codo-ai 2.23.11 → 2.23.12
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +117 -117
- package/bin/codo +0 -0
- package/package.json +60 -60
package/README.md
CHANGED
|
@@ -1,117 +1,117 @@
|
|
|
1
|
-
<div align="center">
|
|
2
|
-
|
|
3
|
-
# \>_ COdo
|
|
4
|
-
|
|
5
|
-
**The security-native AI coding agent.**
|
|
6
|
-
|
|
7
|
-
Spec it. Code it. Ship it. **Secure it.**
|
|
8
|
-
|
|
9
|
-
[Website](https://codo-ai.vercel.app/) · [Documentation](https://codo-ai.vercel.app/) · [GitHub](https://github.com/Mosalah4351/COdo) · [Report Issue](https://github.com/Mosalah4351/COdo/issues)
|
|
10
|
-
|
|
11
|
-
`npm install -g codo-ai`
|
|
12
|
-
|
|
13
|
-
</div>
|
|
14
|
-
|
|
15
|
-
---
|
|
16
|
-
|
|
17
|
-
## What is COdo?
|
|
18
|
-
|
|
19
|
-
COdo is a **terminal-native, spec-driven AI coding agent** — a fork of [OpenCode](https://github.com/anomalyco/opencode) with structured workflow orchestration, an autonomous multi-agent compose engine, and the all-new **Sec-Test** red security engine.
|
|
20
|
-
|
|
21
|
-
No browser tab. No separate app. No context-switching. Just you, your terminal, and an AI that knows what phase of the project you're in.
|
|
22
|
-
|
|
23
|
-
```
|
|
24
|
-
$ npm install -g codo-ai
|
|
25
|
-
$ cd my-project
|
|
26
|
-
$ codo
|
|
27
|
-
```
|
|
28
|
-
|
|
29
|
-
## Why COdo?
|
|
30
|
-
|
|
31
|
-
| | Static linters | CI scanners | **COdo Sec-Test** |
|
|
32
|
-
|---|---|---|---|
|
|
33
|
-
| Finds design flaws pre-code | ✗ | ✗ | ✓ STRIDE threat modeling |
|
|
34
|
-
| Noise level | False-positive flood | Late-stage flood | Evidence-first findings w/ PoC |
|
|
35
|
-
| Runs where you work | ✗ | CI only | ✓ Your terminal |
|
|
36
|
-
| Fixes vulnerabilities | Warnings only | Warnings only | ✓ Remediation diffs + mutation-backed tests |
|
|
37
|
-
|
|
38
|
-
## Highlights
|
|
39
|
-
|
|
40
|
-
### Sec-Test — Autonomous Security Orchestrator
|
|
41
|
-
Six specialist personas guarding the full lifecycle:
|
|
42
|
-
|
|
43
|
-
| Persona | Role |
|
|
44
|
-
|---|---|
|
|
45
|
-
| **Security Architect** | Pre-code STRIDE/DREAD threat modeling (OWASP ASVS mapped) |
|
|
46
|
-
| **AppSec Engineer** | Real-time SAST on diffs — OWASP Top 10:2025 / CWE Top 25, secrets, CVEs |
|
|
47
|
-
| **DevSecOps Engineer** | Pipeline hardening (NIST SSDF), SBOM (CycloneDX/SPDX), SLSA + Sigstore |
|
|
48
|
-
| **Penetration Tester** | Scope-gated live probing (PTES/WSTG) — refuses targets outside `.codo/security-scope.json` |
|
|
49
|
-
| **Quality Engineer** | Adversarial tests verified by mutation kill-rate |
|
|
50
|
-
| **Security Engineer** | Audits the agent itself; posture drift tracking |
|
|
51
|
-
|
|
52
|
-
```bash
|
|
53
|
-
$ /sec-test "Audit git diff for SQL injection and hardcoded secrets"
|
|
54
|
-
[1] Raw string concatenation in query builder
|
|
55
|
-
[2] Hardcoded fallback JWT secret ("dev-secret-key-12345")
