Public recordModerate
Software health reportschema 0.27.0 · metrics 1.13.0 · 2026-07-25 22:11 UTC
xk1ko / aigloo
Self-hosted AI gateway. Route, translate and track requests across providers, with access keys, budgets, and a built-in dashboard.
xk1ko/aigloo holds a health index of 50 out of 100, placing it in the Moderate band. It scores highest on Vitality (75/100) and lowest on Sustainability & Governance (29/100). It was last updated 5 days ago. A single contributor accounts for most of its recent work.
50
overall / 100Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
50
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Ownership
kiko.Personal account
3 followers1 public reposince Jul 2025
This repository is owned by a personal account. A single-owner project carries more continuity risk than an organization-backed one.
Package ecosystems
| Registry | Package | Version | Downloads / mo | Versions | Last publish | Tags |
|---|---|---|---|---|---|---|
| npm | aigloo | 1.2.5 | 3,711 | 24 | 5 days ago | aigatewayllmproxyanthropicopenairouterclaudedashboard |
Metrics by category
Vitality
Is the project alive — is code being written and are releases shipping?
75
Development activity
58Moderate
How it's scored
| 36/36 | Push recency — last push 5 days ago |
| 3.5/36 | Commit cadence — 5/52 weeks with commits |
| 18/18 | Commit volume — 395 commits in the last year |
| 0/10 | OpenSSF Scorecard: Maintained — project was created within the last 90 days. Please review its contents carefully |
Inputs used
| commits_last_year | 395 |
| human_commit_share | 1 |
| days_since_last_push | 5 |
| active_weeks_last_year | 5 |
Release discipline
100Excellent
How it's scored
| 27/27 | Ships releases — 25 releases published |
| 36/36 | Release recency — latest release 5 days ago |
| 27/27 | Release cadence — a release every ~0.9 days |
| 0/10 | OpenSSF Scorecard: Signed-Releases — no data |
Inputs used
| releases_count | 25 |
| latest_release_tag | v1.2.5 |
| releases_from_tags | no |
| days_since_latest_release | 5 |
| mean_days_between_releases | 0.9 |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.
Community & Adoption
Does the project have users, downloads, attention, and a welcoming setup for contributors?
36
Popularity & adoption
8Critical
How it's scored
| 7.7/60 | Stars — 4 stars |
| 0/25 | Forks — 0 forks |
| 0/15 | Watchers — 0 watchers |
Inputs used
| forks | 0 |
| stars | 4 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
Community health
50Moderate
How it's scored
| 22.5/22.5 | README |
| 22.5/22.5 | License — recognized license (MIT) |
| 0/18 | CONTRIBUTING guide |
| 0/13.5 | Code of conduct |
| 0/7.2 | Issue template |
| 0/6.3 | PR template |
Inputs used
| has_readme | yes |
| has_license | yes |
| has_contributing | no |
| has_issue_template | no |
| has_code_of_conduct | no |
| has_pull_request_template | no |
Ecosystem adoption (downloads)
60Moderate
How it's scored
| 47.6/80 | Monthly downloads — 3,711 downloads/month across npm |
| 0/20 | Registry dependents — not reported by this ecosystem |
Inputs used
| packages | aigloo |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 3,711 |
Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.
Sustainability & Governance
Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?
29
Maintainer resilience (bus factor)
10Critical
How it's scored
| 9/54 | Bus factor — 1 contributor(s) cover half of all commits |
| 0/22.5 | Commit distribution — top contributor authored 100% of commits |
| 1.4/13.5 | Contributor breadth — 1 contributors |
| 0/10 | OpenSSF Scorecard: Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
Inputs used
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
Issue & PR responsiveness
1Critical
How it's scored
| 0/46.8 | Issue resolution — 0% of issues closed |
| 0/38.3 | PR acceptance — 0/1 decided PRs merged |
| 0/15 | OpenSSF Scorecard: Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
Inputs used
| merged_prs | 0 |
| open_issues | 1 |
| closed_issues | 0 |
| issue_closed_ratio | 0 |
| closed_unmerged_prs | 1 |
Ownership & stewardship
23Critical
How it's scored
| 10/30 | Ownership backing — personal (user) account |
| 0/20 | Verified domain — not applicable to user accounts |
| 4.3/25 | Owner reach — 3 followers of xk1ko |
| 4.2/25 | Track record — 1 public repos, account ~1 yr old |
Inputs used
| followers | 3 |
| owner_type | User |
| is_verified | — |
| owner_login | xk1ko |
| public_repos | 1 |
| account_age_days | 371 |
Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.
Package maintenance
100Excellent
How it's scored
| 25/25 | Published & resolvable — 1 package(s) on npm |
| 35/35 | Publish recency — latest publish 5 days ago |
| 20/20 | Version history — 24 published versions |
| 20/20 | Not deprecated — active, not deprecated or yanked |
Inputs used
| packages | aigloo |
| ecosystems | npm |
| any_deprecated | no |
| min_days_since_publish | 5 |
Engineering Quality
Are baseline engineering and documentation practices in place?
60
Engineering practices
60Moderate
How it's scored
| 24/24 | CI workflows — 1 workflow(s) |
| 24/24 | Tests present |
| 0/16 | Linter config |
| 0/9.6 | Pre-commit hooks |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard: CI-Tests — no data |
Inputs used
| has_ci | yes |
| has_tests | yes |
| has_editorconfig | no |
| has_linter_config | no |
| has_precommit_config | no |
Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.
Documentation
60Moderate
How it's scored
| 30/30 | README |
| 0/25 | Documentation directory |
| 0/15 | Documentation / homepage site |
| 10/10 | Repository description |
| 10/10 | Topics — 19 topics |
| 10/10 | Wiki |
Inputs used
| topics | ai-gateway, anthropic, claude, claude-code, cline, codex, cursor, dashboard, deepseek, fallback, gemini, llm, llm-gateway, llm-proxy, openai, openai-proxy, opencode, qwen, token-saver |
| has_wiki | yes |
| homepage | — |
| has_readme | yes |
| has_docs_dir | no |
| has_description | yes |
Security
Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?
48
Security posture
35At risk
How it's scored
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — no data |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | License — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 5/5 | Packaging — packaging workflow detected |
| 1/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 2 |
| 0/5 | SAST — no SAST tool detected |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — no data |
| 6.8/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 0/7.5 | Vulnerabilities — 21 existing vulnerabilities detected |
Inputs used
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 3.4 |
Excluded from scoring (no data or not applicable): ci_tests, signed_releases. Remaining weights renormalized.
Dependency advisories
100Excellent
How it's scored
| 35/35 | Direct dependencies free of known advisories — no direct dependency carries a known advisory |
| 25/25 | Indirect dependencies free of known advisories — no indirect dependency carries a known advisory |
| 0/40 | No advisories left outstanding — no advisory carries a publication date |
Inputs used
| source | osv |
| advisories | 0 |
| affected_packages | 0 |
| assessed_packages | 4 |
| unassessed_packages | 0 |
| affected_by_severity | none |
| direct_affected_packages | 0 |
Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:aigloo@1.2.5 runtime dependency closure — what installing the published package pulls in — 4 packages. Reachability is not analyzed.
