codastre / cli

Не вдалося зібрати розв'язаний набір залежностей для цього звіту: GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 189,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "Go": 229663
      },
      "pushed_at": "2026-07-21T07:33:39Z",
      "created_at": "2026-06-23T17:43:36Z",
      "owner_type": "Organization",
      "updated_at": "2026-07-21T07:33:18Z",
      "description": "codastre developer CLI — read-only mirror of jflbr/codastre//cli (do not edit directly)",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": null,
      "type": "Organization",
      "login": "codastre",
      "company": null,
      "location": null,
      "followers": 1,
      "avatar_url": "https://avatars.githubusercontent.com/u/295563504?v=4",
      "created_at": "2026-06-21T10:20:24Z",
      "is_verified": null,
      "public_repos": 2,
      "account_age_days": 30
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2026-07-21T07:35:45Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2026-07-20T06:43:48Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2026-07-17T08:59:46Z"
        },
        {
          "tag": "v0.7.1",
          "kind": "patch",
          "published_at": "2026-07-09T07:12:22Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2026-07-08T11:55:03Z"
        },
        {
          "tag": "v0.6.2",
          "kind": "patch",
          "published_at": "2026-07-06T16:02:00Z"
        },
        {
          "tag": "v0.6.1",
          "kind": "patch",
          "published_at": "2026-07-06T12:14:18Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2026-07-06T11:47:58Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2026-07-04T20:00:56Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2026-06-30T00:27:38Z"
        },
        {
          "tag": "v0.3.1",
          "kind": "patch",
          "published_at": "2026-06-29T17:05:06Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2026-06-27T13:21:39Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2026-06-25T18:14:07Z"
        },
        {
          "tag": "v0.1.3",
          "kind": "patch",
          "published_at": "2026-06-25T17:10:01Z"
        },
        {
          "tag": "v0.1.2",
          "kind": "patch",
          "published_at": "2026-06-23T19:56:29Z"
        },
        {
          "tag": "v0.1.1",
          "kind": "patch",
          "published_at": "2026-06-23T19:42:56Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2026-06-23T19:35:08Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "26781fb57a840b5e97045e9a80249a802e412ccc",
          "body": "The stdio MCP proxy gated ALL response enrichment on UnmaskPath being\nnon-nil. But setupUnmask returns nil for masking_scheme != hmac, so on\n`none`-scheme (cleartext) repos — the common dev/eval setup — QUERY/GRAPH\nresults came back with only `path_token`: no `real_path`, no `snippet`.\nThat silently\n[…]\nbased line contract and clamps a stray line_start of 0.\n\nTests: new none-scheme identity + checkout-hydration cases for QUERY and\nGRAPH; existing hmac/rev tests unchanged. go build/vet/test all green.",
          "is_bot": false,
          "headline": "feat(cli): hydrate snippets/paths on cleartext (none-scheme) repos",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-07-21T07:32:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0b314867515bbb969f7b056e48dfbcaf12bfd6e4",
          "body": "The GRAPH human renderer read the item-level confidence/resolution mirrors\nthat the corpus-hygiene API3 compaction removed — every edge decoded to the\nzero values and rendered as 'conf 0.00  [hypothesis]' while --json showed the\nreal 0.61 resolved. Read the canonical edge object, with a fallback to \n[…]\n still render correctly.\n\nSame-family fix in the QUERY header: scoped federated envelopes (API2) omit\nsearched_repos, so the human view claimed 'searched 0 repo(s)' — fall back to\nsearched_repo_count.",
          "is_bot": false,
          "headline": "fix(cli): graph/query human views read the compacted envelope",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-07-20T06:41:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3509e450b3f733c1f5471bd8ea74e4ece001fc96",
          "body": "…erated envelope scoping (API2), payload compaction + shim rev fix (API3)\n\nAPI1 (P5): plaintext path_prefix is hashed server-side per repo scheme\n(sha256 for none, HMAC via SecretStore key for hmac; 64-hex passthrough);\nfilter_matched hint distinguishes 'prefix matches nothing indexed' from a\ngenuin\n[…]\nH unmasking now reads each endpoint repo's mask_key_rev from the repos\nmap (was hardcoded rev 0); Go fixture test pins the scoped+compacted\ncontract (EV2); graph-tool schema + dashboard types updated.",
          "is_bot": false,
          "headline": "feat(graph): hygiene plan phase 1 — path_prefix plaintext (API1), fed…",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-07-20T06:41:29Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cacb9020781311b65b999af286a64229416e7f7b",
