github TypeScript analyzed f7bc9c2 deep scan · partial (241/1,714 files)

MongLong0214/commitlore

github

Git-native decision memory for Claude Code, Codex, Cursor and other coding agents. Preserve constraints and rejected alternatives; surface only the decisions still in force.

maintainer
MongLong0214
licence
MIT
first seen
2026-07-26
last seen
2026-09-17
releases · 30d
39
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · http verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit f7bc9c2 · analyzer v33 · 16h ago

skills & prompt files 8

danger signals19

code evidence vv1.4.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 598

filesystem 307

  • fs MongLong0214-commitlore-f7bc9c2/action/lint/lint.mjs :26 import { appendFileSync, writeFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/action/preserve/preserve.mjs :36 import { appendFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/deterministic.ts :1 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/capture.ts :1 import { readFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/hooks.ts :1 import { mkdirSync, writeFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/ledger.ts :19 import { readFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/noise.ts :1 import { mkdtempSync, rmSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/quality.ts :1 import { readdirSync, readFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/report.ts :1 import { writeFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/scale.ts :1 import { mkdirSync, statSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/deterministic/survival.ts :1 import { mkdirSync, writeFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/drivers/claude-headless.ts :2 import { mkdtempSync, writeFileSync } from "node:fs";
show 28 more
  • fs MongLong0214-commitlore-f7bc9c2/bench/drivers/dry-run.ts :1 import fs from "node:fs";
  • fs MongLong0214-commitlore-f7bc9c2/bench/external/corpus.ts :11 import { existsSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/external/report.ts :13 import { writeFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/external/run.ts :23 import { mkdirSync, writeFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/hooks-settings.ts :18 import { existsSync, mkdtempSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
  • fs MongLong0214-commitlore-f7bc9c2/bench/m5-analysis.ts :23 import { existsSync, readFileSync, statSync } from "node:fs";
  • fs MongLong0214-commitlore-f7bc9c2/bench/m6-pilot-analysis.ts :13 import { readFileSync } from "node:fs";
  • fs MongLong0214-commitlore-f7bc9c2/bench/metrics.ts :1 import fs from "node:fs";
  • fs MongLong0214-commitlore-f7bc9c2/bench/report.ts :30 import fs from "node:fs";
  • fs MongLong0214-commitlore-f7bc9c2/bench/retrieval/compare.ts :2 import { readFileSync, writeFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/bench/runner.ts :3 import fs from "node:fs";
  • fs MongLong0214-commitlore-f7bc9c2/bench/task-loader.ts :1 import fs from "node:fs";
  • fs MongLong0214-commitlore-f7bc9c2/bench/verify.mjs :90 import fs from "node:fs";
  • fs MongLong0214-commitlore-f7bc9c2/bench/workspace.ts :2 import fs from "node:fs";
  • fs MongLong0214-commitlore-f7bc9c2/dist/cli.js :12 import { readFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/dist/commands/capture.js :19 import { readFileSync, writeFileSync } from 'node:fs';
  • fs (weak) MongLong0214-commitlore-f7bc9c2/dist/commands/demo.js :15 import { mkdtempSync, rmSync, writeFileSync, mkdirSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/capture-commit-msg-hook.js :7 import { existsSync, readFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/capture-hook-runtime.js :7 import { accessSync, constants as fsConstants, existsSync, rmSync, writeFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/delivery-mcp-registration-runtime.js :38 import { existsSync, readFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/history-squash-inheritance.js :32 import { existsSync, readFileSync, readdirSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/runtime-cli-runtime.js :7 import { existsSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/runtime-runtime-identity.js :2 import { existsSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/transport-notes-push.js :7 import { existsSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/report.js :31 import { existsSync, readFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/dist/commands/guard.js :23 import { readFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/dist/commands/harvest-verify.js :18 import { readFileSync, writeFileSync } from 'node:fs';
  • fs MongLong0214-commitlore-f7bc9c2/dist/commands/harvest.js :21 import { readFileSync, writeFileSync } from 'node:fs';

