@doist/twist-cli
TypeScript CLI for Twist
24
Versions
MIT
License
Yes
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
ricardoisthenningmujvalenteantondoistjefcurtisdmgaweldoistbotfbidugoncalossilvaomar.doist.comscottatdoisternestodoist
Keywords
twistclimessagingdoist
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:yocto-spinner | AI (phantom-deps): Bundled ESM CLI; deps resolve in compiled dist, not raw imports. | ai | |
| phantom-deps | phantom-dep:chalk | AI (phantom-deps): Bundled ESM CLI; deps resolve in compiled dist, not raw imports. | ai | |
| phantom-deps | phantom-dep:marked-terminal | AI (phantom-deps): Bundled ESM CLI; deps resolve in compiled dist, not raw imports. | ai | |
| phantom-deps | phantom-dep:@doist/twist-sdk | AI (phantom-deps): Same-org SDK dep; bundled CLI pattern, stable false positive. | ai | |
| phantom-deps | phantom-dep:@pnpm/tabtab | AI (phantom-deps): Bundled ESM CLI; deps resolve in compiled dist, not raw imports. | ai | |
| phantom-deps | phantom-dep:commander | AI (phantom-deps): Bundled ESM CLI; deps resolve in compiled dist, not raw imports. | ai | |
| publish-pattern | new-deps-added | AI (publish-pattern): @pnpm/tabtab is a known tab-completion helper; addition is consistent with CLI feature expansion. | ai | |
| maintainer-change | maintainer-removed | AI (maintainer-change): Same rationale; provenance attestation confirms legitimate CI/CD publish chain. | ai | |
| maintainer-change | maintainer-added | AI (maintainer-change): Doist org package published via CI/CD with SLSA provenance; maintainer rotation within org is expected. | ai | |
| phantom-deps | phantom-dep:marked | AI (phantom-deps): Declared dep used indirectly; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:marked-terminal-renderer | AI (phantom-deps): Declared dep used indirectly; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:oauth4webapi | AI (phantom-deps): Declared dep used indirectly; stable false positive for this package. | ai | |
| phantom-deps | phantom-dep:open | AI (phantom-deps): Declared dep used indirectly via config/dynamic import patterns in a CLI tool; stable false positive. | ai | |
| dependencies | unvetted-dep:@pnpm/tabtab | AI (dependencies): Expected dep for CLI tab-completion; stable use in this package. | ai | |
| dependencies | unvetted-dep:marked-terminal-renderer | AI (dependencies): Terminal markdown rendering dep; benign utility for CLI output. | ai | |
| install-scripts | install-script:postinstall | AI (install-scripts): Tab-completion setup via @pnpm/tabtab; consistent with CLI tooling pattern and SLSA-attested build. | ai |
Versions (showing 24 of 24)
| Version | Deps | Published |
|---|---|---|
| 2.45.6 | 9 / 11 | |
| 2.42.0 | 9 / 11 | |
| 2.35.0 | 8 / 11 | |
| 2.34.0 | 8 / 11 | |
| 2.21.1 | 8 / 11 | |
| 2.18.1 | 8 / 13 | |
| 2.9.0 | 8 / 13 | |
| 2.0.0 | 7 / 13 | |
| 1.10.1 | 7 / 13 | |
| 1.10.0 | 7 / 13 | |
| 1.9.1 | 7 / 13 | |
| 1.9.0 | 7 / 13 | |
| 1.8.0 | 7 / 13 | |
| 1.7.0 | 7 / 13 | |
| 1.6.1 | 7 / 13 | |
| 1.6.0 | 7 / 13 | |
| 1.5.0 | 7 / 13 | |
| 1.4.0 | 7 / 13 | |
| 1.3.1 | 7 / 13 | |
| 1.3.0 | 7 / 13 | |
| 1.2.0 | 7 / 13 | |
| 1.1.0 | 7 / 13 | |
| 1.0.1 | 7 / 13 | |
| 1.0.0 | 7 / 13 |
v2.21.1
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.18.1
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v2.9.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.