codo-ai 2.23.11 → 2.23.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +119 -117
- package/bin/codo +0 -0
- package/package.json +60 -60
- package/postinstall.mjs +26 -9
package/README.md
CHANGED
|
@@ -1,117 +1,119 @@
|
|
|
1
|
-
<div align="center">
|
|
2
|
-
|
|
3
|
-
# \>_ COdo
|
|
4
|
-
|
|
5
|
-
**The security-native AI coding agent.**
|
|
6
|
-
|
|
7
|
-
Spec it. Code it. Ship it. **Secure it.**
|
|
8
|
-
|
|
9
|
-
[Website](https://codo-ai.vercel.app/) · [Documentation](https://codo-ai.vercel.app/) · [GitHub](https://github.com/Mosalah4351/COdo) · [Report Issue](https://github.com/Mosalah4351/COdo/issues)
|
|
10
|
-
|
|
11
|
-
`npm install -g codo-ai`
|
|
12
|
-
|
|
13
|
-
</div>
|
|
14
|
-
|
|
15
|
-
---
|
|
16
|
-
|
|
17
|
-
## What is COdo?
|
|
18
|
-
|
|
19
|
-
COdo is a **terminal-native, spec-driven AI coding agent** — a fork of [OpenCode](https://github.com/anomalyco/opencode) with structured workflow orchestration, an autonomous multi-agent compose engine, and the all-new **Sec-Test** red security engine.
|
|
20
|
-
|
|
21
|
-
No browser tab. No separate app. No context-switching. Just you, your terminal, and an AI that knows what phase of the project you're in.
|
|
22
|
-
|
|
23
|
-
```
|
|
24
|
-
$ npm install -g codo-ai
|
|
25
|
-
$ cd my-project
|
|
26
|
-
$ codo
|
|
27
|
-
```
|
|
28
|
-
|
|
29
|
-
## Why COdo?
|
|
30
|
-
|
|
31
|
-
| | Static linters | CI scanners | **COdo Sec-Test** |
|
|
32
|
-
|---|---|---|---|
|
|
33
|
-
| Finds design flaws pre-code | ✗ | ✗ | ✓ STRIDE threat modeling |
|
|
34
|
-
| Noise level | False-positive flood | Late-stage flood | Evidence-first findings w/ PoC |
|
|
35
|
-
| Runs where you work | ✗ | CI only | ✓ Your terminal |
|
|
36
|
-
| Fixes vulnerabilities | Warnings only | Warnings only | ✓ Remediation diffs + mutation-backed tests |
|
|
37
|
-
|
|
38
|
-
## Highlights
|
|
39
|
-
|
|
40
|
-
### Sec-Test — Autonomous Security Orchestrator
|
|
41
|
-
Six specialist personas guarding the full lifecycle:
|
|
42
|
-
|
|
43
|
-
| Persona | Role |
|
|
44
|
-
|---|---|
|
|
45
|
-
| **Security Architect** | Pre-code STRIDE/DREAD threat modeling (OWASP ASVS mapped) |
|
|
46
|
-
| **AppSec Engineer** | Real-time SAST on diffs — OWASP Top 10:2025 / CWE Top 25, secrets, CVEs |
|
|
47
|
-
| **DevSecOps Engineer** | Pipeline hardening (NIST SSDF), SBOM (CycloneDX/SPDX), SLSA + Sigstore |
|
|
48
|
-
| **Penetration Tester** | Scope-gated live probing (PTES/WSTG) — refuses targets outside `.codo/security-scope.json` |
|
|
49
|
-
| **Quality Engineer** | Adversarial tests verified by mutation kill-rate |
|
|
50
|
-
| **Security Engineer** | Audits the agent itself; posture drift tracking |
|
|
51
|
-
|
|
52
|
-
```bash
|
|
53
|
-
$ /sec-test "Audit git diff for SQL injection and hardcoded secrets"
|
|
54
|
-
[1] Raw string concatenation in query builder
|
|
55
|
-
[2] Hardcoded fallback JWT secret ("dev-secret-key-12345")
|
|
56
|
-
→ Parameterized query fix applied · secret moved to env with startup validation
|
|
57
|
-
```
|
|
58
|
-
|
|
59
|
-
### Workflow Engines
|
|
60
|
-
Switch methodology per project scale:
|
|
61
|
-
|
|
62
|
-
- `/workflow gsd` — autonomous milestone planning, persistent `.planning/` state, survives context resets
|
|
63
|
-
- `/workflow gstack` — Garry Tan's 23-role virtual engineering team
|
|
64
|
-
- `/workflow speckit` — GitHub SDD spec-first pipeline
|
|
65
|
-
- `/workflow vibemode` — pure flow, zero overhead
|
|
66
|
-
|
|
67
|
-
### Multi-Agent Compose
|
|
68
|
-
Complex tasks decompose into DAGs routed to specialist agents executing in parallel waves:
|
|
69
|
-
|
|
70
|
-
```
|
|
71
|
-
/compose "Build auth service with JWT, rate limiting & Sec-Test"
|
|
72
|
-
[A] Security Architect → threat model ┐ parallel
|
|
73
|
-
[B] Builder → implementation ├ wave
|
|
74
|
-
[C] AppSec Engineer → real-time SAST audit │
|
|
75
|
-
[D] Quality Engineer → mutation tests ┘
|
|
76
|
-
```
|
|
77
|
-
|
|
78
|
-
### Goal Judge
|
|
79
|
-
Declare outcomes, not tasks. An independent judge model verifies stop-conditions — the builder never self-approves.
