zkwasm / concord-agent

No fue posible recopilar el conjunto de dependencias resuelto para este informe: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

Instalar npm:concord-agent@0.7.18 arrastra 57 paquetes, directos y transitivos: 0 tienen avisos conocidos, de los cuales 0 son dependencias directas.

Ningún aviso conocido afecta a las dependencias evaluadas.

Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 286,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "JavaScript": 355545
      },
      "pushed_at": "2026-07-23T03:09:02Z",
      "created_at": "2026-06-28T04:01:37Z",
      "owner_type": "User",
      "updated_at": "2026-07-23T03:09:06Z",
      "description": "Host a coding agent (claude/codex/gemini) in a Concord room over ACP. Resident session, idle = zero tokens, token budget, IM control.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "JavaScript",
      "significant_languages": [
        "JavaScript"
      ]
    },
    "owner": {
      "blog": null,
      "name": null,
      "type": "User",
      "login": "zkwasm",
      "company": null,
      "location": null,
      "followers": 2,
      "avatar_url": "https://avatars.githubusercontent.com/u/113981964?v=4",
      "created_at": "2022-09-20T09:31:58Z",
      "is_verified": null,
      "public_repos": 9,
      "account_age_days": 1409
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-06-29T12:24:12Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "0ae809fffffc6860ae9fad729021223e004b3146",
          "body": "A turn whose model output ended cleanly could fail to settle the ACP prompt\nrequest on adapter 0.52.0 — the bridge waited forever for a stop signal and\nshowed \"working\" for hours (observed live: runtime finished at 11:41, host\nwedged until manual restart). The 0.53-0.60 adapter line reworked\nturn-boundary / background-subagent handling, removing this stall class.\nGemini flag intentionally untouched (unrelated + unverifiable locally).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: bump ACP adapters — claude 0.60.0, codex 1.1.5 (0.7.18)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-23T03:09:00Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e1adc7cbedaf249753141fe1216a36ee59a72b73",
          "body": "…by default (0.7.17)\n\n- ensureAddressed: a turn reply that @-mentions no one is auto-addressed back\n  at its trigger sender, and `fallbackMention` rides along so the SERVER can\n  enforce the invariant with the authoritative roster (a lexical scan cannot\n  tell \"@构建者 look\" from a prose \"补@不变量\")\n- bri\n[…]\naware (textMentionsName/hasMentionToken):\n  emails, URL paths, npm scopes, and one-letter substrings never wake anyone;\n  fullwidth ＠ normalized\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: addressing invariant + broadcast self-judgment; retire arbiter …",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-22T01:02:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6bf5096cc3921cdbb93df08c2a0187586967b0f5",
          "body": "…om /compact (0.7.16)\n\nA rate-limited turn used to kill a multi-agent room permanently. Three compounding\ndefects, all confirmed against live host logs:\n\n- The message that triggered the turn was dropped before the attempt\n  (pending.shift() ran ahead of the try), so nothing was left to retry.\n- Tra\n[…]\nion and the transient/addressing predicates move to cli.mjs so they\ncan be tested; acp-bridge.mjs keeps the store side effects. 186 tests pass.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: retry transient turn failures, address room notes, unbreak in-ro…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-20T14:35:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "613b43e6597148d0333e9c31cea4d0308559cdec",
          "body": "…rent models (0.7.15)\n\nThe pinned codex-acp bundles its own @openai/codex and runs THAT — not the user's\ndesktop/PATH codex — so newer models (e.g. gpt-5.6-*) failed with \"Model metadata\nnot found\" / \"requires a newer version of Codex\", even when the desktop app worked.\n1.1.2 bundles @openai/codex 0.144.x. No interface change: same ACP launch, still\nhonors CODEX_PATH. 172/172 tests pass.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: bump codex-acp adapter 1.0.1 → 1.1.2 so hosted codex can use cur…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-13T02:56:16Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b2c6cd0950e5cebd0919b453a1c5289f51b0cebe",
          "body": "….7.14)\n\nThe one-time briefing's NOOP-filler rule hardcoded a Chinese \"待命中\" next to the\nEnglish \"standing by\", so every fresh bridge-hosted agent in an English (locale: en)\nroom saw Chinese in its briefing — a leak in the \"en rooms must be all-English\"\nguarantee. Gate it by room.locale via L(): en rooms get only \"standing by\"; zh rooms\nget \"待命中\" / \"standing by\". Takes effect on a fresh session (/clear or re-join).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: briefing filler example is localized — no Chinese in en rooms (0…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-08T03:34:11Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "704bba3baef44bd5db646e32d8c0597696b4dc29",
          "body": "Agents were curl-posting their content to /messages AND letting the bridge post\ntheir turn-ending reply (a status summary in the agent's default language), so every\nturn showed up twice — once as English content, once as a foreign-language \"I did X\"\nnote. Harden the briefing: the reply text IS the r\n[…]\ntatus report, and\nthe coordination BASE is for claims/files/ballots/signals only — never chat. Takes\neffect on a fresh session (/clear or re-join), since a warm-resumed session keeps the\nold briefing.",
          "is_bot": false,
          "headline": "fix: stop double-posting — the reply IS the room message (0.7.13)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-08T02:44:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "affe3fe19875efa0753d796903b7d3368f146217",
          "body": "Naming read the ALL-TIME sender list (/agents), so it treated departed \"-N\" ghosts\nas present and offered fallbacks like \"agent-one-3\"; and role-name suggestions could\ncome out in the wrong language. Now: gatherRoomInfo reads room.locale from /info and\nnamingPrompt writes role names in that language (English example for en rooms); the\n\"present/taken\" set comes from the online roster via the paired im-for-agents /agents\nchange (online-only), so a reclaimable ghost name is no longer avoided.",
          "is_bot": false,
          "headline": "fix: join-time naming — no ghost names, room's language (0.7.13)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-08T01:59:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d977b5ccdb22c2d2857bc6984046c7c000b9fc1e",
          "body": "…0.7.12)\n\nAn earlier collision persisted the \"-N\" fallback (e.g. agent-coordinator-2) in local\nstate, so every `concord up`/restart resumed under the wrong name forever — the server\n\"free a departed name\" change only helped a fresh join, not a resume. On join, when the\nstored sender is a \"-N\" fallba\n[…]\nline); on success adopt it (ACP context\nis warm-resumed separately, no memory lost), else resume under the fallback as before.\nClient-side complement to the im-for-agents online-only uniqueness check.",
          "is_bot": false,
          "headline": "fix: restarted agent reclaims its clean name, not the \"-N\" fallback (…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-07T17:43:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e621c3a6ca723e20c89a3a9060ce7e9f908f9774",
