公开记录
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-24 03:45 UTC

rschlaefli / devrouter

TypeScriptMIT★ 0 星标⑂ 0 复刻始于 2026年2月在 GitHub 上查看 ↗

rschlaefli/devrouter 的健康指数为 100 分中的 63 分，处于「中等」区间。 其得分最高的类别是Vitality（82/100），最低的是Community & Adoption（44/100）。 最近一次更新在 5 天前。 近期的大部分工作由 1 位贡献者完成。

63
总分 / 100
中等

软件健康指数

指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。

63
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
活力社区与采用可持续性与治理工程质量安全AI 就绪度

评分画像

每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。

所有权

Roland Schläfli个人账户
80 关注者43 个公开仓库始于 2010年9月@uzh-bf University of Zurich

该仓库由个人账户拥有。相较于组织支持的项目，单一所有者项目的延续性风险更高。

软件包生态系统

注册表软件包版本月下载量版本数最近发布
npm@devrouter/cli0.0.352,321155 天前

按类别列示的指标

活力

项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？

82良好 · 占总体的 22%

开发活跃度

70良好
评分方式
36/36推送新近度 — 最近一次推送于 5 天前
6.2/36提交节奏 — 52 周中有 9 周有提交
17.6/18提交量 — 最近一年 91 次提交
10/10OpenSSF Scorecard：Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
所用输入
commits_last_year91
human_commit_share1
days_since_last_push5
active_weeks_last_year9

发布纪律

100优秀
评分方式
27/27有发布版本 — 已发布 14 个发布版本
36/36发布时效 — 最近一次发布版本于 5 天前
27/27发布节奏 — 约每 0.5 天发布一次
0/10OpenSSF Scorecard：Signed-Releases — 无数据
所用输入
releases_count14
latest_release_tagv0.0.35
releases_from_tags否
days_since_latest_release5
mean_days_between_releases0.5
已排除计分（无数据或不适用）：OpenSSF Scorecard：Signed-Releases。 其余权重已重新归一化。

社区与采用

项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？

44存在风险 · 占总体的 18%

流行度与采用

1危急
评分方式
0/60星标 — 0 个星标
0/25复刻 — 0 个复刻
0/15关注者 — 0 位关注者
所用输入
forks0
stars0
watchers0
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

社区健康

85优秀
评分方式
22.5/22.5README
22.5/22.5许可证 — 可识别的许可证（MIT）
18/18CONTRIBUTING 指南
13.5/13.5行为准则
0/7.2议题模板
0/6.3PR 模板
所用输入
has_readme是
has_license是
has_contributing是
has_issue_template否
has_code_of_conduct是
has_pull_request_template否

生态采用（下载量）

56中等
评分方式
44.9/80月度下载量 — npm 合计每月 2,321 次下载
0/20注册表被依赖数 — 该生态系统不报告此项
所用输入
packages@devrouter/cli
dependents—
ecosystemsnpm
total_downloads—
monthly_downloads2,321
已排除计分（无数据或不适用）：注册表被依赖数。 其余权重已重新归一化。

可持续性与治理

项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？

58中等 · 占总体的 24%

维护者韧性（巴士系数）

16危急
评分方式
9/54巴士系数 — 1 位贡献者贡献了半数提交
0/22.5提交分布 — 头号贡献者编写了 100% 的提交
1.4/13.5贡献者广度 — 1 位贡献者
6/10OpenSSF Scorecard：Contributors — project has 2 contributing companies or organizations -- score normalized to 6
所用输入
bus_factor1
contributors_sampled1
top_contributor_share1

议题与 PR 响应能力

72良好
评分方式
0/46.8议题解决 — 没有议题或无数据
38.2/38.3PR 接受 — 已裁定的 PR 中 26/26 已合并
0/15OpenSSF Scorecard：Code-Review — Found 0/30 approved changesets -- score normalized to 0
所用输入
merged_prs26
open_issues0
closed_issues0
issue_closed_ratio—
closed_unmerged_prs0
已排除计分（无数据或不适用）：议题解决。 其余权重已重新归一化。

所有权与托管责任

60中等
评分方式
10/30所有权背书 — 个人（用户）账户
0/20已验证域名 — 不适用于个人账户
13.7/25所有者影响力 — rschlaefli 有 80 位关注者
24/25既往记录 — 43 个公开仓库，账户约 15 年
所用输入
followers80
owner_typeUser
is_verified—
owner_loginrschlaefli
public_repos43
account_age_days5,794
已排除计分（无数据或不适用）：已验证域名。 其余权重已重新归一化。

软件包维护

100优秀
评分方式
25/25已发布且可解析 — npm 上有 1 个软件包
35/35发布时效 — 最近一次发布于 5 天前
20/20版本历史 — 15 个已发布版本
20/20未被弃用 — 活跃，未被弃用或撤回
所用输入
packages@devrouter/cli
ecosystemsnpm
any_deprecated否
min_days_since_publish5

工程质量

基础的工程与文档实践是否到位？

78良好 · 占总体的 20%

工程实践

94优秀
评分方式
24/24CI 工作流 — 1 个工作流
24/24存在测试
16/16Linter 配置 — biome.json
9.6/9.6Pre-commit 钩子
0/6.4.editorconfig
20/20OpenSSF Scorecard：CI-Tests — 22 out of 22 merged PRs checked by a CI test -- score normalized to 10
所用输入
has_ci是
has_tests是
has_editorconfig否
has_linter_config是
has_precommit_config是

文档

55中等
评分方式
30/30README
25/25文档目录
0/15文档 / 主页站点
0/10仓库描述
0/10主题标签
0/10Wiki
所用输入
topics—
has_wiki否
homepage—
has_readme是
has_docs_dir是
has_description否

安全

可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？

45存在风险 · 占总体的 16%

安全态势

37存在风险
评分方式
7.5/7.5Binary-Artifacts — no binaries found in the repo
0/7.5Branch-Protection — branch protection not enabled on development/release branches
2.5/2.5CI-Tests — 22 out of 22 merged PRs checked by a CI test -- score normalized to 10
0/2.5CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5Code-Review — Found 0/30 approved changesets -- score normalized to 0
1.5/2.5Contributors — project has 2 contributing companies or organizations -- score normalized to 6
10/10Dangerous-Workflow — no dangerous workflow patterns detected
0/7.5Dependency-Update-Tool — no update tool detected
0/5Fuzzing — project is not fuzzed
2.5/2.5许可证 — license file detected
7.5/7.5Maintained — 30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
5/5Packaging — packaging workflow detected
0/5Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
0/5SAST — SAST tool is not run on all commits -- score normalized to 0
0/5Security-Policy — security policy file not detected
0/7.5Signed-Releases — 无数据
0/7.5Token-Permissions — detected GitHub workflow tokens with excessive permissions
0/7.5Vulnerabilities — 28 existing vulnerabilities detected
所用输入
sourceopenssf_scorecard
checks_evaluated17
scorecard_versionv5.5.0
checks_inconclusive1
scorecard_aggregate3.7
已排除计分（无数据或不适用）：signed_releases。 其余权重已重新归一化。

依赖安全公告

79良好
评分方式
35/35直接依赖不含已知公告 — 没有直接依赖携带已知公告
10/25间接依赖不含已知公告 — 1 个受影响：uuid 10.0.0 (high 7.5)
33.7/40没有长期未处理的公告 — 1 个携带公告的软件包超过 90 天未处理；最早一条发布于 92 天前
所用输入
sourceosv
advisories1
affected_packages1
assessed_packages69
unassessed_packages0
affected_by_severityhigh 1
direct_affected_packages0
比对的是 npm:@devrouter/cli@0.0.35 的运行时依赖闭包——安装已发布的软件包时真正被拉取进来的内容——共 69 个软件包。 未对可达性进行分析。

AI 就绪度

该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。

67中等 · 占总体的 0%

AI 代理上下文与指引

82良好
评分方式
45/45代理指令 — AGENTS.md, CLAUDE.md
0/15机器可读文档（llms.txt）
37.5/40可读的提交历史 — 91 次人类提交中有 64 次说明了意图（结构化标题或解释性正文）
所用输入
has_llms_txt否
legible_history_share0.703
agent_instruction_filesAGENTS.md, CLAUDE.md
agent_instruction_max_bytes21,294

验证循环（构建 / 测试 / 类型检查）

54中等
评分方式
0/18一条命令的引导启动
22/22自动化测试
11/11Lint / 格式化配置 — biome.json
11/11静态类型检查 — tsconfig.json
10/10可复现环境 — devcontainer, Dockerfile, lockfile
0/10已体现的代理实践 — 最近 91 次提交中没有代理编写的提交
0/8自动化维护 — 未观察到自动依赖更新
0/10OpenSSF Scorecard：Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 0
所用输入
has_nix否
has_tests是
lockfilespnpm-lock.yaml
has_dockerfile是
typed_language是
bootstrap_files—
has_devcontainer是
has_linter_config是
typecheck_configstsconfig.json
agent_commit_share0
toolchain_manifests—
dependency_bot_commit_share0

面向模型的代码可读性

100优秀
评分方式
45/45可类型检查的代码 — TypeScript（静态类型）
55/55可控的文件大小 — 采样的 136 个源文件中有 0 个超过 60KB
所用输入
primary_languageTypeScript
largest_source_bytes35,560
source_files_sampled136
oversized_source_files0

机器可读接口

40存在风险
评分方式
0/40API 模式（OpenAPI/GraphQL/proto）
0/20MCP 服务器
40/40可运行示例 — examples
所用输入
example_dirsexamples
has_mcp_signal否
api_schema_files—

关键数据

0GitHub 星标
1贡献者
91最近 12 个月提交数
5距最近推送天数
14发布版本数
1巴士系数（bus factor）
0开放议题
npm软件包生态系统数

更多细节

OpenSSF Scorecard 3.7 / 10
3.7综合

来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。Scorecard v5.5.0 · 2026-07-24 03:44 UTC

10Binary-Artifactsno binaries found in the repo
0Branch-Protectionbranch protection not enabled on development/release branches
10CI-Tests22 out of 22 merged PRs checked by a CI test -- score normalized to 10
0CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected
0Code-ReviewFound 0/30 approved changesets -- score normalized to 0
6Contributorsproject has 2 contributing companies or organizations -- score normalized to 6
10Dangerous-Workflowno dangerous workflow patterns detected
0Dependency-Update-Toolno update tool detected
0Fuzzingproject is not fuzzed
10Licenselicense file detected
10Maintained30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
10Packagingpackaging workflow detected
0Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 0
0SASTSAST tool is not run on all commits -- score normalized to 0
0Security-Policysecurity policy file not detected
不适用Signed-Releasesno releases found
0Token-Permissionsdetected GitHub workflow tokens with excessive permissions
0Vulnerabilities28 existing vulnerabilities detected
直接依赖 3
注册表软件包版本约束清单文件
npmcommander^12.1.0package.json
npmdockerode^4.0.9package.json
npmyaml^2.5.1package.json
全部依赖 274

