stefandevo/glm-acp-agent holds a health index of 61 out of 100, placing it in the Moderate band. It scores highest on Vitality (80/100) and lowest on Community & Adoption (38/100). It was last updated 6 days ago. A single contributor accounts for most of its recent work.
61
overall / 100
Moderate
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
61
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Direct dependencies free of known advisories — no direct dependency carries a known advisory
25/25
Indirect dependencies free of known advisories — no indirect dependency carries a known advisory
0/40
No advisories left outstanding — no advisory carries a publication date
Inputs used
source
osv
advisories
0
affected_packages
0
assessed_packages
3
unassessed_packages
0
affected_by_severity
none
direct_affected_packages
0
Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:glm-acp-agent@1.3.0 runtime dependency closure — what installing the published package pulls in — 3 packages. Reachability is not analyzed.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Manageable file sizes — 1/27 source files over 60KB
Inputs used
primary_language
TypeScript
largest_source_bytes
80,136
source_files_sampled
27
oversized_source_files
1
Key facts
30GitHub stars
2contributors
79commits, last 12 months
6days since last push
7releases
1bus factor
1open issues
npmpackage ecosystems
Data collection warnings
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
More detail
Star and fork history 0 ★ / 9 ⇿
0Stars
9Forks
2Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 0Minor 1Patch 1
OpenSSF Scorecard 4.2 / 10
4.2aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-27 04:20 UTC
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Dependency advisories 0
Installing npm:glm-acp-agent@1.3.0 pulls in 3 packages, direct and transitive: 0 carry known advisories, of which 0 are direct dependencies.
No known advisories affect the assessed dependencies.
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 270,
"has_wiki": true,
"homepage": null,
"languages": {
"JavaScript": 2800,
"TypeScript": 334198
},
"pushed_at": "2026-07-20T16:04:40Z",
"created_at": "2026-04-27T23:34:07Z",
"owner_type": "User",
"updated_at": "2026-07-26T04:16:03Z",
"description": "ACP agent in TypeScript that uses the Zhipu AI GLM series (specifically GLM-5.1 and GLM-4.7) as the reasoning core",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "main",
"license_spdx_raw": null,
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": null,
"name": "Stefan de Vogelaere",
"type": "User",
"login": "stefandevo",
"company": "Devosoft",
"location": "Belgium",
"followers": 42,
"avatar_url": "https://avatars.githubusercontent.com/u/1656051?v=4",
"created_at": "2012-04-18T15:45:04Z",
"is_verified": null,
"public_repos": 22,
"account_age_days": 5212
},
"license": {
"state": "absent",
"spdx_id": null,
"raw_spdx": null,
"file_present": false,
"scorecard_found": false,
"profile_has_license": false
},
"activity": {
"releases": [
{
"tag": "v1.3.0",
"kind": "minor",
"published_at": "2026-07-20T15:51:26Z"
},
{
"tag": "v1.2.0",
"kind": "minor",
"published_at": "2026-07-18T18:07:24Z"
},
{
"tag": "v1.1.4",
"kind": "patch",
"published_at": "2026-05-16T14:31:32Z"
},
{
"tag": "v1.1.3",
"kind": "patch",
"published_at": "2026-05-11T15:35:15Z"
},
{
"tag": "v1.1.2",
"kind": "patch",
"published_at": "2026-05-01T16:53:17Z"
},
{
"tag": "v1.1.1",
"kind": "patch",
"published_at": "2026-05-01T16:51:22Z"
},
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-05-01T15:59:08Z"
}
],
"recent_commits": [
{
"oid": "b9e7288f4ca4575266af0b996a70eded8ff815b2",
"body": "…ing (#69)\n\n## Problem\n\nThe post-publish `bun x` smoke test in `publish.yml` has failed on\n**every** release run (v1.2.0, v1.3.0) despite the publish itself\nsucceeding. Releases show red even though the package is live on npm.\n\nThe actual error (not the `ERR_MODULE_NOT_FOUND` the docs claimed):\n\n```\n[…]\n fix will exercise on the next release. Manual repro of the\nresolution path:\n\n```bash\nBUN_INSTALL_CACHE_DIR=$(mktemp -d) TMPDIR=$(mktemp -d) \\\n bun x --package \"glm-acp-agent@1.3.0\" glm-acp-agent\n```",
"is_bot": false,
"headline": "fix(ci): bust Bun manifest cache in publish verify, make it non-block…",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-07-20T16:04:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "890be034c52ebdf14976e370f7d4d23098403351",
"body": null,
"is_bot": false,
"headline": "chore(release): 1.3.0",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-07-20T15:51:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ae4aa8a1dee0653be62c873ff7ef1611de563884",
"body": "… background spawns - #67\n\nrunShellCommand resolved on the child's \"close\" event, which Node only\nfires after the process exits AND all stdio streams close. A backgrounded\nprocess (&, nohup, disown) inherits the stdout/stderr pipe FDs and holds\nthem open, so \"close\" never fired and the tool call hun\n[…]\ns for them.\n\nAdds a regression test that spawns a background sleep and asserts\nrun_command resolves in under 2s (pre-fix it never resolves and fails via\nthe test timeout). Carries the fix from PR #66.",
"is_bot": false,
"headline": "fix(executor): detach child and drain pipes so run_command returns on…",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-07-20T15:47:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "66573df433fd1122bbf8891be6b4c21a6a77babd",
"body": "…node to v5",
"is_bot": false,
"headline": "fix(ci): retry bun x verify for npm propagation, bump checkout/setup-…",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-07-18T18:11:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1698f6255ae404f61e3fd94bccf389e72acfcf1f",
"body": "…rement",
"is_bot": false,
"headline": "fix(ci): bump publish workflow to Node 22 for npm@latest engine requi…",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-07-18T18:06:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "136a744cc7adf60160a7e7e721bad5ca15e8cb9d",
"body": null,
"is_bot": false,
"headline": "chore(release): 1.2.0",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-07-18T18:05:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "854a1aecc308d55f2ee966ad510f10e53efeb229",