|
|
56
|
-
→ Parameterized query fix applied · secret moved to env with startup validation
|
|
57
|
-
```
|
|
58
|
-
|
|
59
|
-
### Workflow Engines
|
|
60
|
-
Switch methodology per project scale:
|
|
61
|
-
|
|
62
|
-
- `/workflow gsd` — autonomous milestone planning, persistent `.planning/` state, survives context resets
|
|
63
|
-
- `/workflow gstack` — Garry Tan's 23-role virtual engineering team
|
|
64
|
-
- `/workflow speckit` — GitHub SDD spec-first pipeline
|
|
65
|
-
- `/workflow vibemode` — pure flow, zero overhead
|
|
66
|
-
|
|
67
|
-
### Multi-Agent Compose
|
|
68
|
-
Complex tasks decompose into DAGs routed to specialist agents executing in parallel waves:
|
|
69
|
-
|
|
70
|
-
```
|
|
71
|
-
/compose "Build auth service with JWT, rate limiting & Sec-Test"
|
|
72
|
-
[A] Security Architect → threat model ┐ parallel
|
|
73
|
-
[B] Builder → implementation ├ wave
|
|
74
|
-
[C] AppSec Engineer → real-time SAST audit │
|
|
75
|
-
[D] Quality Engineer → mutation tests ┘
|
|
76
|
-
```
|
|
77
|
-
|
|
78
|
-
### Goal Judge
|
|
79
|
-
Declare outcomes, not tasks. An independent judge model verifies stop-conditions — the builder never self-approves.
|
|
80
|
-
|
|
81
|
-
```
|
|
82
|
-
/goal "All tests pass with >80% coverage and zero HIGH/CVEs"
|
|
83
|
-
```
|
|
84
|
-
|
|
85
|
-
### Business Suite
|
|
86
|
-
Production-grade office tooling as skills: `xlsx-official`, `docx-official`, `pptx-official`, `pdf-official`, `deep-research`, `super-research`, `research-paper-writing`, `html-to-video-pipeline`, `sales`.
|
|
87
|
-
|
|
88
|
-
### Compliance-First Scraper
|
|
89
|
-
`/scraper <url> <what to extract>` — robots.txt honored, ToS checked, crawl-delays enforced, escalation ladder from static fetch to authenticated sessions.
|
|
90
|
-
|
|
91
|
-
## Install
|
|
92
|
-
|
|
93
|
-
```bash
|
|
94
|
-
# Recommended
|
|
95
|
-
npm install -g codo-ai
|
|
96
|
-
|
|
97
|
-
# One-time run
|
|
98
|
-
npx codo-ai
|
|
99
|
-
```
|
|
100
|
-
|
|
101
|
-
Requirements: Node 18+ or Bun · macOS / Linux / Windows · any provider API key (Anthropic, OpenAI, NVIDIA free tier, Google, or OpenAI-compatible).
|
|
102
|
-
|
|
103
|
-
> Migrating from `@codo-ai/cli`? That package is deprecated — `codo-ai` replaces it.
|
|
104
|
-
|
|
105
|
-
## Documentation
|
|
106
|
-
|
|
107
|
-
Full developer docs — every persona, skill, workflow, permission mode, and best practice — live at **[codo-ai.vercel.app](https://codo-ai.vercel.app/)**.
|
|
108
|
-
|
|
109
|
-
## Contributing
|
|
110
|
-
|
|
111
|
-
PRs welcome on [GitHub](https://github.com/Mosalah4351/COdo). Default branch: `dev`. Conventional commits.
|
|
112
|
-
|
|
113
|
-
## License
|
|
114
|
-
|
|
115
|
-
MIT © [Mohamed Salah](https://www.linkedin.com/in/mohamed-salah-59bb41300/)
|
|
116
|
-
|
|
117
|
-
Built on [OpenCode](https://github.com/anomalyco/opencode).