来自 GitHub 依赖图的完整解析依赖集合：5 个直接依赖与 269 个间接（传递）软件包。仓库提交锁文件时，传递闭包才是完整的。

注册表软件包版本关系
npmcommander12.1.0直接
npmcommander4.1.1直接
npmdockerode4.0.9直接
npmyaml2.8.2直接
npmyaml2.9.0直接
npm@balena/dockerignore1.0.2间接
npm@biomejs/biome2.5.3间接
npm@biomejs/cli-darwin-arm642.5.3间接
npm@biomejs/cli-darwin-x642.5.3间接
npm@biomejs/cli-linux-arm642.5.3间接
npm@biomejs/cli-linux-arm64-musl2.5.3间接
npm@biomejs/cli-linux-x642.5.3间接
npm@biomejs/cli-linux-x64-musl2.5.3间接
npm@biomejs/cli-win32-arm642.5.3间接
npm@biomejs/cli-win32-x642.5.3间接
npm@emnapi/core1.11.0间接
npm@emnapi/core1.11.1间接
npm@emnapi/runtime1.11.0间接
npm@emnapi/runtime1.11.1间接
npm@emnapi/wasi-threads1.2.2间接
npm@esbuild/aix-ppc640.27.3间接
npm@esbuild/android-arm0.27.3间接
npm@esbuild/android-arm640.27.3间接
npm@esbuild/android-x640.27.3间接
npm@esbuild/darwin-arm640.27.3间接
npm@esbuild/darwin-x640.27.3间接
npm@esbuild/freebsd-arm640.27.3间接
npm@esbuild/freebsd-x640.27.3间接
npm@esbuild/linux-arm0.27.3间接
npm@esbuild/linux-arm640.27.3间接
npm@esbuild/linux-ia320.27.3间接
npm@esbuild/linux-loong640.27.3间接
npm@esbuild/linux-mips64el0.27.3间接
npm@esbuild/linux-ppc640.27.3间接
npm@esbuild/linux-riscv640.27.3间接
npm@esbuild/linux-s390x0.27.3间接
npm@esbuild/linux-x640.27.3间接
npm@esbuild/netbsd-arm640.27.3间接
npm@esbuild/netbsd-x640.27.3间接
npm@esbuild/openbsd-arm640.27.3间接
npm@esbuild/openbsd-x640.27.3间接
npm@esbuild/openharmony-arm640.27.3间接
npm@esbuild/sunos-x640.27.3间接
npm@esbuild/win32-arm640.27.3间接
npm@esbuild/win32-ia320.27.3间接
npm@esbuild/win32-x640.27.3间接
npm@grpc/grpc-js1.14.3间接
npm@grpc/proto-loader0.7.15间接
npm@grpc/proto-loader0.8.0间接
npm@jridgewell/gen-mapping0.3.13间接
npm@jridgewell/resolve-uri3.1.2间接
npm@jridgewell/sourcemap-codec1.5.5间接
npm@jridgewell/trace-mapping0.3.31间接
npm@js-sdsl/ordered-map4.4.2间接
npm@napi-rs/wasm-runtime1.1.6间接
npm@oxc-parser/binding-android-arm-eabi0.137.0间接
npm@oxc-parser/binding-android-arm640.137.0间接
npm@oxc-parser/binding-darwin-arm640.137.0间接
npm@oxc-parser/binding-darwin-x640.137.0间接
npm@oxc-parser/binding-freebsd-x640.137.0间接
npm@oxc-parser/binding-linux-arm-gnueabihf0.137.0间接
npm@oxc-parser/binding-linux-arm-musleabihf0.137.0间接
npm@oxc-parser/binding-linux-arm64-gnu0.137.0间接
npm@oxc-parser/binding-linux-arm64-musl0.137.0间接
npm@oxc-parser/binding-linux-ppc64-gnu0.137.0间接
npm@oxc-parser/binding-linux-riscv64-gnu0.137.0间接
npm@oxc-parser/binding-linux-riscv64-musl0.137.0间接
npm@oxc-parser/binding-linux-s390x-gnu0.137.0间接
npm@oxc-parser/binding-linux-x64-gnu0.137.0间接
npm@oxc-parser/binding-linux-x64-musl0.137.0间接
npm@oxc-parser/binding-openharmony-arm640.137.0间接
npm@oxc-parser/binding-wasm32-wasi0.137.0间接
npm@oxc-parser/binding-win32-arm64-msvc0.137.0间接
npm@oxc-parser/binding-win32-ia32-msvc0.137.0间接
npm@oxc-parser/binding-win32-x64-msvc0.137.0间接
npm@oxc-project/types0.137.0间接
npm@oxc-resolver/binding-android-arm-eabi11.21.3间接
npm@oxc-resolver/binding-android-arm6411.21.3间接
npm@oxc-resolver/binding-darwin-arm6411.21.3间接
npm@oxc-resolver/binding-darwin-x6411.21.3间接
npm@oxc-resolver/binding-freebsd-x6411.21.3间接
npm@oxc-resolver/binding-linux-arm-gnueabihf11.21.3间接
npm@oxc-resolver/binding-linux-arm-musleabihf11.21.3间接
npm@oxc-resolver/binding-linux-arm64-gnu11.21.3间接
npm@oxc-resolver/binding-linux-arm64-musl11.21.3间接
npm@oxc-resolver/binding-linux-ppc64-gnu11.21.3间接
npm@oxc-resolver/binding-linux-riscv64-gnu11.21.3间接
npm@oxc-resolver/binding-linux-riscv64-musl11.21.3间接
npm@oxc-resolver/binding-linux-s390x-gnu11.21.3间接
npm@oxc-resolver/binding-linux-x64-gnu11.21.3间接
npm@oxc-resolver/binding-linux-x64-musl11.21.3间接
npm@oxc-resolver/binding-openharmony-arm6411.21.3间接
npm@oxc-resolver/binding-wasm32-wasi11.21.3间接
npm@oxc-resolver/binding-win32-arm64-msvc11.21.3间接
npm@oxc-resolver/binding-win32-x64-msvc11.21.3间接
npm@protobufjs/aspromise1.1.2间接
npm@protobufjs/base641.1.2间接
npm@protobufjs/codegen2.0.4间接
npm@protobufjs/eventemitter1.1.0间接
npm@protobufjs/fetch1.1.0间接
npm@protobufjs/float1.0.2间接
npm@protobufjs/inquire1.1.0间接
npm@protobufjs/path1.1.2间接
npm@protobufjs/pool1.1.0间接
npm@protobufjs/utf81.1.0间接
npm@rollup/rollup-android-arm-eabi4.57.1间接
npm@rollup/rollup-android-arm644.57.1间接
npm@rollup/rollup-darwin-arm644.57.1间接
npm@rollup/rollup-darwin-x644.57.1间接
npm@rollup/rollup-freebsd-arm644.57.1间接
npm@rollup/rollup-freebsd-x644.57.1间接
npm@rollup/rollup-linux-arm-gnueabihf4.57.1间接
npm@rollup/rollup-linux-arm-musleabihf4.57.1间接
npm@rollup/rollup-linux-arm64-gnu4.57.1间接
npm@rollup/rollup-linux-arm64-musl4.57.1间接
npm@rollup/rollup-linux-loong64-gnu4.57.1间接
npm@rollup/rollup-linux-loong64-musl4.57.1间接
npm@rollup/rollup-linux-ppc64-gnu4.57.1间接
npm@rollup/rollup-linux-ppc64-musl4.57.1间接
npm@rollup/rollup-linux-riscv64-gnu4.57.1间接
npm@rollup/rollup-linux-riscv64-musl4.57.1间接
npm@rollup/rollup-linux-s390x-gnu4.57.1间接
npm@rollup/rollup-linux-x64-gnu4.57.1间接
npm@rollup/rollup-linux-x64-musl4.57.1间接
npm@rollup/rollup-openbsd-x644.57.1间接
npm@rollup/rollup-openharmony-arm644.57.1间接
npm@rollup/rollup-win32-arm64-msvc4.57.1间接
npm@rollup/rollup-win32-ia32-msvc4.57.1间接
npm@rollup/rollup-win32-x64-gnu4.57.1间接
npm@rollup/rollup-win32-x64-msvc4.57.1间接
npm@standard-schema/spec1.1.0间接
npm@tybys/wasm-util0.10.3间接
npm@types/chai5.2.3间接
npm@types/deep-eql4.0.2间接
npm@types/docker-modem3.0.6间接
npm@types/dockerode3.3.47间接
npm@types/estree1.0.8间接
npm@types/node18.19.130间接
npm@types/node22.19.9间接
npm@types/ssh21.15.5间接
npm@vitest/expect4.0.18间接
npm@vitest/mocker4.0.18间接
npm@vitest/pretty-format4.0.18间接
npm@vitest/runner4.0.18间接
npm@vitest/snapshot4.0.18间接
npm@vitest/spy4.0.18间接
npm@vitest/utils4.0.18间接
npmacorn8.15.0间接
npmansi-regex5.0.1间接
npmansi-styles4.3.0间接
npmany-promise1.3.0间接
npmasn10.2.6间接
npmassertion-error2.0.1间接
npmbase64-js1.5.1间接
npmbcrypt-pbkdf1.0.2间接
npmbl4.1.0间接
npmbuffer5.7.1间接
npmbuildcheck0.0.7间接
npmbundle-require5.1.0间接
npmcac6.7.14间接
npmchai6.2.2间接
npmchokidar4.0.3间接
npmchownr1.1.4间接
npmcliui8.0.1间接
npmcolor-convert2.0.1间接
npmcolor-name1.1.4间接
npmconfbox0.1.8间接
npmconsola3.4.2间接
npmcpu-features0.0.10间接
npmdebug4.4.3间接
npmdocker-modem5.0.6间接
npmemoji-regex8.0.0间接
npmend-of-stream1.4.5间接
npmes-module-lexer1.7.0间接
npmesbuild0.27.3间接
npmescalade3.2.0间接
npmestree-walker3.0.3间接
npmexpect-type1.3.0间接
npmfd-package-json2.0.0间接
npmfdir6.5.0间接
npmfix-dts-default-cjs-exports1.0.1间接
npmformatly0.3.0间接
npmfs-constants1.0.0间接
npmfsevents2.3.3间接
npmget-caller-file2.0.5间接
npmget-tsconfig4.13.6间接
npmget-tsconfig4.14.0间接
npmieee7541.2.1间接
npminherits2.0.4间接
npmis-fullwidth-code-point3.0.0间接
npmjiti2.7.0间接
npmjoycon3.1.1间接
npmknip6.26.0间接
npmlilconfig3.1.3间接
npmlines-and-columns1.2.4间接
npmload-tsconfig0.2.5间接
npmlodash.camelcase4.3.0间接
npmlong5.3.2间接
npmmagic-string0.30.21间接
npmmkdirp-classic0.5.3间接
npmmlly1.8.0间接
npmms2.1.3间接
npmmz2.7.0间接
npmnan2.25.0间接
npmnanoid3.3.11间接
npmobject-assign4.1.1间接
npmobug2.1.1间接
npmonce1.4.0间接
npmoxc-parser0.137.0间接
npmoxc-resolver11.21.3间接
npmpathe2.0.3间接
npmpicocolors1.1.1间接
npmpicomatch4.0.3间接
npmpicomatch4.0.5间接
npmpirates4.0.7间接
npmpkg-types1.3.1间接
npmpostcss8.5.6间接
npmpostcss-load-config6.0.1间接
npmprotobufjs7.5.4间接
npmpump3.0.3间接
npmreadable-stream3.6.2间接
npmreaddirp4.1.2间接
npmrequire-directory2.1.1间接
npmresolve-from5.0.0间接
npmresolve-pkg-maps1.0.0间接
npmrollup4.57.1间接
npmsafe-buffer5.2.1间接
npmsafer-buffer2.1.2间接
npmsiginfo2.0.0间接
npmsmol-toml1.7.0间接
npmsource-map0.7.6间接
npmsource-map-js1.2.1间接
npmsplit-ca1.0.1间接
npmssh21.17.0间接
npmstackback0.0.2间接
npmstd-env3.10.0间接
npmstring-width4.2.3间接
npmstring_decoder1.3.0间接
npmstrip-ansi6.0.1间接
npmstrip-json-comments5.0.3间接
npmsucrase3.35.1间接
npmtar-fs2.1.4间接
npmtar-stream2.2.0间接
npmthenify3.3.1间接
npmthenify-all1.6.0间接
npmtinybench2.9.0间接
npmtinyexec0.3.2间接
npmtinyexec1.0.2间接
npmtinyglobby0.2.15间接
npmtinyglobby0.2.17间接
npmtinyrainbow3.0.3间接
npmtree-kill1.2.2间接
npmts-interface-checker0.1.13间接
npmtslib2.8.1间接
npmtsup8.5.1间接
npmtsx4.21.0间接
npmtweetnacl0.14.5间接
npmtypescript5.9.3间接
npmufo1.6.3间接
npmunbash4.0.2间接
npmundici-types5.26.5间接
npmundici-types6.21.0间接
npmutil-deprecate1.0.2间接
npmuuid10.0.0间接
npmvite7.3.1间接
npmvitest4.0.18间接
npmwalk-up-path4.0.0间接
npmwhy-is-node-running2.3.0间接
npmwrap-ansi7.0.0间接
npmwrappy1.0.2间接
npmy18n5.0.8间接
npmyargs17.7.2间接
npmyargs-parser21.1.1间接
npmzod4.4.3间接
依赖安全公告 1