"body": "- Add ThoughtLevel type with getThoughtLevels/resolveThoughtLevel and\n buildThinkingParams (replacing parseThinking); emit thinking + GLM-5.2-only\n reasoning_effort (high/max), preserving the ACP_GLM_THINKING override\n- Advertise a thought_level SessionConfigOption in new/load/resume/fork,\n handl\n[…]\n them\n- Reject unknown thought_level values instead of silently coercing; only emit\n reasoning_effort for valid high/max\n- Document the option in README and the registry; add glm-client + agent tests",
"is_bot": false,
"headline": "feat(agent): add thought_level reasoning-effort config option - #63",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-07-18T18:02:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d97314ed435892fb74a37cd65bb49c8dc99acea5",
"body": "Bump the default GLM model to glm-5.2, Z.AI's newest Coding Plan model\nwith a verified 1M-token context window and thinking mode.\n\n- glm-client.ts: DEFAULT_MODEL = glm-5.2; prepend glm-5.2 to the\n advertised allowlist (first = default in pickers); add\n MODEL_METADATA entry with 1_000_000 context w\n[…]\nry; update the allowlist assertion\n and add getDefaultModel/getContextWindow coverage for glm-5.2.\n\nAdopts PR #54's approach (credit proteanx; ClarePhang for duplicate\n#61). Supersedes #54, #61, #56.",
"is_bot": false,
"headline": "feat(models): add glm-5.2 as default model (1M context) - #62",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-07-18T17:28:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c5fed2f33eaadd2b04bd6d5d88cb09c42f09ec80",
"body": "- Add Bun setup + packed-tarball bunx smoke test to CI workflow\n- Add post-publish bunx verification to publish workflow\n- Add troubleshooting section to RELEASING.md for corrupted Bun temp installs",
"is_bot": false,
"headline": "feat(ci): add bunx distribution smoke checks - #52",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-19T08:21:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ae7ae6097161f556d9a4f33a782e2f4e5497dde5",
"body": null,
"is_bot": false,
"headline": "chore(release): v1.1.4",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-16T14:30:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a133317f1e41482b22304b1e56a39413bfd8c5e",
"body": "## Purpose\n\nThis update adds `glm-5v-turbo` as a supported Coding Plan model and\nroutes supported ACP image attachments to it through native multimodal\nchat content, while preserving the Vision MCP fallback for non-native\ncoding models.\n\n## Key Changes\n\n- Adds `glm-5v-turbo` to the advertised Coding\n[…]\nMIME\nfallback, and overflow retry behavior.\n\n## Checks\n\n- [x] `npm run lint`\n- [x] `npm test`\n- [x] DevFlow self-review completed\n\n## Task\n\n[#40](https://github.com/stefandevo/glm-acp-agent/issues/40)",
"is_bot": false,
"headline": "#40 - Missing models for coding plan (#51)",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-16T07:29:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d12e4d266c73135a02c3ce3debc64d8c5f65395f",
"body": "- Keep context-overflow retry bookkeeping across the emergency retry\n- Attach the original overflow error as the persistent-overflow cause\n- Tighten the regression test to prove only one retry occurs",
"is_bot": false,
"headline": "fix(agent): preserve overflow retry state - #49",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-15T15:36:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e47404841ed6c040168fef2f532e358c23215ca",
"body": "- Replaced loose `any` casts with narrow local types (`OverflowErrorLike`, `SessionUpdateEnvelope`) in overflow tests.\n- Properly typed `agent.sessions` access in tests.\n- Fixed update filtering to avoid `any` in test assertions.",
"is_bot": false,
"headline": "fix(tests): address PR review comments for type safety - #44",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-15T15:08:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7c714b0944b4cc37ae8bf97735737d90cd35aa21",
"body": "- Bound emergency retry attempts to 1 to avoid infinite loops.\n- Refactored compaction logic to preserve logical interaction groups (turns).\n- Added regression test for persistent context overflow.",
"is_bot": false,
"headline": "fix(agent): address PR review comments for context compaction",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-15T15:08:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b7eefa2eecf349969b77eddad3b72c3ad9dbbb49",
"body": "- Added model context window metadata and ERR_CONTEXT_OVERFLOW constant.\n- Implemented heuristic-based token estimation (4 chars per token).\n- Added history compaction logic that preserves system prompt and last 10 messages.\n- Integrated proactive compaction check before model calls.\n- Added emergency compaction and retry on Z.AI error 1261.\n- Added verification test case in agent.test.ts.",
"is_bot": false,
"headline": "feat(agent): implement automatic context compaction - #44",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-15T15:08:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e67adb9583e027cf8aebbf8dae20af63410c698",
"body": "- Install eslint, typescript-eslint, @eslint/js\n- Add eslint.config.js with modern flat configuration\n- Add lint script to package.json\n- Update GitHub Actions CI workflow to include a linting step\n- Fix existing lint errors in src/ to ensure a clean initial run",
"is_bot": false,
"headline": "chore: add ESLint configuration for TypeScript - #47",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-15T14:26:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "abf5c35e1885ce335c0ecfaacc90bda3991ed5a3",
"body": "- Implement `default`, `accept_edits`, and `bypass_permissions` session modes.\n- Update `ToolExecutor` to selectively suppress permission prompts based on the active mode.\n- Advertise available modes in `newSession`, `loadSession`, `resumeSession`, and `forkSession`.\n- Persist session mode on disk a\n[…]\nrsion to 2 with migration support.\n- Add unit tests for mode persistence and permission behavior.\n- Add end-to-end integration test for mode switching.\n- Update README with session mode documentation.",
"is_bot": false,
"headline": "feat: expose ACP session permission modes - #42",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-15T14:10:36Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e439b17ae371e3ba34a86423e579396b8cad8b6f",