          "body": "* feat(perf): capability-parity Tier 1 — single parse, batched blob reads, bounded graph reads\n\nImplements CAPABILITY_PARITY_PLAN.md Tier 1 (speed + bounded read path):\n\n- 7.1 Capture-row cache: graph_capture_cache (migration 0066) keyed\n  (tenant, blob_sha, lang, EXTRACTOR_REV, pattern_rev). Extrac\n[…]\nms (documentation-only: handlers keep the friendly\nINVALID_REQUEST parse), and repo-internal doc references were removed from\ntool docstrings since MCP clients can't resolve them.\n\n* do not track plan",
          "is_bot": false,
          "headline": "feat: intra-repo graph parity + cold-index and read-path speed (#63)",
          "author_name": "Jeyfel Brandauer M",
          "author_login": "jflbr",
          "committed_at": "2026-07-17T08:57:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "473dae1b79ab21052f3e1ee7aa37af0322672667",
          "body": "… + topology legend (#56)\n\n* feat(graph): precision plan phase 0 — resume scaffolding + FP-class fixtures\n\nAdd the plan's resume section + phase-status table so a fresh session can\n'resume the plan @docs/explorations/graph-edge-precision-plan.md', plus a\ncompanion progress log. Encode the four repor\n[…]\nte-resolution tests, and the throw-away\non-prem remediation notes. Comment/string-only — no extraction behavior change,\nso extractor_rev.lock is regenerated (files_hash) without an EXTRACTOR_REV bump.",
          "is_bot": false,
          "headline": "Cross-repo edge precision: evidence-graded edges + rev-gated re-grade…",
          "author_name": "Jeyfel Brandauer M",
          "author_login": "jflbr",
          "committed_at": "2026-07-09T06:59:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f309af728da02e80de8a59ee1faa368bd3deda77",
          "body": "…(#53)\n\n* Scale indexing: coalesce graph fan-out + worker concurrency (#37)\n\n* fix(graph): coalesce sibling graph-refresh fan-out\n\nenqueue_sibling_graph_refresh inserted an extract_graph job for every ready\nsibling on each (re)index with no dedup, so onboarding N repos enqueued ~N²/2\njobs plus dupli\n[…]\n graph + inspector), portalled to <body>, Esc to exit.\n- Taller default graph pane that fills the viewport height.\n- Shared auto-fit and distinct Fit/Expand toolbar icons come from\n  ForceGraphCanvas.",
          "is_bot": false,
          "headline": "feat: backport indexing/graph scaling + dashboard jobs & graph views …",
          "author_name": "Jeyfel Brandauer M",
          "author_login": "jflbr",
          "committed_at": "2026-07-08T11:52:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d6989da6fed822457b7b114fc671649dd28a7e98",
          "body": "login failed on hosts without a usable OS keychain (e.g. the Qonto\ntooling host) with:\n\n    Error: store API key: No directory provided for file keyring\n\nkeychain.Open() called keyring.Open() with no AllowedBackends, so the\nlibrary auto-selected the file backend but with no FileDir. keyring.Open\nsti\n[…]\nue, surfacing the plaintext-storage\nwarning honestly).\n\nAdd store_test.go covering: primary-open errors without an OS keychain,\nfile-fallback round-trip, and the real OS keychain path (no regression).",
          "is_bot": false,
          "headline": "fix(cli): fall back to file storage when no OS keychain is available",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-07-06T15:57:56Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "250c26cbd2d2cf3fd5f02aa0382a26566bec49bc",
          "body": "handoffHandler flushes the response body before signalling done, so\nhttp.Get can return before done <- nil runs. The non-blocking select\nthen raced that send and hit default under load. Block on done with a\n2s timeout instead.",
          "is_bot": false,
          "headline": "test(cli): deflake handoff test — block on done with a timeout",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-07-06T12:10:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "62148b3cf8d8c5d1ebf1f5e9a7e3cd5dcea0fe08",
          "body": "…mmand\n\nThe CLI defaulted to https://api.codastre.com and required --server on\nevery command for self-hosted deployments. Now the server is remembered:\n\n- new internal/config store at ~/.config/codastre/config.json\n- defaultServerURL resolves $CODASTRE_SERVER -> config -> hosted default\n- login pers\n[…]\ne dashboard /connect page also gains an 'Install the CLI' step (it\npreviously assumed the binary was already installed) linking to the\nreleases page, and prefills --server for self-hosted deployments.",
          "is_bot": false,
          "headline": "feat(cli): persist server URL so self-hosted needs no --server per co…",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-07-06T11:31:12Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a0dcf3f93e844013b04b60b803f85718dbbce36e",
