Public recordAt risk
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-25 22:17 UTC
pizza-droid / cinnamon
Watch Movies, TV shows and anime from your terminal.
pizza-droid/cinnamon holds a health index of 43 out of 100, placing it in the At risk band. It scores highest on Vitality (67/100) and lowest on Community & Adoption (21/100). It was last updated today. A single contributor accounts for most of its recent work.
43
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
43
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Ownership
pizza-droidPersonal account
0 followers1 public reposince Jul 2026
This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.
Package ecosystems
| Registry | Package | Version | Downloads / mo | Versions | Last publish | Tags |
|---|---|---|---|---|---|---|
| npm | cinnamonpoints to another repo — not scored | 0.2.0-beta1 | 31 | 4 | 4676 days ago | ci |
| PyPI | cinnamon-cli | 0.3.0 | - | 20 | 0 days ago | tvmoviesanimestreamingmpvvlctmdbanilistcli |
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
67
Development activity
55Moderate
How it's scored
| 36/36 | Push recency — last push 0 days ago |
| 1.4/36 | Commit cadence — 2/52 weeks with commits |
| 18/18 | Commit volume — 129 commits in the last year |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Inputs used
| commits_last_year | 129 |
| human_commit_share | 1 |
| days_since_last_push | 0 |
| active_weeks_last_year | 2 |
Release discipline
84Good
How it's scored
| 27/27 | Ships releases — 1 releases published |
| 36/36 | Release recency — latest release 6 days ago |
| 12.6/27 | Release cadence — cadence unknown (single release) |
| 0/10 | OpenSSF Scorecard: Signed-Releases — no data |
Inputs used
| releases_count | 1 |
| latest_release_tag | v0.2.37 |
| releases_from_tags | no |
| days_since_latest_release | 6 |
| mean_days_between_releases | — |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
21
Popularity & adoption
1Critical
How it's scored
| 0/60 | Stars — 1 stars |
| 0/25 | Forks — 0 forks |
| 0/15 | Watchers — 0 watchers |
Inputs used
| forks | 0 |
| stars | 1 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
44At risk
How it's scored
| 22.5/22.5 | README |
| 16.9/22.5 | License — license file present, not a recognized license |
| 0/18 | CONTRIBUTING guide |
| 0/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 0/6.3 | PR template |
Inputs used
| has_readme | yes |
| has_license | yes |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | no |
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
31
Maintainer resilience (bus factor)
22Critical
How it's scored
| 9/54 | Bus factor — 1 contributor(s) cover half of all commits |
| 10/22.5 | Commit distribution — top contributor authored 55% of commits |
| 2.7/13.5 | Contributor breadth — 2 contributors |
| 0/10 | OpenSSF Scorecard: Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
Inputs used
| bus_factor | 1 |
| contributors_sampled | 2 |
| top_contributor_share | 0.554 |
Issue & PR responsiveness
1Critical
How it's scored
| 0/46.8 | Issue resolution — no issues or no data |
| 0/38.3 | PR acceptance — no decided pull requests or no data |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Inputs used
| merged_prs | 0 |
| open_issues | 0 |
| closed_issues | 0 |
| issue_closed_ratio | — |
| closed_unmerged_prs | 0 |
Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.
Ownership & stewardship
15Critical
How it's scored
| 10/30 | Ownership backing — personal (user) account |
| 0/20 | Verified domain — not applicable to user accounts |
| 0/25 | Owner reach — 0 followers of pizza-droid |
| 2.2/25 | Track record — 1 public repos, account ~0 yr old |
Inputs used
| followers | 0 |
| owner_type | User |
| is_verified | — |
| owner_login | pizza-droid |
| public_repos | 1 |
| account_age_days | 9 |
Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.
Package maintenance
100Excellent
How it's scored
| 25/25 | Published & resolvable — 1 package(s) on pypi |
| 35/35 | Publish recency — latest publish 0 days ago |
| 20/20 | Version history — 20 published versions |
| 20/20 | Not deprecated — active, not deprecated or yanked |
Inputs used
| packages | cinnamon-cli |
| ecosystems | pypi |
| any_deprecated | no |
| min_days_since_publish | 0 |
Engineering Quality
Are baseline engineering and documentation practices in place?
56
Engineering practices
60Moderate
How it's scored
| 24/24 | CI workflows — 1 workflow(s) |
| 24/24 | Tests present |
| 0/16 | Linter config |
| 0/9.6 | Pre-commit hooks |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — no data |
Inputs used
| has_ci | yes |
| has_tests | yes |
| has_editorconfig | no |
| has_linter_config | no |
| has_precommit_config | no |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.
Documentation
50Moderate
How it's scored
| 30/30 | README |
| 0/25 | Documentation directory |
| 0/15 | Documentation / homepage site |
| 10/10 | Repository description |
| 0/10 | Topics |
| 10/10 | Wiki |
Inputs used
| topics | — |
| has_wiki | yes |
| homepage | — |
| has_readme | yes |
| has_docs_dir | no |
| has_description | yes |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
39
Security posture
41At risk
How it's scored
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — no data |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.2/2.5 | License — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — no SAST tool detected |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — no data |
| 6.8/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 7.5/7.5 | Vulnerabilities — 0 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 4.1 |
Excluded from scoring (no data or not applicable): ci_tests, signed_releases. Remaining weights renormalized.
Dependency advisories
32At risk
How it's scored
| 17.9/35 | Direct dependencies free of known advisories — 1 affected: express 3.4.8 (moderate 6.1) |
| 1.8/25 | Indirect dependencies free of known advisories — 13 affected: minimist 0.0.10 (critical 9.8), shell-quote 0.0.1 (critical 9.8), debug 0.8.1 (high 7.5), +10 more |
| 12.7/40 | No advisories left outstanding — 13 advisory-carrying package(s) unaddressed past 90 days; oldest published 3,196 days ago |
Inputs used
| source | osv |
| advisories | 29 |
| affected_packages | 14 |
| assessed_packages | 59 |
| unassessed_packages | 0 |
| affected_by_severity | critical 2, high 7, moderate 4, low 1 |
| direct_affected_packages | 1 |
Matched the npm:cinnamon@0.2.0-beta1 runtime dependency closure — what installing the published package pulls in — 59 packages. Reachability is not analyzed.