"body": "- Split Installation into Quick Start (npm install -g glm-acp-agent@latest)\n and From Source (Development) subsections\n- Simplify One-time setup to lead with the global `glm-acp-agent --setup`\n command, keeping `node dist/index.js --setup` as a source-clone alternative\n- Reorganize Running so each\n[…]\ne generic ACP-client snippet to recommend\n `\"command\": \"glm-acp-agent\"` and keep the absolute-path form for source builds\n- Flip the top-level Troubleshooting `--setup` hint to match the new ordering",
"is_bot": false,
"headline": "docs(readme): restructure for simplified global install - #41",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-15T13:16:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "abe2eacc094286c85f5e9ee319e7e33380f903e6",
"body": null,
"is_bot": false,
"headline": "chore(release): 1.1.3",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-11T15:34:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "813fceae9fac0517eb54040f7cb806d0192abb4c",
"body": null,
"is_bot": false,
"headline": "fix(tools): use symlink metadata in local listings - #37",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-11T15:30:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a662b9e3faf3f9176f0076eccabf172f08ecb222",
"body": "- Execute read/write/list/command tools from the agent cwd\n- Preserve ACP permission prompts for writes and commands\n- Update docs and tests for capability-independent local tools",
"is_bot": false,
"headline": "feat(tools): run local tools inside agent process - #37",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-11T15:30:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e91a127fa94c4b61941c1eebb12c44eb9d3d4b25",
"body": null,
"is_bot": false,
"headline": "chore(release): 1.1.2",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-01T16:52:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8895b02c574b7e921413d12cd1deaf2e25f2bf23",
"body": "npm publish --provenance verifies that package.json repository.url\nmatches the GitHub repo where provenance was generated. Without it,\nthe registry returns 422 on publish.",
"is_bot": false,
"headline": "fix(pkg): add repository, homepage, bugs fields",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-01T16:52:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3525bf6bea5f99cc2fb755bc237de561fb3195e2",
"body": null,
"is_bot": false,
"headline": "chore(release): 1.1.1",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-01T16:06:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "be60e84094814752cce2a69c5fd76512d43027dc",
"body": "npm Trusted Publishing requires npm >= 11.5.1. Node 20 ships with\nnpm 10.x, which silently falls back to anonymous publish and gets a\n404 from the registry. Install latest npm before publishing.",
"is_bot": false,
"headline": "ci: upgrade npm in publish workflow for Trusted Publishing OIDC",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-01T16:06:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e852a506ef27af3042328d7f3ec73b72bff3bd54",
"body": null,
"is_bot": false,
"headline": "chore(release): 1.1.0",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-01T15:57:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "634e8c82317e3bd81e0db0682ced33fd85d4d1e9",
"body": null,
"is_bot": false,
"headline": "feat(mcp): support session MCP servers - #35",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-05-01T15:46:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "07b145d331a2274de83601ff2639b4b36a2ffbf5",
"body": null,
"is_bot": false,
"headline": "docs(registry): note that post-merge version bumps are automatic",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T19:23:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "246e40c7bfd968f7f8b3d5f1fa255dfc8c61a170",
"body": null,
"is_bot": false,
"headline": "docs: add RELEASING.md",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T19:18:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "981728888c9afe9f314ceaaee52af4d6c86bca87",
"body": "The id-token: write permission already grants the runner an OIDC token\nthat npm verifies against the configured Trusted Publisher, so no\nlong-lived token is required.",
"is_bot": false,
"headline": "ci: drop NPM_TOKEN, rely on npm Trusted Publishing via OIDC",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T19:17:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cee72c3755190a3f6ab0677692808f156f7d0124",
"body": " temp file, fall\n back to URI only when no data is available. Fixes Zed inline\n attachments that arrive with a data: URI the Vision MCP cannot use.\n- Add default prompt argument to callTool so analyze_image no longer\n returns MCP error -32602 due to missing required field.\n- Update tests: verify prompt field is always forwarded, add new test\n asserting temp-file path is used when both uri and data are present.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(#32): add prompt to vision callTool and prefer base64 data over URI",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T18:33:59Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "8be0d995fc3eab05005cf4f8ae66dfadc1ee85f5",
"body": "Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "chore(#30): cross-reference annotation tag names to image-preprocessor",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T18:06:26Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "64715bf067d55c7b770c1e59fadbe97425b8e97c",
"body": "- Add debug-only prompt block diagnostics (ACP_GLM_DEBUG=true)\n Logs block type counts, image metadata (mime, URI presence, approx\n decoded byte length) and resource/resource_link safe URI summaries\n (scheme + basename only; full paths, query strings and data: payloads\n are redacted). Base64 pay\n[…]\nefaults and opt-out, system prompt image_handling section, diagnostic\n output safety (no base64 leakage), and safe URI redaction.\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "feat(#30): harden Zed image attachment handling",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T18:06:26Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "69cea1c41482a84e3dc24c33c2bf0abdbe531ab8",