          "body": "- The operator-facing output of concord join/host/login/upgrade/reset/im/im status\n  (naming prompts, QR-login flow, confirmations, status) is now English, matching\n  the room-language handling from 0.7.11. Only code comments stay as-is.\n- Join-time naming uses the HOSTED agent's own CLI (claude/gem\n[…]\n invocations are best-effort; a wrong flag degrades gracefully to the fallback.)\n- A first-ever join/host notes the first-run adapter download so initial silence\n  reads as \"downloading,\" not \"stuck.\"",
          "is_bot": false,
          "headline": "i18n+ux: English-first CLI, agent-aware naming, first-run hint (0.7.12)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-07T15:54:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "42b8faea0b382d46e828731b7ba25ed581551a85",
          "body": "…e gap (0.7.12)\n\nA `concord join` agent arrived blind: it knew the room protocol but not what the\nroom was FOR, unlike a paste-prompt agent. The one-time briefing now carries,\nread from the join response:\n- room name + objective + context, and the pinned messages (an \"[OBJECTIVE]\" pin\n  is flagged a\n[…]\nm's recent history (≤20 msgs, arb markers skipped),\n  seeded into the inbox so an agent joining an ongoing room isn't blind to it;\n- autonomous-mode rooms (read from room.mode) get a co-owner mindset.",
          "is_bot": false,
          "headline": "feat: bridge-hosted agents get the room's brief — close the join↔past…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-07T15:54:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7b5c0bc7cd3226bda92ec3f9899cf734ce5b45f9",
          "body": "….11)\n\nThe bridge ignored room.locale and was hardcoded Chinese: it posted Chinese\nsystem messages into the room AND fed the agent Chinese context (batched-inbox\nheader, briefing), biasing hosted agents toward replying in Chinese even in an\nEnglish room. Now it reads room.locale on join and localize\n[…]\neout/error notes, and elicitation prompts all switch on locale.\n- Pure-logic helpers (arbiter, budget, elicit) gained an optional `locale` arg\n  (default en); budget.test covers both locales. 172/172.",
          "is_bot": false,
          "headline": "feat: locale-aware bridge output — English rooms read as English (0.7…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-07T10:59:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1fd4b8704ddad76bcaadceff0218f62c8fd9a87e",
          "body": "`spawn('npx', …)` failed on Windows with ENOENT — npx is `npx.cmd` there and\nmodern Node refuses to spawn a .cmd without a shell — so hosting any agent\ncrashed with \"agent failed to start: spawn npx ENOENT\". Spawn the adapter\nthrough the shell on Windows, and reap the child tree with `taskkill /T` in\nshutdown() since Windows has no Unix process groups. macOS/Linux unchanged.\nAlso gate the \"~250MB download\" note to the claude adapter only.",
          "is_bot": false,
          "headline": "fix: Windows agent-adapter spawn + shutdown (0.7.11)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-07T10:59:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "74dfe3bc77c300f83b852b26a82b978adece5b34",
          "body": "…8→0.7.10)\n\nRolls up three versions that shipped without ever being committed (0.7.8\nand 0.7.9 were published to npm from the working tree; 0.7.10 is prepared\nbut unpublished). Their edits are intermingled across the same files, so\nthey are bundled as one honest commit rather than a fabricated per-v\n[…]\nides so silence stays silent and free.\n- 0.7.10: `concord list` gains an ID column — the stable host id\n  (claude-xxxxxx) disambiguates same-named agents and is what\n  stop/status/logs/restart accept.",
          "is_bot": false,
          "headline": "feat: answer arbitration, event-driven wakes, upgrade + list ID (0.7.…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-07T09:06:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7ed8a7560e6f100a462f831dee90395f1f8f97d0",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: 0.7.7 release marker",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-06T10:22:58Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1cd037742eaa34b83f82b4db3b0aa979592eaf1a",
          "body": "The server has always had server-enforced coordination - claims (task\nownership, 409-exclusive), ballots (binding votes), signals, room files - all\nagent-token accessible over HTTP. CLI-hosted agents knew none of it, so\nmulti-agent rooms coordinated by chat alone: duplicate pipelines, three agents\ng\n[…]\not, signals for shared focus. Ballot/signal sections are gated by\nthe room's actual primitives, fetched from /info at boot. 165/165 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: teach hosted agents the room's coordination primitives (0.7.7)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-06T10:21:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6baff5c95a8778cb0b57a657fc02c2465804e7b5",
          "body": "Every room message used to wake every agent for a full LLM turn, and the\n\"never go silent\" rule forced a filler reply, so N idle agents billed each\nother for endless \"standing by\" echo loops.\n\nNow inbound messages are classified (pure, tested):\n- wake: @-mentions this agent, or a human message with \n[…]\npeer's exact name to\nmake it act; un-mentioned posts are ambient status that wakes no one; never\npost \"standing by\" filler. 162/162 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: multi-agent wake economics — delivery != wake (0.7.6)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-06T09:45:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2fb41240d5cbe68f1b60ff8437c9ebd124efb99e",
          "body": "…with bindings (0.7.5)\n\nTwo upgrade-path bugs: (1) nothing auto-pauses since 0.7.4, but the old daemon's\npause record in state.json was never cleared, so list/status showed 'paused'\nforever while the agent actually worked; a clean start now drops it. (2) 'up'\nspawned an IM owner for every platform w\n[…]\n stored creds - a one-time QR login\nwith zero bindings kept resurrecting a useless owner; now creds AND >=1 binding\nare required. 161/161 green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: clear stale pause records at startup; up only revives IM owners …",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-06T09:12:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "401f50cba828e0144d54762173a300747378d560",
          "body": "…, ceiling 30min → 6h (0.7.4)\n\nThe \"3 timeouts in 6h → auto-pause\" fuse turned normal long-running work into\nan unrecoverable-feeling `paused` state (resume → next long task re-tripped it).\nGone: a timed-out turn is simply cancelled (adapter group killed, burn stops),\nthe room is told, and the next \n[…]\n00s\n(6h); ACP_TURN_TIMEOUT=0 disables. `concord resume` remains only to clear a\nstale pause record left by an older daemon. 161/161 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: long tasks are no longer punished — drop the timeout auto-pause…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-06T08:52:02Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "41d67c8e6fcb015cabf3bdb00b607e8ac7d88f1b",
          "body": "A hosted Claude with the concord plugin installed saw room messages, decided it\nhad never formally joined, and started suggesting /concord:resume. The bridge\nnow prepends a one-time briefing to the first turn of every fresh session (the\nbridge owns room I/O; never run /concord:* or touch .concord/). Resumed\nsessions skip it — the briefing is already in their context. 161/161 green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: brief fresh sessions that they are already in the room (0.7.4)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T09:34:37Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b19c3188a6fc6fa0f5c22d3944580bc52c2d37cb",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: 0.7.3 release marker",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:54:49Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d0f0811de699d0623ccce816f816a407fbb80100",