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
28
Agent context & guidance
24Critical
How it's scored
| 0/45 | Agent instructions — no CLAUDE.md / AGENTS.md / editor rules |
| 0/15 | Machine-readable docs (llms.txt) |
| 23.5/40 | Legible commit history — 44 of 100 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 0.44 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
Verify loop (build / test / typecheck)
22Critical
How it's scored
| 0/18 | One-command bootstrap |
| 22/22 | Automated tests |
| 0/11 | Lint / format config |
| 0/11 | Static type checking |
| 0/10 | Reproducible environment |
| 0/10 | Demonstrated agent practice — no agent-authored commits among the last 100 |
| 0/8 | Automated maintenance — no automated dependency updates observed |
| 0/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
Inputs used
| has_nix | no |
| has_tests | yes |
| lockfiles | — |
| has_dockerfile | no |
| typed_language | no |
| bootstrap_files | — |
| has_devcontainer | no |
| has_linter_config | no |
| typecheck_configs | — |
| agent_commit_share | 0 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
Code legibility for models
53Moderate
How it's scored
| 0/45 | Type-checkable code — Python without a type-check config |
| 53.4/55 | Manageable file sizes — 1/34 source files over 60KB |
Inputs used
| primary_language | Python |
| largest_source_bytes | 99,035 |
| source_files_sampled | 34 |
| oversized_source_files | 1 |
Key facts
1GitHub stars
2contributors
129commits, last 12 months
0days since last push
1releases
1bus factor
0open issues
npm, PyPIpackage ecosystems
Data collection warnings
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- npm package 'cinnamon' points at a different repository (https://github.com/akoenig/cinnamon); excluded from ecosystem scoring
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
More detail
OpenSSF Scorecard 4.1 / 10
4.1aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| n/a | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 9 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | no SAST tool detected |
| 0 | Security-Policy | security policy file not detected |
| n/a | Signed-Releases | no releases found |
| 9 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 10 | Vulnerabilities | 0 existing vulnerabilities detected |
Direct dependencies 7
| Registry | Package | Version constraint | Manifest |
|---|---|---|---|
| npm | @movie-web/providers | ^2.4.13 | package.json |
| npm | webtorrent | ^2.8.5 | package.json |
| PyPI | click | >=8 | pyproject.toml |
| PyPI | requests | >=2 | pyproject.toml |
| PyPI | rich | >=13 | pyproject.toml |
| PyPI | questionary | >=2 | pyproject.toml |
| PyPI | pycryptodome | >=3 | pyproject.toml |
All dependencies not collected
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Dependency advisories 14
Installing npm:cinnamon@0.2.0-beta1 pulls in 59 packages, direct and transitive: 14 carry known advisories, of which 1 are direct dependencies.
| Package | Version | Relation | Severity | Advisories | Fixed in |
|---|---|---|---|---|---|
| minimist | 0.0.10 | indirect | critical | 2 | 1.2.6 |
| shell-quote | 0.0.1 | indirect | critical | 2 | 1.9.0 |
| debug | 0.8.1 | indirect | high | 2 | 4.3.1 |
| fresh | 0.2.0 | indirect | high | 1 | 0.5.2 |
| mime | 1.2.11 | indirect | high | 1 | 2.0.3 |
| multiparty | 2.2.0 | indirect | high | 3 | 4.3.0 |
| negotiator | 0.3.0 | indirect | high | 1 | 0.6.1 |
| qs | 0.6.6 | indirect | high | 5 | 6.14.1 |
| semver | 1.1.4 | indirect | high | 1 | 4.3.2 |
| express | 3.4.8 | direct | moderate | 5 | 5.0.0-beta.3 |
| connect | 2.12.0 | indirect | moderate | 1 | 2.14.0 |
| cookie-signature | 1.0.1 | indirect | moderate | 1 | 1.0.4 |
| send | 0.1.4 | indirect | moderate | 3 | 0.19.0 |
| cookie | 0.1.0 | indirect | low | 1 | 0.7.0 |
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 388,
"has_wiki": true,
"homepage": null,
"languages": {
"Python": 262753,
"JavaScript": 19696
},
"pushed_at": "2026-07-25T22:15:51Z",
"created_at": "2026-07-16T14:58:16Z",
"owner_type": "User",
"updated_at": "2026-07-25T22:15:39Z",
"description": "Watch Movies, TV shows and anime from your terminal.",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "master",
"license_spdx_raw": "NOASSERTION",
"primary_language": "Python",
"significant_languages": [
"Python"
]
},
"owner": {
"blog": null,
"name": null,
"type": "User",
"login": "pizza-droid",
"company": null,
"location": null,
"followers": 0,
"avatar_url": "https://avatars.githubusercontent.com/u/305646270?v=4",
"created_at": "2026-07-15T23:35:44Z",
"is_verified": null,
"public_repos": 1,
"account_age_days": 9
},
"license": {
"state": "custom",
"spdx_id": null,
"raw_spdx": "NOASSERTION",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.2.37",
"kind": "patch",
"published_at": "2026-07-18T23:13:06Z"
}
],
"recent_commits": [
{
"oid": "837194f621ac9fdfb90d8394192478f1700334bb",
"body": "_find_show rewrite: normalize x->x for hunter x hunter, factor ep\ncount into scoring so main series (64ep fmab) beats spin-offs (4ep),\nhandle single-word queries via space-stripped substring + highest ep\ncount. add 5x ep shortcut for abbreviated names (1p = one piece).\n\nanime episode picker now show\n[…]\nuture episodes as disabled with\nestimated airing time from anilist, and recently aired ones as\n'coming soon'. .5 episodes no longer crash (float parsing). search\nhistory respects history_enabled flag.",
"is_bot": false,
"headline": "fix anime search, add airing schedule, support .5 recaps",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-25T22:15:20Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1342e39492c862c46bf932adc5c11dc084b7b7bf",
"body": "- cinnamon schedule -- trending TV/movies via TMDB (requires API key)\n- cinnamon schedule anime -- anime airing schedule via AniList (no key)\n - Grouped by day, sorted by popularity\n - Estimated availability time (~45min-6h) based on popularity\n- anilist: add get_schedule() with popularity/score fields\n- tmdb: add get_trending() endpoint",
"is_bot": false,
"headline": "Add 'cinnamon schedule' command (v0.2.40)",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-24T11:57:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c4d574822009b298d3045e4e36230177c98645ab",
"body": "… link-key fix\n\n- _clock_stream: added 'link' key check for clock.json responses\n (allanime returns URLs under links[0].link, not url/file)\n- AnimeScraper.resolve: added yt-dlp fallback step for embed pages\n (ok.ru etc.) when hex sources and mp4upload are unavailable\n- CLI: anime movies now prompt\n[…]\nub/dub choice (like TV shows),\n support --sub/--dub flags, and fall back to other translation\n- CLI: removed 'Next season' button from episode menu\n- README: updated anime movies status (now working)",
"is_bot": false,
"headline": "v0.2.39: anime movies now work (sub/dub), yt-dlp fallback, clock.json…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-24T10:32:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bc74d8fe2025d31b7ca3f0e5abefdfdcf88b3b46",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "Katzover",
"author_login": "Katzover",
"committed_at": "2026-07-19T16:42:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5ae4dc8cd391890cd7b559007bbcef5b0550cf62",
"body": "Updated project name to 'Cinnamon | Beta' in README.",
"is_bot": false,
"headline": "Change project title in README.md",
"author_name": "Katzover",
"author_login": "Katzover",
"committed_at": "2026-07-19T16:32:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7f5e476573209e0619cd9f7ed4a44a93c89fa576",
"body": "Clarified instructions for running the anime command.",
"is_bot": false,
"headline": "Update README with clearer anime command usage",
"author_name": "Katzover",
"author_login": "Katzover",
"committed_at": "2026-07-19T16:20:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6c4a8e59257e1133e270a883ed32c37eddb6514c",
"body": "… to 0.2.38",
"is_bot": false,