"body": "- Export DiscoveredTool from mcp-arg-remap.ts; remove duplicate local definitions from both clients\n- Add signal propagation to rediscoverTools() so abort cancels vision re-discovery\n- Extract resolveAndRemap() private helper in StdioVisionMcpClient to remove duplication\n- Add debug log when resolve\n[…]\noolName() falls back to keyword matching\n- Add mcp-arg-remap.test.ts with 12 focused unit tests for remapArguments/resolveToolName\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "refactor(#28): address review findings",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T17:13:37Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "85a2f4ced256206ebeb21e2b435d87e05e1c172e",
"body": "- Add shared mcp-arg-remap.ts with remapArguments and resolveToolName helpers\n search_query), broaden retry to -32602 for stale-schema self-healing\n- StdioVisionMcpClient: call tools/list after init handshake, resolve tool name via keyword fallback, retry on tool-not-found by re-discovering tools on the existing connection\n- Update executor and MCP client tests to reflect remapped argument names and new tool discovery flow\n\nCo-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(#28): MCP arg remapping + Vision tool discovery",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T17:13:37Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "e768c25676839f5e3aac482e5192469bd49ea2de",
"body": null,
"is_bot": false,
"headline": "feat(mcp): retry tool calls once on tool-not-found errors - #23",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T15:33:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "be83377fa1a8d9578b5600db82ed1b118da7b964",
"body": null,
"is_bot": false,
"headline": "feat(mcp): add dynamic tool name resolution with keyword fallback - #23",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T15:33:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1be41b63db96138246c953bbdb8a3eeb1997d1d6",
"body": null,
"is_bot": false,
"headline": "feat(mcp): add tools/list discovery after session initialization - #23",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T15:33:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ad7fa84af9d63732fe4d14d534f7d095fdead705",
"body": null,
"is_bot": false,
"headline": "docs: align README/registry with Coding Plan models and Vision MCP - #24",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T14:27:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0bd75b93c23724bf9c40a459ff9a781f98f4f13d",
"body": null,
"is_bot": false,
"headline": "feat(agent): preprocess ACP image blocks via Vision MCP - #24",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T14:27:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "57b5571b54a15cc2d2dbe93423788d21765ebf0e",
"body": null,
"is_bot": false,
"headline": "feat(vision): add image-block preprocessor backed by Vision MCP - #24",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T14:27:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "617728c74021000011846c825d6d8cc8670bce70",
"body": null,
"is_bot": false,
"headline": "feat(tools): add image_analysis tool routed through Vision MCP - #24",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T14:27:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c54c2d5f3d2cca47d7655feb2ca97a3092ddbbdd",
"body": null,
"is_bot": false,
"headline": "feat(vision): add stdio Vision MCP client - #24",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T14:27:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "32152779c89ddc8e153461fcf058469d8f3ad549",
"body": null,
"is_bot": false,
"headline": "feat(models): align built-in list with Coding Plan allowlist - #24",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T14:27:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ece9b42ca729ae155d20e82e8e6d201fb1f2b79",
"body": null,
"is_bot": false,
"headline": "docs(help): add ACP_GLM_DEBUG to CLI help and README config table - #22",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T14:07:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e7f5a9e20fe0fe91f9b5ef8c2bfa763e4a39a3a8",
"body": null,
"is_bot": false,
"headline": "feat(tools): route web tools through coding plan mcp - #20",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T12:53:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff54095f8faec745e14788f7f3aaf38769d75dd2",
"body": "- Add \"icon\": \"icon.svg\" to registry agent.json\n- Scale icon.svg from 24x24 to 16x16 viewBox for ACP Registry validation",
"is_bot": false,
"headline": "feat(registry): declare icon in ACP manifest and normalize SVG - #18",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T11:24:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3543c23eacf7d4beb538114f66846dfd3cbd4d6b",
"body": null,
"is_bot": false,
"headline": "fix(assets): replace placeholder icon with official z.AI/Zhipu logo",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T10:55:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "77666f6ffb474c5ab2a26a7474b6d51fd39ce13e",
"body": "… #13",
"is_bot": false,
"headline": "fix(assets): replace placeholder icon with official z.AI/Zhipu logo -…",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T08:22:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "908d0dc6d7999249e079d38698ee56887de828a2",
"body": "- Change DEFAULT_BASE_URL to https://api.z.ai/api/coding/paas/v4\n- Add src/llm/logger.ts with ACP_GLM_DEBUG-controlled debug/warn/error\n- Instrument streamChat() with request, usage, and error logging\n- Instrument agent prompt loop with session lifecycle and tool call logging\n- Log key source (masked) in credentials.ts\n- Add tests for maskSecret and coding endpoint default",
"is_bot": false,
"headline": "feat(llm): switch default to coding endpoint and add debug logging - #15",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T08:05:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b4a86d83002b183e1c6e6bc72c40dd55afca83a0",
"body": null,
"is_bot": false,
"headline": "docs(readme): show local-build setup path before global install - #12",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-29T07:15:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "be19794b34082aa72afcb9589fb8987f8d822a4c",
"body": "…rough - #10",
"is_bot": false,
"headline": "docs(readme): expand Zed setup into step-by-step local-testing walkth…",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-28T20:02:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1aa5ddcf00ba30c5f970991f5bd41c10bae2bbd0",
