zkwasm / concord-agent

The resolved dependency set could not be collected for this report: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

Installing npm:concord-agent@0.7.18 pulls in 57 packages, direct and transitive: 0 carry known advisories, of which 0 are direct dependencies.

No known advisories affect the assessed dependencies.

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 286,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "JavaScript": 355545
      },
      "pushed_at": "2026-07-23T03:09:02Z",
      "created_at": "2026-06-28T04:01:37Z",
      "owner_type": "User",
      "updated_at": "2026-07-23T03:09:06Z",
      "description": "Host a coding agent (claude/codex/gemini) in a Concord room over ACP. Resident session, idle = zero tokens, token budget, IM control.",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "JavaScript",
      "significant_languages": [
        "JavaScript"
      ]
    },
    "owner": {
      "blog": null,
      "name": null,
      "type": "User",
      "login": "zkwasm",
      "company": null,
      "location": null,
      "followers": 2,
      "avatar_url": "https://avatars.githubusercontent.com/u/113981964?v=4",
      "created_at": "2022-09-20T09:31:58Z",
      "is_verified": null,
      "public_repos": 9,
      "account_age_days": 1409
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-06-29T12:24:12Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "0ae809fffffc6860ae9fad729021223e004b3146",
          "body": "A turn whose model output ended cleanly could fail to settle the ACP prompt\nrequest on adapter 0.52.0 — the bridge waited forever for a stop signal and\nshowed \"working\" for hours (observed live: runtime finished at 11:41, host\nwedged until manual restart). The 0.53-0.60 adapter line reworked\nturn-boundary / background-subagent handling, removing this stall class.\nGemini flag intentionally untouched (unrelated + unverifiable locally).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: bump ACP adapters — claude 0.60.0, codex 1.1.5 (0.7.18)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-23T03:09:00Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e1adc7cbedaf249753141fe1216a36ee59a72b73",
          "body": "…by default (0.7.17)\n\n- ensureAddressed: a turn reply that @-mentions no one is auto-addressed back\n  at its trigger sender, and `fallbackMention` rides along so the SERVER can\n  enforce the invariant with the authoritative roster (a lexical scan cannot\n  tell \"@构建者 look\" from a prose \"补@不变量\")\n- bri\n[…]\naware (textMentionsName/hasMentionToken):\n  emails, URL paths, npm scopes, and one-letter substrings never wake anyone;\n  fullwidth ＠ normalized\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: addressing invariant + broadcast self-judgment; retire arbiter …",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-22T01:02:36Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6bf5096cc3921cdbb93df08c2a0187586967b0f5",
          "body": "…om /compact (0.7.16)\n\nA rate-limited turn used to kill a multi-agent room permanently. Three compounding\ndefects, all confirmed against live host logs:\n\n- The message that triggered the turn was dropped before the attempt\n  (pending.shift() ran ahead of the try), so nothing was left to retry.\n- Tra\n[…]\nion and the transient/addressing predicates move to cli.mjs so they\ncan be tested; acp-bridge.mjs keeps the store side effects. 186 tests pass.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: retry transient turn failures, address room notes, unbreak in-ro…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-20T14:35:38Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "613b43e6597148d0333e9c31cea4d0308559cdec",
          "body": "…rent models (0.7.15)\n\nThe pinned codex-acp bundles its own @openai/codex and runs THAT — not the user's\ndesktop/PATH codex — so newer models (e.g. gpt-5.6-*) failed with \"Model metadata\nnot found\" / \"requires a newer version of Codex\", even when the desktop app worked.\n1.1.2 bundles @openai/codex 0.144.x. No interface change: same ACP launch, still\nhonors CODEX_PATH. 172/172 tests pass.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: bump codex-acp adapter 1.0.1 → 1.1.2 so hosted codex can use cur…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-13T02:56:16Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b2c6cd0950e5cebd0919b453a1c5289f51b0cebe",
          "body": "….7.14)\n\nThe one-time briefing's NOOP-filler rule hardcoded a Chinese \"待命中\" next to the\nEnglish \"standing by\", so every fresh bridge-hosted agent in an English (locale: en)\nroom saw Chinese in its briefing — a leak in the \"en rooms must be all-English\"\nguarantee. Gate it by room.locale via L(): en rooms get only \"standing by\"; zh rooms\nget \"待命中\" / \"standing by\". Takes effect on a fresh session (/clear or re-join).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: briefing filler example is localized — no Chinese in en rooms (0…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-08T03:34:11Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "704bba3baef44bd5db646e32d8c0597696b4dc29",
          "body": "Agents were curl-posting their content to /messages AND letting the bridge post\ntheir turn-ending reply (a status summary in the agent's default language), so every\nturn showed up twice — once as English content, once as a foreign-language \"I did X\"\nnote. Harden the briefing: the reply text IS the r\n[…]\ntatus report, and\nthe coordination BASE is for claims/files/ballots/signals only — never chat. Takes\neffect on a fresh session (/clear or re-join), since a warm-resumed session keeps the\nold briefing.",
          "is_bot": false,
          "headline": "fix: stop double-posting — the reply IS the room message (0.7.13)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-08T02:44:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "affe3fe19875efa0753d796903b7d3368f146217",
          "body": "Naming read the ALL-TIME sender list (/agents), so it treated departed \"-N\" ghosts\nas present and offered fallbacks like \"agent-one-3\"; and role-name suggestions could\ncome out in the wrong language. Now: gatherRoomInfo reads room.locale from /info and\nnamingPrompt writes role names in that language (English example for en rooms); the\n\"present/taken\" set comes from the online roster via the paired im-for-agents /agents\nchange (online-only), so a reclaimable ghost name is no longer avoided.",
          "is_bot": false,
          "headline": "fix: join-time naming — no ghost names, room's language (0.7.13)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-08T01:59:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d977b5ccdb22c2d2857bc6984046c7c000b9fc1e",
          "body": "…0.7.12)\n\nAn earlier collision persisted the \"-N\" fallback (e.g. agent-coordinator-2) in local\nstate, so every `concord up`/restart resumed under the wrong name forever — the server\n\"free a departed name\" change only helped a fresh join, not a resume. On join, when the\nstored sender is a \"-N\" fallba\n[…]\nline); on success adopt it (ACP context\nis warm-resumed separately, no memory lost), else resume under the fallback as before.\nClient-side complement to the im-for-agents online-only uniqueness check.",
          "is_bot": false,
          "headline": "fix: restarted agent reclaims its clean name, not the \"-N\" fallback (…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-07T17:43:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e621c3a6ca723e20c89a3a9060ce7e9f908f9774",
          "body": "- The operator-facing output of concord join/host/login/upgrade/reset/im/im status\n  (naming prompts, QR-login flow, confirmations, status) is now English, matching\n  the room-language handling from 0.7.11. Only code comments stay as-is.\n- Join-time naming uses the HOSTED agent's own CLI (claude/gem\n[…]\n invocations are best-effort; a wrong flag degrades gracefully to the fallback.)\n- A first-ever join/host notes the first-run adapter download so initial silence\n  reads as \"downloading,\" not \"stuck.\"",
          "is_bot": false,