267 more not shown — this panel samples each group; the count above is the real total.

shell / exec 187

  • shell MongLong0214-commitlore-f7bc9c2/action/lint/lint.mjs :25 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/action/preserve/preserve.mjs :35 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/bench/deterministic.ts :2 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/bench/deterministic/shared.ts :1 import { execFileSync, spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/bench/drivers/claude-headless.ts :1 import { spawn, spawnSync } from "node:child_process";
  • shell MongLong0214-commitlore-f7bc9c2/bench/git.ts :1 import { spawnSync } from "node:child_process";
  • shell MongLong0214-commitlore-f7bc9c2/bench/repository-instant.ts :13 import { execFileSync } from "node:child_process";
  • shell MongLong0214-commitlore-f7bc9c2/bench/runner.ts :2 import { execFileSync } from "node:child_process";
  • shell (weak) MongLong0214-commitlore-f7bc9c2/dist/commands/demo.js :14 import { execFileSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/capture-hook-runtime.js :104 const preserved = spawn('/bin/sh', ['-c', '"$0" "$1"', chained, probe], {
  • shell MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/delivery-inject-runtime.js :210 const run = spawn(executable, args, {
  • shell MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/delivery-inject-version.js :57 const run = spawn(executable, ['--version'], {
show 28 more
  • shell MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/delivery-mcp-registration-runtime.js :37 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/checks/history-squash-inheritance.js :31 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/commands/doctor/model.js :1 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/commands/hermes.js :7 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/commands/init.js :44 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/commands/installer-hosts.js :12 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/commands/uninstall.js :19 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/commands/update.js :27 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/commitlore.mjs :8180 import childProcess from "node:child_process";
  • shell MongLong0214-commitlore-f7bc9c2/dist/core/backfill.js :50 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/core/codex-plugin.js :6 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/core/git.js :10 import { spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/core/latest-release.js :26 import { spawn, spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/core/mcp-probe.js :10 import { spawn, spawnSync } from 'node:child_process';
  • shell MongLong0214-commitlore-f7bc9c2/dist/core/trusted-authors.js :33 import { spawnSync } from 'node:child_process';
  • shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/adoption-range.mjs :18 import { execFileSync } from 'node:child_process';
  • shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/check-readme-numbers.mjs :26 import { spawnSync } from 'node:child_process';
  • shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/check-release-target.mjs :26 import { spawnSync } from 'node:child_process';
  • shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/check-release-version.mjs :39 import { execFileSync } from 'node:child_process';
  • shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/check-tag-binding.mjs :33 import { spawnSync } from 'node:child_process';
  • shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/make-synthetic-repo.mjs :25 import { spawn } from 'node:child_process';
  • shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/measure-scale.mjs :27 import { execFileSync, spawn, spawnSync } from 'node:child_process';
  • shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/measure.mjs :37 import { execFileSync, spawnSync } from 'node:child_process';
  • shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/negative-control.mjs :33 import { execFileSync, spawnSync } from 'node:child_process';
  • shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/verify-canonical-artifact.mjs :2 import { execFileSync } from 'node:child_process';
  • shell (weak) MongLong0214-commitlore-f7bc9c2/scripts/verify-canonical-handoff.mjs :34 import { execFileSync } from 'node:child_process';
  • shell (weak) MongLong0214-commitlore-f7bc9c2/spec/schema/compare-trailers.mjs :11 import { execFileSync } from 'node:child_process';
  • shell (weak) MongLong0214-commitlore-f7bc9c2/spec/schema/roundtrip.mjs :14 import { execFileSync } from 'node:child_process';

147 more not shown — this panel samples each group; the count above is the real total.

