公开记录中等
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-23 00:52 UTC
R1ck404 / Nodepod
Node.js for inside the browser. An open-source, lightweight WebContainer alternative.
R1ck404/Nodepod 的健康指数为 100 分中的 59 分，处于「中等」区间。 其得分最高的类别是Vitality（78/100），最低的是Security（30/100）。 最近一次更新在 3 天前。 近期的大部分工作由 1 位贡献者完成。
59
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
59
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
软件包生态系统
| 注册表 | 软件包 | 版本 | 月下载量 | 版本数 | 最近发布 | 标签 |
|---|---|---|---|---|---|---|
| npm | @scelar/nodepod | 1.9.12 | 6,174 | 43 | 5 天前 | nodebrowserruntimesandboxtypescriptvirtual-filesystempolyfillwebcontainerin-browsernodejs |
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
78
开发活跃度
71良好
评分方式
| 36/36 | 推送新近度 — 最近一次推送于 3 天前 |
| 6.9/36 | 提交节奏 — 52 周中有 10 周有提交 |
| 18/18 | 提交量 — 最近一年 168 次提交 |
| 10/10 | OpenSSF Scorecard：Maintained — 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 |
所用输入
| commits_last_year | 168 |
| human_commit_share | 1 |
| days_since_last_push | 3 |
| active_weeks_last_year | 10 |
发布纪律
88优秀
评分方式
| 16.2/27 | 有发布版本 — 25 个版本标签（无 GitHub 发布版本） |
| 36/36 | 发布时效 — 最近一次发布版本于 8 天前 |
| 27/27 | 发布节奏 — 约每 9 天发布一次 |
| 0/10 | OpenSSF Scorecard：Signed-Releases — 无数据 |
所用输入
| releases_count | 25 |
| latest_release_tag | v1.9.9 |
| releases_from_tags | 是 |
| days_since_latest_release | 8 |
| mean_days_between_releases | 9 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Signed-Releases。 其余权重已重新归一化。
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
58
流行度与采用
49存在风险
评分方式
| 35.6/60 | 星标 — 158 个星标 |
| 13.4/25 | 复刻 — 41 个复刻 |
| 0/15 | 关注者 — 1 位关注者 |
所用输入
| forks | 41 |
| stars | 158 |
| watchers | 1 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
64中等
评分方式
| 22.5/22.5 | README |
| 16.9/22.5 | 许可证 — 存在许可证文件，但不是可识别的许可证 |
| 18/18 | CONTRIBUTING 指南 |
| 0/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 0/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 是 |
| has_contributing | 是 |
| has_issue_template | 否 |
| has_code_of_conduct | 否 |
| has_pull_request_template | 否 |
生态采用（下载量）
63中等
评分方式
| 50.5/80 | 月度下载量 — npm 合计每月 6,174 次下载 |
| 0/20 | 注册表被依赖数 — 该生态系统不报告此项 |
所用输入
| packages | @scelar/nodepod |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 6,174 |
已排除计分（无数据或不适用）：注册表被依赖数。 其余权重已重新归一化。
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
55
维护者韧性（巴士系数）
19危急
评分方式
| 9/54 | 巴士系数 — 1 位贡献者贡献了半数提交 |
| 1.5/22.5 | 提交分布 — 头号贡献者编写了 94% 的提交 |
| 5.4/13.5 | 贡献者广度 — 4 位贡献者 |
| 3/10 | OpenSSF Scorecard：Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
所用输入
| bus_factor | 1 |
| contributors_sampled | 4 |
| top_contributor_share | 0.935 |
议题与 PR 响应能力
70良好
评分方式
| 36.8/46.8 | 议题解决 — 79% 的议题已关闭 |
| 32.8/38.3 | PR 接受 — 已裁定的 PR 中 36/42 已合并 |
| 0/15 | OpenSSF Scorecard：Code-Review — Found 0/27 approved changesets -- score normalized to 0 |
所用输入
| merged_prs | 36 |
| open_issues | 7 |
| closed_issues | 26 |
| issue_closed_ratio | 0.788 |
| closed_unmerged_prs | 6 |
所有权与托管责任
46存在风险
评分方式
| 10/30 | 所有权背书 — 个人（用户）账户 |
| 0/20 | 已验证域名 — 不适用于个人账户 |
| 10.2/25 | 所有者影响力 — R1ck404 有 25 位关注者 |
| 16.3/25 | 既往记录 — 17 个公开仓库，账户约 3 年 |
所用输入
| followers | 25 |
| owner_type | User |
| is_verified | — |
| owner_login | R1ck404 |
| public_repos | 17 |
| account_age_days | 1,299 |
已排除计分（无数据或不适用）：已验证域名。 其余权重已重新归一化。
软件包维护
100优秀
评分方式
| 25/25 | 已发布且可解析 — npm 上有 1 个软件包 |
| 35/35 | 发布时效 — 最近一次发布于 5 天前 |
| 20/20 | 版本历史 — 43 个已发布版本 |
| 20/20 | 未被弃用 — 活跃，未被弃用或撤回 |
所用输入
| packages | @scelar/nodepod |
| ecosystems | npm |
| any_deprecated | 否 |
| min_days_since_publish | 5 |
工程质量
基础的工程与文档实践是否到位？
65
工程实践
48存在风险
评分方式
| 24/24 | CI 工作流 — 1 个工作流 |
| 24/24 | 存在测试 |
| 0/16 | Linter 配置 |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard：CI-Tests — 0 out of 1 merged PRs checked by a CI test -- score normalized to 0 |
所用输入
| has_ci | 是 |
| has_tests | 是 |
| has_editorconfig | 否 |
| has_linter_config | 否 |
| has_precommit_config | 否 |
文档
90优秀
评分方式
| 30/30 | README |
| 25/25 | 文档目录 |
| 15/15 | 文档 / 主页站点 — https://scelar.com/blog/introducing-nodepod |
| 10/10 | 仓库描述 |
| 10/10 | 主题标签 — 6 个主题标签 |
| 0/10 | Wiki |
所用输入
| topics | browser, nextjs, nodejs, runtime, typescript, webcontainers |
| has_wiki | 否 |
| homepage | https://scelar.com/blog/introducing-nodepod |
| has_readme | 是 |
| has_docs_dir | 是 |
| has_description | 是 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
30
安全态势
30存在风险
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — 0 out of 1 merged PRs checked by a CI test -- score normalized to 0 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/27 approved changesets -- score normalized to 0 |
| 0.8/2.5 | Contributors — project has 1 contributing companies or organizations -- score normalized to 3 |
| 10/10 | Dangerous-Workflow — no dangerous workflow patterns detected |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.2/2.5 | 许可证 — license file detected |
| 7.5/7.5 | Maintained — 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 |
| 0/5 | Packaging — 无数据 |
| 0/5 | Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
| 0/5 | SAST — SAST tool is not run on all commits -- score normalized to 0 |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — 无数据 |
| 0/7.5 | Token-Permissions — detected GitHub workflow tokens with excessive permissions |
| 0/7.5 | Vulnerabilities — 20 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 16 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 2 |
| scorecard_aggregate | 3 |
已排除计分（无数据或不适用）：packaging, signed_releases。 其余权重已重新归一化。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
51
AI 代理上下文与指引
40存在风险
评分方式
| 0/45 | 代理指令 — 没有 CLAUDE.md / AGENTS.md / 编辑器规则 |
| 0/15 | 机器可读文档（llms.txt） |
| 40/40 | 可读的提交历史 — 100 次人类提交中有 80 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 0.8 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
验证循环（构建 / 测试 / 类型检查）
45存在风险
评分方式
| 0/18 | 一条命令的引导启动 |
| 22/22 | 自动化测试 |
| 0/11 | Lint / 格式化配置 |
| 11/11 | 静态类型检查 — examples/scelar-auth-template/app/tsconfig.json, tsconfig.json |
| 10/10 | 可复现环境 — lockfile |
| 2/10 | 已体现的代理实践 — 最近 100 次提交中有 1 次由代理编写或署名代理 |
| 0/8 | 自动化维护 — 未观察到自动依赖更新 |
| 0/10 | OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0 |
所用输入
| has_nix | 否 |
| has_tests | 是 |
| lockfiles | package-lock.json, pnpm-lock.yaml |
| has_dockerfile | 否 |
| typed_language | 是 |
| bootstrap_files | — |
| has_devcontainer | 否 |
| has_linter_config | 否 |
| typecheck_configs | examples/scelar-auth-template/app/tsconfig.json, tsconfig.json |
| agent_commit_share | 0.01 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
面向模型的代码可读性
99优秀
评分方式
| 45/45 | 可类型检查的代码 — TypeScript（静态类型） |
| 53.9/55 | 可控的文件大小 — 采样的 313 个源文件中有 6 个超过 60KB |
所用输入
| primary_language | TypeScript |
| largest_source_bytes | 107,894 |
| source_files_sampled | 313 |
| oversized_source_files | 6 |
机器可读接口
40存在风险
评分方式
| 0/40 | API 模式（OpenAPI/GraphQL/proto） |
| 0/20 | MCP 服务器 |
| 40/40 | 可运行示例 — examples |
所用输入
| example_dirs | examples |
| has_mcp_signal | 否 |
| api_schema_files | — |
关键数据
158GitHub 星标
4贡献者
168最近 12 个月提交数
3距最近推送天数
25发布版本数
1巴士系数（bus factor）
7开放议题
npm软件包生态系统数
数据采集警告
- Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
- deps.dev does not index npm:@scelar/nodepod@1.9.12; advisories assessed against the repository dependency graph instead
更多细节
Star 与 Fork 历史 0 ★ / 41 ⇿
0Star
41Fork
25发布
每颗 star 和每个 fork 的添加时间，来自 GitHub 并按天汇总。累计增长位于其构成来源——每日新增——的正上方，二者可相互对照：稳定的自然增长与短暂的突增形态截然不同。当这一差别可被衡量时，它会作为增长真实性予以报告。
主版本 0次版本 8修订 17
OpenSSF Scorecard 3.0 / 10
3.0综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 0 | CI-Tests | 0 out of 1 merged PRs checked by a CI test -- score normalized to 0 |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/27 approved changesets -- score normalized to 0 |
| 3 | Contributors | project has 1 contributing companies or organizations -- score normalized to 3 |
| 10 | Dangerous-Workflow | no dangerous workflow patterns detected |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 9 | License | license file detected |
| 10 | Maintained | 30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10 |
| 不适用 | Packaging | packaging workflow not detected |
| 0 | Pinned-Dependencies | dependency not pinned by hash detected -- score normalized to 0 |
| 0 | SAST | SAST tool is not run on all commits -- score normalized to 0 |
| 0 | Security-Policy | security policy file not detected |
