feat(web): add authenticated localhost client

[VishnuM049]

Purpose

Add an authenticated localhost web client for daemon-owned sessions, conversation state, workspace review, configuration, and session management while preserving the public SDK and security boundaries.

The rebased branch now builds against current main. It also supports opening the current TUI session in a browser and keeps simultaneous web and TUI projections synchronized during session selection, cancellation, failure, detach, and reconnect.

Fixes

Fixes #99, #100, #101, #108, #109, #110, #111, #112, and #117.

Addresses #98, #113, #114, #115, #116, #118, #119, #120, #121, #122, #126, and #127. These broader issues retain acceptance criteria outside this branch.

Approach

• Rebase the original web branch onto current main and retain the intentional removal of the obsolete changelog.
• Add an authenticated loopback web gateway, one-use launch flow, strict CSP, bounded WebSocket transport, verified static assets, and release-package integration.
• Add the React client with responsive conversation, activity, workspace, session, settings, theme, and slash-command views over the public SDK.
• Keep canonical state and mutations in the daemon. Browser-local commands and presentation state do not simulate daemon operations.
• Add axl web <session-id> and TUI /web current-session handoff through the trusted CLI host. Repeated launches reuse the gateway with fresh one-use tokens and do not create another agent loop.
• Preserve the committed subscription until a replacement session commits. Pending, cancelled, or failed selections cannot suppress its event, activity, cursor, or workspace updates.
• Verify simultaneous TUI and web attachment against one daemon and session, including two-way prompts, streaming, cancellation, failed selection, detach, reconnect, and duplicate-event checks.
• Resolve absolute, tilde, home-relative, and unique shorthand workspace paths in the daemon. Resolution checks a bounded candidate set, canonicalizes existing directories, and rejects ambiguous input.
• Rank recent workspace suggestions locally from synchronized session metadata. Filter loaded recent sessions by workspace and Chat or Code mode without extra RPC traffic.

The rebased branch uses wire protocol version 14. Older clients fail the existing compatibility handshake instead of receiving partial behavior.

Workspace selection

Recent-session filters

How was this tested?

Build-repair commit, verified in an isolated worktree:

• pnpm build: passed.
• pnpm typecheck: passed.
• pnpm lint: passed.
• pnpm format:check: passed.
• pnpm check:boundaries: passed.
• pnpm check:generated: passed.
• git diff --check: passed.
• Focused protocol, SDK, theme, web-shell, and release-package tests: 108 passed.
• node --test --test-timeout=120000 scripts/installed-web.test.ts: passed against a packed CLI outside the repository.

Browser launch and /web handoff commit, verified in an isolated worktree:

• CLI gateway, launch, and TUI suites: 95 passed.
• pnpm --filter @axl/web test: 64 passed, 2 real-browser cases skipped.
• Installed-package smoke: passed for ordinary launch and direct session handoff.
• Build, typecheck, lint, format, boundaries, generated files, and diff checks: passed.

Transcript synchronization commit:

• node --test --test-timeout=30000 packages/web/test/application-shell.test.ts: 19 passed.
• pnpm --filter @axl/web test: 66 passed, 2 real-browser cases skipped.
• SDK projector/subscription and TUI suites: 72 passed.
• A live PTY/WebSocket smoke connected the built TUI and compiled web shell to the same daemon and session, exchanged prompts in both directions, tested picker dismissal and failed selection, and recovered browser detach without lost or duplicate events.
• Build, typecheck, lint, format, boundaries, generated files, and diff checks: passed.

Chrome/Chromium was unavailable, so rendered-browser tests were not run in the final validation. reuse was unavailable. The complete repository suite and real-provider calls were not run.

Learning

Pending session selection and committed subscription ownership are different lifetimes. Candidate generations cancel stale candidates; committed callback identity keeps the current projection live until a replacement commits.

Path convenience does not need browser filesystem access. Bounded daemon-side resolution supports useful shorthand while preserving canonical paths and failing closed on ambiguity.

Checklist

• I reviewed the complete diff.
• I added or updated the smallest relevant test for behavior changes.
• I ran the relevant formatting, lint, type-check, test, boundary, and license checks.
• Every new file has SPDX metadata, directly or through REUSE.toml.
• Every commit has a matching DCO Signed-off-by trailer.
• UI changes include screenshots attached to the pull request, not committed to the repository.

Licenses

Resource	Source and version	License	Use
Inter	Inter project, vendored Latin WOFF2	OFL-1.1	Browser interface text
IBM Plex Mono	IBM Plex, vendored Latin WOFF2	OFL-1.1	Code and data text

AI assistance

• Generative AI materially assisted this change. Tool and model/version: OpenAI ChatGPT through pi; the harness did not expose an exact model version.
• I manually reviewed, understood, and tested the generated work.