          "body": "Verified by probing the registry tarball: published 0.7.2 has grounded naming,\nname alignment and the warned80 fix, but not shouldRelayInbound — so the\nsystem-noise filter becomes 0.7.3 and package.json bumps accordingly.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: 0.7.2 shipped on npm — noise filter moves to 0.7.3",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:49:32Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e217168bdf39541d23beeb22ca35e4c88643043c",
          "body": "File-upload notices ([FILE] x uploaded …, sender_type=system) triggered a full\nLLM turn whose \"no action needed, standing by\" reply was posted back into the\nroom — burning the agent's tokens AND every other participant's, message after\nmessage. Inbound gating is now a pure, tested predicate (shouldRelayInbound):\nown echoes and system notices never wake the agent; humans and other agents do.\n\n161/161 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: ambient 'system' messages no longer wake the agent (0.7.2)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:44:49Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "66e007634fde7c119128e1c314d55707854a66a5",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: 0.7.2 release marker",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:30:47Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "65578cdc85a6ca51a25573819b84e2ac6bfd0933",
          "body": "…es first\n\nCandidates must come from what the room actually says, not model invention.\nThe chain is now grounded-first:\n\n1. TEMPLATE ROLES (deterministic, zero LLM): room templates bake their role\n   list into the room context at creation (compose.ts rolesBlock — a known\n   header + \"- name: descrip\n[…]\nuggestNames() reports source: 'template' | 'headless' | 'fallback'.\n160/160 tests green (extraction matches compose.ts's exact composed format).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(naming): ground candidates in the room's own data — template rol…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:23:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4d30e6e1a0092f8a88da6d0e7d6a245cb1394fd7",
          "body": "…he paste-prompt\n\nThe web paste-prompt's naming step is role-selection (\"ask the user what role\nyou should play … use it as your sender name and persona\"; \"invent a role that\nbrings a distinct viewpoint\"). The headless naming prompt now mirrors that:\n- the name is framed as the agent's ROLE + person\n[…]\nal room: old prompt → 指令官/任务分发/待命-协调 (vague);\nnew prompt → 架构师/测试/代码评审/产品设计 (complementary roles next to the\nexisting 工程师). 158/158 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(naming): frame the headless prompt around ROLES, mirroring t…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:16:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "32729adc5fe4e5813cc92533c8887fdc7c8ca8b7",
          "body": "…room names (0.7.2)\n\nA readable name is the room's core handle in a multi-agent room — it's how\nhumans decide who to @ and who gets which task. `concord join`/`host` (TTY, no\n--as/--name) now gathers the project dir + room name/purpose (/agent .../info)\n+ who is already present (/agents), runs a ONE\n[…]\nshows in every case.\n\nLive-verified against a real room (existing members listed, role-style Chinese\ncandidates generated). 158/158 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: join-time naming via a one-off headless agent + CLI shows real …",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:01:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4ca56e6d200fb2a4bb39f943ba782f2a92caef96",
          "body": "…e up (0.7.2)\n\n`concord list`'s \"claude-a1b2c3\" and the room's \"claude-6016\" were two unrelated\nidentifiers (hex host id vs pid%10000). The 409-fallback sender now derives from\nCONCORD_HOST_ID's hex tail: same name in both places, stable across restarts —\nso a restarting host resumes its identity instead of minting a fresh ghost each\ntime. A pid-based candidate remains as last resort (stale-session edge).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: room fallback name = host id hex tail — CLI and roster names lin…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T07:38:37Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ab4c4a5a20cb8d37d46299fca04fd1cc1edc00c9",
          "body": "The one-time warning flag was in-memory, so a crash-looping host re-posted the\nwarning into the room on every restart. It now lives in the store next to the\nusage meter and is cleared only by `concord budget --reset` (resetUsage).\n152/152 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: persist the 80%-of-budget warning flag (0.7.2)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T04:09:10Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0e169f0f1dcd78bf14ee719b06d15d7f273ae33a",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: 0.7.1 is published — drop the (unreleased) marker",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T03:41:38Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "fd766755d426a0e4d5040279f742da1aa30852ce",
          "body": "…rdingly\n\nThe published 0.7.0 tarball (verified by probing the registry artifact) contains\nlifetime token metering + in-room slash commands only. Warm resume, the live\nplan card, the context meter and elicitation landed after that publish, so they\nmove to a new unreleased 0.7.1 section and package.json bumps to 0.7.1 (patch\nonly, per the 0.7.x policy).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: 0.7.0 shipped on npm — bump to 0.7.1, split the CHANGELOG acco…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T03:25:26Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "2e39a765b77dc956b08a2e1c22b19d998aa2a538",
          "body": "The agent's AskUserQuestion tool (and MCP-server elicitations) now reach the\nhuman: the adapter converts them to ACP `elicitation/create` once we advertise\nclientCapabilities.elicitation.form; the bridge renders a numbered question card\ninto the room / bound IM chat, takes the first HUMAN reply as t\n[…]\n \"2\" →\nagent continued with the chosen answer. 151/151 tests green.\n\nFolded into the unpublished 0.7.0 (version unchanged per the 0.7.x policy).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: agent-initiated questions in chat — ACP form elicitation (0.7.0)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T03:18:47Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "690dace3681e7f16a457205952274ed94d3e5505",
          "body": "….7.0)\n\nWarm resume: startEngine hands the persisted ACP session id back to the adapter\n(session/resume + ctx.attachSession — public at runtime, typed private), so a\nrestart/crash recovery keeps the agent's conversation context instead of starting\ncold. Any resume failure falls back to a fresh sessi\n[…]\nded into the unpublished 0.7.0 (version unchanged per the 0.7.x policy).\n142/142 tests green (adds resume success/fallback + store round-trips).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: warm resume across restarts + live plan card + context meter (0…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T02:40:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "910f060b6d568c3db5693e1bf056dac7cd8ce15f",
          "body": "Token accounting becomes a lifetime cumulative meter: usage per task/room only\ngrows and never auto-resets — not by time, restart, /compact, or /clear. The only\nreset is an explicit `concord budget --reset` (now over SIGUSR2, decoupled from\n`concord resume`, which is unpause-only). `--budget` is a l\n[…]\nom a room message.\n\nDrop-in upgrade (bindings/creds/sessions preserved); restart running hosts so they\nrun the new daemon. 138/138 tests green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: lifetime token metering + in-room slash commands (0.7.0)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-01T22:19:13Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "772f15814949156784b5daa7af8a7ad1130e5e04",
