@canonmsg/claude-code-plugin
Canon channel plugin for Claude Code — messaging where AI agents are first-class citizens
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@canonmsg/coding-agent-host | AI (dependencies): First-party @canonmsg-scoped sibling package in same monorepo; not external/unresolvable. | ai | |
| dependencies | unvetted-dep:@canonmsg/rich-cards | AI (dependencies): Same-org monorepo sibling, trusted publisher. | ai | |
| dependencies | unvetted-dep:@canonmsg/agent-tools | AI (dependencies): Same-org monorepo sibling, trusted publisher. | ai | |
| phantom-deps | phantom-dep:@canonmsg/rich-cards | AI (phantom-deps): Same-org scope, likely indirect usage; not suspicious. | ai | |
| provenance | missing-githead | AI (provenance): Isolated missing gitHead with no other risk signals; clean publish history and no code changes from prior version. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): zod is a widely-used, well-vetted validation library; addition is benign for this package. | ai | |
| provenance | no-provenance | AI (provenance): Low-risk provenance gap; no other risk signals present for this package. | ai |
Versions (showing 51 of 75)
| Version | Deps | Published |
|---|---|---|
| 0.28.1 | 7 / 3 | |
| 0.28.0 | 7 / 3 | |
| 0.27.3 | 7 / 3 | |
| 0.27.2 | 7 / 3 | |
| 0.27.1 | 7 / 3 | |
| 0.27.0 | 7 / 3 | |
| 0.26.1 | 7 / 3 | |
| 0.26.0 | 7 / 3 | |
| 0.25.6 | 5 / 3 | |
| 0.25.5 | 5 / 3 | |
| 0.25.4 | 5 / 3 | |
| 0.25.3 | 5 / 3 | |
| 0.25.2 | 5 / 3 | |
| 0.25.0 | 5 / 3 | |
| 0.24.0 | 5 / 3 | |
| 0.23.0 | 5 / 3 | |
| 0.22.0 | 7 / 3 | |
| 0.21.2 | 7 / 3 | |
| 0.21.1 | 7 / 3 | |
| 0.21.0 | 7 / 3 | |
| 0.20.0 | 7 / 3 | |
| 0.19.6 | 5 / 3 | |
| 0.19.5 | 5 / 3 | |
| 0.19.4 | 5 / 3 | |
| 0.19.3 | 5 / 3 | |
| 0.19.2 | 5 / 3 | |
| 0.19.1 | 5 / 3 | |
| 0.19.0 | 5 / 3 | |
| 0.15.2 | 4 / 3 | |
| 0.15.1 | 4 / 3 | |
| 0.15.0 | 4 / 3 | |
| 0.14.18 | 4 / 3 | |
| 0.14.17 | 4 / 3 | |
| 0.14.16 | 4 / 3 | |
| 0.14.15 | 4 / 3 | |
| 0.14.14 | 4 / 3 | |
| 0.14.13 | 4 / 3 | |
| 0.14.12 | 4 / 3 | |
| 0.14.11 | 4 / 3 | |
| 0.14.10 | 4 / 3 | |
| 0.14.9 | 4 / 3 | |
| 0.14.8 | 4 / 3 | |
| 0.14.7 | 4 / 3 | |
| 0.14.6 | 4 / 3 | |
| 0.14.5 | 4 / 3 | |
| 0.14.4 | 4 / 3 | |
| 0.14.3 | 4 / 3 | |
| 0.14.2 | 4 / 3 | |
| 0.14.1 | 4 / 3 | |
| 0.14.0 | 4 / 3 | |
| 0.13.1 | 4 / 3 |
v0.28.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.28.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.27.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.27.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.27.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: canonmsg.
v0.27.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: canonmsg.
v0.26.1
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.26.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.25.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.25.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.25.4
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.25.3
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.25.2
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.25.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.24.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.23.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: canonmsg.
v0.22.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: canonmsg.
v0.21.2
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: canonmsg.
v0.21.1
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: canonmsg.
v0.21.0
2 findings[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
[Accepted risk] This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: canonmsg.
v0.20.0
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.19.6
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.19.5
1 finding[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.