          "headline": "i18n+ux: English-first CLI, agent-aware naming, first-run hint (0.7.12)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-07T15:54:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "42b8faea0b382d46e828731b7ba25ed581551a85",
          "body": "…e gap (0.7.12)\n\nA `concord join` agent arrived blind: it knew the room protocol but not what the\nroom was FOR, unlike a paste-prompt agent. The one-time briefing now carries,\nread from the join response:\n- room name + objective + context, and the pinned messages (an \"[OBJECTIVE]\" pin\n  is flagged a\n[…]\nm's recent history (≤20 msgs, arb markers skipped),\n  seeded into the inbox so an agent joining an ongoing room isn't blind to it;\n- autonomous-mode rooms (read from room.mode) get a co-owner mindset.",
          "is_bot": false,
          "headline": "feat: bridge-hosted agents get the room's brief — close the join↔past…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-07T15:54:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7b5c0bc7cd3226bda92ec3f9899cf734ce5b45f9",
          "body": "….11)\n\nThe bridge ignored room.locale and was hardcoded Chinese: it posted Chinese\nsystem messages into the room AND fed the agent Chinese context (batched-inbox\nheader, briefing), biasing hosted agents toward replying in Chinese even in an\nEnglish room. Now it reads room.locale on join and localize\n[…]\neout/error notes, and elicitation prompts all switch on locale.\n- Pure-logic helpers (arbiter, budget, elicit) gained an optional `locale` arg\n  (default en); budget.test covers both locales. 172/172.",
          "is_bot": false,
          "headline": "feat: locale-aware bridge output — English rooms read as English (0.7…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-07T10:59:21Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1fd4b8704ddad76bcaadceff0218f62c8fd9a87e",
          "body": "`spawn('npx', …)` failed on Windows with ENOENT — npx is `npx.cmd` there and\nmodern Node refuses to spawn a .cmd without a shell — so hosting any agent\ncrashed with \"agent failed to start: spawn npx ENOENT\". Spawn the adapter\nthrough the shell on Windows, and reap the child tree with `taskkill /T` in\nshutdown() since Windows has no Unix process groups. macOS/Linux unchanged.\nAlso gate the \"~250MB download\" note to the claude adapter only.",
          "is_bot": false,
          "headline": "fix: Windows agent-adapter spawn + shutdown (0.7.11)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-07T10:59:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "74dfe3bc77c300f83b852b26a82b978adece5b34",
          "body": "…8→0.7.10)\n\nRolls up three versions that shipped without ever being committed (0.7.8\nand 0.7.9 were published to npm from the working tree; 0.7.10 is prepared\nbut unpublished). Their edits are intermingled across the same files, so\nthey are bundled as one honest commit rather than a fabricated per-v\n[…]\nides so silence stays silent and free.\n- 0.7.10: `concord list` gains an ID column — the stable host id\n  (claude-xxxxxx) disambiguates same-named agents and is what\n  stop/status/logs/restart accept.",
          "is_bot": false,
          "headline": "feat: answer arbitration, event-driven wakes, upgrade + list ID (0.7.…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-07T09:06:34Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7ed8a7560e6f100a462f831dee90395f1f8f97d0",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: 0.7.7 release marker",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-06T10:22:58Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1cd037742eaa34b83f82b4db3b0aa979592eaf1a",
          "body": "The server has always had server-enforced coordination - claims (task\nownership, 409-exclusive), ballots (binding votes), signals, room files - all\nagent-token accessible over HTTP. CLI-hosted agents knew none of it, so\nmulti-agent rooms coordinated by chat alone: duplicate pipelines, three agents\ng\n[…]\not, signals for shared focus. Ballot/signal sections are gated by\nthe room's actual primitives, fetched from /info at boot. 165/165 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: teach hosted agents the room's coordination primitives (0.7.7)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-06T10:21:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6baff5c95a8778cb0b57a657fc02c2465804e7b5",
          "body": "Every room message used to wake every agent for a full LLM turn, and the\n\"never go silent\" rule forced a filler reply, so N idle agents billed each\nother for endless \"standing by\" echo loops.\n\nNow inbound messages are classified (pure, tested):\n- wake: @-mentions this agent, or a human message with \n[…]\npeer's exact name to\nmake it act; un-mentioned posts are ambient status that wakes no one; never\npost \"standing by\" filler. 162/162 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: multi-agent wake economics — delivery != wake (0.7.6)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-06T09:45:29Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "2fb41240d5cbe68f1b60ff8437c9ebd124efb99e",
          "body": "…with bindings (0.7.5)\n\nTwo upgrade-path bugs: (1) nothing auto-pauses since 0.7.4, but the old daemon's\npause record in state.json was never cleared, so list/status showed 'paused'\nforever while the agent actually worked; a clean start now drops it. (2) 'up'\nspawned an IM owner for every platform w\n[…]\n stored creds - a one-time QR login\nwith zero bindings kept resurrecting a useless owner; now creds AND >=1 binding\nare required. 161/161 green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: clear stale pause records at startup; up only revives IM owners …",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-06T09:12:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "401f50cba828e0144d54762173a300747378d560",
          "body": "…, ceiling 30min → 6h (0.7.4)\n\nThe \"3 timeouts in 6h → auto-pause\" fuse turned normal long-running work into\nan unrecoverable-feeling `paused` state (resume → next long task re-tripped it).\nGone: a timed-out turn is simply cancelled (adapter group killed, burn stops),\nthe room is told, and the next \n[…]\n00s\n(6h); ACP_TURN_TIMEOUT=0 disables. `concord resume` remains only to clear a\nstale pause record left by an older daemon. 161/161 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: long tasks are no longer punished — drop the timeout auto-pause…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-06T08:52:02Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "41d67c8e6fcb015cabf3bdb00b607e8ac7d88f1b",
          "body": "A hosted Claude with the concord plugin installed saw room messages, decided it\nhad never formally joined, and started suggesting /concord:resume. The bridge\nnow prepends a one-time briefing to the first turn of every fresh session (the\nbridge owns room I/O; never run /concord:* or touch .concord/). Resumed\nsessions skip it — the briefing is already in their context. 161/161 green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: brief fresh sessions that they are already in the room (0.7.4)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T09:34:37Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b19c3188a6fc6fa0f5c22d3944580bc52c2d37cb",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: 0.7.3 release marker",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:54:49Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "d0f0811de699d0623ccce816f816a407fbb80100",
          "body": "Verified by probing the registry tarball: published 0.7.2 has grounded naming,\nname alignment and the warned80 fix, but not shouldRelayInbound — so the\nsystem-noise filter becomes 0.7.3 and package.json bumps accordingly.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: 0.7.2 shipped on npm — noise filter moves to 0.7.3",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:49:32Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e217168bdf39541d23beeb22ca35e4c88643043c",
