{"actions":{"bootstrapAndRun":{"effect":"installs rote if missing, inspects, prepares, and asks before running","href":"https://play.modiqo.ai/install?play=rajkaria/upstream-pulse@0.1.0","method":"GET","rel":"https://rote.dev/rels/bootstrap-and-run","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"inspect":{"command":"rote play inspect https://play.modiqo.ai/rajkaria/upstream-pulse@0.1.0","effect":"read-only"},"installCliOnly":{"effect":"installs the rote CLI, nothing else","href":"https://play.modiqo.ai/install","method":"GET","rel":"https://rote.dev/rels/install-cli","requiresConsent":true,"responseMediaType":"text/x-shellscript"},"run":{"command":"rote play run https://play.modiqo.ai/rajkaria/upstream-pulse@0.1.0","effect":"executes the play locally after consent","headless":{"approvalAssertion":"--yes","approvalRequiredBeforeInvocation":true,"commandTemplate":"rote play run https://play.modiqo.ai/rajkaria/upstream-pulse@0.1.0 <name=value...> --yes","stdinPolicy":"never pipe input to automate the interactive Ready selector"},"requiresConsent":true}},"description":"A vulnerability scanner tells you about the bugs somebody has already found and written down. This tells you about the packages where nobody is looking for them any more: the last release was three years ago, there is exactly one human who can publish, the repository is archived, and the thing sits in the code path that answers requests. None of that is a CVE. All of it is the shape of the next one. The Play is two programs on purpose, and the seam between them is a file. The local half parses every lockfile under a root you choose — npm, pip, poetry, uv, Cargo, Go — and builds the inventory and the dependency graph from files already on your disk, running no package manager and opening no network. The other half is one step that asks the public registries about the packages that inventory names, and writes their answers into \u0060out_dir\u0060 as JSON. That step is the only part of this package that opens a connection and it is one short file you can read before you run it. \u0060daily_core\u0060, which does every judgement, i","distribution":{"digest":"sha256:3cb0523fdfd0289c394191a25bdb8ffff23c5d5cb5835a8c5d79b92b326b9ca4","mediaType":"application/vnd.modiqo.rote-flow","size":1028107,"verifiedBy":"rote verifies the downloaded archive against this digest before it runs"},"effects":{"credentialsProvidedBy":"runner","credentialsRemainLocal":true,"declaredWrites":[],"publisherReceivesCredentials":false},"id":"https://play.modiqo.ai/rajkaria/upstream-pulse@0.1.0","inputPolicy":{"omittedValues":"inspect_full_parameters_before_collecting_values_or_consent","optionalWithDefault":"show_default_and_accept_override","optionalWithoutDefault":"omit_unless_supplied","required":"ask","secrets":"collect_locally_outside_conversation"},"links":{"docs":"https://rote.dev","page":"https://play.modiqo.ai/rajkaria/upstream-pulse@0.1.0","protocol":"https://play.modiqo.ai/.well-known/rote","self":"https://play.modiqo.ai/rajkaria/upstream-pulse@0.1.0.json"},"name":"upstream-pulse","owner":{"kind":"user","slug":"rajkaria"},"parameters":[{"default":"~/daily","description":"Created if missing. Everything this Play writes goes here and nowhere else.","example":"~/daily","input":{"allowCustom":true,"choices":[],"label":"Out dir"},"name":"out_dir","required":false,"type":"string"},{"default":"false","description":"true runs the whole Play against five bundled synthetic project trees and a bundled registry answer set, so a first run needs nothing installed and no account.","example":"false","input":{"allowCustom":true,"choices":[],"label":"Demo"},"name":"demo","required":false,"type":"string"},{"default":"~","description":"Every lockfile under this folder is parsed. Nothing outside it is opened, and no package manager is run.","example":"~/Projects","input":{"allowCustom":true,"choices":[],"label":"Root"},"name":"root","required":false,"type":"string"},{"default":120,"description":"The most packages to ask the registries about, direct dependencies first. Everything else is inventoried and reported as not checked, which is not the same as healthy.","example":120,"input":{"allowCustom":true,"choices":[],"label":"Max packages"},"name":"max_packages","required":false,"type":"integer"},{"default":24,"description":"How long a registry answer under out_dir may be reused before it is asked for again. The card prints how old the answers are.","example":24,"input":{"allowCustom":true,"choices":[],"label":"Cache hours"},"name":"cache_hours","required":false,"type":"integer"},{"default":730,"description":"A package with no release in this many days is called dormant. Two years is long enough that a maintained package would have shipped something.","example":730,"input":{"allowCustom":true,"choices":[],"label":"Dormant days"},"name":"dormant_days","required":false,"type":"integer"}],"preparation":[{"action":{"command":"rote play inspect https://play.modiqo.ai/rajkaria/upstream-pulse@0.1.0 --json","effect":"read-only"},"step":1,"type":"inspect_local_readiness"},{"references":["/parameters"],"step":2,"type":"collect_parameters","whenValuesOmitted":"Run step 1 before collecting inputs or showing defaults; omittedFields are unknown values, not absent defaults or exhaustive choices."},{"references":["/parameters","/requirements","/effects"],"step":3,"type":"review"},{"consentBoundary":"the user approves the exact play and parameter values","references":["/parameters","/requirements","/effects"],"step":4,"type":"obtain_run_consent"},{"action":{"command":"rote play run https://play.modiqo.ai/rajkaria/upstream-pulse@0.1.0","headlessCommandTemplate":"rote play run https://play.modiqo.ai/rajkaria/upstream-pulse@0.1.0 <name=value...> --yes"},"preservesAcquisitionBoundaries":["adapter_selection","oauth_dcr","google_discovery","static_token_setup","runtime_security_checks"],"requiresConsent":true,"step":5,"type":"run"}],"producedBy":{"roteVersion":"0.79.0"},"publishedAt":"2026-09-05T20:40:44.701529+00:00","reference":"rajkaria/upstream-pulse@0.1.0","requested":"rajkaria/upstream-pulse","requirements":{"adapters":[],"browser":{"dependencies":[],"runtime":false,"signIn":false},"hostToolRequirements":[{"command":"python3","required":true,"versionRequirement":null}],"localTools":["python3"],"roteCli":{"minimumVersion":"0.91.0"},"sessions":false},"resolution":"latest","schema":"rote.play.v1","stats":{"downloads":1,"installs":0},"steps":{"count":4,"names":["fetch_registry","read_lockfiles","read_registry","report"]},"title":"upstream-pulse","type":"play","version":"0.1.0","visibility":"public"}