| 不适用 | Signed-Releases | no releases found |
| 0 | Token-Permissions | detected GitHub workflow tokens with excessive permissions |
| 0 | Vulnerabilities | 20 existing vulnerabilities detected |
直接依赖 9
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| npm | @noble/hashes | ^1.8.0 | package.json |
| npm | acorn | ^8.15.0 | package.json |
| npm | acorn-jsx | ^5.3.2 | package.json |
| npm | brotli | ^1.3.3 | package.json |
| npm | brotli-wasm | ^3.0.1 | package.json |
| npm | comlink | ^4.4.2 | package.json |
| npm | pako | ^2.1.0 | package.json |
| npm | resolve.exports | ^2.0.3 | package.json |
| npm | set-cookie-parser | ^3.1.1 | package.json |
全部依赖 未采集
本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [
"browser",
"nextjs",
"nodejs",
"runtime",
"typescript",
"webcontainers"
],
"is_fork": false,
"size_kb": 10246,
"has_wiki": false,
"homepage": "https://scelar.com/blog/introducing-nodepod",
"languages": {
"JavaScript": 58822,
"TypeScript": 2226529
},
"pushed_at": "2026-07-19T18:37:45Z",
"created_at": "2026-02-17T10:24:18Z",
"owner_type": "User",
"updated_at": "2026-07-21T22:38:29Z",
"description": "Node.js for inside the browser. An open-source, lightweight WebContainer alternative.",
"is_archived": false,
"is_disabled": false,
"license_spdx": null,
"default_branch": "main",
"license_spdx_raw": "NOASSERTION",
"primary_language": "TypeScript",
"significant_languages": [
"TypeScript"
]
},
"owner": {
"blog": "Im building these:",
"name": "Rick",
"type": "User",
"login": "R1ck404",
"company": null,
"location": "Earth",
"followers": 25,
"avatar_url": "https://avatars.githubusercontent.com/u/121722314?v=4",
"created_at": "2022-12-31T13:48:15Z",
"is_verified": null,
"public_repos": 17,
"account_age_days": 1299
},
"license": {
"state": "custom",
"spdx_id": null,
"raw_spdx": "NOASSERTION",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.9.9",
"kind": "patch",
"published_at": "2026-07-14T13:31:18Z"
},
{
"tag": "v1.9.8",
"kind": "patch",
"published_at": "2026-07-13T17:57:45Z"
},
{
"tag": "v1.9.7",
"kind": "patch",
"published_at": "2026-07-13T17:57:45Z"
},
{
"tag": "v1.9.6",
"kind": "patch",
"published_at": "2026-07-13T17:57:45Z"
},
{
"tag": "v1.9.5",
"kind": "patch",
"published_at": "2026-07-13T17:57:44Z"
},
{
"tag": "v1.8.2",
"kind": "patch",
"published_at": "2026-04-29T16:53:44Z"
},
{
"tag": "v1.8.1",
"kind": "patch",
"published_at": "2026-04-29T12:10:18Z"
},
{
"tag": "v1.8.0",
"kind": "minor",
"published_at": "2026-04-29T10:40:55Z"
},
{
"tag": "v1.7.4",
"kind": "patch",
"published_at": "2026-04-24T18:20:47Z"
},
{
"tag": "v1.7.3",
"kind": "patch",
"published_at": "2026-04-24T15:46:34Z"
},
{
"tag": "v1.7.2",
"kind": "patch",
"published_at": "2026-04-22T18:21:09Z"
},
{
"tag": "v1.7.1",
"kind": "patch",
"published_at": "2026-04-22T17:55:38Z"
},
{
"tag": "v1.7.0",
"kind": "minor",
"published_at": "2026-04-22T10:58:39Z"
},
{
"tag": "v1.6.0",
"kind": "minor",
"published_at": "2026-04-22T09:53:25Z"
},
{
"tag": "v1.5.0",
"kind": "minor",
"published_at": "2026-04-21T15:38:43Z"
},
{
"tag": "v1.4.0",
"kind": "minor",
"published_at": "2026-04-20T15:36:56Z"
},
{
"tag": "v1.3.0",
"kind": "minor",
"published_at": "2026-04-18T15:34:38Z"
},
{
"tag": "v1.2.0",
"kind": "minor",
"published_at": "2026-04-17T22:13:26Z"
},
{
"tag": "v1.1.1",
"kind": "patch",
"published_at": "2026-04-17T17:47:13Z"
},
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2026-04-17T17:05:47Z"
},
{
"tag": "v1.0.14",
"kind": "patch",
"published_at": "2026-04-14T14:44:51Z"
},
{
"tag": "v1.0.13",
"kind": "patch",
"published_at": "2026-04-14T13:31:56Z"
},
{
"tag": "v1.0.12",
"kind": "patch",
"published_at": "2026-04-14T13:07:22Z"
},
{
"tag": "v1.0.11",
"kind": "patch",
"published_at": "2026-04-14T12:08:17Z"
},
{
"tag": "v1.0.10",
"kind": "patch",
"published_at": "2026-04-14T11:36:16Z"
}
],
"recent_commits": [
{
"oid": "cd7c9861ff2f1cf1792fe4f693aabed32d03a896",
"body": "feat: Node-compatible import.meta.resolve and main",
"is_bot": false,
"headline": "Merge pull request #77 from R1ck404/import-meta-node-parity",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-07-19T18:37:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e7caf03add2ef8774a82eca0ec8f70ff4aa35126",
"body": "Co-authored-by: Rick <R1ck404@users.noreply.github.com>",
"is_bot": false,
"headline": "1.9.13",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-19T17:29:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a639ce11ba2788e02f37965e0e7d753d1120d0d7",
"body": "Cast the resolver function after construction so Object.defineProperty\nfor shared main does not trip TS2741 at the declaration site.\n\nCo-authored-by: Rick <R1ck404@users.noreply.github.com>",
"is_bot": false,
"headline": "fix: satisfy ResolverFn.main for TypeScript",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-19T17:29:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2ad4ee0257a23bc3841c8598d30a08c13c3fae06",
"body": "Expose resolve() and main on the ScriptEngine import.meta shim so\nESM entry modules match Node, and keep the regex import.meta rewrite\nout of string literals so Vite's import.meta.glob guards stay intact.\n\nCo-authored-by: Rick <R1ck404@users.noreply.github.com>",
"is_bot": false,
"headline": "feat: add Node-compatible import.meta.resolve and main",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-19T17:27:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1b008f53332bb3d8fd88c4d8366a2dc72249c057",
"body": null,
"is_bot": false,
"headline": "fix: support vite 8.1 import analysis",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-17T16:34:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd3e19b2ba078679f210b182def9b17999f0ce52",
"body": null,
"is_bot": false,
"headline": "ci: limit vitest worker concurrency",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-17T16:13:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bb45f1094793805d2ae4bc3f5df3d354d2f59b72",
"body": null,
"is_bot": false,
"headline": "fix: serialize napi wasm async work",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-17T16:09:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "38190370c5f0a8a931d852319ec7b76875321539",
"body": null,
"is_bot": false,
"headline": "feat: add preview inspector API",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-15T14:36:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df62efd79c06a3c5d7d8eda4acda894593cc59b3",
"body": null,
"is_bot": false,
"headline": "1.9.9",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-14T13:31:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "52bcfe65b9fb10e9d6d5e18f245448fcd2e1492e",
"body": "\r\nRoute native WASI workers through a tab-realm broker with CDN recovery for missing installed .wasm files. Give MemoryVolume hard-link inodes, symlink resolution, and binary snapshots that preserve modes and links. Order installer writes by depth and keep VFS chunk boundaries intact for large files.",
"is_bot": false,
"headline": "fix: WASI worker broker, inode-aware VFS, and WASM recovery",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-14T13:31:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0459e55b58838df8f5d59f489292cc9d4661ded9",
"body": null,
"is_bot": false,
"headline": "fix: improve install and preview reliability",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T23:56:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0d6d0ece2b951fd33fe5990884f3daba43d1fd63",
"body": null,
"is_bot": false,
"headline": "perf: report process startup benchmarks",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T20:43:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "215de671e29fe0e44a50362fe6f073a6cbf7b8ad",
"body": null,
"is_bot": false,
"headline": "perf: stream extracted package files",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T20:43:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0eb1fcbe806d3e271611b141472f171a594d7e53",
"body": null,
"is_bot": false,
"headline": "perf: persist dependency resolution graphs",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T20:43:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de0baadf68a8e1dff652fa984d80fb9fc853bf44",
"body": null,
"is_bot": false,
"headline": "perf: batch lazy filesystem metadata",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T20:43:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7285901e491ff7996270194c51a31a9903352b80",
