internalcot - npm Package Compare versions

Comparing version 0.2.1 to 0.2.2

README.zh-CN.md

+# internalcot
+
+[English](README.md) · [简体中文](README.zh-CN.md)
+
+**让智能体展示完整思维链。**
+
+`internalcot` 为 Codex 和 Claude Code 增加一种可选的工作笔记模式。开启一次后，智能体会在整个对话期间，把当前目标、约束、计划变化、证据和检查过程写进正常的工具执行记录。
+
+```sh
+npx internalcot@latest setup
+```
+
+```text
+› $internalcot
+
+• internalcot 模式已在本次对话中启用。
+
+› 重新检查这个证明。我认为已发表的答案有问题。
+
+• internalcot> 目标：重新评估证明，而不是沿用之前的结论。
+  检查：验证变化中的边界，并区分计算结果与定理证明。
+```
+
+你可以在智能体工作时查看一条持续、易读的思维链。智能体会主动把推理写成可见的工作笔记。
+
+## 安装
+
+上面的 setup 命令会同时安装 CLI 和 skill。它会检测 Codex 与 Claude Code，列出将要执行的全局安装命令和 skill 路径，并在修改前请求确认。如果安装后没有立即看到 skill，请重启编码智能体。
+
+无人值守安装 Codex 版本：
+
+```sh
+npx internalcot@latest setup --codex --yes
+```
+
+使用 `--project` 可将 skill 安装到当前仓库，而不是用户主目录。你也可以先预览全部改动：
+
+```sh
+npx internalcot@latest setup --codex --project --dry-run
+```
+
+重复运行 setup 会更新 internalcot 自己的文件，并保留同一 skill 目录中的其他文件。
+
+## 使用
+
+开启可见工作笔记：
+
+```text
+$internalcot
+```
+
+在当前对话中，该模式会持续作用于每一次回复，也会跨越工具调用和上下文压缩。智能体会在开始实质性工作前记录笔记；当新证据、失败的检查或计划变化实质性地改变推理时，也会再次记录。
+
+明确关闭该模式：
+
+```text
+$internalcot off
+```
+
+此模式属于对话状态，不会改变宿主的原生推理设置。新对话默认关闭 internalcot。
+
+## 执行记录中会显示什么
+
+有用的笔记记录当下的推理状态，而不是事后润色的解释：
+
+```text
+internalcot> 目标：找出刷新令牌为什么只在轮换后被拒绝。
+约束：保留现有会话数据，不能削弱重放攻击防护。
+证据：第二个请求在事务提交前读取了旧的令牌族。
+检查：修改存储代码前，先通过公开登录流程复现问题。
+```
+
+CLI 会把笔记拆成少量只追加的输出片段，让支持流式进程输出的宿主逐步显示内容。会缓冲输出的宿主则会一次显示完整笔记。无论哪种情况，笔记都在命令启动前由智能体写好；分段显示只是一种呈现方式。
+
+## 从 skills.sh 安装
+
+你也可以从 [skills.sh](https://www.skills.sh/morluto/internalcot/internalcot) 安装引导 skill：
+
+```sh
+npx skills add morluto/internalcot
+```
+
+此命令只安装 skill。如果系统中没有持久安装的 CLI，skill 会改用 npx 运行当前版本：
+
+```sh
+npx --yes internalcot@latest skill --npx
+```
+
+在这种模式下，笔记命令为 `npx --yes internalcot@latest note`。推荐的 `setup` 方式仍然更快，因为它会持久安装 CLI。
+
+## skill 如何保持最新
+
+实际安装的 `SKILL.md` 是一个很小的引导入口。启用时，它会向 CLI 请求与已安装版本一致的指令：
+
+```sh
+internalcot skill
+```
+
+完整工作流程随 npm 包一起发布。因此，更新 CLI 就会同时更新笔记约定，不会留下与 CLI 版本不匹配的旧 skill 副本。
+
+## 直接使用 note 命令
+
+无需开启对话模式，也可以直接写一条可见笔记：
+
+```sh
+internalcot note '起草前先检查等号成立的情况。'
+```
+
+笔记会以 `internalcot>` 为前缀写入 stderr。默认情况下，输出会分段显示，stdout 保持为空。使用 `--no-pace` 可立即输出；使用 `--receipt` 可获得机器可读结果：
+
+```sh
+internalcot note --no-pace '检查等号成立的情况。'
+internalcot note --receipt '检查等号成立的情况。'
+```
+
+```json
+{"recorded":true,"next":"Continue the work. Record another note only for materially new reasoning state."}
+```
+
+该命令不访问网络、不需要 API key，也不会单独保存笔记。编码智能体的工具执行记录就是存档。
+
+## API 观察模式 POC
+
+`internalcot observe` 保留了本项目最初的实验：它通过 OpenAI Responses API 启动另一个模型，强制模型调用可见的 scratchpad 工具，流式输出工具输入，然后再流式输出最终回答。
+
+这是用于单独 API 请求的测试工具，不是常规 skill 工作流程。它需要 OpenAI API key，并可能产生 API 费用。
+
+请在 [OpenAI 控制台](https://platform.openai.com/api-keys)创建项目 key。不要把 key 粘贴到提示词、issue、源文件或会被 shell 历史记录保存的命令中。
+
+```sh
+unset OPENAI_BASE_URL
+
+read -rsp "OpenAI API key: " OPENAI_API_KEY && echo
+export OPENAI_API_KEY
+
+internalcot observe --model gpt-5.6-luna \
+  '计算 17 * 23，然后只给出乘积。'
+
+unset OPENAI_API_KEY
+```
+
+Scratchpad 输出写入 stderr，最终回答写入 stdout：
+
+```sh
+internalcot observe '检查 17 * 23 是否等于 391' \
+  >answer.txt 2>scratchpad.txt
+```
+
+默认观察模型为 `gpt-5.6-sol`。参阅 [OpenAI 模型目录](https://developers.openai.com/api/docs/models)和 [API 快速入门](https://developers.openai.com/api/docs/quickstart)。
+
+## 开发
+
+```sh
+npm install
+npm run check
+npm test
+npm run build
+npm link
+```
+
+验证公开的引导 skill：
+
+```sh
+npx skills add . --list
+```
+
+## 发布
+
+```sh
+npm whoami
+npm run prepublishOnly
+npm pack --dry-run --json
+npm publish
+```
+
+发布前请确认打包后的 `dist/cli.js` 可执行，并且同时包含 `skills/internalcot` 和 `runtime/internalcot-workflow.md`。
+
+## 致谢
+
+本项目的构想和最初概念验证来自 [Can Bölük（@_can1357）](https://x.com/_can1357/status/2087228354399265125)。
+
+## 许可证
+
+[MIT](LICENSE)