安装 npm:@devrouter/cli@0.0.35 会引入 69 个包（直接与传递）：其中 1 个存在已知公告，0 个为直接依赖。

软件包版本关系严重程度公告数修复版本
uuid10.0.0间接高113.0.1

公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。

原始 JSON 报告 机器可读
{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": false,
      "size_kb": 1339,
      "has_wiki": false,
      "homepage": null,
      "languages": {
        "Shell": 36271,
        "Dockerfile": 1043,
        "JavaScript": 22333,
        "TypeScript": 843322
      },
      "pushed_at": "2026-07-18T17:52:26Z",
      "created_at": "2026-02-07T17:20:34Z",
      "owner_type": "User",
      "updated_at": "2026-07-18T17:35:30Z",
      "description": null,
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "MIT",
      "default_branch": "main",
      "license_spdx_raw": "MIT",
      "primary_language": "TypeScript",
      "significant_languages": [
        "TypeScript"
      ]
    },
    "owner": {
      "blog": "https://www.linkedin.com/in/rschlaefli",
      "name": "Roland Schläfli",
      "type": "User",
      "login": "rschlaefli",
      "company": "@uzh-bf University of Zurich",
      "location": "Zurich",
      "followers": 80,
      "avatar_url": "https://avatars.githubusercontent.com/u/395846?v=4",
      "created_at": "2010-09-11T19:05:50Z",
      "is_verified": null,
      "public_repos": 43,
      "account_age_days": 5794
    },
    "license": {
      "state": "standard",
      "spdx_id": "MIT",
      "raw_spdx": "MIT",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": true
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.0.35",
          "kind": "patch",
          "published_at": "2026-07-18T17:52:26Z"
        },
        {
          "tag": "v0.0.34",
          "kind": "patch",
          "published_at": "2026-07-16T17:49:58Z"
        },
        {
          "tag": "v0.0.33",
          "kind": "patch",
          "published_at": "2026-07-16T16:09:04Z"
        },
        {
          "tag": "v0.0.32",
          "kind": "patch",
          "published_at": "2026-07-16T15:46:21Z"
        },
        {
          "tag": "v0.0.31",
          "kind": "patch",
          "published_at": "2026-07-15T19:52:48Z"
        },
        {
          "tag": "v0.0.30",
          "kind": "patch",
          "published_at": "2026-07-14T06:57:48Z"
        },
        {
          "tag": "v0.0.29",
          "kind": "patch",
          "published_at": "2026-07-13T23:45:35Z"
        },
        {
          "tag": "v0.0.28",
          "kind": "patch",
          "published_at": "2026-07-13T23:02:47Z"
        },
        {
          "tag": "v0.0.27",
          "kind": "patch",
          "published_at": "2026-07-13T22:32:28Z"
        },
        {
          "tag": "v0.0.26",
          "kind": "patch",
          "published_at": "2026-07-13T22:15:20Z"
        },
        {
          "tag": "v0.0.25",
          "kind": "patch",
          "published_at": "2026-07-08T16:23:14Z"
        },
        {
          "tag": "v0.0.24",
          "kind": "patch",
          "published_at": "2026-07-07T17:11:07Z"
        },
        {
          "tag": "v0.0.23",
          "kind": "patch",
          "published_at": "2026-06-28T20:51:16Z"
        },
        {
          "tag": "v0.0.22",
          "kind": "patch",
          "published_at": "2026-06-28T13:29:15Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "57e9749b86e8afeb41f850bd7fdbbeb99826880c",
          "body": "* docs(project): add documentation rework plan\n\n* docs(project): organize dated project plans\n\n* docs(knowledge): add lean OKF repository bundle\n\n* docs: consolidate product and contributor guidance\n\n* refactor(knowledge): modularize repository validator\n\n* docs(project): record final documentation proof\n\n* fix(knowledge): report source link lines\n\n* docs(project): finalize documentation rework plan",
          "is_bot": false,
          "headline": "docs: reorganize repository knowledge and guidance (#26)",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-18T17:35:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ee425ab7b9b7460432b8c06e127a690d62d84a08",
          "body": "* docs(plan): define workspace safety hardening\n\n* fix(workspace): serialize exact DevPod ownership mutations\n\n* fix(ensure): bind routes and processes to runtime identity\n\n* fix(routes): make published route state crash consistent\n\n* docs(solutions): refresh workspace identity safeguards\n\n* chore(release): prepare devrouter 0.0.35\n\n* refactor(workspace): centralize mutation safety\n\n* docs(plan): record final workspace safety proof\n\n* docs(plan): record downstream workspace proof",
          "is_bot": false,
          "headline": "fix(workspace): bind lifecycle to exact workspace identity (#25)",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-18T17:22:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cf7626aa19ed7974f2170d1ab5566da1499d1139",
          "body": "* docs(project): add runtime helper delivery plan\n\n* fix(ensure): deliver managed process helper at runtime\n\n* fix(devcontainer): keep devrouter out of consumer images\n\n* chore(release): prepare 0.0.34\n\n* fix(ensure): isolate managed startup failures\n\n* docs(project): link runtime helper pull request\n\n* docs(project): record runtime helper CI",
          "is_bot": false,
          "headline": "fix(devcontainer): keep devrouter out of consumer images (#24)",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-16T17:49:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e8a2dbb1f873434e372bfd14105a1af7abb0a33e",
          "body": null,
          "is_bot": false,
          "headline": "fix(exec): suppress completed DevPod diagnostic (#23)",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-16T16:08:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "49f8436b83360281f3bfdb0d295869d602359296",
          "body": "* docs(project): add unified workspace reconciler plan\n\n* fix(routing): enforce trusted route publication\n\n* enhance(workspace): reconcile primary checkouts\n\n* enhance(cli): add canonical environment lifecycle\n\n* feat(exec): run commands in managed DevPods\n\n* chore(release): publish 0.0.32 unified reconciliation\n\n* fix(lifecycle): preserve exact environment ownership\n\n* fix(reconcile): preserve evidence and failed-route cleanup",
          "is_bot": false,
          "headline": "enhance(cli): unify checkout environment reconciliation (#22)",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-16T15:45:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b57315c52d1249f3cbd5cc9fc58fd2feaf760778",
          "body": "Adds durable repository-local workspace ownership, fail-closed lifecycle cleanup, ownership-aware garbage collection, and release 0.0.31 metadata.",
          "is_bot": false,
          "headline": "feat(workspace): persist ownership and clean stale workspaces",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-15T19:52:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "302ac44459f308837f23268ab8afa906e6d9baf9",
          "body": "* docs(project): add managed dev-process plan\n\n* feat(process): add managed dev-process helper\n\n* chore(release): prepare 0.0.30\n\n* refactor(process): extract helper without CLI dependencies",
          "is_bot": false,
          "headline": "feat(process): centralize devcontainer process lifecycle (#20)",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-14T06:56:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4a7b04b7838aedddd2e1f17aaf5960be872b36fd",
          "body": "* fix(workspace): recover stale HTTP routes\n\n* docs(solutions): capture HTTP readiness recovery",
          "is_bot": false,
          "headline": "fix(workspace): recover stale HTTP routes",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-13T23:45:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "52c34faaa0b2846faffb3547fa579a3fc9571c6b",
          "body": "Release 0.0.28 with refreshable, worktree-aware generated agent guidance.",
          "is_bot": false,
          "headline": "fix(agents): generate correct worktree startup guidance",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-13T23:00:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bee69d00794f5cc0874664e17787b93e052f84b9",
          "body": "* fix(upgrade): resolve packaged prompt directory\n\n* docs(solutions): capture npm resource lookup\n\n* Release 0.0.27 -- packaged prompt resolution",
          "is_bot": false,
          "headline": "fix(upgrade): resolve packaged prompt directory (#17)",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-13T22:30:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "25e04099adde66ec77e9ef033e4abc1bf9f5c778",
          "body": "* feat(workspace): harden worktree lifecycle\n\n* docs(solutions): capture worktree identity drift\n\n* Release 0.0.26 -- workspace lifecycle hardening",
          "is_bot": false,
          "headline": "feat(workspace): harden worktree lifecycle (#16)",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-13T22:12:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d3c97c5ed08cdbd07f25cffa95bc7c90e11a7f79",
          "body": null,
          "is_bot": false,
          "headline": "chore(quality): add Biome and repository checks",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-13T18:40:41Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0d755bfebcf74a4bfe37153f5774fc3fac1f08d6",
          "body": "…p of the README",
          "is_bot": false,
          "headline": "docs: place onboarding prompt generation instructions right at the to…",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-08T16:57:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4c64570aa1ebcbf908edebf650a82bde627f1743",
          "body": "…mmended",
          "is_bot": false,
          "headline": "docs: update devcontainer documentation to explain why DevPod is reco…",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-08T16:36:27Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "048c6ed0e48b830f0f59e87752554d71c24a12cb",
          "body": null,
          "is_bot": false,
          "headline": "docs: update README to clarify Redis, MariaDB, and MySQL support",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-08T16:25:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d39dcae604707a5a3ef8de8d87dea9c0c0910650",
          "body": null,
          "is_bot": false,
          "headline": "release: v0.0.25 (#15)",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-08T16:22:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4ded4da40899efa1755d54c7047ab06e914093f7",
          "body": null,
          "is_bot": false,
          "headline": "refactor: remove linear workflow integrations and CLI parameters (#14)",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-08T16:08:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9760737e541c50ea0ee71a3e2b345dbfa40c7bcf",
          "body": null,
          "is_bot": false,
          "headline": "bump: v0.0.24",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-07T17:11:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "47dc14aa4b17fba6f5740f31232ea5a5d191caec",
          "body": "…v variable",
          "is_bot": false,
          "headline": "feat(workspace): automatically inject DEVCONTAINER_COMPOSE_OVERLAY en…",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-07T16:54:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2207b50645d4aad4d8f9e30668144f46ddc93857",
          "body": "…r (#13)",
          "is_bot": false,
          "headline": "docs(oss): update all agent skills, prompts, and docs to use devroute…",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-05T19:36:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7462e634d7299393436804bb30dc06cf91b80cf8",
          "body": null,
          "is_bot": false,
          "headline": "chore(oss): prepare repository for open-source release (#12)",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-07-05T19:31:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2380928e52e48e2a465315ba4fad4e25e36f972e",
          "body": "* docs(project): add agent-native devcontainer plan\n\n* feat(setup): add first-run setup command\n\n* feat(repo): add stack inspection for agents\n\n* feat(devcontainer): add agent-native scaffold writer\n\n* feat(devcontainer): verify onboarding evidence\n\n* test(devcontainer): add live devpod example smok\n[…]\nlve final review blockers\n\n* docs(project): mark agent-native plan as pr 11\n\n* docs(examples): organize routing and devcontainer fixtures\n\n* chore(release): 0.0.23 agent-native devcontainer onboarding",
          "is_bot": false,
          "headline": "feat(devcontainer): add agent-native onboarding workflow",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-28T20:50:16Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "bb25d1048b5eb122c2045e1775ec565e2a6c414b",
          "body": "Deepen dependency runtime planning, route-state ownership, and config capability facts while preserving the public CLI/config surface.",
          "is_bot": false,
          "headline": "refactor(architecture): deepen runtime route internals",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-28T15:54:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "18b099861c5f0f310c27efecd11d4c826c248898",
          "body": null,
          "is_bot": false,
          "headline": "docs(project): record workspace release deployment",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-28T13:37:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5ea6686985c8669e22fb6ada42191af95774fad8",
          "body": null,
          "is_bot": false,
          "headline": "fix(ci): publish private releases without provenance",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-28T13:33:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7994c02ec71b2df722c985164af8fc7b710d9fe3",
          "body": "* docs(project): workspace-agent-native design v2 (post-review)\n\n* feat(workspace): workspace token resolution + worktree detection (S0)\n\n* feat(workspace): namespaced runtime config + ${WORKSPACE} upstream templating (S1)\n\n- applyWorkspace/loadRuntimeConfig: per-workspace host namespacing, ${WORKSP\n[…]\naunch\n\n* docs(project): record workspace E2E verification\n\n* docs(workspace): align devpod id comment\n\n* docs(project): record final workspace review gates\n\n* fix(app-run): keep docker targets running",
          "is_bot": false,
          "headline": "feat(workspace): workspace isolation for parallel worktrees (0.0.22)",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-28T13:27:38Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1bb75f84a866eb683e5bb7cb836f75ffc8f070b5",
          "body": "…otchas (#8)\n\nFold the learnings from onboarding klicker-uzh (the first multi-app monorepo\non the devnet devcontainer pattern) into the skill:\n\n- SKILL.md: new \"Multi-app monorepo variant\" section — one container runs\n  turbo dev for N apps; devrouter routes N *.<proj>.localhost hosts to that\n  cont\n[…]\nV=development, plus an OS note that the mkcert CA\n  mount fallback is macOS-only (#27).\n- CHANGELOG [Unreleased] ### Changed.\n\nDocs-only, no version bump (skills read at runtime from .agents/skills/).",
          "is_bot": false,
          "headline": "docs(devcontainer-onboarding): multi-app monorepo variant + klicker g…",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-15T10:35:01Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "032fadb36702ab79e88ff4b42aa945e5f7b1544b",
          "body": "… (#7)\n\n* docs(skill): add AGENTS.md agent-instructions step + prisma format gotcha\n\ndevcontainer-onboarding skill:\n- New workflow step 5: append a 'Local development (devcontainer)' section to\n  the target repo's agent-instructions file (AGENTS.md/CLAUDE.md) from the new\n  references/AGENTS-devcont\n[…]\nst-create loudly if seeding never succeeds\n\nMirror the prisma:push guard in the reference post-create.sh — the seed loop\nfell through to exit 0 on total failure, leaving an unseeded DB with no signal.",