"body": "Addresses CodeRabbit review feedback on src/protocol/system-prompt.ts:120\n(major): AGENTS.md content was injected verbatim into the\n<project_context> wrapper, allowing crafted content to break out via\na literal </project_context> closing tag or instruction-like delimiters.\n\n- Wrap AGENTS.md content \n[…]\n can't read as a new top-level directive.\n- Add regression test asserting an adversarial AGENTS.md leaves exactly\n one </project_context> close tag and one outer fence pair in the\n assembled prompt.",
"is_bot": false,
"headline": "fix(prompt): fence and sanitize AGENTS.md project context - #8",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-28T17:17:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1233bd5152c39e9c37788bcee8aa30247842e295",
"body": "- New src/protocol/system-prompt.ts: pure buildSystemPrompt() with\n tagged sections (persona, environment, tools, file_system_guidelines,\n version_control, code_quality, tone, problem_solving_workflow,\n optional project_context).\n- Agent.newSession now reads AGENTS.md (preferred) or CLAUDE.md fro\n[…]\nso capability-gating tests\n continue to pass.\n- 8 new tests covering env block, filesystem/git guardrails, AGENTS.md\n present/absent/preference/truncation, and the single-system-message\n invariant.",
"is_bot": false,
"headline": "feat(prompt): extend system prompt to native-ACP norms - #8",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-28T17:17:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c9a057d859eaf4b6aa59140e2e30fe459b1e525e",
"body": "- setup: handle stream close/error in readSecret to prevent indefinite hang on TTY disconnect\n- session-store: spread session before schemaVersion so the constant always wins\n- glm-client: drop redundant startsWith branch; rely on the regex alone (now case-insensitive)\n- tests: hoist mid-file rmSync / SessionStore imports to the top import block",
"is_bot": false,
"headline": "fix: address CodeRabbit review nitpicks - #5",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-28T10:50:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a33a90869bc81bf39cd23ed88f9e4a026ecdebb5",
"body": "- SessionStore.listMetadata returns slim metadata, sorted updatedAt desc\n- PersistedSession gains schemaVersion (1); load() rejects unknown versions\n- unstable_setSessionModel emits session_info_update notification\n- setup --setup masks API key with raw-mode TTY input + backspace handling\n- structur\n[…]\n replace inline import(\"...\") types\n- Tests redirect default ACP_GLM_SESSION_DIR to tempdir as defence in depth\n- New tests: closeSession persists + reload, fork-from-disk-only, set_model notification",
"is_bot": false,
"headline": "fix(protocol): address self-review findings - #5",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-28T10:50:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8642939138b11b0e6b5232324f8ca1ade3e2a91d",
"body": "- Per-session model + unstable_setSessionModel: model moves off GlmClient ctor to SessionState; newSession returns curated availableModels\n- Image input: promptCapabilities.image advertised; image blocks become OpenAI image_url data-URL parts\n- Terminal Auth: --setup CLI writes ~/.config/glm-acp-age\n[…]\nplays history, unstable_forkSession deep-clones, resumeSession restores without replay; listSessions merges in-memory + on-disk\n- Capabilities updated: loadSession=true, fork={}, resume={}, image=true",
"is_bot": false,
"headline": "feat(protocol): close registry feature-parity gaps - #5",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-28T10:50:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "284543c6add2b8624426dd8910b59059a38ca7b9",
"body": "- Advertise an `agent`-default auth method so the registry's\n verify_agents.py --auth-check is satisfied; keep the existing\n env_var method for capable clients.\n- Extend initialize test to assert the new auth method.\n- Add zod runtime dep (peer dep of @agentclientprotocol/sdk 0.20.0)\n so tests can load the SDK.\n- Add 16x16 monochrome icon.svg at the repo root.\n- Stage registry/glm-acp-agent/ (agent.json + icon.svg) and a README\n documenting the external publish + PR steps.",
"is_bot": false,
"headline": "feat(registry): prepare ACP registry submission - #4",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-28T08:06:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "23f2654e01547769b5d1c654002fddea02353e1a",
"body": "Expand test coverage and improve tool execution robustness",
"is_bot": false,
"headline": "Merge pull request #3 from stefandevo/claude/acp-protocol-glm-sdk-Ki1AP",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-28T06:39:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "edb4bb7bb7fbc2f86ab5736e979b5047555d8304",
"body": "availableToolNames previously fell back to the full TOOL_DEFINITIONS\nlist whenever it ended up with only the two unconditional web tools.\nThat meant a client which explicitly advertised `clientCapabilities: {}`\n(legitimately reporting no fs and no terminal) would still see\nread_file / write_file / l\n[…]\nnal web tools.\n\nAdds two tests:\n- explicit empty capabilities yields web tools only\n- missing capabilities (no initialize) yields the full list\n\nhttps://claude.ai/code/session_01UaGE3ceacdUBA5DRBcf5GY",
"is_bot": false,
"headline": "Fix tool advertisement when client sends empty capabilities",
"author_name": "Claude",
"author_login": "claude",
"committed_at": "2026-04-28T06:39:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2e880cb4c1d80d937ca0af1f5c88add85865edcd",
"body": "Review comments addressed:\n\nagent.ts:\n- Validate options.maxTurns: fall back to 20 for non-finite, NaN, or\n non-positive values; floor non-integer inputs.\n- Track an in-flight prompt promise per session and await it before\n starting a follow-up prompt, so the previous loop fully unwinds (and\n sto\n[…]\n tool calls are\n not yielded by the GLM client. Total tests now 48 (up from 41).\n\nREADME:\n- Add integration.test.ts to the tests tree listing.\n\nhttps://claude.ai/code/session_01UaGE3ceacdUBA5DRBcf5GY",
"is_bot": false,
"headline": "Address CodeRabbit PR #3 review feedback",
"author_name": "Claude",
"author_login": "claude",
