@cline/agents
7
Versions
—
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
No source commit
Maintainers
beatrix-clinebarreirotarakhansaoudcline
Keywords
llmagentsaitool-calling
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| provenance | missing-githead | AI (provenance): CI monorepo publish quirk, not a manual-publish regression; SLSA attestation still present. | ai | |
| publish-pattern | rapid-publish | AI (publish-pattern): Lockstep monorepo release cadence across many sibling packages, not anomalous. | ai | |
| dependencies | unvetted-dep:@cline/llms | AI (dependencies): First-party sibling package in same monorepo/version lockstep. | ai | |
| provenance | no-provenance | AI (provenance): Consistent across all @cline/* packages; absence of provenance is not a risk signal for this org. | ai | |
| phantom-deps | phantom-dep:@cline/llms | AI (phantom-deps): Same-org sibling package; phantom-dep heuristic fires because it's consumed as a bundled/re-exported dep, not directly imported. | ai | |
| phantom-deps | phantom-dep:nanoid | AI (phantom-deps): Likely used indirectly via bundled output; stable false positive for this package. | ai |
Versions (showing 7 of 7)
| Version | Deps | Published |
|---|---|---|
| 0.0.59 | 3 / 0 | |
| 0.0.43 | 3 / 0 | |
| 0.0.42 | 3 / 0 | |
| 0.0.41 | 3 / 0 | |
| 0.0.40 | 3 / 0 | |
| 0.0.39 | 3 / 0 | |
| 0.0.38 | 3 / 0 |
v0.0.59
2 findings
HIGH
Missing gitHead — previous versions had it
provenance
This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.