公开记录存在风险
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-23 19:09 UTC
Ivan-Pasco / clean-node-server
Clean Language Framework (Frame) for Node.js Server
Ivan-Pasco/clean-node-server 的健康指数为 100 分中的 49 分，处于「存在风险」区间。 其得分最高的类别是Vitality（81/100），最低的是Community & Adoption（24/100）。 最近一次更新在 5 天前。 近期的大部分工作由 1 位贡献者完成。
49
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
49
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
软件包生态系统
| 注册表 | 软件包 | 版本 | 月下载量 | 版本数 | 最近发布 | 标签 |
|---|---|---|---|---|---|---|
| npm | @ivan-pasco/clean-node-server | 0.1.97 | 4,376 | 93 | 5 天前 | clean-languagewasmwebassemblyserverruntime |
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
81
开发活跃度
77良好
评分方式
| 36/36 | 推送新近度 — 最近一次推送于 5 天前 |
| 13.2/36 | 提交节奏 — 52 周中有 19 周有提交 |
| 18/18 | 提交量 — 最近一年 118 次提交 |
| 10/10 | OpenSSF Scorecard：Maintained — 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 |
所用输入
| commits_last_year | 118 |
| human_commit_share | 1 |
| days_since_last_push | 5 |
| active_weeks_last_year | 19 |
发布纪律
88优秀
评分方式
| 16.2/27 | 有发布版本 — 98 个版本标签（无 GitHub 发布版本） |
| 36/36 | 发布时效 — 最近一次发布版本于 5 天前 |
| 27/27 | 发布节奏 — 约每 0.7 天发布一次 |
| 0/10 | OpenSSF Scorecard：Signed-Releases — 无数据 |
所用输入
| releases_count | 98 |
| latest_release_tag | v0.1.97 |
| releases_from_tags | 是 |
| days_since_latest_release | 5 |
| mean_days_between_releases | 0.7 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Signed-Releases。 其余权重已重新归一化。
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
24
流行度与采用
1危急
评分方式
| 0/60 | 星标 — 0 个星标 |
| 0/25 | 复刻 — 0 个复刻 |
| 0/15 | 关注者 — 0 位关注者 |
所用输入
| forks | 0 |
| stars | 0 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
25危急
评分方式
| 22.5/22.5 | README |
| 0/22.5 | 许可证 — 未检测到许可证文件 |
| 0/18 | CONTRIBUTING 指南 |
| 0/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 0/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 否 |
| has_contributing | 否 |
| has_issue_template | 否 |
| has_code_of_conduct | 否 |
| has_pull_request_template | 否 |
生态采用（下载量）
61中等
评分方式
| 48.5/80 | 月度下载量 — npm 合计每月 4,376 次下载 |
| 0/20 | 注册表被依赖数 — 该生态系统不报告此项 |
所用输入
| packages | @ivan-pasco/clean-node-server |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 4,376 |
已排除计分（无数据或不适用）：注册表被依赖数。 其余权重已重新归一化。
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
31
维护者韧性（巴士系数）
10危急
评分方式
| 9/54 | 巴士系数 — 1 位贡献者贡献了半数提交 |
| 0/22.5 | 提交分布 — 头号贡献者编写了 100% 的提交 |
| 1.4/13.5 | 贡献者广度 — 1 位贡献者 |
| 0/10 | OpenSSF Scorecard：Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
所用输入
| bus_factor | 1 |
| contributors_sampled | 1 |
| top_contributor_share | 1 |
议题与 PR 响应能力
1危急
评分方式
| 0/46.8 | 议题解决 — 0% 的议题已关闭 |
| 0/38.3 | PR 接受 — 没有已裁定的拉取请求或无数据 |
| 0/15 | OpenSSF Scorecard：Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
所用输入
| merged_prs | 0 |
| open_issues | 1 |
| closed_issues | 0 |
| issue_closed_ratio | 0 |
| closed_unmerged_prs | 0 |
已排除计分（无数据或不适用）：PR 接受。 其余权重已重新归一化。
所有权与托管责任
32存在风险
评分方式
| 10/30 | 所有权背书 — 个人（用户）账户 |
| 0/20 | 已验证域名 — 不适用于个人账户 |
| 2.2/25 | 所有者影响力 — Ivan-Pasco 有 1 位关注者 |
| 13.8/25 | 既往记录 — 10 个公开仓库，账户约 3 年 |
所用输入
| followers | 1 |
| owner_type | User |
| is_verified | — |
| owner_login | Ivan-Pasco |
| public_repos | 10 |
| account_age_days | 1,127 |
已排除计分（无数据或不适用）：已验证域名。 其余权重已重新归一化。
软件包维护
100优秀
评分方式
| 25/25 | 已发布且可解析 — npm 上有 1 个软件包 |
| 35/35 | 发布时效 — 最近一次发布于 5 天前 |
| 20/20 | 版本历史 — 93 个已发布版本 |
| 20/20 | 未被弃用 — 活跃，未被弃用或撤回 |
所用输入
| packages | @ivan-pasco/clean-node-server |
| ecosystems | npm |
| any_deprecated | 否 |
| min_days_since_publish | 5 |
工程质量
基础的工程与文档实践是否到位？
66
工程实践
60中等
评分方式
| 24/24 | CI 工作流 — 3 个工作流 |
| 24/24 | 存在测试 |
| 0/16 | Linter 配置 |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard：CI-Tests — 无数据 |
所用输入
| has_ci | 是 |
| has_tests | 是 |
| has_editorconfig | 否 |
| has_linter_config | 否 |
| has_precommit_config | 否 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：CI-Tests。 其余权重已重新归一化。
文档
75良好
评分方式
| 30/30 | README |
| 25/25 | 文档目录 |
| 0/15 | 文档 / 主页站点 |
| 10/10 | 仓库描述 |
| 0/10 | 主题标签 |
| 10/10 | Wiki |
所用输入
| topics | — |
| has_wiki | 是 |
| homepage | — |
| has_readme | 是 |
| has_docs_dir | 是 |
| has_description | 是 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
37
安全态势
37存在风险
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — 无数据 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 0/2.5 | 许可证 — license file not detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 |
| 5/5 | Packaging — packaging workflow detected |
| 2/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 4 |
| 0/5 | SAST — no SAST tool detected |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — 无数据 |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 3/7.5 | Vulnerabilities — 6 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 3.7 |
已排除计分（无数据或不适用）：ci_tests, signed_releases。 其余权重已重新归一化。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
62
AI 代理上下文与指引
85优秀
评分方式
| 45/45 | 代理指令 — CLAUDE.md |
| 0/15 | 机器可读文档（llms.txt） |
| 40/40 | 可读的提交历史 — 100 次人类提交中有 100 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 1 |
| agent_instruction_files | CLAUDE.md |
| agent_instruction_max_bytes | 5,920 |
验证循环（构建 / 测试 / 类型检查）
47存在风险
评分方式
| 0/18 | 一条命令的引导启动 |
| 22/22 | 自动化测试 |
| 0/11 | Lint / 格式化配置 |
| 11/11 | 静态类型检查 — tsconfig.json |
| 10/10 | 可复现环境 — lockfile |
| 0/10 | 已体现的代理实践 — 最近 100 次提交中没有代理编写的提交 |
| 0/8 | 自动化维护 — 未观察到自动依赖更新 |
| 4/10 | OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 4 |
所用输入
| has_nix | 否 |
| has_tests | 是 |
| lockfiles | package-lock.json |
| has_dockerfile | 否 |
| typed_language | 是 |
| bootstrap_files | — |
| has_devcontainer | 否 |
| has_linter_config | 否 |
| typecheck_configs | tsconfig.json |
| agent_commit_share | 0 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
面向模型的代码可读性
100优秀
评分方式
| 45/45 | 可类型检查的代码 — TypeScript（静态类型） |
| 55/55 | 可控的文件大小 — 采样的 122 个源文件中有 0 个超过 60KB |
所用输入
| primary_language | TypeScript |
| largest_source_bytes | 31,875 |
| source_files_sampled | 122 |
| oversized_source_files | 0 |
机器可读接口
20危急
评分方式
| 0/40 | API 模式（OpenAPI/GraphQL/proto） |
| 20/20 | MCP 服务器 |
| 0/40 | 可运行示例 |
所用输入
| example_dirs | — |
| has_mcp_signal | 是 |
| api_schema_files | — |
关键数据
0GitHub 星标
1贡献者
118最近 12 个月提交数
5距最近推送天数
98发布版本数
1巴士系数（bus factor）
1开放议题
npm软件包生态系统数
数据采集警告
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
- deps.dev does not index npm:@ivan-pasco/clean-node-server@0.1.97; advisories assessed against the repository dependency graph instead
更多细节
OpenSSF Scorecard 3.7 / 10
3.7综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 不适用 | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 0 | License | license file not detected |
| 10 | Maintained | 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 |
| 10 | Packaging | packaging workflow detected |
| 4 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 4 |
| 0 | SAST | no SAST tool detected |
| 0 | Security-Policy | security policy file not detected |
| 不适用 | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 4 | Vulnerabilities | 6 existing vulnerabilities detected |
直接依赖 16
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| npm | bcryptjs | ^2.4.3 | package.json |
| npm | better-sqlite3 | ^11.0.0 | package.json |
| npm | commander | ^12.0.0 | package.json |
| npm | compression | ^1.8.1 | package.json |
| npm | cookie-parser | ^1.4.6 | package.json |
| npm | cors | ^2.8.6 | package.json |
| npm | express | ^4.18.2 | package.json |
| npm | express-rate-limit | ^8.4.1 | package.json |
| npm | ioredis | ^5.10.1 | package.json |
| npm | jsonwebtoken | ^9.0.2 | package.json |
| npm | mysql2 | ^3.9.0 | package.json |
| npm | nodemailer | ^8.0.10 | package.json |
| npm | pg | ^8.11.3 | package.json |
| npm | pino | ^10.3.1 | package.json |
| npm | pino-http | ^11.0.0 | package.json |
| npm | prom-client | ^15.1.3 | package.json |
全部依赖 未采集
本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 597,
"has_wiki": true,
"homepage": null,
"languages": {
"Shell": 1668,
"JavaScript": 47421,
"TypeScript": 984795
},
"pushed_at": "2026-07-18T11:44:39Z",
"created_at": "2026-01-25T01:01:30Z",
"owner_type": "User",
"updated_at": "2026-07-18T11:44:30Z",
"description": "Clean Language Framework (Frame) for Node.js Server",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "main",
"license_spdx_raw": null,
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": null,
"name": null,
"type": "User",
"login": "Ivan-Pasco",
"company": null,
"location": null,
"followers": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/137369164?v=4",
"created_at": "2023-06-22T03:23:49Z",
"is_verified": null,
"public_repos": 10,
"account_age_days": 1127
},
"license": {
"state": "absent",
"spdx_id": null,
"raw_spdx": null,
"file_present": false,
"scorecard_found": false,
"profile_has_license": false
},
"activity": {
"releases": [
{
"tag": "v0.1.97",
"kind": "patch",
"published_at": "2026-07-18T11:44:03Z"
},
{
"tag": "v0.1.96",
"kind": "patch",
"published_at": "2026-07-17T12:35:05Z"
},
{
"tag": "v0.1.95",
"kind": "patch",
"published_at": "2026-07-14T22:31:56Z"
},
{
"tag": "v0.1.94",
"kind": "patch",
"published_at": "2026-07-14T06:19:05Z"
},
{
"tag": "v0.1.93",
"kind": "patch",
"published_at": "2026-07-13T20:07:34Z"
},
{
"tag": "v0.1.92",
"kind": "patch",
"published_at": "2026-07-12T15:01:04Z"
},
{
"tag": "v0.1.91",
"kind": "patch",
"published_at": "2026-07-12T14:58:38Z"
},
{
"tag": "v0.1.90",
"kind": "patch",
"published_at": "2026-07-12T14:17:45Z"
},
{
"tag": "v0.1.89",
"kind": "patch",
"published_at": "2026-07-12T05:43:30Z"
},
{
"tag": "v0.1.88",
"kind": "patch",
"published_at": "2026-07-12T05:23:54Z"
},
{
"tag": "v0.1.87",
"kind": "patch",
"published_at": "2026-07-11T16:16:43Z"
},
{
"tag": "v0.1.86",
"kind": "patch",
"published_at": "2026-07-11T15:45:29Z"
},
{
"tag": "v0.1.85",
"kind": "patch",
"published_at": "2026-07-09T00:26:34Z"
},
{
"tag": "v0.1.84",
"kind": "patch",
"published_at": "2026-07-09T00:10:39Z"
},
{
"tag": "v0.1.83",
"kind": "patch",
"published_at": "2026-07-08T20:44:52Z"
},
{
"tag": "v0.1.82",
"kind": "patch",
"published_at": "2026-07-08T18:13:42Z"
},
{
"tag": "v0.1.81",
"kind": "patch",
"published_at": "2026-07-08T15:34:21Z"
},
{
"tag": "v0.1.80",
"kind": "patch",
"published_at": "2026-07-07T02:07:36Z"
},
{
"tag": "v0.1.79",
"kind": "patch",
"published_at": "2026-07-06T14:56:23Z"
},
{
"tag": "v0.1.78",
"kind": "patch",
"published_at": "2026-07-06T14:53:14Z"
},
{
"tag": "v0.1.77",
"kind": "patch",
"published_at": "2026-07-06T14:41:57Z"
},
{
"tag": "v0.1.76",
"kind": "patch",
"published_at": "2026-06-29T20:50:53Z"
},
{
"tag": "v0.1.75",
"kind": "patch",
"published_at": "2026-06-29T20:46:41Z"
},
{
"tag": "v0.1.74",
"kind": "patch",
"published_at": "2026-06-29T20:43:25Z"
},
{
"tag": "v0.1.73",
"kind": "patch",
"published_at": "2026-06-26T14:46:07Z"
},
{
"tag": "v0.1.72",
"kind": "patch",
"published_at": "2026-06-23T13:53:34Z"
},
{
"tag": "v0.1.71",
"kind": "patch",
"published_at": "2026-06-23T06:07:01Z"
},
{
"tag": "v0.1.70",
"kind": "patch",
"published_at": "2026-06-23T05:45:48Z"
},
{
"tag": "v0.1.69",
"kind": "patch",
"published_at": "2026-06-22T06:11:59Z"
},
{
"tag": "v0.1.68",
"kind": "patch",
"published_at": "2026-06-21T00:31:09Z"
},
{
"tag": "v0.1.67",
"kind": "patch",
"published_at": "2026-06-20T14:31:35Z"
},
{
"tag": "v0.1.66",
"kind": "patch",
"published_at": "2026-06-20T13:53:59Z"
},
{
"tag": "v0.1.65",
"kind": "patch",
"published_at": "2026-06-20T03:23:38Z"
},
{
"tag": "v0.1.64",
"kind": "patch",
"published_at": "2026-06-19T23:51:05Z"
},
{
"tag": "v0.1.63",
"kind": "patch",
"published_at": "2026-06-19T19:58:29Z"
},
{
"tag": "v0.1.62",
"kind": "patch",
"published_at": "2026-06-19T17:33:45Z"
},
{
"tag": "v0.1.61",
"kind": "patch",
"published_at": "2026-06-19T16:08:00Z"
},
{
"tag": "v0.1.60",
"kind": "patch",
"published_at": "2026-06-19T13:50:11Z"
},
{
"tag": "v0.1.59",
"kind": "patch",
"published_at": "2026-06-19T12:56:24Z"
},
{
"tag": "v0.1.58",
"kind": "patch",
"published_at": "2026-06-19T06:01:39Z"
},
{
"tag": "v0.1.57",
"kind": "patch",
"published_at": "2026-06-19T01:57:48Z"
},
{
"tag": "v0.1.56",
"kind": "patch",
"published_at": "2026-06-18T16:53:56Z"
},
{
"tag": "v0.1.55",
"kind": "patch",
"published_at": "2026-06-18T03:35:59Z"
},
{
"tag": "v0.1.54",
"kind": "patch",
"published_at": "2026-06-18T02:28:23Z"
},
{
"tag": "v0.1.53",
"kind": "patch",
"published_at": "2026-06-18T00:49:02Z"
},
{
"tag": "v0.1.52",
"kind": "patch",
"published_at": "2026-06-16T15:28:33Z"
},
{
"tag": "v0.1.51",
