公开记录存在风险
软件健康报告模式 0.27.0 · 指标 1.13.0 · 2026-07-31 05:48 UTC
zkwasm / concord-agent
Host a coding agent (claude/codex/gemini) in a Concord room over ACP. Resident session, idle = zero tokens, token budget, IM control.
zkwasm/concord-agent 的健康指数为 100 分中的 38 分，处于「存在风险」区间。 其得分最高的类别是Vitality（58/100），最低的是Engineering Quality（31/100）。 最近一次更新在 8 天前。 近期的大部分工作由 1 位贡献者完成。
38
总分 / 100软件健康指数
指标归入加权类别，统一采用 1–100 量表。总体分先取类别加权平均；当公开证据触发高风险司法辖区政策时，评级会按政策调整，并设置 49（有风险）的上限。AI 就绪度不计入总体分。
38
优秀85-100堪称典范；基本满足所有检验标准
良好70-84健康；仅有轻微不足
中等50-69可接受，但存在明显不足；建议进行审查
存在风险30-49存在重大薄弱环节；采用时应保持审慎
危急1-29问题严重（项目被弃置、仅有单一维护者、缺乏基本工程规范）
评分画像
每条轴代表一个类别。形状比平均值更重要——健康的对象会填满整个图形，而“一峰一谷”式画像意味着某一维度的优势正掩盖另一维度的风险。
所有权
软件包生态系统
| 注册表 | 软件包 | 版本 | 月下载量 | 版本数 | 最近发布 | 标签 |
|---|---|---|---|---|---|---|
| npm | concord-agent | 0.7.18 | 4,994 | 33 | 8 天前 | concordacpagent-client-protocolcoding-agentclaudecodexaicli |
按类别列示的指标
活力
项目是否仍有生命——是否仍在编写代码，是否仍在发布版本？
58
开发活跃度
48存在风险
评分方式
| 28.8/36 | 推送新近度 — 最近一次推送于 8 天前 |
| 2.8/36 | 提交节奏 — 52 周中有 4 周有提交 |
| 16.9/18 | 提交量 — 最近一年 76 次提交 |
| 0/10 | OpenSSF Scorecard：Maintained — project was created within the last 90 days. Please review its contents carefully |
所用输入
| commits_last_year | 76 |
| human_commit_share | 1 |
| days_since_last_push | 8 |
| active_weeks_last_year | 4 |
发布纪律
72良好
评分方式
| 16.2/27 | 有发布版本 — 1 个版本标签（无 GitHub 发布版本） |
| 36/36 | 发布时效 — 最近一次发布版本于 31 天前 |
| 12.6/27 | 发布节奏 — 节奏未知（仅一次发布） |
| 0/10 | OpenSSF Scorecard：Signed-Releases — 无数据 |
所用输入
| releases_count | 1 |
| latest_release_tag | v0.2.0 |
| releases_from_tags | 是 |
| days_since_latest_release | 31 |
| mean_days_between_releases | — |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Signed-Releases。 其余权重已重新归一化。
社区与采用
项目是否拥有用户、下载量与关注度，并具备欢迎贡献者参与的配置？
33
流行度与采用
1危急
评分方式
| 0/60 | 星标 — 0 个星标 |
| 0/25 | 复刻 — 0 个复刻 |
| 0/15 | 关注者 — 0 位关注者 |
所用输入
| forks | 0 |
| stars | 0 |
| watchers | 0 |
| growth_state | unverified |
| growth_factor_pct | 100 |
| growth_unverified_reason | no_history |
社区健康
50中等
评分方式
| 22.5/22.5 | README |
| 22.5/22.5 | 许可证 — 可识别的许可证（MIT） |
| 0/18 | CONTRIBUTING 指南 |
| 0/13.5 | 行为准则 |
| 0/7.2 | 议题模板 |
| 0/6.3 | PR 模板 |
所用输入
| has_readme | 是 |
| has_license | 是 |
| has_contributing | 否 |
| has_issue_template | 否 |
| has_code_of_conduct | 否 |
| has_pull_request_template | 否 |
生态采用（下载量）
62中等
评分方式
| 49.3/80 | 月度下载量 — npm 合计每月 4,994 次下载 |
| 0/20 | 注册表被依赖数 — 该生态系统不报告此项 |
所用输入
| packages | concord-agent |
| dependents | — |
| ecosystems | npm |
| total_downloads | — |
| monthly_downloads | 4,994 |
已排除计分（无数据或不适用）：注册表被依赖数。 其余权重已重新归一化。
可持续性与治理
项目能否在其成员之外延续——巴士系数、响应能力、由谁支持，以及软件包的维护状况？
33
维护者韧性（巴士系数）
14危急
评分方式
| 9/54 | 巴士系数 — 1 位贡献者贡献了半数提交 |
| 2.4/22.5 | 提交分布 — 头号贡献者编写了 90% 的提交 |
| 2.7/13.5 | 贡献者广度 — 2 位贡献者 |
| 0/10 | OpenSSF Scorecard：Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
所用输入
| bus_factor | 1 |
| contributors_sampled | 2 |
| top_contributor_share | 0.895 |
议题与 PR 响应能力
1危急
评分方式
| 0/46.8 | 议题解决 — 没有议题或无数据 |
| 0/38.3 | PR 接受 — 没有已裁定的拉取请求或无数据 |
| 0/15 | OpenSSF Scorecard：Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
所用输入
| merged_prs | 0 |
| open_issues | 0 |
| closed_issues | 0 |
| issue_closed_ratio | — |
| closed_unmerged_prs | 0 |
已排除计分（无数据或不适用）：议题解决, PR 接受。 其余权重已重新归一化。
所有权与托管责任
36存在风险
评分方式
| 10/30 | 所有权背书 — 个人（用户）账户 |
| 0/20 | 已验证域名 — 不适用于个人账户 |
| 3.4/25 | 所有者影响力 — zkwasm 有 2 位关注者 |
| 15/25 | 既往记录 — 9 个公开仓库，账户约 3 年 |
所用输入
| followers | 2 |
| owner_type | User |
| is_verified | — |
| owner_login | zkwasm |
| public_repos | 9 |
| account_age_days | 1,409 |
已排除计分（无数据或不适用）：已验证域名。 其余权重已重新归一化。
软件包维护
100优秀
评分方式
| 25/25 | 已发布且可解析 — npm 上有 1 个软件包 |
| 35/35 | 发布时效 — 最近一次发布于 8 天前 |
| 20/20 | 版本历史 — 33 个已发布版本 |
| 20/20 | 未被弃用 — 活跃，未被弃用或撤回 |
所用输入
| packages | concord-agent |
| ecosystems | npm |
| any_deprecated | 否 |
| min_days_since_publish | 8 |
工程质量
基础的工程与文档实践是否到位？
31
工程实践
1危急
评分方式
| 0/24 | CI 工作流 |
| 0/24 | 存在测试 |
| 0/16 | Linter 配置 |
| 0/9.6 | Pre-commit 钩子 |
| 0/6.4 | .editorconfig |
| 0/20 | OpenSSF Scorecard：CI-Tests — 无数据 |
所用输入
| has_ci | 否 |
| has_tests | 否 |
| has_editorconfig | 否 |
| has_linter_config | 否 |
| has_precommit_config | 否 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：CI-Tests。 其余权重已重新归一化。
文档
75良好
评分方式
| 30/30 | README |
| 25/25 | 文档目录 |
| 0/15 | 文档 / 主页站点 |
| 10/10 | 仓库描述 |
| 0/10 | 主题标签 |
| 10/10 | Wiki |
所用输入
| topics | — |
| has_wiki | 是 |
| homepage | — |
| has_readme | 是 |
| has_docs_dir | 是 |
| has_description | 是 |
安全
可见的安全与供应链实践是否稳固，且不存在未解决的高风险司法辖区暴露？
32
安全态势
15危急
评分方式
| 7.5/7.5 | Binary-Artifacts — no binaries found in the repo |
| 0/7.5 | Branch-Protection — branch protection not enabled on development/release branches |
| 0/2.5 | CI-Tests — 无数据 |
| 0/2.5 | CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected |
| 0/7.5 | Code-Review — Found 0/30 approved changesets -- score normalized to 0 |
| 0/2.5 | Contributors — project has 0 contributing companies or organizations -- score normalized to 0 |
| 0/10 | Dangerous-Workflow — 无数据 |
| 0/7.5 | Dependency-Update-Tool — no update tool detected |
| 0/5 | Fuzzing — project is not fuzzed |
| 2.5/2.5 | 许可证 — license file detected |
| 0/7.5 | Maintained — project was created within the last 90 days. Please review its contents carefully |
| 0/5 | Packaging — 无数据 |
| 0/5 | Pinned-Dependencies — 无数据 |
| 0/5 | SAST — no SAST tool detected |
| 0/5 | Security-Policy — security policy file not detected |
| 0/7.5 | Signed-Releases — 无数据 |
| 0/7.5 | Token-Permissions — 无数据 |
| 0/7.5 | Vulnerabilities — 29 existing vulnerabilities detected |
所用输入
| source | openssf_scorecard |
| checks_evaluated | 12 |
| scorecard_version | v5.5.0 |
| checks_inconclusive | 6 |
| scorecard_aggregate | 1.5 |
已排除计分（无数据或不适用）：ci_tests, dangerous_workflow, packaging, pinned_dependencies, signed_releases, token_permissions。 其余权重已重新归一化。
依赖安全公告
100优秀
评分方式
| 35/35 | 直接依赖不含已知公告 — 没有直接依赖携带已知公告 |
| 25/25 | 间接依赖不含已知公告 — 没有间接依赖携带已知公告 |
| 0/40 | 没有长期未处理的公告 — 没有公告带有发布日期 |
所用输入
| source | osv |
| advisories | 0 |
| affected_packages | 0 |
| assessed_packages | 57 |
| unassessed_packages | 0 |
| affected_by_severity | none |
| direct_affected_packages | 0 |
已排除计分（无数据或不适用）：没有长期未处理的公告。 其余权重已重新归一化。 比对的是 npm:concord-agent@0.7.18 的运行时依赖闭包——安装已发布的软件包时真正被拉取进来的内容——共 57 个软件包。 未对可达性进行分析。
AI 就绪度
该仓库在多大程度上具备与 AI 编码代理协同开发与维护的条件？这是一枚独立的实验性徽章——权重为 0.0，因此单独呈现，不影响总体健康评分。
34
AI 代理上下文与指引
40存在风险
评分方式
| 0/45 | 代理指令 — 没有 CLAUDE.md / AGENTS.md / 编辑器规则 |
| 0/15 | 机器可读文档（llms.txt） |
| 40/40 | 可读的提交历史 — 76 次人类提交中有 76 次说明了意图（结构化标题或解释性正文） |
所用输入
| has_llms_txt | 否 |
| legible_history_share | 1 |
| agent_instruction_files | — |
| agent_instruction_max_bytes | — |
评分方式
| 0/18 | 一条命令的引导启动 |
| 0/22 | 自动化测试 |
| 0/11 | Lint / 格式化配置 |
| 0/11 | 静态类型检查 |
| 10/10 | 可复现环境 — lockfile |
| 10/10 | 已体现的代理实践 — 最近 76 次提交中有 68 次由代理编写或署名代理 |
| 0/8 | 自动化维护 — 未观察到自动依赖更新 |
| 0/10 | OpenSSF Scorecard：Pinned-Dependencies — 无数据 |
所用输入
| has_nix | 否 |
| has_tests | 否 |
| lockfiles | package-lock.json |
| has_dockerfile | 否 |
| typed_language | 否 |
| bootstrap_files | — |
| has_devcontainer | 否 |
| has_linter_config | 否 |
| typecheck_configs | — |
| agent_commit_share | 0.895 |
| toolchain_manifests | — |
| dependency_bot_commit_share | 0 |
已排除计分（无数据或不适用）：OpenSSF Scorecard：Pinned-Dependencies。 其余权重已重新归一化。
面向模型的代码可读性
54中等
评分方式
| 0/45 | 可类型检查的代码 — JavaScript，未配置类型检查 |
| 53.9/55 | 可控的文件大小 — 采样的 48 个源文件中有 1 个超过 60KB |
所用输入
| primary_language | JavaScript |
| largest_source_bytes | 60,670 |
| source_files_sampled | 48 |
| oversized_source_files | 1 |
关键数据
0GitHub 星标
2贡献者
76最近 12 个月提交数
8距最近推送天数
1发布版本数
1巴士系数（bus factor）
0开放议题
npm软件包生态系统数
数据采集警告
- GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
更多细节
OpenSSF Scorecard 1.5 / 10
1.5综合
来自开源项目 OpenSSF Scorecard 的独立、工具无关的安全评估。每项检查奖励的是安全实践本身，而非特定供应商的工具。Scorecard 无法判定的检查项标记为 不适用，并从安全评分中剔除（绝不按零分计）。
| 10 | Binary-Artifacts | no binaries found in the repo |
| 0 | Branch-Protection | branch protection not enabled on development/release branches |
| 不适用 | CI-Tests | no pull request found |
| 0 | CII-Best-Practices | no effort to earn an OpenSSF best practices badge detected |
| 0 | Code-Review | Found 0/30 approved changesets -- score normalized to 0 |
| 0 | Contributors | project has 0 contributing companies or organizations -- score normalized to 0 |
| 不适用 | Dangerous-Workflow | no workflows found |
| 0 | Dependency-Update-Tool | no update tool detected |
| 0 | Fuzzing | project is not fuzzed |
| 10 | License | license file detected |
| 0 | Maintained | project was created within the last 90 days. Please review its contents carefully |
| 不适用 | Packaging | packaging workflow not detected |
| 不适用 | Pinned-Dependencies | no dependencies found |
| 0 | SAST | no SAST tool detected |
| 0 | Security-Policy | security policy file not detected |
| 不适用 | Signed-Releases | no releases found |
| 不适用 | Token-Permissions | No tokens found |
| 0 | Vulnerabilities | 29 existing vulnerabilities detected |
直接依赖 3
| 注册表 | 软件包 | 版本约束 | 清单文件 |
|---|---|---|---|
| npm | @agentclientprotocol/sdk | 0.28.1 | package.json |
| npm | @larksuiteoapi/node-sdk | ^1.68.0 | package.json |
| npm | qrcode-terminal | ^0.12.0 | package.json |
全部依赖 未采集
本报告未能采集到解析后的依赖集合：GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository
依赖安全公告 0
安装 npm:concord-agent@0.7.18 会引入 57 个包（直接与传递）：其中 0 个存在已知公告，0 个为直接依赖。
没有已知公告影响已评估的依赖。
公告表示依赖图中记录的版本落入某条公告的受影响范围。可达性未经分析，且依赖图包含开发与测试的版本固定——某项发现可能只涉及工具链而非交付的软件。
原始 JSON 报告 机器可读
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 286,
"has_wiki": true,
"homepage": null,
"languages": {
"JavaScript": 355545
},
"pushed_at": "2026-07-23T03:09:02Z",
"created_at": "2026-06-28T04:01:37Z",