"headline": "fix: replace blocking TMDB key prompt on launch with a dim hint; bump…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-19T15:28:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "61ef92450d5feec6045321bfe8a77aaf5df5a201",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-19T15:25:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f52d2440420cbd1148ae5e0dd8b63a8e54e120f3",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-19T15:22:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "36ed9956c02a6a823090ebadd68bb07169035b11",
"body": "- Allow _anime_movie_tmdb_id to use keyless EmbedClient (2embed) so the\n movie fallback works without a TMDB API key\n- Remove vixsrc API pre-filter that rejected correct movie IDs (vidlink\n covers the divergent id space)\n- Guard vidlink scrapers against null/non-dict responses (no crash)\n- Treat proxy 502 (vidlink 429 throttle) as inconclusive in stream probe\n- Use --http-header-fields Referer for direct mp4 instead of proxy\n double-fetch that tripped vidlink rate-limiting",
"is_bot": false,
"headline": "fix: anime movies now play via keyless webstream fallback",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-19T15:16:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9575312a4409379753e5c3c8897b7c88d3fa9374",
"body": null,
"is_bot": false,
"headline": "bump version to 0.2.37",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T23:10:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4d9e4fe7d9f2be3f298fbaed1e7e638896b7cc91",
"body": "Added extra_words count to scoring (penalizes results with words\nbeyond the query, e.g. 'The Quintessential Quintuplets Movie'\nhas 1 extra word vs the main series). Also added 'movie' and 'film'\nto the suffix penalty list.\n\nSort key: overlap > all_match > no_suffix > extra_words > name_len",
"is_bot": false,
"headline": "fix: _find_show penalizes extra words and movie/film suffixes",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T22:53:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "10973efe42575d73fbfe6918f85cf977aa600a94",
"body": "Switched _title() priority from romaji -> english -> native to\nenglish -> romaji -> native so anime search results display\nEnglish names by default.",
"is_bot": false,
"headline": "feat: show English titles instead of romaji for anime search",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T22:38:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "33803b4349a3e5bcc517e271a1d6036d42f50e0e",
"body": "TV shows on vixsrc have well-synced English subtitles. Using vidlink's\nexternal SRT caused timing drift. Only fetch vidlink subtitles for TV\nwhen vixsrc has no embedded subtitle tracks at all.\n\nMovies always try vidlink subs since vixsrc movies lack English\nsubtitles.",
"is_bot": false,
"headline": "fix: skip vidlink subs when vixsrc has embedded subs (TV shows)",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T22:23:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "99c0e7a24af5eaf0edf78e00ae9eca2aebd8540e",
"body": "This mpv build has no Lua scripting support — remove all Lua auto-\nselect logic. The fundamental issue: --slang=eng prevents mpv from\nauto-selecting the external SRT (which has no language metadata).\n\nFix: when subtitle_url is provided, skip --slang=eng and\n--subs-with-matching-audio=yes. With no la\n[…]\nmpv\nauto-selects the first (and only) subtitle track — our English SRT.\nWhen no external sub is provided, keep --slang=eng for embedded\nsubtitle track selection (TV shows with multi-language streams).",
"is_bot": false,
"headline": "fix: no Lua, no --slang when external subtitles are used",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T22:19:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2033262bb5900c60a62e5aa50b34806f31c94a83",
"body": "Reverted to vixsrc-first priority (vidlink CDN was returning 403).\nvidlink is still queried for English subtitle SRT, downloaded to a\nlocal temp file and passed to mpv via --sub-file.\n\nCritical Windows fix: mpv v0.41.0 on Windows requires\n--option=value (equals) syntax, not --option value (space-separated).\nSpace-separated --sub-file / --script caused mpv to interpret the\npath as a media file and exit with code 1.",
"is_bot": false,
"headline": "fix: vixsrc-first resolve, use --option=value format for Windows mpv",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T22:11:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a6a8d675b1166240a9e9bb47ea66b1504381c098",
"body": "- Download subtitle SRT from CDN to local temp file instead of\n passing URL to mpv (which may not support HTTP URLs for --sub-file)\n- Lua script now retries external sub selection after 500ms delay\n if tracks not yet available at file-loaded time\n- Also listens to tracks-changed event for late-loading subtitles\n- Pass --script and --sub-file as separate args to avoid Windows\n path-parsing issues with spaces in temp file paths\n- Clean up both Lua scripts and downloaded SRTs on exit",
"is_bot": false,
"headline": "fix: download SRT locally, robust Lua auto-select with retry",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T21:58:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2df65737ad46cbcf51f8a52718cc1db8cf74b974",
"body": "Resolve logic now tries vidlink first (it always has English SRT\ncaptions). vixsrc is used only as fallback when vidlink fails.\n\nmpv --sub-file loads external SRT but does NOT auto-select it for\ndisplay. Added a Lua script (written to temp file, cleaned up on\nexit) that watches for file-loaded event\n[…]\nk-first priority in both movie and TV paths\n - player.py: --sub-file=URL + --script=auto_select.lua\n - Removed previous --sid=no / --sid=0 attempts that conflicted\n with external subtitle display",
"is_bot": false,
"headline": "fix: prefer vidlink with auto-selected English subtitles over vixsrc",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T21:53:50Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0621b1989e9800e07a7e92a05b2740417640a256",
"body": "…id=no\n\nThe resolve logic previously used vixsrc's has_subs flag to decide\nwhether to skip vidlink entirely. This meant vixsrc streams with\nembedded Arabic subtitles (but no English) were returned without\nany English subtitle URL.\n\nNow: always try both sources. vixsrc is preferred for video quality,\n[…]\nt vidlink's English SRT is always fetched and passed alongside.\nIn player.py, --sid=no disables embedded subtitle tracks from the\nHLS stream so mpv shows only the external English SRT from --sub-file.",
"is_bot": false,
"headline": "fix: always try vidlink for subtitles, disable embedded subs with --s…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T21:42:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "df7bf53c77c0ffaf5abc23b91e80da7022c91f0d",
"body": "vidlink caption tracks use full language names ('English', 'Francais')\nnot codes. The previous check only matched lowercase 'english' --\nnow uses .lower() for case-insensitive comparison.\nAlso improved fallback: picks first caption with a non-empty language\nfield instead of blindly returning captions[0] (which can be garbled).",
"is_bot": false,
"headline": "fix: case-insensitive subtitle language match",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T21:39:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "21b38515a1bc58a3e65934beeddaa318b9576427",
"body": "- Added subtitle_url field to ScraperResult\n- _try_vidlink / _try_vidlink_movie extract English caption URL\n from vidlink's API response (SRT subtitle)\n- _try_vixsrc / _try_vixsrc_movie now also return whether the HLS\n master playlist has embedded subtitle tracks (has_subs)\n- Resolve method prefer\n[…]\n back to vixsrc only if vidlink also fails\n- play_mpv passes subtitle URL via --sub-file=URL\n- vixsrc (primary source) has no subtitles for many movies;\n vidlink always provides external SRT captions",
"is_bot": false,
"headline": "fix: subtitle support for movies (vidlink captions)",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T21:34:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8d8a90e7f84fb334c3c69675d668d5123d0b4b0c",