AI Readiness
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
53
Agent context & guidance
40At risk
How it's scored
| 0/45 | Agent instructions — no CLAUDE.md / AGENTS.md / editor rules |
| 0/15 | Machine-readable docs (llms.txt) |
| 40/40 | Legible commit history — 99 of 100 human commits state their intent (structured subject or explanatory body) |
Inputs used
| has_llms_txt | no |
| legible_history_share | 0.99 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
How it's scored
| 0/18 | One-command bootstrap |
| 22/22 | Automated tests |
| 0/11 | Lint / format config |
| 11/11 | Static type checking — dashboard/tsconfig.json, tsconfig.json |
| 10/10 | Reproducible environment — Dockerfile, lockfile |
| 0/10 | Demonstrated agent practice — no agent-authored commits among the last 100 |
| 0/8 | Automated maintenance — no automated dependency updates observed |
| 2/10 | OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 2 |
Inputs used
| has_nix | no |
| has_tests | yes |
| lockfiles | package-lock.json |
| has_dockerfile | yes |
| typed_language | yes |
| bootstrap_files | — |
| has_devcontainer | no |
| has_linter_config | no |
| typecheck_configs | dashboard/tsconfig.json, tsconfig.json |
| agent_commit_share | 0 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
Code legibility for models
100Excellent
How it's scored
| 45/45 | Type-checkable code — TypeScript (statically typed) |
| 55/55 | Manageable file sizes — 0/183 source files over 60KB |
Inputs used
| primary_language | TypeScript |
| largest_source_bytes | 41,201 |
| source_files_sampled | 183 |
| oversized_source_files | 0 |
Key facts
4GitHub stars
1contributors
395commits, last 12 months
5days since last push
25releases
1bus factor
1open issues
npmpackage ecosystems
Data collection warnings
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
More detail
OpenSSF Scorecard 3.4 / 10
3.4aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| n/a | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 10 | Packaging | packaging workflow detected |
| 2 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 2 |
| 0 | SAST | no SAST tool detected |
| 0 | Security-Policy | security policy file not detected |
| n/a | Signed-Releases | no releases found |
| 9 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 0 | Vulnerabilities | 21 existing vulnerabilities detected |
Direct dependencies 17
| Registry | Package | Version constraint | Manifest |
|---|---|---|---|
| npm | @dnd-kit/core | ^6.3.1 | dashboard/package.json |
| npm | @dnd-kit/sortable | ^10.0.0 | dashboard/package.json |
| npm | @dnd-kit/utilities | ^3.2.2 | dashboard/package.json |
| npm | aigloo | file:.. | dashboard/package.json |
| npm | marked | ^18.0.5 | dashboard/package.json |
| npm | next | ^16.2.9 | dashboard/package.json |
| npm | react | ^19.0.0 | dashboard/package.json |
| npm | react-dom | ^19.0.0 | dashboard/package.json |
| npm | server-only | ^0.0.1 | dashboard/package.json |
| npm | sql.js | ^1.14.1 | dashboard/package.json |
| npm | undici | ^7.2.0 | dashboard/package.json |
| npm | yaml | ^2.9.0 | dashboard/package.json |
| npm | zod | ^3.24.1 | dashboard/package.json |
| npm | sql.js | ^1.14.1 | package.json |
| npm | undici | ^7.2.0 | package.json |
| npm | yaml | ^2.6.1 | package.json |
| npm | zod | ^3.24.1 | package.json |
All dependencies not collected
The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
Dependency advisories 0
Installing npm:aigloo@1.2.5 pulls in 4 packages, direct and transitive: 0 carry known advisories, of which 0 are direct dependencies.
No known advisories affect the assessed dependencies.
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"ai-gateway",
"anthropic",
"claude",
"claude-code",
"cline",
"codex",
"cursor",
"dashboard",
"deepseek",
"fallback",
"gemini",
"llm",
"llm-gateway",
"llm-proxy",
"openai",
"openai-proxy",
"opencode",
"qwen",
"token-saver"
],
"is_fork": false,
"size_kb": 3772,
"has_wiki": true,
"homepage": null,
"languages": {
"CSS": 15059,
"Shell": 1141,
"Dockerfile": 2368,
"JavaScript": 35148,
"TypeScript": 1022420
},
"pushed_at": "2026-07-19T22:12:12Z",
"created_at": "2026-06-24T17:35:01Z",
"owner_type": "User",
"updated_at": "2026-07-25T17:23:57Z",
"description": "Self-hosted AI gateway. Route, translate and track requests across providers, with access keys, budgets, and a built-in dashboard.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": null,
"name": "kiko.",
"type": "User",
"login": "xk1ko",
"company": null,
"location": null,
"followers": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/221650117?v=4",
"created_at": "2025-07-19T03:18:42Z",
"is_verified": null,
"public_repos": 1,
"account_age_days": 371
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.2.5",
"kind": "patch",
"published_at": "2026-07-19T22:13:21Z"
},
{
"tag": "v1.2.4",
"kind": "patch",
"published_at": "2026-07-19T19:02:18Z"
},
{
"tag": "v1.2.3",
"kind": "patch",
"published_at": "2026-07-12T12:29:45Z"
},
{
"tag": "v1.2.2",
"kind": "patch",
"published_at": "2026-07-12T12:23:47Z"
},
{
"tag": "v1.2.1",
"kind": "patch",
"published_at": "2026-07-12T10:59:32Z"
},
{
"tag": "v1.2.0",
"kind": "minor",
"published_at": "2026-07-12T10:04:38Z"
},
{
"tag": "v1.1.17",
"kind": "patch",
"published_at": "2026-07-12T08:09:27Z"
},
{
"tag": "v1.1.16",
"kind": "patch",
"published_at": "2026-07-11T20:45:28Z"
},
{
"tag": "v1.1.15",
"kind": "patch",
"published_at": "2026-07-11T20:36:59Z"
},
{
"tag": "v1.1.14",
"kind": "patch",
"published_at": "2026-07-11T20:10:18Z"
},
{
"tag": "v1.1.11",
"kind": "patch",
"published_at": "2026-07-11T20:12:39Z"
},
{
"tag": "v1.1.12",
"kind": "patch",
"published_at": "2026-07-11T20:12:32Z"
},
{
"tag": "v1.1.13",
"kind": "patch",
"published_at": "2026-07-11T20:12:27Z"
},
{
"tag": "v1.1.10",
"kind": "patch",
"published_at": "2026-07-11T19:04:33Z"
},
{
"tag": "v1.1.9",
"kind": "patch",
"published_at": "2026-07-11T18:33:31Z"
},
{
"tag": "v1.1.8",
"kind": "patch",
"published_at": "2026-07-11T09:14:23Z"
},
{
"tag": "v1.1.7",
"kind": "patch",
"published_at": "2026-07-09T14:54:42Z"
},
{
"tag": "v1.1.6",
"kind": "patch",
"published_at": "2026-07-09T08:44:42Z"
},
{
"tag": "v1.1.5",
"kind": "patch",
"published_at": "2026-07-07T12:04:22Z"
},
{
"tag": "v1.1.4",
"kind": "patch",
"published_at": "2026-07-05T21:37:16Z"
},
{
"tag": "v1.1.3",
"kind": "patch",
"published_at": "2026-07-03T07:14:48Z"
},
{
"tag": "v1.1.1",
"kind": "patch",
"published_at": "2026-06-30T14:10:40Z"
},
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-06-30T05:38:20Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2026-06-28T17:06:28Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2026-06-28T12:36:30Z"
}
],
"recent_commits": [
{
"oid": "76a1a4f3b2cc84408d5140b7e06b48fa22d18075",
"body": null,
"is_bot": false,
"headline": "chore: release 1.2.5 — roll back thinking levels",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-19T22:11:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "552847685b6760245901a1a345ce582cc9faf471",
"body": "Adds capability-aware thinking-level selection, preserves OpenAI max effort, and attributes provider model tests to admin-ping in Usage.",
"is_bot": false,
"headline": "chore: release 1.2.4 — thinking levels and admin-ping attribution",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-19T19:01:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "40ccd3138f446555f65ad17228fae304f4edf83a",
"body": null,
"is_bot": false,
"headline": "fix: respect model-specific thinking levels",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-19T18:47:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ad7fc84eb0c2188cffbe7a2b6aefd6e71c2eb4f2",
"body": null,
"is_bot": false,
"headline": "feat: add thinking levels to model pickers",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-19T15:13:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "070d4f2ac1317f3bc40f223804c36b6b2d2d61f0",
"body": null,
"is_bot": false,
"headline": "fix: preserve max thinking effort for OpenAI models",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-19T02:26:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed20ec64dca7bc69e27b70916683865366e6650f",
"body": "Dashboard test-model calls record client_key admin-ping so By Access Key\nshows admin-ping instead of (no key).",
"is_bot": false,
"headline": "fix: attribute provider model pings as admin-ping in usage by key",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T16:55:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bb8e7646c85821c374f1e62ddaa1a1847b1abf44",
"body": "Disable Next image optimization and strip sharp/@img/detect-libc from the\ndashboard standalone so Linux, macOS, and Windows share one package.",
"is_bot": false,
"headline": "chore: release 1.2.3 — cross-platform npm pack without host-native sharp",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T12:29:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "22930ebbc93fc837c965c7866179d5cf8ca575a8",
"body": "Headroom Endpoint card: setup ladder, Start & enable, proxy log, copy install,\nenabled-but-down warning. Ships expanded RTK filters and caveman/ponytail prompts.",