"kind": "patch",
"published_at": "2026-06-16T15:09:51Z"
},
{
"tag": "v0.1.50",
"kind": "patch",
"published_at": "2026-06-16T05:40:17Z"
},
{
"tag": "v0.1.49",
"kind": "patch",
"published_at": "2026-06-16T04:24:30Z"
},
{
"tag": "v0.1.48",
"kind": "patch",
"published_at": "2026-06-16T04:14:32Z"
},
{
"tag": "v0.1.47",
"kind": "patch",
"published_at": "2026-06-16T02:16:28Z"
},
{
"tag": "v0.1.46",
"kind": "patch",
"published_at": "2026-06-16T00:30:38Z"
},
{
"tag": "v0.1.45",
"kind": "patch",
"published_at": "2026-06-13T04:00:35Z"
},
{
"tag": "v0.1.44",
"kind": "patch",
"published_at": "2026-06-10T19:41:07Z"
},
{
"tag": "v0.1.43",
"kind": "patch",
"published_at": "2026-06-05T13:05:19Z"
},
{
"tag": "v0.1.42",
"kind": "patch",
"published_at": "2026-06-04T06:40:31Z"
},
{
"tag": "v0.1.41",
"kind": "patch",
"published_at": "2026-06-03T05:13:31Z"
},
{
"tag": "v0.1.40",
"kind": "patch",
"published_at": "2026-06-02T15:37:53Z"
},
{
"tag": "v0.1.39",
"kind": "patch",
"published_at": "2026-06-02T04:36:46Z"
},
{
"tag": "v0.1.38",
"kind": "patch",
"published_at": "2026-06-01T01:10:31Z"
},
{
"tag": "v0.1.37",
"kind": "patch",
"published_at": "2026-06-01T01:08:38Z"
},
{
"tag": "v0.1.36",
"kind": "patch",
"published_at": "2026-05-28T03:59:09Z"
},
{
"tag": "v0.1.35",
"kind": "patch",
"published_at": "2026-05-24T02:08:07Z"
},
{
"tag": "v0.1.34",
"kind": "patch",
"published_at": "2026-05-23T20:24:28Z"
},
{
"tag": "v0.1.33",
"kind": "patch",
"published_at": "2026-05-22T02:00:47Z"
},
{
"tag": "v0.1.32",
"kind": "patch",
"published_at": "2026-05-21T15:05:57Z"
},
{
"tag": "v0.1.31",
"kind": "patch",
"published_at": "2026-05-20T21:33:14Z"
},
{
"tag": "v0.1.30",
"kind": "patch",
"published_at": "2026-05-20T03:45:37Z"
},
{
"tag": "v0.1.29",
"kind": "patch",
"published_at": "2026-05-19T06:05:41Z"
},
{
"tag": "v0.1.28",
"kind": "patch",
"published_at": "2026-05-18T16:13:06Z"
},
{
"tag": "v0.1.27",
"kind": "patch",
"published_at": "2026-05-18T16:11:29Z"
},
{
"tag": "v0.1.26",
"kind": "patch",
"published_at": "2026-05-18T05:11:27Z"
},
{
"tag": "v0.1.25",
"kind": "patch",
"published_at": "2026-05-18T04:32:03Z"
},
{
"tag": "v0.1.24",
"kind": "patch",
"published_at": "2026-05-18T01:58:50Z"
},
{
"tag": "v0.1.23",
"kind": "patch",
"published_at": "2026-05-18T01:54:39Z"
},
{
"tag": "v0.1.22",
"kind": "patch",
"published_at": "2026-05-18T01:31:01Z"
},
{
"tag": "v0.1.21",
"kind": "patch",
"published_at": "2026-05-18T01:08:36Z"
},
{
"tag": "v0.1.20",
"kind": "patch",
"published_at": "2026-05-18T00:43:58Z"
},
{
"tag": "v0.1.19",
"kind": "patch",
"published_at": "2026-05-17T23:43:38Z"
},
{
"tag": "v0.1.18",
"kind": "patch",
"published_at": "2026-05-16T22:07:08Z"
},
{
"tag": "v0.1.17",
"kind": "patch",
"published_at": "2026-05-16T19:58:01Z"
},
{
"tag": "v0.1.16",
"kind": "patch",
"published_at": "2026-05-16T17:47:12Z"
},
{
"tag": "v0.1.15",
"kind": "patch",
"published_at": "2026-05-16T15:27:11Z"
},
{
"tag": "v0.1.14",
"kind": "patch",
"published_at": "2026-05-16T15:02:06Z"
},
{
"tag": "v0.1.13",
"kind": "patch",
"published_at": "2026-05-16T14:56:46Z"
},
{
"tag": "v0.1.12",
"kind": "patch",
"published_at": "2026-05-16T14:51:31Z"
},
{
"tag": "v0.1.11",
"kind": "patch",
"published_at": "2026-05-16T14:38:54Z"
},
{
"tag": "v0.1.10",
"kind": "patch",
"published_at": "2026-05-12T02:10:09Z"
},
{
"tag": "v0.1.9",
"kind": "patch",
"published_at": "2026-05-03T04:25:29Z"
},
{
"tag": "v0.1.8",
"kind": "patch",
"published_at": "2026-04-17T01:26:02Z"
},
{
"tag": "v0.1.7",
"kind": "patch",
"published_at": "2026-04-01T06:30:32Z"
},
{
"tag": "v0.1.6",
"kind": "patch",
"published_at": "2026-03-23T17:03:16Z"
},
{
"tag": "v0.1.5",
"kind": "patch",
"published_at": "2026-02-14T15:05:56Z"
},
{
"tag": "v0.1.4",
"kind": "patch",
"published_at": "2026-01-26T16:59:00Z"
},
{
"tag": "v0.1.3",
"kind": "patch",
"published_at": "2026-01-26T14:56:08Z"
},
{
"tag": "v0.1.2",
"kind": "patch",
"published_at": "2026-01-25T01:42:05Z"
},
{
"tag": "v0.1.1",
"kind": "patch",
"published_at": "2026-01-25T01:16:18Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-01-25T01:00:01Z"
}
],
"recent_commits": [
{
"oid": "a4a5d694ff85b427b8dfa34d671e78ac6cbf45dd",
"body": "…t body\n\nAdds the Option B convenience bridge requested by prompt 752c552c\n(tarball-upload integrity check). Returns lowercase-hex SHA-256 of the\npre-parse request body as an LP-string, so a handler can compare against\na client-supplied X-Tarball-SHA256 without materializing the body in\nlinear memor\n[…]\n.\n\nContract tests: 7 cases covering binary payloads (null bytes, 0xFF,\ntar.gz-shaped), the empty-body baseline, UTF-8 text fallback (including\nmulti-byte / emoji), and additivity with _req_body_bytes.",
"is_bot": false,
"headline": "feat(bridge): _req_body_sha256_hex — one-shot SHA-256 over raw reques…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-18T11:44:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b0553773a2ee4e6c2dd193b328bab7ed57237913",
"body": "…utation detection\n\nInstruments repro_http_request.mjs with a heap-forensics probe requested by\nthe compiler team for bug #eed00ffee567 (STATE A truncation V2) attribution.\nTwo flags: --probe-heap enables the probe; --probe-fn <name> adds any custom\nexport (e.g. build_rows) to the wrap set.\n\nWhat it\n[…]\nring_builder_finalize get overwritten by any subsequent import\n (bridge) call, attributing the mutation to the specific bridge.\n\nBaseline unchanged — no flag, no wrapping. Resolves prompt 41e44fdf.",
"is_bot": false,
"headline": "tools(repro): --probe-heap for __heap_ptr rewind + finalize-content m…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-18T11:27:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "88064cc93d8273e59ae8d617a14de75df52fcf08",
"body": "- Move docs/functions-reference.md → spec/ (formal function reference table)\n- Delete system-documents/test-strategy.md (session debris)\n\ndocs/ retains 6 human-readable guides (getting-started, authentication,\ndatabase, files, http-client, http-server). No principal\nNode Server Specification.md yet — README.md serves as introduction.\n\nPart of monorepo-wide docs restructuring.",
"is_bot": false,
"headline": "docs: adopt docs/ + spec/ two-folder structure",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-18T05:28:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5480fe5dfae20dfda6c2e781d5a923bcfb21d6e6",
"body": "Adds Layer 3 dev-mode capture bridge (`_dev_snapshot`) plus request/log\nring buffers scoped to each request worker. Gated on CLEAN_DEV=1; returns\nan empty LP string in production. Log interceptor is idempotent and no-op\nwhen the gate is closed. Full test parity with the Rust host at 36 tests\n(tests/\n[…]\n Acceptable under the\ndev-mode-is-single-user assumption; cross-worker fidelity via main-thread\nRPC is a follow-up if that assumption changes.\n\nHost-parity check (`--host node-server --strict`) clean.",
"is_bot": false,
"headline": "feat(bridge): _dev_snapshot — worker-local dev-mode capture ring buffers",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-17T12:35:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "da4361f2c807f5cf1544984ac3981c05995c7145",
"body": "Implements the middle of the binary-safe triad\n _req_body_bytes → _crypto_sha256_bytes → _fs_write_bytes\nso uploads (tarballs, images, arbitrary octets) can be hashed on the\nNode runtime without a UTF-8 decode detour.\n\n- New src/bridge/crypto-sha256-bytes.ts. Handle layout is identical to\n _req_bo\n[…]\n)\n payloads, gzip-like binary payloads, and output format\n (64 lowercase hex chars).\n- Matches function-registry.toml entry _crypto_sha256_bytes shipped in\n the compiler release preceding this one.",
"is_bot": false,
"headline": "feat(bridge): _crypto_sha256_bytes — binary-safe SHA-256 over LP handle",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-14T22:31:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4eea40e70cda66b6e3e7f835c3beb6413f30ea5e",
"body": "Adds two additive bridges to un-stub the errors dashboard's tarball-upload\nendpoint on the Node runtime.\n\n_req_body_bytes: raw request body as an opaque byte sequence. Registers\nexpress.raw for application/octet-stream so binary payloads arrive as a\nBuffer instead of a UTF-8-decoded string. Returns \n[…]\ngic), the 0/1/3/4\nreturn-code taxonomy, allowlist enforcement, atomic-rename with no .tmp\nresidue, overwrite semantics, and Content-Length parity. Host parity check\nnow exits 0 for --host node-server.",
"is_bot": false,
"headline": "feat(bridge): binary-safe request body and atomic byte writes",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-14T06:19:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "dac0372b86eadec45489638acd3d85aef939f4ac",
"body": "…nner\n\nSingle-process runner that instantiates a compiled WASM against the real\ncompiled bridge (dist/), sets a fake RequestContext, invokes a named\nroute handler export, and prints response bytes to stdout with forensic\ncontext (result_ptr, LP-prefix length, byte/char counts) on stderr.\n\nPurpose: g\n[…]\nspatch path. Supports\n--dump-memory <off>[:<len>], --dump-hex-output, --wat-out, --json-output\nfor aliasing / truncation forensics.\n\nFirst consumer: compiler bug #eed00ffee567 (STATE A truncation V2).",
"is_bot": false,
"headline": "tools(repro): add repro_http_request.mjs — standalone HTTP handler ru…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-13T20:07:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9d3f2a2366182c875ad930c82817a32c6aea5776",
"body": "…ot cause is compiler-side (CODEGEN-UNBOX-TO-I32-MISSING-STRING-TAG-CASE)\n\nPins 4 invariants at the node-server bridge boundary against the\n+320-stride pointer-shaped-integer symptom the reporter of\n#61ef80a34ec6 (BRIDGE-JSON-GET-INTEGER-RETURNS-POINTER-AGGREGATE-QUERY)\nattributed to a 'stale box sl\n[…]\nEN-UNBOX-TO-I32-MISSING-STRING-TAG-CASE (#0ccc47714523,\ncomponent=compiler). This test guards the bridge invariants so that a\nfuture regression at THIS layer surfaces separately from the compiler bug.",
"is_bot": false,
"headline": "test(bridge): regression pin for aggregate json.get + .toInteger — ro…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-13T04:56:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a115f34aabfa24f57aa256d57b99bffc1ac76fac",
"body": "Adds push tag 'v*' as a trigger now that the workflow_dispatch dry run\nis green. Every tagged release must pass all open reporter-artifact\nreplays before shipping.",
"is_bot": false,
"headline": "ci(reporter-artifacts): enable release-tag trigger",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-13T01:36:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "259679b5a1410453e694866d3baedfd2cb8d2de3",
"body": "Runs every open reporter-artifact issue's replay tarball against this\ncheckout's built node-server. Manual-dispatch only for initial rollout;\nrelease-tag trigger will be added after first green run.\n\nInstalls cln + this checkout's clean-node-server build globally so\ntarballs invoke the local build via PATH.",
"is_bot": false,
"headline": "ci: add reporter-artifacts replay workflow (closed-loop bug workflow)",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-13T01:34:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eeca6ddc09739bd1a8f46ceb145879ca56b6fb50",
"body": "Adds .nvmrc → 20. Contributors with nvm auto-switch to Node 20 on `cd`\ninto the repo (or `nvm use`), matching CI (Node 20 in publish.yml) and\nthe >=18 requirement declared in package.json engines. Also unblocks\nthe pre-push hook on machines whose system Node predates vitest 2's\nminimum.\n\nRegenerates\n[…]\nson — the previous lockfile was written by an\nold npm and still claimed version 0.1.53. Re-locked under npm 10 on Node\n20 so `npm ci` in CI stays consistent with what a fresh install produces\nlocally.",
"is_bot": false,
"headline": "build: pin Node 20 via .nvmrc; refresh lockfile",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-12T15:55:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4d23e65577583b5c8511ecf9a0ee63df57259020",
"body": "The previous injectArray helper walked the store to find the next handle\nabove the highest injected key, but that did not advance the module's\ninternal nextHandle counter. As a result, after\n resetArrayStore() // nextHandle = 1\n injectArray([...]) // store[1] set, nextHandle still 1\n bridge.arr\n[…]\nnextHandle keeps counting from 1 for\nstoreArray-minted handles, and never collides with the injected range in\nany realistic test.\n\nNo source changes — the bridge is correct; the test helper was wrong.",