          "body": "…6.0→0.6.4)\n\nShip the IM lifecycle + reliability arc, published as 0.6.0 through 0.6.4.\n\nLifecycle & monitoring:\n- `concord shutdown` is now a SOFT stop — keeps every agent config and IM binding\n  (reversible); `concord up` revives the whole fleet with no re-binding; `concord reset`\n  is the explici\n[…]\nocs/getting-started.md shutdown description corrected.\n- Test hygiene: hosts/creds/store tests cleaned up leaked mkdtemp dirs. 139 tests green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): fleet lifecycle + local agent-presence + resume-403 fix (0.…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-01T07:16:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "07613ce6b85c6acd4a47a2c306724f37566959c8",
          "body": "… health\n\ngetConnectionStatus()'s live behavior is unverified (API confirmed, behavior pending a real\nbot scan). Guard against a quirky 'idle' false-alarming an actively-used binding: if inbound\nevents are flowing, the connection demonstrably works → 'flowing', regardless of reported\nstate. Only \"no recent events AND not connected\" reads as 'suspect'.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): receiving inbound overrides a stale connState in event-plane…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T16:20:57Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "66b6120eb90751e46ba1fd98467f5d056ff00f8d",
          "body": "…im status)\n\nThe IM owner now continuously reconciles desired (bindings) vs actual (connection / relay /\nroom / agent) state and writes a health.json the CLI reads, turning a class of silent\nfailures into a visible \"what's wrong + the one next command\".\n\n- WSClient connection callbacks (onReady/onEr\n[…]\ndown). 134/134 tests pass. Needs the new backend endpoint\ndeployed for agent-presence to activate; degrades gracefully until then.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): owner reconcile loop + end-to-end health snapshot (concord …",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T16:18:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "46474fd9ae432f13445a40b025140ff68c793ae7",
          "body": "Root cause of \"switched bot app (login --qr --new) but binding the new app gets no\nresponse, the old app still works\": the IM owner bakes appId/appSecret into its WSClient\nAT SPAWN, but `startImOwnerIfNeeded` only checked whether an owner process was alive — not\nwhich app it was connected to. So aft\n[…]\nis treated as unverifiable → restarted (never\nsilently trusted). 118/118 tests pass. CLI / owner only — Concord backend untouched.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): restart the IM owner onto the current bot app when creds change",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T14:50:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "39c1557263970488e357142f192cd63f10969ab4",
          "body": "…ailures, bindings\n\nHigh-priority UX quick-wins from the 2026-06-30 review (CLI side, zero core-backend changes):\n\n- room name in `concord list`/`status` (cached at host start, CJK-width aligned, falls back to short id)\n- STATUS now shows working/idle/paused/crashed — what the agent is DOING, not ju\n[…]\n, store activity/paused/exit\nsetters (+tests). All in the CLI / ACP bridge — the Concord backend is untouched. 111/111 tests pass.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(cli): surface what each agent is doing — room names, activity, f…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T08:34:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0dbfae6988d3c34423ef0ee1a58f897abfa3538c",
          "body": "The README still only documented manual `--app-id/--app-secret` login and\nomitted the IM owner command. Add the QR login (the recommended 0.3.0 flow —\nno developer console, no version publish) and `concord im` to the Commands block.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: README Commands — surface `concord login --qr` and `concord im`",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T03:57:43Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0bc6fe8901209cfcca7bdb0bc2841f1b6d6a48ff",
          "body": "…ount workaround\n\nThe `--qr` flow doesn't bypass Lark/Feishu's enterprise governance: in a tenant\nwhere the user isn't an admin, the scan returns valid creds but the new app sits\nin admin-approval limbo and messages don't actually route. Creds look healthy so\nwe can't detect this from code. Fixes:\n\n\n[…]\nadmin approval — no\n  re-scan needed once approved.\" The reuse path is silent (creds came from a\n  presumably working prior scan).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs+cli: surface the enterprise admin-approval caveat + personal-acc…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T02:27:59Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b2287eb3721cc0dc47817ff8c74409e8576947c5",
          "body": "…force escape hatches)\n\nRe-running the QR flow with existing creds used to silently create a duplicate\napp every time, littering the user's workspace with dead Concord apps. Default\nnow: if creds already exist, skip the scan, show how to override, and ensure\nthe IM owner is up (so re-running becomes\n[…]\nand --force to\nre-scan and update the existing app's config (registerApp with appId = the\n2nd-scan grant flow). Help text updated.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: `concord login --qr` reuses existing app by default (--new / --…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T02:19:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f89a7c6f067d43fd22e6a6510bc61a85d602ab10",
          "body": "After a successful scan the bot has creds but nothing is listening, so a\n`/concord-bind` in the chat would go nowhere until the user separately ran\n`concord im`. Auto-start the owner at the tail of the QR flow (skip if one is\nalready running for that platform). Extract the owner-spawn logic into a s\n[…]\ntach behavior are identical. Auto-start failure is non-fatal — the user still\nhas working creds and can fall back to `concord im`.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: `concord login --qr` auto-starts the IM owner",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T02:15:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ceb83c46bc55c0046bd6fc59be4fa7a83da0d6de",
          "body": "…3.0)\n\nThe Lark/Feishu onboarding is now one command: `concord login lark --qr` renders\na QR in the terminal, you scan it in the app, tap Agree on the confirm page,\nand the bot's appId+appSecret land in ~/.concord/creds.json. No developer\nconsole, no manual scope hunt, no version publish.\n\nUses regi\n[…]\ne user sees the easy path first.\ndocs/getting-started.md restructured to make QR the primary flow, manual a\ncollapsed alternative.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: `concord login --qr` — zero-config bot creation via QR scan (0.…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T01:54:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5bfb2a5311a7783f625bd246707f814e52bc04df",
          "body": "…I is missing (0.2.3)\n\nA fresh `concord join claude` on a machine without Claude Code would silently\nstart the ~250MB ACP-adapter npx download and then mysteriously fail to auth\n(the bundled runtime reads ~/.claude credentials from a normal install). Check\nPATH for the chosen agent's CLI at startup \n[…]\n npm-install lines for claude / gemini / codex; --no-agent-check (or\nCONCORD_NO_AGENT_CHECK=1) bypasses for non-standard installs.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: preflight check — fail fast with install hint when the agent CL…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T00:00:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3ed08e37eae607dfd75c9edc33c247742b2b7ce4",