|
|
1
|
+
<div align="center">
|
|
2
|
+
|
|
3
|
+
# \>_ COdo
|
|
4
|
+
|
|
5
|
+
**The security-native AI coding agent.**
|
|
6
|
+
|
|
7
|
+
Spec it. Code it. Ship it. **Secure it.**
|
|
8
|
+
|
|
9
|
+
[Website](https://codo-ai.vercel.app/) · [Documentation](https://codo-ai.vercel.app/) · [GitHub](https://github.com/Mosalah4351/COdo) · [Report Issue](https://github.com/Mosalah4351/COdo/issues)
|
|
10
|
+
|
|
11
|
+
`npm install -g codo-ai`
|
|
12
|
+
|
|
13
|
+
</div>
|
|
14
|
+
|
|
15
|
+
---
|
|
16
|
+
|
|
17
|
+
## What is COdo?
|
|
18
|
+
|
|
19
|
+
COdo is a **terminal-native, spec-driven AI coding agent** — a fork of [OpenCode](https://github.com/anomalyco/opencode) with structured workflow orchestration, an autonomous multi-agent compose engine, and the all-new **Sec-Test** red security engine.
|
|
20
|
+
|
|
21
|
+
No browser tab. No separate app. No context-switching. Just you, your terminal, and an AI that knows what phase of the project you're in.
|
|
22
|
+
|
|
23
|
+
```
|
|
24
|
+
$ npm install -g codo-ai
|
|
25
|
+
$ cd my-project
|
|
26
|
+
$ codo
|
|
27
|
+
```
|
|
28
|
+
|
|
29
|
+
## Why COdo?
|
|
30
|
+
|
|
31
|
+
| | Static linters | CI scanners | **COdo Sec-Test** |
|
|
32
|
+
|---|---|---|---|
|
|
33
|
+
| Finds design flaws pre-code | ✗ | ✗ | ✓ STRIDE threat modeling |
|
|
34
|
+
| Noise level | False-positive flood | Late-stage flood | Evidence-first findings w/ PoC |
|
|
35
|
+
| Runs where you work | ✗ | CI only | ✓ Your terminal |
|
|
36
|
+
| Fixes vulnerabilities | Warnings only | Warnings only | ✓ Remediation diffs + mutation-backed tests |
|
|
37
|
+
|
|
38
|
+
## Highlights
|
|
39
|
+
|
|
40
|
+
### Sec-Test — Autonomous Security Orchestrator
|
|
41
|
+
Six specialist personas guarding the full lifecycle:
|
|
42
|
+
|
|
43
|
+
| Persona | Role |
|
|
44
|
+
|---|---|
|
|
45
|
+
| **Security Architect** | Pre-code STRIDE/DREAD threat modeling (OWASP ASVS mapped) |
|
|
46
|
+
| **AppSec Engineer** | Real-time SAST on diffs — OWASP Top 10:2025 / CWE Top 25, secrets, CVEs |
|
|
47
|
+
| **DevSecOps Engineer** | Pipeline hardening (NIST SSDF), SBOM (CycloneDX/SPDX), SLSA + Sigstore |
|
|
48
|
+
| **Penetration Tester** | Scope-gated live probing (PTES/WSTG) — refuses targets outside `.codo/security-scope.json` |
|
|
49
|
+
| **Quality Engineer** | Adversarial tests verified by mutation kill-rate |
|
|
50
|
+
| **Security Engineer** | Audits the agent itself; posture drift tracking |
|
|
51
|
+
|
|
52
|
+
```bash
|
|
53
|
+
$ /sec-test "Audit git diff for SQL injection and hardcoded secrets"
|
|
54
|
+
[1] Raw string concatenation in query builder
|
|
55
|
+
[2] Hardcoded fallback JWT secret ("dev-secret-key-12345")
|
|
56
|
+
→ Parameterized query fix applied · secret moved to env with startup validation
|
|
57
|
+
```
|
|
58
|
+
|
|
59
|
+
### Workflow Engines
|
|
60
|
+
Switch methodology per project scale:
|
|
61
|
+
|
|
62
|
+
- `/workflow gsd` — autonomous milestone planning, persistent `.planning/` state, survives context resets
|
|
63
|
+
- `/workflow gstack` — Garry Tan's 23-role virtual engineering team
|
|
64
|
+
- `/workflow speckit` — GitHub SDD spec-first pipeline
|
|
65
|
+
- `/workflow vibemode` — pure flow, zero overhead
|
|
66
|
+
|
|
67
|
+
### Multi-Agent Compose
|
|
68
|
+
Complex tasks decompose into DAGs routed to specialist agents executing in parallel waves:
|
|
69
|
+
|
|
70
|
+
```
|
|
71
|
+
/compose "Build auth service with JWT, rate limiting & Sec-Test"
|
|
72
|
+
[A] Security Architect → threat model ┐ parallel
|
|
73
|
+
[B] Builder → implementation ├ wave
|
|
74
|
+
[C] AppSec Engineer → real-time SAST audit │
|
|
75
|
+
[D] Quality Engineer → mutation tests ┘
|
|
76
|
+
```
|
|
77
|
+
|
|
78
|
+
### Goal Judge
|
|
79
|
+
Declare outcomes, not tasks. An independent judge model verifies stop-conditions — the builder never self-approves.