"body": null,
"is_bot": false,
"headline": "perf: defer sqlite engine for package installs",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T20:43:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5e857a151e0c5aad3a84dd7bc2d0351b23882459",
"body": null,
"is_bot": false,
"headline": "perf: add opfs package storage",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T20:24:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3507a5b694558b579f8ce458c5edc9b5be421f14",
"body": null,
"is_bot": false,
"headline": "perf: cache resolution and transforms",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T20:24:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "75f69898de84c1755d759a86e959192472a961d1",
"body": null,
"is_bot": false,
"headline": "perf: stream package installation",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T20:24:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "45884397e65204dca9b6dba9d2ca29d17876cdc3",
"body": null,
"is_bot": false,
"headline": "perf: reuse lazy filesystem buffers",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T20:24:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c84edf9e06e7454d26359cfacff828264b05e291",
"body": null,
"is_bot": false,
"headline": "perf: mount cached package snapshots",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T20:24:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fb336e2cb5bcf6ec2978765b8fdad1465aa21dc0",
"body": null,
"is_bot": false,
"headline": "perf: reduce process startup work",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T20:23:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e9b77d4919de2733e7797c8cd04395ff3bd88cbe",
"body": null,
"is_bot": false,
"headline": "perf: add browser runtime benchmarks",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T20:22:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bafd955b22f9d524d567c4d8fb58e4a58a9f248b",
"body": null,
"is_bot": false,
"headline": "perf: reduce pod memory and resource retention",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T19:40:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d9d42849cff2f27dfc43f212e6a894c5a8e14723",
"body": null,
"is_bot": false,
"headline": "test: cover package-local file URL reads from CommonJS",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T17:57:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "63807e669ad7845e78b3da92b01011cfc94faec0",
"body": "Co-authored-by: Cursor <cursoragent@cursor.com>",
"is_bot": false,
"headline": "fix: raise SharedVFS entry cap to 65K and warn on directory drops",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T17:57:45Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "80e4d2f761b6dd023c7911865fda9649d11f60de",
"body": null,
"is_bot": false,
"headline": "1.9.6",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T17:57:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ae78b0915c558b29a40b70770c8b0fba4cba1052",
"body": "Record exact resolved deps in WASI worker bundles, validate WASM import tables, anchor instanceof Promise to the intrinsic constructor, fix callable CJS dynamic-import defaults, raise SharedVFS default to 256 MiB with sharedVFSBufferSize, and add the scelar auth template example.",
"is_bot": false,
"headline": "fix: harden napi-rs worker bundling and native Promise interop",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T17:57:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2f3b983488e72387a04647fe94600456a0bb5fc7",
"body": null,
"is_bot": false,
"headline": "fix: allow peerDependencies in version-resolver mock registry fixture",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T17:57:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "15c4d905121c95c8af62360a1e0b9ad4684d9cfa",
"body": null,
"is_bot": false,
"headline": "1.9.5",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T17:57:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ea4cf4d0707b55199fd135654dbdd7493cc25fa4",
"body": "…e major",
"is_bot": false,
"headline": "fix: resolve manifest direct deps before plugin peers hoist wrong vit…",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-13T17:57:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a241385bcffea4af1dae2fb64f765d5ba7537ac6",
"body": "Service worker v13 only proxies same-origin requests a preview document has positively claimed, so host routes are never hijacked. Replay server registrations queued before SW init. Update the Better Auth example to mount auth as Vite middleware.",
"is_bot": false,
"headline": "fix: route stripped preview traffic via pod self-claims (v1.9.4)",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-09T12:05:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4c602fad2581f5a7e44880d2ad5499d7426b5c5c",
"body": "\r\nSeed path claims on virtual preview navigations and resolve referer paths by walking up to parent claims so fetch() calls from nested routes reach the pod.",
"is_bot": false,
"headline": "fix: route stripped preview subresources via path-claim prefix walk",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-08T14:08:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d604c94275814b2e202c794b230f31992fb35b88",
"body": "\r\nDrop package-specific route 6 and keep generic preview routing via path claims and referer matching.",
"is_bot": false,
"headline": "fix: remove hardcoded /api/auth routing from service worker",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-08T13:36:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "324756c2d397177eb3f35bbd3a9d1f1163741427",
"body": "\r\nStop SW route 4b from falling through to the host when clientId is present but unregistered. Add /api/auth fallback routing and always inject Origin on mutating proxy requests.",
"is_bot": false,
"headline": "fix: route Better Auth API calls through preview pod on shared port",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-08T13:34:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4f81a8e7d1172b57f5780f5a170099b44c818248",
"body": "\r\nSQLite WASM preload writes use writeCacheSync and internal-path filters so fs.watch and cross-worker sync skip /.nodepod/**. SW route 4b also proxies referer-matched API calls when clientId is empty (Firefox race). Releases v1.9.2.",
"is_bot": false,
"headline": "fix: hide /.nodepod runtime cache from user VFS watch",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-08T12:25:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f300b66e796aaace37d32077c06b553d528f76c4",
"body": "\r\nWorkers warm wa-sqlite during init via a main-thread fetch handshake, so sync DatabaseSync use in vite.config.ts works without await preloadSqlite(). Adds repro example, sync-wait tests, and releases v1.9.1.",
"is_bot": false,
"headline": "fix: auto-preload node:sqlite WASM in process workers",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-08T12:11:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "63bffb165b29c4fe0617d5add8cf3bbf666aa531",
"body": null,
"is_bot": false,
"headline": "chore: release v1.9.0 with type fixes and repo metadata",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-08T11:17:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "63f3ad633a0ad41632db884a82b879f8ac41a800",
"body": "\r\nAdd SW and RequestProxy cookie jars, Fetch Request/Response class parity, setFetchResponse bridge, cross-worker HTTP client, and a Vite React Router Better Auth demo example.",
"is_bot": false,
"headline": "fix: virtual cookie sessions with generic Fetch and Node parity",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-08T11:13:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3be1dbe72392203beaa86942ddf841f5a6e6b80b",
"body": "\r\nImplement wa-sqlite-backed DatabaseSync, fix spawn argv and exit stdout merge, keep async scripts alive until WASM/callbacks finish, and add sqlite-test and better-auth-vite demos.",
"is_bot": false,
"headline": "Add node:sqlite polyfill, spawn output fixes, and new examples.",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-06T14:47:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9e331d2f696dc969ee5713e27b69d85ede95bed0",
"body": "\r\nReplace the direct rollup type import with a local BuildAsset shape so tsc passes in CI where rollup is only a transitive vite dependency.",
"is_bot": false,