          "is_bot": false,
          "headline": "docs(skill): AGENTS.md agent-instructions step + prisma format gotcha…",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-15T06:24:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8a287ead8dc8ca4aae080fee95ed378616860adb",
          "body": "…outer.yml (#6)\n\nBy default `dev app rm` removes the app entry from the repo's .devrouter.yml\nAND frees the live route. When the goal is only to release a hostname claimed\nby another repo's route (e.g. a stale worktree) without rewriting that repo's\ncommitted config, that's destructive.\n\n--keep-conf\n[…]\nrm`.\n- app-rm.ts: route-only branch.\n- ai-prompt.ts + CHANGELOG [Unreleased] + GOTCHAS #19: document the flag.\n- app-rm.test.ts: 4 cases (default remove, not-found, keep-config, keep-config-no-route).",
          "is_bot": false,
          "headline": "feat(app-rm): add --keep-config to free a route without editing .devr…",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T20:50:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0d718489fc52b699337b78f5038bde05f68d0ee6",
          "body": "…ost-port pattern (#5)\n\n* docs(devcontainer-onboarding): rewrite skill + docs for devnet zero-host-port pattern\n\nRework the devcontainer-onboarding skill and DEVCONTAINER.md for the\ndevrouter >= 0.0.21 devnet pattern (proxy routes over the shared external\nnetwork, no published host ports, OIDC split\n[…]\nds in DEVCONTAINER.md (placeholders, not prisma/prisma).\n- Note runServices / post-start route loop must match defined services\n  (drop oidc/redis if unused); mark the SKILL redis curl as conditional.",
          "is_bot": false,
          "headline": "docs(devcontainer-onboarding): rewrite skill + docs for devnet zero-h…",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T20:19:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b5c7bbb84cada08815bd5ff38219e712370a9274",
          "body": "Release artifacts for the TCP proxy feature: upgrade prompt, CHANGELOG\nprompt reference, demo devrouter.version bump, and ai-prompt.ts validation\nrules updated for runtime=proxy + protocol=tcp.",
          "is_bot": false,
          "headline": "Release 0.0.21 -- TCP proxy upstreams",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T18:28:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "08470aec0d6583b7883bf63a2426b683048a47ac",
          "body": "Extend `runtime: proxy` to TCP so a database in an externally-managed container\n(e.g. a devcontainer's Postgres reachable on devnet by alias) can be fronted by\na stable `db.*.localhost` with NO per-DB host port — the missing half of the\n\"front a DevPod container, zero host-port collisions\" story (HT\n[…]\nTTP proxy-by-devnet-name route served 200\n— both with zero per-service host ports.\n\nTests: proxy+tcp parse (accept/reject), buildHostRoutesDocument http+tcp+ALPN.\nAll 235 pass. Bumps 0.0.20 -> 0.0.21.",
          "is_bot": false,
          "headline": "feat: TCP proxy upstreams (runtime: proxy + protocol: tcp)",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T18:28:26Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "55aec9432c20fee20bac3ce8a05f8b4a76772541",
          "body": "* feat: add devcontainer-onboarding skill\n\nA reusable skill for AI agents that onboard a repo to the new\ndevcontainer-first approach: self-contained .devcontainer (app +\nPostgres + Redis + local OIDC mock, clone-and-run, no Infisical/Auth0)\nfronted by proxy-only devrouter routing.\n\n- SKILL.md: detec\n[…]\n, REPO_ONBOARDING, GETTING_STARTED,\n  devrouter SKILL.md); historical CHANGELOG/upgrade-prompts left as-is\n\nmode 120000 (symlink) for .claude/skills. 230 tests + typecheck + docs-policy + build green.",
          "is_bot": false,
          "headline": "feat: devcontainer-onboarding skill + move skills to .agents/skills (#3)",
          "author_name": "Roland Schläfli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T12:07:17Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b5538b590bdccb2a296c049b6272354c8166947c",
          "body": "- packageManager + volta -> pnpm@11.6.0, node 24.16.0\n- engines.node >=22 -> >=24; CI node-version 22 -> 24\n- demo compose node:22-alpine -> node:24-alpine; docs Node >=24\n- migrate pnpm-workspace.yaml build-deps config to allowBuilds (pnpm 11\n  renamed onlyBuiltDependencies -> allowBuilds and no longer reads the\n  package.json pnpm field)\n\nVerified under pnpm 11.6.0: frozen install, docs-policy, typecheck,\n230 tests, build all pass; lockfile (v9.0) unchanged.",
          "is_bot": false,
          "headline": "chore: pin Node 24 (LTS) and upgrade pnpm to 11.6.0",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T09:57:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6b60fa47766c0675fe9d8c4628422abc3180856a",
          "body": "ripgrep is not installed on the GitHub ubuntu-latest runner, so the\ndocs-policy check failed with 'rg: command not found' once the install\nstep started passing. grep -E is equivalent here and dependency-free.",
          "is_bot": false,
          "headline": "ci: use grep instead of rg in docs-policy check",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T08:28:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "dc59aa73aa9c22d38c5af64a6641d116a739c6e8",
          "body": "CI ran corepack's unpinned default pnpm (v11), which (a) ignores the\npackage.json \"pnpm\" field and (b) uses a different build-allow key than\npnpm 10 — so --frozen-lockfile hard-errored on ERR_PNPM_IGNORED_BUILDS.\n\nPin packageManager to pnpm@10.28.2 (matches volta) so CI and local agree,\nand declare \n[…]\nuiltDependencies in pnpm-workspace.yaml (the canonical home)\nfor the four transitive native deps (cpu-features, esbuild, protobufjs, ssh2).\nssh2's native crypto binding is optional (pure-JS fallback).",
          "is_bot": false,
          "headline": "ci: pin pnpm@10.28.2 and approve native build scripts",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T08:28:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "1f8e306ed61acbcf105f42da5f33257bd9ad05f1",
          "body": "Add a 'Two ways to use devrouter' section to the README and a dedicated\ndocs/DEVCONTAINER.md walkthrough. Presents fronting a devcontainer via\nruntime: proxy as the preferred option going forward, while keeping the\nhost/docker 'devrouter runs everything' mode fully supported.",
          "is_bot": false,
          "headline": "docs: document devcontainer + proxy as the preferred workflow",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T08:28:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7837b7d511e6199caf77fee950cff819c40c0a06",
          "body": "- registerProxyRoute now reuses assertAppNotRunning instead of a duplicate\n  hostname-conflict scan. Fixes a latent bug: a stale (dead-PID) non-proxy route\n  claiming the same host was not evicted, leaving a dangling state entry alongside\n  the new proxy route. Drops now-unused imports.\n- parseUpstream accepts underscores in the host (valid docker compose service\n  names) for the devnet-container upstream use case.\n- Tests: underscore host, out-of-range upstream port at the repo-config layer.",
          "is_bot": false,
          "headline": "refactor: simplify registerProxyRoute, harden upstream parsing",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T08:28:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6b654692cec1d01fb92f8103b5f789a3121322bf",
          "body": "The generated traefik dynamic base.yml emitted empty standalone maps\n(http: {} / tls: {}) when TLS was disabled. Traefik v2.11 rejects these\n('cannot be a standalone element'), which fails the whole file provider so\nhost AND proxy routes never load (every request 404s). With TLS off, base.yml\nis now an empty comment-only file (Traefik ignores it). TLS-on path unchanged.\n\nFound while verifying runtime: proxy end-to-end over HTTP.",
          "is_bot": false,
          "headline": "fix: empty base.yml broke Traefik v2.11 file provider (TLS-off routing)",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T08:28:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c507eee63fd41515be8044b4fde22c193a9d3c90",
          "body": null,
          "is_bot": false,
          "headline": "Release 0.0.20 -- proxy runtime mode",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T08:28:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "13ddbbacf263f5f0f42ff175d54808d9ac4104f3",
          "body": "Register a Traefik HTTP route to an already-running upstream (e.g. a\ndevcontainer's published port) with no lifecycle, env injection, hostRun,\ncompose ownership, or dependencies. Makes devrouter compose-runner-agnostic\nso it can sit in front of DevPod / raw docker compose / a host process.\n\n- types:\n[…]\n/doctor: proxy routes (no pid) are never stale-evicted\n- output: proxy apps/routes shown with upstream target + active status\n- tests: parseUpstream, proxy config parse/reject, proxy eviction immunity",
          "is_bot": false,
          "headline": "feat: add runtime: proxy (upstream-only) app mode",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T08:28:07Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "999f6547022e40ca5df93f2d44f84c98ba3cda15",
          "body": null,
          "is_bot": false,
          "headline": "docs: plan runtime: proxy (upstream-only) mode",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-06-14T08:28:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6bf63c4aef9a1f6e795d0db0975a731a9a9748b9",
          "body": null,
          "is_bot": false,
          "headline": "docs: update skill + AI prompt for 0.0.18 env injection changes",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-03-07T09:11:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9c63afe674265ebf574c7893eda2a22e9ee10da5",
          "body": null,
          "is_bot": false,
          "headline": "docs: add release checklist to AGENTS.md",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-03-07T08:59:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "df01993ef658319a024b47bf795d37c5e6e6bd6c",
          "body": null,
          "is_bot": false,
          "headline": "Release 0.0.19 -- dep env injection when deps already running",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-03-07T08:58:50Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c44b8f89e14dce1ba7eac2fc82eb800d3e0ba190",
          "body": null,
          "is_bot": false,
          "headline": "fix: inject dep env when containers already running",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-03-07T08:57:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "823594642ea47ca622d10b8aacb463c82ae6330c",
          "body": null,
          "is_bot": false,
          "headline": "Merge remote 0.0.18: combine per-dep env + concurrency guard",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-03-07T08:44:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d7c3d268f69f250d9ed5736f9a9350480b184e1d",
          "body": null,
          "is_bot": false,
          "headline": "chore: update demo version",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-03-07T08:39:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a11e25e2f265162c9fcb7c585376a626446f00fb",
          "body": null,
          "is_bot": false,
          "headline": "Release 0.0.18 — per-dep env vars + config envMap",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-03-07T08:39:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "98c9f2323afb2e150f92494faad0f7d5cf45bcc5",
          "body": null,
          "is_bot": false,
          "headline": "Release 0.0.18 — concurrent run guard for dev app run",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-03-06T12:52:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6023eef272e732983bfc683d0dee108fb97050ff",
          "body": null,
          "is_bot": false,
          "headline": "Release 0.0.17 — generic TCP routing",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-03-05T13:04:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6b515983935c3b669118cb80a6fc17af4e9ba4d3",
          "body": null,
          "is_bot": false,
          "headline": "Release 0.0.16 — secret manager integration",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-03-02T12:16:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6e72ae501cac076b46fdbe87236e86dcfa8cea4b",
          "body": null,
          "is_bot": false,
          "headline": "Release 0.0.15 — DIRECT_URL injection for postgres deps",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-03-02T11:04:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "7885799ab0c04b9f2b03089e54337dd1c72dd83d",
          "body": null,
          "is_bot": false,
          "headline": "Refactor upgrade system for .devroot",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-15T22:04:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b2548e44b1f7e61738f88f23c09744fecc442c74",
          "body": null,
          "is_bot": false,
          "headline": "Add dev upgrade flow",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-15T19:48:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1f91eb8e8e7165e58ddc545204e4101501cfd1d2",
          "body": null,
          "is_bot": false,
          "headline": "Add dependency only docker apps",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-15T19:19:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2c82b664d0a9daf6da94ce56d9da004cab63c3d2",
          "body": null,
          "is_bot": false,
          "headline": "Add TLS host coverage check",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-15T19:06:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "aac1f78bb77ff3cfaa4c3f6da1831f9a74f9f7f3",
          "body": null,
          "is_bot": false,
          "headline": "Keep existing deps during exec tear­",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-15T18:43:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4093ebc6b86b4abf0db5a27b0e4916b181766f7f",
          "body": null,
          "is_bot": false,
          "headline": "chore: fix repo path name to valid one",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-15T17:45:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "43dae851df33aa0966832849d8a56eeb96a38920",
          "body": null,
          "is_bot": false,
          "headline": "Update Linear SCH issue statuses",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-15T17:25:44Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "eb79e59afe5947965033a5a1dbc82a19a4705ac6",
          "body": null,
          "is_bot": false,
          "headline": "Implement Linear update policy",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-15T14:39:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "900b2a08826240e7a8f791111c2a082242e9c07b",
          "body": null,
          "is_bot": false,
          "headline": "feat(linear-workflow): add guided workspace/team/project AGENTS mapping",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-15T14:20:59Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c4546931f82710c2c1dd01c0a394eacfe02add3f",
          "body": null,
          "is_bot": false,
          "headline": "Clarify CHANGELOG ownership guidance",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-15T14:09:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d69f7e449344d517225bbf89e65d0cbc33bb1c5d",
          "body": null,
          "is_bot": false,
          "headline": "feat(linear-workflow): add optional --with-linear bootstrap",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-15T13:45:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b1f5a1363d5ef8552c4b57018312e288ac22d3ac",
          "body": null,
          "is_bot": false,
          "headline": "Implement argv-safe app exec",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-14T16:38:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "62ff2d873684d753c4931ad5511d36b402428aab",