"is_bot": false,
"headline": "test(bridge): array-bridge injectArray helper uses high handle range",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-12T15:01:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ce1ac734772cbc3e9abcc9718d1dd95037e57c4d",
"body": "…w bridge tests\n\nAdds a comprehensive test strategy with five tiers (policy, unit, contract,\nintegration, canary) enforced by git hooks and CI:\n\n - scripts/check-test-policy.mjs (Tier 0): blocks skipped tests without\n a `// policy-allow-skip: <reason>` justification, placeholder markers,\n emp\n[…]\ncomment.\n\nThe --no-verify used here is bootstrap-only: the pre-commit hook it\ninstalls cannot run against itself before it exists, and vitest 2 cannot\nboot on this machine's Node 16 (CI runs Node 20).",
"is_bot": false,
"headline": "test(strategy): tiered test suite with policy guard, hooks, and 12 ne…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-12T14:58:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "68743811f74659b7a40c5fb6759e91f354e6557e",
"body": "…alues — resolves RUNTIME-INT-VALUES-ARE-POINTERS-STATS-STRIP\n\nAdds an end-to-end regression pinning the reporter's flow: repeated\ndb.query→_json_get→numeric-string leaf must yield the exact digits, not\n+320-stride pointer-shaped values. Complements the existing hand-rolled\nJSON case in tests/json-g\n[…]\npath a compiler-emitted handler takes.\n\nThe underlying fix (BRIDGE-JSON-GET-INTEGER-RETURNS-POINTER, commit\nb14f101 in v0.1.88) already addresses the root cause — this test\nprevents silent regression.",
"is_bot": false,
"headline": "test(bridge): pin db.query→json.get→numeric leaf against ptr-shaped v…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-12T14:17:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9f61d33def7afe06340a2fa3ad2264b74297913c",
"body": "… resolves NODE-SERVER-UI-RENDER-PAGE-NO-SUBSTITUTION\n\nAlign _ui_render_page with HOST_BRIDGE.md line 419 spec and frame.ui plugin\nconvention (v3.2.7). Templates use { key } single-brace substitution with\nwhitespace tolerance and dotted paths; {{ and }} emit literal { and }.\n\nPrevious implementation\n[…]\n { item.field } placeholders per-iteration before the\nglobal pass. Key validity is restricted to identifier / dotted-path form,\nso CSS bodies and JSON literals containing { } are left as literal text.",
"is_bot": false,
"headline": "fix(bridge): _ui_render_page uses single-brace { key } substitution —…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-12T05:43:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b14f1018dc4e4d5de4cc7123e8cc0ff88df1b4ee",
"body": "…GE-JSON-GET-INTEGER-RETURNS-POINTER\n\nCompiler 0.33.55 + frame.server 2.8.4 declared _json_get with\nparams=['any','string'], returns='any', expand_strings=false. The bridge\nkept the old 4-arg (jsonPtr,jsonLen,pathPtr,pathLen) shape and returned\na raw LP-string pointer, so the compiler's emit_unbox_a\n[…]\n Migrated the\nthree existing test files that were exercising the old 4-arg ABI to\nthe new signature — they now box the JSON input and unbox the result\nthe same way the compiler does at each call site.",
"is_bot": false,
"headline": "fix(bridge): _json_get switches to any-in/any-out ABI — resolves BRID…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-12T05:23:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "eaef219ad135be395e68afc724b48722b87daca7",
"body": "…-SERVER-BRIDGE-OOB-TASKS-FILTER\n\nfoundation/platform-architecture/function-registry.toml declares mem_scope_push\nand mem_scope_pop as \"no-op currently\" for every host, and clean-server's Rust\nbridge treats them that way. This bridge previously called the WASM-side\nscope_pop export on every internal\n[…]\nrn from\nthe bug survives an internal pop. All 383 vitest tests pass; 14/15 canaries\npass (http_client canary DIFF is a separate compiler-side canary bug).\n\nFix commit for fingerprint 654ef241296a631e.",
"is_bot": false,
"headline": "fix(bridge): make mem_scope_pop a no-op for WASM heap — resolves NODE…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-11T16:16:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e6cb315f90d1bff73ea55e3029947d370fee5289",
"body": "Pins the db.query + json.get + string.concat pattern reported as trapping\n\"memory access out of bounds\" on node-server 0.1.85. Cannot reproduce\nend-to-end against clean-errors/dist/errors.wasm today (20x sequential +\n10x concurrent /tasks?origin=error return HTTP 200) — likely already\nfixed by compi\n[…]\nesses:\n- Sequential _db_query responses don't overlap\n- Driver errors surface as parsable {ok:false} envelopes (not raw bytes)\n- _json_get chain preserves LP-string integrity under a healthy allocator",
"is_bot": false,
"headline": "test(bridge): regression harness for NODE-SERVER-BRIDGE-OOB-TASKS-FILTER",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-11T15:45:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "81bb3345ebcf752e205575403ac38a661b500916",
"body": "_time_now now returns BigInt(unixSeconds) per foundation/platform-architecture\n/function-registry.toml — the registry declares it as `returns = \"i64\"` and\nNode's WebAssembly bindings require host functions bound to i64 result to\nreturn a BigInt. Previously node-server returned a heap pointer to a JS\n[…]\nal host runs with\n`--sandbox /tmp` for a file-heavy workload. Fixes the file canary DIFF\nwhere writes to /tmp/clean_canary_file.txt were rejected as\noutside-sandbox and the round-trip silently failed.",
"is_bot": false,
"headline": "fix(bridge): correct _time_now signature + canary driver sandbox root",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-09T00:26:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2224fba849fd124e0147e7d051df98b7815ec2e0",
"body": "Implements the node-server child of the Cross-Component Contract\nCanaries umbrella (prompt 6ace888b-7a8d-11f1-9586-da25a95a496b,\numbrella 7fb425cb-79ba-11f1-9586-da25a95a496b).\n\nscripts/run_canaries.mjs discovers the compiler's canary corpus,\nfilters out browser-only namespaces, compiles each canary\n[…]\ns (env/file/http_client diffs, time trap). The time trap\n(_time_* i64/BigInt signature drift) is filed as\nNODE-SERVER-TIME-I64-BIGINT. The other three DIFFs need follow-up\ninvestigation before filing.",
"is_bot": false,
"headline": "feat(canaries): add Layer-2 nightly canary runner",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-09T00:10:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "680d2b32b3f55d0f4550faba5b4de80f9203091f",
"body": "…SERVER-CGROUP-THROTTLE-WEDGE)\n\nWorker rotation was gated only on `readHeapPtr() - initialHeapPtr > 50MB`.\nscope_pop rewinds `__heap_ptr` but WASM `memory.grow()` is permanent — a\nsingle request that momentarily needed 60MB permanently extended\n`memory.buffer.byteLength`, but the rotation check saw \n[…]\n recycling.\n\nComplements the --memory-soft-limit mitigation shipped in 0.1.81: that\nprevents an unrecoverable wedge if the leak still happens, this stops the\nleak from accumulating in the first place.",
"is_bot": false,
"headline": "fix(pool): rotate on memory.buffer growth, not just __heap_ptr (NODE-…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-08T20:44:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "01f6ba6a544f4b23ac9ac3d925c4d705359e7861",
"body": "Adds Cross-component prompts section to CLAUDE.md (mirrors the wording\nalready in the project-root CLAUDE.md) and allows a few read-only bash\npatterns previously prompted for.",
"is_bot": false,
"headline": "chore: document team-prompt skills and expand bash allowlist",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-08T18:13:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "73ff058b9b5572e983a996a72cea6881291d2a28",
"body": "Implements FRAME-AUTH-REFRESH-TOKEN-NO-ROTATION and\nFRAME-AUTH-RESET-TOKEN-BRIDGES-MISSING per function-registry.toml:\n\n- _jwt_refresh_and_rotate: verify + atomically consume a refresh token's\n jti and return a freshly-signed token (AUTH-J007 / AUTH-J009 single-use\n rotation). Rejects replays, tok\n[…]\n-present in one\n event-loop tick). Expired entries return 0 and are swept lazily.\n\nBoth stores expose reset* test helpers; 9 unit tests cover round-trip,\nreplay rejection, expiry, and invalid inputs.",
"is_bot": false,
"headline": "feat(bridge): add _jwt_refresh_and_rotate + _auth_reset_token bridges",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-08T18:13:02Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "5e2a68507706c085c9bd651f59e2c9649c0a7911",
"body": "… cgroup wedge\n\nUnder a systemd unit with MemoryMax, once RSS hits the ceiling the process gets\npinned in kernel mem_cgroup_handle_over_high (uninterruptible sleep) on the\nnext allocation. The listening socket stops responding and only SIGKILL clears\nit — Restart=always cannot rescue a D-state task \n[…]\nrprint\nf65b346bb0c4efcf02c43d4668f6f17031e7610cdb5b1e3b7c498aa70c7446f1). This is\na mitigation, not a leak fix — the underlying host-bridge scope tracking\n(part 2 of the suggested fix) is a follow-up.",
"is_bot": false,
"headline": "feat(cli): add --memory-soft-limit for graceful drain-and-exit before…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-08T15:34:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4d9321fe14eca537abf5897d0f7e20fa4571cfc9",
"body": "The ws module was in devDependencies but imported at runtime, so production\ninstalls threw ERR_MODULE_NOT_FOUND from attachWebsocketServer(). Pino's err\nserializer expanded that into a multi-line requireStack trace on every process\nstart, and the rejected import promise held the request-scope closur\n[…]\nered no WS routes — avoids\n loading ws (~1MB heap) for API-only deployments.\n\nPart of NODE-SERVER-CGROUP-THROTTLE-WEDGE (fingerprint\nf65b346bb0c4efcf02c43d4668f6f17031e7610cdb5b1e3b7c498aa70c7446f1).",
"is_bot": false,
"headline": "fix(bridge): make ws an optional dependency and skip attach when unused",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-08T15:33:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c3e74175b73ec723bae727a614dcc9034ca1d82e",
"body": "…ING-READ-OOB-INTERMITTENT)\n\nreadRawString and readLengthPrefixedString now emit console.error with\nptr, len, bufferSize, a hex dump of bytes at ptr, the length reinterpreted\nas 4 little-endian ASCII chars, and a stack trace before throwing.\n\nThe intermittent case observed in production (len=1684632\n[…]\nbleed remain in place\n(scope_push/scope_pop rewind, per-request JS accumulator reset, worker\nrotation on error). This commit closes the diagnostic gap so future\noccurrences are not silent server-side.",
"is_bot": false,
"headline": "fix(bridge): log forensic context on OOB string read (NODE-SERVER-STR…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-07T02:07:36Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7b8e36c18175eca602bcc135ebf2a6a8fe9d6d77",
"body": "The 0.1.78 workflow failed because clean-language-spec has foundation/\nas a subfolder at its root, not the root itself. Full checkout put the\nscript at $WORKSPACE/foundation/foundation/management/scripts/... but\nCLEAN_LANGUAGE_ROOT was set to $WORKSPACE, so the script wasn't found.\n\nFix: sparse-chec\n[…]\ne foundation/ subtree into a staging dir\n(_spec/), then move _spec/foundation to $WORKSPACE/foundation. This\ngives the layout the parity script expects (<root>/foundation/,\n<root>/clean-node-server/).",
"is_bot": false,
"headline": "ci(parity): sparse-checkout foundation subtree from clean-language-spec",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-06T14:56:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cd2413dd46ba08df9b82441e86fbdeb0698e98c4",
"body": "Adds a 'parity' job to the publish workflow that runs\ncheck_host_parity.py --host node-server --strict on every pull request\nand tag push. The job checks out clean-language-spec as a sibling of\nthis repo and points CLEAN_LANGUAGE_ROOT at the workspace so the script\nresolves foundation/ and clean-nod\n[…]\nng no-op stubs; this closes the systemic gap).\n\nVerified locally:\n- baseline parity check: missing 0, exit 0\n- with _arena_scope_push/_pop removed: missing 2, exit 1\n- full test suite: 359/359 passing",