          "body": "Make which supported languages are active on a deployment an operator\ndecision, stored deny-list style in deployment_config (LANGUAGES_KEY):\nabsent config = everything on; disabling degrades a language to line-window\nchunking with no graph edges (LG5) — never excluded from retrieval.\n\n- pure resolve\n[…]\nsture, LanguagesCard dashboard, doctor line\n- conformance item 6 (test_enablement)\n\nCHUNKER_REV unchanged: the snapshot corpus proves byte-identical output (LG2),\nso chunker_rev.lock only regenerates.",
          "is_bot": false,
          "headline": "feat(languages): operator language enablement (Phase 2)",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-07-04T16:18:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ce2aaf1ae5733fad1468691e4b5cf6dd48e1a18c",
          "body": "Uploaded runbooks/docs were embedded into Qdrant but unreachable: corpus\ncreation never minted the repos+indexes rows the QUERY path resolves, and\neven once reachable, results were opaque doc-ids with no way to read the body.\n\n- ingest_document: register repos+indexes (repo_id=index_id=corpus_id) on\n[…]\noc title; add --alert-ids / --error-codes flags.\n\nTests: ingest registration, repos document_set exclusion, search filter\nforwarding + enrichment, CLI doc-title render. make check + integration green.",
          "is_bot": false,
          "headline": "feat(corpora): make document/runbook corpora queryable end-to-end",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-30T00:24:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fe6aaa29beb4340cb2b820955c6543719e442512",
          "body": "version/commit/date were only set via -ldflags at GoReleaser release time, so\n`go install …@vX.Y.Z` and local `go build`/`make cli-build` always printed\n\"dev\". resolveBuildInfo() now falls back to the binary's embedded Go build info\nwhen the linker values are absent: the module version from `go install`, and the\nVCS revision/time/dirty stamp from a build in a git checkout. Injected release\nvalues still take precedence. The pure computeBuildInfo() core is unit-tested.",
          "is_bot": false,
          "headline": "fix(cli): report real version from build info instead of \"dev\"",
          "author_name": "Jeyfel B. Missanda",
          "author_login": null,
          "committed_at": "2026-06-29T17:01:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7522ff57e6163b74dec010714ac78514260b4303",
          "body": "Auto-target resolution for `codastre query`/`graph` only read the `origin`\nremote. A clone whose `origin` points at an unregistered fork while a\nregistered mirror lives under `upstream`/`source` resolved to the wrong\ncanonical URL and returned REPO_NOT_INDEXED, even though the repo was indexed.\n\naut\n[…]\nacks and never retries. The resolved target is reported\nback so the target line and path unmasking use the repo that actually matched.\n\nsync still targets origin (its push/diff semantics are correct).",
          "is_bot": false,
          "headline": "fix(cli): resolve current repo across all remotes, not just origin",
          "author_name": "Jeyfel B. Missanda",
          "author_login": null,
          "committed_at": "2026-06-29T16:55:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fb1839c01fce3aa71fb72815b7b75a507c61b339",
          "body": "On a fresh deployment, one-click repo connect is walled until an operator seals a\nGitHub App key. Make that loud to the only people who can fix it:\n\n- GET /v1/operator/health returns github_app_configured (deployment-global)\n- Operator console shows a GitHubAppNotice warning banner when unconfigured\n[…]\nithub/app-config;\n  skipped silently if it can't run)\n- docs/github-app-setup.md: callout that it's a one-time, per-deployment operator\n  step (not per-tenant), and manual deploy-key URLs keep working",
          "is_bot": false,
          "headline": "feat(onboarding): surface GitHub App health to operators (Phase G)",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-27T12:53:11Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "a23c1f578fb5154212624de0a747dee72631e19d",
          "body": "A --repo-path that doesn't match the target repo is now reported and ignored,\nthen the remembered checkout registry is tried as a fallback (previously a wrong\n--repo-path short-circuited to the masked-paths warning). Verified: wrong\n--repo-path + a known clone unmasks via the fallback.",
          "is_bot": false,
          "headline": "fix(cli): fall back to remembered clone when --repo-path is wrong",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-25T18:09:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "32947335b6ab6da80c034cc48c4a71c35356a4d8",
          "body": "…o-path\n\nHMAC is one-way: the masking key alone can't reverse a path_token — unmasking\nmust hash a local checkout's real paths and match. So unmasking a repo you're\nnot currently inside needs a clone to hash against, not just the key.\n\nAdd a checkout registry (~/.config/codastre/checkouts.json) that\n[…]\ne inside a repo, then query/graph it from\nanywhere and paths unmask automatically; --repo-path works with an empty\nregistry; a wrong --repo-path is reported and ignored; no clone → actionable\nwarning.",