"owner_type": "User",
"updated_at": "2026-07-23T03:09:06Z",
"description": "Host a coding agent (claude/codex/gemini) in a Concord room over ACP. Resident session, idle = zero tokens, token budget, IM control.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "JavaScript",
"significant_languages": [
"JavaScript"
]
},
"owner": {
"blog": null,
"name": null,
"type": "User",
"login": "zkwasm",
"company": null,
"location": null,
"followers": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/113981964?v=4",
"created_at": "2022-09-20T09:31:58Z",
"is_verified": null,
"public_repos": 9,
"account_age_days": 1409
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-06-29T12:24:12Z"
}
],
"recent_commits": [
{
"oid": "0ae809fffffc6860ae9fad729021223e004b3146",
"body": "A turn whose model output ended cleanly could fail to settle the ACP prompt\nrequest on adapter 0.52.0 — the bridge waited forever for a stop signal and\nshowed \"working\" for hours (observed live: runtime finished at 11:41, host\nwedged until manual restart). The 0.53-0.60 adapter line reworked\nturn-boundary / background-subagent handling, removing this stall class.\nGemini flag intentionally untouched (unrelated + unverifiable locally).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: bump ACP adapters — claude 0.60.0, codex 1.1.5 (0.7.18)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-23T03:09:00Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "e1adc7cbedaf249753141fe1216a36ee59a72b73",
"body": "…by default (0.7.17)\n\n- ensureAddressed: a turn reply that @-mentions no one is auto-addressed back\n at its trigger sender, and `fallbackMention` rides along so the SERVER can\n enforce the invariant with the authoritative roster (a lexical scan cannot\n tell \"@构建者 look\" from a prose \"补@不变量\")\n- bri\n[…]\naware (textMentionsName/hasMentionToken):\n emails, URL paths, npm scopes, and one-letter substrings never wake anyone;\n fullwidth ＠ normalized\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: addressing invariant + broadcast self-judgment; retire arbiter …",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-22T01:02:36Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6bf5096cc3921cdbb93df08c2a0187586967b0f5",
"body": "…om /compact (0.7.16)\n\nA rate-limited turn used to kill a multi-agent room permanently. Three compounding\ndefects, all confirmed against live host logs:\n\n- The message that triggered the turn was dropped before the attempt\n (pending.shift() ran ahead of the try), so nothing was left to retry.\n- Tra\n[…]\nion and the transient/addressing predicates move to cli.mjs so they\ncan be tested; acp-bridge.mjs keeps the store side effects. 186 tests pass.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: retry transient turn failures, address room notes, unbreak in-ro…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-20T14:35:38Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "613b43e6597148d0333e9c31cea4d0308559cdec",
"body": "…rent models (0.7.15)\n\nThe pinned codex-acp bundles its own @openai/codex and runs THAT — not the user's\ndesktop/PATH codex — so newer models (e.g. gpt-5.6-*) failed with \"Model metadata\nnot found\" / \"requires a newer version of Codex\", even when the desktop app worked.\n1.1.2 bundles @openai/codex 0.144.x. No interface change: same ACP launch, still\nhonors CODEX_PATH. 172/172 tests pass.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: bump codex-acp adapter 1.0.1 → 1.1.2 so hosted codex can use cur…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-13T02:56:16Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b2c6cd0950e5cebd0919b453a1c5289f51b0cebe",
"body": "….7.14)\n\nThe one-time briefing's NOOP-filler rule hardcoded a Chinese \"待命中\" next to the\nEnglish \"standing by\", so every fresh bridge-hosted agent in an English (locale: en)\nroom saw Chinese in its briefing — a leak in the \"en rooms must be all-English\"\nguarantee. Gate it by room.locale via L(): en rooms get only \"standing by\"; zh rooms\nget \"待命中\" / \"standing by\". Takes effect on a fresh session (/clear or re-join).\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: briefing filler example is localized — no Chinese in en rooms (0…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-08T03:34:11Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "704bba3baef44bd5db646e32d8c0597696b4dc29",
"body": "Agents were curl-posting their content to /messages AND letting the bridge post\ntheir turn-ending reply (a status summary in the agent's default language), so every\nturn showed up twice — once as English content, once as a foreign-language \"I did X\"\nnote. Harden the briefing: the reply text IS the r\n[…]\ntatus report, and\nthe coordination BASE is for claims/files/ballots/signals only — never chat. Takes\neffect on a fresh session (/clear or re-join), since a warm-resumed session keeps the\nold briefing.",
"is_bot": false,
"headline": "fix: stop double-posting — the reply IS the room message (0.7.13)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-08T02:44:47Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "affe3fe19875efa0753d796903b7d3368f146217",
"body": "Naming read the ALL-TIME sender list (/agents), so it treated departed \"-N\" ghosts\nas present and offered fallbacks like \"agent-one-3\"; and role-name suggestions could\ncome out in the wrong language. Now: gatherRoomInfo reads room.locale from /info and\nnamingPrompt writes role names in that language (English example for en rooms); the\n\"present/taken\" set comes from the online roster via the paired im-for-agents /agents\nchange (online-only), so a reclaimable ghost name is no longer avoided.",
"is_bot": false,
"headline": "fix: join-time naming — no ghost names, room's language (0.7.13)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-08T01:59:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d977b5ccdb22c2d2857bc6984046c7c000b9fc1e",
"body": "…0.7.12)\n\nAn earlier collision persisted the \"-N\" fallback (e.g. agent-coordinator-2) in local\nstate, so every `concord up`/restart resumed under the wrong name forever — the server\n\"free a departed name\" change only helped a fresh join, not a resume. On join, when the\nstored sender is a \"-N\" fallba\n[…]\nline); on success adopt it (ACP context\nis warm-resumed separately, no memory lost), else resume under the fallback as before.\nClient-side complement to the im-for-agents online-only uniqueness check.",
"is_bot": false,
"headline": "fix: restarted agent reclaims its clean name, not the \"-N\" fallback (…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-07T17:43:05Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e621c3a6ca723e20c89a3a9060ce7e9f908f9774",
"body": "- The operator-facing output of concord join/host/login/upgrade/reset/im/im status\n (naming prompts, QR-login flow, confirmations, status) is now English, matching\n the room-language handling from 0.7.11. Only code comments stay as-is.\n- Join-time naming uses the HOSTED agent's own CLI (claude/gem\n[…]\n invocations are best-effort; a wrong flag degrades gracefully to the fallback.)\n- A first-ever join/host notes the first-run adapter download so initial silence\n reads as \"downloading,\" not \"stuck.\"",
"is_bot": false,
"headline": "i18n+ux: English-first CLI, agent-aware naming, first-run hint (0.7.12)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-07T15:54:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "42b8faea0b382d46e828731b7ba25ed581551a85",
"body": "…e gap (0.7.12)\n\nA `concord join` agent arrived blind: it knew the room protocol but not what the\nroom was FOR, unlike a paste-prompt agent. The one-time briefing now carries,\nread from the join response:\n- room name + objective + context, and the pinned messages (an \"[OBJECTIVE]\" pin\n is flagged a\n[…]\nm's recent history (≤20 msgs, arb markers skipped),\n seeded into the inbox so an agent joining an ongoing room isn't blind to it;\n- autonomous-mode rooms (read from room.mode) get a co-owner mindset.",
"is_bot": false,
"headline": "feat: bridge-hosted agents get the room's brief — close the join↔past…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-07T15:54:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7b5c0bc7cd3226bda92ec3f9899cf734ce5b45f9",
"body": "….11)\n\nThe bridge ignored room.locale and was hardcoded Chinese: it posted Chinese\nsystem messages into the room AND fed the agent Chinese context (batched-inbox\nheader, briefing), biasing hosted agents toward replying in Chinese even in an\nEnglish room. Now it reads room.locale on join and localize\n[…]\neout/error notes, and elicitation prompts all switch on locale.\n- Pure-logic helpers (arbiter, budget, elicit) gained an optional `locale` arg\n (default en); budget.test covers both locales. 172/172.",
"is_bot": false,
"headline": "feat: locale-aware bridge output — English rooms read as English (0.7…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-07T10:59:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1fd4b8704ddad76bcaadceff0218f62c8fd9a87e",
"body": "`spawn('npx', …)` failed on Windows with ENOENT — npx is `npx.cmd` there and\nmodern Node refuses to spawn a .cmd without a shell — so hosting any agent\ncrashed with \"agent failed to start: spawn npx ENOENT\". Spawn the adapter\nthrough the shell on Windows, and reap the child tree with `taskkill /T` in\nshutdown() since Windows has no Unix process groups. macOS/Linux unchanged.\nAlso gate the \"~250MB download\" note to the claude adapter only.",