"is_bot": false,
"headline": "ci(parity): enforce host bridge parity against function-registry.toml",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-06T14:53:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a9b9224b9645259bc45b8a65dfded0c0b6b89e7f",
"body": "…E-E001)\n\nCompiler 0.31.5+ (confirmed on 0.33.2) emits env._arena_scope_push\n(() -> i32) and env._arena_scope_pop (i32 -> void) as WASM imports on\nevery module. clean-node-server 0.1.72-0.1.76 shipped without handlers,\ncausing every fresh WASM to fail WebAssembly.instantiate with\n\"function import re\n[…]\n33.2-produced errors.wasm and\nvia a direct WebAssembly.instantiate smoke test — module now loads\nwithout LinkError. Regression test added in\ntests/arena-scope-bridges.test.ts.\n\nBumps 0.1.76 -> 0.1.77.",
"is_bot": false,
"headline": "fix(bridge): add _arena_scope_push/_arena_scope_pop stubs (HOST-BRIDG…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-07-06T14:41:57Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3bf77aa0ca21a378255b80a8d713e272d9cc1403",
"body": "Port clean-server/src/locale.rs to TypeScript. Closes the host-parity gap\nfor the 8 _i18n_* bridge functions previously stubbed to throw at runtime.\n\nThe TypeScript LocaleState mirrors the Rust observable behavior:\n - JSON translation maps flattened to dot-separated keys.\n - BCP-47 fallback chain:\n[…]\n for some locales than the\nRust host. Inline matches Rust output exactly.\n\nCloses the i18n entry on Step 4 of the host-bridge-parity-enforcement\nprompt (was throw-error stub; now real implementation).",
"is_bot": false,
"headline": "feat(bridge): implement frame.locale (i18n) — replace throw-error stubs",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-29T20:50:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2b890e7973a00983972428fd1fe0786e15f58b32",
"body": "Port clean-server's build-manifest reader (Plugin Contracts v2 §5/§8) to\nTypeScript. At startup the server looks for build-manifest.json next to\nthe main WASM. When present, it is the authoritative source for artifact\npaths: the client_hydration artifact (frontend.wasm) is served from the\ndeclared p\n[…]\nrser + path resolver (TS port of build_manifest.rs)\n- src/server.ts: manifest-first frontend.wasm + auto-registered artifact routes\n- tests/build-manifest.test.ts: 11 tests mirroring the Rust test set",
"is_bot": false,
"headline": "feat(server): read build-manifest.json for artifact resolution (SRV004)",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-29T20:46:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "657359ac56473033b00941291313537bab1e87f7",
"body": "The frame.ui plugin removed _ui_inject_head_css entirely (theme values now\nlive in public/css/theme.css and ship via _ui_inject_head_link). Drop the\nhost implementation, the registration, and the state.injectedCss accumulator\n(types, pool, worker, test). See the\nall-remove-ui-inject-head-css-bridge \n[…]\nno longer\nlisted as MISSING (was never MISSING here — the implementation existed; the\nregistry no longer requires it). Remaining MISSING/UNKNOWN counts are\npre-existing drift unrelated to this change.",
"is_bot": false,
"headline": "chore(bridge): remove orphaned _ui_inject_head_css",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-29T20:43:25Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e37f1658efc1869cd40943fe520d3b76b37ce10f",
"body": "… config bridges (BRIDGE_REG_002)\n\nCompiler 0.30.362+ lowers integer:64 .toString() to an env.int64_to_string\nWASM import. Without this bridge function the Node host fails to\ninstantiate any module that uses 64-bit integer toString. Bridge receives\na JS BigInt (Node's surfacing of WASM i64) and uses\n[…]\net_global_error_handler)\npaired with upstream FRAME-SERVER-CONFIG-FIELDS-UNIMPLEMENTED — signatures\nfollow that report's suggested fix and may need adjustment if the\nframework PR picks different ones.",
"is_bot": false,
"headline": "fix(bridge): add int64_to_string + _mcp_http_respond, scaffold server…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-26T14:46:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "52b0ce4ed998a75de1c86cc5ed5e7b8740981d07",
"body": "…-WRAP-INCOMPLETE)\n\nscope_push/scope_pop correctly rewind the WASM bump heap per request, but\nthree bridges keep module-level Maps that grow with every allocation and\nare never reclaimed:\n\n - bridge/list.ts: listStore (handle -> JS array)\n - bridge/array.ts: arrayStore (handle -> JS array)\n - bri\n[…]\nope_pop on both the success and\nerror paths. Safe because scope_pop has already reclaimed the WASM heap\nthe handles pointed into — any caller holding a stale handle is already\nholding a stale pointer.",
"is_bot": false,
"headline": "fix(bridge): release JS-side accumulators per request (NSR-HTTP-SCOPE…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-23T13:53:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b6d9509e968e3659e0a44e3c6d03838b6009c913",
"body": "…ry coverage test\n\nThe compiler stopped emitting dot-notation bridge aliases in v0.30.123\n(see node-server CLAUDE.md \"Bridge Function Naming — Canonical Names Only\").\nThe ui.ts client-stub map kept 58 'ui.X': noop entries from that era,\nshadowed by their canonical _ui_* siblings two sections above. \n[…]\nng=0 unchanged; unknown dropped 209 → 159 (the\nremaining residual is real registry gaps tracked in\nfoundation/management/cross-component-prompts/all-registry-backfill-server-and-builtin-functions.md).",
"is_bot": false,
"headline": "chore(bridge): drop dead ui.X dot-notation registrations + fix regist…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-23T06:07:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "53c8a64b9baead0491d0e58d6883cd52975fdd1a",
"body": "…-REQUEST-MEMORY-RELEASE)\n\nThe HTTP request path already wraps its handler in scope_push/scope_pop\n(commit efc7cc0), but three other handler-dispatch sites that share the\nsame long-lived init WASM instance kept advancing __heap_ptr forever:\n\n - src/workers/sse-worker.ts: each SSE connection's emitt\n[…]\ntation, and add it to the three new\nsites. The wrapper is a no-op against modules compiled with\npre-0.30.330 compilers (no scope_push/scope_pop exports), matching\nthe existing request-worker fallback.",
"is_bot": false,
"headline": "fix(bridge): wrap SSE/cron/job handlers in per-call scope (NSR-NO-PER…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-23T05:45:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "93f995781b7c9edeca1148cd80e99a7cf2439350",
"body": "…VER-UI-RENDER-PAGE-INTERP-STRICT-WHITESPACE)\n\nReplace the regex `/\\{([\\w.]+)\\}/g`, which only matched single-brace\n`{key}` with no internal whitespace, with a single-pass `{{ … }}`\nscanner. Matches HOST_BRIDGE.md / function-registry.toml (`{{ key }}`\nwith whitespace tolerated, missing keys → empty string) and the\nclean-server v1.9.57 sibling implementation. Single-brace `{key}` is\nintentionally no longer consumed so it stays available for the\ncl-iterate directive's item placeholders.",
"is_bot": false,
"headline": "fix(bridge): _ui_render_page substitutes {{ key }} per spec (NODE-SER…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-22T06:11:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "efc7cc0ae0c296a513211e4b1fecfdc870c81d7a",
"body": "…p per request (CNS-MEM-SCOPE-POP)\n\nmem_scope_push now snapshots state.exports.scope_push(); mem_scope_pop\nhands the snapshot to state.exports.scope_pop(), rewinding __heap_ptr.\nThe request worker brackets each handler invocation (including the\nerror path) with the same primitives so __malloc alloca\n[…]\n concatLengthPrefixed — which never go\nthrough mem_alloc and so can't be reclaimed by the per-allocation refcount\npath — are released at request boundaries instead of leaking until the\nworker rotates.",
"is_bot": false,
"headline": "fix(bridge): consume compiler scope_push/scope_pop to rewind WASM hea…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-21T00:31:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3a9c2531c7168da3dba57a409e503d7de7af1f56",
"body": "The 7679a9e fix (0.1.65) and b50d2e0 (0.1.66) added the defensive\n__heap_ptr bump to concatLengthPrefixed, string_split,\nwriteLengthPrefixedString, and writeRawBytes, but mem_alloc was\noverlooked. The compiler emits mem_alloc for every non-string object\n(records, list element slots, struct/class ins\n[…]\nogy used by nsr002-heap-ptr-overlap, covering\nconsecutive non-overlap, sentinel survival across interleaved string\nwrites, the 30-card prod render pattern, alignment, and the zero/negative\nsize no-op.",
"is_bot": false,
"headline": "fix(bridge): mem_alloc bumps __heap_ptr after every allocation (NSR002)",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-20T14:31:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b50d2e084e4bc76697da9b46e121f1a730520957",
"body": "The compiler's __malloc uses the __heap_ptr exported global as a bump\npointer, but doesn't reliably advance it when re-entered from a host\nbridge call. By the time control returns to JS, the global is still at\nits pre-call value — so the next bridge malloc hands out an overlapping\npointer, the next \n[…]\nvery malloc (the\nexact prod pathology) and asserts that consecutive writeString,\nstring.concat, _json_get + concat (30-card render loop), and\nstring_split all survive without length-prefix corruption.",
"is_bot": false,
"headline": "fix(bridge): defensively bump __heap_ptr after every malloc (NSR002)",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-20T13:53:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7679a9e893a7741e386b73ae8a8820555e86edfd",
"body": "…sion)\n\nThe 0.1.63 byte-level rewrite added an empty-input short-circuit that\nreturned one of the input pointers verbatim when the other was empty,\nas a malloc-saving optimization for the 30-card render loop. The\noptimization aliased the input into the result, which broke the\nownership invariant the\n[…]\nmutating an input buffer after concat must not change the result.\n- Updated the two short-circuit-aliasing pins that captured the 0.1.63\n optimization to expect fresh buffers with equivalent content.",
"is_bot": false,
"headline": "fix(bridge): string.concat always returns fresh buffer (NSR002 regres…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-20T03:23:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e0e159d969bb7efb25d38fcba52d7b8419503b80",
"body": "…E_STRING_SPLIT)\n\nThe compiler's `iterate part in parts` reads list size from offset 0 of\nthe returned pointer and element pointers at offset 16 + i*4. Returning a\nJSON-encoded length-prefixed string meant offset 0 held the JSON byte\nlength (e.g. 17 for `[\"a\",\"b\",\"c\",\"d\"]`), so the loop ran 17× past\n[…]\nclean-server's write_string_list_to_caller and the\nwasmtime_runner reference.\n\nUpdated bridge-abi tests to assert the list layout, including the exact\n\"a```b```c```d\" / \"```\" repro from the dashboard.",
"is_bot": false,
"headline": "fix(bridge): string.split returns Clean list, not LP-JSON (HOST_BRIDG…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-19T23:51:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d5e0911925ed66e4fa84a18845656aded9ecd2f8",
"body": "The compiler emits byte-position substring inline, so iterating a string in\na `while i < s.length(): i += 1` loop over multibyte UTF-8 (em-dash E2 80 94,\narrow E2 86 92, CJK, emoji) yields a sequence of length-prefixed fragments\neach holding a single continuation byte. The previous string_concat dec\n[…]\n prod-symptom reproducer (prod WASM md5 14b8276e..., prod\nDB via SSH tunnel): /tutorials goes from 38 U+FFFD / 0 em-dashes preserved\nto 0 U+FFFD / 12 em-dashes preserved across 5 consecutive requests.",
"is_bot": false,
"headline": "fix(bridge): string.concat joins at byte level (NSR002)",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-19T19:58:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "45aff4ec840f396f36a0167e809b916e8a60116d",
"body": "…NSR002)\n\nAdds two more guards on top of utf8-roundtrip:\n\n- http-utf8-wire.test.ts: stands up the real Express middleware stack\n (compression, json, urlencoded, cookieParser, express.text) and verifies\n res.type + res.send preserve multibyte UTF-8 on the wire across text/plain,\n text/html, applic\n[…]\n round-trip, IPC, and Express's response pipeline. The\nproduction U+FFFD symptom isolated to none of them in unit/integration\ntesting — a regression introduced in any layer will now break loudly here.",