          "body": "…hung (0.2.2)\n\nThe ACP adapter is fetched via `npx` at first use, and the claude adapter drags\nin a ~250MB platform-native agent runtime. startEngine() awaited that download\nsilently before pollLoop() ran, so a fresh machine looked like \"joined the room\nbut never responds\" with no clue. Print the ad\n[…]\ns\" note before spawning, and on startup failure\nhint that the first run needs npm-registry access (or pre-warm with that command).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: announce the first-run adapter download so startup doesn't look …",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T15:46:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fe0c256250f5c90d11a722512bfa9642045757c0",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: release 0.2.1 (room-too-large reply fallback + join-a-room guide)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T15:01:34Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a4926c0d1fb4fd0faff2cd3135b8301778c5829a",
          "body": "The CLI's everyday flow is `concord join <agent> <roomId>` — install, grab the\nroom id (it's the access token), join; idle = zero tokens. Separate from the IM\ngetting-started guide (concord host + a bot). README now links both: joining-a-room\nfor the plain room flow, getting-started for the personal IM-bot flow.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add a \"joining a room\" guide for everyday Concord users",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T14:56:20Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6a6a89775f3b8d9c8b12a5abe1ac1189269e234b",
          "body": "The room caps a message body at 2MB (HTTP) and hard-truncates content past ~50k\nchars. sendToRoom posted via a bare fetch and never checked res.ok — and fetch\ndoesn't throw on an HTTP error status — so a >2MB reply got a 413 and vanished\nwith no error and nothing in the chat. On 413, resend a truncated body (+ a\n\"reply too large, truncated\" marker) so the user gets the clipped reply instead\nof silence; log other non-ok posts.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): don't silently drop a reply the room rejects as too large",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T14:34:46Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "754073c20dd0b1af53fbcfb4b50623fb03801e9f",
          "body": "…st task)\n\nWalks a first-time user from `npm install` through creating their own\nLark/Feishu custom app (bot capability, long-connection events,\nim.message.receive_v1, the exact scopes, release-to-take-effect), storing\ncreds, starting the owner, binding a chat, daily use, management, token\nsafety, and a troubleshooting table. Linked from the README.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add a from-zero getting-started guide (install → Lark bot → fir…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T14:07:10Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "9a87557c122717e02bce2bc6dc144cd6761dbfff",
          "body": "Claude Code sometimes concludes a turn with a post_turn_summary system event\ninstead of assistant text; ACP adapter 0.52.0 doesn't map it (logs \"Unexpected\ncase\") so the reply comes through empty and nothing reaches the IM chat — worst\non no-tool conversational turns, which go fully silent. Post a \"\n[…]\nr\nwhen a clean turn produces no text, so the chat always shows the turn finished.\nProgress cards already convey what the turn did.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): never go silent — confirm turn end when the agent emits no text",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T12:24:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5fc224dfc30f69191c9cb5f79985f10113d4a43f",
          "body": "… only)\n\nA bound host ran ACP_PROGRESS=0, so the IM chat saw the instant ack then nothing\nuntil the final reply — the agent's work was invisible. host (incl. --bind) is\ndocumented as progress ON; the bound special-case contradicted that. Drop it so a\nbound host emits one progress card per tool call \n[…]\n`\nowner relays on to the chat. im=null on a bound host (owner owns the bot), so out()\nstays room-only and there is no double-send.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): bound agents relay progress to the IM chat (was final-reply…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T12:04:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7946f461729805e37110973add32db14c65f4cf5",
          "body": "The only way to get a \"private\" chat with the bot is to make a group and add\nit, but a group otherwise forces every message to @-mention the bot. Detect a\ngroup with user_count <= 1 (Lark chat.get returns the human count apart from\nbot_count) and drop the @ requirement for it, like p2p. Cached 60s s\n[…]\nd person reverts within a\nminute. Needs the im:chat:readonly scope; without it chat.get throws and we\nstay @-only (safe fallback).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): treat a solo group (one human + bot) like p2p — no @ required",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T11:52:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3c162e9c9db44647bd0d23e0ae1c437103d73d08",
          "body": "Live render test: Lark cards show inline-code backticks literally but render fenced\nblocks as a copyable code box. So shell commands stay fenced (the copy button Tom\nwanted) and every other inline backtick is dropped → bold/plain. 100/100.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): commands as fenced code blocks (copy box), no inline backticks",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T11:34:18Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a1a87c94a52cf80cd4bbb61f4cee8cc895ab0d55",
          "body": "…ckticks\n\n#1 was the Concord room name, not the Lark group name. Fetch it from the agent\nREST /rooms/:id/info (room id is the bearer) instead of Lark im.chat.get. Show it\nin the self-intro and /agents. Also drop inline backticks from the intro/agents —\nLark cards render **bold** but show `code` backticks literally. 100/100.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): show the CONCORD ROOM name (not Lark chat) + drop literal ba…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T11:30:02Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "43de7846a88f9a46ae2cc2724386e08c78f61c7a",
          "body": "…rdown\n\n- #1: the owner resolves the chat/group name (Lark im.chat.get, cached, best-effort)\n  and shows it in the self-intro (\"已接入「后端项目」\") and /agents listing.\n- #3: `concord shutdown` stops the IM owner + every agent and clears all bindings —\n  the one-command clean slate (what we'd been doing by \n[…]\nnt bots coexist in a group via @-targeting;\nthe only cautions are shared room / shared cwd / others burning your budget.)\n100/100.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): chat name in intro/agents + `concord shutdown` one-shot tea…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T11:18:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7e0d8db3714025587c6f63d7fc3ac28632678e05",
          "body": "…ng fix (0.2.0)\n\n- #1 copy: bind/rebind commands now sent as a fenced code block (Lark renders a\n  copyable code box) instead of inline backticks.\n- #3 hang: obtainRoomId force-closes the loopback (Connection: close +\n  closeAllConnections) so a browser keep-alive can't leave `concord host --bind`\n \n[…]\nat that host's room\n  (was lingering → owner kept relaying into a dead agent).\n\nBump 0.2.0 (IM owner + bindings feature). 100/100.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): bind UX round 2 — copy-box, /agents, rm unbinds, handoff ha…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T11:04:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fd6e5136a5aa6f64f390054203ad9e006348dc27",