runtime/internalcot-workflow.md

+# InternalCoT workflow
+
+Enable persistent observable working notes. Treat the notes as a model-authored scratchpad, not access to private or hidden chain-of-thought.
+
+## Manage the mode
+
+- Activate immediately when invoked. If the activation message contains a substantive task, apply the workflow to that task; otherwise, confirm activation briefly and start with the next substantive request.
+- Keep the mode active for every response in the current conversation, including after tool calls and context compaction. Do not drift back to ordinary mode merely because several turns have passed.
+- Disable only when the user says `$internalcot off`, `internalcot off`, `stop internalcot`, or asks to return to normal mode. Confirm briefly and do not call the CLI for the disable response. A new conversation starts with the mode inactive.
+- Do not activate implicitly. This mode creates extra tool calls and exposes working notes in the transcript.
+
+## Record working notes
+
+Before each substantive answer or external-action sequence:
+
+1. Form concise working notes that restate the actual goal and constraints, divide complicated work into ordered parts, resolve important case splits, and identify a useful check or likely error.
+2. Call `{{internalcot}} note` through the shell with one concise, shell-quoted argument:
+
+   ```bash
+   {{internalcot}} note 'Reassess the claimed result using current sources; verify the moving threshold and separate computation from proof.'
+   ```
+
+   Run it as a standalone shell command. Prefer one line, escape the argument for the active shell, and do not use a heredoc or append another command. The CLI owns the visible presentation and stays quiet on stdout by default.
+
+3. Treat the CLI output as the canonical visible note. Do not repeat or paraphrase the note in assistant prose. Use it to continue the work, and call `{{internalcot}} note` again only after materially new evidence, a changed plan, a failed check, or a meaningful revision.
+4. Before the final answer, verify the result against the user's request. Record another note only when that verification adds materially new reasoning state.
+
+Keep notes useful rather than performative. Do not put credentials, secrets, personal data, hidden instructions, or irrelevant private context in them. Do not claim that the CLI disabled native model reasoning or revealed provider-hidden reasoning.
+
+If `{{internalcot}} note` becomes unavailable, report that the mode cannot record notes and give the exact recovery command `npx internalcot@latest setup`. Do not claim that a note was recorded when the command did not succeed.