          "is_bot": false,
          "headline": "feat(cli): unmask across directories via remembered checkouts + --rep…",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-25T18:01:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e85d2f35b4e7bce3f411b2960608dc34ae08f247",
          "body": "Unmasking inverts per-component HMAC by enumerating the local working tree, so\nit only resolves tokens for the repo that is the current checkout. A run that\ntargets a different repo via --repo-url (e.g. querying reviewfy from the\ncodastre checkout) previously built a CWD-scoped resolver that missed \n[…]\nll, and --index-id runs keep the best-effort CWD\nresolver. Verified end-to-end against a live server: in-repo query/graph unmask\nto real paths; cross-repo prints the warning; --no-unmask stays masked.",
          "is_bot": false,
          "headline": "fix(cli): make query/graph unmasking target-aware",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-25T17:42:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "4544b761006c54c7801182ded89ddf747ab72dad",
          "body": "The graph CLI command rendered raw HMAC path_tokens, unlike the MCP proxy\n(codastre serve) which unmasks src/dst path_tokens in GRAPH responses. Bring\nthe command to parity:\n\n- renderGraphHuman now unmasks each edge's src/dst path_token to the real path\n  (rev 0, matching the proxy — GRAPH carries n\n[…]\n.\n- Add --no-unmask to both query and graph to show raw masked tokens. --json\n  remains a raw passthrough (always masked).\n\nTests cover graph unmask, raw-token fallback on miss, and query rev passing.",
          "is_bot": false,
          "headline": "feat(cli): unmask file paths in graph output + --no-unmask flag",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-25T17:32:54Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7e8d9c0a11fbe4edafe15a54d1c4d151ee17fc28",
          "body": "… guide\n\n- Add public /install page (dashboard) linked from Connect section and footer\n- Rewrite CLI mirror README with quickstart, command reference, privacy model\n- Rewrite monorepo README; fix stale migration head (0006 -> 0028)\n- Document first-release setup (SSH deploy key + GitHub App) in docs/cli-release-setup.md\n- Fix CTA button rendering on /install (move out of .l-prose)",
          "is_bot": false,
          "headline": "docs(cli): add public install page + CLI download docs, release setup…",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-24T23:31:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9bb416a29322640ac0b9a7711c71feb37856de04",
          "body": "The CLI fell back to http://localhost:8000 when CODASTRE_SERVER was\nunset, which only works for local dev. Point the default at the hosted\nAPI so a fresh install connects out of the box; CODASTRE_SERVER and\n--server still override for local/self-hosted use.",
          "is_bot": false,
          "headline": "feat(cli): default server URL to https://api.codastre.com",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-24T22:09:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "10b2b0288afa412f19116b6ed110b4daf7a326f2",
          "body": "go install github.com/codastre/cli@latest produced a binary named 'cli' (the\nmodule's last path segment). Move the main package to cmd/codastre/ so the install\npath is github.com/codastre/cli/cmd/codastre@latest and the binary is 'codastre'.\nPrebuilt release archives were already named correctly; update goreleaser main path,\nMakefile, and the READMEs.",
          "is_bot": false,
          "headline": "fix(cli): name the go-install binary 'codastre'",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-23T19:39:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1333cb502be5b25ef8ed6a865ffd65780bfc9667",
          "body": "The previous design put the release workflow inside the mirror, but GitHub\nrejects pushing .github/workflows/* into codastre/cli via the deploy key\n('refusing to allow ... to create or update workflow ... without workflow scope'),\nso the mirror push failed and a tag-triggered run could never exist t\n[…]\n_CLI_RELEASE_TOKEN).\n- release.yml mirrors the tag then runs GoReleaser; mirror-cli.yml now only syncs\n  main between releases.\n- Remove cli/.goreleaser.yaml and cli/.github; update README + Makefile.",
          "is_bot": false,
          "headline": "fix(cli): build release in monorepo, publish to codastre/cli",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-23T18:01:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "c3deb16b165d370858b59150acae5f19686f1918",
          "body": "…mirror\n\nDashboard URL auto-discovery:\n- Add unauthenticated GET /v1/system/discovery returning dashboard_url,\n  server_base_url, and version from Settings; exempt it in AuthMiddleware.\n- CLI resolves the dashboard URL by precedence: --dashboard > $CODASTRE_DASHBOARD_URL\n  > server discovery > local\n[…]\nath matches (go install github.com/codastre/cli@latest) and tags trigger\n  releases there.\n- Apache-2.0 LICENSE + NOTICE, cli/README.md, README install section, Makefile\n  cli-release-snapshot target.",