|
|
80
|
+
|
|
81
|
+
```
|
|
82
|
+
/goal "All tests pass with >80% coverage and zero HIGH/CVEs"
|
|
83
|
+
```
|
|
84
|
+
|
|
85
|
+
### Business Suite
|
|
86
|
+
Production-grade office tooling as skills: `xlsx-official`, `docx-official`, `pptx-official`, `pdf-official`, `deep-research`, `super-research`, `research-paper-writing`, `html-to-video-pipeline`, `sales`.
|
|
87
|
+
|
|
88
|
+
### Compliance-First Scraper
|
|
89
|
+
`/scraper <url> <what to extract>` — robots.txt honored, ToS checked, crawl-delays enforced, escalation ladder from static fetch to authenticated sessions.
|
|
90
|
+
|
|
91
|
+
## Install
|
|
92
|
+
|
|
93
|
+
```bash
|
|
94
|
+
# Recommended
|
|
95
|
+
npm install -g codo-ai
|
|
96
|
+
|
|
97
|
+
# One-time run
|
|
98
|
+
npx codo-ai
|
|
99
|
+
```
|
|
100
|
+
|
|
101
|
+
Requirements: Node 18+ or Bun · macOS / Linux / Windows · any provider API key (Anthropic, OpenAI, NVIDIA free tier, Google, or OpenAI-compatible).
|
|
102
|
+
|
|
103
|
+
> Migrating from `@codo-ai/cli`? That package is deprecated — `codo-ai` replaces it.
|
|
104
|
+
|
|
105
|
+
## Documentation
|
|
106
|
+
|
|
107
|
+
Full developer docs — every persona, skill, workflow, permission mode, and best practice — live at **[codo-ai.vercel.app](https://codo-ai.vercel.app/)**.
|
|
108
|
+
|
|
109
|
+
## Contributing
|
|
110
|
+
|
|
111
|
+
PRs welcome on [GitHub](https://github.com/Mosalah4351/COdo). Default branch: `dev`. Conventional commits.
|
|
112
|
+
|
|
113
|
+
## License
|
|
114
|
+
|
|
115
|
+
MIT © [Mohamed Salah](https://www.linkedin.com/in/mohamed-salah-59bb41300/)
|
|
116
|
+
|
|
117
|
+
Built on [OpenCode](https://github.com/anomalyco/opencode).
|
package/bin/codo
CHANGED
|
File without changes
|
package/package.json
CHANGED
|
@@ -1,60 +1,60 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "codo-ai",
|
|
3
|
-
"
|
|
4
|
-
"
|
|
5
|
-
|
|
6
|
-
"
|
|
7
|
-
"
|
|
8
|
-
"
|
|
9
|
-
"
|
|
10
|
-
"
|
|
11
|
-
"
|
|
12
|
-
"
|
|
13
|
-
"
|
|
14
|
-
"
|
|
15
|
-
"
|
|
16
|
-
"
|
|
17
|
-
"
|
|
18
|
-
"
|
|
19
|
-
"
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
"
|
|
23
|
-
|
|
24
|
-
"
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
"
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
"
|
|
37
|
-
|
|
38
|
-
"
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
"
|
|
45
|
-
|
|
46
|
-
"optionalDependencies": {
|
|
47
|
-
"@codo-ai/codo-windows-x64": "2.23.
|
|
48
|
-
"@codo-ai/codo-windows-x64
|
|
49
|
-
"@codo-ai/codo-windows-arm64": "2.23.
