{
"name": "run-parallel",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "safer-buffer",
"direct": false,
"version": "2.1.2",
"ecosystem": "npm"
},
{
"name": "send",
"direct": false,
"version": "1.2.1",
"ecosystem": "npm"
},
{
"name": "serve-static",
"direct": false,
"version": "2.2.1",
"ecosystem": "npm"
},
{
"name": "setprototypeof",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "shebang-command",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "shebang-regex",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "side-channel",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "side-channel-list",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "side-channel-map",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "side-channel-weakmap",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "siginfo",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "signal-exit",
"direct": false,
"version": "3.0.7",
"ecosystem": "npm"
},
{
"name": "signal-exit",
"direct": false,
"version": "4.1.0",
"ecosystem": "npm"
},
{
"name": "sisteransi",
"direct": false,
"version": "1.0.5",
"ecosystem": "npm"
},
{
"name": "slash",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "source-map-js",
"direct": false,
"version": "1.2.1",
"ecosystem": "npm"
},
{
"name": "spawndamnit",
"direct": false,
"version": "3.0.1",
"ecosystem": "npm"
},
{
"name": "sprintf-js",
"direct": false,
"version": "1.0.3",
"ecosystem": "npm"
},
{
"name": "stackback",
"direct": false,
"version": "0.0.2",
"ecosystem": "npm"
},
{
"name": "statuses",
"direct": false,
"version": "2.0.2",
"ecosystem": "npm"
},
{
"name": "std-env",
"direct": false,
"version": "3.10.0",
"ecosystem": "npm"
},
{
"name": "string-width",
"direct": false,
"version": "4.2.3",
"ecosystem": "npm"
},
{
"name": "string-width",
"direct": false,
"version": "5.1.2",
"ecosystem": "npm"
},
{
"name": "strip-ansi",
"direct": false,
"version": "6.0.1",
"ecosystem": "npm"
},
{
"name": "strip-ansi",
"direct": false,
"version": "7.2.0",
"ecosystem": "npm"
},
{
"name": "strip-bom",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "strip-literal",
"direct": false,
"version": "3.1.0",
"ecosystem": "npm"
},
{
"name": "supports-color",
"direct": false,
"version": "7.2.0",
"ecosystem": "npm"
},
{
"name": "term-size",
"direct": false,
"version": "2.2.1",
"ecosystem": "npm"
},
{
"name": "test-exclude",
"direct": false,
"version": "7.0.2",
"ecosystem": "npm"
},
{
"name": "tinybench",
"direct": false,
"version": "2.9.0",
"ecosystem": "npm"
},
{
"name": "tinyexec",
"direct": false,
"version": "0.3.2",
"ecosystem": "npm"
},
{
"name": "tinyglobby",
"direct": false,
"version": "0.2.16",
"ecosystem": "npm"
},
{
"name": "tinypool",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "tinyrainbow",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "tinyspy",
"direct": false,
"version": "4.0.4",
"ecosystem": "npm"
},
{
"name": "to-regex-range",
"direct": false,
"version": "5.0.1",
"ecosystem": "npm"
},
{
"name": "toidentifier",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "ts-algebra",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "ts-api-utils",
"direct": false,
"version": "2.5.0",
"ecosystem": "npm"
},
{
"name": "type-check",
"direct": false,
"version": "0.4.0",
"ecosystem": "npm"
},
{
"name": "type-is",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "typescript",
"direct": false,
"version": "5.9.3",
"ecosystem": "npm"
},
{
"name": "typescript",
"direct": false,
"version": "^5.4.0",
"ecosystem": "npm"
},
{
"name": "undici-types",
"direct": false,
"version": "7.19.2",
"ecosystem": "npm"
},
{
"name": "universalify",
"direct": false,
"version": "0.1.2",
"ecosystem": "npm"
},
{
"name": "unpipe",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "uri-js",
"direct": false,
"version": "4.4.1",
"ecosystem": "npm"
},
{
"name": "vary",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "vite",
"direct": false,
"version": "7.3.2",
"ecosystem": "npm"
},
{
"name": "vite-node",
"direct": false,
"version": "3.2.4",
"ecosystem": "npm"
},
{
"name": "vitest",
"direct": false,
"version": "3.2.4",
"ecosystem": "npm"
},
{
"name": "which",
"direct": false,
"version": "2.0.2",
"ecosystem": "npm"
},
{
"name": "why-is-node-running",
"direct": false,
"version": "2.3.0",
"ecosystem": "npm"
},
{
"name": "word-wrap",
"direct": false,
"version": "1.2.5",
"ecosystem": "npm"
},
{
"name": "wrap-ansi",
"direct": false,
"version": "7.0.0",
"ecosystem": "npm"
},
{
"name": "wrap-ansi",
"direct": false,
"version": "8.1.0",
"ecosystem": "npm"
},
{
"name": "wrappy",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "yocto-queue",
"direct": false,
"version": "0.1.0",
"ecosystem": "npm"
},
{
"name": "zod-to-json-schema",
"direct": false,
"version": "3.25.2",
"ecosystem": "npm"
}
],
"collected": true,
"truncated": false,
"total_count": 423,
"direct_count": 10,
"indirect_count": 413
}
},
"maintainership": {
"issues": {
"open_prs": 11,
"merged_prs": 185,
"open_issues": 9,
"closed_ratio": 0.1,
"closed_issues": 1,
"closed_unmerged_prs": 17
},
"bus_factor": 1,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "himerus",
"commits": 184,
"avatar_url": "https://avatars.githubusercontent.com/u/21905?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"changeset-check.yml",
"ci.yml",
"dco.yml",
"gitleaks.yml",
"release.yml"
],
"has_docs_dir": true,
"linter_configs": [
"eslint.config.js"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"pnpm-lock.yaml"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 9,
"reason": "28 out of 30 merged PRs checked by a CI test -- score normalized to 9",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 8,
"reason": "dependency not pinned by hash detected -- score normalized to 8",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "37 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "0d2206b56efb80d788aa292630371c9abeb45891",