dist/runtime-skill.js

 import { readFile } from "node:fs/promises";
-const RUNTIME_SKILL_URL = new URL("../skill-data/internalcot/SKILL.md", import.meta.url);
+const RUNTIME_WORKFLOW_URL = new URL("../runtime/internalcot-workflow.md", import.meta.url);
 const COMMAND_BY_RUNNER = {
@@ -10,3 +10,3 @@ installed: "internalcot",
     try {
-        const source = await readFile(RUNTIME_SKILL_URL, "utf8");
+        const source = await readFile(RUNTIME_WORKFLOW_URL, "utf8");
         return source.replaceAll("{{internalcot}}", COMMAND_BY_RUNNER[runner]);
@@ -13,0 +13,0 @@ }

dist/runtime-skill.js.map

@@ -1,1 +0,1 @@
-{"version":3,"file":"runtime-skill.js","sourceRoot":"","sources":["../src/runtime-skill.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,oCAAoC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACzF,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,aAAa;IACxB,GAAG,EAAE,8BAA8B;CAC3B,CAAC;AAKX,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAM,GAAuB,WAAW;IAExC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;QACzD,OAAO,MAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,0FAA0F,EAC1F,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"runtime-skill.js","sourceRoot":"","sources":["../src/runtime-skill.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,oCAAoC,EAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AAC5F,MAAM,iBAAiB,GAAG;IACxB,SAAS,EAAE,aAAa;IACxB,GAAG,EAAE,8BAA8B;CAC3B,CAAC;AAKX,2EAA2E;AAC3E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,MAAM,GAAuB,WAAW;IAExC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC;QAC5D,OAAO,MAAM,CAAC,UAAU,CAAC,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,0FAA0F,EAC1F,EAAE,KAAK,EAAE,CACV,CAAC;IACJ,CAAC;AACH,CAAC"}

package.json

 {
   "name": "internalcot",
-  "version": "0.2.1",
-  "description": "Visible working notes for coding agents, plus an API observation POC.",
+  "version": "0.2.2",
+  "description": "Make agents show their full chain of thought with persistent, visible working notes.",
   "license": "MIT",
@@ -19,5 +19,9 @@ "author": "morluto",
     "agent-skill",
+    "chain-of-thought",
+    "claude-code",
+    "codex",
     "reasoning",
     "scratchpad",
-    "openai"
+    "openai",
+    "working-notes"
   ],
@@ -29,4 +33,5 @@ "type": "module",
   "files": [
+    "README.zh-CN.md",
     "dist",
-    "skill-data",
+    "runtime",
     "skills"
@@ -33,0 +38,0 @@ ],

README.md

 # internalcot
 
-`internalcot` gives coding agents a persistent, observable working-notes mode. An installed skill tells the current agent to call a small local CLI before substantive responses, so its model-authored scratchpad appears in the tool transcript.
+[English](README.md) · [简体中文](README.zh-CN.md)
 
-This does not reveal private or provider-hidden chain-of-thought. It records notes that the model deliberately writes for observation.
+**Make agents show their full chain of thought.**
 
-## Install the CLI and skill
+`internalcot` adds an opt-in working-notes mode to Codex and Claude Code. Turn it on once and the agent externalizes its goals, constraints, plan changes, evidence, and checks in the normal tool transcript for the full conversation.
 