"is_bot": false,
"headline": "fix: Windows agent-adapter spawn + shutdown (0.7.11)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-07T10:59:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "74dfe3bc77c300f83b852b26a82b978adece5b34",
"body": "…8→0.7.10)\n\nRolls up three versions that shipped without ever being committed (0.7.8\nand 0.7.9 were published to npm from the working tree; 0.7.10 is prepared\nbut unpublished). Their edits are intermingled across the same files, so\nthey are bundled as one honest commit rather than a fabricated per-v\n[…]\nides so silence stays silent and free.\n- 0.7.10: `concord list` gains an ID column — the stable host id\n (claude-xxxxxx) disambiguates same-named agents and is what\n stop/status/logs/restart accept.",
"is_bot": false,
"headline": "feat: answer arbitration, event-driven wakes, upgrade + list ID (0.7.…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-07T09:06:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "7ed8a7560e6f100a462f831dee90395f1f8f97d0",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: 0.7.7 release marker",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-06T10:22:58Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "1cd037742eaa34b83f82b4db3b0aa979592eaf1a",
"body": "The server has always had server-enforced coordination - claims (task\nownership, 409-exclusive), ballots (binding votes), signals, room files - all\nagent-token accessible over HTTP. CLI-hosted agents knew none of it, so\nmulti-agent rooms coordinated by chat alone: duplicate pipelines, three agents\ng\n[…]\not, signals for shared focus. Ballot/signal sections are gated by\nthe room's actual primitives, fetched from /info at boot. 165/165 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: teach hosted agents the room's coordination primitives (0.7.7)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-06T10:21:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6baff5c95a8778cb0b57a657fc02c2465804e7b5",
"body": "Every room message used to wake every agent for a full LLM turn, and the\n\"never go silent\" rule forced a filler reply, so N idle agents billed each\nother for endless \"standing by\" echo loops.\n\nNow inbound messages are classified (pure, tested):\n- wake: @-mentions this agent, or a human message with \n[…]\npeer's exact name to\nmake it act; un-mentioned posts are ambient status that wakes no one; never\npost \"standing by\" filler. 162/162 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: multi-agent wake economics — delivery != wake (0.7.6)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-06T09:45:29Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "2fb41240d5cbe68f1b60ff8437c9ebd124efb99e",
"body": "…with bindings (0.7.5)\n\nTwo upgrade-path bugs: (1) nothing auto-pauses since 0.7.4, but the old daemon's\npause record in state.json was never cleared, so list/status showed 'paused'\nforever while the agent actually worked; a clean start now drops it. (2) 'up'\nspawned an IM owner for every platform w\n[…]\n stored creds - a one-time QR login\nwith zero bindings kept resurrecting a useless owner; now creds AND >=1 binding\nare required. 161/161 green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: clear stale pause records at startup; up only revives IM owners …",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-06T09:12:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "401f50cba828e0144d54762173a300747378d560",
"body": "…, ceiling 30min → 6h (0.7.4)\n\nThe \"3 timeouts in 6h → auto-pause\" fuse turned normal long-running work into\nan unrecoverable-feeling `paused` state (resume → next long task re-tripped it).\nGone: a timed-out turn is simply cancelled (adapter group killed, burn stops),\nthe room is told, and the next \n[…]\n00s\n(6h); ACP_TURN_TIMEOUT=0 disables. `concord resume` remains only to clear a\nstale pause record left by an older daemon. 161/161 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: long tasks are no longer punished — drop the timeout auto-pause…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-06T08:52:02Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "41d67c8e6fcb015cabf3bdb00b607e8ac7d88f1b",
"body": "A hosted Claude with the concord plugin installed saw room messages, decided it\nhad never formally joined, and started suggesting /concord:resume. The bridge\nnow prepends a one-time briefing to the first turn of every fresh session (the\nbridge owns room I/O; never run /concord:* or touch .concord/). Resumed\nsessions skip it — the briefing is already in their context. 161/161 green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: brief fresh sessions that they are already in the room (0.7.4)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T09:34:37Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b19c3188a6fc6fa0f5c22d3944580bc52c2d37cb",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: 0.7.3 release marker",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T08:54:49Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "d0f0811de699d0623ccce816f816a407fbb80100",
"body": "Verified by probing the registry tarball: published 0.7.2 has grounded naming,\nname alignment and the warned80 fix, but not shouldRelayInbound — so the\nsystem-noise filter becomes 0.7.3 and package.json bumps accordingly.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: 0.7.2 shipped on npm — noise filter moves to 0.7.3",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T08:49:32Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "e217168bdf39541d23beeb22ca35e4c88643043c",
"body": "File-upload notices ([FILE] x uploaded …, sender_type=system) triggered a full\nLLM turn whose \"no action needed, standing by\" reply was posted back into the\nroom — burning the agent's tokens AND every other participant's, message after\nmessage. Inbound gating is now a pure, tested predicate (shouldRelayInbound):\nown echoes and system notices never wake the agent; humans and other agents do.\n\n161/161 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: ambient 'system' messages no longer wake the agent (0.7.2)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T08:44:49Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "66e007634fde7c119128e1c314d55707854a66a5",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: 0.7.2 release marker",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T08:30:47Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "65578cdc85a6ca51a25573819b84e2ac6bfd0933",
"body": "…es first\n\nCandidates must come from what the room actually says, not model invention.\nThe chain is now grounded-first:\n\n1. TEMPLATE ROLES (deterministic, zero LLM): room templates bake their role\n list into the room context at creation (compose.ts rolesBlock — a known\n header + \"- name: descrip\n[…]\nuggestNames() reports source: 'template' | 'headless' | 'fallback'.\n160/160 tests green (extraction matches compose.ts's exact composed format).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(naming): ground candidates in the room's own data — template rol…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T08:23:25Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4d30e6e1a0092f8a88da6d0e7d6a245cb1394fd7",
"body": "…he paste-prompt\n\nThe web paste-prompt's naming step is role-selection (\"ask the user what role\nyou should play … use it as your sender name and persona\"; \"invent a role that\nbrings a distinct viewpoint\"). The headless naming prompt now mirrors that:\n- the name is framed as the agent's ROLE + person\n[…]\nal room: old prompt → 指令官/任务分发/待命-协调 (vague);\nnew prompt → 架构师/测试/代码评审/产品设计 (complementary roles next to the\nexisting 工程师). 158/158 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "refactor(naming): frame the headless prompt around ROLES, mirroring t…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T08:16:55Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "32729adc5fe4e5813cc92533c8887fdc7c8ca8b7",
"body": "…room names (0.7.2)\n\nA readable name is the room's core handle in a multi-agent room — it's how\nhumans decide who to @ and who gets which task. `concord join`/`host` (TTY, no\n--as/--name) now gathers the project dir + room name/purpose (/agent .../info)\n+ who is already present (/agents), runs a ONE\n[…]\nshows in every case.\n\nLive-verified against a real room (existing members listed, role-style Chinese\ncandidates generated). 158/158 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: join-time naming via a one-off headless agent + CLI shows real …",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T08:01:03Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "4ca56e6d200fb2a4bb39f943ba782f2a92caef96",
"body": "…e up (0.7.2)\n\n`concord list`'s \"claude-a1b2c3\" and the room's \"claude-6016\" were two unrelated\nidentifiers (hex host id vs pid%10000). The 409-fallback sender now derives from\nCONCORD_HOST_ID's hex tail: same name in both places, stable across restarts —\nso a restarting host resumes its identity instead of minting a fresh ghost each\ntime. A pid-based candidate remains as last resort (stale-session edge).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: room fallback name = host id hex tail — CLI and roster names lin…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T07:38:37Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "ab4c4a5a20cb8d37d46299fca04fd1cc1edc00c9",