          "is_bot": false,
          "headline": "feat(cli): auto-discover dashboard URL + distribute via codastre/cli …",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-23T17:51:49Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "255fd9cb5e32a8f5b5dad4fe18984780ca6af797",
          "body": "Distinguish the many API keys one account holds (one per agent/device).\n\n- Add api_keys.label + device_codes.label (migration 0028); label flows from\n  `codastre login` (--label, defaults to hostname) through the device flow onto\n  the minted key. Browser/SSO/invite logins default to \"Dashboard\"; op\n[…]\n/rename/revoke happy +\n  404-when-not-owned + account-less empty, and device-key account linking.\n- Log follow-ups in TODO.md (admin revoke gating, owner column, pre-existing\n  signup time-bomb test).",
          "is_bot": false,
          "headline": "feat(keys): per-key labels + account-scoped personal key management",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-23T00:35:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b387701e2671a904db72dbdda0a4de3718660d08",
          "body": "…shboard auth\n\nTenant-scoped membership invites let a tenant admin onboard teammates to an\nexisting workspace without per-tenant SSO or operator/shell access:\n\n- membership_invites (migration 0027) + domain/port/adapter/application and\n  /v1/members endpoints. Single-use, email-pinned, TTL'd bearer \n[…]\nalhost key handoff (key never enters a URL/history); graceful shutdown so\n  the handoff response flushes fully before the listener closes.\n\nTests: tests/api/test_members.py, cli/cmd/dashboard_test.go.",
          "is_bot": false,
          "headline": "feat(members): non-SSO teammate onboarding, member management, CLI da…",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-22T22:24:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b467d8ef4b0066014a9343e032cb28dae2cb4d39",
          "body": "Resolves the repo from the cwd origin (or --repo-url), reads its HMAC\nmasking key from the keychain — fetching from the server if uncached —\nand copies it as hex to the clipboard. --rev targets a specific revision,\n--print writes to stdout instead. The key is never echoed unless --print;\nthe clipboard path prints only a confirmation + a clear-your-clipboard\nwarning. Clipboard uses the OS tool (pbcopy/clip/wl-copy/xclip/xsel), no\nnew dependency. Documents the command in CLAUDE.md.",
          "is_bot": false,
          "headline": "feat(cli): masking-key command to copy a repo's key to the clipboard",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-20T21:58:06Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "192476eb14b47879ed2450ec5d94b1192404d3a1",
          "body": "Disabling then re-enabling masking lands back on rev 1 with new key bytes,\nbut keys are cached by rev number (keychain + in-memory reverse map), so the\nproxy kept using the old rev-1 key and no token resolved.\n\n- KeyFetcher gains a force flag; fetchMaskKey skips the keychain read and\n  overwrites th\n[…]\nfetch on every miss.\n- Recovers a fresh serve start with a stale keychain entry too.\n\nAdds tests for the re-enable refresh and the cooldown; updates existing\nfetcher signatures and the sync.go caller.",
          "is_bot": false,
          "headline": "fix(cli/unmask): refresh stale masking key when a rev is reused",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-20T21:16:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6c353bcd52305eb0936e03feeeaf07b113e6bb7f",
          "body": "The stdio MCP proxy never unmasked QUERY/GRAPH paths. enrichResponse\nlooked for \"results\"/\"edges\" at the top level of the /mcp HTTP body,\nbut tool results are wrapped in a JSON-RPC envelope: the payload sits\nunder result.structuredContent (and is mirrored as a JSON string in\nresult.content[0].text).\n[…]\nokens unresolved.\n\nVerified end-to-end against a live server from a masked checkout: tokens\nresolve to real paths with hydrated snippets. Adds tests for the envelope\nunwrap and per-repo rev selection.",
          "is_bot": false,
          "headline": "fix(cli/serve): unmask paths in MCP tool responses",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-20T20:22:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "acbb91d201c262f9cf50fd7c55ed26b00656088a",
          "body": "Apply HMAC path masking at rest end-to-end (impl-spec §3.6/§6.2/§8.3).\nPreviously an hmac repo still stored cleartext path_tokens in Qdrant and\nQUERY returned them verbatim, defeating masking.\n\nServer:\n- domain/masking_fields: rev-aware {path_tokens, path_prefixes} maps plus\n  scalar mirror; init_in\n[…]\nresolver/client + serve stdio proxy forwarding so the agent\n  sees real paths and snippets while the server holds only masked tokens.\n\nTests moved to the canonical repo-root tree so they actually run.",