|
|
50
|
-
"@codo-ai/codo-linux-x64": "2.23.
|
|
51
|
-
"@codo-ai/codo-linux-x64-baseline": "2.23.
|
|
52
|
-
"@codo-ai/codo-linux-
|
|
53
|
-
"@codo-ai/codo-linux-x64
|
|
54
|
-
"@codo-ai/codo-linux-
|
|
55
|
-
"@codo-ai/codo-linux-arm64
|
|
56
|
-
"@codo-ai/codo-darwin-x64": "2.23.
|
|
57
|
-
"@codo-ai/codo-darwin-x64
|
|
58
|
-
"@codo-ai/codo-darwin-arm64": "2.23.
|
|
59
|
-
}
|
|
60
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"name": "codo-ai",
|
|
3
|
+
"description": "The security-native AI coding agent. Six Sec-Test security personas, compliance-first /scraper, a business documents & research suite, and multi-agent Compose orchestration — spec-driven workflow engines in one terminal-first CLI.",
|
|
4
|
+
"keywords": [
|
|
5
|
+
"ai",
|
|
6
|
+
"coding-agent",
|
|
7
|
+
"cli",
|
|
8
|
+
"terminal",
|
|
9
|
+
"tui",
|
|
10
|
+
"llm",
|
|
11
|
+
"security",
|
|
12
|
+
"sast",
|
|
13
|
+
"appsec",
|
|
14
|
+
"devsecops",
|
|
15
|
+
"threat-modeling",
|
|
16
|
+
"pentest",
|
|
17
|
+
"spec-driven",
|
|
18
|
+
"multi-agent",
|
|
19
|
+
"opencode"
|
|
20
|
+
],
|
|
21
|
+
"homepage": "https://codo-ai.vercel.app/",
|
|
22
|
+
"repository": {
|
|
23
|
+
"type": "git",
|
|
24
|
+
"url": "git+https://github.com/Mosalah4351/COdo.git"
|
|
25
|
+
},
|
|
26
|
+
"bugs": {
|
|
27
|
+
"url": "https://github.com/Mosalah4351/COdo/issues"
|
|
28
|
+
},
|
|
29
|
+
"bin": {
|
|
30
|
+
"codo": "./bin/codo"
|
|
31
|
+
},
|
|
32
|
+
"scripts": {
|
|
33
|
+
"postinstall": "node ./postinstall.mjs"
|
|
34
|
+
},
|
|
35
|
+
"version": "2.23.12",
|
|
36
|
+
"license": "MIT",
|
|
37
|
+
"os": [
|
|
38
|
+
"darwin",
|
|
39
|
+
"linux",
|
|
40
|
+
"win32"
|
|
41
|
+
],
|
|
42
|
+
"cpu": [
|
|
43
|
+
"arm64",
|
|
44
|
+
"x64"
|
|
45
|
+
],
|
|
46
|
+
"optionalDependencies": {
|
|
47
|
+
"@codo-ai/codo-windows-x64-baseline": "2.23.12",
|
|
48
|
+
"@codo-ai/codo-windows-x64": "2.23.12",
|
|
49
|
+
"@codo-ai/codo-windows-arm64": "2.23.12",
|
|
50
|
+
"@codo-ai/codo-linux-x64-musl": "2.23.12",
|
|
51
|
+
"@codo-ai/codo-linux-x64-baseline-musl": "2.23.12",
|
|
52
|
+
"@codo-ai/codo-linux-x64-baseline": "2.23.12",
|
|
53
|
+
"@codo-ai/codo-linux-x64": "2.23.12",
|
|
54
|
+
"@codo-ai/codo-linux-arm64-musl": "2.23.12",
|
|
55
|
+
"@codo-ai/codo-linux-arm64": "2.23.12",
|
|
56
|
+
"@codo-ai/codo-darwin-x64-baseline": "2.23.12",
|
|
57
|
+
"@codo-ai/codo-darwin-x64": "2.23.12",
|
|
58
|
+
"@codo-ai/codo-darwin-arm64": "2.23.12"
|
|
59
|
+
}
|
|
60
|
+
}
|