          "body": null,
          "is_bot": false,
          "headline": "feat(exec): add argv-safe app exec with env mapping",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-14T16:26:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d9b16c53aa81002590b945c24e4979d87a0951fe",
          "body": null,
          "is_bot": false,
          "headline": "Update demo defaults and changelog",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-14T15:49:09Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5b1fd27c171961d5b4a8bf982be74ed8df015f87",
          "body": "36 tests covering parseHostsFromRule, findDuplicateHosts, resolveRouteByName, discoverRoutes. Fix: \"unhealthy\" status was matching \"healthy\" branch due to substring check order.",
          "is_bot": false,
          "headline": "feat: unit tests for routes.ts + fix unhealthy health check ordering",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-09T21:49:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cc1e83b9fa2a5171eba1eb0b09889df10f663dec",
          "body": null,
          "is_bot": false,
          "headline": "feat: vitest + unit tests for paths.ts and repo-config.ts",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-09T21:38:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "97c3325c6e7c478d87918603daec7adee64c7802",
          "body": null,
          "is_bot": false,
          "headline": "chore: bump version",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-09T20:37:07Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6fb956924631cb09cfaeea162a679164948f951d",
          "body": "…ocs sync",
          "is_bot": false,
          "headline": "feat: agent discoverability (dev repo agents, skill distribution) + d…",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-09T20:36:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6e81c99d0b22f69e8abf1f32721883fd018b24eb",
          "body": null,
          "is_bot": false,
          "headline": "chore: update docs",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-09T18:50:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6d79d9c87a2467f825299291df8db015bcf768df",
          "body": "Add `dev app exec <name> -- <command>` to run one-shot commands\n(prisma migrate, seed, etc.) with resolved dependency env vars.\nRefactor dep lifecycle into reusable startAppDependencies helper.\nAdd queryMappedPort + publishTcpPorts overlay support in docker-run.\nUpdate docs, AI prompt, and README.",
          "is_bot": false,
          "headline": "feat: dev app exec + TCP port injection for host app deps",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-09T18:43:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "925988bc5a3ac659e2c485606ea0b757ae6338e9",
          "body": null,
          "is_bot": false,
          "headline": "fix: clickable output log links",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-09T07:42:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2e0c403dfee7c2ab47c90f628a4bed542d7e8fd8",
          "body": "…+ docs\n\n- docker compose up --wait blocks until deps healthy\n- auto-stop docker deps on host app exit\n- print last 20 dep log lines after start\n- inject build-time version from package.json\n- AI prompt: new compose requirements section (healthcheck, no host ports)\n- docs: compose requirements, dep lifecycle across all doc files",
          "is_bot": false,
          "headline": "feat: dep lifecycle (health wait, auto-stop, logs) + version display …",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-09T07:32:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "46e29504f068c2d9f22d81020007ef064ae8232e",
          "body": null,
          "is_bot": false,
          "headline": "fix: add extra_hosts",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-08T22:13:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5ff453fbe957d6067d509327cbe2edffe58d5d4d",
          "body": null,
          "is_bot": false,
          "headline": "chore: bump version",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-08T21:48:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fdb50b109b46607eea8c7d1a89bc661b06f7689a",
          "body": null,
          "is_bot": false,
          "headline": "fix: port timeout and random port injection",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-08T21:48:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "10500be0dfd3296a605d294c62be4a1994e4b6db",
          "body": null,
          "is_bot": false,
          "headline": "ci: use provenance",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-08T21:30:10Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "defe17cdaf94720e1cdafd5ee813163cba125efb",
          "body": null,
          "is_bot": false,
          "headline": "ci: add initial NPM publish workflow",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-08T21:24:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fb5eb575d68df75e5188f43090dbfe41016c52bd",
          "body": "…ection\n\n- Add assertPathWithinRepo guard for composeFiles and hostRun.cwd\n- Strict hostname regex (lowercase alphanumeric + hyphens + .localhost)\n- Dependency cycle detection with clear error paths\n- Document shell:true trust model, add 4096-char command length cap\n- Update AGENTS.md, PLAN.md, OSS_PLAN.md with progress and constraints",
          "is_bot": false,
          "headline": "M1 security hardening: path traversal, hostname validation, cycle det…",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-08T21:11:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fa64791daa77e6998ea78d242ad382e4fb8fc884",
          "body": null,
          "is_bot": false,
          "headline": "chore(docs): add OSS plan",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-08T17:41:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "311f19c8c5c8378dd332ca08304564e3c534748e",
          "body": null,
          "is_bot": false,
          "headline": "Remove legacy CLI commands",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-08T17:16:57Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "76e5d36c75ab123541cdc10cd50f4c26782968f6",
          "body": null,
          "is_bot": false,
          "headline": "Remove legacy CLI commands",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-08T17:01:54Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4541340a5792dd60be2ec4ef8ee9bfcc583f3c8d",
          "body": null,
          "is_bot": false,
          "headline": "Strengthen repo onboarding prompt",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-08T16:47:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bcf5f008c2d1b0f5b3b272cc5a0098df5830f5b1",
          "body": null,
          "is_bot": false,
          "headline": "Fix host-run timeout cleanup",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-08T10:31:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8278f2311e70f5d13407f2abda1c75edbe611446",
          "body": null,
          "is_bot": false,
          "headline": "Add TCP routing support",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-08T10:17:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5be481dfe40caf6b007b1289a9cd9f8a116ab4cf",
          "body": null,
          "is_bot": false,
          "headline": "Implement unified devrouter config",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-07T22:20:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ee0840353d15dd7f8f9cea50adeacd9d7e4b8e15",
          "body": null,
          "is_bot": false,
          "headline": "Add host-run dev server support",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-07T20:17:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "482483a214eabd6072cd1b4f23df83ecf9de2825",
          "body": null,
          "is_bot": false,
          "headline": "perf",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-07T19:06:55Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d0ea24ab0bbc597c3db71366aae3744d53415688",
          "body": null,
          "is_bot": false,
          "headline": "Initial devrouter MVP CLI and docs",
          "author_name": "Roland Schlaefli",
          "author_login": "rschlaefli",
          "committed_at": "2026-02-07T17:37:45Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 14,
      "commits_last_year": 91,
      "latest_release_at": "2026-07-18T17:52:26Z",
      "latest_release_tag": "v0.0.35",
      "releases_from_tags": false,
      "days_since_last_push": 5,
      "active_weeks_last_year": 9,
      "days_since_latest_release": 5,
      "mean_days_between_releases": 0.5
    },
    "community": {
      "has_readme": true,
      "has_license": true,
      "has_description": false,
      "has_contributing": true,
      "health_percentage": 57,
      "has_issue_template": false,
      "has_code_of_conduct": true,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "@devrouter/cli",
          "exists": true,
          "license": "MIT",
          "keywords": [],
          "ecosystem": "npm",
          "matches_repo": true,
          "registry_url": "https://www.npmjs.com/package/@devrouter/cli",
          "is_deprecated": false,
          "latest_version": "0.0.35",
          "repository_url": "https://github.com/rschlaefli/devrouter",
          "versions_count": 15,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": 1,
          "monthly_downloads": 2321,
          "first_published_at": "2026-02-08T21:25:23.100000Z",
          "latest_published_at": "2026-07-18T17:53:30.679000Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 5
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "examples"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [],
      "api_schema_files": [],
      "has_devcontainer": true,
      "typecheck_configs": [
        "tsconfig.json"
      ],
      "toolchain_manifests": [],
      "largest_source_bytes": 35560,
      "source_files_sampled": 136,
      "oversized_source_files": 0,
      "agent_instruction_files": [
        "AGENTS.md",
        "CLAUDE.md"
      ],
      "agent_instruction_max_bytes": 21294
    },
    "dependencies": {
      "manifests": [
        "package.json"
      ],
      "advisories": {
        "error": null,
        "scope": "published_package",
        "source": "osv",
        "findings": [
          {
            "name": "uuid",
            "direct": false,
            "version": "10.0.0",
            "severity": "high",
            "ecosystem": "npm",
            "cvss_score": 7.5,
            "advisory_ids": [
              "GHSA-w5hq-g745-h8pq"
            ],
            "fixed_version": "13.0.1",
            "advisory_count": 1,
            "oldest_advisory_days": 92
          }
        ],
        "collected": true,
        "malicious": [],
        "truncated": false,
        "by_severity": {
          "high": 1
        },
        "advisory_count": 1,
        "affected_count": 1,
        "assessed_count": 69,
        "malicious_count": 0,
        "assessed_package": "npm:@devrouter/cli@0.0.35",
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "npm"
      ],
      "dependencies": [
        {
          "name": "commander",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^12.1.0"
        },
        {
          "name": "dockerode",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^4.0.9"
        },
        {
          "name": "yaml",
          "manifest": "package.json",
          "ecosystem": "npm",
          "version_constraint": "^2.5.1"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [
          {
            "name": "commander",
            "direct": true,
            "version": "12.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "commander",
            "direct": true,
            "version": "4.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "dockerode",
            "direct": true,
            "version": "4.0.9",
            "ecosystem": "npm"
          },
          {
            "name": "yaml",
            "direct": true,
            "version": "2.8.2",
            "ecosystem": "npm"
          },
          {
            "name": "yaml",
            "direct": true,
            "version": "2.9.0",
            "ecosystem": "npm"
          },
          {
            "name": "@balena/dockerignore",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@biomejs/biome",
            "direct": false,
            "version": "2.5.3",
            "ecosystem": "npm"
          },
          {
            "name": "@biomejs/cli-darwin-arm64",
            "direct": false,
            "version": "2.5.3",
            "ecosystem": "npm"
          },
          {
            "name": "@biomejs/cli-darwin-x64",
            "direct": false,
            "version": "2.5.3",
            "ecosystem": "npm"
          },
          {
            "name": "@biomejs/cli-linux-arm64",
            "direct": false,
            "version": "2.5.3",
            "ecosystem": "npm"
          },
          {
            "name": "@biomejs/cli-linux-arm64-musl",
            "direct": false,
            "version": "2.5.3",
            "ecosystem": "npm"
          },
          {
            "name": "@biomejs/cli-linux-x64",
            "direct": false,
            "version": "2.5.3",
            "ecosystem": "npm"
          },
          {
            "name": "@biomejs/cli-linux-x64-musl",
            "direct": false,
            "version": "2.5.3",
            "ecosystem": "npm"
          },
          {
            "name": "@biomejs/cli-win32-arm64",
            "direct": false,
            "version": "2.5.3",
            "ecosystem": "npm"
          },
          {
            "name": "@biomejs/cli-win32-x64",
            "direct": false,
            "version": "2.5.3",
            "ecosystem": "npm"
          },
          {
            "name": "@emnapi/core",
            "direct": false,
            "version": "1.11.0",
            "ecosystem": "npm"
          },
          {
            "name": "@emnapi/core",
            "direct": false,
            "version": "1.11.1",
            "ecosystem": "npm"
          },
          {
            "name": "@emnapi/runtime",
            "direct": false,
            "version": "1.11.0",
            "ecosystem": "npm"
          },
          {
            "name": "@emnapi/runtime",
            "direct": false,
            "version": "1.11.1",
            "ecosystem": "npm"
          },
          {
            "name": "@emnapi/wasi-threads",
            "direct": false,
            "version": "1.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/aix-ppc64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/android-arm",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/android-arm64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/android-x64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/darwin-arm64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/darwin-x64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/freebsd-arm64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/freebsd-x64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-arm",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-arm64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-ia32",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-loong64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-mips64el",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-ppc64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-riscv64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-s390x",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/linux-x64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/netbsd-arm64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/netbsd-x64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/openbsd-arm64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/openbsd-x64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/openharmony-arm64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/sunos-x64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/win32-arm64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/win32-ia32",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@esbuild/win32-x64",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "@grpc/grpc-js",