-Run the guided setup:
-
 ```sh
@@ -15,34 +13,36 @@ npx internalcot@latest setup
 
-Setup always installs the persistent CLI and its skill together. Select Codex, Claude Code, or both; setup shows the exact global command and skill paths before it changes anything.
+```text
+› $internalcot
 
-For a non-interactive Codex install:
+• internalcot mode is active for this conversation.
 
-```sh
-npx internalcot@latest setup --codex --yes
+› Recheck this proof. I think the published answer is wrong.
+
+• internalcot> Goal: reassess the proof instead of trusting its prior conclusion.
+  Check: verify the moving boundary and separate computation from theorem.
 ```
 
-Use `--project` to place the skill in the current repository instead of your home directory. Preview the complete installation without making changes:
+The result is a persistent, readable chain of thought you can inspect as the agent works. The agent writes its reasoning into visible working notes.
 
-```sh
-# Preview without making changes
-npx internalcot@latest setup --codex --project --dry-run
-```
+## Install
 
-Setup writes only the bundled `internalcot` skill files. Re-running it reports an unchanged installation or updates those files while preserving unrelated files in the same directory.
+The setup command above installs the CLI and skill together. It detects Codex and Claude Code, shows the exact global command and skill paths, and asks before changing anything. After installation, restart your coding agent if the skill does not appear immediately.
 
-The installed discovery skill is intentionally small. When `$internalcot` is invoked, it runs `internalcot skill` to load workflow instructions bundled with the installed CLI, so the instructions always match that CLI version.
+For unattended Codex setup:
 
-## Install the discovery skill only
+```sh
+npx internalcot@latest setup --codex --yes
+```
 
-The internalcot skill is also distributed through [skills.sh](https://skills.sh/). Install only the discovery skill with:
+Use `--project` to install the skill in the current repository instead of your home directory. Preview every change without applying it:
 
 ```sh
-npx skills add morluto/internalcot
+npx internalcot@latest setup --codex --project --dry-run
 ```
 
-This does not install the CLI. If it is missing, the discovery skill uses `npx --yes internalcot@latest` for workflow and note calls, so skill-only installation still works. The recommended setup remains faster because it installs the CLI persistently. Restart your coding agent if the new skill does not appear immediately.
+Re-running setup updates internalcot's own files and preserves unrelated files in the same skill directory.
 
-## Turn working notes on
+## Use it
 
-Explicitly invoke the skill without giving it a task:
+Enable visible working notes:
 
@@ -53,5 +53,5 @@ ```text
 
-The mode remains active for subsequent requests. The agent calls `internalcot note` before substantive work and again only when it has materially new reasoning state. The CLI output is the visible note, so the agent does not repeat it in prose.
+The mode remains active for every response in the current conversation, including across tool calls and context compaction. The agent records a new note before substantive work and when new evidence, a failed check, or a changed plan materially alters its reasoning.
 
-Turn it off with:
+Disable it explicitly:
 
@@ -62,11 +62,26 @@ ```text
 
-The toggle is conversational state carried by the skill instructions. It does not change the host's native reasoning setting or install a new first-class tool dynamically.
+The mode is conversational state. It does not change the host's native reasoning setting, and a new conversation starts with internalcot off.
 