"body": "The one-time warning flag was in-memory, so a crash-looping host re-posted the\nwarning into the room on every restart. It now lives in the store next to the\nusage meter and is cleared only by `concord budget --reset` (resetUsage).\n152/152 tests green.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: persist the 80%-of-budget warning flag (0.7.2)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T04:09:10Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "0e169f0f1dcd78bf14ee719b06d15d7f273ae33a",
"body": "Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: 0.7.1 is published — drop the (unreleased) marker",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T03:41:38Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "fd766755d426a0e4d5040279f742da1aa30852ce",
"body": "…rdingly\n\nThe published 0.7.0 tarball (verified by probing the registry artifact) contains\nlifetime token metering + in-room slash commands only. Warm resume, the live\nplan card, the context meter and elicitation landed after that publish, so they\nmove to a new unreleased 0.7.1 section and package.json bumps to 0.7.1 (patch\nonly, per the 0.7.x policy).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: 0.7.0 shipped on npm — bump to 0.7.1, split the CHANGELOG acco…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T03:25:26Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "2e39a765b77dc956b08a2e1c22b19d998aa2a538",
"body": "The agent's AskUserQuestion tool (and MCP-server elicitations) now reach the\nhuman: the adapter converts them to ACP `elicitation/create` once we advertise\nclientCapabilities.elicitation.form; the bridge renders a numbered question card\ninto the room / bound IM chat, takes the first HUMAN reply as t\n[…]\n \"2\" →\nagent continued with the chosen answer. 151/151 tests green.\n\nFolded into the unpublished 0.7.0 (version unchanged per the 0.7.x policy).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: agent-initiated questions in chat — ACP form elicitation (0.7.0)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T03:18:47Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "690dace3681e7f16a457205952274ed94d3e5505",
"body": "….7.0)\n\nWarm resume: startEngine hands the persisted ACP session id back to the adapter\n(session/resume + ctx.attachSession — public at runtime, typed private), so a\nrestart/crash recovery keeps the agent's conversation context instead of starting\ncold. Any resume failure falls back to a fresh sessi\n[…]\nded into the unpublished 0.7.0 (version unchanged per the 0.7.x policy).\n142/142 tests green (adds resume success/fallback + store round-trips).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: warm resume across restarts + live plan card + context meter (0…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-02T02:40:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "910f060b6d568c3db5693e1bf056dac7cd8ce15f",
"body": "Token accounting becomes a lifetime cumulative meter: usage per task/room only\ngrows and never auto-resets — not by time, restart, /compact, or /clear. The only\nreset is an explicit `concord budget --reset` (now over SIGUSR2, decoupled from\n`concord resume`, which is unpause-only). `--budget` is a l\n[…]\nom a room message.\n\nDrop-in upgrade (bindings/creds/sessions preserved); restart running hosts so they\nrun the new daemon. 138/138 tests green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: lifetime token metering + in-room slash commands (0.7.0)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-01T22:19:13Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "772f15814949156784b5daa7af8a7ad1130e5e04",
"body": "…6.0→0.6.4)\n\nShip the IM lifecycle + reliability arc, published as 0.6.0 through 0.6.4.\n\nLifecycle & monitoring:\n- `concord shutdown` is now a SOFT stop — keeps every agent config and IM binding\n (reversible); `concord up` revives the whole fleet with no re-binding; `concord reset`\n is the explici\n[…]\nocs/getting-started.md shutdown description corrected.\n- Test hygiene: hosts/creds/store tests cleaned up leaked mkdtemp dirs. 139 tests green.\n\nCo-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(im): fleet lifecycle + local agent-presence + resume-403 fix (0.…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-07-01T07:16:30Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "07613ce6b85c6acd4a47a2c306724f37566959c8",
"body": "… health\n\ngetConnectionStatus()'s live behavior is unverified (API confirmed, behavior pending a real\nbot scan). Guard against a quirky 'idle' false-alarming an actively-used binding: if inbound\nevents are flowing, the connection demonstrably works → 'flowing', regardless of reported\nstate. Only \"no recent events AND not connected\" reads as 'suspect'.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(im): receiving inbound overrides a stale connState in event-plane…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-30T16:20:57Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "66b6120eb90751e46ba1fd98467f5d056ff00f8d",
"body": "…im status)\n\nThe IM owner now continuously reconciles desired (bindings) vs actual (connection / relay /\nroom / agent) state and writes a health.json the CLI reads, turning a class of silent\nfailures into a visible \"what's wrong + the one next command\".\n\n- WSClient connection callbacks (onReady/onEr\n[…]\ndown). 134/134 tests pass. Needs the new backend endpoint\ndeployed for agent-presence to activate; degrades gracefully until then.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(im): owner reconcile loop + end-to-end health snapshot (concord …",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-30T16:18:40Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "46474fd9ae432f13445a40b025140ff68c793ae7",
"body": "Root cause of \"switched bot app (login --qr --new) but binding the new app gets no\nresponse, the old app still works\": the IM owner bakes appId/appSecret into its WSClient\nAT SPAWN, but `startImOwnerIfNeeded` only checked whether an owner process was alive — not\nwhich app it was connected to. So aft\n[…]\nis treated as unverifiable → restarted (never\nsilently trusted). 118/118 tests pass. CLI / owner only — Concord backend untouched.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(im): restart the IM owner onto the current bot app when creds change",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-30T14:50:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "39c1557263970488e357142f192cd63f10969ab4",
"body": "…ailures, bindings\n\nHigh-priority UX quick-wins from the 2026-06-30 review (CLI side, zero core-backend changes):\n\n- room name in `concord list`/`status` (cached at host start, CJK-width aligned, falls back to short id)\n- STATUS now shows working/idle/paused/crashed — what the agent is DOING, not ju\n[…]\n, store activity/paused/exit\nsetters (+tests). All in the CLI / ACP bridge — the Concord backend is untouched. 111/111 tests pass.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(cli): surface what each agent is doing — room names, activity, f…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-30T08:34:06Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0dbfae6988d3c34423ef0ee1a58f897abfa3538c",
"body": "The README still only documented manual `--app-id/--app-secret` login and\nomitted the IM owner command. Add the QR login (the recommended 0.3.0 flow —\nno developer console, no version publish) and `concord im` to the Commands block.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: README Commands — surface `concord login --qr` and `concord im`",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-30T03:57:43Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "0bc6fe8901209cfcca7bdb0bc2841f1b6d6a48ff",
"body": "…ount workaround\n\nThe `--qr` flow doesn't bypass Lark/Feishu's enterprise governance: in a tenant\nwhere the user isn't an admin, the scan returns valid creds but the new app sits\nin admin-approval limbo and messages don't actually route. Creds look healthy so\nwe can't detect this from code. Fixes:\n\n\n[…]\nadmin approval — no\n re-scan needed once approved.\" The reuse path is silent (creds came from a\n presumably working prior scan).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs+cli: surface the enterprise admin-approval caveat + personal-acc…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-30T02:27:59Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b2287eb3721cc0dc47817ff8c74409e8576947c5",
"body": "…force escape hatches)\n\nRe-running the QR flow with existing creds used to silently create a duplicate\napp every time, littering the user's workspace with dead Concord apps. Default\nnow: if creds already exist, skip the scan, show how to override, and ensure\nthe IM owner is up (so re-running becomes\n[…]\nand --force to\nre-scan and update the existing app's config (registerApp with appId = the\n2nd-scan grant flow). Help text updated.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: `concord login --qr` reuses existing app by default (--new / --…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-30T02:19:42Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f89a7c6f067d43fd22e6a6510bc61a85d602ab10",
"body": "After a successful scan the bot has creds but nothing is listening, so a\n`/concord-bind` in the chat would go nowhere until the user separately ran\n`concord im`. Auto-start the owner at the tail of the QR flow (skip if one is\nalready running for that platform). Extract the owner-spawn logic into a s\n[…]\ntach behavior are identical. Auto-start failure is non-fatal — the user still\nhas working creds and can fall back to `concord im`.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: `concord login --qr` auto-starts the IM owner",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-30T02:15:11Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ceb83c46bc55c0046bd6fc59be4fa7a83da0d6de",