            "direct": false,
            "version": "1.14.3",
            "ecosystem": "npm"
          },
          {
            "name": "@grpc/proto-loader",
            "direct": false,
            "version": "0.7.15",
            "ecosystem": "npm"
          },
          {
            "name": "@grpc/proto-loader",
            "direct": false,
            "version": "0.8.0",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/gen-mapping",
            "direct": false,
            "version": "0.3.13",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/resolve-uri",
            "direct": false,
            "version": "3.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/sourcemap-codec",
            "direct": false,
            "version": "1.5.5",
            "ecosystem": "npm"
          },
          {
            "name": "@jridgewell/trace-mapping",
            "direct": false,
            "version": "0.3.31",
            "ecosystem": "npm"
          },
          {
            "name": "@js-sdsl/ordered-map",
            "direct": false,
            "version": "4.4.2",
            "ecosystem": "npm"
          },
          {
            "name": "@napi-rs/wasm-runtime",
            "direct": false,
            "version": "1.1.6",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-android-arm-eabi",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-android-arm64",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-darwin-arm64",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-darwin-x64",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-freebsd-x64",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-linux-arm-gnueabihf",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-linux-arm-musleabihf",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-linux-arm64-gnu",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-linux-arm64-musl",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-linux-ppc64-gnu",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-linux-riscv64-gnu",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-linux-riscv64-musl",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-linux-s390x-gnu",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-linux-x64-gnu",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-linux-x64-musl",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-openharmony-arm64",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-wasm32-wasi",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-win32-arm64-msvc",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-win32-ia32-msvc",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-parser/binding-win32-x64-msvc",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-project/types",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-android-arm-eabi",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-android-arm64",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-darwin-arm64",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-darwin-x64",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-freebsd-x64",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-linux-arm-gnueabihf",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-linux-arm-musleabihf",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-linux-arm64-gnu",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-linux-arm64-musl",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-linux-ppc64-gnu",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-linux-riscv64-gnu",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-linux-riscv64-musl",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-linux-s390x-gnu",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-linux-x64-gnu",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-linux-x64-musl",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-openharmony-arm64",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-wasm32-wasi",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-win32-arm64-msvc",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@oxc-resolver/binding-win32-x64-msvc",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "@protobufjs/aspromise",
            "direct": false,
            "version": "1.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "@protobufjs/base64",
            "direct": false,
            "version": "1.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "@protobufjs/codegen",
            "direct": false,
            "version": "2.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "@protobufjs/eventemitter",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@protobufjs/fetch",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@protobufjs/float",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@protobufjs/inquire",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@protobufjs/path",
            "direct": false,
            "version": "1.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "@protobufjs/pool",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@protobufjs/utf8",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-android-arm-eabi",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-android-arm64",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-darwin-arm64",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-darwin-x64",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-freebsd-arm64",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-freebsd-x64",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-arm-gnueabihf",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-arm-musleabihf",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-arm64-gnu",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-arm64-musl",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-loong64-gnu",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-loong64-musl",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-ppc64-gnu",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-ppc64-musl",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-riscv64-gnu",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-riscv64-musl",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-s390x-gnu",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-x64-gnu",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-linux-x64-musl",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-openbsd-x64",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-openharmony-arm64",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-win32-arm64-msvc",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-win32-ia32-msvc",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-win32-x64-gnu",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@rollup/rollup-win32-x64-msvc",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "@standard-schema/spec",
            "direct": false,
            "version": "1.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "@tybys/wasm-util",
            "direct": false,
            "version": "0.10.3",
            "ecosystem": "npm"
          },
          {
            "name": "@types/chai",
            "direct": false,
            "version": "5.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "@types/deep-eql",
            "direct": false,
            "version": "4.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "@types/docker-modem",
            "direct": false,
            "version": "3.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "@types/dockerode",
            "direct": false,
            "version": "3.3.47",
            "ecosystem": "npm"
          },
          {
            "name": "@types/estree",
            "direct": false,
            "version": "1.0.8",
            "ecosystem": "npm"
          },
          {
            "name": "@types/node",
            "direct": false,
            "version": "18.19.130",
            "ecosystem": "npm"
          },
          {
            "name": "@types/node",
            "direct": false,
            "version": "22.19.9",
            "ecosystem": "npm"
          },
          {
            "name": "@types/ssh2",
            "direct": false,
            "version": "1.15.5",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/expect",
            "direct": false,
            "version": "4.0.18",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/mocker",
            "direct": false,
            "version": "4.0.18",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/pretty-format",
            "direct": false,
            "version": "4.0.18",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/runner",
            "direct": false,
            "version": "4.0.18",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/snapshot",
            "direct": false,
            "version": "4.0.18",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/spy",
            "direct": false,
            "version": "4.0.18",
            "ecosystem": "npm"
          },
          {
            "name": "@vitest/utils",
            "direct": false,
            "version": "4.0.18",
            "ecosystem": "npm"
          },
          {
            "name": "acorn",
            "direct": false,
            "version": "8.15.0",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-regex",
            "direct": false,
            "version": "5.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "ansi-styles",
            "direct": false,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "any-promise",
            "direct": false,
            "version": "1.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "asn1",
            "direct": false,
            "version": "0.2.6",
            "ecosystem": "npm"
          },
          {
            "name": "assertion-error",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "base64-js",
            "direct": false,
            "version": "1.5.1",
            "ecosystem": "npm"
          },
          {
            "name": "bcrypt-pbkdf",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "bl",
            "direct": false,
            "version": "4.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "buffer",
            "direct": false,
            "version": "5.7.1",
            "ecosystem": "npm"
          },
          {
            "name": "buildcheck",
            "direct": false,
            "version": "0.0.7",
            "ecosystem": "npm"
          },
          {
            "name": "bundle-require",
            "direct": false,
            "version": "5.1.0",
            "ecosystem": "npm"
          },
          {
            "name": "cac",
            "direct": false,
            "version": "6.7.14",
            "ecosystem": "npm"
          },
          {
            "name": "chai",
            "direct": false,
            "version": "6.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "chokidar",
            "direct": false,
            "version": "4.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "chownr",
            "direct": false,
            "version": "1.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "cliui",
            "direct": false,
            "version": "8.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "color-convert",
            "direct": false,
            "version": "2.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "color-name",
            "direct": false,
            "version": "1.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "confbox",
            "direct": false,
            "version": "0.1.8",
            "ecosystem": "npm"
          },
          {
            "name": "consola",
            "direct": false,
            "version": "3.4.2",
            "ecosystem": "npm"
          },
          {
            "name": "cpu-features",
            "direct": false,
            "version": "0.0.10",
            "ecosystem": "npm"
          },
          {
            "name": "debug",
            "direct": false,
            "version": "4.4.3",
            "ecosystem": "npm"
          },
          {
            "name": "docker-modem",
            "direct": false,
            "version": "5.0.6",
            "ecosystem": "npm"
          },
          {
            "name": "emoji-regex",
            "direct": false,
            "version": "8.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "end-of-stream",
            "direct": false,
            "version": "1.4.5",
            "ecosystem": "npm"
          },
          {
            "name": "es-module-lexer",
            "direct": false,
            "version": "1.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "esbuild",
            "direct": false,
            "version": "0.27.3",
            "ecosystem": "npm"
          },
          {
            "name": "escalade",
            "direct": false,
            "version": "3.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "estree-walker",
            "direct": false,
            "version": "3.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "expect-type",
            "direct": false,
            "version": "1.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "fd-package-json",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "fdir",
            "direct": false,
            "version": "6.5.0",
            "ecosystem": "npm"
          },
          {
            "name": "fix-dts-default-cjs-exports",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "formatly",
            "direct": false,
            "version": "0.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "fs-constants",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "fsevents",
            "direct": false,
            "version": "2.3.3",
            "ecosystem": "npm"
          },
          {
            "name": "get-caller-file",
            "direct": false,
            "version": "2.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "get-tsconfig",
            "direct": false,
            "version": "4.13.6",
            "ecosystem": "npm"
          },
          {
            "name": "get-tsconfig",
            "direct": false,
            "version": "4.14.0",
            "ecosystem": "npm"
          },
          {
            "name": "ieee754",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "inherits",
            "direct": false,
            "version": "2.0.4",
            "ecosystem": "npm"
          },
          {
            "name": "is-fullwidth-code-point",
            "direct": false,
            "version": "3.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "jiti",
            "direct": false,
            "version": "2.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "joycon",
            "direct": false,
            "version": "3.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "knip",
            "direct": false,
            "version": "6.26.0",
            "ecosystem": "npm"
          },
          {
            "name": "lilconfig",
            "direct": false,
            "version": "3.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "lines-and-columns",
            "direct": false,
            "version": "1.2.4",
            "ecosystem": "npm"
          },
          {
            "name": "load-tsconfig",
            "direct": false,
            "version": "0.2.5",
            "ecosystem": "npm"
          },
          {
            "name": "lodash.camelcase",
            "direct": false,
            "version": "4.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "long",