-The installed skill loads the current workflow with:
+## What appears in the transcript
 
+A useful note captures the current reasoning state, not a polished explanation after the fact:
+
+```text
+internalcot> Goal: find why the refresh token is rejected only after rotation.
+Constraint: preserve existing session data and do not weaken replay protection.
+Evidence: the second request reads the old token family before the transaction commits.
+Check: reproduce through the public login flow before changing storage code.
+```
+
+The CLI prints notes in small, append-only chunks so hosts that stream process output can display them progressively. Hosts that buffer output show the same completed note at once. Either way, the note was authored before the command began; pacing is presentation, not access to hidden token generation.
+
+## Install from skills.sh
+
+The discovery skill is also available on [skills.sh](https://www.skills.sh/morluto/internalcot/internalcot):
+
 ```sh
-internalcot skill
+npx skills add morluto/internalcot
 ```
 
-For a skill-only installation without a persistent CLI, the discovery skill loads an npx-ready workflow with:
+This installs only the skill. If the persistent CLI is unavailable, the skill runs the current package through npx instead:
 
@@ -77,15 +92,25 @@ ```sh
 
-## Use the working-notes CLI directly
+That workflow uses `npx --yes internalcot@latest note` for its notes. The recommended `setup` command remains faster because it installs the CLI persistently.
 
-Pass a short note as one quoted argument:
+## How the skill stays current
 
+The installed `SKILL.md` is a small discovery stub. On activation it asks the CLI for instructions matching the installed version:
+
 ```sh
-internalcot note "Check the equality case before drafting."
+internalcot skill
 ```
 
-The CLI displays the completed note in small, append-only chunks and writes nothing to stdout by default. This paced display works in hosts that stream process output and safely appears all at once in hosts that buffer it. It is presentation of an already-authored note, not token-by-token access to hidden reasoning.
+The full workflow ships inside the npm package. Updating the CLI therefore updates the note contract without leaving an older copied skill behind.
 
-For immediate output or a machine-readable receipt:
+## Use the note command directly
 
+You can write a visible note without enabling the conversational mode:
+
 ```sh
+internalcot note 'Check the equality case before drafting.'
+```
+
+Notes go to stderr with an `internalcot>` prefix. Output is paced and stdout stays empty by default. Use `--no-pace` for immediate output or `--receipt` for a machine-readable result:
+
+```sh
 internalcot note --no-pace 'Check the equality case.'
@@ -95,4 +120,2 @@ internalcot note --receipt 'Check the equality case.'
 
-The note is written to stderr with an `internalcot>` prefix. With `--receipt`, stdout receives:
-
 ```json
@@ -102,14 +125,13 @@ {"recorded":true,"next":"Continue the work. Record another note only for materially new reasoning state."}
 
-The command does not use the network, require an API key, or save notes to disk. The coding agent's tool transcript is the record.
+The command does not use the network, require an API key, or save notes separately. The coding agent's tool transcript is the record.
 
-## Run the API observation POC
+## API observation POC
 
-The separate `observe` command preserves the original experiment: it starts a second model through the OpenAI Responses API, sets its reasoning effort to `none` by default, forces an `internalcot` function call on the first turn, streams those tool arguments as a visible scratchpad, and then streams the final answer.
+`internalcot observe` preserves the original experiment behind this project. It starts a separate model through the OpenAI Responses API, forces a visible scratchpad tool call, streams that tool input, and then streams the answer.
 
-Create a project key in the [OpenAI dashboard](https://platform.openai.com/api-keys). Never paste a key into a prompt, issue, chat, source file, or shell command that will be saved in history. Revoke and replace any exposed key.
+This is a test harness for a separate API request, not the normal skill workflow. It requires an OpenAI API key and may incur API charges.
 
-In Bash on macOS or Linux:
+Create a project key in the [OpenAI dashboard](https://platform.openai.com/api-keys). Never paste a key into a prompt, issue, source file, or shell command saved in history.
 
 ```sh
-# Use OpenAI directly, not a previously configured compatible gateway.
 unset OPENAI_BASE_URL
@@ -121,3 +143,3 @@
 internalcot observe --model gpt-5.6-luna \
-  "Work out 17 * 23, then give only the product."
+  'Work out 17 * 23, then give only the product.'
 
@@ -127,6 +149,6 @@ unset OPENAI_API_KEY
 
-Scratchpad output goes to stderr and the final answer to stdout, so they can be captured separately:
+Scratchpad output goes to stderr and the final answer to stdout:
 