"body": "…3.0)\n\nThe Lark/Feishu onboarding is now one command: `concord login lark --qr` renders\na QR in the terminal, you scan it in the app, tap Agree on the confirm page,\nand the bot's appId+appSecret land in ~/.concord/creds.json. No developer\nconsole, no manual scope hunt, no version publish.\n\nUses regi\n[…]\ne user sees the easy path first.\ndocs/getting-started.md restructured to make QR the primary flow, manual a\ncollapsed alternative.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: `concord login --qr` — zero-config bot creation via QR scan (0.…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-30T01:54:31Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5bfb2a5311a7783f625bd246707f814e52bc04df",
"body": "…I is missing (0.2.3)\n\nA fresh `concord join claude` on a machine without Claude Code would silently\nstart the ~250MB ACP-adapter npx download and then mysteriously fail to auth\n(the bundled runtime reads ~/.claude credentials from a normal install). Check\nPATH for the chosen agent's CLI at startup \n[…]\n npm-install lines for claude / gemini / codex; --no-agent-check (or\nCONCORD_NO_AGENT_CHECK=1) bypasses for non-standard installs.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: preflight check — fail fast with install hint when the agent CL…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-30T00:00:19Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3ed08e37eae607dfd75c9edc33c247742b2b7ce4",
"body": "…hung (0.2.2)\n\nThe ACP adapter is fetched via `npx` at first use, and the claude adapter drags\nin a ~250MB platform-native agent runtime. startEngine() awaited that download\nsilently before pollLoop() ran, so a fresh machine looked like \"joined the room\nbut never responds\" with no clue. Print the ad\n[…]\ns\" note before spawning, and on startup failure\nhint that the first run needs npm-registry access (or pre-warm with that command).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: announce the first-run adapter download so startup doesn't look …",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T15:46:17Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "fe0c256250f5c90d11a722512bfa9642045757c0",
"body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: release 0.2.1 (room-too-large reply fallback + join-a-room guide)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T15:01:34Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a4926c0d1fb4fd0faff2cd3135b8301778c5829a",
"body": "The CLI's everyday flow is `concord join <agent> <roomId>` — install, grab the\nroom id (it's the access token), join; idle = zero tokens. Separate from the IM\ngetting-started guide (concord host + a bot). README now links both: joining-a-room\nfor the plain room flow, getting-started for the personal IM-bot flow.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add a \"joining a room\" guide for everyday Concord users",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T14:56:20Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6a6a89775f3b8d9c8b12a5abe1ac1189269e234b",
"body": "The room caps a message body at 2MB (HTTP) and hard-truncates content past ~50k\nchars. sendToRoom posted via a bare fetch and never checked res.ok — and fetch\ndoesn't throw on an HTTP error status — so a >2MB reply got a 413 and vanished\nwith no error and nothing in the chat. On 413, resend a truncated body (+ a\n\"reply too large, truncated\" marker) so the user gets the clipped reply instead\nof silence; log other non-ok posts.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(im): don't silently drop a reply the room rejects as too large",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T14:34:46Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "754073c20dd0b1af53fbcfb4b50623fb03801e9f",
"body": "…st task)\n\nWalks a first-time user from `npm install` through creating their own\nLark/Feishu custom app (bot capability, long-connection events,\nim.message.receive_v1, the exact scopes, release-to-take-effect), storing\ncreds, starting the owner, binding a chat, daily use, management, token\nsafety, and a troubleshooting table. Linked from the README.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: add a from-zero getting-started guide (install → Lark bot → fir…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T14:07:10Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "9a87557c122717e02bce2bc6dc144cd6761dbfff",
"body": "Claude Code sometimes concludes a turn with a post_turn_summary system event\ninstead of assistant text; ACP adapter 0.52.0 doesn't map it (logs \"Unexpected\ncase\") so the reply comes through empty and nothing reaches the IM chat — worst\non no-tool conversational turns, which go fully silent. Post a \"\n[…]\nr\nwhen a clean turn produces no text, so the chat always shows the turn finished.\nProgress cards already convey what the turn did.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(im): never go silent — confirm turn end when the agent emits no text",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T12:24:12Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "5fc224dfc30f69191c9cb5f79985f10113d4a43f",
"body": "… only)\n\nA bound host ran ACP_PROGRESS=0, so the IM chat saw the instant ack then nothing\nuntil the final reply — the agent's work was invisible. host (incl. --bind) is\ndocumented as progress ON; the bound special-case contradicted that. Drop it so a\nbound host emits one progress card per tool call \n[…]\n`\nowner relays on to the chat. im=null on a bound host (owner owns the bot), so out()\nstays room-only and there is no double-send.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(im): bound agents relay progress to the IM chat (was final-reply…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T12:04:40Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "7946f461729805e37110973add32db14c65f4cf5",
"body": "The only way to get a \"private\" chat with the bot is to make a group and add\nit, but a group otherwise forces every message to @-mention the bot. Detect a\ngroup with user_count <= 1 (Lark chat.get returns the human count apart from\nbot_count) and drop the @ requirement for it, like p2p. Cached 60s s\n[…]\nd person reverts within a\nminute. Needs the im:chat:readonly scope; without it chat.get throws and we\nstay @-only (safe fallback).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(im): treat a solo group (one human + bot) like p2p — no @ required",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T11:52:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3c162e9c9db44647bd0d23e0ae1c437103d73d08",
"body": "Live render test: Lark cards show inline-code backticks literally but render fenced\nblocks as a copyable code box. So shell commands stay fenced (the copy button Tom\nwanted) and every other inline backtick is dropped → bold/plain. 100/100.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(im): commands as fenced code blocks (copy box), no inline backticks",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T11:34:18Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "a1a87c94a52cf80cd4bbb61f4cee8cc895ab0d55",
"body": "…ckticks\n\n#1 was the Concord room name, not the Lark group name. Fetch it from the agent\nREST /rooms/:id/info (room id is the bearer) instead of Lark im.chat.get. Show it\nin the self-intro and /agents. Also drop inline backticks from the intro/agents —\nLark cards render **bold** but show `code` backticks literally. 100/100.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(im): show the CONCORD ROOM name (not Lark chat) + drop literal ba…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T11:30:02Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "43de7846a88f9a46ae2cc2724386e08c78f61c7a",
"body": "…rdown\n\n- #1: the owner resolves the chat/group name (Lark im.chat.get, cached, best-effort)\n and shows it in the self-intro (\"已接入「后端项目」\") and /agents listing.\n- #3: `concord shutdown` stops the IM owner + every agent and clears all bindings —\n the one-command clean slate (what we'd been doing by \n[…]\nnt bots coexist in a group via @-targeting;\nthe only cautions are shared room / shared cwd / others burning your budget.)\n100/100.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(im): chat name in intro/agents + `concord shutdown` one-shot tea…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T11:18:49Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "7e0d8db3714025587c6f63d7fc3ac28632678e05",
"body": "…ng fix (0.2.0)\n\n- #1 copy: bind/rebind commands now sent as a fenced code block (Lark renders a\n copyable code box) instead of inline backticks.\n- #3 hang: obtainRoomId force-closes the loopback (Connection: close +\n closeAllConnections) so a browser keep-alive can't leave `concord host --bind`\n \n[…]\nat that host's room\n (was lingering → owner kept relaying into a dead agent).\n\nBump 0.2.0 (IM owner + bindings feature). 100/100.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(im): bind UX round 2 — copy-box, /agents, rm unbinds, handoff ha…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T11:04:39Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "fd6e5136a5aa6f64f390054203ad9e006348dc27",
