Repository navigation
Review migration hold: hieunt286/bm #66
Description
hieunt286/bm remains held at paseo-bm-plugin@0.5.5 (source commit 5f6dee4f4cec4fa04c105d1e91f1f2174a8de03d). Static inspection only.
- plugin/server/setup-tools.ts:35: When the user confirms installing missing br or bv and brew is unavailable, setup-tools.ts:202-212 runs a shell command that downloads raw.githubusercontent.com/Dicklesworthstone/beads_rust/main/install.sh or raw.githubusercontent.com/Dicklesworthstone/beads_viewer/a43b8e85a39664381566abdfd85dc8fcbfdcb773/install.sh and pipes it to bash. Supplying the required Beads tools explains the host, but fetching and executing remote scripts remains a hold.
- plugin/server/setup-skills.ts:123: When required skills are missing and the user chooses their installation, setup-skills.ts:170 executes npx -y skills add cuongntr/agent-skills -g -a claude-code codex with the required skill names. npx downloads and runs the third-party skills package. The skills setup purpose explains the action, but fetching and executing remote code remains a hold.
Shell execution: setup-tools.ts:212, setup-skills.ts:170. Published index.server.ts matches the declared plugin-package source at this commit.
Activity
boudra commentedon Oct 6, 2026
Cleared under the current review policy: the exact npm artifact matches its declared source and has no lifecycle/build/runtime dependencies. Beads tools and skills install only through explicit confirmations validated by the backend; the overview names the software and Homebrew, GitHub and npm sources. The reviewed record and overview are ready in #137.
paseo-bot commentedon Oct 23, 2026
@hieunt286, Beads Management 0.6.0 is approved and merged for publication. I completed the listing edits; nothing is required from you. Full review and next steps.
paseo-bot commentedon Oct 29, 2026
@hieunt286, Beads Management 0.7.0 is approved and merged in #1507. I updated its registry overview for the new workflow; no action is needed from you. Deployment succeeded, but the public registry still serves the previous pin.