"body": "Adds a 'Next Season →' option to the post-playback menu when\nscraper is 'anime'. When selected:\n1. Queries AniList for the show's SEQUEL relation\n2. Looks up the sequel on allanime\n3. Opens the episode picker for the new show\n\nThis bridges TMDB's single-season grouping with allanime's\nseparate-show-per-season model (e.g. AoT S1 → AoT S2).",
"is_bot": false,
"headline": "feat: Next Season in anime post-playback menu",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T21:16:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f2f4d2b4cfdea475215068570dd0dde4f27d89aa",
"body": "This reverts commit d2578f970880de3cb67f06a7576bc73c9b12e82f.",
"is_bot": false,
"headline": "Revert \"feat: add Next Season option in anime episode picker\"",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T21:14:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d2578f970880de3cb67f06a7576bc73c9b12e82f",
"body": "When the current season has a next season available in allanime's\nepisode data, a 'Next Season \\u2192' choice appears at the bottom\nof the episode list. Selecting it re-opens the picker for the\nnext season.",
"is_bot": false,
"headline": "feat: add Next Season option in anime episode picker",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T21:12:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8bd3afa80910be10dcbad962b886be8f7fcae560",
"body": "When exact and substring matching fails, _find_show fell back to\nresults[0] which often returns a spinoff/special instead of the\nmain series (e.g. 'Frieren: Part 3' vs 'Sousou no Frieren').\n\nNew fallback scores each result by:\n- word overlap with the query\n- whether all query words appear\n- absence of suffix keywords (part, season, special, cour, ova)\n- shortest name (main series names are typically shortest)\n\nFixes 'cinnamon frieren' showing only 6 episodes instead of 28.",
"is_bot": false,
"headline": "fix: match main series in _find_show instead of spinoffs",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T21:03:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2a8f03a7eefc55dd133112df7fa6311fba149def",
"body": "Allanime can list a translation type (e.g. dub) in\navailableEpisodesDetail with an empty episode array.\nFilter those out before offering the picker, and add a\nguard for 'no episodes at all' to prevent max() on [].",
"is_bot": false,
"headline": "fix: skip empty translation keys in anime episode picker",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T20:53:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "542657c64c4eaa7fc498b08c59b20ec3eee11e08",
"body": null,
"is_bot": false,
"headline": "0.2.36",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T20:51:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df20f5c2108a31c186b0197600e0f400b636257d",
"body": "- xpass returned fake TikTok PNG slides as video segments (TIK)\n or 403 Forbidden (VID) — neither is a working stream\n- Removed xpass.py, its entry in _BUILTIN_SCRAPERS, and README entry\n- Cleaned up related test and debug files",
"is_bot": false,
"headline": "revert: remove xpass scraper (broken sources)",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T20:51:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f15d0287b33b86844e743822001c278a48041466",
"body": "Setup now offers a skip option when no key is configured, with a\nnote about the experimental 2embed fallback. First-run welcome\nscreen also updated to mention the proxy fallback (default: skip).\nThis makes setup non-blocking for users without a TMDB key.",
"is_bot": false,
"headline": "feat: allow skipping TMDB key in setup wizard",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T20:51:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4e7cf564b1ffb8156a1fca961ab87ab87b2159a4",
"body": null,
"is_bot": false,
"headline": "docs: add xpass to built-in scrapers list in README",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T20:51:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "789f7a113d1f3bd33d0d4b3b9a1a3ad466ffa21f",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T20:37:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "17c2640aaca2be116576a0508548893cfe09f8b7",
"body": "- EmbedClient wraps api.2embed.cc for TV/movie search and details\n when no TMDB API key is configured (replaces SystemExit with\n graceful fallback)\n- _get_tmdb() returns EmbedClient on MissingAPIKey instead of\n printing error and exiting\n- Fixed watch command passing None as metadata client to\n _interactive_episode_picker -> now calls _get_tmdb()\n- XPassScraper added to _BUILTIN_SCRAPERS (2embed video source)\n- Version bumped to 0.2.35\n- tests/probe_embedapi.py: smoketest for EmbedClient",
"is_bot": false,
"headline": "feat: 2embed metadata fallback (no TMDB key) + XPass scraper",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T20:35:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ef8386131ea5e26bcce0ba7799b691f165aad4de",
"body": "… raw exception leak\n\n- Replace _handle_tmdb_error with broader _handle_errors that also catches\n ScraperError, PlayerError, and unknown exceptions\n- Apply _handle_errors to all user-facing commands (anime, play_url, history,\n scrapers, install) for consistent clean error output\n- Wrap anilist search_anime() requests in try/except to avoid raw\n ConnectionError/Timeout/HTTPError bubbling up\n- Normalize pip install -- python -m pip install in help text\n\nVersion bump: 0.2.35",
"is_bot": false,
"headline": "refactor: catch all errors with _handle_errors decorator, fix anilist…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T19:42:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "44bfcc25cbc6966403d610b0983b0c5d2d5a7b94",
"body": "…lect",
"is_bot": false,
"headline": "revert(ui): roll back keyboard episode picker, restore questionary se…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T19:24:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2031df6424ae1cc62fde011d0279222256543986",
"body": "…mber again plays",
"is_bot": false,
"headline": "feat(ui): keyboard episode picker — one number press selects, same nu…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T19:20:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "331a17eac19de86b4b905c204fdea77a51652e49",
"body": "…yt-dlp retry backoff + real error output",
"is_bot": false,
"headline": "fix(webstream): prefer vixsrc for downloads (vidlink .mp4 CDN 429s); …",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T19:14:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c5ab7945f644a3219b14fd252c1be73615cbc434",
"body": null,
"is_bot": false,
"headline": "fix(download): surface yt-dlp's real error instead of bare exit code 1",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T19:06:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9fd257dd452fe8a27ae9a7a069a6a9cfdf8e629a",
"body": "…+ quality select",
"is_bot": false,
"headline": "fix(webstream): repair vidlink parser (direct mp4, not HLS playlist) …",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T19:01:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff4cdc78019ea083dbc3f4e1e1a170119c36d4ab",
"body": "…eam downloads",
"is_bot": false,
"headline": "feat(naming): Sub/Dub + quality labels; prefer vidlink CDN for webstr…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T18:57:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0f7eee621006141cf034f4caec3c031c4e66ac7a",
"body": "…an network errors",
"is_bot": false,
"headline": "fix(download): revert slow yt-dlp flags; allanime IPv4 DNS bias + cle…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-18T18:45:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ae768f5d43f5618b1914c26070016d05f6da3bc1",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T15:26:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a9cff6f10593fd1a479191c6a815ccf4021c2825",