          "is_bot": false,
          "headline": "feat(masking): rev-aware path masking-at-rest pipeline + e2e unmask",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-20T15:55:52Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ab9c4cddc968ddd64d4eeaa83d5650c552a37f35",
          "body": "Add `codastre query` and `codastre graph` so an agent or human can run\nhybrid search and graph traversal directly, as an alternative to wiring\nup an MCP connection. Each command posts a single stateless tools/call to\nthe server's /mcp endpoint (no initialize handshake) and supports the\nindex-free ac\n[…]\n a new\n`count` field. The calls extractor emits one edge per call site, so a single\nrelation could appear many times; this de-noises every GRAPH consumer, and\nthe CLI renders the multiplicity as (×N).",
          "is_bot": false,
          "headline": "feat(cli): codastre query/graph — index-free search from the CLI",
          "author_name": "jflbr",
          "author_login": "jflbr",
          "committed_at": "2026-06-18T11:24:10Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1c033c51e051e097d349e783108a330149005f15",
          "body": null,
          "is_bot": false,
          "headline": "refactor(cli): improve client-side conf ux",
          "author_name": "Jeyfel",
          "author_login": null,
          "committed_at": "2026-06-16T09:30:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d7a122354166bafa8e1954a396c0b324b818e2fe",
          "body": "Device-code (RFC 8628) onboarding was broken and exploitable. Fixes:\n\nSecurity & correctness (server):\n- device/confirm derived the new key's tenant from the request *body* while\n  requiring only any authenticated key — any principal could mint a working\n  key into an arbitrary tenant. Now tenant + \n[…]\nof generating an unrelated device code; tenant derived server-side.\n\nDocs/config:\n- impl-spec §2.1: normative server-side device-flow contract.\n- CODASTRE_DASHBOARD_URL setting + .env.example entries.",
          "is_bot": false,
          "headline": "fix(auth): secure device-code flow end-to-end + add `codastre logout`",
          "author_name": "Jeyfel",
          "author_login": null,
          "committed_at": "2026-06-15T12:12:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e8668e37a999e9d4c7d43462f3d5a93228574243",
          "body": "…nmasking",
          "is_bot": false,
          "headline": "feat(m2-d): agent-facing GRAPH tool — service, MCP handler, Go shim u…",
          "author_name": "Jeyfel",
          "author_login": null,
          "committed_at": "2026-06-14T10:30:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "02c81b7d314fe7341c0346fc912e31f4bd6d61ba",
          "body": "…ync/serve/doctor",
          "is_bot": false,
          "headline": "M1: Go CLI — git diff, URL norm, masking, keychain, MCP shim, login/s…",
          "author_name": "Jeyfel",
          "author_login": null,
          "committed_at": "2026-06-13T18:35:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2b73a084f6967d8974ddb110880caf4e70b584d4",
          "body": "- Use go build/test -C cli flag so targets work from any cwd (Go 1.21+)\n- go mod tidy: trimmed unused deps (fsnotify, keyring, go-git not yet imported);\n  go.sum generated",
          "is_bot": false,
          "headline": "Install Go, tidy cli module, fix Makefile cli targets",
          "author_name": "Jeyfel",
          "author_login": null,
          "committed_at": "2026-06-12T18:12:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "f1778985de4801e7fa78010faeffb1c6ff098489",
          "body": "- Directory tree: server/ (domain, ports, adapters, api, admin, workers, chunking,\n  retrieval, secrets, evals, migrations), cli/ (cmd, internal/git, keychain, mcpshim),\n  dashboard/, schemas/, tests/\n- pyproject.toml: all spec §1 deps pinned by major (fastapi, mcp, psycopg3,\n  qdrant-client, tree-s\n[…]\n + 99designs/keyring + go-git + cobra\n- Makefile: sync, fmt, lint, typecheck, test, check, cli-build, cli-test targets\n- CLAUDE.md: version control and workflow conventions\n- PROGRESS.md: M1 checklist",
          "is_bot": false,
          "headline": "M1 setup: repo skeleton, pyproject.toml, go.mod, Makefile",
          "author_name": "Jeyfel",
          "author_login": null,
          "committed_at": "2026-06-12T18:06:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        }
      ],
      "releases_count": 17,
      "commits_last_year": 36,
      "latest_release_at": "2026-07-21T07:35:45Z",
      "latest_release_tag": "v0.10.0",
      "releases_from_tags": false,
      "days_since_last_push": 1,
      "active_weeks_last_year": 6,
      "days_since_latest_release": 1,
      "mean_days_between_releases": 2.4
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": true,
      "has_contributing": false,
      "health_percentage": 50,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/codastre/cli",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": true,