"is_bot": false,
"headline": "test(bridge): pin HTTP wire + SharedArrayBuffer IPC UTF-8 contracts (…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-19T17:33:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "49737ebcc4ce0923f238c772f7a649439315b241",
"body": "NSR002 claimed clean-node-server corrupts multibyte UTF-8 in HTTP response\nbodies (em-dash bytes surfacing as U+FFFD chars). Investigation showed the\nhost bridge actually preserves UTF-8 across the full request flow when given\nvalid input: writeLengthPrefixedString / readLengthPrefixedString use\n`by\n[…]\nhows up in\nproduction traffic, WASM memory contained invalid UTF-8 before the bridge\nread it, so the corruption is upstream (compiler-emitted string-length\nhandling or framework http.respond wrapper).",
"is_bot": false,
"headline": "test(bridge): pin multibyte UTF-8 round-trip contract (NSR002 triage)",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-19T16:08:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ec1bb6f132275a1544245d1f92a68cccce2d7aab",
"body": "RouteRegistry.match() did a strict method check, so HEAD requests against\nGET-registered routes (including /health, /metrics, and every WASM route)\nreturned 404. Load balancers and uptime probes using HEAD got false negatives.\n\nRFC 9110 §9.3.2: HEAD must be served identically to GET with the body\nsu\n[…]\nD', so the fix is localised to the registry — try the\nrequested method first, and for HEAD fall back to the GET route. Explicit\nHEAD handlers still win because the first pass runs before the fallback.",
"is_bot": false,
"headline": "fix(router): HEAD falls back to GET handler (HTTP-HEAD-RETURNS-404)",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-19T13:50:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "af0d898a49497948486574e978e59ca1fdede9b4",
"body": "… failure\n\nCompiler 0.30.321 ships MALLOC-IGNORES-MEMORY-GROW-FAILURE — __malloc now\nreturns 0 (null) when memory.grow refuses to grow instead of returning a\ncorrupted pointer. The old bridge guard treated null-pointer and\nout-of-bounds-pointer as the same misleading \"WASM heap exhausted (see\nNSR002\n[…]\non message users have been seeing was\nthe symptom of the upstream allocator bug; with the compiler fix shipped\nand this bridge message updated, the user-visible failure now describes\nthe actual cause.",
"is_bot": false,
"headline": "fix(bridge): report null malloc clearly now that compiler honors grow…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-19T12:56:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c6141f5a60235d240eaeb7453d08a6b535c37f71",
"body": "…lookup\n\nThe dot-path walker used `(current as Record<string, unknown>)[part]` for\nevery step, so `items.length` returned the array length, `items.push`\nreturned the function, and `items.constructor` returned `Array` — none of\nwhich should be reachable via a JSON path. Mirrors clean-server's\nhost-br\n[…]\nGNORES-MEMORY-GROW-FAILURE, #d8fba3f01151) — this commit closes a\nseparate correctness divergence from clean-server in the same bridge\nfunction. Adds tests/json-get-bridge.test.ts; 163/163 tests pass.",
"is_bot": false,
"headline": "fix(bridge): _json_get rejects Array.prototype keys and uses own-key …",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-19T06:01:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4b1f6e8b558edbe62564c0e34d33b9323703c86a",
"body": "Adds a regression test that proves _http_respond writes state.response.status\nunconditionally regardless of any prior _http_set_cache / _http_no_cache call.\nThe two reports (5ac075ee, 70f95ccc) misclassified against node-server were\ncaused by frame.server's auto-wrap emitting a second _http_respond(200, ...)\nafter the helper had already set 4xx. Reclassified to framework; new bug\n276d424935c8 (FRAME-SERVER-AUTO-WRAP-CLOBBERS-STATUS) tracks the real fix.",
"is_bot": false,
"headline": "test(bridge): pin _http_respond status contract (RUN001/RUN002 triage)",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-19T04:40:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c78422a0ddccd3d133b3dbcccee44996a1048e61",
"body": "…NTIME-DB-POOL-WEDGE)\n\nTransaction begin/commit/rollback used release() in finally blocks even when\nthe underlying op threw. mysql2 connections that error mid-stream still have\nunconsumed response bytes; releasing them back into the pool causes the next\nconsumer to trip PROTOCOL_PACKETS_OUT_OF_ORDER\n[…]\nequest-seq to the worker SAB so a timed-out sendAndWait no longer\n leaves the worker free to clobber the next request's payload buffer.\n- 12 tests covering destroy-vs-release across every error path.",
"is_bot": false,
"headline": "fix(db): destroy mysql pool connections on error to prevent wedge (RU…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-19T01:57:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7ffadb3bfd848865aabdccc2684b83650718f082",
"body": "…T-INSERT-ID-ZERO)\n\nThe db bridge dispatches each call against a fresh pooled MySQL connection,\nso LAST_INSERT_ID() — session-local — saw a different connection than the\nprior INSERT and returned 0. SQLite (single-connection) was not affected;\nPostgreSQL uses RETURNING and has no equivalent function\n[…]\nb_execute (sync + async paths)\n- tests: 14 new cases covering alias parsing, response shape, INSERT\n detection, and the round-trip cache (INSERT -> SELECT -> cached id,\n no driver hit on the SELECT)",
"is_bot": false,
"headline": "fix(db): cache last_insert_id across pool connections (FRAME-DATA-LAS…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-18T16:53:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f1976bf26ad05ed0207dedfd70a46f909518c1c6",
"body": "…R-PAGE-MUSTACHE-SYNTAX-MISMATCH)\n\nThe substitution regex previously matched {{key}} (double-brace mustache),\nbut the canonical syntax — emitted by the frame.ui plugin's process_html\nexample and implemented by Rust clean-server — is {key} (single-brace).\nCompanion-page templates serving through clean-node-server were returned\nwith placeholders intact.\n\nAligns the node-server implementation with substitute_template in\nclean-server/src/bridge.rs.",
"is_bot": false,
"headline": "fix(bridge): _ui_render_page uses {key} single-brace syntax (UI-RENDE…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-18T03:35:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e5e1bfe422509c74773f2cb35160ef5137269471",
"body": "…SPOND-RETURNS-ZERO-CLEARS-BODY)\n\nThe compiler-emitted route wrapper takes the _http_respond return value and\npasses it as the body pointer to a second _http_respond call. Returning 0 caused\nthe response body to be cleared. Matches Rust clean-server's\nwrite_string_to_caller(body) pattern and the registry's `returns = \"ptr\"`.",
"is_bot": false,
"headline": "fix(bridge): _http_respond returns body pointer instead of 0 (HTTP-RE…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-18T02:28:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e68c9b343ab4b7fd534fdf16c25c35cf99322da",
"body": "…n (NODE-MEM-ALLOC-SIGNATURE-MISMATCH)\n\nThe compiler emits memory_runtime.mem_alloc with signature (type_id: i32, size: i32) -> i32, but the JS bridge declared a single `size` parameter. JS silently dropped the second argument, so every WASM allocation called mem_alloc(0, N) and was read as size=0, \n[…]\nurned 0, and json.encode of any string produced the literal \"null\".\n\nBrings the Node host into line with function-registry.toml and the Rust host in clean-server/host-bridge/src/wasm_linker/memory.rs.",
"is_bot": false,
"headline": "fix(bridge): mem_alloc accepts (type_id, size) per compiler conventio…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-18T00:49:02Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "dc2ca5e17ccfec28f1a1c495c82814f841d9116d",
"body": "…pe (DB-BUILD-WHERE-IGNORES-DUNDER-WHERE)\n\nbuild_where_clause treated every JSON key as a column name, producing\n`WHERE __where = ?` with the SQL fragment bound as a parameter whenever\nthe framework's frame.data plugin emitted `{\"__where\":\"<fragment>\"}` for\nModel.paginate: / Model.cursor: where: blo\n[…]\nh\nno parameter binding; `__order` is validated against a strict charset\nand surfaced via WhereResult.orderBy so _db_paginate can splice it into\nORDER BY. Matches the protocol shared with clean-server.",
"is_bot": false,
"headline": "fix(bridge): honor __where/__order reserved keys in where_json envelo…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-16T15:28:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "163aa8e95667fbfc78b5afff5d7a22e7a0328521",
"body": "…VER_MEM_LEAK)\n\nTwo leaks identified from production telemetry on a node-server process\nthat hit its cgroup MemoryHigh limit after days of uptime:\n\n1. request-worker.ts: the error path hardcoded `needsRestart: false`\n and never incremented `requestCount`. WASM has no GC, so a partially\n advanced\n[…]\nhestration, which is beyond unit test reach without significant\nmocking scaffolding. Existing 121-test suite still passes; production\nverification is the cgroup-limited reproduction in the bug report.",
"is_bot": false,
"headline": "fix(worker): rotate on error path + sequence terminate→spawn (NODESER…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-16T15:09:51Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c3619c4a46fb3dcf3b7b22daea88a411c4c7d3bf",
"body": "…or stubs\n\nReplaces the throw-error stubs in three bridge modules with full\nimplementations matching clean-server (Rust) behaviour, closing the\nparity gap tracked in node-server-stub-implementations-triage.md.\n\n- schedule.ts: ported 5-field cron parser + setTimeout timer wheel.\n startScheduler(stat\n[…]\nss-component bug\nDBWHERE_RAW_FRAGMENT against frame.data so both hosts can be fixed\ntogether rather than diverging node-server alone.\n\nFull vitest: 121/121 (84 prior + 37 new).\nHost parity: missing=0.",
"is_bot": false,
"headline": "feat(bridge): implement schedule/jobs/websocket — burn down throw-err…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-16T05:40:17Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9a7dfc82d1bd23814a16dd8fad75f8c824814a9a",
"body": "…-drift fix\n\nFrame.server plugin.toml originally declared _server_sleep params as\n[\"i32\"], so the WASM import wired up as (i32) -> void. Node-server's\nhandler matched that with `ms: number`. Clean-framework now corrects\nplugin.toml to [\"integer\"] (committed in clean-framework as\n0e5547b@main), align\n[…]\nloop. Millisecond\nsleep durations fit safely in a JS number.\n\nCloses the PLUGIN-REGISTRY-DRIFT diagnostic fingerprint\nf952554dd54431f7 (cln dev-queue), the last drift the validator was\nstill flagging.",
"is_bot": false,
"headline": "fix(bridge): _server_sleep accepts bigint (i64) per registry/registry…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-16T04:24:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "489c8321d13f2067a95e2d586f0b69ac21adc52f",
"body": "Replaces three throw-error stubs with real SQL builders that hit the\nexisting state.database.querySync path. The clean-server implementations\ndelegate to a `db_bridge.call(\"paginate\" | \"cursor_page\" | \"valid_field\")`\nabstraction that doesn't exist in node-server; these versions inline the\nSQL direct\n[…]\nng, cursor\npredicate, and has_more detection).\n\nCloses Step 8 items 1-3 in\nfoundation/management/cross-component-prompts/\n all-host-bridge-parity-enforcement.md. Remaining: schedule, jobs,\nwebsocket.",
"is_bot": false,
"headline": "feat(bridge): implement _db_paginate, _db_cursor_page, _db_valid_field",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-16T04:14:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "05185ef8f1098cd4df5a39856ad6230d96e0a611",
"body": "…RTE002)\n\nThe _http_route and _http_route_protected bridges previously took a numeric\nhandler index and node-server reconstructed __route_handler_${index} at\ndispatch time. The framework actually passes the WASM export name as a\nstring (e.g. __route_handler_get__ping) per the function-registry.toml\n\n[…]\nts callHandler,\n bridge/test.ts) look up exports[handlerName] directly.\n- New test guards against regressing the naming reconstruction.\n\nCloses RTE002, RTE002-FRAMEWORK (×2). 73/73 vitest tests pass.",