network 13

  • net MongLong0214-commitlore-f7bc9c2/bench/retrieval/compare.ts :375 const response = await fetch(`${OLLAMA_URL}${path}`, {
  • net MongLong0214-commitlore-f7bc9c2/dist/commitlore.mjs :14543 const found = prs.fetch(target.sha);
  • net MongLong0214-commitlore-f7bc9c2/dist/core/backfill.js :454 const found = prs.fetch(target.sha);
  • net MongLong0214-commitlore-f7bc9c2/dist/core/query.js :189 return fallback.fetch(query);
  • net (weak) MongLong0214-commitlore-f7bc9c2/scripts/app-installation-token.mjs :52 const response = await fetch(`https://api.github.com${path}`, {
  • net (weak) MongLong0214-commitlore-f7bc9c2/scripts/check-exact-head-ci.mjs :175 const response = await fetch(`${apiBase}/repos/${encodeURIComponent(owner)}/${encodeURIComponent(repo)}${path}`, {
  • net MongLong0214-commitlore-f7bc9c2/src/core/backfill.ts :694 const found = prs.fetch(target.sha);
  • net MongLong0214-commitlore-f7bc9c2/src/core/query.ts :462 if (fallback !== null) return fallback.fetch(query);
  • net (weak) MongLong0214-commitlore-f7bc9c2/test/action-lint.test.ts :529 const CLIENTS = ['fetch(', 'axios', 'node-fetch', 'XMLHttpRequest', 'node:https', 'node:http'];
  • net (weak) MongLong0214-commitlore-f7bc9c2/test/action-preserve.test.ts :713 const CLIENTS = ['fetch(', 'axios', 'node-fetch', 'XMLHttpRequest', 'node:https', 'node:http'];
  • net (weak) MongLong0214-commitlore-f7bc9c2/test/doctor-invariants.test.ts :58 import net from 'node:net';
  • net (weak) MongLong0214-commitlore-f7bc9c2/test/pre-push-hook.test.ts :19 import { createServer } from 'node:http';
show 1 more
  • net (weak) MongLong0214-commitlore-f7bc9c2/test/token-ledger.test.ts :190 writeFileSync(join(dir, 'leaf.js'), "import https from 'node:https';\nexport const get = () => https;\n");

secrets 3

  • secrets MongLong0214-commitlore-f7bc9c2/action/preserve/preserve.mjs :91 const TOKEN = (process.env.COMMITLORE_TOKEN ?? '').trim();
  • secrets (weak) MongLong0214-commitlore-f7bc9c2/scripts/app-installation-token.mjs :72 const privateKey = process.env.COMMITLORE_BOT_KEY ?? '';
  • secrets (weak) MongLong0214-commitlore-f7bc9c2/scripts/check-exact-head-ci.mjs :171 const token = process.env.GITHUB_TOKEN;

database 2

  • db (weak) MongLong0214-commitlore-f7bc9c2/test/bench-rejected-path.test.ts :75 '+import Redis from "ioredis";',
  • db (weak) MongLong0214-commitlore-f7bc9c2/test/capture-verify.test.ts :1086 const diff = 'diff --git a/db.ts b/db.ts\n--- a/db.ts\n+++ b/db.ts\n@@ -1 +1 @@\n-import sqlite from "sqlite3"\n+import pg from "pg"\n';

declared dependencies 10

  • @modelcontextprotocol/sdk@^1.30.0
  • ajv@^8.20.0
  • ajv-formats@^3.0.1
  • commander@^15.0.0
  • @types/js-yaml@^4.0.9
  • @types/node@^22.10.0
  • esbuild@^0.28.2
  • js-yaml@^5.4.1
  • typescript@^5.7.0
  • vitest@^4.1.11

obfuscation 1

  • dynamic require()/import() MongLong0214-commitlore-f7bc9c2/scripts/measure-scale.mjs :143 const { openIndex, closeIndex, updateIndex } = await import(${JSON.stringify(join(PACKAGE_ROOT, 'dist', 'core', 'index-db.js'))});