"is_bot": false,
"headline": "chore: release 1.2.2 — headroom onboarding and token savers sync",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T12:22:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8588fb5aa3aef0b100fb745fc6d592141624aac9",
"body": "Reorder pipeline to RTK then Headroom then style inject. Port richer\nsaver prompts (auto-clarity, YAGNI ladder). Grow RTK autodetect/filters\n(git-log, build-output, smart-truncate, dedup-log, and more) with array\ntool content and size gates. Built-in ports only — no upstream packages.",
"is_bot": false,
"headline": "feat: expand RTK filters and sync caveman/ponytail prompts",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T11:23:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6b48ca8ea667c0a4fe5672a201c883ea86e9ec2a",
"body": "Footer link refs made 1.2.x render without brackets unlike older entries.",
"is_bot": false,
"headline": "docs: drop empty Unreleased section; keep version headings consistent",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T11:00:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c31870a7a6d330fc1ced8c60dca0d7ad812e172",
"body": "Admin vs access-key login tabs; member usage card (snippets, block\nreasons); member CLI Tools auto-detect with their key and allowed\nmodels; lifetime spend window; Settings activity log.",
"is_bot": false,
"headline": "feat: login tabs, member CLI tools, lifetime caps, audit log (1.2.1)",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T10:55:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cfde610e8ff746b1bee88b5eb3bd792564e6c020",
"body": "Key holders run their own tools against your aigloo without admin access.",
"is_bot": false,
"headline": "docs: clarify access keys are for personal use on a shared gateway",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T09:59:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1c224b9023b097bfefe080400b07900252b8cdd0",
"body": "Professional-but-casual section for admin vs member login, spend caps,\nand usage breakdown — aligned with 1.2.0 features.",
"is_bot": false,
"headline": "docs: document member access keys and usage-by-key in README",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T09:58:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3f05cb319dd97bb2ff974136c9a942303c514c07",
"body": "Usage-by-key, member access-key login, member access card, and no-shell PATH detection.",
"is_bot": false,
"headline": "chore: bump version to 1.2.0 + changelog",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T09:58:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "066c610657363cc167c41e9ec7d3000976de705c",
"body": "Members see their refilling budget window, allowed models, and key\nexpiry on Usage. Drop the cramped sidebar name label.",
"is_bot": false,
"headline": "feat: show member key spend cap, models, and expiry on usage",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T09:56:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b8d4c0bc62670ecd0d48c1242d501b9e9cf1e496",
"body": "Login accepts admin password or a gateway access key. Member sessions\nare fingerprint-bound and can only open Usage (scoped to that key).\nAdmin password keeps full console access. Proxy + /api/gw enforce ACL;\nGET /api/me exposes role for sidebar/topbar.",
"is_bot": false,
"headline": "feat: member dashboard login with gateway access key",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T09:30:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f032ab076b60b5956d8b4ed199ac15b45d9fc2fa",
"body": "Add by_key aggregation to usage summaries and a By Access Key panel on\nthe Usage page (key labels, spend, tokens, request counts per window).\nGET /admin/keys/usage accepts optional since for window-scoped totals.",
"is_bot": false,
"headline": "feat: show usage breakdown by access key",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T09:16:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "87878e5aeb63f2644a1e1f18af2315e85ab47254",
"body": "Walk PATH and known install dirs with fs instead of where/which, so\nWindows does not flash a console when probing tools or headroom.\nPython version checks use execFile only. Shared helper in\nplatform/resolveBin; used by headroom detect and CLI Tools detect.",
"is_bot": false,
"headline": "fix: resolve CLI/headroom binaries without shelling out",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T09:12:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "39ccbbb356cd16337ac9589de583eee0d8fb2507",
"body": "Add a short tip section with an Ethereum badge and a single EVM-compatible\naddress for optional support across any EVM network.",
"is_bot": false,
"headline": "docs: add optional EVM donation section to README",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T09:04:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "91298ea1d62fe357dca710a3b6af4c046db80146",
"body": "Opening Endpoint auto-ran where/python status detection, which flashes\na console on Windows. Defer probing until the user clicks Check, Start,\nor Stop; show not checked until then. Config toggles stay probe-free.\n\nChangelog under v1.1.17.",
"is_bot": false,
"headline": "fix: probe headroom only on Check/Start/Stop",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T08:07:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7bd50c581d2e226415a05df4ae475a22f0d1cdc0",
"body": "Local next build leaves dashboard/.next/standalone without .next/static,\nso /_next/static/* 404s — React never hydrates and Connect does nothing\n(Windows, Linux, macOS; local/source installs). npm publish already ran\nprepare-standalone; everyday builds did not.\n\n- Run prepare-standalone.mjs after ev\n[…]\nld (no rm -rf); Windows killTree via taskkill\n- Session cookie on NextResponse; SESSION_SECRET file fallback; HTTP-safe Secure\n- AuthStore version cache uses mtime+size after persist\n- Bump to v1.1.17",
"is_bot": false,
"headline": "fix: copy Next static into standalone so login UI hydrates",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-12T00:26:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "76d06887bcae29ce664cfdf80af7cd11f2b9af04",
"body": "Root cause of missing `next` was unanchored `node_modules/` in\ndashboard/.npmignore (and root .gitignore), which stripped\ndashboard/.next/standalone/node_modules from the npm tarball.\n\n- Anchor ignore rules to /node_modules only\n- Drop vendor rename; keep prepare-standalone for static + next gate\n- Migrate legacy vendor/ → node_modules when present\n- NODE_PATH prefers node_modules, falls back to legacy vendor\n- Bump to v1.1.16",
"is_bot": false,
"headline": "fix: ship standalone deps as node_modules",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-11T20:47:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2048b0f69841e9213483b6d77efbc3afed61a207",
"body": "Root cause of missing `next` was unanchored `node_modules/` in\ndashboard/.npmignore (and root .gitignore), which stripped\ndashboard/.next/standalone/node_modules from the npm tarball.\n\n- Anchor ignore rules to /node_modules only\n- Drop vendor rename; keep prepare-standalone for static + next gate\n- Migrate legacy vendor/ → node_modules when present\n- NODE_PATH prefers node_modules, falls back to legacy vendor\n- Bump to v1.1.16",
"is_bot": false,
"headline": "fix: ship standalone deps as node_modules",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-11T20:33:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cbef9e85044bc1edd33304c8590b4ba1c627b02d",
"body": "v1.1.14 dropped the node_modules→vendor rename under the wrong\nassumption that npm only strips root-level node_modules. npm omits\nevery directory named node_modules, so published packages shipped\nserver.js without traced deps → Cannot find module 'next' on all OSes.\n\n- Restore rename via scripts/pre\n[…]\ncker)\n- Fail hard if vendor/next is missing after prepare\n- NODE_PATH accepts vendor (published) or node_modules (local build)\n- Keep Windows createRequire process.argv[1] fix intact\n- Bump to v1.1.15",
"is_bot": false,
"headline": "fix: restore standalone vendor rename so npm ships next deps",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-11T20:22:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "653d81b41ff6aad70b61906fbbe66e596bbd6dad",
"body": "…e resolution failure\n\nnpm does NOT strip nested node_modules (only root-level). The rename was\nunnecessary and broke createRequire on Windows: webpack hardcodes\nimport.meta.url to the build machine's Linux path, and the renamed\nvendor/ dir wasn't where Node's resolver expected node_modules.\n\n- Remo\n[…]\nrl fallback\n- Add /api/debug diagnostic endpoint\n- Add sql.js to dashboard dependencies + serverExternalPackages\n- Clean dist/ of .map/.d.ts and standalone/src from published package\n- Bump to v1.1.14",
"is_bot": false,
"headline": "fix(windows): remove node_modules→vendor rename — root cause of SQLit…",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-11T20:08:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e05ffbf810b43fb944fef044fe79bc17e86e1cf3",