          "body": "File-upload notices ([FILE] x uploaded …, sender_type=system) triggered a full\nLLM turn whose \"no action needed, standing by\" reply was posted back into the\nroom — burning the agent's tokens AND every other participant's, message after\nmessage. Inbound gating is now a pure, tested predicate (shouldRelayInbound):\nown echoes and system notices never wake the agent; humans and other agents do.\n\n161/161 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: ambient 'system' messages no longer wake the agent (0.7.2)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:44:49Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "66e007634fde7c119128e1c314d55707854a66a5",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: 0.7.2 release marker",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:30:47Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "65578cdc85a6ca51a25573819b84e2ac6bfd0933",
          "body": "…es first\n\nCandidates must come from what the room actually says, not model invention.\nThe chain is now grounded-first:\n\n1. TEMPLATE ROLES (deterministic, zero LLM): room templates bake their role\n   list into the room context at creation (compose.ts rolesBlock — a known\n   header + \"- name: descrip\n[…]\nuggestNames() reports source: 'template' | 'headless' | 'fallback'.\n160/160 tests green (extraction matches compose.ts's exact composed format).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(naming): ground candidates in the room's own data — template rol…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:23:25Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4d30e6e1a0092f8a88da6d0e7d6a245cb1394fd7",
          "body": "…he paste-prompt\n\nThe web paste-prompt's naming step is role-selection (\"ask the user what role\nyou should play … use it as your sender name and persona\"; \"invent a role that\nbrings a distinct viewpoint\"). The headless naming prompt now mirrors that:\n- the name is framed as the agent's ROLE + person\n[…]\nal room: old prompt → 指令官/任务分发/待命-协调 (vague);\nnew prompt → 架构师/测试/代码评审/产品设计 (complementary roles next to the\nexisting 工程师). 158/158 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "refactor(naming): frame the headless prompt around ROLES, mirroring t…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:16:55Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "32729adc5fe4e5813cc92533c8887fdc7c8ca8b7",
          "body": "…room names (0.7.2)\n\nA readable name is the room's core handle in a multi-agent room — it's how\nhumans decide who to @ and who gets which task. `concord join`/`host` (TTY, no\n--as/--name) now gathers the project dir + room name/purpose (/agent .../info)\n+ who is already present (/agents), runs a ONE\n[…]\nshows in every case.\n\nLive-verified against a real room (existing members listed, role-style Chinese\ncandidates generated). 158/158 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: join-time naming via a one-off headless agent + CLI shows real …",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T08:01:03Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "4ca56e6d200fb2a4bb39f943ba782f2a92caef96",
          "body": "…e up (0.7.2)\n\n`concord list`'s \"claude-a1b2c3\" and the room's \"claude-6016\" were two unrelated\nidentifiers (hex host id vs pid%10000). The 409-fallback sender now derives from\nCONCORD_HOST_ID's hex tail: same name in both places, stable across restarts —\nso a restarting host resumes its identity instead of minting a fresh ghost each\ntime. A pid-based candidate remains as last resort (stale-session edge).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: room fallback name = host id hex tail — CLI and roster names lin…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T07:38:37Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "ab4c4a5a20cb8d37d46299fca04fd1cc1edc00c9",
          "body": "The one-time warning flag was in-memory, so a crash-looping host re-posted the\nwarning into the room on every restart. It now lives in the store next to the\nusage meter and is cleared only by `concord budget --reset` (resetUsage).\n152/152 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: persist the 80%-of-budget warning flag (0.7.2)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T04:09:10Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0e169f0f1dcd78bf14ee719b06d15d7f273ae33a",
          "body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: 0.7.1 is published — drop the (unreleased) marker",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T03:41:38Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "fd766755d426a0e4d5040279f742da1aa30852ce",
          "body": "…rdingly\n\nThe published 0.7.0 tarball (verified by probing the registry artifact) contains\nlifetime token metering + in-room slash commands only. Warm resume, the live\nplan card, the context meter and elicitation landed after that publish, so they\nmove to a new unreleased 0.7.1 section and package.json bumps to 0.7.1 (patch\nonly, per the 0.7.x policy).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: 0.7.0 shipped on npm — bump to 0.7.1, split the CHANGELOG acco…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T03:25:26Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "2e39a765b77dc956b08a2e1c22b19d998aa2a538",
          "body": "The agent's AskUserQuestion tool (and MCP-server elicitations) now reach the\nhuman: the adapter converts them to ACP `elicitation/create` once we advertise\nclientCapabilities.elicitation.form; the bridge renders a numbered question card\ninto the room / bound IM chat, takes the first HUMAN reply as t\n[…]\n \"2\" →\nagent continued with the chosen answer. 151/151 tests green.\n\nFolded into the unpublished 0.7.0 (version unchanged per the 0.7.x policy).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: agent-initiated questions in chat — ACP form elicitation (0.7.0)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T03:18:47Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "690dace3681e7f16a457205952274ed94d3e5505",
          "body": "….7.0)\n\nWarm resume: startEngine hands the persisted ACP session id back to the adapter\n(session/resume + ctx.attachSession — public at runtime, typed private), so a\nrestart/crash recovery keeps the agent's conversation context instead of starting\ncold. Any resume failure falls back to a fresh sessi\n[…]\nded into the unpublished 0.7.0 (version unchanged per the 0.7.x policy).\n142/142 tests green (adds resume success/fallback + store round-trips).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: warm resume across restarts + live plan card + context meter (0…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-02T02:40:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "910f060b6d568c3db5693e1bf056dac7cd8ce15f",
          "body": "Token accounting becomes a lifetime cumulative meter: usage per task/room only\ngrows and never auto-resets — not by time, restart, /compact, or /clear. The only\nreset is an explicit `concord budget --reset` (now over SIGUSR2, decoupled from\n`concord resume`, which is unpause-only). `--budget` is a l\n[…]\nom a room message.\n\nDrop-in upgrade (bindings/creds/sessions preserved); restart running hosts so they\nrun the new daemon. 138/138 tests green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: lifetime token metering + in-room slash commands (0.7.0)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-01T22:19:13Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "772f15814949156784b5daa7af8a7ad1130e5e04",
          "body": "…6.0→0.6.4)\n\nShip the IM lifecycle + reliability arc, published as 0.6.0 through 0.6.4.\n\nLifecycle & monitoring:\n- `concord shutdown` is now a SOFT stop — keeps every agent config and IM binding\n  (reversible); `concord up` revives the whole fleet with no re-binding; `concord reset`\n  is the explici\n[…]\nocs/getting-started.md shutdown description corrected.\n- Test hygiene: hosts/creds/store tests cleaned up leaked mkdtemp dirs. 139 tests green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): fleet lifecycle + local agent-presence + resume-403 fix (0.…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-07-01T07:16:30Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "07613ce6b85c6acd4a47a2c306724f37566959c8",
