@agentuity/coder
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): Manual publish by known maintainer, no attested lineage regressed. | ai | |
| npm-metadata | no-description | AI (npm-metadata): Established SDK subpackage, not throwaway. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Growth explained by generated .d.ts/type files from SDK refactor, not obfuscated payload. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): Deps are first-party sibling packages from a monorepo split, not unrelated third-party additions. | ai | |
| dependencies | unvetted-dep:@agentuity/api | AI (dependencies): First-party sibling package in the same monorepo/scope, pinned to matching version. | ai | |
| bogus-package | bogus-package | AI (bogus-package): Internal monorepo package; missing description/repo/keywords is consistent across @agentuity/* scope packages. | ai | |
| phantom-deps | phantom-dep:@agentuity/server | AI (phantom-deps): Same-org dep at matching version; likely re-exported rather than directly imported — stable false positive for this package. | ai |
Versions (showing 71 of 71)
| Version | Deps | Published |
|---|---|---|
| 3.1.6 | 6 / 3 | |
| 3.1.5 | 6 / 3 | |
| 3.0.12 | 1 / 3 | |
| 3.0.11 | 1 / 3 | |
| 3.0.10 | 1 / 3 | |
| 3.0.9 | 1 / 3 | |
| 3.0.8 | 1 / 3 | |
| 3.0.7 | 1 / 3 | |
| 3.0.6 | 1 / 3 | |
| 3.0.5 | 1 / 3 | |
| 3.0.4 | 1 / 3 | |
| 3.0.3 | 1 / 3 | |
| 3.0.2 | 1 / 3 | |
| 3.0.1 | 1 / 3 | |
| 3.0.0 | 1 / 3 | |
| 2.0.30 | 2 / 4 | |
| 2.0.29 | 2 / 4 | |
| 2.0.28 | 2 / 4 | |
| 2.0.27 | 2 / 4 | |
| 2.0.26 | 2 / 4 | |
| 2.0.25 | 2 / 4 | |
| 2.0.24 | 2 / 4 | |
| 2.0.23 | 2 / 4 | |
| 2.0.22 | 2 / 4 | |
| 2.0.21 | 2 / 4 | |
| 2.0.20 | 2 / 4 | |
| 2.0.19 | 2 / 4 | |
| 2.0.18 | 2 / 4 | |
| 2.0.17 | 2 / 4 | |
| 2.0.16 | 2 / 4 | |
| 2.0.15 | 2 / 4 | |
| 2.0.14 | 2 / 4 | |
| 2.0.13 | 2 / 4 | |
| 2.0.12 | 2 / 4 | |
| 2.0.8 | 2 / 4 | |
| 2.0.7 | 0 / 6 | |
| 2.0.6 | 0 / 6 | |
| 2.0.5 | 0 / 6 | |
| 2.0.4 | 0 / 6 | |
| 2.0.3 | 0 / 6 | |
| 2.0.2 | 0 / 6 | |
| 2.0.1 | 0 / 6 | |
| 2.0.0 | 0 / 6 | |
| 1.0.64 | 0 / 6 | |
| 1.0.63 | 0 / 6 | |
| 1.0.62 | 0 / 6 | |
| 1.0.61 | 0 / 6 | |
| 1.0.60 | 0 / 6 | |
| 1.0.59 | 0 / 6 | |
| 1.0.58 | 0 / 6 | |
| 1.0.57 | 0 / 6 | |
| 1.0.56 | 0 / 6 | |
| 1.0.55 | 0 / 6 | |
| 1.0.54 | 0 / 6 | |
| 1.0.53 | 0 / 6 | |
| 1.0.52 | 0 / 6 | |
| 1.0.51 | 0 / 6 | |
| 1.0.50 | 0 / 6 | |
| 1.0.49 | 0 / 6 | |
| 1.0.48 | 0 / 6 | |
| 1.0.47 | 0 / 6 | |
| 1.0.46 | 0 / 6 | |
| 1.0.45 | 0 / 6 | |
| 1.0.44 | 0 / 6 | |
| 1.0.43 | 0 / 6 | |
| 1.0.42 | 0 / 6 | |
| 1.0.41 | 0 / 6 | |
| 1.0.40 | 0 / 6 | |
| 1.0.39 | 0 / 6 | |
| 1.0.38 | 0 / 6 | |
| 1.0.37 | 0 / 6 |
v3.1.6
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: jhaynie.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (jhaynie) than the most recent previously approved version (p0tofpie) on 2026-07-02, but jhaynie is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v3.1.5
3 findingsThis version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: huijiro.
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (huijiro) than the most recent previously approved version (p0tofpie) on 2026-06-29, but huijiro is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.0.61
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (p0tofpie) than the most recent previously approved version (jhaynie) on 2026-03-26, but p0tofpie is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.
v1.0.53
2 findingsPackage was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
This version was published by a different npm account (p0tofpie) than the most recent previously approved version (jhaynie) on 2026-03-19, but p0tofpie is listed as a maintainer on prior approved versions (matched on name). This looks like a manual publish by a known maintainer rather than a publisher change. Recorded as INFO for audit trail.