"is_bot": false,
"headline": "fix(router): dispatch handlers by export name, not sequential index (…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-16T02:16:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "446286717ec35c56135906bed44197d20786f427",
"body": "… gaps\n\nThree independent fixes uncovered while running tests:\n\n1. _test_http_request signature corrected to 10 raw (ptr, len) pairs.\n Was using 5 length-prefixed pointers (readPrefixedString); the\n compiler (wasmtime_runner.rs) and clean-server (bridge.rs:3347)\n both emit/expect the 10-i32 fo\n[…]\nalidate which compiler v0.30.123+ no longer\n emits. Required by tests/registry-coverage.test.ts (auto-alias\n regression guard).\n\nTest suite: 72/72 passing (was 70/72 with 2 pre-existing failures).",
"is_bot": false,
"headline": "fix(bridge): correct _test_http_request ABI + close registry-coverage…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-16T00:30:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7b98fad9a0ffb4043bf3d244053a5420f0b85265",
"body": "…gination\n\nCloses the remaining 26 entries in the host bridge parity check; clean\nparity now reports 0 missing on node-server.\n\nNew files (throw-error stubs — apps using these features fail with a\nclear message instead of crashing during WASM linking):\n- bridge/jobs.ts — 12 _job_* stubs\n- bri\n[…]\n\ndb field/paginate → cursor_page → schedule → jobs → websocket.\n\nStub bodies reference clean-server/src/{jobs,websocket,locale}.rs and\nhost-bridge/src/wasm_linker/database.rs as the porting reference.",
"is_bot": false,
"headline": "feat(bridge): add throw-error stubs for jobs/websocket/schedule/db-pa…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-16T00:17:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "26e8f9a67f9fd715a9ae2c9337a5d23cb5dfe715",
"body": "Closes 31 entries in the host bridge parity check against\nfoundation/platform-architecture/function-registry.toml:\n\n- storage (8): _storage_local_*, _storage_session_* — no-op stubs\n- UI helpers (12): _ui_focus, _ui_blur, _ui_get_focus, _ui_get_selection,\n _ui_insert_at_cursor, _ui_text_diff, _ui_s\n[…]\noss-component-prompts/\n all-host-bridge-parity-enforcement.md.\n\nRemaining 26 missing functions (jobs, websocket, db pagination,\nschedule) need real implementations and are tracked in the same prompt.",
"is_bot": false,
"headline": "feat(bridge): backfill missing storage/UI/build_state/i18n imports",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-15T23:27:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "46eea56e1d43bf1f1e805fa0480a044c584f8dfd",
"body": "…g (SRV005)\n\nSame fix as clean-server: loader.js reads data-wasm from its own script element\nto locate frontend.wasm. Without it the fallback is a relative path that 404s on\nroutes deeper than /. Injecting data-wasm=\"/frontend.wasm\" (absolute) fixes hydration\non all routes.",
"is_bot": false,
"headline": "fix(bridge): add data-wasm absolute path to injected loader script ta…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-13T04:00:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "221b665a4179b8f9fb0d7ab509bc3ee5fd2464cb",
"body": "Closes 6 cross-server parity bugs against clean-server (commits bb37270,\na6dc693, 88565eb, 2d19719, efb38cd, 2c43399):\n\n- NSRV-ENV-ERROR: register env.error host import with LP-format signature\n so compiled modules that propagate runtime errors instantiate cleanly\n- NSRV-HTTP-HEADERS: add http_put/\n[…]\nV002: serve /loader.js (from ~/.cleen/plugins/frame.ui/runtime\n with embedded stub fallback) and /frontend.wasm (sibling-of-main-WASM\n first, then CWD / public / dist) ahead of the Express catch-all",
"is_bot": false,
"headline": "fix(bridge): port clean-server fixes to close NSRV-* error reports",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-10T19:41:07Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ae7c6cccb71fa166e10a44d44aa0217d3288c922",
"body": "…ectives\n\nAdds _http_redirect_route bridge function (layer 3) that registers static\nredirect routes during WASM start() without generating a WASM handler function.\nMatches the signature in function-registry.toml:\n (method_ptr, method_len, from_ptr, from_len, to_ptr, to_len, status) -> i32\n\nRouteReg\n[…]\nute\nentry. Server.handleRequest short-circuits on redirectTo routes, issuing the\nLocation header and status code directly without dispatching to the worker pool.\n\nResolves NODE-REDIRECT-ROUTE-MISSING.",
"is_bot": false,
"headline": "feat(bridge): implement _http_redirect_route for static redirect: dir…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-05T13:05:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "dec28818611029e1dfa7441a48bc2446c3c8c92c",
"body": "…e_body\n\nResolves SYNC-CANVAS-STUBS-MISSING: WASM modules with canvasScene: blocks\nemit imports for all 238 frame.canvas bridge functions even when running\nserver-side. Without host stubs, WebAssembly.instantiate fails with a\nLinkError. Added src/bridge/canvas-stubs.ts with no-op stubs whose\nsignatu\n[…]\n Mirrors the\nclean-server/src/bridge_canvas_stubs.rs pattern.\n\nAlso adds http_get_response_body (Layer 2 http_client), fixing the\npre-existing registry-coverage test failure.\n\nBumps version to 0.1.42.",
"is_bot": false,
"headline": "feat(bridge): add frame.canvas client-side stubs and http_get_respons…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-04T06:40:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7191f288c14f2140fb63bce2bd8237f03f8fd1b0",
"body": "… _email_last_error\n\nFixes BRIDGE001, SRV-MISSING-BRIDGE, BRIDGE002 on the node server runtime.\nAll frame.server apps were failing at WASM instantiation because these four\nbridge functions declared in frame.server plugin.toml [bridge] were missing.\n\n- _res_download: sets Content-Disposition: attachm\n[…]\nfires async with\n error captured in lastEmailError for _email_last_error to report\n- _email_last_error: returns error string from last failed send\n\nAlso removes unused camelToSnake helper from ui.ts.",
"is_bot": false,
"headline": "feat(bridge): implement _res_download, _email_configure, _email_send,…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-03T05:13:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1d80a5069663d40a4ef526fc430debc1ca2da75f",
"body": "Part A (§FEXT-4): Full SSE wire-protocol implementation.\n- _http_sse_route registers STREAM routes by exported handler name\n- _sse_emit, _sse_emit_event, _sse_close, _sse_retry, _sse_is_connected\n backed by a dedicated per-connection SSE worker thread\n- Worker posts events via parentPort; main thre\n[…]\n,3,5): Browser-only no-op stubs for server-side WASM\ninstantiation — DOM query, DOM patching, iframe communication, drag data.\nAll stubs return 0 or satisfy the linker; never called at server runtime.",
"is_bot": false,
"headline": "feat(bridge): implement SSE bridge and browser-only UI stubs",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-02T15:37:53Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8891684693f4d095b0057543adfc73fc1adba38b",
"body": "BRIDGE001: replace 4-param string_matches with 3-param version using\ncompile-time pattern IDs (0=email, 1=url, 2=uuid, 3=phone, 4=date,\n5=integer, 6=number, 7=alphanumeric); old signature read pattern as a\nruntime WASM string causing always-false results.\n\nBRIDGE002: add src/bridge/test.ts implementing _test_http_request,\n_test_response_status, and _test_response_body — in-process endpoint\ntest dispatch using the route registry and handle-map pattern.",
"is_bot": false,
"headline": "fix(bridge): implement BRIDGE001 and BRIDGE002 fixes",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-02T04:36:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f8b87080203ce02deca30e76864908ddccb0fce7",
"body": null,
"is_bot": false,
"headline": "feat(bridge): add mcp bridge source files missing from previous commit",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-01T01:10:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "702634c3c0c4a98728c9a3cbd50fb1bf9e476c6b",
"body": "…_head_link\n\n_db_register_migration: update from 2-param (name only) to 6-param form\n(name, up_sql, down_sql as ptr+len pairs) to match frame.data plugin output.\nStore SQL strings alongside migration name; _db_run_migrations and\n_db_rollback_migration now execute stored SQL with WASM export fallback\n[…]\nmissing bridge function (was in function-registry\nbut not implemented in node server). Injects <link rel=stylesheet href=...>\ninto response head, deduplicated by href. Adds injectedLinks to WasmState.",
"is_bot": false,
"headline": "feat(bridge): fix _db_register_migration signature and add _ui_inject…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-06-01T01:08:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c4f5637c88d2e403fdf76ae11fa3fd8822a26cdd",
"body": "…BRIDGE001)\n\nRemoved JSON.parse() branch that was re-serializing valid JSON objects\nwithout outer quotes, causing parameterized SQL queries to receive an\nembedded object instead of a string literal.",
"is_bot": false,
"headline": "fix(bridge): json.encode() always serializes as JSON string literal (…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-28T03:59:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aa2258d2da7efeeb6bffe3aeff1a36f426200d45",
"body": "… (NSR001)\n\nCompiler 0.30.155+ emits these as WASM imports in every module. Both are\nno-ops for the bump-allocator runtime but must be registered to allow\nWASM instantiation to succeed.\n\n[dev-queue-skipped: SRV001, SRV002 are clean-server issues, not node-server]",
"is_bot": false,
"headline": "fix(bridge): add _state_reset_all and _state_reset_named host imports…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-24T02:08:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2ccac1a636dece5f7997047615b8bd1e086a8b2d",
"body": "_ui_load_layout, _ui_load_page, and _ui_render_page previously constructed\npaths internally (app/pages/, app/layouts/), encoding frame.ui plugin\nconventions in the server layer. The first argument is now treated as a full\nrelative path from project root — path construction is the caller's\nresponsibility. Mirrors the same fix in clean-server.",
"is_bot": false,
"headline": "fix(bridge): UI template functions accept full relative paths (SRV001)",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-23T20:24:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6bebec5b7261b45973c5bccb3cb8b9f74f3c1a25",
"body": "…UI_RENDER_PAGE_MISSING)\n\nframe.server plugin declares _ui_render_page as a bridge function for\nrender() and renderWith() DSL calls, but neither function was registered\nin the WASM imports object. WASM instantiation failed immediately with\n\"unknown import: env::_ui_render_page\".\n\nImplements _ui_rend\n[…]\ndata string.\nMissing keys produce an empty string. Includes path traversal protection.\n\nAlso registers _ui_load_page which was implemented in ui.ts since\nc5cd2ea but never wired into the bridge index.",
"is_bot": false,
"headline": "fix(bridge): add _ui_render_page and _ui_load_page host imports (SRV_…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-22T02:00:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "120cce4d46284f719e0e3a0e595b71a1e597fbde",
"body": "Chrome 95+ and Firefox 103+ require 'wasm-unsafe-eval' in script-src to\nallow WebAssembly.compile() and WebAssembly.instantiate(). The previous\ndefault-src 'self' policy blocked all WASM loading in modern browsers.",
"is_bot": false,
"headline": "fix(security): add wasm-unsafe-eval to CSP script-src (CSP_BLOCKS_WASM)",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-21T15:05:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "50ea5099224d3fb3c5cbdd37155fbd669d64b75f",
"body": "Compiler v0.30.134+ emits string_matches as a WASM import in all compiled\nmodules. Adds the implementation (sig: i32,i32,i32,i32 -> i32) to the string\nbridge and registers it in the env import object, preventing LinkError on\nWASM instantiation.",
"is_bot": false,
"headline": "fix(bridge): add string_matches host import (BRIDGE_MISSING_STDLIB)",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-20T21:33:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6ea369f74c2783c63a99817c7aee0041ab9bad25",