          "body": "… health\n\ngetConnectionStatus()'s live behavior is unverified (API confirmed, behavior pending a real\nbot scan). Guard against a quirky 'idle' false-alarming an actively-used binding: if inbound\nevents are flowing, the connection demonstrably works → 'flowing', regardless of reported\nstate. Only \"no recent events AND not connected\" reads as 'suspect'.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): receiving inbound overrides a stale connState in event-plane…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T16:20:57Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "66b6120eb90751e46ba1fd98467f5d056ff00f8d",
          "body": "…im status)\n\nThe IM owner now continuously reconciles desired (bindings) vs actual (connection / relay /\nroom / agent) state and writes a health.json the CLI reads, turning a class of silent\nfailures into a visible \"what's wrong + the one next command\".\n\n- WSClient connection callbacks (onReady/onEr\n[…]\ndown). 134/134 tests pass. Needs the new backend endpoint\ndeployed for agent-presence to activate; degrades gracefully until then.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): owner reconcile loop + end-to-end health snapshot (concord …",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T16:18:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "46474fd9ae432f13445a40b025140ff68c793ae7",
          "body": "Root cause of \"switched bot app (login --qr --new) but binding the new app gets no\nresponse, the old app still works\": the IM owner bakes appId/appSecret into its WSClient\nAT SPAWN, but `startImOwnerIfNeeded` only checked whether an owner process was alive — not\nwhich app it was connected to. So aft\n[…]\nis treated as unverifiable → restarted (never\nsilently trusted). 118/118 tests pass. CLI / owner only — Concord backend untouched.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): restart the IM owner onto the current bot app when creds change",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T14:50:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "39c1557263970488e357142f192cd63f10969ab4",
          "body": "…ailures, bindings\n\nHigh-priority UX quick-wins from the 2026-06-30 review (CLI side, zero core-backend changes):\n\n- room name in `concord list`/`status` (cached at host start, CJK-width aligned, falls back to short id)\n- STATUS now shows working/idle/paused/crashed — what the agent is DOING, not ju\n[…]\n, store activity/paused/exit\nsetters (+tests). All in the CLI / ACP bridge — the Concord backend is untouched. 111/111 tests pass.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(cli): surface what each agent is doing — room names, activity, f…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T08:34:06Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0dbfae6988d3c34423ef0ee1a58f897abfa3538c",
          "body": "The README still only documented manual `--app-id/--app-secret` login and\nomitted the IM owner command. Add the QR login (the recommended 0.3.0 flow —\nno developer console, no version publish) and `concord im` to the Commands block.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: README Commands — surface `concord login --qr` and `concord im`",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T03:57:43Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0bc6fe8901209cfcca7bdb0bc2841f1b6d6a48ff",
          "body": "…ount workaround\n\nThe `--qr` flow doesn't bypass Lark/Feishu's enterprise governance: in a tenant\nwhere the user isn't an admin, the scan returns valid creds but the new app sits\nin admin-approval limbo and messages don't actually route. Creds look healthy so\nwe can't detect this from code. Fixes:\n\n\n[…]\nadmin approval — no\n  re-scan needed once approved.\" The reuse path is silent (creds came from a\n  presumably working prior scan).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs+cli: surface the enterprise admin-approval caveat + personal-acc…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T02:27:59Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b2287eb3721cc0dc47817ff8c74409e8576947c5",
          "body": "…force escape hatches)\n\nRe-running the QR flow with existing creds used to silently create a duplicate\napp every time, littering the user's workspace with dead Concord apps. Default\nnow: if creds already exist, skip the scan, show how to override, and ensure\nthe IM owner is up (so re-running becomes\n[…]\nand --force to\nre-scan and update the existing app's config (registerApp with appId = the\n2nd-scan grant flow). Help text updated.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: `concord login --qr` reuses existing app by default (--new / --…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T02:19:42Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f89a7c6f067d43fd22e6a6510bc61a85d602ab10",
          "body": "After a successful scan the bot has creds but nothing is listening, so a\n`/concord-bind` in the chat would go nowhere until the user separately ran\n`concord im`. Auto-start the owner at the tail of the QR flow (skip if one is\nalready running for that platform). Extract the owner-spawn logic into a s\n[…]\ntach behavior are identical. Auto-start failure is non-fatal — the user still\nhas working creds and can fall back to `concord im`.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: `concord login --qr` auto-starts the IM owner",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T02:15:11Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ceb83c46bc55c0046bd6fc59be4fa7a83da0d6de",
          "body": "…3.0)\n\nThe Lark/Feishu onboarding is now one command: `concord login lark --qr` renders\na QR in the terminal, you scan it in the app, tap Agree on the confirm page,\nand the bot's appId+appSecret land in ~/.concord/creds.json. No developer\nconsole, no manual scope hunt, no version publish.\n\nUses regi\n[…]\ne user sees the easy path first.\ndocs/getting-started.md restructured to make QR the primary flow, manual a\ncollapsed alternative.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: `concord login --qr` — zero-config bot creation via QR scan (0.…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T01:54:31Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5bfb2a5311a7783f625bd246707f814e52bc04df",
          "body": "…I is missing (0.2.3)\n\nA fresh `concord join claude` on a machine without Claude Code would silently\nstart the ~250MB ACP-adapter npx download and then mysteriously fail to auth\n(the bundled runtime reads ~/.claude credentials from a normal install). Check\nPATH for the chosen agent's CLI at startup \n[…]\n npm-install lines for claude / gemini / codex; --no-agent-check (or\nCONCORD_NO_AGENT_CHECK=1) bypasses for non-standard installs.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: preflight check — fail fast with install hint when the agent CL…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-30T00:00:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3ed08e37eae607dfd75c9edc33c247742b2b7ce4",
          "body": "…hung (0.2.2)\n\nThe ACP adapter is fetched via `npx` at first use, and the claude adapter drags\nin a ~250MB platform-native agent runtime. startEngine() awaited that download\nsilently before pollLoop() ran, so a fresh machine looked like \"joined the room\nbut never responds\" with no clue. Print the ad\n[…]\ns\" note before spawning, and on startup failure\nhint that the first run needs npm-registry access (or pre-warm with that command).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: announce the first-run adapter download so startup doesn't look …",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T15:46:17Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fe0c256250f5c90d11a722512bfa9642045757c0",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: release 0.2.1 (room-too-large reply fallback + join-a-room guide)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T15:01:34Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a4926c0d1fb4fd0faff2cd3135b8301778c5829a",