            "direct": false,
            "version": "5.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "magic-string",
            "direct": false,
            "version": "0.30.21",
            "ecosystem": "npm"
          },
          {
            "name": "mkdirp-classic",
            "direct": false,
            "version": "0.5.3",
            "ecosystem": "npm"
          },
          {
            "name": "mlly",
            "direct": false,
            "version": "1.8.0",
            "ecosystem": "npm"
          },
          {
            "name": "ms",
            "direct": false,
            "version": "2.1.3",
            "ecosystem": "npm"
          },
          {
            "name": "mz",
            "direct": false,
            "version": "2.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "nan",
            "direct": false,
            "version": "2.25.0",
            "ecosystem": "npm"
          },
          {
            "name": "nanoid",
            "direct": false,
            "version": "3.3.11",
            "ecosystem": "npm"
          },
          {
            "name": "object-assign",
            "direct": false,
            "version": "4.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "obug",
            "direct": false,
            "version": "2.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "once",
            "direct": false,
            "version": "1.4.0",
            "ecosystem": "npm"
          },
          {
            "name": "oxc-parser",
            "direct": false,
            "version": "0.137.0",
            "ecosystem": "npm"
          },
          {
            "name": "oxc-resolver",
            "direct": false,
            "version": "11.21.3",
            "ecosystem": "npm"
          },
          {
            "name": "pathe",
            "direct": false,
            "version": "2.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "picocolors",
            "direct": false,
            "version": "1.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "picomatch",
            "direct": false,
            "version": "4.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "picomatch",
            "direct": false,
            "version": "4.0.5",
            "ecosystem": "npm"
          },
          {
            "name": "pirates",
            "direct": false,
            "version": "4.0.7",
            "ecosystem": "npm"
          },
          {
            "name": "pkg-types",
            "direct": false,
            "version": "1.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "postcss",
            "direct": false,
            "version": "8.5.6",
            "ecosystem": "npm"
          },
          {
            "name": "postcss-load-config",
            "direct": false,
            "version": "6.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "protobufjs",
            "direct": false,
            "version": "7.5.4",
            "ecosystem": "npm"
          },
          {
            "name": "pump",
            "direct": false,
            "version": "3.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "readable-stream",
            "direct": false,
            "version": "3.6.2",
            "ecosystem": "npm"
          },
          {
            "name": "readdirp",
            "direct": false,
            "version": "4.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "require-directory",
            "direct": false,
            "version": "2.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "resolve-from",
            "direct": false,
            "version": "5.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "resolve-pkg-maps",
            "direct": false,
            "version": "1.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "rollup",
            "direct": false,
            "version": "4.57.1",
            "ecosystem": "npm"
          },
          {
            "name": "safe-buffer",
            "direct": false,
            "version": "5.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "safer-buffer",
            "direct": false,
            "version": "2.1.2",
            "ecosystem": "npm"
          },
          {
            "name": "siginfo",
            "direct": false,
            "version": "2.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "smol-toml",
            "direct": false,
            "version": "1.7.0",
            "ecosystem": "npm"
          },
          {
            "name": "source-map",
            "direct": false,
            "version": "0.7.6",
            "ecosystem": "npm"
          },
          {
            "name": "source-map-js",
            "direct": false,
            "version": "1.2.1",
            "ecosystem": "npm"
          },
          {
            "name": "split-ca",
            "direct": false,
            "version": "1.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "ssh2",
            "direct": false,
            "version": "1.17.0",
            "ecosystem": "npm"
          },
          {
            "name": "stackback",
            "direct": false,
            "version": "0.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "std-env",
            "direct": false,
            "version": "3.10.0",
            "ecosystem": "npm"
          },
          {
            "name": "string-width",
            "direct": false,
            "version": "4.2.3",
            "ecosystem": "npm"
          },
          {
            "name": "string_decoder",
            "direct": false,
            "version": "1.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "strip-ansi",
            "direct": false,
            "version": "6.0.1",
            "ecosystem": "npm"
          },
          {
            "name": "strip-json-comments",
            "direct": false,
            "version": "5.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "sucrase",
            "direct": false,
            "version": "3.35.1",
            "ecosystem": "npm"
          },
          {
            "name": "tar-fs",
            "direct": false,
            "version": "2.1.4",
            "ecosystem": "npm"
          },
          {
            "name": "tar-stream",
            "direct": false,
            "version": "2.2.0",
            "ecosystem": "npm"
          },
          {
            "name": "thenify",
            "direct": false,
            "version": "3.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "thenify-all",
            "direct": false,
            "version": "1.6.0",
            "ecosystem": "npm"
          },
          {
            "name": "tinybench",
            "direct": false,
            "version": "2.9.0",
            "ecosystem": "npm"
          },
          {
            "name": "tinyexec",
            "direct": false,
            "version": "0.3.2",
            "ecosystem": "npm"
          },
          {
            "name": "tinyexec",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "tinyglobby",
            "direct": false,
            "version": "0.2.15",
            "ecosystem": "npm"
          },
          {
            "name": "tinyglobby",
            "direct": false,
            "version": "0.2.17",
            "ecosystem": "npm"
          },
          {
            "name": "tinyrainbow",
            "direct": false,
            "version": "3.0.3",
            "ecosystem": "npm"
          },
          {
            "name": "tree-kill",
            "direct": false,
            "version": "1.2.2",
            "ecosystem": "npm"
          },
          {
            "name": "ts-interface-checker",
            "direct": false,
            "version": "0.1.13",
            "ecosystem": "npm"
          },
          {
            "name": "tslib",
            "direct": false,
            "version": "2.8.1",
            "ecosystem": "npm"
          },
          {
            "name": "tsup",
            "direct": false,
            "version": "8.5.1",
            "ecosystem": "npm"
          },
          {
            "name": "tsx",
            "direct": false,
            "version": "4.21.0",
            "ecosystem": "npm"
          },
          {
            "name": "tweetnacl",
            "direct": false,
            "version": "0.14.5",
            "ecosystem": "npm"
          },
          {
            "name": "typescript",
            "direct": false,
            "version": "5.9.3",
            "ecosystem": "npm"
          },
          {
            "name": "ufo",
            "direct": false,
            "version": "1.6.3",
            "ecosystem": "npm"
          },
          {
            "name": "unbash",
            "direct": false,
            "version": "4.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "undici-types",
            "direct": false,
            "version": "5.26.5",
            "ecosystem": "npm"
          },
          {
            "name": "undici-types",
            "direct": false,
            "version": "6.21.0",
            "ecosystem": "npm"
          },
          {
            "name": "util-deprecate",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "uuid",
            "direct": false,
            "version": "10.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "vite",
            "direct": false,
            "version": "7.3.1",
            "ecosystem": "npm"
          },
          {
            "name": "vitest",
            "direct": false,
            "version": "4.0.18",
            "ecosystem": "npm"
          },
          {
            "name": "walk-up-path",
            "direct": false,
            "version": "4.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "why-is-node-running",
            "direct": false,
            "version": "2.3.0",
            "ecosystem": "npm"
          },
          {
            "name": "wrap-ansi",
            "direct": false,
            "version": "7.0.0",
            "ecosystem": "npm"
          },
          {
            "name": "wrappy",
            "direct": false,
            "version": "1.0.2",
            "ecosystem": "npm"
          },
          {
            "name": "y18n",
            "direct": false,
            "version": "5.0.8",
            "ecosystem": "npm"
          },
          {
            "name": "yargs",
            "direct": false,
            "version": "17.7.2",
            "ecosystem": "npm"
          },
          {
            "name": "yargs-parser",
            "direct": false,
            "version": "21.1.1",
            "ecosystem": "npm"
          },
          {
            "name": "zod",
            "direct": false,
            "version": "4.4.3",
            "ecosystem": "npm"
          }
        ],
        "collected": true,
        "truncated": false,
        "total_count": 274,
        "direct_count": 5,
        "indirect_count": 269
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 26,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 0,
      "top_contributors": [
        {
          "type": "User",
          "login": "rschlaefli",
          "commits": 91,
          "avatar_url": "https://avatars.githubusercontent.com/u/395846?v=4"
        }
      ],
      "contributors_sampled": 1,
      "top_contributor_share": 1
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "ci.yml"
      ],
      "has_docs_dir": true,
      "linter_configs": [
        "biome.json"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": true
    },
    "security_signals": {
      "lockfiles": [
        "pnpm-lock.yaml"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 10,
            "reason": "no binaries found in the repo",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": 10,
            "reason": "22 out of 22 merged PRs checked by a CI test -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 6,
            "reason": "project has 2 contributing companies or organizations -- score normalized to 6",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 0,
            "reason": "no update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 10,
            "reason": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": 10,
            "reason": "packaging workflow detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 0,
            "reason": "dependency not pinned by hash detected -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 0,
            "reason": "SAST tool is not run on all commits -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "28 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "57e9749b86e8afeb41f850bd7fdbbeb99826880c",
        "ran_at": "2026-07-24T03:44:58Z",
        "aggregate_score": 3.7,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": false,
      "has_security_policy": false,
      "has_dependabot_config": false
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": "2026-07-18T17:53:34Z",
      "oldest_open_prs": [],
      "last_merged_pr_at": "2026-07-18T17:35:26Z",
      "ci_last_conclusion": "SUCCESS",
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/rschlaefli/devrouter",
    "host": "github.com",
    "name": "devrouter",
    "owner": "rschlaefli"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "moderate",
      "name": "Overall health",
      "note": null,
      "notes": [],
      "value": 63,
      "inputs": {
        "security": 45,
        "vitality": 82,
        "community": 44,
        "governance": 58,
        "engineering": 78
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "good",
        "name": "Vitality",
        "value": 82,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "good",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 70,
            "inputs": {
              "commits_last_year": 91,
              "human_commit_share": 1,
              "days_since_last_push": 5,
              "active_weeks_last_year": 9
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 5 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "9/52 weeks with commits",
                "points": 6.2,
                "status": "partial",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 9
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "91 commits in the last year",
                "points": 17.6,
                "status": "partial",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 91
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "excellent",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "releases_count": 14,
              "latest_release_tag": "v0.0.35",
              "releases_from_tags": false,
              "days_since_latest_release": 5,
              "mean_days_between_releases": 0.5
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "14 releases published",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "releases_published",
                    "params": {
                      "count": 14
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 5 days ago",
                "points": 36,
                "status": "met",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~0.5 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 0.5
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "cap": null,
              "state": "unverified",
              "guards": [],
              "signals": [],
              "red_flag": false,
              "multiplier_pct": 100,
              "declared_reason": null,
              "unverified_reason": "repository_too_young",
              "unanswered_open_prs": null,
              "unanswered_open_issues": null,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": null,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "maintenance record not established from the collected data",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "abandonment_unverified",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "at_risk",
        "name": "Community & Adoption",
        "value": 44,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "excellent",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "has_readme": true,