          "body": "- #2 markdown: render outbound via im-render.mjs — status lines (收到/✓) go as plain\n  text, replies as a card; ATX headings (#) → bold (Lark cards render # literally).\n- #3 self-intro: a new binding now posts a proper intro to the chat (agent name +\n  cwd, @-me reminder), not a bare \"✓ 绑定成功\". concord\n[…]\nder open_id → display name (agent sees \"张三: task\"); /help command;\n  /usage routed to the agent verbatim (was a no-op). 97→ tests.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): UX polish — markdown render, self-intro, names, /help",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T10:47:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6ea48dffce02304e7d194010154f777971675c26",
          "body": "A stopped owner's relay session lingers in the room, so a fresh owner joining as\n\"IM\" hit 409 and the relay never came up after restart. Retry with a pid-suffixed\nname on 409 and key the loop-guard on the name actually joined (per-room). 93/93.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): owner relay survives restart — retry room join on 409",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T10:27:38Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b0c02c342c26c4428effc12270c0f7c3bcd93eca",
          "body": "When the owner picks up a NEW binding it now posts \"✓ 绑定成功 …\" (or \"⚠️ 绑定失败\"\nif the room won't join) to that chat, so the user who just ran `concord host --bind`\ngets feedback in the chat, not only the terminal. Watch the ~/.concord directory\n(the bindings file may not exist at owner startup) instead\n[…]\n the\nrelay only coming up lazily on the first message. Startup sync stays silent (a\nrestart never re-spams existing chats). 93/93.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): confirm bind success/failure IN the chat + watch dir not file",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T10:23:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0abfe811ea4c3f03615dbdec2aa54ab394008dfd",
          "body": "…phase 3+4)\n\nPhase 3 (relay, im-owner.mjs): bound chat → POST into the room (as \"IM\") + instant\nack (decision 4); per-room poll relays the agent's reply/progress/budget-notes back\nto the chat (loop-guard: skip \"IM\"); fs.watch on the bindings file brings relays up\nfor fresh binds without restarting t\n[…]\ne]` writes\nthe chat→room binding + starts a progress-OFF agent (the owner relays). Group binds\ndefault to --budget 1000000. 92/92.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): owner relay + `concord im` daemon + `concord host --bind` (…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T09:54:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8444018f7b987cb756f284955ebcbe5f5e1ed926",
          "body": "/concord-bind handshake verified live against a real Lark app: both p2p and\ngroup → action=bind, owner replies the guided command in-chat. The text-preview\nlog made the (transient first-run) ignore easy to rule out.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(im): owner logs parsed text preview (live-debug aid)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T09:23:46Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e90b3e7a1fa8a5952d8d529893306ad70b589d27",
          "body": "im-owner.mjs (`concord im`): owns the bot's single WSClient, classifies inbound\n(im-routing), handles /concord-bind + /concord-unbind IN the chat (decision 1:\nreply in-group), routes bound chats (room relay = phase 3). Bind command is now\n/concord-bind (slash, canonical; bare still accepted) — clear\n[…]\nind\". Group binds default to --budget 1000000. createOwner is testable\nwith a mock client; 6 owner tests + routing updated. 92/92.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): IM owner with /concord-bind handshake (phase 2b)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T08:49:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ecf7628f7c6022e3b4a68729296340a4cedbc46f",
          "body": "im-routing.mjs: classifyInbound + commandOf — decides ignore/bind/unbind/usage/\nmessage for each inbound message (p2p=all, group=@bot only; commands matched on\nthe mention-stripped text). No I/O/SDK → 6 offline tests. The owner daemon (2b)\nwill wire this to the WSClient. 86/86.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): pure inbound-routing brain (phase 2a)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T08:03:50Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f4576f948d5f9ea6e6917b6d4c6fc67f2b57f2c6",
          "body": "Groundwork for the single-tenant IM owner model (one bot drives N agents, routed\nby chat). im-bindings.mjs: local, atomic, keyed by platform:chat_id, force-guard\non clobber. Not wired in yet — pure store + 6 tests. Design:\nim-for-agents/docs/im-binding-design.md. 80/80.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): chat→room binding store (phase 1 of owner+bindings redesign)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T07:55:24Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "40b90c0cff2e8b5ee3dee6520175a49022f2097c",
          "body": "obtainRoomId left its 5-minute watchdog setTimeout un-cleared after the room\ncallback resolved, so the event loop stayed alive and `concord join/host` (the\nno-room browser-handoff path) appeared \"stuck waiting\" long after the daemon had\nstarted. Clear the timer on resolve + unref it so it can never block process\nexit. Adds an e2e regression test.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: CLI no longer hangs ~5min after browser room-pick (0.1.3)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T05:26:05Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "21eeb197e6de0eb8fb35317e14e9752be3b273ea",
          "body": "Reads version from package.json at runtime (single source of truth, can't drift\nfrom what's published). Folded into the not-yet-published 0.1.2. 73/73 tests\n(adds concord-version.test.mjs).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: `concord version` (-v / --version) prints the version",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T05:00:23Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6ecc12ac7b348e31d34daf3525a3aa39a55d25e0",
          "body": "Token/memory safety. `concord rm` on a RUNNING (or orphaned) host used to just\nunregister + delete state — leaving the supervisor + ACP adapter + agent group\nalive, still polling the room and burning tokens, AND throwing away the pids\nneeded to ever reap them. Confirmed live: three rm'd hosts left ~\n[…]\ncord-rm.test.mjs): a real running process\nregistered as a host is killed by `concord rm` before the entry is dropped.\n72/72 tests.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: `concord rm` reclaims the agent group before removing (0.1.2)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T04:54:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e58c5b0bd87b3ee9a6cc3bade266875cbdec1288",
          "body": "Two fixes for the published package so it works out of the box:\n\n- Default --url is now https://concord.fenginwind.com (was localhost:3001,\n  a dev leak). Override with --url http://localhost:3001 or CONCORD_URL for\n  self-hosted/dev.\n- Room id can be the 2nd positional: `concord join <agent> <room>\n[…]\nonal > CONCORD_ROOM_ID > web handoff.\n\nHelp text (concord --help and bare-bridge --help) and README updated to match.\n71/71 tests.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: default to hosted Concord + accept positional room id (0.1.1)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T04:42:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1d83a037b85cf1eafa4b14d6b0d1e86718857f94",