"body": "…--dub\n\n- player: remove invalid --demuxer-read-timeout (crashed mpv instantly);\n keep valid --network-timeout=20; clearer launch-failure message\n- webstream: verify vixsrc master playlist before returning it so a 502\n error page falls back to vidlink cleanly instead of a silent black screen\n- web\n[…]\nng=eng --slang=eng (don't strip Italian track,\n which broke mpv's HLS demuxer -> audio=eof)\n- cli: add --sub/--dub flags to \u0007nime to skip the translation prompt\n- docs: document --sub/--dub in README",
"is_bot": false,
"headline": "fix(playback): mpv flags, vixsrc 502 fallback, English audio + --sub/…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T15:23:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "bc6b47e88c9a4f5981f96639eb12b85bc266ac2b",
"body": null,
"is_bot": false,
"headline": "ui: trim 'timeout 90s' debug text from resolving spinner",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T12:52:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8f8eb62e7923a71d4a287d6912c758106cb07d99",
"body": "…or mp4 streams",
"is_bot": false,
"headline": "fix(mpv): allow seeking to unloaded time (--force-seekable + cache) f…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T12:43:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "02215d65932b001ba21410721c0a807fa4d4fe70",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T12:40:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1be31558e1841a3a95eb2cf7895a9a1e7d874d6a",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T12:25:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "017e53a476c109ee8bb8a4e7151baed47fc375bb",
"body": null,
"is_bot": false,
"headline": "docs: fix version badge endpoint (pypi/v not pyproject/v)",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T12:18:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "34b3e279b276d3836b08b276f32ff502e0fd2d16",
"body": null,
"is_bot": false,
"headline": "docs: label version badge as 'version'",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T12:16:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a79b0e88259c1e475a02b24235809d1911a5ad95",
"body": null,
"is_bot": false,
"headline": "docs: use dynamic PyPI version badge (auto-updates, no manual bump)",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T12:16:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "300c395e19d88bad813463e02671ad5c970fb7c3",
"body": "…on (AA_CRYPTO_MISSING)",
"is_bot": false,
"headline": "fix(anime): add allanime aaReq crypto token + GCM tobeparsed decrypti…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T12:16:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fccbfed0be33c93c8b9bebf494dbc936f19c0695",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T11:07:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d4d3282f2e0a0d4f386cf54b083caaa15f144c43",
"body": null,
"is_bot": false,
"headline": "Stop tracking AGENTS.md (added to .gitignore)",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T10:58:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8fdb6abaab2e9f6b6afad79cf68b46d52efcf005",
"body": "…b tarball",
"is_bot": false,
"headline": "update command now installs from PyPI (cinnamon-cli) instead of githu…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T10:53:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "31ee98730ac20071376d06fa2e2e06cf98ff0282",
"body": null,
"is_bot": false,
"headline": "docs(AGENTS): clarify version bump policy and stop force-tagging",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T10:50:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "632b1648d87b931e6c55b8fb4b4f41c947f7df16",
"body": null,
"is_bot": false,
"headline": "README: use pip install cinnamon-cli instead of github URL",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T10:49:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5271df109ba1627e0ee47be1198aadae031b1754",
"body": null,
"is_bot": false,
"headline": "Add download extra (yt-dlp) and simplify README install",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T10:45:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "24eb2c990e682f1b4300e78dbb5b128bc74b25db",
"body": "…on v5/v6)",
"is_bot": false,
"headline": "Fix CI: revert action bumps, disable attestations (Set up job failed …",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T10:42:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "594ce563a9d5a89e022c40bc5c2276bff69d27e6",
"body": null,
"is_bot": false,
"headline": "Bump version to 0.2.20",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T10:14:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "282a95783c2f7010eefade122f1dae7caf79fc8f",
"body": "…tations, Node 20 warning)",
"is_bot": false,
"headline": "Bump publish action to v1 + checkout/setup-python to v5/v6 (fix attes…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T10:13:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "85a92e3547cffb04454a5c02291cb341be70fb50",
"body": null,
"is_bot": false,
"headline": "Add PyPI trusted-publish GitHub Actions workflow (workflow.yml)",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T10:05:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03587a95ef4c9f588c880f29ed6d05fa96819754",
"body": "…, add readme/urls metadata",
"is_bot": false,
"headline": "Prepare PyPI publish: rename to cinnamon-cli, drop unused textual dep…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T09:54:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf2d82694d9c9093d033df6c54ebf17a46095f8d",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T09:44:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "61a04308749e458762b0890309152428a69cbac8",
"body": "…c, notes)",
"is_bot": false,
"headline": "README: sync with v0.2.19 (install URL, resume wording, webstream des…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T09:43:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c75250b53f9cc9a1cb3799904a9dee385d96c5dd",
"body": "- switch LICENSE from MIT to CC BY-NC 4.0 (free/open for everyone,\n non-commercial only); update README badge and pyproject license field\n- setup wizard no longer asks for a default scraper (fallback handles it)\n- check for updates on every command entry via cli() group (cached 24h)\n- bump version to 0.2.19",
"is_bot": false,
"headline": "Non-commercial license + setup/update-check tweaks (v0.2.19)",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T09:37:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c66372404d9dfe6a66d06b6038ccabbc9fce0870",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T09:31:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "74634d3aa321395ff0ff595e9e82003ed195dbec",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-17T09:29:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9d85d83893afcd8dc1c444cace5e514a009a381",
"body": "- TV picker now suggests last watched + 1 when that episode exists,\n falls back to last watched otherwise\n- anime flow suggests next episode and falls back to last available\n instead of hard-erroring when it isn't out yet\n- bump version to 0.2.18",
"is_bot": false,
"headline": "Resume from next unwatched episode instead of last watched (v0.2.18)",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-16T22:27:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2c867a8f6b5680c36438a64c5a64eb6c074ac2d9",
"body": "…ng (v0.2.17)\n\n- _launch() verifies the desktop player actually started; if it exits\n immediately (e.g. mpv with no on WSL2/headless) it\n captures stderr and raises PlayerLaunchError with a clear reason\n instead of returning a dead proc that _play_with_menu blocks on forever\n- surfaces 'no display found' hint for missing X11/Wayland\n- bump version to 0.2.17",
"is_bot": false,
"headline": "Fix player launch: detect dead player and report why instead of hangi…",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-16T22:10:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "24f20cba3be26fccef3c0e4b0a0a4548b16af054",