[github-actions]

⚠️ Deprecation Warning: The deny-licenses option is deprecated for possible removal in the next major release. For more information, see issue 997.

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ⚠️ 4 package(s) with unknown licenses.
• ⚠️ 1 packages with OpenSSF Scorecard issues.

See the Details below.

License Issues

packages/cli/package.json

Package	Version	License	Issue Type
@axl/theme	workspace:*	Null	Unknown License

packages/tui/package.json

Package	Version	License	Issue Type
@axl/theme	workspace:*	Null	Unknown License

packages/web/package.json

Package	Version	License	Issue Type
@axl/sdk	workspace:*	Null	Unknown License
@axl/theme	workspace:*	Null	Unknown License

Denied Licenses:

SSPL-1.0, BUSL-1.1, Elastic-2.0

OpenSSF Scorecard

Scorecard details

Package	Version	Score	Details
npm/ws	8.21.0	🟢 5.5	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 14 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 0 Found 1/29 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@axl/theme	workspace:*	Unknown	Unknown
npm/@types/ws	8.18.1	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing ⚠️ 0 project is not fuzzed
npm/ws	8.21.0	🟢 5.5	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 14 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 0 Found 1/29 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@axl/theme	workspace:*	Unknown	Unknown
npm/@axl/cli	workspace:*	Unknown	Unknown
npm/@axl/daemon	workspace:*	Unknown	Unknown
npm/@axl/kernel	workspace:*	Unknown	Unknown
npm/@axl/sdk	workspace:*	Unknown	Unknown
npm/@axl/theme	workspace:*	Unknown	Unknown
npm/@types/react	19.2.18	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing ⚠️ 0 project is not fuzzed
npm/@types/react-dom	19.2.7	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing ⚠️ 0 project is not fuzzed
npm/react	19.2.8	Unknown	Unknown
npm/react-dom	19.2.8	Unknown	Unknown
npm/vite	8.2.2	🟢 7	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Code-Review 🟢 9 Found 22/24 approved changesets -- score normalized to 9 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 7 detected GitHub workflow tokens with excessive permissions Binary-Artifacts ⚠️ 1 binaries present in source code Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits
npm/@oxc-project/types	0.148.0	Unknown	Unknown
npm/@rolldown/binding-android-arm-eabi	1.2.7	Unknown	Unknown
npm/@rolldown/binding-android-arm64	1.2.7	Unknown	Unknown
npm/@rolldown/binding-darwin-arm64	1.2.7	Unknown	Unknown
npm/@rolldown/binding-darwin-x64	1.2.7	Unknown	Unknown
npm/@rolldown/binding-freebsd-x64	1.2.7	Unknown	Unknown
npm/@rolldown/binding-linux-arm-gnueabihf	1.2.7	Unknown	Unknown
npm/@rolldown/binding-linux-arm64-gnu	1.2.7	Unknown	Unknown
npm/@rolldown/binding-linux-arm64-musl	1.2.7	Unknown	Unknown
npm/@rolldown/binding-linux-ppc64-gnu	1.2.7	Unknown	Unknown
npm/@rolldown/binding-linux-s390x-gnu	1.2.7	Unknown	Unknown
npm/@rolldown/binding-linux-x64-gnu	1.2.7	Unknown	Unknown
npm/@rolldown/binding-linux-x64-musl	1.2.7	Unknown	Unknown
npm/@rolldown/binding-openharmony-arm64	1.2.7	Unknown	Unknown
npm/@rolldown/binding-win32-arm64-msvc	1.2.7	Unknown	Unknown
npm/@rolldown/binding-win32-x64-msvc	1.2.7	Unknown	Unknown
npm/@rolldown/pluginutils	1.0.1	Unknown	Unknown
npm/@types/react	19.2.18	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing ⚠️ 0 project is not fuzzed
npm/@types/react-dom	19.2.7	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing ⚠️ 0 project is not fuzzed
npm/@types/ws	8.18.1	🟢 6.5	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 8 Found 26/30 approved changesets -- score normalized to 8 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 8 dependency not pinned by hash detected -- score normalized to 8 Fuzzing ⚠️ 0 project is not fuzzed
npm/csstype	3.2.3	🟢 3.4	Details Check Score Reason Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Code-Review ⚠️ 1 Found 3/28 approved changesets -- score normalized to 1 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/detect-libc	2.1.2	🟢 3.8	Details Check Score Reason Maintained ⚠️ 0 0 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 0 Code-Review ⚠️ 2 Found 7/30 approved changesets -- score normalized to 2 Binary-Artifacts 🟢 8 binaries present in source code Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/fdir	6.5.0	🟢 3.3	Details Check Score Reason Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Code-Review 🟢 5 Found 14/28 approved changesets -- score normalized to 5 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/fsevents	2.3.3	🟢 3.1	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 3 Found 7/22 approved changesets -- score normalized to 3 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/lightningcss	1.33.0	Unknown	Unknown