"body": "- #2 markdown: render outbound via im-render.mjs — status lines (收到/✓) go as plain\n text, replies as a card; ATX headings (#) → bold (Lark cards render # literally).\n- #3 self-intro: a new binding now posts a proper intro to the chat (agent name +\n cwd, @-me reminder), not a bare \"✓ 绑定成功\". concord\n[…]\nder open_id → display name (agent sees \"张三: task\"); /help command;\n /usage routed to the agent verbatim (was a no-op). 97→ tests.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(im): UX polish — markdown render, self-intro, names, /help",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T10:47:18Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "6ea48dffce02304e7d194010154f777971675c26",
"body": "A stopped owner's relay session lingers in the room, so a fresh owner joining as\n\"IM\" hit 409 and the relay never came up after restart. Retry with a pid-suffixed\nname on 409 and key the loop-guard on the name actually joined (per-room). 93/93.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(im): owner relay survives restart — retry room join on 409",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T10:27:38Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "b0c02c342c26c4428effc12270c0f7c3bcd93eca",
"body": "When the owner picks up a NEW binding it now posts \"✓ 绑定成功 …\" (or \"⚠️ 绑定失败\"\nif the room won't join) to that chat, so the user who just ran `concord host --bind`\ngets feedback in the chat, not only the terminal. Watch the ~/.concord directory\n(the bindings file may not exist at owner startup) instead\n[…]\n the\nrelay only coming up lazily on the first message. Startup sync stays silent (a\nrestart never re-spams existing chats). 93/93.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(im): confirm bind success/failure IN the chat + watch dir not file",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T10:23:12Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "0abfe811ea4c3f03615dbdec2aa54ab394008dfd",
"body": "…phase 3+4)\n\nPhase 3 (relay, im-owner.mjs): bound chat → POST into the room (as \"IM\") + instant\nack (decision 4); per-room poll relays the agent's reply/progress/budget-notes back\nto the chat (loop-guard: skip \"IM\"); fs.watch on the bindings file brings relays up\nfor fresh binds without restarting t\n[…]\ne]` writes\nthe chat→room binding + starts a progress-OFF agent (the owner relays). Group binds\ndefault to --budget 1000000. 92/92.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(im): owner relay + `concord im` daemon + `concord host --bind` (…",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T09:54:24Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "8444018f7b987cb756f284955ebcbe5f5e1ed926",
"body": "/concord-bind handshake verified live against a real Lark app: both p2p and\ngroup → action=bind, owner replies the guided command in-chat. The text-preview\nlog made the (transient first-run) ignore easy to rule out.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore(im): owner logs parsed text preview (live-debug aid)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T09:23:46Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "e90b3e7a1fa8a5952d8d529893306ad70b589d27",
"body": "im-owner.mjs (`concord im`): owns the bot's single WSClient, classifies inbound\n(im-routing), handles /concord-bind + /concord-unbind IN the chat (decision 1:\nreply in-group), routes bound chats (room relay = phase 3). Bind command is now\n/concord-bind (slash, canonical; bare still accepted) — clear\n[…]\nind\". Group binds default to --budget 1000000. createOwner is testable\nwith a mock client; 6 owner tests + routing updated. 92/92.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(im): IM owner with /concord-bind handshake (phase 2b)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T08:49:16Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "ecf7628f7c6022e3b4a68729296340a4cedbc46f",
"body": "im-routing.mjs: classifyInbound + commandOf — decides ignore/bind/unbind/usage/\nmessage for each inbound message (p2p=all, group=@bot only; commands matched on\nthe mention-stripped text). No I/O/SDK → 6 offline tests. The owner daemon (2b)\nwill wire this to the WSClient. 86/86.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(im): pure inbound-routing brain (phase 2a)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T08:03:50Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "f4576f948d5f9ea6e6917b6d4c6fc67f2b57f2c6",
"body": "Groundwork for the single-tenant IM owner model (one bot drives N agents, routed\nby chat). im-bindings.mjs: local, atomic, keyed by platform:chat_id, force-guard\non clobber. Not wired in yet — pure store + 6 tests. Design:\nim-for-agents/docs/im-binding-design.md. 80/80.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(im): chat→room binding store (phase 1 of owner+bindings redesign)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T07:55:24Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "40b90c0cff2e8b5ee3dee6520175a49022f2097c",
"body": "obtainRoomId left its 5-minute watchdog setTimeout un-cleared after the room\ncallback resolved, so the event loop stayed alive and `concord join/host` (the\nno-room browser-handoff path) appeared \"stuck waiting\" long after the daemon had\nstarted. Clear the timer on resolve + unref it so it can never block process\nexit. Adds an e2e regression test.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: CLI no longer hangs ~5min after browser room-pick (0.1.3)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T05:26:05Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "21eeb197e6de0eb8fb35317e14e9752be3b273ea",
"body": "Reads version from package.json at runtime (single source of truth, can't drift\nfrom what's published). Folded into the not-yet-published 0.1.2. 73/73 tests\n(adds concord-version.test.mjs).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: `concord version` (-v / --version) prints the version",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T05:00:23Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "6ecc12ac7b348e31d34daf3525a3aa39a55d25e0",
"body": "Token/memory safety. `concord rm` on a RUNNING (or orphaned) host used to just\nunregister + delete state — leaving the supervisor + ACP adapter + agent group\nalive, still polling the room and burning tokens, AND throwing away the pids\nneeded to ever reap them. Confirmed live: three rm'd hosts left ~\n[…]\ncord-rm.test.mjs): a real running process\nregistered as a host is killed by `concord rm` before the entry is dropped.\n72/72 tests.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: `concord rm` reclaims the agent group before removing (0.1.2)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T04:54:56Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "e58c5b0bd87b3ee9a6cc3bade266875cbdec1288",
"body": "Two fixes for the published package so it works out of the box:\n\n- Default --url is now https://concord.fenginwind.com (was localhost:3001,\n a dev leak). Override with --url http://localhost:3001 or CONCORD_URL for\n self-hosted/dev.\n- Room id can be the 2nd positional: `concord join <agent> <room>\n[…]\nonal > CONCORD_ROOM_ID > web handoff.\n\nHelp text (concord --help and bare-bridge --help) and README updated to match.\n71/71 tests.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: default to hosted Concord + accept positional room id (0.1.1)",
"author_name": "zkwasm",
"author_login": "zkwasm",
"committed_at": "2026-06-29T04:42:27Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "1d83a037b85cf1eafa4b14d6b0d1e86718857f94",
"body": "Wires the IM half of `concord host` (was a stub): talk to your hosted agent from\nLark/Feishu. Personal mode = 1:1 (your own custom-app bot ↔ your room ↔ your agent),\nso NO chat↔room binding table, NO central relay, NO multi-tenant — the model-B\nmachinery that caused the old \"private chat = no respon\n[…]\nction needs a real custom app to verify\n(WSClient handshake) — see docs/im-setup-guide.md (user) + docs/lark-host-private-chat.md.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat(im): personal-mode Lark/Feishu bridge for `concord host --im`",
"author_name": "zkwasm",
"author_login": "masstensor",
"committed_at": "2026-06-29T03:09:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "3ec6414ea9241f3f1aa14322ad79d48f37cae7cd",
"body": "The 'retry once ps recovers' note holds only for a transient ps failure at reap\n(start was captured); if ps was absent AT CAPTURE the start is null forever and the\nhost is never auto-reaped (clean shutdown / manual kill only). No behavior change.\n\nRound-5 final convergence review: CONVERGED — zero confirmed critical/high; all\ntoken-burn paths bounded. This was the only (low, doc-only) confirmed item.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "docs: clarify the unverifiable-orphan keep-pid comment (round-5 nit)",
"author_name": "zkwasm",
"author_login": "masstensor",
"committed_at": "2026-06-28T12:29:20Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "0dc27e1bbf31430d01a2beee56226ed9a2cf426f",
"body": "…pause)\n\nRound-4 stabilization review found the cbfcf10 fixes themselves had two false-\nnegatives that REOPENED an unbounded burn path. Closed both:\n\nHIGH — identity-guard false-negative + permanent forfeit. When the adapter's\n start-time was unverifiable (ps failed/absent at spawn OR transiently a\n[…]\n'}`); now it\n points to `concord list` for the id.\n\nTests 63/63 (+4 reapAdapterGroup reason tests incl. unverifiable-not-killed).\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(safety): close round-4 false-negatives (identity guard + timeout …",