"body": "- watch defaults to combined TV+movie search and dispatches by picked type\n- reword bare prompt to 'show or movie'; update README/version badge\n- add themed focus style so the highlighted picker row is the clear focus\n- EOF-safe prompts (history/download/resume no longer crash on closed stdin)\n- cap numbered-fallback attempts to avoid infinite loop on bad input\n- remove dead 'tui' command that hung on a missing module\n- add tests/test_ui_smoke.py UI fragility harness",
"is_bot": false,
"headline": "Make movies first-class and harden interactive UI (v0.2.16)",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-16T22:03:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "84c9f931affbb9e59558d129594467b1de40bfad",
"body": "…ferer-injecting server",
"is_bot": false,
"headline": "Termux: proxy hotlink-protected direct links (mp4upload) via local re…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T22:03:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9c265476dc61d8b89471a3f1170ef1b0700e95b6",
"body": null,
"is_bot": false,
"headline": "Add scraper fallback: anime auto-tries webstream when no source found",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T22:03:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5c0038e1db295f7c8c5a737553317326001bb22a",
"body": null,
"is_bot": false,
"headline": "Fix anime scraper crash on episodes with no stream ({'episode': None})",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T22:03:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9d46e754db06c4488454766f247fd179608bb3f",
"body": null,
"is_bot": false,
"headline": "Fix resume prompt aborting/looping on invalid input (cinnamon frieren)",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T22:03:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e78375ff633c4871114b3cabedee3a8d38771fee",
"body": null,
"is_bot": false,
"headline": "Add movie download via yt-dlp (_play_movie)",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T22:03:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0bf67236c26e479a068ed36c4d1631b6246038fb",
"body": "…I, cache logic)",
"is_bot": false,
"headline": "Movie support for vidsrc/torrentio + watch; fix update check (tags AP…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T22:03:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "583b8a3d680ba52b146c56f4c414ae7cb833e448",
"body": "…bstream",
"is_bot": false,
"headline": "Search both TV and movies by default; implement movie playback via we…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T22:03:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0d9e0a88ed74f6da973a3c2ec146e8e7368bf324",
"body": null,
"is_bot": false,
"headline": "Remove useless plain-output mode entirely",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T22:03:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "333c1c7420d8d40dc4c3e91d650826a87d48e749",
"body": null,
"is_bot": false,
"headline": "Add --plain/-p flag and persistent plain output to hide the TUI",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T22:03:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0f82aa5b43dcffd95fa17cd35e266ff6220aba15",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-16T19:11:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cda376089e8980832a52bd8234986905b0ba68f4",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-16T19:10:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c322870ec1b36e0322e5ade54c2d12b195d7fe1b",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-16T19:09:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8656083439b4ba7cc6660a7cf573bb6912906c07",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-16T19:04:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff09e5ea6eefedda6f07225445f721ed0906678f",
"body": null,
"is_bot": false,
"headline": "Update README.md",
"author_name": "pizza-droid",
"author_login": "pizza-droid",
"committed_at": "2026-07-16T18:57:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e9637f0fbeb9f90a421cc7fd63d3bc569567c605",
"body": "… for live HLS)",
"is_bot": false,
"headline": "Termux: auto-enable English subtitles via mpv.conf (practical burn-in…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T18:47:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7db8b02545a63c5f9eaed1e224d8205c4b6e76c7",
"body": "…tles now included",
"is_bot": false,
"headline": "webstream: force English audio (lang=en) on vixsrc and vidlink; subti…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T18:42:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "008c8fd69a9dff719e45ebfbb501546048fed0d3",
"body": "…ot opening)",
"is_bot": false,
"headline": "Termux: launch mpv/vlc via explicit am start VIEW intent (fixes VLC n…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T18:38:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0a1c307705bf68d05d609797c19de9fe2f2f8de0",
"body": "…c, fixing Exec format error",
"is_bot": false,
"headline": "Termux: launch mpv/vlc via shell wrapper (Android app) instead of exe…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T18:36:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7a6eaa1542f4f1929ea86ac2dba9058df3b25812",
"body": "….2.2, add post-install version verify",
"is_bot": false,
"headline": "Fix stale __version__ (0.1.9) causing infinite update loop; bump to 0…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T18:31:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9b54f766ab5b5498d4776c55ed20948280e472d",
"body": "…a path (fixes Exec format error)",
"is_bot": false,
"headline": "On Termux, invoke players via PATH name instead of absolute /data/dat…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T18:26:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "05a7e5afb0db2879c73e2cbb7a0bb1110df083a5",
"body": "…xec format error",
"is_bot": false,
"headline": "Auto-fallback to vlc when mpv fails to launch; suggest reinstall on E…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T18:24:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cecc3d57990451632864129551ef6c7c254d16c4",
"body": null,
"is_bot": false,
"headline": "Add config show-api-key command to reveal active TMDB key and its source",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T18:07:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6811f3a125e26a8ac52f1d3e5b9359046a416450",
"body": "… bump to 0.2.1",
"is_bot": false,
"headline": "Make playwright optional (scrapers extra) so core installs on Termux;…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T18:01:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd0adeb3581eeac1d00a3962af1c0a2a54e8aa8c",
"body": "…ommand",
"is_bot": false,
"headline": "Add watch history tracking with resume prompts and cinnamon history c…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T17:56:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "984f4db4a19eddfebd4a04048d31a20a4257f207",
"body": null,
"is_bot": false,
"headline": "Fix progress line artifacts, remove redundant --progress --newline flags",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T17:43:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dadac8010e43eeef430fbe39f07cc5267a54bd5c",
"body": "…show bar or raw yt-dlp output",
"is_bot": false,
"headline": "Simplify progress: merge stderr to stdout, add --progress --newline, …",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T17:21:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c7ef2935c3238d9861636f19f9c49edf2010c5a2",
"body": null,
"is_bot": false,
"headline": "Resume can now re-run range downloads by re-resolving all episodes",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T17:15:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9c441e8b832389eafea146d4b3885be4ef221197",
"body": "…esent",
"is_bot": false,
"headline": "Resume: add cleanup prompt when only unresumable range entries are pr…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T17:13:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3e6940604e3395cf8a31ad387356885a64b5cb48",
"body": "…rect mp4)",
"is_bot": false,
