@flyingrobots/graft
Context governor and between-commit activity surface for coding agents
13
Versions
Apache-2.0
License
No
Install Scripts
Verified
Provenance
Supply chain provenance
Status for the latest visible version.
SLSA provenance attestation
npm registry signatures
gitHead linked
Maintainers
flyingrobots
Keywords
mcpmcp-servermodel-context-protocolclaude-codecursorcoding-agentai-agentcontext-windowcode-navigationstructural-difftree-sitterdeveloper-tools
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:env-spread | AI (semgrep): env spread used to forward process.env to a child process — standard pattern, not exfiltration. | ai | |
| semgrep | semgrep:api-obfuscation-reflect | AI (semgrep): Reflect.get inside a Proxy get trap is idiomatic JS; not obfuscation. | ai | |
| phantom-deps | phantom-dep:tree-sitter-wasms | AI (phantom-deps): Platform-specific binary package; declared as runtime dep but consumed indirectly — stable false positive. | ai |
Versions (showing 13 of 13)
| Version | Deps | Published |
|---|---|---|
| 0.11.0 | 10 / 11 | |
| 0.10.1 | 10 / 11 | |
| 0.10.0 | 10 / 11 | |
| 0.9.0 | 10 / 10 | |
| 0.8.0 | 10 / 10 | |
| 0.7.1 | 9 / 10 | |
| 0.7.0 | 10 / 9 | |
| 0.6.1 | 10 / 9 | |
| 0.6.0 | 10 / 9 | |
| 0.5.0 | 8 / 9 | |
| 0.4.0 | 8 / 8 | |
| 0.3.5 | 6 / 8 | |
| 0.3.1 | 6 / 8 |
v0.11.0
1 finding
INFO
Has SLSA provenance attestation
provenance
Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.