"headline": "fix: type-check vite test without rollup dependency",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-06T08:50:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b3c9e712c244df082bdd6bb62347c758a4e070a",
"body": "\r\nExclude node_modules from per-spawn VFS snapshots with on-demand fs proxy fallback, transform packages on first require() instead of at install time, and persist tarballs plus binary snapshots in IndexedDB.\r\n\r\nAdd SharedVFS hash lookup and compaction, bounded worker transform LRU caches, async WASM module loading, unified esbuild boot preload, and an externalized worker bundle. Record CoW shared VFS spike as NO-GO and expand tests for lazy VFS, transforms, snapshots, and WASM cache.",
"is_bot": false,
"headline": "perf: lazy installs, lean spawn snapshots, and WASM caches",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-06T08:48:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d45e6bfa3d65f1393515a0da3196d07395cc7167",
"body": "\r\nLand plans 001-010 from the full-repo audit: real sync crypto digests,\r\nservice worker security hardening, tarball zip-slip guards, unified CORS\r\nallowlist enforcement, scoped HTTP callback drain with timeouts, fs.openSync\r\nnumeric flags, StringDecoder/Buffer/hrtime fidelity fixes, ProcessHandle output\r\ncaps, and README/SDK cleanup with zod removed.\r\n\r\nSwitch development and CI to pnpm, add plans 011-020 for memory and\r\nperformance work, and expand test coverage for the changed surfaces.",
"is_bot": false,
"headline": "fix: implement audit remediation and add performance plans",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-07-02T12:56:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d57a8667345c879df2ca2957f7601357e2a4a32f",
"body": null,
"is_bot": false,
"headline": "ci: type-check, build, and test on push (#61)",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-06-19T14:57:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "90ce134b20b0920bd3a9572bb8252128eb8a7ba5",
"body": "…2 #66 #68)",
"is_bot": false,
"headline": "fix: timer teardown, raw ctrl+c, node -e loop, and perf_hooks (#45 #6…",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-06-19T14:57:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "925892128e09ebb25803f38b7a970c6f36dac14d",
"body": null,
"is_bot": false,
"headline": "1.8.2",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-29T16:53:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "57abd30a766950bc4aaa6f50dd6c7d394d1e0f8f",
"body": "fix: route wasi fs proxy via messageport for chrome (#54)",
"is_bot": false,
"headline": "Merge pull request #63 from ScelarOrg/fix/chrome-vite-rolldown-hang",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-29T16:51:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c227de9c3189a5b954d19faac48f26957b20eb88",
"body": "vite 8 + react + tailwind v4 still hung in chrome (issue #54 was only fixed\nfor firefox). two chrome quirks behind it:\n\n1. broadcastchannel postmessage from a blob-url web worker doesnt deliver\n to the main tab subscriber, even same-origin and cross-origin-isolated.\n firefox does deliver it.\n2. \n[…]\n.unref() for wasi workers. napi-rs calls it intentionally\n to mirror node behavior where the http server keeps the loop alive, but\n in nodepod the spawned process loop drains before vite even binds.",
"is_bot": false,
"headline": "fix: route wasi fs proxy via messageport for chrome (#54)",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-29T16:25:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "986311e571dcf7d87ab48f04426b71106136e095",
"body": null,
"is_bot": false,
"headline": "1.8.1",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-29T12:10:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6fa911cf601f08d9ad9f40ae2d496a9ea5715c26",
"body": "Fix/vite hmr websocket",
"is_bot": false,
"headline": "Merge pull request #60 from ScelarOrg/fix/vite-hmr-websocket",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-29T11:50:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b4f9fea29391fa155294aef96647a5997e95e36",
"body": "the location patch added in #51 strips the /__virtual__/{id}/{port}\nprefix from location.pathname before any inline script runs, so the\nws shims regex came up empty and _previewPort stayed at 0. the shim\nthen fell through to the URLs literal port, which for vite hmr is\nthe page port (3333) not the d\n[…]\nnd vite gave up reconnecting\n\nbake the port into the shim as a numeric literal at SW injection\ntime instead. proxyToVirtualServer already has it in scope as\nserverPort, just hand it to getWsShimScript",
"is_bot": false,
"headline": "fix: route vite hmr ws to the virtual server port",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-29T11:29:33Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0f87f71f65b3a62cdf4b3489a835d9d9d3b1b422",
"body": "boots vite 8 + react inside nodepod, wraps WebSocket from inside\nthe iframe so hmr connection events are visible from the host page,\nand rewrites App.tsx via pod.fs.writeFile to check whether edits\napply without a full reload. counter state survives on real hmr,\nresets to zero on a vite give-up reload so we can tell them apart",
"is_bot": false,
"headline": "example: vite hmr ws test",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-29T11:29:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "17909d579dc982124301ceaef1d4055da9021531",
"body": null,
"is_bot": false,
"headline": "1.8.0",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-29T10:40:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "15ada72583ee16a405d22569e88434268f9fd2c7",
"body": "Fix/issue 56 typebox 1x",
"is_bot": false,
"headline": "Merge pull request #58 from ScelarOrg/fix/issue-56-typebox-1x",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-29T10:38:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0a97d8a030e17be43ed7a3d62164188aff6a7959",
"body": null,
"is_bot": false,
"headline": "merge main into fix/issue-56-typebox-1x",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-29T10:37:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1d14c5963ee2cae3eba85d56a27d0dd6d55b0856",
"body": "three layered bugs surfaced from issue #56:\n\n1. TDZ on Object.defineProperty when user code shadows Object/Array/etc\n (eg typebox `import { Object }` or `export class Object`). marker\n now lives in the wrapper's outer scope so user-scope shadowing cant\n trip it.\n\n2. `export * as X from 'mod'` \n[…]\nz-repro.test.ts\ncover all three patterns plus interop preservation (esm modules still\nget __esModule, cjs ones dont).\n\nalso fixes a path bug in the inline ESM example that was unrelated to\nthe loader.",
"is_bot": false,
"headline": "fix: typebox 1.x and circular ESM loading (#56)",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-29T10:33:45Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7d9fbdffa7174dc2d98b2432313f39a95a9fa604",
"body": "feat: add terminal custom command support",
"is_bot": false,
"headline": "Merge pull request #55 from Qainguin/feat/custom-commands",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-29T09:59:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c821cb5eb0b2d8afcead3bad0cb44ec91595f821",
"body": "Fix/issue 54 tailwind v4",
"is_bot": false,
"headline": "Merge pull request #57 from ScelarOrg/fix/issue-54-tailwind-v4",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-29T09:58:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fcc37b15184a1731f17cc8a8978880af4543ad52",
"body": "tailwind v4 oxide and other rayon-using napi-rs WASM packages call fs\nfrom inside a Web Worker. the worker's __fsSyncCall used to post to its\nparent (the spawned process worker emulating Node) and Atomics.wait, but\nduring oxide.scan() the parent's JS thread is in synchronous WASM and\ncant drain its \n[…]\n stuck in sync WASM) subscribes and\nservices the request directly against MemoryVolume. parent's onmessage\nqueue is no longer in the critical path.\n\nalso humanizes the comments touched in this branch.",
"is_bot": false,
"headline": "fix: route WASI worker fs ops through BroadcastChannel (#54)",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-29T09:54:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "069e3b862d160a14517da3013fde741ae66dc6dd",
"body": "scaffolds an example that exercises the typebox 1.x TDZ regression and a\nmatching unit test in src/__tests__.",