"ran_at": "2026-07-27T14:15:43Z",
"aggregate_score": 5.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-25T19:13:15Z",
"oldest_open_prs": [
{
"number": 6,
"created_at": "2026-04-18T14:38:15Z",
"last_comment_at": "2026-04-18T14:38:15Z",
"last_comment_author": "dependabot"
},
{
"number": 50,
"created_at": "2026-04-21T02:07:18Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 125,
"created_at": "2026-05-04T05:13:08Z",
"last_comment_at": "2026-05-04T05:13:09Z",
"last_comment_author": "dependabot"
},
{
"number": 126,
"created_at": "2026-05-04T05:13:18Z",
"last_comment_at": "2026-05-04T05:13:18Z",
"last_comment_author": "dependabot"
},
{
"number": 127,
"created_at": "2026-05-04T05:14:15Z",
"last_comment_at": "2026-05-04T05:14:15Z",
"last_comment_author": "dependabot"
},
{
"number": 128,
"created_at": "2026-05-04T05:14:28Z",
"last_comment_at": "2026-05-04T05:14:29Z",
"last_comment_author": "dependabot"
},
{
"number": 205,
"created_at": "2026-06-08T04:44:23Z",
"last_comment_at": "2026-06-08T04:44:24Z",
"last_comment_author": "dependabot"
},
{
"number": 207,
"created_at": "2026-06-09T00:55:48Z",
"last_comment_at": "2026-06-09T00:55:48Z",
"last_comment_author": "dependabot"
},
{
"number": 208,
"created_at": "2026-06-22T04:44:10Z",
"last_comment_at": "2026-06-22T04:44:10Z",
"last_comment_author": "dependabot"
},
{
"number": 209,
"created_at": "2026-06-22T04:44:13Z",
"last_comment_at": "2026-06-22T04:44:13Z",
"last_comment_author": "dependabot"
},
{
"number": 223,
"created_at": "2026-07-20T04:44:49Z",
"last_comment_at": "2026-07-20T04:44:50Z",
"last_comment_author": "dependabot"
}
],
"last_merged_pr_at": "2026-07-19T16:19:27Z",
"ci_last_conclusion": "FAILURE",
"oldest_open_issues": [
{
"number": 56,
"created_at": "2026-04-21T14:01:03Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 57,
"created_at": "2026-04-21T14:01:16Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 58,
"created_at": "2026-04-21T14:01:35Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 59,
"created_at": "2026-04-21T14:01:43Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 60,
"created_at": "2026-04-21T14:01:57Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 61,
"created_at": "2026-04-21T14:54:11Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 62,
"created_at": "2026-04-21T16:12:03Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 63,
"created_at": "2026-04-21T16:12:37Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 64,
"created_at": "2026-04-21T16:52:28Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/bookedsolidtech/rea",
"host": "github.com",
"name": "rea",
"owner": "bookedsolidtech"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"security": 59,
"vitality": 82,
"community": 44,
"governance": 45,
"engineering": 89
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 82,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"commits_last_year": 186,
"human_commit_share": 1,
"days_since_last_push": 7,
"active_weeks_last_year": 9
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 7 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 7
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "9/52 weeks with commits",
"points": 6.2,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 9
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "186 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 186
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 79,
"latest_release_tag": "v0.53.0",
"releases_from_tags": false,
"days_since_latest_release": 7,
"mean_days_between_releases": 7
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "79 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 79
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 7 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 7
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~7 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 7
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 44,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 1,
"stars": 0,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "0 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 0
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "1 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 1
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "excellent",
"name": "Community health",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": true,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 13.5,
"status": "met",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 55,
"inputs": {
"packages": [
"@bookedsolid/rea"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 1950
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "1,950 downloads/month across npm",
"points": 43.9,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 1950,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 45,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 13,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "at_risk",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"merged_prs": 185,
"open_issues": 9,
"closed_issues": 1,
"issue_closed_ratio": 0.1,
"closed_unmerged_prs": 17
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "10% of issues closed",
"points": 4.7,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 10
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "185/202 decided PRs merged",
"points": 35,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 185,
"decided": 202
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 43,
"inputs": {
"followers": 3,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "bookedsolidtech",
"public_repos": 10,
"account_age_days": 149
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "3 followers of bookedsolidtech",