          "body": "Wires the IM half of `concord host` (was a stub): talk to your hosted agent from\nLark/Feishu. Personal mode = 1:1 (your own custom-app bot ↔ your room ↔ your agent),\nso NO chat↔room binding table, NO central relay, NO multi-tenant — the model-B\nmachinery that caused the old \"private chat = no respon\n[…]\nction needs a real custom app to verify\n(WSClient handshake) — see docs/im-setup-guide.md (user) + docs/lark-host-private-chat.md.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): personal-mode Lark/Feishu bridge for `concord host --im`",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-29T03:09:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3ec6414ea9241f3f1aa14322ad79d48f37cae7cd",
          "body": "The 'retry once ps recovers' note holds only for a transient ps failure at reap\n(start was captured); if ps was absent AT CAPTURE the start is null forever and the\nhost is never auto-reaped (clean shutdown / manual kill only). No behavior change.\n\nRound-5 final convergence review: CONVERGED — zero confirmed critical/high; all\ntoken-burn paths bounded. This was the only (low, doc-only) confirmed item.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: clarify the unverifiable-orphan keep-pid comment (round-5 nit)",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T12:29:20Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0dc27e1bbf31430d01a2beee56226ed9a2cf426f",
          "body": "…pause)\n\nRound-4 stabilization review found the cbfcf10 fixes themselves had two false-\nnegatives that REOPENED an unbounded burn path. Closed both:\n\nHIGH — identity-guard false-negative + permanent forfeit. When the adapter's\n  start-time was unverifiable (ps failed/absent at spawn OR transiently a\n[…]\n'}`); now it\n  points to `concord list` for the id.\n\nTests 63/63 (+4 reapAdapterGroup reason tests incl. unverifiable-not-killed).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(safety): close round-4 false-negatives (identity guard + timeout …",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T11:15:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cbfcf10f4aa0e600a580cac2ec980ca4d408c1eb",
          "body": "… review)\n\nA focused adversarial review of commit 484c4e4 confirmed the P0/P1/P3 fixes hold\nbut flagged new issues the fixes themselves introduced. Closed them (UX unchanged):\n\nHIGH — sweepOrphans group-killed a bare stale adapter pgid with NO identity guard,\n  on every command incl. read-only ones \n[…]\n delay 0), so a just-finished turn is never killed.\n\nTests 59/59 (added a recycled-pid 'never group-killed' test). README updated.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(safety): close new bugs from the burn-fix batch (fix-verification…",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T09:41:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "484c4e4606a53e2b6732cec152a1a3d41a21cc5a",
          "body": "The core guarantee — a hosted agent must never be a silent bottomless token sink —\nwas not held. A focused threat-model review (reproduced: one wedged turn burned 8M\ntokens under a 50k cap; usage-absent made the cap a no-op; crash-loop spawned 100\nadapters). Closed every path, WITHOUT changing the c\n[…]\nout test that proves a never-stopping turn is\nbounded). turnTimeoutMs is an injectable createEngine option. README \"Token safety\".\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(safety): bound + surface all token-burn paths (threat-model review)",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T08:55:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f6fbbcf38edd4a613bbce40fb580fdda473754ec",
          "body": "Resolve the comprehensive-review findings (1 critical, 1 high, 4 medium, 2 low):\n\n- CRITICAL: drain() now wraps each turn in try/catch + finally(busy=false), posts\n  a failure note to the room, and self-heals a dead engine (recreate the adapter +\n  ACP session) instead of crashing the host. Added an\n[…]\nrget stopHost, usage-mapper, dead()/resilience,\nadapter-pgid persistence). npm pack clean. Real-adapter shutdown reclaim verified.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: harden turn loop + adapter-group reclamation (review findings)",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T07:21:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b3114d9f1b17b5015800f899e9033731568f62f2",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: add repository/homepage/bugs metadata",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T04:03:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1a70268328ef12dbc279832fc332e858a3e1f8d3",
          "body": "New package (bin: concord) split out from the im-for-agents bridges/acp spike.\nDrives claude/codex/gemini over the open Agent Client Protocol via the official\n@agentclientprotocol/sdk (Zed, Apache-2.0) — no third-party orchestrator dep.\nResident session (idle = zero tokens), token budget, daemon lif\n[…]\nhild-group reclamation, personal IM bridge (concord login).\n\nconcord-mcp stays frozen; this is the additive agent-hosting ingress.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: concord-agent — host coding agents in Concord rooms over ACP",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T02:59:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        }
      ],
      "releases_count": 1,
      "commits_last_year": 76,
      "latest_release_at": "2026-06-29T12:24:12Z",
      "latest_release_tag": "v0.2.0",
      "releases_from_tags": true,
      "days_since_last_push": 8,
      "active_weeks_last_year": 4,
      "days_since_latest_release": 31,
      "mean_days_between_releases": null
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "concord-agent",
          "exists": true,
          "license": "MIT",
          "keywords": [
            "concord",
            "acp",
            "agent-client-protocol",
            "coding-agent",
            "claude",
            "codex",
            "ai",
            "cli"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/concord-agent",
          "is_deprecated": false,
          "latest_version": "0.7.18",
          "repository_url": "https://github.com/zkwasm/concord-agent",
          "versions_count": 33,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 4994,
          "first_published_at": "2026-06-29T03:40:36.745000Z",
          "latest_published_at": "2026-07-22T07:23:55.919000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 8
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [],
      "largest_source_bytes": 60670,
      "source_files_sampled": 48,
      "oversized_source_files": 1,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 57,
        "malicious_count": 0,
        "assessed_package": "npm:concord-agent@0.7.18",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "@agentclientprotocol/sdk",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "0.28.1"
        },
        {
          "name": "@larksuiteoapi/node-sdk",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.68.0"
        },
        {
          "name": "qrcode-terminal",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.12.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "zkwasm",
          "commits": 68,
          "avatar_url": "https://avatars.githubusercontent.com/u/113981964?v=4"
        },
        {
          "type": "User",
          "login": "masstensor",
          "commits": 8,
          "avatar_url": "https://avatars.githubusercontent.com/u/1336077?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.895
    },
    "quality_signals": {
      "has_ci": false,
      "has_tests": false,
      "ci_workflows": [],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": null,
            "reason": "no workflows found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": null,