"committed_at": "2026-04-28T06:29:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4a0392d474bb29bc86714ef9ff2f916affbd52c7",
"body": "Brings the agent in line with the @agentclientprotocol/sdk 0.20 schema\nand the live Z.AI Chat Completions API, and adds an integration suite\nthat exercises the agent over the real ndjson transport.\n\nProtocol fixes:\n- Track and respect ClientCapabilities so file/terminal tools fail\n cleanly with a c\n[…]\nansform streams.\n\nREADME rewritten to document the new capability gating, auth method,\nenv vars, supported models, and troubleshooting entries.\n\nhttps://claude.ai/code/session_01UaGE3ceacdUBA5DRBcf5GY",
"is_bot": false,
"headline": "Make ACP agent fully spec-compliant and harden GLM integration",
"author_name": "Claude",
"author_login": "claude",
"committed_at": "2026-04-28T01:25:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2aa85497c3f4cb6c675d8972f9f1146398968359",
"body": "…mentation-with-z.ai-sdk\n\nImprove ACP protocol compliance: stop reasons, tool statuses, and tests",
"is_bot": false,
"headline": "Merge pull request #2 from stefandevo/codex/revise-acp-protocol-imple…",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-28T01:07:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "381bb859cf1f8109b582beb21b71b76f4aebc0d4",
"body": null,
"is_bot": false,
"headline": "Fix ACP stop/tool status compliance and add protocol tests",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-28T01:06:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8649d1223ab97dfcc462588a37219da895ab70d0",
"body": "Implement GLM ACP Agent — native TypeScript ACP protocol with Zhipu AI GLM backend",
"is_bot": false,
"headline": "Merge pull request #1 from stefandevo/copilot/build-acp-agent-core",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-28T00:57:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "29d7a1fda2386c4acb48260847268f176a5b5a4f",
"body": "…on comment\n\nAgent-Logs-Url: https://github.com/stefandevo/glm-acp-agent/sessions/6b21c16f-8985-4a15-85c1-36cd20978dc4\n\nCo-authored-by: stefandevo <1656051+stefandevo@users.noreply.github.com>",
"is_bot": true,
"headline": "fix: clarify command-split limitation comment and MAX_TURNS stop reas…",
"author_name": "copilot-swe-agent[bot]",
"author_login": "Copilot",
"committed_at": "2026-04-28T00:56:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9cc9189344c64390a17dbc5e3873b3f0ba57000",
"body": "…path, fix tsconfig and README\n\nAgent-Logs-Url: https://github.com/stefandevo/glm-acp-agent/sessions/6b21c16f-8985-4a15-85c1-36cd20978dc4\n\nCo-authored-by: stefandevo <1656051+stefandevo@users.noreply.github.com>",
"is_bot": true,
"headline": "fix: propagate AbortSignal, fix stopReason, split commands, validate …",
"author_name": "copilot-swe-agent[bot]",
"author_login": "Copilot",
"committed_at": "2026-04-28T00:54:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7822c9c56bd8cafb50f497645ef2e271ba8c106c",
"body": "Agent-Logs-Url: https://github.com/stefandevo/glm-acp-agent/sessions/f9736d23-0c83-47ad-b999-78224a2e8ba1\n\nCo-authored-by: stefandevo <1656051+stefandevo@users.noreply.github.com>",
"is_bot": true,
"headline": "fix: apply all PR review suggestions from code review thread",
"author_name": "copilot-swe-agent[bot]",
"author_login": "Copilot",
"committed_at": "2026-04-28T00:43:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5522d50804d10a38db55f7934a741ead78cd72c5",
"body": "Agent-Logs-Url: https://github.com/stefandevo/glm-acp-agent/sessions/83eb9fac-2208-40bd-b505-7a7da33660ca\n\nCo-authored-by: stefandevo <1656051+stefandevo@users.noreply.github.com>",
"is_bot": true,
"headline": "fix: mention web_search and web_reader tools in system prompt",
"author_name": "copilot-swe-agent[bot]",
"author_login": "Copilot",
"committed_at": "2026-04-28T00:34:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2d98593338b74c21d0f24c6bd54c7017b3cf1168",
"body": "Agent-Logs-Url: https://github.com/stefandevo/glm-acp-agent/sessions/90eca013-c6a5-49d6-a186-6fb2bcc08b5a\n\nCo-authored-by: stefandevo <1656051+stefandevo@users.noreply.github.com>",
"is_bot": true,
"headline": "ci: add CI and npm publish GitHub Actions workflows",
"author_name": "copilot-swe-agent[bot]",
"author_login": "Copilot",
"committed_at": "2026-04-28T00:31:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e564e8cffa9729304b0f2bef658784efbb2495da",
"body": "Agent-Logs-Url: https://github.com/stefandevo/glm-acp-agent/sessions/234f4545-c00d-4751-adc6-34eedb3d341d\n\nCo-authored-by: stefandevo <1656051+stefandevo@users.noreply.github.com>",
"is_bot": true,
"headline": "docs: add full README.md",
"author_name": "copilot-swe-agent[bot]",
"author_login": "Copilot",
"committed_at": "2026-04-28T00:25:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03bec5ead226fd1fc3794ccebcde79ea7c13000f",
"body": "Agent-Logs-Url: https://github.com/stefandevo/glm-acp-agent/sessions/defc7199-4624-482c-99c3-35e743ff0c15\n\nCo-authored-by: stefandevo <1656051+stefandevo@users.noreply.github.com>",
"is_bot": true,
"headline": "feat: add web_search and web_reader tools using Z.AI APIs",
"author_name": "copilot-swe-agent[bot]",
"author_login": "Copilot",
"committed_at": "2026-04-28T00:22:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f73c058f58adf627d2ec01f49c6583217ae24951",
"body": "Agent-Logs-Url: https://github.com/stefandevo/glm-acp-agent/sessions/da089260-49dd-4ba5-8c14-ba5e8e75a819\n\nCo-authored-by: stefandevo <1656051+stefandevo@users.noreply.github.com>",
"is_bot": true,
"headline": "feat: complete ACP agent based on reference implementation comparison",
"author_name": "copilot-swe-agent[bot]",
"author_login": "Copilot",
"committed_at": "2026-04-28T00:02:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "629f6e69dafbb3f7fed9dcd539d31c6836cbdd63",
"body": "Agent-Logs-Url: https://github.com/stefandevo/glm-acp-agent/sessions/ff7acce9-584e-450a-bf83-c149b237af38\n\nCo-authored-by: stefandevo <1656051+stefandevo@users.noreply.github.com>",
"is_bot": true,
"headline": "feat: implement closeSession to prevent memory leak",
"author_name": "copilot-swe-agent[bot]",
"author_login": "Copilot",
"committed_at": "2026-04-27T23:55:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc338984981af8c629270808f6b8010daae384c7",