"is_bot": false,
"headline": "example: typebox 1.x reproduction (#56)",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-29T09:34:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8a146ae1bbac33eec0b775fe9599bb545aef6ef",
"body": "* New examples/tailwind-v3-test/: reproduces the user's ai-landing\n template (tailwindcss v3 + postcss + autoprefixer + react 18, with\n vite 7 and vite 8 variants). Verifies the polyfill fixes end-to-end.\n An opt-in diagnostic probe (window.__nodepodTailwindV3Probe = true)\n invokes tailwindcss c\n[…]\n hangs at WASI worker pool init (separate issue\n in the napi-rs/emnapi worker bootstrap layer); the probe stays in\n place so the next investigation has fresh data.\n\n* serve.js: link the new example.",
"is_bot": false,
"headline": "example: add tailwind v3 reproduction + v4 diagnostic probes",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-29T08:25:11Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f1864b97cbb7179c75a00021d3b43e71ff128ccb",
"body": "…(#54)\n\nThree generic polyfill correctness fixes that together unblock Tailwind v3\n(and any other glob-based tooling) running inside nodepod:\n\n* path.dirname / path.basename: rewritten to match Node.js's path.posix\n algorithm exactly (find the last meaningful slash, slice -- never\n normalize the i\n[…]\nt.\n* SW request timeout 30s -> 300s, aligned with HTTP_DISPATCH_SAFETY so\n cold WASI workers (tailwind v4 oxide, rolldown) don't get cut off\n prematurely on first request.\n\nTest suite: 583/583 pass.",
"is_bot": false,
"headline": "fix: posix-correct path.dirname/basename + url-aware path resolution …",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-29T08:25:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "94669d1e20c354d6f60ed9250d9d03215076720a",
"body": "The Dirent flattening fix unblocks @tailwindcss/oxide-wasm32-wasi but\nthe first request to /src/index.css now takes ~2-4 minutes in nodepod\nunder Vite 8 because Tailwind has to compile its napi-rs WASM, init\nemnapi's worker pool, and run an initial content scan, all while\nrolldown is concurrently st\n[…]\n 300s\nso the example doesn't FAIL prematurely while Tailwind is still\nwarming up.\n\nThis is the second of two changes for issue #54; the first was the\nDirent type-info forwarding fix in commit e797426.",
"is_bot": false,
"headline": "fix: extend HTTP dispatch ceiling so tailwind v4 first request can land",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-28T11:46:39Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e797426ea79b77652c8b0b9b8bfaa9aef4469593",
"body": "Tailwind v4's @tailwindcss/vite plugin pulls in @tailwindcss/oxide-\nwasm32-wasi, which scans the workspace for class candidates from a\nrayon worker pool. The scanner calls fs.readdirSync with\n{withFileTypes:true} via the napi worker's __fsSyncCall SAB bridge.\n\nThree bugs combined to make every dev-s\n[…]\nDirectory/... in the worker stub, and threads\nwithFileTypes:true through fd_readdir so d_type is set correctly\n(3 = DIRECTORY, 4 = REGULAR_FILE, 7 = SYMBOLIC_LINK).\n\nAll 573 existing tests still pass.",
"is_bot": false,
"headline": "fix: forward Dirent type info across the napi worker FS bridge (#54)",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-28T08:57:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "c37084e60a083f627c881d9c1bcaa751985814a0",
"body": "Mirrors the reporter's flow: boot pod with workdir=/app, mount Vite\n+ React-TS project via pod.fs.writeFile, npm install, npm run dev,\npoint an iframe at the url from onServerReady. Three buttons cover\ntailwind v4 + vite 7, tailwind v4 + vite 8, and plain css (reporter's\n\"this works\" baseline). Probes root, src/index.css, and the dep-\noptimized chunk so the failure mode (vite ready -> 504 on requests)\nis visible.",
"is_bot": false,
"headline": "example: add issue-54 tailwind v4 reproduction",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-28T08:57:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7f0761513e71a7d2978ee2a0a72e5f8c91751f42",
"body": "- Allow Nodepod terminals to run custom JS commands\n- Add completion support and a demo example",
"is_bot": false,
"headline": "Add terminal custom command support",
"author_name": "Qainguin",
"author_login": "Qainguin",
"committed_at": "2026-04-27T23:06:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3e7f83a94ed7d28ab6200806392fb5f0f584ac7e",
"body": null,
"is_bot": false,
"headline": "1.7.4",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-24T18:20:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b86d7aea661c652c84a00dbd19fa90b7428baae0",
"body": "fix: transparent virtual-prefix url for preview iframes",
"is_bot": false,
"headline": "Merge pull request #51 from ScelarOrg/fix/virtual-location-transparent",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-24T18:20:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "942dc52c597206fc3da6a7924d0f5dcc196049ad",
"body": "client-side routers (react-router, vue-router, sveltekit, etc) read\nlocation.pathname to pick a route. iframes served by the SW live at\n/__virtual__/{id}/{port}/ so every router saw that prefix and matched\nnothing. the reporter was working around it by injecting a basename\ninto every user app.\n\ncan'\n[…]\nin the outer app can't accidentally get\nrouted into a pod.\n\nmap is bounded to 512 entries with oldest-out eviction.\n\nadded examples/issue-44-react-router-basename as a repro, all 573\ntests still pass.",
"is_bot": false,
"headline": "fix: transparent virtual-prefix url for preview iframes",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-24T18:18:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "95c088929d75f70c78e449b56f978e15c18702ae",
"body": "fix: clear terminal scrollback with shell \"clear\"",
"is_bot": false,
"headline": "Merge pull request #50 from Qainguin/fix/clear",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-24T18:03:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "921b04974db755ff38222b4b6369dd4de4c09908",
"body": null,
"is_bot": false,
"headline": "Clear scrollback with shell 'clear'",
"author_name": "Qainguin",
"author_login": "Qainguin",
"committed_at": "2026-04-24T16:14:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f7190eec34ffa340520e5b7aa0a501b752ee9baf",
"body": null,
"is_bot": false,
"headline": "1.7.3",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-24T15:46:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d294be1f4e9b3c434ff11bf7ed6bff2b5a7bc2d4",
"body": "feat: add @xterm/addon-serialize integration",
"is_bot": false,
"headline": "Merge pull request #48 from Qainguin/feat/serialize",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-24T15:45:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "639ad47dc8becd7743d4aff508a081d6c0b75c52",
"body": "fix: native node parity for spawn/exit/esbuild inside nodepod",
"is_bot": false,
"headline": "Merge pull request #49 from ScelarOrg/fix/issue-44-native-node-parity",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-24T15:42:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ea33f7e96a1bd77d2d1fa4181642b93df4f25f69",
"body": "three bugs making vite dev server exit early or lose args when run\ninside a nodepod instance:\n\n1. esbuild.build() registered its handle after await initialize(), so\n the cdn import inside wasn't tracked by the registry and the loop\n could drain mid-await. vite 7 hit this during config bundling a\n[…]\nan already-exited process). call worker.terminate()\n right after emitting exit, both the immediate and deferred paths.\n\nadded examples/issue-44-react-dev-server as a repro. all 573 tests\nstill pass.",
"is_bot": false,
"headline": "fix: native node parity for spawn/exit/esbuild inside nodepod",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-24T15:41:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f04bca124f9f9d26e2380240860760b45a6f1260",
"body": null,
"is_bot": false,
"headline": "Added @xterm/addon-serialize integration",
"author_name": "Qainguin",
"author_login": "Qainguin",
"committed_at": "2026-04-24T15:10:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "dde932e591bdcc6d424ff850c18f44fb3ecd6f94",
"body": "fix(esm-transform): support `export * as Name` from namespace re-exports",
"is_bot": false,