          "body": "The CLI's everyday flow is `concord join <agent> <roomId>` — install, grab the\nroom id (it's the access token), join; idle = zero tokens. Separate from the IM\ngetting-started guide (concord host + a bot). README now links both: joining-a-room\nfor the plain room flow, getting-started for the personal IM-bot flow.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add a \"joining a room\" guide for everyday Concord users",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T14:56:20Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6a6a89775f3b8d9c8b12a5abe1ac1189269e234b",
          "body": "The room caps a message body at 2MB (HTTP) and hard-truncates content past ~50k\nchars. sendToRoom posted via a bare fetch and never checked res.ok — and fetch\ndoesn't throw on an HTTP error status — so a >2MB reply got a 413 and vanished\nwith no error and nothing in the chat. On 413, resend a truncated body (+ a\n\"reply too large, truncated\" marker) so the user gets the clipped reply instead\nof silence; log other non-ok posts.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): don't silently drop a reply the room rejects as too large",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T14:34:46Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "754073c20dd0b1af53fbcfb4b50623fb03801e9f",
          "body": "…st task)\n\nWalks a first-time user from `npm install` through creating their own\nLark/Feishu custom app (bot capability, long-connection events,\nim.message.receive_v1, the exact scopes, release-to-take-effect), storing\ncreds, starting the owner, binding a chat, daily use, management, token\nsafety, and a troubleshooting table. Linked from the README.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: add a from-zero getting-started guide (install → Lark bot → fir…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T14:07:10Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "9a87557c122717e02bce2bc6dc144cd6761dbfff",
          "body": "Claude Code sometimes concludes a turn with a post_turn_summary system event\ninstead of assistant text; ACP adapter 0.52.0 doesn't map it (logs \"Unexpected\ncase\") so the reply comes through empty and nothing reaches the IM chat — worst\non no-tool conversational turns, which go fully silent. Post a \"\n[…]\nr\nwhen a clean turn produces no text, so the chat always shows the turn finished.\nProgress cards already convey what the turn did.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): never go silent — confirm turn end when the agent emits no text",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T12:24:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "5fc224dfc30f69191c9cb5f79985f10113d4a43f",
          "body": "… only)\n\nA bound host ran ACP_PROGRESS=0, so the IM chat saw the instant ack then nothing\nuntil the final reply — the agent's work was invisible. host (incl. --bind) is\ndocumented as progress ON; the bound special-case contradicted that. Drop it so a\nbound host emits one progress card per tool call \n[…]\n`\nowner relays on to the chat. im=null on a bound host (owner owns the bot), so out()\nstays room-only and there is no double-send.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): bound agents relay progress to the IM chat (was final-reply…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T12:04:40Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7946f461729805e37110973add32db14c65f4cf5",
          "body": "The only way to get a \"private\" chat with the bot is to make a group and add\nit, but a group otherwise forces every message to @-mention the bot. Detect a\ngroup with user_count <= 1 (Lark chat.get returns the human count apart from\nbot_count) and drop the @ requirement for it, like p2p. Cached 60s s\n[…]\nd person reverts within a\nminute. Needs the im:chat:readonly scope; without it chat.get throws and we\nstay @-only (safe fallback).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): treat a solo group (one human + bot) like p2p — no @ required",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T11:52:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3c162e9c9db44647bd0d23e0ae1c437103d73d08",
          "body": "Live render test: Lark cards show inline-code backticks literally but render fenced\nblocks as a copyable code box. So shell commands stay fenced (the copy button Tom\nwanted) and every other inline backtick is dropped → bold/plain. 100/100.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): commands as fenced code blocks (copy box), no inline backticks",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T11:34:18Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "a1a87c94a52cf80cd4bbb61f4cee8cc895ab0d55",
          "body": "…ckticks\n\n#1 was the Concord room name, not the Lark group name. Fetch it from the agent\nREST /rooms/:id/info (room id is the bearer) instead of Lark im.chat.get. Show it\nin the self-intro and /agents. Also drop inline backticks from the intro/agents —\nLark cards render **bold** but show `code` backticks literally. 100/100.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): show the CONCORD ROOM name (not Lark chat) + drop literal ba…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T11:30:02Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "43de7846a88f9a46ae2cc2724386e08c78f61c7a",
          "body": "…rdown\n\n- #1: the owner resolves the chat/group name (Lark im.chat.get, cached, best-effort)\n  and shows it in the self-intro (\"已接入「后端项目」\") and /agents listing.\n- #3: `concord shutdown` stops the IM owner + every agent and clears all bindings —\n  the one-command clean slate (what we'd been doing by \n[…]\nnt bots coexist in a group via @-targeting;\nthe only cautions are shared room / shared cwd / others burning your budget.)\n100/100.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): chat name in intro/agents + `concord shutdown` one-shot tea…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T11:18:49Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "7e0d8db3714025587c6f63d7fc3ac28632678e05",
          "body": "…ng fix (0.2.0)\n\n- #1 copy: bind/rebind commands now sent as a fenced code block (Lark renders a\n  copyable code box) instead of inline backticks.\n- #3 hang: obtainRoomId force-closes the loopback (Connection: close +\n  closeAllConnections) so a browser keep-alive can't leave `concord host --bind`\n \n[…]\nat that host's room\n  (was lingering → owner kept relaying into a dead agent).\n\nBump 0.2.0 (IM owner + bindings feature). 100/100.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): bind UX round 2 — copy-box, /agents, rm unbinds, handoff ha…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T11:04:39Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "fd6e5136a5aa6f64f390054203ad9e006348dc27",
          "body": "- #2 markdown: render outbound via im-render.mjs — status lines (收到/✓) go as plain\n  text, replies as a card; ATX headings (#) → bold (Lark cards render # literally).\n- #3 self-intro: a new binding now posts a proper intro to the chat (agent name +\n  cwd, @-me reminder), not a bare \"✓ 绑定成功\". concord\n[…]\nder open_id → display name (agent sees \"张三: task\"); /help command;\n  /usage routed to the agent verbatim (was a no-op). 97→ tests.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): UX polish — markdown render, self-intro, names, /help",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T10:47:18Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "6ea48dffce02304e7d194010154f777971675c26",
          "body": "A stopped owner's relay session lingers in the room, so a fresh owner joining as\n\"IM\" hit 409 and the relay never came up after restart. Retry with a pid-suffixed\nname on 409 and key the loop-guard on the name actually joined (per-room). 93/93.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(im): owner relay survives restart — retry room join on 409",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T10:27:38Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "b0c02c342c26c4428effc12270c0f7c3bcd93eca",