"author_name": "zkwasm",
"author_login": "masstensor",
"committed_at": "2026-06-28T11:15:19Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "cbfcf10f4aa0e600a580cac2ec980ca4d408c1eb",
"body": "… review)\n\nA focused adversarial review of commit 484c4e4 confirmed the P0/P1/P3 fixes hold\nbut flagged new issues the fixes themselves introduced. Closed them (UX unchanged):\n\nHIGH — sweepOrphans group-killed a bare stale adapter pgid with NO identity guard,\n on every command incl. read-only ones \n[…]\n delay 0), so a just-finished turn is never killed.\n\nTests 59/59 (added a recycled-pid 'never group-killed' test). README updated.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(safety): close new bugs from the burn-fix batch (fix-verification…",
"author_name": "zkwasm",
"author_login": "masstensor",
"committed_at": "2026-06-28T09:41:14Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "484c4e4606a53e2b6732cec152a1a3d41a21cc5a",
"body": "The core guarantee — a hosted agent must never be a silent bottomless token sink —\nwas not held. A focused threat-model review (reproduced: one wedged turn burned 8M\ntokens under a 50k cap; usage-absent made the cap a no-op; crash-loop spawned 100\nadapters). Closed every path, WITHOUT changing the c\n[…]\nout test that proves a never-stopping turn is\nbounded). turnTimeoutMs is an injectable createEngine option. README \"Token safety\".\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix(safety): bound + surface all token-burn paths (threat-model review)",
"author_name": "zkwasm",
"author_login": "masstensor",
"committed_at": "2026-06-28T08:55:07Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "f6fbbcf38edd4a613bbce40fb580fdda473754ec",
"body": "Resolve the comprehensive-review findings (1 critical, 1 high, 4 medium, 2 low):\n\n- CRITICAL: drain() now wraps each turn in try/catch + finally(busy=false), posts\n a failure note to the room, and self-heals a dead engine (recreate the adapter +\n ACP session) instead of crashing the host. Added an\n[…]\nrget stopHost, usage-mapper, dead()/resilience,\nadapter-pgid persistence). npm pack clean. Real-adapter shutdown reclaim verified.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "fix: harden turn loop + adapter-group reclamation (review findings)",
"author_name": "zkwasm",
"author_login": "masstensor",
"committed_at": "2026-06-28T07:21:52Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "b3114d9f1b17b5015800f899e9033731568f62f2",
"body": "Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "chore: add repository/homepage/bugs metadata",
"author_name": "zkwasm",
"author_login": "masstensor",
"committed_at": "2026-06-28T04:03:08Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "1a70268328ef12dbc279832fc332e858a3e1f8d3",
"body": "New package (bin: concord) split out from the im-for-agents bridges/acp spike.\nDrives claude/codex/gemini over the open Agent Client Protocol via the official\n@agentclientprotocol/sdk (Zed, Apache-2.0) — no third-party orchestrator dep.\nResident session (idle = zero tokens), token budget, daemon lif\n[…]\nhild-group reclamation, personal IM bridge (concord login).\n\nconcord-mcp stays frozen; this is the additive agent-hosting ingress.\n\nCo-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>",
"is_bot": false,
"headline": "feat: concord-agent — host coding agents in Concord rooms over ACP",
"author_name": "zkwasm",
"author_login": "masstensor",
"committed_at": "2026-06-28T02:59:16Z",
"body_truncated": true,
"is_coding_agent": true
}
],
"releases_count": 1,
"commits_last_year": 76,
"latest_release_at": "2026-06-29T12:24:12Z",
"latest_release_tag": "v0.2.0",
"releases_from_tags": true,
"days_since_last_push": 8,
"active_weeks_last_year": 4,
"days_since_latest_release": 31,
"mean_days_between_releases": null
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "concord-agent",
"exists": true,
"license": "MIT",
"keywords": [
"concord",
"acp",
"agent-client-protocol",
"coding-agent",
"claude",
"codex",
"ai",
"cli"
],
"ecosystem": "npm",
"matches_repo": true,
"registry_url": "https://www.npmjs.com/package/concord-agent",
"is_deprecated": false,
"latest_version": "0.7.18",
"repository_url": "https://github.com/zkwasm/concord-agent",
"versions_count": 33,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": 1,
"monthly_downloads": 4994,
"first_published_at": "2026-06-29T03:40:36.745000Z",
"latest_published_at": "2026-07-22T07:23:55.919000Z",
"latest_version_yanked": null,
"days_since_latest_publish": 8
}
]
},
"popularity": {
"forks": 0,
"stars": 0,
"watchers": 0,
"fork_history": {
"days": [],
"complete": true,
"collected": 0,
"total_forks": 0
},
"star_history": {
"days": [],
"complete": true,
"collected": 0,
"total_stars": 0,
"collected_at": null
},
"open_issues_and_prs": 0
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [],
"largest_source_bytes": 60670,
"source_files_sampled": 48,
"oversized_source_files": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"package.json"
],
"advisories": {
"error": null,
"scope": "published_package",
"source": "osv",
"findings": [],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {},
"advisory_count": 0,
"affected_count": 0,
"assessed_count": 57,
"malicious_count": 0,
"assessed_package": "npm:concord-agent@0.7.18",
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"npm"
],
"dependencies": [
{
"name": "@agentclientprotocol/sdk",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "0.28.1"
},
{
"name": "@larksuiteoapi/node-sdk",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^1.68.0"
},
{
"name": "qrcode-terminal",
"manifest": "package.json",
"ecosystem": "npm",
"version_constraint": "^0.12.0"
}
],
"all_dependencies": {
"error": "GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository",
"source": null,
"packages": [],
"collected": false,
"truncated": false,
"total_count": null,
"direct_count": null,
"indirect_count": null
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 0,
"open_issues": 0,
"closed_ratio": null,
"closed_issues": 0,
"closed_unmerged_prs": 0
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "zkwasm",
"commits": 68,
"avatar_url": "https://avatars.githubusercontent.com/u/113981964?v=4"
},
{
"type": "User",
"login": "masstensor",
"commits": 8,
"avatar_url": "https://avatars.githubusercontent.com/u/1336077?v=4"
}
],
"contributors_sampled": 2,
"top_contributor_share": 0.895
},
"quality_signals": {
"has_ci": false,
"has_tests": false,
"ci_workflows": [],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"package-lock.json"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 0,
"reason": "branch protection not enabled on development/release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": null,
"reason": "no pull request found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/30 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 0,
"reason": "project has 0 contributing companies or organizations -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": null,
"reason": "no workflows found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 0,
"reason": "project was created within the last 90 days. Please review its contents carefully",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": null,
"reason": "no dependencies found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "no SAST tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": null,
"reason": "No tokens found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 0,
"reason": "29 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "0ae809fffffc6860ae9fad729021223e004b3146",
"ran_at": "2026-07-31T05:48:14Z",
"aggregate_score": 1.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-23T03:09:03Z",
"oldest_open_prs": [],
"last_merged_pr_at": null,
"ci_last_conclusion": null,
"oldest_open_issues": []
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/zkwasm/concord-agent",
"host": "github.com",
"name": "concord-agent",
"owner": "zkwasm"
},
"metrics": {
"overall": {
"key": "overall",
"band": "at_risk",
"name": "Overall health",
"note": null,
"notes": [],
"value": 38,
"inputs": {
"security": 32,
"vitality": 58,
"community": 33,
"governance": 33,
"engineering": 31
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 58,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "at_risk",
"name": "Development activity",
"note": null,
"notes": [],
"value": 48,
"inputs": {
"commits_last_year": 76,
"human_commit_share": 1,
"days_since_last_push": 8,
"active_weeks_last_year": 4
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 8 days ago",
"points": 28.8,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 8
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "4/52 weeks with commits",
"points": 2.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 4
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "76 commits in the last year",
"points": 16.9,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 76
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "good",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 72,
"inputs": {
"releases_count": 1,
"latest_release_tag": "v0.2.0",
"releases_from_tags": true,
"days_since_latest_release": 31,
"mean_days_between_releases": null
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "1 version tags (no GitHub releases)",
"points": 16.2,
"status": "partial",
"details": [
{
"code": "version_tags_no_releases",