"headline": "Merge pull request #47 from livesession/fix/export-star-as-namespace",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-24T10:30:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "505f4adf5c097f844cc6f8645c69be91686a89d0",
"body": null,
"is_bot": false,
"headline": "fix(esm-transform): support export * as Name from namespace re-exports",
"author_name": "Patryk Zdunowski",
"author_login": "zdunecki",
"committed_at": "2026-04-23T22:02:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2bf51fda701efe390f916e804d297e5da671ad85",
"body": null,
"is_bot": false,
"headline": "1.7.2",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-22T18:21:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d7249b96546fabfeada4c9eb52b2dc14fe47289b",
"body": "Both `InstallFlags.registry` and the `--registry` CLI flag were non-functional:\nthe field was declared but never read, and the shim's arg parser didn't look\nfor --registry at all, so both silently fell back to the default npm registry.\n\n- installer.ts: honor flags.registry in install() and installFr\n[…]\ncting a per-call RegistryClient when set, else use the instance's.\n- polyfills/child_process.ts: parse `--registry=<url>` and `--registry <url>`\n in installPackages() and thread it into InstallFlags.",
"is_bot": false,
"headline": "Merge pull request #40 from Qainguin/fix/npm-registry",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-22T18:13:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a1e97d3043c95cff565ad1f50188dbae8c3ed819",
"body": "The prerelease guard in satisfiesRange only checks whether the range\nstring has a dash somewhere:\n\n if (sv.prerelease && !range.includes(\"-\")) return false;\n\nIf the range has any prerelease comparator, like >=4.0.0-beta.0, the\nguard lets prereleases from unrelated major.minor.patch tuples through.\n\n[…]\n is a prerelease, look for version literals in\nthe range and only pass the guard if at least one of them is a\nprerelease with the same major.minor.patch as the candidate. That's\nwhat node-semver does.",
"is_bot": false,
"headline": "Merge pull request #41 from livesession/fix/npm-install",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-22T18:10:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "013664e5fb2caef335b96d657992b01d200fb58a",
"body": null,
"is_bot": false,
"headline": "1.7.1",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-22T17:55:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "57cc9f99936cec98b0000fb15d104477f802ac41",
"body": "fix: multi-tab SW routing, chrome delete+reload hang, hard refresh hang",
"is_bot": false,
"headline": "Merge pull request #42 from ScelarOrg/fix/multi-boot-sw-multiplexing",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-22T17:53:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a382e354bfb2b9678fb2ffc45c37d8460d2786e1",
"body": "one SW shared across tabs was blowing up in a few ways:\n\n- each tab's init() overwrote the SW's global port so fetches for Tab\n A's instance landed on Tab B's RequestProxy and 503'd with \"No server\n on {id}/{port}\". SW now keeps a MessagePort map per instanceId\n- on chrome, unregister + reload lef\n[…]\n, pagehide\nfires release-all so closed tabs drop their routing entries instead of\ntiming out for 30s on the next fetch, examples/multi-boot-race\nreproducer, integration test for the multi-tenant paths",
"is_bot": false,
"headline": "fix: multi-tab SW routing, chrome delete+reload hang, hard refresh hang",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-22T17:42:23Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9298040dd54a718b98600f18db11bfce9832d099",
"body": null,
"is_bot": false,
"headline": "fix(npm-install): fix prerelease semver matching to match npm behavior",
"author_name": "Patryk Zdunowski",
"author_login": "zdunecki",
"committed_at": "2026-04-22T16:35:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "292bd8f61e489fc359adec2f9b18e2567abb1aa8",
"body": " Pre-release versions like 5.0.0-next.0 were incorrectly matching ranges like >=4.0.0-beta.0 because the check only looked for a - anywhere in the range string. Now prerelease candidates only match when the\n range contains a prerelease tag for the same major.minor.patch, matching npm's semantics.",
"is_bot": false,
"headline": "fix(npm-install): fix prerelease semver matching to match npm behavior",
"author_name": "Patryk Zdunowski",
"author_login": "zdunecki",
"committed_at": "2026-04-22T16:32:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8a31d0dae05eec271028e19d922a84298b58f7bc",
"body": null,
"is_bot": false,
"headline": "Make --registry flag and the registry flag in InstallOptions work.",
"author_name": "Qainguin",
"author_login": "Qainguin",
"committed_at": "2026-04-22T14:17:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af316be1f7039da6f7d5e85c9ef09f20bde98cff",
"body": null,
"is_bot": false,
"headline": "1.7.0",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-22T10:58:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3f938bbf898dac82771f7d8775e105256b6295fc",
"body": "previously Nodepod.boot() hard-threw when SAB was missing which broke any host without COOP/COEP headers. now theres an explicit flag you can set to false and boot still succeeds with a warn. missing SAB at runtime also degrades gracefully instead of crashing.\n\nfeatures that need SAB auto-disable wh\n[…]\nback to async message passing\n\ndefaults to true so existing code keeps working exactly as-is. adds isSharedArrayBufferEnabled getter, a new example at examples/sab-opt-out, and 3 tests. related to #36",
"is_bot": false,
"headline": "feat(sdk): add enableSharedArrayBuffer opt-out flag",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-22T10:53:50Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "39c29215b8a8f8437238db4bb8d8e44875f37f9a",
"body": null,
"is_bot": false,
"headline": "1.6.0",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-22T09:53:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "94cd75926c1b5311ee22be3dbbf5b56139956642",
"body": "exposes nodepod.sharedFSBuffer and Nodepod.attachFS(buffer) so workers\nthe host app spawns (not ones from nodepod.spawn) can read the VFS\ndirectly without postMessage per call. returned client is read-only,\nwrites throw ENOTSUP and should be routed back to the booting thread\nover a MessagePort.\n\ncov\n[…]\n + readdirSync on reader\n- src/threading/vfs-bridge.ts: relative to absolute in watch callback\n- src/__tests__/shared-vfs.test.ts: 40 tests incl cross-thread\n- examples/shared-fs-attach: runnable demo",
"is_bot": false,
"headline": "feat(sdk): add Nodepod.attachFS for sibling-worker VFS access",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-22T09:51:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0e30719b0a6429afcfb5704be2f3f28a70d9c27f",
"body": null,
"is_bot": false,
"headline": "1.5.0",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-21T15:38:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4e01f7254d1ab3c07930f9c02fc723a8fa34918d",
"body": "typed handle registry with O(1) refed count, drain promise, and\nbeforeExit emission. migrates timers, fs.watch, net, http, ws,\nworker_threads, child_process, fetch, and readline to register\ntyped handles so top-level await waits on pending resources before\nexit instead of racing them.\n\nalso adds process.getActiveResourcesInfo and an exit-semantics\ntest suite.",
"is_bot": false,
"headline": "feat(event-loop): add libuv-parity HandleRegistry",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-21T15:38:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "204f4bf12045283a3333a24c686b615ec238cb9c",
"body": null,
"is_bot": false,
"headline": "1.4.0",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-20T15:36:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed395cc2b81be16f2ef5790253313532cb41b7ac",
"body": "feat: propagate terminal size to process.stdout (#26)",
"is_bot": false,
"headline": "Merge pull request #33 from ScelarOrg/feat/terminal-resize",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-20T15:18:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d124c76b83ad8123c0c38bf1b6cc6113728d9a85",