              "has_license": true,
              "has_contributing": true,
              "has_issue_template": false,
              "has_code_of_conduct": true,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 22.5,
                "status": "met",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (MIT)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "MIT"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 18,
                "status": "met",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 13.5,
                "status": "met",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          },
          {
            "key": "ecosystem_adoption",
            "band": "moderate",
            "name": "Ecosystem adoption (downloads)",
            "note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "registry_dependents"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 56,
            "inputs": {
              "packages": [
                "@devrouter/cli"
              ],
              "dependents": null,
              "ecosystems": "npm",
              "total_downloads": null,
              "monthly_downloads": 2321
            },
            "components": [
              {
                "key": "monthly_downloads",
                "name": "Monthly downloads",
                "detail": "2,321 downloads/month across npm",
                "points": 44.9,
                "status": "partial",
                "details": [
                  {
                    "code": "downloads_monthly",
                    "params": {
                      "count": 2321,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 80
              },
              {
                "key": "registry_dependents",
                "name": "Registry dependents",
                "detail": "not reported by this ecosystem",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_reported_by_this_ecosystem",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "moderate",
        "name": "Sustainability & Governance",
        "value": 58,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "critical",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 16,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 1,
              "top_contributor_share": 1
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 100% of commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 100
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "1 contributors",
                "points": 1.4,
                "status": "partial",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 6,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "good",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 72,
            "inputs": {
              "merged_prs": 26,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "26/26 decided PRs merged",
                "points": 38.2,
                "status": "met",
                "details": [
                  {
                    "code": "decided_prs_merged",
                    "params": {
                      "merged": 26,
                      "decided": 26
                    }
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 60,
            "inputs": {
              "followers": 80,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "rschlaefli",
              "public_repos": 43,
              "account_age_days": 5794
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "80 followers of rschlaefli",
                "points": 13.7,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 80,
                      "login": "rschlaefli"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "43 public repos, account ~15 yr old",
                "points": 24,
                "status": "partial",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 43
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 15
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          },
          {
            "key": "package_maintenance",
            "band": "excellent",
            "name": "Package maintenance",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "packages": [
                "@devrouter/cli"
              ],
              "ecosystems": "npm",
              "any_deprecated": false,
              "min_days_since_publish": 5
            },
            "components": [
              {
                "key": "published_resolvable",
                "name": "Published & resolvable",
                "detail": "1 package(s) on npm",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "packages_published",
                    "params": {
                      "count": 1,
                      "ecosystems": "npm"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "publish_recency",
                "name": "Publish recency",
                "detail": "latest publish 5 days ago",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "publish_recency",
                    "params": {
                      "days": 5
                    }
                  }
                ],
                "max_points": 35
              },
              {
                "key": "version_history",
                "name": "Version history",
                "detail": "15 published versions",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "published_versions",
                    "params": {
                      "count": 15
                    }
                  }
                ],
                "max_points": 20
              },
              {
                "key": "not_deprecated",
                "name": "Not deprecated",
                "detail": "active, not deprecated or yanked",
                "points": 20,
                "status": "met",
                "details": [
                  {
                    "code": "package_not_deprecated",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "good",
        "name": "Engineering Quality",
        "value": 78,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "excellent",
            "name": "Engineering practices",
            "note": null,
            "notes": [],
            "value": 94,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": true
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "1 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": "biome.json",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "biome.json"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 9.6,
                "status": "met",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "22 out of 22 merged PRs checked by a CI test -- score normalized to 10",
                "points": 20,
                "status": "met",
                "details": [],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "moderate",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 55,
            "inputs": {
              "topics": [],
              "has_wiki": false,
              "homepage": null,
              "has_readme": true,
              "has_docs_dir": true,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 30,
                "status": "met",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 25,
                "status": "met",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 45,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 37,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 17,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 1,
              "scorecard_aggregate": 3.7
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "no binaries found in the repo",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "22 out of 22 merged PRs checked by a CI test -- score normalized to 10",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 2 contributing companies or organizations -- score normalized to 6",
                "points": 1.5,
                "status": "partial",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "no update tool detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow detected",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool is not run on all commits -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "28 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "dependency_advisories",
            "band": "good",
            "name": "Dependency advisories",
            "note": "Matched the npm:@devrouter/cli@0.0.35 runtime dependency closure — what installing the published package pulls in — 69 packages. Reachability is not analyzed.",
            "notes": [
              {
                "code": "advisories_scope_published",
                "params": {
                  "package": "npm:@devrouter/cli@0.0.35",
                  "assessed": 69
                }
              },
              {
                "code": "advisories_reachability",
                "params": {}
              }
            ],
            "value": 79,
            "inputs": {
              "source": "osv",
              "advisories": 1,
              "affected_packages": 1,
              "assessed_packages": 69,
              "unassessed_packages": 0,
              "affected_by_severity": "high 1",
              "direct_affected_packages": 0
            },
            "components": [
              {
                "key": "direct_dependencies_free_of_known_advisories",
                "name": "Direct dependencies free of known advisories",
                "detail": "no direct dependency carries a known advisory",
                "points": 35,
                "status": "met",
                "details": [
                  {
                    "code": "no_direct_advisories",
                    "params": {}
                  }
                ],
                "max_points": 35
              },
              {
                "key": "indirect_dependencies_free_of_known_advisories",
                "name": "Indirect dependencies free of known advisories",
                "detail": "1 affected: uuid 10.0.0 (high 7.5)",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_affected",
                    "params": {
                      "count": 1,
                      "packages": "uuid 10.0.0 (high 7.5)"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "no_advisories_left_outstanding",
                "name": "No advisories left outstanding",
                "detail": "1 advisory-carrying package(s) unaddressed past 90 days; oldest published 92 days ago",
                "points": 33.7,
                "status": "partial",
                "details": [
                  {
                    "code": "advisories_stale",
                    "params": {
                      "days": 90,
                      "count": 1,
                      "oldest": 92
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "malicious_dependencies",
            "band": "excellent",
            "name": "Malicious dependencies",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "source": "osv",
              "meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
              "packages": [],
              "red_flag": false,
              "assessed_packages": 69,
              "malicious_packages": 0,
              "direct_malicious_packages": 0,
              "withdrawn_malicious_packages": 0,
              "installable_malicious_packages": 0
            },
            "components": [
              {
                "key": "no_dependency_reported_as_a_malicious_package",
                "name": "No dependency reported as a malicious package",
                "detail": "no dependency is reported as a malicious package",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "no_malicious_dependencies",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 3
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 67,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "good",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 82,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 0.703,
              "agent_instruction_files": [
                "AGENTS.md",
                "CLAUDE.md"
              ],
              "agent_instruction_max_bytes": 21294
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "AGENTS.md, CLAUDE.md",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "AGENTS.md, CLAUDE.md"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "64 of 91 human commits state their intent (structured subject or explanatory body)",
                "points": 37.5,
                "status": "partial",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 64,
                      "sampled": 91
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "moderate",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 54,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "pnpm-lock.yaml"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [],
              "has_devcontainer": true,
              "has_linter_config": true,
              "typecheck_configs": [
                "tsconfig.json"
              ],
              "agent_commit_share": 0,
              "toolchain_manifests": [],
              "dependency_bot_commit_share": 0
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": "biome.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "biome.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "tsconfig.json",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "tsconfig.json"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "devcontainer, Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "devcontainer, Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 91",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 91
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "no automated dependency updates observed",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_dependency_automation",
                    "params": {}
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "TypeScript",
              "largest_source_bytes": 35560,
              "source_files_sampled": 136,
              "oversized_source_files": 0
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "TypeScript (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "TypeScript"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "0/136 source files over 60KB",
                "points": 55,
                "status": "met",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 136,
                      "oversized": 0
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "examples"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "examples",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "examples"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [],
  "report_type": "repository",
  "generated_at": "2026-07-24T03:45:13.329044Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/r/rschlaefli/devrouter.svg",
  "full_name": "rschlaefli/devrouter",
  "license_state": "standard",
  "license_spdx": "MIT"
}

相关记录

与 rschlaefli/devrouter 共享目录标签或生态系统的已检测仓库。 并排阅读 →

97apache/supersetApache Superset is a Data Visualization and Data Exploration Platform优秀93deepset-ai/haystackOpen-source AI orchestration framework for building context-engineered, production-ready LLM applications. Design modular pipelines and agent workflows with explicit control over retrieval, routing, memory, and generation. Built for scalable agents, RAG, multimodal applications, semantic search, and conversational systems.优秀93spotify/backstageBackstage is an open framework for building developer portals优秀93apache/airflowApache Airflow - A platform to programmatically author, schedule, and monitor workflows优秀92fastify/fastifyFast and low overhead web framework, for Node.js优秀91authelia/autheliaThe Single Sign-On Multi-Factor portal for web apps, now OpenID Certified™优秀

评分是信号，而非担保。 评分反映的是 GitHub 上公开可见的实践——不是代码审计，也不是安全保证。

缺失数据将被剔除并重新归一化权重，绝不按零分计。方法论已版本化并公开：指标 v1.13.0、模式 v0.27.0—— 完整方法论 · 指标知识库.

单项结果在整体记录中的位置： 汇总统计 — npm.