@cleocode/worktree — Greenflagged

Native CLEO worktree backend SDK — createWorktree, destroyWorktree, listWorktrees, pruneWorktrees with XDG path canon and declarative hooks (T1161)

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

kryptobaseddev

cleoworktreegitagentsdkisolation

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
npm-metadata	bundled-binaries	AI (npm-metadata): Native NAPI binding package; .node files are the expected build output, backed by SLSA provenance.	ai	2026/05/30
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require is a platform-specific binary loader gated on existsSync; stable false positive for this package.	ai	2026/05/30
publish-pattern	new-deps-added	AI (publish-pattern): New dep is a same-org sibling package (@cleocode/paths) pinned to matching calver; consistent monorepo release pattern.	ai	2026/05/29
dependencies	unvetted-dep:env-paths	AI (dependencies): env-paths is a well-known sindresorhus utility for XDG/platform paths; its use is appropriate and expected for this package's stated purpose. Stable false positive for this package.	ai	2026/04/25

View all versions

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.