"body": "…ash log file, spawn error handler\n\n- Gate --experimental-sqlite on Node >=22.5 (older Node crashes with 'bad option')\n- Init tray BEFORE waitForGateway so icon shows even if dashboard fails\n- Don't exit on dashboard failure in tray mode — keep tray alive for auto-restart\n- Write crash log to ~/.aig\n[…]\nt (--no-save pruned each other)\n- Use npm.cmd + shell:true on Windows for dev fallback\n- Log Windows tray init errors instead of silent catch\n- Fix npx.cmd resolution in hideToTray dev mode on Windows",
"is_bot": false,
"headline": "fix(windows): conditional --experimental-sqlite, tray before wait, cr…",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-11T19:03:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3077ec118ec345f5ad95f0def48df73cfed400df",
"body": null,
"is_bot": false,
"headline": "chore: bump version to 1.1.9 + changelog",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-11T18:33:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "112138966bb889c3c9077d51df1fe80a6af72472",
"body": "- move --require/--experimental-sqlite from NODE_OPTIONS to spawn args\n (NODE_OPTIONS splits on spaces — breaks if install path has spaces)\n- auto-restart never gives up: reset restartCount + retry after 5s\n instead of shutdown()+exit (tray stays alive, 9router pattern)\n- login page: AbortController 15s timeout + try/catch/finally\n (fetch can't hang forever, setBusy(false) always runs)\n- taskkill /F /T /PID for tree kill on Windows\n- windowsHide: true on all spawn calls",
"is_bot": false,
"headline": "fix: Windows crash + tray disappears + login hangs",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-11T18:28:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "615e843070b5fbfb1d3b02b1ddb282edc1e5df2a",
"body": null,
"is_bot": false,
"headline": "chore: bump version to 1.1.8 + changelog",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-11T09:11:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5b3fdc5587ef77614f678dcbbc9c452f786c44ff",
"body": "- killAllAppProcesses: find+kill stale aigloo processes by matching\n install root path in command line. Catches zombies not holding the\n port but locking files/sqlite handles. Never matches other apps\n (9router etc.) — filter is exact path, not app name.\n- Crash log: capture dashboard stderr (las\n[…]\n-restart: up to 2 restarts with 1-5s backoff. Resets counter if\n alive >30s (stable run). After MAX_RESTARTS, prints crash log and\n exits.\n- pidOnPort: now works on Windows (netstat -ano | findstr).",
"is_bot": false,
"headline": "feat: killAllAppProcesses + crash logging + auto-restart",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-11T09:09:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "25f456b3876bd5434f6dc9bd4836176ca8b33a2f",
"body": "- ensurePortFree: implement Windows support (taskkill /F /PID)\n Previously skipped on win32 — stale aigloo processes held port 18080,\n new dashboard crashed EADDRINUSE silently, tray showed but localhost\n never responded (infinite loading).\n- waitForGateway: check return value, exit with error on timeout\n Previously timed out silently and showed tray anyway — user clicked\n Open Dashboard and got infinite loading with no error message.",
"is_bot": false,
"headline": "fix: Windows dashboard infinite loading",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-11T08:42:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5b970bcffc365bdcad8d64100668655bdfef36f3",
"body": "Arial fallback metrics differ from Inter/ui-sans-serif — wider glyphs +\nhigher baseline caused text overflow and overlap with the logo icon.\nAdd 'Segoe UI' to fallback chain (Windows default), reduce font-size\n200→180, tighten letter-spacing -8→-6.",
"is_bot": false,
"headline": "fix: wordmark font overlapping on Windows",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-11T08:37:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "63667c051cea48516690fc0eba6ac2066f577d87",
"body": "Previous approach compared avg tokens_out of active vs 'off' baseline\nwithin the same window. If user always has caveman/ponytail on (typical),\nthere are no 'off' rows → offAvg=0 → savings always /usr/bin/bash.\n\nNow uses empirical reduction percentages from caveman/ponytail repos:\n lite=15%, full=3\n[…]\n%\n\nFormula: if model produced N tokens WITH the saver at reduction pct,\nit would have produced N/(1-pct) without it. Savings = that - N.\n\nAlways shows savings when saver is active, no baseline needed.",
"is_bot": false,
"headline": "fix: caveman/ponytail savings estimate using empirical percentages",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-10T08:24:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a668fbf62b6332e43b9ed03feddbe635bfffbdf8",
"body": "- trayWin: assign ContextMenuStrip to NotifyIcon (.ContextMenuStrip = )\n Without this, right-click on the tray icon does nothing — the menu exists\n in memory but is never attached to the icon.\n- login route: set secure cookie based on x-forwarded-proto instead of\n NODE_ENV=production. Standalone build sets NODE_ENV=production, so\n secure:true blocked the session cookie over HTTP localhost — browser\n refused to set it, every login appeared to fail.",
"is_bot": false,
"headline": "fix: Windows tray right-click + login cookie over HTTP",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-09T23:08:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "46d0d7004dc562e15486e2f1718c1b9c28176364",
"body": "- Add docker/setup-qemu-action for proper multi-arch QEMU setup\n- Add concurrency group with cancel-in-progress to prevent duplicate runs\n- Add timeout-minutes: 30 to prevent 90m hangs\n- Fix latest tag: remove enable={{is_default_branch}} (false on tag pushes)\n- Fixes cancelled/failure status checks on release commits",
"is_bot": false,
"headline": "fix: add QEMU setup, concurrency, timeout to Docker workflow",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-09T14:44:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6f3ff9bf0f166b41c0c38ef6206babab335def97",
"body": "- CHANGELOG for 1.1.7 (sql.js fallback, cost_out, allow-scripts fix)\n- package-lock.json synced (removed better-sqlite3 transitive deps)\n- sql.js added to serverExternalPackages so Next.js standalone\n traces the WASM binary into the vendor output",
"is_bot": false,
"headline": "chore: changelog + lockfile sync + sql.js in serverExternalPackages",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-09T09:23:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "73f4381c70ccef88f151d8c0d5afc627a01c51c0",
"body": null,
"is_bot": false,
"headline": "chore: bump version to 1.1.7",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-09T09:20:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc2d46dd79a78b7b7fb76dacb4ff2ee5586f7e1d",
"body": "better-sqlite3 triggered npm allow-scripts warning on global install.\nNow installed at runtime to ~/.aigloo/runtime/ — no native build script\nruns during npm install.",
"is_bot": false,
"headline": "fix: remove better-sqlite3 from optionalDependencies",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-09T09:18:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "40ad48939c0426e369eb7cdd8839b2835c6d775a",
"body": "package-lock.json was missing sql.js@1.14.1 added in 62ba657, causing\nnpm ci to fail in Docker CI.",
"is_bot": false,
"headline": "fix: sync lockfile with sql.js dependency",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-09T08:58:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f2e895de17eea1c70190fb27ea956ef88faf01bf",
"body": null,
"is_bot": false,
"headline": "chore: bump version to 1.1.6",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-09T08:44:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e7417e8ea91b5498d8dfa8b697ee8d4d5b18b561",
"body": "fetchModels() skipped the Authorization header when provider.free was\ntrue, even if the provider had api_keys. This caused 401 on providers\nthat require auth but were marked free (common misconfiguration).\n\nfree means 'no key required' (validation only), not 'never send a key'.\nbuildHeaders in upstream/client.ts already sends keys regardless of free\n— fetchModels was the only outlier.",
"is_bot": false,
"headline": "fix: send auth header for model fetch even when provider is free",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-08T06:56:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "62153f390787bba672f204b777b4a33cdf606f90",
"body": "Capabilities (vision, reasoning, tools, contextWindow, modalities) now\nsync from the same models.dev fetch as pricing — one fetch updates both.\n\nResolution chain for capabilities (synced sits LOWER than hardcoded,\nbecause hardcoded carries richer thinkingFormat/search data models.dev\nlacks):\n 1. PR\n[…]\nerved.\n\nNew table capabilities_synced, transform function, 9 new tests.\nPricing sync interval (AIGLOO_PRICING_SYNC_INTERVAL, default 24h)\napplies to both pricing and capabilities — single fetch cycle.",
"is_bot": false,
"headline": "feat: sync model capabilities from models.dev",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T19:24:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f613ce34cc543caf6db2cdd915cc619081d6cd3e",