          "body": "When the owner picks up a NEW binding it now posts \"✓ 绑定成功 …\" (or \"⚠️ 绑定失败\"\nif the room won't join) to that chat, so the user who just ran `concord host --bind`\ngets feedback in the chat, not only the terminal. Watch the ~/.concord directory\n(the bindings file may not exist at owner startup) instead\n[…]\n the\nrelay only coming up lazily on the first message. Startup sync stays silent (a\nrestart never re-spams existing chats). 93/93.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): confirm bind success/failure IN the chat + watch dir not file",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T10:23:12Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "0abfe811ea4c3f03615dbdec2aa54ab394008dfd",
          "body": "…phase 3+4)\n\nPhase 3 (relay, im-owner.mjs): bound chat → POST into the room (as \"IM\") + instant\nack (decision 4); per-room poll relays the agent's reply/progress/budget-notes back\nto the chat (loop-guard: skip \"IM\"); fs.watch on the bindings file brings relays up\nfor fresh binds without restarting t\n[…]\ne]` writes\nthe chat→room binding + starts a progress-OFF agent (the owner relays). Group binds\ndefault to --budget 1000000. 92/92.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): owner relay + `concord im` daemon + `concord host --bind` (…",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T09:54:24Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "8444018f7b987cb756f284955ebcbe5f5e1ed926",
          "body": "/concord-bind handshake verified live against a real Lark app: both p2p and\ngroup → action=bind, owner replies the guided command in-chat. The text-preview\nlog made the (transient first-run) ignore easy to rule out.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore(im): owner logs parsed text preview (live-debug aid)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T09:23:46Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "e90b3e7a1fa8a5952d8d529893306ad70b589d27",
          "body": "im-owner.mjs (`concord im`): owns the bot's single WSClient, classifies inbound\n(im-routing), handles /concord-bind + /concord-unbind IN the chat (decision 1:\nreply in-group), routes bound chats (room relay = phase 3). Bind command is now\n/concord-bind (slash, canonical; bare still accepted) — clear\n[…]\nind\". Group binds default to --budget 1000000. createOwner is testable\nwith a mock client; 6 owner tests + routing updated. 92/92.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): IM owner with /concord-bind handshake (phase 2b)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T08:49:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "ecf7628f7c6022e3b4a68729296340a4cedbc46f",
          "body": "im-routing.mjs: classifyInbound + commandOf — decides ignore/bind/unbind/usage/\nmessage for each inbound message (p2p=all, group=@bot only; commands matched on\nthe mention-stripped text). No I/O/SDK → 6 offline tests. The owner daemon (2b)\nwill wire this to the WSClient. 86/86.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): pure inbound-routing brain (phase 2a)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T08:03:50Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "f4576f948d5f9ea6e6917b6d4c6fc67f2b57f2c6",
          "body": "Groundwork for the single-tenant IM owner model (one bot drives N agents, routed\nby chat). im-bindings.mjs: local, atomic, keyed by platform:chat_id, force-guard\non clobber. Not wired in yet — pure store + 6 tests. Design:\nim-for-agents/docs/im-binding-design.md. 80/80.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): chat→room binding store (phase 1 of owner+bindings redesign)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T07:55:24Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "40b90c0cff2e8b5ee3dee6520175a49022f2097c",
          "body": "obtainRoomId left its 5-minute watchdog setTimeout un-cleared after the room\ncallback resolved, so the event loop stayed alive and `concord join/host` (the\nno-room browser-handoff path) appeared \"stuck waiting\" long after the daemon had\nstarted. Clear the timer on resolve + unref it so it can never block process\nexit. Adds an e2e regression test.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: CLI no longer hangs ~5min after browser room-pick (0.1.3)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T05:26:05Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "21eeb197e6de0eb8fb35317e14e9752be3b273ea",
          "body": "Reads version from package.json at runtime (single source of truth, can't drift\nfrom what's published). Folded into the not-yet-published 0.1.2. 73/73 tests\n(adds concord-version.test.mjs).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: `concord version` (-v / --version) prints the version",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T05:00:23Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "6ecc12ac7b348e31d34daf3525a3aa39a55d25e0",
          "body": "Token/memory safety. `concord rm` on a RUNNING (or orphaned) host used to just\nunregister + delete state — leaving the supervisor + ACP adapter + agent group\nalive, still polling the room and burning tokens, AND throwing away the pids\nneeded to ever reap them. Confirmed live: three rm'd hosts left ~\n[…]\ncord-rm.test.mjs): a real running process\nregistered as a host is killed by `concord rm` before the entry is dropped.\n72/72 tests.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: `concord rm` reclaims the agent group before removing (0.1.2)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T04:54:56Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "e58c5b0bd87b3ee9a6cc3bade266875cbdec1288",
          "body": "Two fixes for the published package so it works out of the box:\n\n- Default --url is now https://concord.fenginwind.com (was localhost:3001,\n  a dev leak). Override with --url http://localhost:3001 or CONCORD_URL for\n  self-hosted/dev.\n- Room id can be the 2nd positional: `concord join <agent> <room>\n[…]\nonal > CONCORD_ROOM_ID > web handoff.\n\nHelp text (concord --help and bare-bridge --help) and README updated to match.\n71/71 tests.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: default to hosted Concord + accept positional room id (0.1.1)",
          "author_name": "zkwasm",
          "author_login": "zkwasm",
          "committed_at": "2026-06-29T04:42:27Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "1d83a037b85cf1eafa4b14d6b0d1e86718857f94",
          "body": "Wires the IM half of `concord host` (was a stub): talk to your hosted agent from\nLark/Feishu. Personal mode = 1:1 (your own custom-app bot ↔ your room ↔ your agent),\nso NO chat↔room binding table, NO central relay, NO multi-tenant — the model-B\nmachinery that caused the old \"private chat = no respon\n[…]\nction needs a real custom app to verify\n(WSClient handshake) — see docs/im-setup-guide.md (user) + docs/lark-host-private-chat.md.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat(im): personal-mode Lark/Feishu bridge for `concord host --im`",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-29T03:09:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "3ec6414ea9241f3f1aa14322ad79d48f37cae7cd",
          "body": "The 'retry once ps recovers' note holds only for a transient ps failure at reap\n(start was captured); if ps was absent AT CAPTURE the start is null forever and the\nhost is never auto-reaped (clean shutdown / manual kill only). No behavior change.\n\nRound-5 final convergence review: CONVERGED — zero confirmed critical/high; all\ntoken-burn paths bounded. This was the only (low, doc-only) confirmed item.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "docs: clarify the unverifiable-orphan keep-pid comment (round-5 nit)",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T12:29:20Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "0dc27e1bbf31430d01a2beee56226ed9a2cf426f",