npm/lightningcss-android-arm64	1.33.0	Unknown	Unknown
npm/lightningcss-darwin-arm64	1.33.0	Unknown	Unknown
npm/lightningcss-darwin-x64	1.33.0	Unknown	Unknown
npm/lightningcss-freebsd-x64	1.33.0	Unknown	Unknown
npm/lightningcss-linux-arm-gnueabihf	1.33.0	Unknown	Unknown
npm/lightningcss-linux-arm64-gnu	1.33.0	Unknown	Unknown
npm/lightningcss-linux-arm64-musl	1.33.0	Unknown	Unknown
npm/lightningcss-linux-x64-gnu	1.33.0	Unknown	Unknown
npm/lightningcss-linux-x64-musl	1.33.0	Unknown	Unknown
npm/lightningcss-win32-arm64-msvc	1.33.0	Unknown	Unknown
npm/lightningcss-win32-x64-msvc	1.33.0	Unknown	Unknown
npm/nanoid	3.3.18	🟢 6.4	Details Check Score Reason Code-Review ⚠️ 0 Found 2/30 approved changesets -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Security-Policy 🟢 10 security policy file detected Maintained 🟢 10 30 commit(s) and 7 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Pinned-Dependencies 🟢 10 all dependencies are pinned Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST 🟢 5 SAST tool is not run on all commits -- score normalized to 5
npm/picocolors	1.1.1	🟢 3.2	Details Check Score Reason Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review 🟢 4 Found 11/23 approved changesets -- score normalized to 4 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/picomatch	4.0.7	🟢 6.8	Details Check Score Reason Code-Review 🟢 5 Found 7/13 approved changesets -- score normalized to 5 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 10 Packaging ⚠️ -1 packaging workflow not detected Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 10 security policy file detected SAST 🟢 5 SAST tool is not run on all commits -- score normalized to 5
npm/postcss	8.5.28	🟢 7.4	Details Check Score Reason Code-Review 🟢 3 Found 11/30 approved changesets -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Maintained 🟢 10 30 commit(s) and 16 issue activity found in the last 90 days -- score normalized to 10 Security-Policy 🟢 10 security policy file detected Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies 🟢 10 all dependencies are pinned Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing 🟢 10 project is fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection 🟢 3 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/react	19.2.8	Unknown	Unknown
npm/react-dom	19.2.8	Unknown	Unknown
npm/rolldown	1.2.7	Unknown	Unknown
npm/scheduler	0.27.0	Unknown	Unknown
npm/source-map-js	1.2.1	⚠️ 2.8	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Code-Review ⚠️ 0 Found 0/30 approved changesets -- score normalized to 0 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Binary-Artifacts 🟢 10 no binaries found in the repo CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 License 🟢 9 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 1 branch protection is not maximal on development and all release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0 Fuzzing ⚠️ 0 project is not fuzzed
npm/tinyglobby	0.2.17	Unknown	Unknown
npm/vite	8.2.2	🟢 7	Details Check Score Reason Maintained 🟢 10 30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Packaging ⚠️ -1 packaging workflow not detected Security-Policy 🟢 10 security policy file detected Code-Review 🟢 9 Found 22/24 approved changesets -- score normalized to 9 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 7 detected GitHub workflow tokens with excessive permissions Binary-Artifacts ⚠️ 1 binaries present in source code Pinned-Dependencies 🟢 6 dependency not pinned by hash detected -- score normalized to 6 License 🟢 10 license file detected Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Fuzzing ⚠️ 0 project is not fuzzed SAST 🟢 10 SAST tool is run on all commits
npm/ws	8.21.0	🟢 5.5	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Maintained 🟢 10 14 commit(s) and 4 issue activity found in the last 90 days -- score normalized to 10 Token-Permissions 🟢 10 GitHub workflow tokens follow principle of least privilege Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 0 Found 1/29 approved changesets -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Security-Policy 🟢 10 security policy file detected Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 10 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches Signed-Releases ⚠️ -1 no releases found SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• distribution/npm/package.json
• packages/cli/package.json
• packages/tui/package.json
• packages/web/package.json
• pnpm-lock.yaml