 ```sh
-internalcot observe "Check whether 17 * 23 = 391" \
+internalcot observe 'Check whether 17 * 23 = 391' \
   >answer.txt 2>scratchpad.txt
@@ -137,4 +159,2 @@ ```
 
-If you intentionally use an OpenAI-compatible gateway, set `OPENAI_BASE_URL` only for that gateway and use a credential issued by that provider.
-
 ## Development
@@ -150,3 +170,3 @@
 
-Validate the bundled skill with:
+Validate the public discovery skill with:
 
@@ -166,3 +186,3 @@ ```sh
 
-Verify the packed `dist/cli.js` is executable and the `skills/internalcot` and `skill-data/internalcot` directories are included before publishing.
+Verify that the packed `dist/cli.js` is executable and that both `skills/internalcot` and `runtime/internalcot-workflow.md` are included.
 
@@ -172,1 +192,5 @@ ## Credit
 The idea and original proof of concept are by [Can Bölük (@_can1357)](https://x.com/_can1357/status/2087228354399265125).
+
+## License
+
+[MIT](LICENSE)

skill-data/internalcot/SKILL.md

----
-name: internalcot
-description: Activate a persistent observable working-notes mode that calls the local internalcot CLI before substantive responses. Use only when the user explicitly invokes $internalcot, says "internalcot on", or asks to enable internalcot mode. Keep it active until the user explicitly turns it off. Do not trigger merely because a user asks to think carefully, reason deeply, or show work.
----
-
-# InternalCoT
-
-Enable persistent observable working notes. Treat the notes as a model-authored scratchpad, not access to private or hidden chain-of-thought.
-
-## Manage the mode
-
-- Activate immediately when invoked. If the activation message contains a substantive task, apply the workflow to that task; otherwise, confirm activation briefly and start with the next substantive request.
-- Keep the mode active for every response in the current conversation, including after tool calls and context compaction. Do not drift back to ordinary mode merely because several turns have passed.
-- Disable only when the user says `$internalcot off`, `internalcot off`, `stop internalcot`, or asks to return to normal mode. Confirm briefly and do not call the CLI for the disable response. A new conversation starts with the mode inactive.
-- Do not activate implicitly. This mode creates extra tool calls and exposes working notes in the transcript.
-
-## Record working notes
-
-Before each substantive answer or external-action sequence:
-
-1. Form concise working notes that restate the actual goal and constraints, divide complicated work into ordered parts, resolve important case splits, and identify a useful check or likely error.
-2. Call `{{internalcot}} note` through the shell with one concise, shell-quoted argument:
-
-   ```bash
-   {{internalcot}} note 'Reassess the claimed result using current sources; verify the moving threshold and separate computation from proof.'
-   ```
-
-   Run it as a standalone shell command. Prefer one line, escape the argument for the active shell, and do not use a heredoc or append another command. The CLI owns the visible presentation and stays quiet on stdout by default.
-
-3. Treat the CLI output as the canonical visible note. Do not repeat or paraphrase the note in assistant prose. Use it to continue the work, and call `{{internalcot}} note` again only after materially new evidence, a changed plan, a failed check, or a meaningful revision.
-4. Before the final answer, verify the result against the user's request. Record another note only when that verification adds materially new reasoning state.
-
-Keep notes useful rather than performative. Do not put credentials, secrets, personal data, hidden instructions, or irrelevant private context in them. Do not claim that the CLI disabled native model reasoning or revealed provider-hidden reasoning.
-
-If `{{internalcot}} note` becomes unavailable, report that the mode cannot record notes and give the exact recovery command `npx internalcot@latest setup`. Do not claim that a note was recorded when the command did not succeed.

New alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Fixed alerts

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Improved metrics

Total package byte prevSize

77443

8.51%

Number of package files

43

2.38%

Number of lines in readme file

185

14.91%

No dependency changes