@cleocode/runtime
Long-running process layer for CLEO — agent polling, SSE connections, heartbeat, key rotation
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| source-diff | obfuscated-file:dist/gateway/index.d.ts | AI (source-diff): Long single-line TypeScript barrel re-export in .d.ts; not obfuscated code, stable pattern for this bundled package. | ai | |
| dependencies | unvetted-dep:@cleocode/core | AI (dependencies): Sibling package in the same @cleocode monorepo, published at the same version via the same CI/CD pipeline with SLSA provenance. Unvetted status is a registry artifact, not a risk signal. | ai | |
| dependencies | unvetted-dep:@cleocode/contracts | AI (dependencies): Sibling package in the same @cleocode monorepo, published at the same version via the same CI/CD pipeline with SLSA provenance. Unvetted status is a registry artifact, not a risk signal. | ai |
Versions (showing 100 of 254)
v2026.7.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2026.7.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2026.6.19
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2026.6.18
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.