@cleocode/caamp
Central AI Agent Managed Packages - unified provider registry and package manager for AI coding agents
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:@cleocode/paths | AI (dependencies): Same-org sibling package pinned to matching version; consistent with monorepo release pattern. | ai | |
| phantom-deps | phantom-dep:@cleocode/ct-skills | AI (phantom-deps): Same-org dep; likely re-exported or used indirectly — stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:@clack/prompts | AI (phantom-deps): @clack/prompts is explicitly declared in dependencies in package.json; phantom-dep flag is a false positive for this package. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @cleocode/cant is a sibling package in the same @cleocode monorepo, versioned identically (2026.4.9). New sibling deps added in lockstep are expected for this package's release pattern. | ai | |
| dependencies | unvetted-dep:@cleocode/cant | AI (dependencies): Same-org scoped package pinned to matching version — consistent monorepo release pattern. Not an independent risk. | ai | |
| dependencies | unvetted-dep:env-paths | AI (dependencies): env-paths is a well-known, widely-used npm utility for getting standard OS paths. Not a meaningful risk for this package. | ai | |
| provenance | slsa-provenance | AI (provenance): Package consistently publishes via CI/CD with Sigstore SLSA attestation — this is a stable, positive signal for this package. | ai |
Versions (showing 78 of 283)
| Version | Deps | Published |
|---|---|---|
| 2026.4.64 | 10 / 10 | |
| 2026.4.63 | 10 / 10 | |
| 2026.4.62 | 10 / 10 | |
| 2026.4.60 | 10 / 10 | |
| 2026.4.58 | 10 / 10 | |
| 2026.4.57 | 10 / 10 | |
| 2026.4.56 | 10 / 10 | |
| 2026.4.55 | 10 / 10 | |
| 2026.4.54 | 10 / 10 | |
| 2026.4.53 | 10 / 10 | |
| 2026.4.52 | 10 / 10 | |
| 2026.4.51 | 10 / 10 | |
| 2026.4.50 | 10 / 10 | |
| 2026.4.49 | 10 / 10 | |
| 2026.4.48 | 10 / 10 | |
| 2026.4.47 | 10 / 10 | |
| 2026.4.46 | 10 / 10 | |
| 2026.4.45 | 10 / 10 | |
| 2026.4.44 | 10 / 10 | |
| 2026.4.43 | 10 / 10 | |
| 2026.4.31 | 10 / 10 | |
| 2026.4.30 | 10 / 10 | |
| 2026.4.29 | 10 / 10 | |
| 2026.4.28 | 10 / 10 | |
| 2026.4.27 | 10 / 10 | |
| 2026.4.26 | 10 / 10 | |
| 2026.4.25 | 10 / 10 | |
| 2026.4.24 | 10 / 10 | |
| 2026.4.23 | 10 / 10 | |
| 2026.4.22 | 10 / 10 | |
| 2026.4.21 | 10 / 10 | |
| 2026.4.20 | 10 / 10 | |
| 2026.4.19 | 10 / 10 | |
| 2026.4.18 | 10 / 10 | |
| 2026.4.17 | 10 / 10 | |
| 2026.4.16 | 10 / 10 | |
| 2026.4.15 | 10 / 10 | |
| 2026.4.14 | 10 / 10 | |
| 2026.4.11 | 10 / 10 | |
| 2026.4.10 | 10 / 10 | |
| 2026.4.9 | 10 / 9 | |
| 2026.4.7 | 9 / 9 | |
| 2026.4.6 | 9 / 9 | |
| 2026.4.5 | 9 / 9 | |
| 2026.4.4 | 9 / 9 | |
| 2026.4.3 | 9 / 9 | |
| 2026.4.0 | 9 / 9 | |
| 2026.3.74 | 9 / 9 | |
| 1.9.1 | 9 / 9 | |
| 1.9.0 | 9 / 9 | |
| 1.8.1 | 9 / 9 | |
| 1.8.0 | 9 / 9 | |
| 1.7.1 | 9 / 9 | |
| 1.7.0 | 9 / 9 | |
| 1.6.1 | 8 / 9 | |
| 1.6.0 | 8 / 9 | |
| 1.5.2 | 8 / 9 | |
| 1.5.1 | 8 / 9 | |
| 1.5.0 | 8 / 9 | |
| 1.4.0 | 8 / 9 | |
| 1.3.1 | 8 / 9 | |
| 1.3.0 | 8 / 9 | |
| 1.2.1 | 8 / 9 | |
| 1.1.3 | 8 / 9 | |
| 1.1.2 | 8 / 9 | |
| 1.1.1 | 8 / 9 | |
| 1.1.0 | 8 / 9 | |
| 1.0.4 | 9 / 9 | |
| 1.0.3 | 9 / 9 | |
| 1.0.2 | 9 / 9 | |
| 1.0.1 | 9 / 9 | |
| 1.0.0 | 9 / 9 | |
| 0.5.1 | 9 / 9 | |
| 0.4.1 | 8 / 9 | |
| 0.4.0 | 9 / 7 | |
| 0.3.0 | 8 / 7 | |
| 0.2.0 | 8 / 6 | |
| 0.1.0 | 8 / 6 |
v2026.4.60
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2026.4.57
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2026.4.51
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2026.4.50
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2026.4.44
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2026.4.19
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2026.4.18
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2026.4.11
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.
v2026.4.0
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.