"body": "…s (ASYNC001)\n\nResolves ASYNC001 — three async bridge functions were absent from the env\nimport object, causing WASM instantiation failures for modules that use\nbackground tasks or server sleep. Implements the same busy-wait pattern\nused by _time_sleep; _async_fire and _async_await are fire-and-forget stubs\nmatching the clean-server v1.9.11 fix.",
"is_bot": false,
"headline": "fix(bridge): add _async_fire, _async_await, _server_sleep host import…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-20T03:45:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3dc30aa431da766343ac05ae370a439b460a5317",
"body": "…FEAT001)\n\nAdds _ui_load_page to createUiBridge() in src/bridge/ui.ts, resolving\napp/pages/{name}.html with the same path-traversal guard used by\n_ui_load_layout. Closes the render() parity gap between clean-server\nand clean-node-server reported as FEAT001.",
"is_bot": false,
"headline": "feat(bridge): add _ui_load_page bridge function for render() parity (…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-19T06:05:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c5cd2eaf404c86005c9678460240639f2f5e1b68",
"body": "Tests encoded the old broken convention (1=equal, 0=different).\nCompiler codegen emits i32.eqz after string_compare, requiring 0=equal,\nnon-zero=different. Updated to match the corrected bridge implementation.",
"is_bot": false,
"headline": "test(bridge-abi): update string_compare expectations to match spec",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-18T16:13:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1160e95be43ba0c7d51ea914998fad962b730211",
"body": "…turn convention\n\nNSR002: _http_redirect signature was (urlPtr, urlLen, permanent) but compiler\nemits (status, urlPtr, urlLen) per function-registry.toml spec. Status is now\npassed directly instead of being derived from a boolean permanent flag.\nAdded separate _res_redirect(urlPtr, urlLen, status) i\n[…]\n: string_compare was returning 1 for equal, 0 for different. Compiler\ncodegen emits i32.eqz after calling string_compare, so it expects 0=equal,\nnon-zero=different. Inverted the return value to match.",
"is_bot": false,
"headline": "fix(bridge): correct _http_redirect param order and string_compare re…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-18T16:11:29Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2a3b54da20e5ff511844bbe9648a4563efcf12b6",
"body": "… bounds check, ui snake_case rename\n\nNSR001: sanitizeHeaderValue now strips all chars outside RFC 7230 obs-text range\n(tab, 0x20–0x7E, 0x80–0xFF), preventing U+FFFD and other Unicode chars that\nNode.js v22 rejects in HTTP headers.\n\nNSR002: writeLengthPrefixedString now validates ptr+totalSize <= bu\n[…]\nctHeadCss to _ui_load_layout/_ui_inject_head_css\nin ui.ts and index.ts to match plugin.toml [bridge] declarations — the compiler\nemits snake_case WASM imports matching the canonical plugin.toml names.",
"is_bot": false,
"headline": "fix(bridge): resolve NSR001/NSR002/NSR003 — header sanitization, heap…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-18T05:11:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ead96808127c2f82bbe58202db81000da2e4a878",
"body": "…al names only\n\nThe compiler (v0.30.123) was fixed to emit only canonical _namespace_fn import\nnames. Dot-notation aliases (db.query, req.param, etc.) are no longer emitted as\nseparate WASM imports, so the auto-alias derivation loop in createBridgeImports()\nis dead code.\n\nRemove the loop. Update the\n[…]\n method imports that the compiler always emitted as dot-notation primaries\n(string.concat, math.sin, integer.toString, list.*, etc.) remain explicitly\nregistered — those are unaffected by this change.",
"is_bot": false,
"headline": "refactor(bridge): remove auto-alias loop — compiler now emits canonic…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-18T04:32:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8d514c1c29930e16ede1a1478863634bf0c7620a",
"body": "_auth_hash_password and _auth_verify_password were never canonical names.\nThe registry defines _crypto_hash_password and _crypto_verify_password.\nNo backward compatibility needed in a development project with a single spec.",
"is_bot": false,
"headline": "refactor(bridge): remove backward-compat crypto aliases",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-18T01:58:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0d2537bc70bde52ce9ef26fc4af9806438818eec",
"body": "…issing functions\n\nAdds a registry coverage test that reads function-registry.toml and verifies\nthe env object covers every canonical name and alias. Fixed all 43 gaps it found:\n\ncrypto.ts: renamed _auth_hash_password/_auth_verify_password to canonical\n_crypto_hash_password/_crypto_verify_password; \n[…]\nrd and\n_auth_verify_password pointing to renamed canonical functions.\n\ntests/registry-coverage.test.ts: parses module field to skip memory_runtime\nentries; checks every env-module canonical and alias.",
"is_bot": false,
"headline": "fix(bridge): full registry coverage — canonical names, aliases, and m…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-18T01:54:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f75809490b8a9747d9acc04717c0fae14115d6a9",
"body": "…nent prompt format\n\nAdds a \"Bridge Function Naming\" section to CLAUDE.md explaining the dual\n_namespace_fn / namespace.fn registration requirement and pointing to\nHOST_BRIDGE.md for the full spec. Updates the cross-component prompt\nformat reference to point at the README instead of embedding a stale\ninline template.",
"is_bot": false,
"headline": "docs(bridge): document dual-naming requirement and update cross-compo…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-18T01:31:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0b67de00959a697cdb496771234fedce3f48c750",
"body": "…efixed bridge functions\n\nThe compiler emits WASM imports in both _namespace_fn and namespace.fn\nstyles for all bridge namespaces. The env object only registered underscore\nnames, causing LinkError on db.query, req.param, http.respond, etc.\n\nRefactors createBridgeImports() to build env as a named va\n[…]\nnt. Keys starting with __ (e.g. __stack_pointer) are skipped.\n\nCovers all namespaces: db, req, http, json, html, ui, session, auth,\ncrypto, file, and any future additions automatically.\n\nFixes NSR004.",
"is_bot": false,
"headline": "fix(bridge): auto-generate dot-notation aliases for all underscore-pr…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-18T01:08:36Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b2da585eae44180331fa671d59cf934d5f65b0cb",
"body": "The compiler generates both camelCase and snake_case dot-notation imports\nfor every frame.ui bridge function. The previous partial fix added camelCase\nstubs but left 29 snake_case variants uncovered, causing a LinkError on\nui.set_state (and others) at WASM instantiation.\n\nAdds camelToSnake() and a p\n[…]\n-build loop in createUiClientStubs() that\nderives snake_case aliases from all camelCase ui.* entries automatically.\nFuture bridge function additions stay in sync without manual listing.\n\nFixes NSR003.",
"is_bot": false,
"headline": "fix(bridge): auto-generate snake_case aliases for all ui.* client stubs",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-18T00:43:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8908755e96fa8dba0499246da21e9b075b496450",
"body": "…ry pre-grow, ui client stubs\n\nNSR003: frame.ui 2.6.9 registers client-side bridge functions as WASM imports in\nserver builds. Add no-op stubs for all ui.* functions in createUiClientStubs()\nand spread them into the linker env — satisfies the linker without runtime overhead.\n\nNSR001: http.redirect()\n[…]\nffset is outside the\nbounds of the DataView\". Add preGrowMemory() (16 MB default) called at startup in\nboth server.ts and request-worker.ts so memory.grow() is never triggered during\nrequest handling.",
"is_bot": false,
"headline": "fix(bridge): resolve NSR001/NSR002/NSR003 — header sanitization, memo…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-17T23:43:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "290f9ffb80976996590a1a1dbdd6ef509854df07",
"body": "…ring_split to LP-pointer ABI\n\nWASM calls these functions with one i32 LP-pointer per string argument\n(pointing to [4-byte LE length][UTF-8 content]). The previous (ptr, len,\nptr, len) signature misread the second LP-pointer as a length value, causing\nexponential memory growth and offset-out-of-boun\n[…]\nted call site expectation.\n\nAdds bridge-abi.test.ts with 12 ABI contract tests covering LP-pointer and\nraw ptr+len conventions across all four affected functions.\n\nFixes: NODE-STRING-BRIDGE-CONVENTION",
"is_bot": false,
"headline": "fix(bridge): switch string.concat, string_compare, string_replace, st…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-16T22:07:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "62c2349a6d0abe2646706f92bae323de4a4eb704",
"body": "…mer into shutdown\n\nNODE-DB-BRIDGE-OOB: writeLengthPrefixedString, readLengthPrefixedString, and\nreadRawString each called memory.buffer multiple times. When WASM malloc causes\na memory.grow(), the old ArrayBuffer is detached and replaced. All reads and\nwrites now snapshot the buffer once after mall\n[…]\nver.start(), so it fired unconditionally 35 seconds\nafter startup regardless of whether shutdown was in progress. Moved into\nthe shutdown() handler so the watchdog only runs when a signal is received.",
"is_bot": false,
"headline": "fix(bridge): snap memory buffer once after malloc, move force-exit ti…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-16T19:58:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "22a2684ca2c1b3fd3f87750e98bd5ec5b8525b03",
"body": "The compiler exports handlers as __route_handler_0, __route_handler_1, ...\nin registration order. The WASM table index passed to _http_route is an\ninternal offset unrelated to the export naming scheme.\n\nRouteRegistry now maintains a sequential counter and stores it as the\nhandlerIndex, replacing the raw WASM table offset. Dispatch uses\n__route_handler_${handlerIndex} with the counter-based index.\n\nFixes NODE-HANDLER-DISPATCH-V2.",
"is_bot": false,
"headline": "fix(bridge): dispatch route handlers via sequential registration counter",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-16T17:47:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3ebefc8d27eec7b579279fc30f4f78d942335442",
"body": "…ort names\n\nThe compiler emits handler indices as function table offsets, not named\nexports. Constructing __route_handler_<N> / __handler_<N> export names\nnever matched anything in the WASM module.\n\nBoth callHandler() and request-worker.ts now use\n__indirect_function_table.get(handlerIndex) — the same pattern already\nused by the array bridge for callbacks.\n\nFixes NODE-HANDLER-DISPATCH.",
"is_bot": false,
"headline": "fix(bridge): dispatch route handlers via WASM function table, not exp…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-16T15:27:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f696b4a102e1be2346e247a9437cc9de9b66eb85",
"body": "…pected\n\nstart() resolved the port as: port || getConfiguredPort() || this.config.port\ngetConfiguredPort() always returned truthy 3000 (its module-level default),\nso this.config.port (the parsed --port value) was never reached.\n\nPassing config.port explicitly makes the CLI flag win unconditionally.\n\nFixes NODE-PORT-FLAG-IGNORED.",
"is_bot": false,
"headline": "fix(server): pass config.port to server.start() so --port flag is res…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-16T15:02:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3352fb8fd439ba8a4d75654a3e5c8e16f873a1de",
"body": "…e.js v22\n\nObject.create alone is insufficient: JS [[Set]] walks the prototype chain\nand throws TypeError when the prototype property is non-writable, even on\nthe shadow object. Object.defineProperty creates an OWN property directly,\nbypassing the prototype chain check entirely.\n\nFixes NODE-WASM-MALLOC-READONLY (complete fix, supersedes v0.1.12).",
"is_bot": false,
"headline": "fix(wasm): use Object.defineProperty to install malloc wrapper on Nod…",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-16T14:56:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0a89695e9c12d639be722d1b6446d1fa4d432375",