"body": "…I GLM backend\n\nAgent-Logs-Url: https://github.com/stefandevo/glm-acp-agent/sessions/5ed0f328-0c77-4f2c-8c18-959f58ca6323\n\nCo-authored-by: stefandevo <1656051+stefandevo@users.noreply.github.com>",
"is_bot": true,
"headline": "Implement GLM ACP Agent — native TypeScript ACP protocol with Zhipu A…",
"author_name": "copilot-swe-agent[bot]",
"author_login": "Copilot",
"committed_at": "2026-04-27T23:47:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4be18022dab402f40d2dc3ea1dfa24688c960526",
"body": "…command string\n\nAgent-Logs-Url: https://github.com/stefandevo/glm-acp-agent/sessions/5692e534-aa78-49dd-9c22-ae0a299150b5\n\nCo-authored-by: stefandevo <1656051+stefandevo@users.noreply.github.com>",
"is_bot": true,
"headline": "Fix shell injection in list_files: use ls with args instead of shell …",
"author_name": "copilot-swe-agent[bot]",
"author_login": "Copilot",
"committed_at": "2026-04-27T23:41:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1c2f49b985b41bf5b46da18ad3c8ae69acf0432c",
"body": "Agent-Logs-Url: https://github.com/stefandevo/glm-acp-agent/sessions/5692e534-aa78-49dd-9c22-ae0a299150b5\n\nCo-authored-by: stefandevo <1656051+stefandevo@users.noreply.github.com>",
"is_bot": true,
"headline": "Implement GLM ACP Agent - full TypeScript project",
"author_name": "copilot-swe-agent[bot]",
"author_login": "Copilot",
"committed_at": "2026-04-27T23:40:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4413ea69e50b727c160055cc29941f33b8be2a4e",
"body": null,
"is_bot": true,
"headline": "Initial plan",
"author_name": "copilot-swe-agent[bot]",
"author_login": "Copilot",
"committed_at": "2026-04-27T23:34:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f3c0e1d208a39215153d2a88f7f194fddede97be",
"body": null,
"is_bot": false,
"headline": "Initial commit",
"author_name": "Stefan de Vogelaere",
"author_login": "stefandevo",
"committed_at": "2026-04-27T23:34:08Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 7,
"commits_last_year": 79,
"latest_release_at": "2026-07-20T15:51:26Z",
"latest_release_tag": "v1.3.0",
"releases_from_tags": false,
"days_since_last_push": 6,
"active_weeks_last_year": 5,
"days_since_latest_release": 6,
"mean_days_between_releases": 13.3
},
"community": {
"has_readme": true,
"has_license": false,
"has_description": true,
"has_contributing": false,
"health_percentage": 28,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "glm-acp-agent",
"exists": true,
"license": "Apache-2.0",
"keywords": [
"acp",
"agent",
"glm",
"zhipu",
"coding-agent"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/glm-acp-agent",
"is_deprecated": false,
"latest_version": "1.3.0",
"repository_url": "https://github.com/stefandevo/glm-acp-agent",
"versions_count": 6,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 8474,
"first_published_at": "2026-04-29T19:13:40.409000Z",
"latest_published_at": "2026-07-20T15:51:50.027000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 6
}
]
},
"popularity": {
"forks": 9,
"stars": 30,
"watchers": 0,
"fork_history": {
"days": [
{
"date": "2026-05-13",
"count": 1
},
{
"date": "2026-06-10",
"count": 1
},
{
"date": "2026-06-15",
"count": 1
},
{
"date": "2026-06-23",
"count": 1
},
{
"date": "2026-06-25",
"count": 1
},
{
"date": "2026-06-29",
"count": 1
},
{
"date": "2026-06-30",
"count": 1
},
{
"date": "2026-07-13",
"count": 1
},
{
"date": "2026-07-19",
"count": 1
}
],
"complete": true,
"collected": 9,
"total_forks": 9
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 80136,
"source_files_sampled": 27,
"oversized_source_files": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 3,
"malicious_count": 0,
"assessed_package": "npm:glm-acp-agent@1.3.0",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "@agentclientprotocol/sdk",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^0.20.0"
},
{
"name": "openai",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^6.34.0"
},
{
"name": "zod",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^3.25.76"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 31,
"open_issues": 1,
"closed_ratio": 0.97,
"closed_issues": 32,
"closed_unmerged_prs": 6
},
"bus_factor": 1,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "stefandevo",
"commits": 63,
"avatar_url": "https://avatars.githubusercontent.com/u/1656051?v=4"
},
{
"type": "User",
"login": "claude",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/81847?v=4"
}
],
"contributors_sampled": 2,
"top_contributor_share": 0.955
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml",
"publish.yml"
],
"has_docs_dir": false,
"linter_configs": [
"eslint.config.js"
],
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "13 out of 13 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/27 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 0,
"reason": "license file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 3,
"reason": "dependency not pinned by hash detected -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 8,
"reason": "2 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "b9e7288f4ca4575266af0b996a70eded8ff815b2",
"ran_at": "2026-07-27T04:20:22Z",
"aggregate_score": 4.2,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-20T16:05:01Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-20T16:04:39Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 70,
"created_at": "2026-07-21T08:24:43Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/stefandevo/glm-acp-agent",
"host": "github.com",
"name": "glm-acp-agent",
"owner": "stefandevo"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"security": 54,
"vitality": 80,
"community": 38,
"governance": 58,
"engineering": 70
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 80,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 67,
"inputs": {
"commits_last_year": 79,
"human_commit_share": 0.835,
"days_since_last_push": 6,
"active_weeks_last_year": 5
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 6 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 6
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "5/52 weeks with commits",
"points": 3.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 5
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "79 commits in the last year",
"points": 17.1,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 79