          "registry_url": "https://pkg.go.dev/github.com/codastre/cli",
          "is_deprecated": false,
          "latest_version": "v0.10.0",
          "repository_url": "https://github.com/codastre/cli",
          "versions_count": 17,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-21T07:32:52Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 1
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [],
      "has_llms_txt": false,
      "has_dockerfile": false,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod"
      ],
      "largest_source_bytes": 16593,
      "source_files_sampled": 52,
      "oversized_source_files": 0,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": null,
        "scope": null,
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.1"
        }
      ],
      "all_dependencies": {
        "error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
        "source": null,
        "packages": [],
        "collected": false,
        "truncated": false,
        "total_count": null,
        "direct_count": null,
        "indirect_count": null
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "jflbr",
          "commits": 28,
          "avatar_url": "https://avatars.githubusercontent.com/u/13803272?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": false,
      "has_tests": true,
      "ci_workflows": [],
      "has_docs_dir": false,
      "linter_configs": [],
      "has_editorconfig": false,
      "has_linter_config": false,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "go.sum"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 6,
            "reason": "project has 2 contributing companies or organizations -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": null,
            "reason": "no workflows found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "project was created within the last 90 days. Please review its contents carefully",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": null,
            "reason": "no dependencies found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "no SAST tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": 0,
            "reason": "Project has not signed or included provenance with any releases.",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": null,
            "reason": "No tokens found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 6,
            "reason": "4 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "26781fb57a840b5e97045e9a80249a802e412ccc",
        "ran_at": "2026-07-22T08:06:59Z",
        "aggregate_score": 2.1,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": null,
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": null,
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/codastre/cli",
    "host": "github.com",
    "name": "cli",
    "owner": "codastre"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "at_risk",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 38,
      "inputs": {
        "security": 21,
        "vitality": 68,
        "community": 24,
        "governance": 34,
        "engineering": 38
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "moderate",
        "name": "Vitality",
        "value": 68,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "moderate",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "commits_last_year": 36,
              "human_commit_share": 1,
              "days_since_last_push": 1,
              "active_weeks_last_year": 6
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "6/52 weeks with commits",
                "points": 4.2,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 6
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "36 commits in the last year",
                "points": 14.1,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 36
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": null,
            "notes": [],
            "value": 90,
            "inputs": {
              "releases_count": 17,
              "latest_release_tag": "v0.10.0",
              "releases_from_tags": false,
              "days_since_latest_release": 1,
              "mean_days_between_releases": 2.4
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "17 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 17
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~2.4 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 2.4
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 24,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "moderate",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 34,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 16,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "at_risk",
            "name": "Ownership & stewardship",
            "note": null,
            "notes": [],
            "value": 36,
            "inputs": {
              "followers": 1,
              "owner_type": "Organization",