"headline": "Add spinner thread for downloads without percentage progress (e.g. di…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T17:00:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "06b48a1ee54a93b0d030d941b8278f799e901dc2",
"body": null,
"is_bot": false,
"headline": "Fix download list: convert float timestamp to formatted date string",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T16:56:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "92b064c6da5e01cdcbc248a639794951099b7ecc",
"body": "…h download_video and _resolve_and_play",
"is_bot": false,
"headline": "Fix status management: set status to 'error' on yt-dlp failure in bot…",
"author_name": "katzover",
"author_login": "Katzover",
"committed_at": "2026-07-16T16:53:46Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 1,
"commits_last_year": 129,
"latest_release_at": "2026-07-18T23:13:06Z",
"latest_release_tag": "v0.2.37",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 2,
"days_since_latest_release": 6,
"mean_days_between_releases": null
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "cinnamon",
"exists": true,
"license": "MIT",
"keywords": [
"ci"
],
"ecosystem": "npm",
"matches_repo": false,
"registry_url": "https://www.npmjs.com/package/cinnamon",
"is_deprecated": false,
"latest_version": "0.2.0-beta1",
"repository_url": "https://github.com/akoenig/cinnamon",
"versions_count": 4,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 31,
"first_published_at": "2013-10-05T11:35:50.081000Z",
"latest_published_at": "2013-10-05T22:09:30.150000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 4676
},
{
"name": "cinnamon-cli",
"exists": true,
"license": "CC BY-NC 4.0",
"keywords": [
"tv",
"movies",
"anime",
"streaming",
"mpv",
"vlc",
"tmdb",
"anilist",
"cli",
"Environment :: Console",
"License :: Other/Proprietary License",
"Operating System :: OS Independent",
"Programming Language :: Python :: 3",
"Topic :: Utilities"
],
"ecosystem": "pypi",
"matches_repo": true,
"registry_url": "https://pypi.org/project/cinnamon-cli/",
"is_deprecated": false,
"latest_version": "0.3.0",
"repository_url": "https://github.com/pizza-droid/cinnamon",
"versions_count": 20,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": "2026-07-17T10:06:28.909512Z",
"latest_published_at": "2026-07-25T22:16:20.511473Z",
"latest_version_yanked": null,
"days_since_latest_publish": 0
}
]
},
"popularity": {
"forks": 0,
"stars": 1,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": null,
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [],
"largest_source_bytes": 99035,
"source_files_sampled": 34,
"oversized_source_files": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json",
"pyproject.toml"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [
{
"name": "minimist",
"direct": false,
"version": "0.0.10",
"severity": "critical",
"ecosystem": "npm",
"cvss_score": 9.8,
"advisory_ids": [
"GHSA-vh95-rmgr-6w4m",
"GHSA-xvch-5gv4-984h"
],
"fixed_version": "1.2.6",
"advisory_count": 2,
"oldest_advisory_days": 2304
},
{
"name": "shell-quote",
"direct": false,
"version": "0.0.1",
"severity": "critical",
"ecosystem": "npm",
"cvss_score": 9.8,
"advisory_ids": [
"GHSA-395f-4hp3-45gv",
"GHSA-qg8p-v9q4-gh34"
],
"fixed_version": "1.9.0",
"advisory_count": 2,
"oldest_advisory_days": 2713
},
{
"name": "debug",
"direct": false,
"version": "0.8.1",
"severity": "high",
"ecosystem": "npm",
"cvss_score": 7.5,
"advisory_ids": [
"GHSA-9vvw-cc9w-f27h",
"GHSA-gxpj-cx7g-858c"
],
"fixed_version": "4.3.1",
"advisory_count": 2,
"oldest_advisory_days": 2907
},
{
"name": "fresh",
"direct": false,
"version": "0.2.0",
"severity": "high",
"ecosystem": "npm",
"cvss_score": 7.5,
"advisory_ids": [
"GHSA-9qj9-36jm-prpv"
],
"fixed_version": "0.5.2",
"advisory_count": 1,
"oldest_advisory_days": 2923
},
{
"name": "mime",
"direct": false,
"version": "1.2.11",
"severity": "high",
"ecosystem": "npm",
"cvss_score": 7.5,
"advisory_ids": [
"GHSA-wrvr-8mpx-r7pp"
],
"fixed_version": "2.0.3",
"advisory_count": 1,
"oldest_advisory_days": 2927
},
{
"name": "multiparty",
"direct": false,
"version": "2.2.0",
"severity": "high",
"ecosystem": "npm",
"cvss_score": 7.5,
"advisory_ids": [
"GHSA-65x3-rw7q-gx94",
"GHSA-qxch-whhj-8956",
"GHSA-xh3c-6gcq-g4rv"
],
"fixed_version": "4.3.0",
"advisory_count": 3,
"oldest_advisory_days": 68
},
{
"name": "negotiator",
"direct": false,
"version": "0.3.0",
"severity": "high",
"ecosystem": "npm",
"cvss_score": null,
"advisory_ids": [
"GHSA-7mc5-chhp-fmc3"
],
"fixed_version": "0.6.1",
"advisory_count": 1,
"oldest_advisory_days": 2846
},
{
"name": "qs",
"direct": false,
"version": "0.6.6",
"severity": "high",
"ecosystem": "npm",
"cvss_score": 7.5,
"advisory_ids": [
"GHSA-6rw7-vpxm-498p",
"GHSA-f9cm-p3w6-xvr3",
"GHSA-gqgv-6jq5-jjj9",
"GHSA-hrpp-h998-j3pp",
"GHSA-jjv7-qpx3-h62q"
],
"fixed_version": "6.14.1",
"advisory_count": 5,
"oldest_advisory_days": 3196
},
{
"name": "semver",
"direct": false,
"version": "1.1.4",
"severity": "high",
"ecosystem": "npm",
"cvss_score": 7.5,
"advisory_ids": [
"GHSA-x6fg-f45m-jf5q"
],
"fixed_version": "4.3.2",
"advisory_count": 1,
"oldest_advisory_days": 3196
},
{
"name": "express",
"direct": true,
"version": "3.4.8",
"severity": "moderate",
"ecosystem": "npm",
"cvss_score": 6.1,
"advisory_ids": [
"GHSA-cm5g-3pgc-8rg4",
"GHSA-gpvr-g6gh-9mc2",
"GHSA-jj78-5fmv-mv28",
"GHSA-qw6h-vgh9-j6wx",
"GHSA-rv95-896h-c2vc"
],
"fixed_version": "5.0.0-beta.3",
"advisory_count": 5,
"oldest_advisory_days": 2832
},
{
"name": "connect",
"direct": false,
"version": "2.12.0",
"severity": "moderate",
"ecosystem": "npm",
"cvss_score": 5.4,
"advisory_ids": [
"GHSA-rch9-xh7r-mqgw"
],
"fixed_version": "2.14.0",
"advisory_count": 1,
"oldest_advisory_days": 2921
},
{
"name": "cookie-signature",
"direct": false,
"version": "1.0.1",
"severity": "moderate",
"ecosystem": "npm",
"cvss_score": 4.4,
"advisory_ids": [
"GHSA-92vm-wfm5-mxvv"
],
"fixed_version": "1.0.4",
"advisory_count": 1,
"oldest_advisory_days": 2392
},
{
"name": "send",
"direct": false,
"version": "0.1.4",
"severity": "moderate",
"ecosystem": "npm",
"cvss_score": 5.3,
"advisory_ids": [
"GHSA-jgqf-hwc5-hh37",
"GHSA-m6fv-jmcg-4jfg",
"GHSA-xwg4-93c6-3h42"
],
"fixed_version": "0.19.0",
"advisory_count": 3,
"oldest_advisory_days": 3196
},
{
"name": "cookie",
"direct": false,
"version": "0.1.0",
"severity": "low",
"ecosystem": "npm",
"cvss_score": null,
"advisory_ids": [
"GHSA-pxg6-pf52-xh8x"
],
"fixed_version": "0.7.0",
"advisory_count": 1,
"oldest_advisory_days": 659
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"low": 1,
"high": 7,
"critical": 2,
"moderate": 4
},
"advisory_count": 29,
"affected_count": 14,
"assessed_count": 59,
"malicious_count": 0,
"assessed_package": "npm:cinnamon@0.2.0-beta1",
"unassessed_count": 0,
"direct_affected_count": 1
},
"ecosystems": [
"npm",
"pypi"
],
"dependencies": [
{
"name": "@movie-web/providers",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^2.4.13"
},
{
"name": "webtorrent",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^2.8.5"
},
{
"name": "click",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=8"
},
{
"name": "requests",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=2"
},
{
"name": "rich",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=13"
},
{
"name": "questionary",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=2"
},
{
"name": "pycryptodome",
"manifest": "pyproject.toml",
"ecosystem": "pypi",
"version_constraint": ">=3"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 0,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "pizza-droid",
"commits": 72,
"avatar_url": "https://avatars.githubusercontent.com/u/305646270?v=4"
},
{
"type": "User",
"login": "Katzover",
"commits": 58,
"avatar_url": "https://avatars.githubusercontent.com/u/100523537?v=4"
}
],
"contributors_sampled": 2,
"top_contributor_share": 0.554
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"workflow.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 9,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 9,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 10,