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 7,
"latest_release_tag": "v1.3.0",
"releases_from_tags": false,
"days_since_latest_release": 6,
"mean_days_between_releases": 13.3
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "7 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 7
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 6 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 6
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~13.3 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 13.3
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 38,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 31,
"inputs": {
"forks": 9,
"stars": 30,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "30 stars",
"points": 23.7,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 30
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "9 forks",
"points": 7.5,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 9
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "critical",
"name": "Community health",
"note": null,
"notes": [],
"value": 25,
"inputs": {
"has_readme": true,
"has_license": false,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "no license file detected",
"points": 0,
"status": "missed",
"details": [
{
"code": "license_absent",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 66,
"inputs": {
"packages": [
"glm-acp-agent"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 8474
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "8,474 downloads/month across npm",
"points": 52.4,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 8474,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 58,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 16,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 2,
"top_contributor_share": 0.955
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 96% of commits",
"points": 1,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 96
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "2 contributors",
"points": 2.7,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 2
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"merged_prs": 31,
"open_issues": 1,
"closed_issues": 32,
"issue_closed_ratio": 0.97,
"closed_unmerged_prs": 6
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "97% of issues closed",
"points": 45.3,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 97
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "31/37 decided PRs merged",
"points": 32,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 31,
"decided": 37
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/27 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 54,
"inputs": {
"followers": 42,
"owner_type": "User",
"is_verified": null,
"owner_login": "stefandevo",
"public_repos": 22,
"account_age_days": 5212
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "42 followers of stefandevo",
"points": 11.7,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 42,
"login": "stefandevo"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "22 public repos, account ~14 yr old",
"points": 21.9,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 22
}
},
{
"code": "account_age_years",
"params": {
"years": 14
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"glm-acp-agent"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 6
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 6 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 6
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "6 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 6
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 70,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 84,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": "eslint.config.js",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.js"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "13 out of 13 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 54,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 42,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 17,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 1,
"scorecard_aggregate": 4.2
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "13 out of 13 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/27 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 29 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 3",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "2 existing vulnerabilities detected",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:glm-acp-agent@1.3.0 runtime dependency closure — what installing the published package pulls in — 3 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "npm:glm-acp-agent@1.3.0",
"assessed": 3
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 3,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 3,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 2
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 63,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.97,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "64 of 66 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 64,
"sampled": 66
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 67,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [
"tsconfig.json"
],
"agent_commit_share": 0.063,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": "eslint.config.js",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "eslint.config.js"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "5 of the last 79 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 5,
"sampled": 79
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 98,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 80136,
"source_files_sampled": 27,
"oversized_source_files": 1
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "1/27 source files over 60KB",
"points": 53,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 27,
"oversized": 1
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-27T04:20:34.445952Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/s/stefandevo/glm-acp-agent.svg",
"full_name": "stefandevo/glm-acp-agent",
"license_state": "absent",
"license_spdx": null
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with stefandevo/glm-acp-agent. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