"body": "turns out I was firing 'resize' on stdin and writing columns/rows to it,\nwhich real Node doesn't do. stdin is a tty.ReadStream, it has no\ncolumns/rows and never emits resize, only tty.WriteStream does.\n\n- fabricateStream only installs the resize-emitting accessors on output\n streams now, stdin is left as plain data props\n- dropped the stdin.columns/rows writes in child_process\n- notifyTerminalResize skips stdin, stdout+stderr only\n- tests lock in that stderr fires resize and stdin does not",
"is_bot": false,
"headline": "fix: match node's tty semantics for resize",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-20T15:12:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "778351e3419cbea1fa6559daafd1ef0559b08a1c",
"body": "wires NodepodTerminal's FitAddon up to the worker so xterm reflows\nactually reach the running script. process.stdout / stderr / stdin get\na real 'resize' event whenever cols or rows change, which is what\nblessed, ink, prompts etc. listen for.\n\n- new onResize hook on TerminalWiring, debounced (~80ms)\n[…]\nrocess keeps a set of active node procs so the worker can push\n size updates to every running script on SIGWINCH-style resizes\n- added a terminal-resize example with a tiny TUI that redraws on resize",
"is_bot": false,
"headline": "feat: propagate terminal size to process.stdout",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-20T14:57:30Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "795bf034d2dc332187d4ce5a191149bcd66755e2",
"body": null,
"is_bot": false,
"headline": "1.3.0",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-18T15:34:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c5a025eee629685c6ce775416a1b1cf085e5e33d",
"body": "Feat/terminal tab autocomplete",
"is_bot": false,
"headline": "Merge pull request #32 from ScelarOrg/feat/terminal-tab-autocomplete",
"author_name": "Rick",
"author_login": "R1ck404",
"committed_at": "2026-04-18T15:33:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6d9192ca4591f74d3e48d95bb34767550c585d2c",
"body": null,
"is_bot": false,
"headline": "feat: terminal tab autocomplete",
"author_name": "Rick Huijser",
"author_login": "R1ck404",
"committed_at": "2026-04-18T15:26:59Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 25,
"commits_last_year": 168,
"latest_release_at": "2026-07-14T13:31:18Z",
"latest_release_tag": "v1.9.9",
"releases_from_tags": true,
"days_since_last_push": 3,
"active_weeks_last_year": 10,
"days_since_latest_release": 8,
"mean_days_between_releases": 9
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 57,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "@scelar/nodepod",
"exists": true,
"license": "MIT WITH Commons-Clause",
"keywords": [
"node",
"browser",
"runtime",
"sandbox",
"typescript",
"virtual-filesystem",
"polyfill",
"webcontainer",
"in-browser",
"nodejs"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/@scelar/nodepod",
"is_deprecated": false,
"latest_version": "1.9.12",
"repository_url": "https://github.com/R1ck404/Nodepod",
"versions_count": 43,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 6174,
"first_published_at": "2026-03-02T17:25:42.141000Z",
"latest_published_at": "2026-07-17T17:26:56.549000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 5
}
]
},
"popularity": {
"forks": 41,
"stars": 158,
"watchers": 1,
"fork_history": {
"days": [
{
"date": "2026-03-05",
"count": 1
},
{
"date": "2026-03-08",
"count": 2
},
{
"date": "2026-03-09",
"count": 1
},
{
"date": "2026-03-16",
"count": 2
},
{
"date": "2026-03-17",
"count": 1
},
{
"date": "2026-03-26",
"count": 2
},
{
"date": "2026-03-28",
"count": 1
},
{
"date": "2026-03-30",
"count": 1
},
{
"date": "2026-03-31",
"count": 1
},
{
"date": "2026-04-03",
"count": 1
},
{
"date": "2026-04-04",
"count": 1
},
{
"date": "2026-04-08",
"count": 1
},
{
"date": "2026-04-09",
"count": 1
},
{
"date": "2026-04-11",
"count": 1
},
{
"date": "2026-04-14",
"count": 2
},
{
"date": "2026-04-18",
"count": 1
},
{
"date": "2026-04-22",
"count": 1
},
{
"date": "2026-04-23",
"count": 1
},
{
"date": "2026-04-26",
"count": 1
},
{
"date": "2026-04-28",
"count": 1
},
{
"date": "2026-05-17",
"count": 1
},
{
"date": "2026-05-20",
"count": 1
},
{
"date": "2026-05-25",
"count": 1
},
{
"date": "2026-05-27",
"count": 1
},
{
"date": "2026-06-01",
"count": 2
},
{
"date": "2026-06-04",
"count": 1
},
{
"date": "2026-06-19",
"count": 1
},
{
"date": "2026-06-23",
"count": 1
},
{
"date": "2026-06-26",
"count": 1
},
{
"date": "2026-06-30",
"count": 1
},
{
"date": "2026-07-01",
"count": 1
},
{
"date": "2026-07-05",
"count": 1
},
{
"date": "2026-07-20",
"count": 1
},
{
"date": "2026-07-22",
"count": 1
}
],
"complete": true,
"collected": 39,
"total_forks": 41
},
"star_history": null,
"open_issues_and_prs": 8
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"examples"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [
"examples/scelar-auth-template/app/tsconfig.json",
"tsconfig.json"
],
"toolchain_manifests": [],
"largest_source_bytes": 107894,
"source_files_sampled": 313,
"oversized_source_files": 6,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": null,
"source": null,
"findings": [],
"collected": false,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 0,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "@noble/hashes",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.8.0"
},
{
"name": "acorn",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^8.15.0"
},
{
"name": "acorn-jsx",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^5.3.2"
},
{
"name": "brotli",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.3.3"
},
{
"name": "brotli-wasm",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^3.0.1"
},
{
"name": "comlink",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^4.4.2"
},
{
"name": "pako",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^2.1.0"
},
{
"name": "resolve.exports",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^2.0.3"
},
{
"name": "set-cookie-parser",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^3.1.1"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 36,
"open_issues": 7,
"closed_ratio": 0.788,
"closed_issues": 26,
"closed_unmerged_prs": 6
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "R1ck404",
"commits": 157,
"avatar_url": "https://avatars.githubusercontent.com/u/121722314?v=4"
},
{
"type": "User",
"login": "Qainguin",
"commits": 7,
"avatar_url": "https://avatars.githubusercontent.com/u/94211064?v=4"
},
{
"type": "User",
"login": "zdunecki",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/18244904?v=4"
},
{
"type": "User",
"login": "wysisoft",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/15177964?v=4"
}
],
"contributors_sampled": 4,
"top_contributor_share": 0.935
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"ci.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json",
"pnpm-lock.yaml"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 0,
"reason": "0 out of 1 merged PRs checked by a CI test -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/27 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 3,
"reason": "project has 1 contributing companies or organizations -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 9,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "20 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "cd7c9861ff2f1cf1792fe4f693aabed32d03a896",
"ran_at": "2026-07-23T00:52:49Z",
"aggregate_score": 3,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-19T18:56:00Z",
"oldest_open_prs": [
{
"number": 71,
"created_at": "2026-06-26T14:46:49Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-07-19T18:37:45Z",
"ci_last_conclusion": "FAILURE",
"oldest_open_issues": [
{
"number": 20,
"created_at": "2026-04-13T14:58:30Z",
"last_comment_at": "2026-04-27T18:53:01Z",
"last_comment_author": "yzuyr"
},
{
"number": 31,
"created_at": "2026-04-18T13:35:22Z",
"last_comment_at": "2026-04-22T12:32:40Z",
"last_comment_author": "R1ck404"
},
{
"number": 54,
"created_at": "2026-04-27T10:43:43Z",
"last_comment_at": "2026-04-29T19:59:49Z",
"last_comment_author": "saadalimalik-unstuck"
},
{
"number": 65,
"created_at": "2026-05-01T11:44:33Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 67,
"created_at": "2026-05-23T18:20:54Z",
"last_comment_at": "2026-06-30T16:33:30Z",
"last_comment_author": "ndingwan"
},
{
"number": 70,
"created_at": "2026-06-22T08:33:32Z",
"last_comment_at": "2026-06-26T13:12:38Z",
"last_comment_author": "ndingwan"