"body": "Node.js v22 (V8) enforces that WebAssembly.Instance.exports properties\nare non-writable per spec. wrapMalloc() was assigning directly to\nexports.malloc, throwing TypeError on v22+.\n\nFixes NODE-WASM-MALLOC-READONLY by using Object.create(instance.exports)\nto create a shadow object — the wrapper becomes an own property while\nall other WASM exports remain accessible via the prototype chain.",
"is_bot": false,
"headline": "fix(wasm): shadow WASM exports to allow malloc wrapping on Node.js v22",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-16T14:51:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2eee5bf7c6bc5be1d59eee48bd5949a146500faa",
"body": null,
"is_bot": false,
"headline": "chore(settings): update allowed commands",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-16T14:39:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "859f850340226d98e0746a3d01b5e9ff6afa51f6",
"body": "Implements SyncMysqlDriver using the same SharedArrayBuffer + Atomics\npattern as SyncPostgresDriver, with a mysql-worker thread handling async\nmysql2 operations. Adds mysql/mysql2 protocol cases to createDatabaseDriver.\n\nFixes FEATURE-NODE-MYSQL reported against 0.30.110.",
"is_bot": false,
"headline": "feat(database): add MySQL driver via worker-thread sync bridge",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-16T14:38:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e7cdc68081e67671d497762fad26d4f9727ad62d",
"body": "Register _html_escape, _html_raw, print_string, console_input, and\nall 29 math dot-notation aliases (math.sin, math.cos, etc.) that\nwere in the HOST_BRIDGE spec but not wired into the env import object.",
"is_bot": false,
"headline": "feat(bridge): add missing HOST_BRIDGE functions per spec",
"author_name": "Ivan",
"author_login": "Ivan-Pasco",
"committed_at": "2026-05-12T02:10:09Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 98,
"commits_last_year": 118,
"latest_release_at": "2026-07-18T11:44:03Z",
"latest_release_tag": "v0.1.97",
"releases_from_tags": true,
"days_since_last_push": 5,
"active_weeks_last_year": 19,
"days_since_latest_release": 5,
"mean_days_between_releases": 0.7
},
"community": {
"has_readme": true,
"has_license": false,
"has_description": true,
"has_contributing": false,
"health_percentage": 28,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "@ivan-pasco/clean-node-server",
"exists": true,
"license": "MIT",
"keywords": [
"clean-language",
"wasm",
"webassembly",
"server",
"runtime"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@ivan-pasco/clean-node-server",
"is_deprecated": false,
"latest_version": "0.1.97",
"repository_url": "https://github.com/Ivan-Pasco/clean-node-server",
"versions_count": 93,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 4376,
"first_published_at": "2026-01-25T02:57:33.837000Z",
"latest_published_at": "2026-07-18T11:45:36.434000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 5
}
]
},
"popularity": {
"forks": 0,
"stars": 0,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": {
"days": [],
"complete": true,
"collected": 0,
"total_stars": 0,
"collected_at": null
},
"open_issues_and_prs": 1
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": true,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 31875,
"source_files_sampled": 122,
"oversized_source_files": 0,
"agent_instruction_files": [
"CLAUDE.md"
],
"agent_instruction_max_bytes": 5920
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "bcryptjs",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^2.4.3"
},
{
"name": "better-sqlite3",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^11.0.0"
},
{
"name": "commander",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^12.0.0"
},
{
"name": "compression",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.8.1"
},
{
"name": "cookie-parser",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.4.6"
},
{
"name": "cors",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^2.8.6"
},
{
"name": "express",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^4.18.2"
},
{
"name": "express-rate-limit",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^8.4.1"
},
{
"name": "ioredis",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^5.10.1"
},
{
"name": "jsonwebtoken",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^9.0.2"
},
{
"name": "mysql2",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^3.9.0"
},
{
"name": "nodemailer",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^8.0.10"
},
{
"name": "pg",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^8.11.3"
},
{
"name": "pino",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^10.3.1"
},
{
"name": "pino-http",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^11.0.0"
},
{
"name": "prom-client",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^15.1.3"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 0,
"open_issues": 1,
"closed_ratio": 0,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "Ivan-Pasco",
"commits": 118,
"avatar_url": "https://avatars.githubusercontent.com/u/137369164?v=4"
}
],
"contributors_sampled": 1,
"top_contributor_share": 1
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"nightly-canaries.yml",
"publish.yml",
"reporter-artifacts.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 0,
"reason": "license file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 4,
"reason": "dependency not pinned by hash detected -- score normalized to 4",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 4,
"reason": "6 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "a4a5d694ff85b427b8dfa34d671e78ac6cbf45dd",
"ran_at": "2026-07-23T19:09:07Z",
"aggregate_score": 3.7,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-23T08:46:10Z",
"oldest_open_prs": [],
"last_merged_pr_at": null,
"ci_last_conclusion": "FAILURE",
"oldest_open_issues": [
{
"number": 1,
"created_at": "2026-07-13T04:02:03Z",
"last_comment_at": "2026-07-18T11:45:37Z",
"last_comment_author": "github-actions"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/Ivan-Pasco/clean-node-server",
"host": "github.com",
"name": "clean-node-server",
"owner": "Ivan-Pasco"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 49,
"inputs": {
"security": 37,
"vitality": 81,
"community": 24,
"governance": 31,
"engineering": 66
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 81,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"commits_last_year": 118,
"human_commit_share": 1,
"days_since_last_push": 5,
"active_weeks_last_year": 19
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "19/52 weeks with commits",
"points": 13.2,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 19
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "118 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 118
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 88,
"inputs": {
"releases_count": 98,
"latest_release_tag": "v0.1.97",
"releases_from_tags": true,
"days_since_latest_release": 5,
"mean_days_between_releases": 0.7
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "98 version tags (no GitHub releases)",
"points": 16.2,
"status": "partial",
"details": [
{
"code": "version_tags_no_releases",
"params": {
"count": 98
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~0.7 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 0.7
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "critical",
"name": "Community & Adoption",
"value": 24,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 0,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "0 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 0
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "critical",
"name": "Community health",
"note": null,
"notes": [],
"value": 25,
"inputs": {
"has_readme": true,
"has_license": false,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "no license file detected",
"points": 0,
"status": "missed",
"details": [
{
"code": "license_absent",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 61,
"inputs": {
"packages": [
"@ivan-pasco/clean-node-server"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 4376
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "4,376 downloads/month across npm",
"points": 48.5,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 4376,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 31,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 10,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 1,
"top_contributor_share": 1
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 100% of commits",
"points": 0,
"status": "missed",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 100
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "1 contributors",
"points": 1.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 1
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"merged_prs": 0,
"open_issues": 1,
"closed_issues": 0,
"issue_closed_ratio": 0,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "0% of issues closed",
"points": 0,
"status": "missed",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 0
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "no decided pull requests or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_decided_prs_or_data",
"params": {}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 32,
"inputs": {
"followers": 1,
"owner_type": "User",
"is_verified": null,
"owner_login": "Ivan-Pasco",
"public_repos": 10,
"account_age_days": 1127
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "1 followers of Ivan-Pasco",
"points": 2.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 1,
"login": "Ivan-Pasco"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "10 public repos, account ~3 yr old",
"points": 13.8,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 10
}
},
{
"code": "account_age_years",
"params": {
"years": 3
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@ivan-pasco/clean-node-server"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 5
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 5 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 5
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "93 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 93
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 66,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 60,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "3 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 3
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 37,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 37,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 3.7
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 4",
"points": 2,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "6 existing vulnerabilities detected",
"points": 3,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 62,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [
"CLAUDE.md"
],
"agent_instruction_max_bytes": 5920
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "CLAUDE.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "CLAUDE.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "100 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 100,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "at_risk",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 47,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"tsconfig.json"
],
"agent_commit_share": 0,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 4",
"points": 4,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 31875,
"source_files_sampled": 122,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/122 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 122,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "critical",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 20,
"inputs": {
"example_dirs": [],
"has_mcp_signal": true,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 20,
"status": "met",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"deps.dev does not index npm:@ivan-pasco/clean-node-server@0.1.97; advisories assessed against the repository dependency graph instead"
],
"report_type": "repository",
"generated_at": "2026-07-23T19:09:13.595025Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/i/Ivan-Pasco/clean-node-server.svg",
"full_name": "Ivan-Pasco/clean-node-server",
"license_state": "absent",
"license_spdx": null
}