Software Bill of Materials

Table of contents

1. Software Bill of Materials
   1. Node packages
   2. Go modules (cheasee-pi CLI)
   3. Rust crates (web control center)
   4. System dependencies
   5. Python packages (venv)
   6. Pi extensions
   7. Docker image base

---

Node packages

Package	Version	License	Purpose
@earendil-works/pi-coding-agent	1.0.2	MIT	Pi agent runtime
@earendil-works/pi-ai	1.0.2	MIT	Pi API client
@earendil-works/pi-tui	1.0.2	MIT	Pi TUI runtime
@ast-grep/cli	—	MIT	AST-aware code search
typescript	^6.0.3	Apache-2.0	TypeScript compiler
prettier	^3.8.3	MIT	Code formatting
proper-lockfile	^4.1.2	MIT	File-based locking for session logs
shell-quote	^1.9.0	MIT	Shell command parsing for worktree sandbox
typebox	^1.2.8	MIT	Runtime type validation
js-yaml	^5.2.2	MIT	YAML parsing (dev, release tests)
vscode-jsonrpc	^8.2.1	MIT	LSP communication
zod	^4.4.3	MIT	Schema-driven config validation
@octokit/rest	^22.0.1	MIT	GitHub REST API client (supervisor pipeline)
@octokit/graphql	^8.2.1	MIT	GitHub GraphQL API client (supervisor pipeline)

Go modules (cheasee-pi CLI)

Module	Version	License	Purpose
charm.land/huh/v2	v2.0.3	MIT	Terminal UI forms
github.com/cli/oauth	v1.2.2	MIT	Device-flow OAuth for GitHub auth
github.com/go-git/go-git/v5	v5.19.1	Apache-2.0	Git repository operations
github.com/spf13/cobra	v1.10.2	Apache-2.0	CLI framework
golang.org/x/mod	v0.40.0	BSD-3-Clause	Go module utilities

Rust crates (web control center)

Crate	Version	License	Purpose
leptos	0.8	MIT	UI framework (server-rendered + hydrated)
leptos_axum	0.8	MIT	Leptos ↔ Axum SSR integration
leptos_meta	0.8	MIT	Head/meta tags + hydration bootstrap
axum	0.8	MIT	HTTP server: routing, WebSocket upgrade, static assets
cargo-leptos	0.3	MIT	Two-target hydrate/SSR build + content-hashed assets

Upstream advisories on transitive leptos-stack crates (tracked, not directly fixable here):

• paste (RUSTSEC-2024-0436, unmaintained) — pulled by leptos, tachys, reactive_graph, reactive_stores, and either_of. No maintained replacement exists in the pinned leptos 0.8 line; resolve by tracking the upstream leptos migration off paste.
• proc-macro-error2 (RUSTSEC-2026-0173, unmaintained) — pulled by rstml → syn_derive. Same upstream-tracking resolution; there is no reachable direct replacement through the leptos macro stack.

System dependencies

Tool	Version	License	Purpose
Docker Engine	≥24.0	Apache-2.0	Container runtime
Docker Compose	V2	Apache-2.0	Multi-container orchestration
Go	≥1.25	BSD-3-Clause	Build language for the cheasee-pi CLI
Node.js	≥22	MIT	JavaScript runtime
Python 3	≥3.10	PSF	Web scraping, search tools
ripgrep (rg)	latest	MIT	Fast code search
ast-grep	≥0.42	MIT	Structural code search
GitHub CLI (gh)	latest	MIT	GitHub API client
jscpd	4.2.4	MIT	Duplicate code detection
osv-scanner	v2.4.0	Apache-2.0	Vulnerability scanning (audit pipeline)
eslint	latest	MIT	JS/TS linting (extension checks)
pyright	latest	MIT	Python type checking
rust-analyzer	latest	MIT/Apache-2.0	Rust LSP server
gopls	latest	BSD-3-Clause	Go LSP server
typescript-language-server	latest	MIT	TypeScript LSP server
fd-find	latest	MIT/Apache-2.0	Fast file search (fd)
universal-ctags	latest	GPL-2.0	Code index for tag generation
jq	latest	MIT	JSON processor for shell scripts
unzip	latest	Info-ZIP	Archive extraction
git	—	GPL-2.0	Version control, worktrees
gosu	—	Apache-2.0	UID/GID mapping in container

Python packages (venv)

Package	License	Purpose
scrapling[fetchers]	MIT	Web crawling with progressive fetching
markdownify	MIT	HTML to Markdown conversion
beautifulsoup4	MIT	HTML parsing (scrapling dependency)
ddgs	MIT	DuckDuckGo search API
Playwright Chromium	Apache-2.0	Browser automation for web crawling

Pi extensions

Extension	Type	Purpose
structural-analyzer	Core tool	AST-aware code search via ast-grep
ripgrep-search	Core tool	Fast text/regex search via ripgrep
scrapling	Core tool	Web crawling with Cloudflare bypass
web-search	Core tool	DuckDuckGo search
supervisor	Pipeline	Kanban multi-agent orchestration
context-info	UX	Rich TUI status bar
session-logger	UX	Session logging to JSONL
agent-harness	Safety	Runtime tool call validation
caveman	Communication	Token-efficient protocol
ask-user	Interaction	Interactive MC/freetext questions + JSONL logging
format-on-save	DX	Auto Prettier + ESLint after write/edit
tsc-checkpoint	DX	TypeScript type checking
worktree-sandbox	Safety	Worktree path enforcement
rtk	Core tool	Token-saving bash rewrite via rtk binary (60-90% less output)
lsp-auditor	Pipeline	LSP diagnostics pre-audit
zzz-dump-context	Debug	System prompt capture + dump

Docker image base

• Base image: Debian 12-slim (bookworm)
• Image name: cheasee-pi
• Build context: cmd/cheasee-pi/embedded/docker/Dockerfile (canonical source, embedded via //go:embed and extracted to a cache dir at runtime)