"reason": "0 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "837194f621ac9fdfb90d8394192478f1700334bb",
"ran_at": "2026-07-25T22:17:29Z",
"aggregate_score": 4.1,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-25T22:16:24Z",
"oldest_open_prs": [],
"last_merged_pr_at": null,
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/pizza-droid/cinnamon",
"host": "github.com",
"name": "cinnamon",
"owner": "pizza-droid"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 43,
"inputs": {
"security": 39,
"vitality": 67,
"community": 21,
"governance": 31,
"engineering": 56
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 67,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"commits_last_year": 129,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 2
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "2/52 weeks with commits",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 2
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "129 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 129
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "good",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 84,
"inputs": {
"releases_count": 1,
"latest_release_tag": "v0.2.37",
"releases_from_tags": false,
"days_since_latest_release": 6,
"mean_days_between_releases": null
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "1 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 1
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 6 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 6
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "cadence unknown (single release)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "release_cadence_unknown",
"params": {}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 21,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 1,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "1 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 1
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "at_risk",
"name": "Community health",
"note": null,
"notes": [],
"value": 44,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "license file present, not a recognized license",
"points": 16.9,
"status": "partial",
"details": [
{
"code": "license_custom",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 31,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 22,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 2,
"top_contributor_share": 0.554
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 55% of commits",
"points": 10,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 55
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "2 contributors",
"points": 2.7,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 2
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution",
"pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"merged_prs": 0,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "no decided pull requests or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_decided_prs_or_data",
"params": {}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "critical",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 15,
"inputs": {
"followers": 0,
"owner_type": "User",
"is_verified": null,
"owner_login": "pizza-droid",
"public_repos": 1,
"account_age_days": 9
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "0 followers of pizza-droid",
"points": 0,
"status": "missed",
"details": [
{
"code": "owner_followers",
"params": {
"count": 0,
"login": "pizza-droid"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "1 public repos, account ~0 yr old",
"points": 2.2,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 1
}
},
{
"code": "account_age_years",
"params": {
"years": 0
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"cinnamon-cli"
],
"ecosystems": "pypi",
"any_deprecated": false,
"min_days_since_publish": 0
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on pypi",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "pypi"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 0 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 0
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "20 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 20
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 56,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 60,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "1 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 1
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 39,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 41,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 4.1
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "0 existing vulnerabilities detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "at_risk",
"name": "Dependency advisories",
"note": "Matched the npm:cinnamon@0.2.0-beta1 runtime dependency closure — what installing the published package pulls in — 59 packages. Reachability is not analyzed.",
"notes": [
{
"code": "advisories_scope_published",
"params": {
"package": "npm:cinnamon@0.2.0-beta1",
"assessed": 59
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 32,
"inputs": {
"source": "osv",
"advisories": 29,
"affected_packages": 14,
"assessed_packages": 59,
"unassessed_packages": 0,
"affected_by_severity": "critical 2, high 7, moderate 4, low 1",
"direct_affected_packages": 1
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "1 affected: express 3.4.8 (moderate 6.1)",
"points": 17.9,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 1,
"packages": "express 3.4.8 (moderate 6.1)"
}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "13 affected: minimist 0.0.10 (critical 9.8), shell-quote 0.0.1 (critical 9.8), debug 0.8.1 (high 7.5), +10 more",
"points": 1.8,
"status": "partial",
"details": [
{
"code": "advisories_affected",
"params": {
"count": 13,
"packages": "minimist 0.0.10 (critical 9.8), shell-quote 0.0.1 (critical 9.8), debug 0.8.1 (high 7.5)"
}
},
{
"code": "advisories_affected_more",
"params": {
"count": 10
}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "13 advisory-carrying package(s) unaddressed past 90 days; oldest published 3196 days ago",
"points": 12.7,
"status": "partial",
"details": [
{
"code": "advisories_stale",
"params": {
"days": 90,
"count": 13,
"oldest": 3196
}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 59,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 1
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "critical",
"name": "AI Readiness",
"value": 28,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "critical",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 24,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.44,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "44 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 23.5,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 44,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "critical",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 22,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [],
"has_dockerfile": false,
"typed_language": false,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 53,
"inputs": {
"primary_language": "Python",
"largest_source_bytes": 99035,
"source_files_sampled": 34,
"oversized_source_files": 1
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Python without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "Python"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "1/34 source files over 60KB",
"points": 53.4,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 34,
"oversized": 1
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"npm package 'cinnamon' points at a different repository (https://github.com/akoenig/cinnamon); excluded from ecosystem scoring",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-25T22:17:35.120432Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/p/pizza-droid/cinnamon.svg",
"full_name": "pizza-droid/cinnamon",
"license_state": "custom",
"license_spdx": null
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics — npm, PyPI.