},
{
"number": 74,
"created_at": "2026-06-29T07:50:12Z",
"last_comment_at": "2026-06-30T07:04:41Z",
"last_comment_author": "ndingwan"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/R1ck404/Nodepod",
"host": "github.com",
"name": "Nodepod",
"owner": "R1ck404"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 59,
"inputs": {
"security": 30,
"vitality": 78,
"community": 58,
"governance": 55,
"engineering": 65
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "good",
"name": "Vitality",
"value": 78,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 71,
"inputs": {
"commits_last_year": 168,
"human_commit_share": 1,
"days_since_last_push": 3,
"active_weeks_last_year": 10
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 3 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 3
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "10/52 weeks with commits",
"points": 6.9,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 10
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "168 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 168
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 88,
"inputs": {
"releases_count": 25,
"latest_release_tag": "v1.9.9",
"releases_from_tags": true,
"days_since_latest_release": 8,
"mean_days_between_releases": 9
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "25 version tags (no GitHub releases)",
"points": 16.2,
"status": "partial",
"details": [
{
"code": "version_tags_no_releases",
"params": {
"count": 25
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 8 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 8
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~9 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 9
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 58,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 49,
"inputs": {
"forks": 41,
"stars": 158,
"watchers": 1,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "158 stars",
"points": 35.6,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 158
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "41 forks",
"points": 13.4,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 41
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "1 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 1
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "license file present, not a recognized license",
"points": 16.9,
"status": "partial",
"details": [
{
"code": "license_custom",
"params": {}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 63,
"inputs": {
"packages": [
"@scelar/nodepod"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 6174
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "6,174 downloads/month across npm",
"points": 50.5,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 6174,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 55,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 19,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 4,
"top_contributor_share": 0.935
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 94% of commits",
"points": 1.5,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 94
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "4 contributors",
"points": 5.4,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 4
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 3,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"merged_prs": 36,
"open_issues": 7,
"closed_issues": 26,
"issue_closed_ratio": 0.788,
"closed_unmerged_prs": 6
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "79% of issues closed",
"points": 36.8,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 79
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "36/42 decided PRs merged",
"points": 32.8,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 36,
"decided": 42
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/27 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 46,
"inputs": {
"followers": 25,
"owner_type": "User",
"is_verified": null,
"owner_login": "R1ck404",
"public_repos": 17,
"account_age_days": 1299
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "25 followers of R1ck404",
"points": 10.2,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 25,
"login": "R1ck404"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "17 public repos, account ~3 yr old",
"points": 16.3,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 17
}
},
{
"code": "account_age_years",
"params": {
"years": 3
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"@scelar/nodepod"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 5
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 5 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 5
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "43 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 43
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 65,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "at_risk",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 48,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "1 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 1
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "0 out of 1 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"topics": [
"browser",
"nextjs",
"nodejs",
"runtime",
"typescript",
"webcontainers"
],
"has_wiki": false,
"homepage": "https://scelar.com/blog/introducing-nodepod",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://scelar.com/blog/introducing-nodepod",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "6 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 6
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 30,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 30,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 3
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "0 out of 1 merged PRs checked by a CI test -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/27 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 1 contributing companies or organizations -- score normalized to 3",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 10 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "20 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 4
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 51,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.8,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "80 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 80,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "at_risk",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 45,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"package-lock.json",
"pnpm-lock.yaml"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [
"examples/scelar-auth-template/app/tsconfig.json",
"tsconfig.json"
],
"agent_commit_share": 0.01,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "examples/scelar-auth-template/app/tsconfig.json, tsconfig.json",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples/scelar-auth-template/app/tsconfig.json, tsconfig.json"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "1 of the last 100 commits agent-authored or agent-credited",
"points": 2,
"status": "partial",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 1,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 99,
"inputs": {
"primary_language": "TypeScript",
"largest_source_bytes": 107894,
"source_files_sampled": 313,
"oversized_source_files": 6
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "TypeScript (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "TypeScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "6/313 source files over 60KB",
"points": 53.9,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 313,
"oversized": 6
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"examples"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "examples",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "examples"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"deps.dev does not index npm:@scelar/nodepod@1.9.12; advisories assessed against the repository dependency graph instead"
],
"report_type": "repository",
"generated_at": "2026-07-23T00:52:57.422640Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/r/R1ck404/Nodepod.svg",
"full_name": "R1ck404/Nodepod",
"license_state": "custom",
"license_spdx": null
}