"body": "Sync model pricing rates from models.dev (primary, 4000+ models) and\nLiteLLM (backup) every 24h so budget tracking and Usage cost stay accurate\nas new models ship — no manual pricing.ts edits needed.\n\nResolution chain (highest wins):\n 1. runtimeOverrides (user dashboard/config — never touched, even\n[…]\ndel keyed) and never touches\npricing_overrides.\n\nAdmin endpoints: GET/POST/DELETE /admin/pricing/sync\nEnv: AIGLOO_PRICING_SYNC_ENABLED (default true)\n AIGLOO_PRICING_SYNC_INTERVAL (default 86400s)",
"is_bot": false,
"headline": "feat: auto-fetch model pricing from external sources",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T19:09:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b37a09becf2788b06b9343ab971c935eff619210",
"body": "Previously used blended rate (total_cost / total_tokens_in+out) which\nunderstated savings when output price > input price. Now tracks\ncost_out per-request (output + reasoning token cost) and uses\ncost_out / tokens_out as the per-token rate for caveman/ponytail\nestimates.",
"is_bot": false,
"headline": "fix: use output-only rate for caveman/ponytail savings estimate",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T18:25:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "62ba657701f0066bde3ef1265cc26848393c719b",
"body": "Driver chain: better-sqlite3 → node:sqlite → sql.js (WASM).\nbetter-sqlite3 installed at runtime to ~/.aigloo/runtime/ instead of\nnpm install time — avoids native build script warnings on global install.\nsql.js added as dependency for guaranteed fallback when native drivers\nunavailable.",
"is_bot": false,
"headline": "feat: add sql.js fallback + runtime better-sqlite3 install",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T18:04:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "10f0154be3fb9112576e2fd2e4630d72785ea1cb",
"body": null,
"is_bot": false,
"headline": "chore: bump version to 1.1.5",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T12:02:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "60855c8eba84c6bb5b7b6a68cc9906d0fccd44df",
"body": "dashboard/.gitignore had \"next-env.d.ts.tmp\" instead of the standard\nNext.js \"next-env.d.ts\" pattern, so the real generated file was only\nkept out of git via a local-only .git/info/exclude entry. That's fine\nfor personal/tool junk but this is a standard generated file every\nNext.js project ignores — belongs in the tracked, project-wide\n.gitignore, not a machine-local exclude list.",
"is_bot": false,
"headline": "chore: fix next-env.d.ts gitignore typo, move out of local-only exclude",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T11:59:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "14ebaf50312c0f641d73a685bd2b27b4c6119a89",
"body": "Pricing and Alerts & Notifications are both nav cards to a\ndedicated page (\"Configure ->\"); Backup (Export/Import buttons) sat\nbetween them, breaking that rhythm. Moved it last, next to the\nAdvanced raw-config section below, which it's actually related to.",
"is_bot": false,
"headline": "ux: move Backup card after Alerts & Notifications on Settings",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T11:54:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d198cf4d4bfedd5d4307970154a8e7386dd9b442",
"body": "RTK/Headroom/Caveman/Ponytail were four separate, inconsistently\nformatted blocks. Now one card: a single \"total saved\" hero number\nup top, then a compact per-saver breakdown below.\n\nRTK/Headroom keep their real measured cost_saved. Caveman/Ponytail\nhave no per-request counterfactual (they bias outp\n[…]\n is an estimate:\navg output tokens at the active level vs the \"off\" baseline in the\nsame window, times a blended $/token rate — labeled \"est.\" and kept\nvisually distinct from the two measured figures.",
"is_bot": false,
"headline": "feat: unify Token Saver Savings into one panel with a combined total",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T11:44:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "fb8529f355b624dadd8e4cfa44718b86ecd72249",
"body": "router.replace() + router.refresh() only busts the Next.js Router\nCache for the route being navigated to — every other page visited\nbefore the auth transition keeps its stale cached RSC payload\n(including ones the proxy computed as a redirect to /login while\nunauthenticated). Clicking a Link to one \n[…]\nthe\ncached redirect instead of re-checking the session, bouncing back to\n/login until a hard refresh cleared the whole cache. A full\nnavigation on login/logout success avoids the stale cache entirely.",
"is_bot": false,
"headline": "fix: use hard navigation after login/logout, not router.replace()",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T11:33:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1074245d520f37d563ae04d7362714ab1c1f3b64",
"body": "Without this, a nested git worktree checked out during development\ngets its own copies of tests/ and dashboard/ double-discovered from\nthe main repo root, tripping the dashboard-alias exclusion that only\nmatched the root-level dashboard/ path.",
"is_bot": false,
"headline": "test: exclude .worktrees/** from root vitest discovery",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T07:15:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a0e4d1b3284c48e9e234ac30fff1c5a5c12e17c7",
"body": "Not in allowScripts yet — currently inert (no lavamoat gate wired\ninto install/CI today), but if one ever is, the native binary build\ngets silently blocked, require() throws, and it falls back to\nnode:sqlite with no error. Cheap to allowlist now.",
"is_bot": false,
"headline": "chore: allowlist better-sqlite3's install script",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T07:10:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e8e082954c6d2126e7a030ea1a9215db761e1fa1",
"body": null,
"is_bot": false,
"headline": "feat: log which SQLite driver loaded at startup",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T06:54:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e418bfc79f04357226ccfe15f848c37b7330ca76",
"body": null,
"is_bot": false,
"headline": "feat: prefer better-sqlite3 over node:sqlite when available",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T06:48:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e32445fb544323f9a5b05b37442cd5556adfd9ed",
"body": null,
"is_bot": false,
"headline": "fix: don't swallow real DB-open errors as driver-unavailable",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T06:44:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c953283b969088220fde6a689973325172cf78cf",
"body": null,
"is_bot": false,
"headline": "feat: add better-sqlite3/node:sqlite driver resolver",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-07T06:37:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e90aa90d72936b535ab3c0b82e489430d27b4be7",
"body": "Node made node:sqlite builtin at 22.5.0 but gated it behind\n--experimental-sqlite until 22.13.0. aigloo never passed that flag, so\nfirst run silently crashed on any Node in that range. The dashboard's\nchild process already builds NODE_OPTIONS for other reasons (net\npreload) — add the flag there too; it's a no-op on newer Node so it's\nalways safe to pass. Bumped package.json/README's floor from >=22 to\nthe true minimum, >=22.5.",
"is_bot": false,
"headline": "fix: ensure node:sqlite works on Node 22.5-22.12 without a manual flag",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-06T22:12:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0ae9abfffe07c7b3452e73f93b3326f6e4fd53a6",
"body": "headroom is an object (enabled/url/compress_user_messages), not the\noff|on scalar the reference example showed — was stale from before\nit grew a proxy URL + user-message toggle.",
"is_bot": false,
"headline": "docs: fix headroom config shape in README reference",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-06T18:16:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d1b5e37883b9e00f5fbc59ec572c5d760aff3298",
"body": "RTK/Headroom cost lines still leaked onto Endpoint after the previous\ncommit — removing avg-tokens was only half the ask. Endpoint now shows\nonly toggles/levels; savings summary lives solely on Usage.",
"is_bot": false,
"headline": "fix: drop savings text from Endpoint page entirely, Usage-only",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-06T18:10:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4cd04d224aeaa113030445dd391ad53068529203",
"body": "… display\n\nMove avg output tokens/request off the Endpoint page (stays on Usage), and\nlead RTK/Headroom savings lines with the $ estimate for quicker scanning.",
"is_bot": false,
"headline": "docs: note savings tracking in README; ui: dedupe token-saver savings…",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-06T18:07:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6c69a7b424eaba3c6e5ca2139d9809843d9e7930",
"body": "Said :v{version} but the actual pushed tag drops the v prefix\n(docker/metadata-action's type=semver behavior) — confirmed via the\nlive xk1ko/aigloo:1.1.4 tag on Docker Hub, same convention the reference project uses.",