"points": 4.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 3,
"login": "bookedsolidtech"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "10 public repos, account ~0 yr old",
"points": 8.4,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 10
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@bookedsolid/rea"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 7
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 7 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 7
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "79 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 79
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "excellent",
"name": "Engineering Quality",
"value": 89,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 82,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "5 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 5
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": "eslint.config.js",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.js"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "28 out of 30 merged PRs checked by a CI test -- score normalized to 9",
"points": 18,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"topics": [
"ai-safety",
"claude-code",
"mcp",
"typescript",
"agentic-ai",
"ai-agents",
"ai-governance",
"anthropic",
"anthropic-claude",
"audit-log",
"developer-tools",
"guardrails",
"llm-guardrails",
"llm-security",
"mcp-gateway",
"mcp-server",
"model-context-protocol",
"policy-enforcement",
"prompt-injection",
"zero-trust"
],
"has_wiki": true,
"homepage": "https://github.com/bookedsolidtech/rea",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://github.com/bookedsolidtech/rea",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "20 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 20
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 59,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 55,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 5.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "28 out of 30 merged PRs checked by a CI test -- score normalized to 9",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 8",
"points": 4,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "37 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "good",
"name": "Dependency advisories",
"note": "Matched the npm:@bookedsolid/rea@0.53.0 runtime dependency closure — what installing the published package pulls in — 115 packages. Reachability is not analyzed.",
"notes": [
{
"code": "advisories_scope_published",
"params": {
"package": "npm:@bookedsolid/rea@0.53.0",
"assessed": 115
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 76,
"inputs": {
"source": "osv",
"advisories": 2,
"affected_packages": 2,
"assessed_packages": 115,
"unassessed_packages": 0,
"affected_by_severity": "moderate 2",
"direct_affected_packages": 1
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "1 affected: @anthropic-ai/sdk 0.90.0 (moderate 4.4)",
"points": 22.7,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 1,
"packages": "@anthropic-ai/sdk 0.90.0 (moderate 4.4)"
}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "1 affected: @hono/node-server 1.19.15 (moderate 5.9)",
"points": 13.2,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 1,
"packages": "@hono/node-server 1.19.15 (moderate 5.9)"
}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory has been public longer than 90 days",
"points": 40,
"status": "met",
"details": [
{
"code": "advisories_none_stale",
"params": {
"days": 90
}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 115,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 70,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [
"AGENTS.md",
"CLAUDE.md"
],
"agent_instruction_max_bytes": 17098
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "AGENTS.md, CLAUDE.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "AGENTS.md, CLAUDE.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 100,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 67,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"pnpm-lock.yaml"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [
"tsconfig.json"
],
"agent_commit_share": 0,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": "eslint.config.js",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.js"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "dependency automation configured, none observed in the sampled commits",
"points": 5,
"status": "partial",
"details": [
{
"code": "dependency_bot_config_only",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 8",
"points": 8,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 98,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 358052,
"source_files_sampled": 355,
"oversized_source_files": 13
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "13/355 source files over 60KB",
"points": 53,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 355,
"oversized": 13
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "critical",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 20,
"inputs": {
"example_dirs": [],
"has_mcp_signal": true,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 20,
"status": "met",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [],
"report_type": "repository",
"generated_at": "2026-07-27T14:16:01.355749Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/b/bookedsolidtech/rea.svg",
"full_name": "bookedsolidtech/rea",
"license_state": "standard",
"license_spdx": "MIT"
}Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.
Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v1.13.0, esquema v0.27.0 — metodología completa · wiki de métricas.
Cómo se sitúa un resultado dentro del registro general: estadísticas agregadas — npm.