            "reason": "no dependencies found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": null,
            "reason": "No tokens found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "29 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "0ae809fffffc6860ae9fad729021223e004b3146",
        "ran_at": "2026-07-31T05:48:14Z",
        "aggregate_score": 1.5,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-23T03:09:03Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": null,
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/zkwasm/concord-agent",
    "host": "github.com",
    "name": "concord-agent",
    "owner": "zkwasm"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 38,
      "inputs": {
        "security": 32,
        "vitality": 58,
        "community": 33,
        "governance": 33,
        "engineering": 31
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 58,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "at_risk",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 48,
            "inputs": {
              "commits_last_year": 76,
              "human_commit_share": 1,
              "days_since_last_push": 8,
              "active_weeks_last_year": 4
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 8 days ago",
                "points": 28.8,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 8
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "4/52 weeks with commits",
                "points": 2.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "76 commits in the last year",
                "points": 16.9,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 76
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "good",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 72,
            "inputs": {
              "releases_count": 1,
              "latest_release_tag": "v0.2.0",
              "releases_from_tags": true,
              "days_since_latest_release": 31,
              "mean_days_between_releases": null
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "1 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 31 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 31
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "cadence unknown (single release)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "release_cadence_unknown",
                    "params": {}
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 33,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 62,
            "inputs": {
              "packages": [
                "concord-agent"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 4994
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "4,994 downloads/month across npm",
                "points": 49.3,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 4994,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 33,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 14,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.895
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 90% of commits",
                "points": 2.4,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 90
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 36,
            "inputs": {
              "followers": 2,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "zkwasm",
              "public_repos": 9,
              "account_age_days": 1409
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "2 followers of zkwasm",
                "points": 3.4,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 2,
                      "login": "zkwasm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "9 public repos, account ~3 yr old",
                "points": 15,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 9
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 3
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "concord-agent"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 8
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 8 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 8
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "33 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 33
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "at_risk",
        "name": "Engineering Quality",
        "value": 31,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "critical",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "has_ci": false,
              "has_tests": false,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 32,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "critical",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Dangerous-Workflow, Packaging, Pinned-Dependencies, Signed-Releases, Token-Permissions. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "dangerous_workflow",
                    "packaging",
                    "pinned_dependencies",
                    "signed_releases",
                    "token_permissions"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 15,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 12,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 6,
              "scorecard_aggregate": 1.5
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no workflows found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "no dependencies found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "No tokens found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "29 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:concord-agent@0.7.18 runtime dependency closure — what installing the published package pulls in — 57 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:concord-agent@0.7.18",
                  "assessed": 57
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 57,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 57,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "at_risk",
        "name": "AI Readiness",
        "value": 34,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "76 of 76 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 76,
                      "sampled": 76
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "critical",
            "name": "Verify loop (build / test / typecheck)",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_pinned_dependencies"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 22,
            "inputs": {
              "has_nix": false,
              "has_tests": false,
              "lockfiles": [
                "package-lock.json"
              ],
              "has_dockerfile": false,
              "typed_language": false,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0.895,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "68 of the last 76 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 68,
                      "sampled": 76
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "no dependencies found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "moderate",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "primary_language": "JavaScript",
              "largest_source_bytes": 60670,
              "source_files_sampled": 48,
              "oversized_source_files": 1
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "JavaScript without a type-check config",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_typecheck_config_language",
                    "params": {
                      "language": "JavaScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "1/48 source files over 60KB",
                "points": 53.9,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 48,
                      "oversized": 1
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-31T05:48:18.641568Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/z/zkwasm/concord-agent.svg",
  "full_name": "zkwasm/concord-agent",
  "license_state": "standard",
  "license_spdx": "MIT"
}