"is_bot": false,
"headline": "docs: fix DOCKER.md tag format, v1.1.4 confirmed live on Docker Hub",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-06T05:23:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dc982d52af6d8a77504ebb41b34311a7f7a7e43e",
"body": "First-ever docker-publish.yml run took 57+min before being cancelled\nwith no error — checked the reference project's actual CI history (gh run list) and\ntheir steady-state multi-arch builds run ~15-20min once the registry\nbuildcache is warm; one of their runs (v0.4.77) hit 72min too, so this\nmatches\n[…]\namental arm64 problem.\nKeeping amd64+arm64 as-is.\n\nAdding npm cache mounts anyway since it's a real (if secondary) win —\nmatches the reference project's own Dockerfile pattern for local rebuild speed.",
"is_bot": false,
"headline": "perf: add npm cache mounts to Dockerfile",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-06T04:42:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "63b951fbb2ab61dd47038fae6727209ac45a6a98",
"body": null,
"is_bot": false,
"headline": "chore: bump version to 1.1.4",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-05T21:23:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9ce1076e3db64a98e5b2b81a46ce94a77a6d26f4",
"body": null,
"is_bot": false,
"headline": "docs: add deploy-anywhere feature bullet (npm/source/Docker)",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-05T21:07:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0a0b148393c2e64ae226462a092798f36ca18899",
"body": "README's Docker section still told readers to clone the repo and\ndocker compose up — leftover from before docker-compose.yml switched\nto pulling the published image instead of building locally. Now a\nplain docker run against xk1ko/aigloo, pointing to DOCKER.md for the\nrest.\n\nBadges point at xk1ko/aigloo on Docker Hub/GHCR — will render broken\nuntil the first image is actually published there.",
"is_bot": false,
"headline": "docs: add Docker Hub/GHCR badges, fix stale docker-compose quick start",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-05T20:53:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "451a4a528ac4e52fabe979e2834556980a980a8f",
"body": "RTK and Headroom both cut input tokens, so their savings can be priced\nhonestly at that request's resolved input rate — unlike Caveman/Ponytail,\nwhich bias output with no counterfactual (see the existing comment on\nsavingsSummary). Computed per-request in recordUsage using the same\npriceIn already r\n[…]\n.\n\nRTK only measures bytes, not tokens, so its $ figure is an estimate\n(~4 chars/token, shown with a \"~\" prefix in the UI). Headroom already\ntracks exact token counts, so its figure isn't an estimate.",
"is_bot": false,
"headline": "feat: add $ estimate to token saver savings",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-05T20:40:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2bc79b46339f4ded5b158349adda865250d340b5",
"body": "The banner told readers to use main instead of dev — now that dev's\nfeatures are merged here, it doesn't apply.",
"is_bot": false,
"headline": "docs: drop dev-branch WIP banner after merging dev into main",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-05T20:30:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd2dd52769facc80db99d94b806a422b072a6122",
"body": null,
"is_bot": false,
"headline": "Merge branch 'main' into dev",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-05T20:26:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aeca2e136e31ccd1b162a9a9a896f3310f7a5593",
"body": "Mirrors the reference project's Docker setup:\n- .github/workflows/docker-publish.yml — on v* tag push, builds\n multi-platform (amd64+arm64) and pushes to ghcr.io/xk1ko/aigloo and\n xk1ko/aigloo, both :latest and :v{version}. Needs DOCKERHUB_USERNAME\n + DOCKERHUB_TOKEN repo secrets (not added here,\n[…]\noss restart under the new user, login +\nsavings endpoints respond correctly. Also validated docker-compose.yml\nagainst a locally-tagged image (real registry push still pending the\nDocker Hub secrets).",
"is_bot": false,
"headline": "feat: publish Docker image to GHCR + Docker Hub",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-05T20:19:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "35787dc1f28861ec9adf19fe403e27743cf6b932",
"body": "docker-compose.yml fell back to a hardcoded literal SESSION_SECRET,\nso every deployment that didn't override it shared the same cookie\nsigning key. Leave it unset instead: cli.ts already generates and\npersists a random one to the data volume on first boot, matching\nnon-Docker installs.\n\nThe standalone-output fixup used renameSync to move node_modules to\nvendor/, which fails with EXDEV on BuildKit's layered filesystem when\nsource and dest land on different devices. Switched to cpSync+rmSync.",
"is_bot": false,
"headline": "fix: shared docker session secret + EXDEV build failure",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-05T20:03:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "95688685743202a872776231c6f7ef07549e7b46",
"body": "Warns at the top of the README that this branch may have unfinished\nor broken features, pointing readers to main / npm install -g aigloo\nfor a stable install.",
"is_bot": false,
"headline": "docs: flag dev branch as work-in-progress",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-05T11:36:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f3ae245cfd8a5ca8a5ebce3ca2c80543dbfd158b",
"body": "Login page now shows \"Default password is 123456\" only while the\nadmin password is still the seeded default (checked server-side via\nAuthStore.verify against the known default, never exposing the actual\npassword to the browser); disappears once changed. New GET /api/login\nbacks this.\n\n\"Hide to Tray\"\n[…]\n\nManually verified via ./dev.sh + preview browser: hint shows on first\nlogin, changed the password through Settings, logged out, confirmed\nthe hint is gone on the next login screen. No console errors.",
"is_bot": false,
"headline": "feat: default-password login hint and tray-mode dashboard URL",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-05T11:36:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a25bd7c921828ee66ad2e3ec4fbbdaeb9d0bebd6",
"body": "RTK and Headroom already computed byte/token savings per request but\nonly logged them to the console. Now persisted to the usage table\n(rtk_bytes_in/out, headroom_tokens_before/after) and surfaced on the\nEndpoint page (inline stat per saver toggle) and Usage page (new\nToken Saver Savings panel).\n\nCa\n[…]\n enabled\nRTK, set Caveman=full/Ponytail=lite, inserted a synthetic usage row,\nconfirmed both the Endpoint page inline stats and the Usage page panel\nrender the expected numbers with no console errors.",
"is_bot": false,
"headline": "feat: persist and surface token-saver savings",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-05T11:36:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d561f637aff486839dd9afb09d96f7eea331eaa4",
"body": "Multi-stage Dockerfile + docker-compose.yml mirroring the standalone\nbuild path npm-global installs already use (dist/ + dashboard/.next/\nstandalone, vendor/ node_modules rename, static asset copy) so the\ncontainer behaves identically to `npm install -g aigloo && aigloo`.\n\npackage-lock.json version field was stale (1.0.1 vs package.json's\n1.1.3); refreshed by npm install.",
"is_bot": false,
"headline": "feat: add Docker deployment support",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-05T11:36:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e498b40ff2143fe4452e4d5b833620fa9642555",
"body": "proxy.ts runs on every nav/prefetch and called AuthStore.currentVersion()\nwhich did a sync readFileSync+JSON.parse of auth.json each time. Now\ncached by mtime so the hot path skips the parse unless the file changed.\n\nUsage page also had no loading.tsx — full nav blocked on the sqlite log\nquery with no skeleton.",
"is_bot": false,
"headline": "perf: cache auth version check, add usage page loading skeleton",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-04T12:44:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0916f0a2c177699c6fc2e079ddaf3bcd33b6c041",
"body": null,
"is_bot": false,
"headline": "chore: bump version to 1.1.3",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-03T07:10:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e578f3dd30da6b47c12f44da77df34dec5147035",
"body": null,
"is_bot": false,
"headline": "docs: fold dist-cleanup into 1.1.2 changelog, fix stale README comment",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-03T06:02:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ef34b1427c7418eb40032e20d2fe8450e184f4c8",
"body": "…outes from pre-1-port build",
"is_bot": false,
"headline": "fix: prepublishOnly published stale dead-code dist/server.js + dist/r…",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-02T06:55:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bc27989718e02cb0a524d8b63a8608ee80bd632c",