"params": {
"count": 1
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 31 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 31
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "cadence unknown (single release)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "release_cadence_unknown",
"params": {}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "unverified",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": "repository_too_young",
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": null,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "maintenance record not established from the collected data",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_unverified",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 33,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "critical",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 1,
"inputs": {
"forks": 0,
"stars": 0,
"watchers": 0,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "0 stars",
"points": 0,
"status": "missed",
"details": [
{
"code": "stars",
"params": {
"count": 0
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "0 forks",
"points": 0,
"status": "missed",
"details": [
{
"code": "forks",
"params": {
"count": 0
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "0 watchers",
"points": 0,
"status": "missed",
"details": [
{
"code": "watchers",
"params": {
"count": 0
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
},
{
"key": "ecosystem_adoption",
"band": "moderate",
"name": "Ecosystem adoption (downloads)",
"note": "Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"registry_dependents"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 62,
"inputs": {
"packages": [
"concord-agent"
],
"dependents": null,
"ecosystems": "npm",
"total_downloads": null,
"monthly_downloads": 4994
},
"components": [
{
"key": "monthly_downloads",
"name": "Monthly downloads",
"detail": "4,994 downloads/month across npm",
"points": 49.3,
"status": "partial",
"details": [
{
"code": "downloads_monthly",
"params": {
"count": 4994,
"ecosystems": "npm"
}
}
],
"max_points": 80
},
{
"key": "registry_dependents",
"name": "Registry dependents",
"detail": "not reported by this ecosystem",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_reported_by_this_ecosystem",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "at_risk",
"name": "Sustainability & Governance",
"value": 33,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "critical",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 14,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 2,
"top_contributor_share": 0.895
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 90% of commits",
"points": 2.4,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 90
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "2 contributors",
"points": 2.7,
"status": "partial",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 2
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "critical",
"name": "Issue & PR responsiveness",
"note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"issue_resolution",
"pr_acceptance"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"merged_prs": 0,
"open_issues": 0,
"closed_issues": 0,
"issue_closed_ratio": null,
"closed_unmerged_prs": 0
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "no issues or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_issues_or_data",
"params": {}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "no decided pull requests or no data",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_decided_prs_or_data",
"params": {}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "at_risk",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 36,
"inputs": {
"followers": 2,
"owner_type": "User",
"is_verified": null,
"owner_login": "zkwasm",
"public_repos": 9,
"account_age_days": 1409
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "2 followers of zkwasm",
"points": 3.4,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 2,
"login": "zkwasm"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "9 public repos, account ~3 yr old",
"points": 15,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 9
}
},
{
"code": "account_age_years",
"params": {
"years": 3
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"concord-agent"
],
"ecosystems": "npm",
"any_deprecated": false,
"min_days_since_publish": 8
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on npm",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "npm"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 8 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 8
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "33 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 33
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "at_risk",
"name": "Engineering Quality",
"value": 31,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "critical",
"name": "Engineering practices",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_ci_tests"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 1,
"inputs": {
"has_ci": false,
"has_tests": false,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "good",
"name": "Documentation",
"note": null,
"notes": [],
"value": 75,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "at_risk",
"name": "Security",
"value": 32,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "critical",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): CI-Tests, Dangerous-Workflow, Packaging, Pinned-Dependencies, Signed-Releases, Token-Permissions. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"ci_tests",
"dangerous_workflow",
"packaging",
"pinned_dependencies",
"signed_releases",
"token_permissions"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 15,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 12,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 6,
"scorecard_aggregate": 1.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection not enabled on development/release branches",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "no pull request found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/30 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 0 contributing companies or organizations -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no workflows found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "project was created within the last 90 days. Please review its contents carefully",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "no dependencies found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "no SAST tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "No tokens found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "29 existing vulnerabilities detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): No advisories left outstanding. Remaining weights renormalized. Matched the npm:concord-agent@0.7.18 runtime dependency closure — what installing the published package pulls in — 57 packages. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_published",
"params": {
"package": "npm:concord-agent@0.7.18",
"assessed": 57
}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 0,
"affected_packages": 0,
"assessed_packages": 57,
"unassessed_packages": 0,
"affected_by_severity": "none",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "no indirect dependency carries a known advisory",
"points": 25,
"status": "met",
"details": [
{
"code": "no_indirect_advisories",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 57,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "at_risk",
"name": "AI Readiness",
"value": 34,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 1,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "76 of 76 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 76,
"sampled": 76
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "critical",
"name": "Verify loop (build / test / typecheck)",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Pinned-Dependencies. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_pinned_dependencies"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 22,
"inputs": {
"has_nix": false,
"has_tests": false,
"lockfiles": [
"package-lock.json"
],
"has_dockerfile": false,
"typed_language": false,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.895,
"toolchain_manifests": [],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "68 of the last 76 commits agent-authored or agent-credited",
"points": 10,
"status": "met",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 68,
"sampled": 76
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "no dependencies found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 54,
"inputs": {
"primary_language": "JavaScript",
"largest_source_bytes": 60670,
"source_files_sampled": 48,
"oversized_source_files": 1
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "JavaScript without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "JavaScript"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "1/48 source files over 60KB",
"points": 53.9,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 48,
"oversized": 1
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"GitHub dependency-graph SBOM unavailable (404); the dependency graph may be disabled for this repository"
],
"report_type": "repository",
"generated_at": "2026-07-31T05:48:18.641568Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/z/zkwasm/concord-agent.svg",
"full_name": "zkwasm/concord-agent",
"license_state": "standard",
"license_spdx": "MIT"
}