          "body": "…pause)\n\nRound-4 stabilization review found the cbfcf10 fixes themselves had two false-\nnegatives that REOPENED an unbounded burn path. Closed both:\n\nHIGH — identity-guard false-negative + permanent forfeit. When the adapter's\n  start-time was unverifiable (ps failed/absent at spawn OR transiently a\n[…]\n'}`); now it\n  points to `concord list` for the id.\n\nTests 63/63 (+4 reapAdapterGroup reason tests incl. unverifiable-not-killed).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(safety): close round-4 false-negatives (identity guard + timeout …",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T11:15:19Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "cbfcf10f4aa0e600a580cac2ec980ca4d408c1eb",
          "body": "… review)\n\nA focused adversarial review of commit 484c4e4 confirmed the P0/P1/P3 fixes hold\nbut flagged new issues the fixes themselves introduced. Closed them (UX unchanged):\n\nHIGH — sweepOrphans group-killed a bare stale adapter pgid with NO identity guard,\n  on every command incl. read-only ones \n[…]\n delay 0), so a just-finished turn is never killed.\n\nTests 59/59 (added a recycled-pid 'never group-killed' test). README updated.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(safety): close new bugs from the burn-fix batch (fix-verification…",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T09:41:14Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "484c4e4606a53e2b6732cec152a1a3d41a21cc5a",
          "body": "The core guarantee — a hosted agent must never be a silent bottomless token sink —\nwas not held. A focused threat-model review (reproduced: one wedged turn burned 8M\ntokens under a 50k cap; usage-absent made the cap a no-op; crash-loop spawned 100\nadapters). Closed every path, WITHOUT changing the c\n[…]\nout test that proves a never-stopping turn is\nbounded). turnTimeoutMs is an injectable createEngine option. README \"Token safety\".\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix(safety): bound + surface all token-burn paths (threat-model review)",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T08:55:07Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "f6fbbcf38edd4a613bbce40fb580fdda473754ec",
          "body": "Resolve the comprehensive-review findings (1 critical, 1 high, 4 medium, 2 low):\n\n- CRITICAL: drain() now wraps each turn in try/catch + finally(busy=false), posts\n  a failure note to the room, and self-heals a dead engine (recreate the adapter +\n  ACP session) instead of crashing the host. Added an\n[…]\nrget stopHost, usage-mapper, dead()/resilience,\nadapter-pgid persistence). npm pack clean. Real-adapter shutdown reclaim verified.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "fix: harden turn loop + adapter-group reclamation (review findings)",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T07:21:52Z",
          "body_truncated": true,
          "is_coding_agent": true
        },
        {
          "oid": "b3114d9f1b17b5015800f899e9033731568f62f2",
          "body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "chore: add repository/homepage/bugs metadata",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T04:03:08Z",
          "body_truncated": false,
          "is_coding_agent": true
        },
        {
          "oid": "1a70268328ef12dbc279832fc332e858a3e1f8d3",
          "body": "New package (bin: concord) split out from the im-for-agents bridges/acp spike.\nDrives claude/codex/gemini over the open Agent Client Protocol via the official\n@agentclientprotocol/sdk (Zed, Apache-2.0) — no third-party orchestrator dep.\nResident session (idle = zero tokens), token budget, daemon lif\n[…]\nhild-group reclamation, personal IM bridge (concord login).\n\nconcord-mcp stays frozen; this is the additive agent-hosting ingress.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
          "is_bot": false,
          "headline": "feat: concord-agent — host coding agents in Concord rooms over ACP",
          "author_name": "zkwasm",
          "author_login": "masstensor",
          "committed_at": "2026-06-28T02:59:16Z",
          "body_truncated": true,
          "is_coding_agent": true
        }
      ],
      "releases_count": 1,
      "commits_last_year": 76,
      "latest_release_at": "2026-06-29T12:24:12Z",
      "latest_release_tag": "v0.2.0",
      "releases_from_tags": true,
      "days_since_last_push": 8,
      "active_weeks_last_year": 4,
      "days_since_latest_release": 31,
      "mean_days_between_releases": null
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 42,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "concord-agent",
          "exists": true,
          "license": "MIT",
          "keywords": [
            "concord",
            "acp",
            "agent-client-protocol",
            "coding-agent",
            "claude",
            "codex",
            "ai",
            "cli"
          ],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/concord-agent",
          "is_deprecated": false,
          "latest_version": "0.7.18",
          "repository_url": "https://github.com/zkwasm/concord-agent",
          "versions_count": 33,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 4994,
          "first_published_at": "2026-06-29T03:40:36.745000Z",
          "latest_published_at": "2026-07-22T07:23:55.919000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 8
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [],
      "largest_source_bytes": 60670,
      "source_files_sampled": 48,
      "oversized_source_files": 1,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 57,
        "malicious_count": 0,
        "assessed_package": "npm:concord-agent@0.7.18",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "@agentclientprotocol/sdk",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "0.28.1"
        },
        {
          "name": "@larksuiteoapi/node-sdk",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^1.68.0"
        },
        {
          "name": "qrcode-terminal",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^0.12.0"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "zkwasm",
          "commits": 68,
          "avatar_url": "https://avatars.githubusercontent.com/u/113981964?v=4"
        },
        {
          "type": "User",
          "login": "masstensor",
          "commits": 8,
          "avatar_url": "https://avatars.githubusercontent.com/u/1336077?v=4"
        }
      ],
      "contributors_sampled": 2,
      "top_contributor_share": 0.895
    },
    "quality_signals": {
      "has_ci": false,
      "has_tests": false,
      "ci_workflows": [],
      "has_docs_dir": true,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "package-lock.json"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 0,
            "reason": "project has 0 contributing companies or organizations -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": null,
            "reason": "no workflows found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": null,
            "reason": "no dependencies found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": null,
            "reason": "No tokens found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "29 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "0ae809fffffc6860ae9fad729021223e004b3146",
        "ran_at": "2026-07-31T05:48:14Z",
        "aggregate_score": 1.5,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-23T03:09:03Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": null,
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/zkwasm/concord-agent",
    "host": "github.com",
    "name": "concord-agent",
    "owner": "zkwasm"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 38,
      "inputs": {
        "security": 32,
        "vitality": 58,
        "community": 33,
        "governance": 33,
        "engineering": 31
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 58,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "at_risk",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 48,
            "inputs": {
              "commits_last_year": 76,
              "human_commit_share": 1,
              "days_since_last_push": 8,
              "active_weeks_last_year": 4
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 8 days ago",