"body": null,
"is_bot": false,
"headline": "chore: remove dead .npmignore",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-02T06:32:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8ff74abc828b2d05893eafb11909bba9d54776f6",
"body": null,
"is_bot": false,
"headline": "chore: bump version to 1.1.2, changelog entry",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-02T04:11:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a3af36db3d12e729d9ba06bcf4c963e8d54c1709",
"body": "…ck/round-robin chain",
"is_bot": false,
"headline": "fix: a non-retryable error from one provider aborted the whole fallba…",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-01T15:56:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b14ac3cdd8caf035c11dc0f586859a9ebcc1348d",
"body": "…he provider",
"is_bot": false,
"headline": "fix: model-test result discarded the real status/error message from t…",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-01T15:56:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd2a7a3136adda9b35d4a16ddfef2e8c4ac37a0e",
"body": "…real usability",
"is_bot": false,
"headline": "fix: key-check test only hit a free /models endpoint, didn't reflect …",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-01T15:56:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "027b7767fce0290efeeeffae517c566237951b17",
"body": null,
"is_bot": false,
"headline": "chore: delete dead Rail.tsx (superseded rail implementation, unused)",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-01T13:27:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8ebb3d4494aa27668fd13abb2bad3c9791e5c05d",
"body": null,
"is_bot": false,
"headline": "fix: add missing Back to Settings button on Notifications page",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-01T13:26:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a31c56c789af8bd25cc381e49120b875326c9c0a",
"body": "…l icon",
"is_bot": false,
"headline": "feat: dedicated Pricing page — per-provider + global override, no rai…",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-01T13:25:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ab105fde53966abb8fd97db9a6231f2ec2c39d5c",
"body": null,
"is_bot": false,
"headline": "fix: consoleBuffer singleton not HMR-safe, same class of bug as gw()",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-01T12:50:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc823956676b5f04047ed107360e99f844dcdaa4",
"body": "…, close IP-spoof coverage gap",
"is_bot": false,
"headline": "test: add dashboard vitest infra, resurrect dead e2e/key-expiry tests…",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-01T11:49:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "16f94ace69f5984ea92df0eab3fe23fbdb526cfc",
"body": "…-safe singleton, dedup",
"is_bot": false,
"headline": "fix: post-migration hardening — headers, body limit, host config, HMR…",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-01T11:37:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "11639416b4f2d805034e11a1d064ccb91718ef5a",
"body": null,
"is_bot": false,
"headline": "fix: password rotation didn't revoke outstanding dashboard sessions",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-01T11:20:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "82ee145f73af050a54ea91735c43c4c2b067012f",
"body": "…ecks",
"is_bot": false,
"headline": "fix: spoofable client-IP auth bypass + /v1/embeddings skipping key ch…",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-07-01T10:59:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "10c4c1809c28fff50f21236f3e6d75bea945f710",
"body": null,
"is_bot": false,
"headline": "release: v1.1.1 — fix version display in production",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-06-30T14:06:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2c60c9e5f2f551848a8c17502785d7b2a8d9ed94",
"body": "Standalone server runs with cwd=standaloneDir, so readVersion() couldn't\nfind package.json with name 'aigloo'. cli.ts now reads version from root\npackage.json at startup and passes it as AIGLOO_VERSION env var to the\nspawned server process.",
"is_bot": false,
"headline": "fix: version shows 0.0.0 in production — pass via env var",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-06-30T13:56:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d6aee5e858610f2b46947074a4d53d15a20587d5",
"body": null,
"is_bot": false,
"headline": "chore: clean .npmignore + remove src/tsconfig from npm package",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-06-30T06:34:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a86571eddd22fd6258a233b699258a66a61cb6f9",
"body": null,
"is_bot": false,
"headline": "fix: README — combos are optional, provider/model works directly",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-06-30T05:45:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cfb94f1c13dfef1f724f47912668b6dc8cdc7f48",
"body": "- Bump version 1.0.1 → 1.1.0\n- CHANGELOG: full v1.1.0 entry (3 features, 1 architecture change, 15 fixes)\n- README: add 'How it works' section with architecture diagram",
"is_bot": false,
"headline": "release: v1.1.0 — notifications, one-port architecture, bug fixes",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-06-30T05:36:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8ad4d34ea23d3a710cc7f29c31ad78e2c692b9e3",
"body": "Toggle enable/disable now calls API immediately. Save button remains\nfor text fields (URL, token, chat_id) and event selection.",
"is_bot": false,
"headline": "fix: notification toggle auto-saves without needing Save button",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-06-30T05:16:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4e8bb477b231a994e881737be95a639733d84e26",
"body": null,
"is_bot": false,
"headline": "fix: center LoadingDots vertically in content area",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-06-30T05:13:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6def0b9bc0ef65e951c34061c7c6406cb9003f39",
"body": "loading.tsx created a Suspense boundary around all routes. Every\nnavigation triggered the fallback (three-dot animation), making page\nswitches feel slow. Clicking the same page link twice caused the\nSuspense to re-trigger without resolving — infinite loading.\n\nIn-page LoadingDots is sufficient: shows only during data fetch, not\nduring route transition.",
"is_bot": false,
"headline": "fix: remove loading.tsx causing navigation delay + infinite loading",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-06-30T05:10:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "92e974f8d77eced792a0cc1fe7994e1426597468",
"body": "- readVersion() now scans cwd + parent for package.json with name 'aigloo'\n (dev mode cwd is dashboard/ which has version 0.1.0 — was showing wrong version)\n- Remove NavigationProgress: caused double loading dots (overlay + in-page\n LoadingDots) and useInsertionEffect console error from history.pushState patch\n- In-page LoadingDots is sufficient for navigation feedback",
"is_bot": false,
"headline": "fix: version reads root pkg, remove NavigationProgress overlay",
"author_name": "xk1ko",
"author_login": "xk1ko",
"committed_at": "2026-06-30T05:03:20Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 25,
"commits_last_year": 395,
"latest_release_at": "2026-07-19T22:13:21Z",
"latest_release_tag": "v1.2.5",
"releases_from_tags": false,
"days_since_last_push": 5,
"active_weeks_last_year": 5,
"days_since_latest_release": 5,
"mean_days_between_releases": 0.9
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "aigloo",
"exists": true,
"license": "MIT",
"keywords": [
"ai",
"gateway",
"llm",
"proxy",
"anthropic",
"openai",
"router",
"claude",
"dashboard"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/aigloo",
"is_deprecated": false,
"latest_version": "1.2.5",
"repository_url": "https://github.com/xk1ko/aigloo",
"versions_count": 24,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 3711,
"first_published_at": "2026-06-28T12:59:04.641000Z",
"latest_published_at": "2026-07-19T22:12:58.036000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 5
}
]
},
"popularity": {
"forks": 0,
"stars": 4,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": null,
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"dashboard/tsconfig.json",
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 41201,
"source_files_sampled": 183,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"dashboard/package.json",
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 4,
"malicious_count": 0,
"assessed_package": "npm:aigloo@1.2.5",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "@dnd-kit/core",
"manifest": "dashboard/package.json",
"ecosystem": "npm",
"version_constraint": "^6.3.1"
},
{
"name": "@dnd-kit/sortable",
"manifest": "dashboard/package.json",
"ecosystem": "npm",
"version_constraint": "^10.0.0"
},
{
"name": "@dnd-kit/utilities",
"manifest": "dashboard/package.json",
"ecosystem": "npm",
"version_constraint": "^3.2.2"
},
{
"name": "aigloo",
"manifest": "dashboard/package.json",
"ecosystem": "npm",
"version_constraint": "file:.."