              "is_verified": null,
              "owner_login": "codastre",
              "public_repos": 2,
              "account_age_days": 30
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "organization-owned",
                "points": 30,
                "status": "met",
                "details": [
                  {
                    "code": "owner_organization",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "1 followers of codastre",
                "points": 2.2,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 1,
                      "login": "codastre"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "2 public repos, account ~0 yr old",
                "points": 3.6,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 2
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 0
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "github.com/codastre/cli"
              ],
              "ecosystems": "go",
              "any_deprecated": false,
              "min_days_since_publish": 1
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on go",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "go"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 1 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 1
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "17 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 17
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "at_risk",
        "name": "Engineering Quality",
        "value": 38,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "at_risk",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 30,
            "inputs": {
              "has_ci": false,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": false,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 50,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": false,
              "has_description": true
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "critical",
        "name": "Security",
        "value": 21,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "critical",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Dangerous-Workflow, Packaging, Pinned-Dependencies, Token-Permissions. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "dangerous_workflow",
                    "packaging",
                    "pinned_dependencies",
                    "token_permissions"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 21,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 13,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 5,
              "scorecard_aggregate": 2.1
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no workflows found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "project was created within the last 90 days. Please review its contents carefully",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "no dependencies found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "no SAST tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "Project has not signed or included provenance with any releases.",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "No tokens found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "4 existing vulnerabilities detected",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 1
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 61,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.972,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "35 of 36 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 35,
                      "sampled": 36
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_pinned_dependencies"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 62,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "go.sum"
              ],
              "has_dockerfile": false,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": false,
              "has_linter_config": false,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod"
              ],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "go.mod (toolchain convention, no task runner)",
                "points": 12.6,
                "status": "partial",
                "details": [
                  {
                    "code": "toolchain_convention",
                    "params": {
                      "files": "go.mod"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 36",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 36
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "no dependencies found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 16593,
              "source_files_sampled": 52,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/52 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 52,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-22T08:07:04.881721Z",
  "schema_version": "0.26.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/c/codastre/cli.svg",
  "full_name": "codastre/cli",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}