                "points": 28.8,
                "status": "partial",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 8
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "4/52 weeks with commits",
                "points": 2.8,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 4
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "76 commits in the last year",
                "points": 16.9,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 76
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "good",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 72,
            "inputs": {
              "releases_count": 1,
              "latest_release_tag": "v0.2.0",
              "releases_from_tags": true,
              "days_since_latest_release": 31,
              "mean_days_between_releases": null
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "1 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 31 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 31
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "cadence unknown (single release)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "release_cadence_unknown",
                    "params": {}
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 33,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 62,
            "inputs": {
              "packages": [
                "concord-agent"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 4994
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "4,994 downloads/month across npm",
                "points": 49.3,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 4994,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 33,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 14,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 2,
              "top_contributor_share": 0.895
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 90% of commits",
                "points": 2.4,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 90
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "2 contributors",
                "points": 2.7,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 2
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 36,
            "inputs": {
              "followers": 2,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "zkwasm",
              "public_repos": 9,
              "account_age_days": 1409
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "2 followers of zkwasm",
                "points": 3.4,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 2,
                      "login": "zkwasm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "9 public repos, account ~3 yr old",
                "points": 15,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 9
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 3
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "concord-agent"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 8
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 8 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 8
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "33 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 33
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "at_risk",
        "name": "Engineering Quality",
        "value": 31,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "critical",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "has_ci": false,
              "has_tests": false,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "good",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 75,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 32,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "critical",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Dangerous-Workflow, Packaging, Pinned-Dependencies, Signed-Releases, Token-Permissions. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "dangerous_workflow",
                    "packaging",
                    "pinned_dependencies",
                    "signed_releases",
                    "token_permissions"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 15,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 12,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 6,
              "scorecard_aggregate": 1.5
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 0 contributing companies or organizations -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no workflows found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "no dependencies found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "No tokens found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "29 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "excellent",
            "name": "Dependency advisories",
            "note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:concord-agent@0.7.18 runtime dependency closure — what installing the published package pulls in — 57 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "no_advisories_left_outstanding"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              },
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:concord-agent@0.7.18",
                  "assessed": 57
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "source": "osv",
              "advisories": 0,
              "affected_packages": 0,
              "assessed_packages": 57,
              "unassessed_packages": 0,
              "affected_by_severity": "none",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "no indirect dependency carries a known advisory",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "no_indirect_advisories",
                    "params": {}
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "no advisory carries a publication date",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "advisories_no_publication_date",
                    "params": {}
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 57,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "at_risk",
        "name": "AI Readiness",
        "value": 34,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "76 of 76 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 76,
                      "sampled": 76
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "critical",
            "name": "Verify loop (build / test / typecheck)",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_pinned_dependencies"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 22,
            "inputs": {
              "has_nix": false,
              "has_tests": false,
              "lockfiles": [
                "package-lock.json"
              ],
              "has_dockerfile": false,
              "typed_language": false,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0.895,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "68 of the last 76 commits agent-authored or agent-credited",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "agent_authored_commits",
                    "params": {
                      "count": 68,
                      "sampled": 76
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "no dependencies found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "moderate",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "primary_language": "JavaScript",
              "largest_source_bytes": 60670,
              "source_files_sampled": 48,
              "oversized_source_files": 1
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "JavaScript without a type-check config",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_typecheck_config_language",
                    "params": {
                      "language": "JavaScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "1/48 source files over 60KB",
                "points": 53.9,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 48,
                      "oversized": 1
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-31T05:48:18.641568Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/z/zkwasm/concord-agent.svg",
  "full_name": "zkwasm/concord-agent",
  "license_state": "standard",
  "license_spdx": "MIT"
}