},
{
"name": "marked",
"manifest": "dashboard/package.json",
"ecosystem": "npm",
"version_constraint": "^18.0.5"
},
{
"name": "next",
"manifest": "dashboard/package.json",
"ecosystem": "npm",
"version_constraint": "^16.2.9"
},
{
"name": "react",
"manifest": "dashboard/package.json",
"ecosystem": "npm",
"version_constraint": "^19.0.0"
},
{
"name": "react-dom",
"manifest": "dashboard/package.json",
"ecosystem": "npm",
"version_constraint": "^19.0.0"
},
{
"name": "server-only",
"manifest": "dashboard/package.json",
"ecosystem": "npm",
"version_constraint": "^0.0.1"
},
{
"name": "sql.js",
"manifest": "dashboard/package.json",
"ecosystem": "npm",
"version_constraint": "^1.14.1"
},
{
"name": "undici",
"manifest": "dashboard/package.json",
"ecosystem": "npm",
"version_constraint": "^7.2.0"
},
{
"name": "yaml",
"manifest": "dashboard/package.json",
"ecosystem": "npm",
"version_constraint": "^2.9.0"
},
{
"name": "zod",
"manifest": "dashboard/package.json",
"ecosystem": "npm",
"version_constraint": "^3.24.1"
},
{
"name": "sql.js",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.14.1"
},
{
"name": "undici",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^7.2.0"
},
{
"name": "yaml",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^2.6.1"
},
{
"name": "zod",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^3.24.1"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 0,
"open_issues": 1,
"closed_ratio": 0,
"closed_issues": 0,
"closed_unmerged_prs": 1
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "xk1ko",
"commits": 395,
"avatar_url": "https://avatars.githubusercontent.com/u/221650117?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"docker-publish.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 2,
"reason": "dependency not pinned by hash detected -- score normalized to 2",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 9,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "21 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "76a1a4f3b2cc84408d5140b7e06b48fa22d18075",
"ran_at": "2026-07-25T22:11:02Z",
"aggregate_score": 3.4,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-19T22:24:44Z",
"oldest_open_prs": [],
"last_merged_pr_at": null,
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 2,
"created_at": "2026-07-25T12:55:37Z",
"last_comment_at": "2026-07-25T18:55:40Z",
"last_comment_author": "devtekve"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/xk1ko/aigloo",
"host": "github.com",
"name": "aigloo",
"owner": "xk1ko"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"security": 48,
"vitality": 75,
"community": 36,
"governance": 29,
"engineering": 60
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 75,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "moderate",
"name": "Development activity",
"note": null,
"notes": [],
"value": 58,
"inputs": {
"commits_last_year": 395,
"human_commit_share": 1,
"days_since_last_push": 5,
"active_weeks_last_year": 5
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "5/52 weeks with commits",
"points": 3.5,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 5
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "395 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 395
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 25,
"latest_release_tag": "v1.2.5",
"releases_from_tags": false,
"days_since_latest_release": 5,
"mean_days_between_releases": 0.9
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "25 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 25
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.9 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.9
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 36,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 8,
"inputs": {
"forks": 0,
"stars": 4,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "4 stars",
"points": 7.7,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 4
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 60,
"inputs": {
"packages": [
"aigloo"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 3711
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "3,711 downloads/month across npm",
"points": 47.6,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 3711,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "critical",
"name": "Sustainability & Governance",
"value": 29,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"merged_prs": 0,
"open_issues": 1,
"closed_issues": 0,
"issue_closed_ratio": 0,
"closed_unmerged_prs": 1
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "0% of issues closed",
"points": 0,
"status": "missed",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 0
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "0/1 decided PRs merged",
"points": 0,
"status": "missed",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 0,
"decided": 1
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "critical",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 23,
"inputs": {
"followers": 3,
"owner_type": "User",
"is_verified": null,
"owner_login": "xk1ko",
"public_repos": 1,
"account_age_days": 371
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "3 followers of xk1ko",
"points": 4.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 3,
"login": "xk1ko"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "1 public repos, account ~1 yr old",
"points": 4.2,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 1
}
},
{
"code": "account_age_years",
"params": {
"years": 1
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"aigloo"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 5
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 5 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 5
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "24 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 24
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 60,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 60,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "1 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 1
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 60,
"inputs": {
"topics": [
"ai-gateway",
"anthropic",
"claude",
"claude-code",
"cline",
"codex",
"cursor",
"dashboard",
"deepseek",
"fallback",
"gemini",
"llm",
"llm-gateway",
"llm-proxy",
"openai",
"openai-proxy",
"opencode",
"qwen",
"token-saver"
],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "19 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 19
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 48,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 35,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 3.4
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 2",
"points": 1,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "21 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:aigloo@1.2.5 runtime dependency closure — what installing the published package pulls in — 4 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "npm:aigloo@1.2.5",
"assessed": 4
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 4,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 4,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 53,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.99,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "99 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 99,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "at_risk",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 45,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": true,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"dashboard/tsconfig.json",
"tsconfig.json"
],
"agent_commit_share": 0,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "dashboard/tsconfig.json, tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "dashboard/tsconfig.json, tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 2",
"points": 2,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 41201,
"source_files_sampled": 183,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/183 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 183,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-25T22:11:06.868300Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/x/xk1ko/aigloo.svg",
"full_name": "xk1ko/aigloo",
"license_state": "standard",
"license_spdx": "MIT"
}Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
How one result sits in the wider record: aggregate statistics — npm.