|
|
80
|
-
|
|
81
|
-
```
|
|
82
|
-
/goal "All tests pass with >80% coverage and zero HIGH/CVEs"
|
|
83
|
-
```
|
|
84
|
-
|
|
85
|
-
### Business Suite
|
|
86
|
-
Production-grade office tooling as skills: `xlsx-official`, `docx-official`, `pptx-official`, `pdf-official`, `deep-research`, `super-research`, `research-paper-writing`, `html-to-video-pipeline`, `sales`.
|
|
87
|
-
|
|
88
|
-
### Compliance-First Scraper
|
|
89
|
-
`/scraper <url> <what to extract>` — robots.txt honored, ToS checked, crawl-delays enforced, escalation ladder from static fetch to authenticated sessions.
|
|
90
|
-
|
|
91
|
-
## Install
|
|
92
|
-
|
|
93
|
-
```bash
|
|
94
|
-
# Recommended
|
|
95
|
-
npm install -g codo-ai
|
|
96
|
-
|
|
97
|
-
# One-time run
|
|
98
|
-
npx codo-ai
|
|
99
|
-
```
|
|
100
|
-
|
|
101
|
-
Requirements: Node 18+ or Bun · macOS / Linux / Windows · any provider API key (Anthropic, OpenAI, NVIDIA free tier, Google, or OpenAI-compatible).
|
|
102
|
-
|
|
103
|
-
>
|
|
104
|
-
|
|
105
|
-
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
|
|
110
|
-
|
|
111
|
-
|
|
112
|
-
|
|
113
|
-
|
|
114
|
-
|
|
115
|
-
|
|
116
|
-
|
|
117
|
-
|
|
1
|
+
<div align="center">
|
|
2
|
+
|
|
3
|
+
# \>_ COdo
|
|
4
|
+
|
|
5
|
+
**The security-native AI coding agent.**
|
|
6
|
+
|
|
7
|
+
Spec it. Code it. Ship it. **Secure it.**
|
|
8
|
+
|
|
9
|
+
[Website](https://codo-ai.vercel.app/) · [Documentation](https://codo-ai.vercel.app/) · [GitHub](https://github.com/Mosalah4351/COdo) · [Report Issue](https://github.com/Mosalah4351/COdo/issues)
|
|
10
|
+
|
|
11
|
+
`npm install -g codo-ai`
|
|
12
|
+
|
|
13
|
+
</div>
|
|
14
|
+
|
|
15
|
+
---
|
|
16
|
+
|
|
17
|
+
## What is COdo?
|
|
18
|
+
|
|
19
|
+
COdo is a **terminal-native, spec-driven AI coding agent** — a fork of [OpenCode](https://github.com/anomalyco/opencode) with structured workflow orchestration, an autonomous multi-agent compose engine, and the all-new **Sec-Test** red security engine.
|
|
20
|
+
|
|
21
|
+
No browser tab. No separate app. No context-switching. Just you, your terminal, and an AI that knows what phase of the project you're in.
|
|
22
|
+
|
|
23
|
+
```
|
|
24
|
+
$ npm install -g codo-ai
|
|
25
|
+
$ cd my-project
|
|
26
|
+
$ codo
|
|
27
|
+
```
|
|
28
|
+
|
|
29
|
+
## Why COdo?
|
|
30
|
+
|
|
31
|
+
| | Static linters | CI scanners | **COdo Sec-Test** |
|
|
32
|
+
|---|---|---|---|
|
|
33
|
+
| Finds design flaws pre-code | ✗ | ✗ | ✓ STRIDE threat modeling |
|
|
34
|
+
| Noise level | False-positive flood | Late-stage flood | Evidence-first findings w/ PoC |
|
|
35
|
+
| Runs where you work | ✗ | CI only | ✓ Your terminal |
|
|
36
|
+
| Fixes vulnerabilities | Warnings only | Warnings only | ✓ Remediation diffs + mutation-backed tests |
|
|
37
|
+
|
|
38
|
+
## Highlights
|
|
39
|
+
|
|
40
|
+
### Sec-Test — Autonomous Security Orchestrator
|
|
41
|
+
Six specialist personas guarding the full lifecycle:
|
|
42
|
+
|
|
43
|
+
| Persona | Role |
|
|
44
|
+
|---|---|
|
|
45
|
+
| **Security Architect** | Pre-code STRIDE/DREAD threat modeling (OWASP ASVS mapped) |
|
|
46
|
+
| **AppSec Engineer** | Real-time SAST on diffs — OWASP Top 10:2025 / CWE Top 25, secrets, CVEs |
|
|
47
|
+
| **DevSecOps Engineer** | Pipeline hardening (NIST SSDF), SBOM (CycloneDX/SPDX), SLSA + Sigstore |
|
|
48
|
+
| **Penetration Tester** | Scope-gated live probing (PTES/WSTG) — refuses targets outside `.codo/security-scope.json` |
|
|
49
|
+
| **Quality Engineer** | Adversarial tests verified by mutation kill-rate |
|
|
50
|
+
| **Security Engineer** | Audits the agent itself; posture drift tracking |
|
|
51
|
+
|
|
52
|
+
```bash
|
|
53
|
+
$ /sec-test "Audit git diff for SQL injection and hardcoded secrets"
|
|
54
|
+
[1] Raw string concatenation in query builder
|
|
55
|
+
[2] Hardcoded fallback JWT secret ("dev-secret-key-12345")
|
|
56
|
+
→ Parameterized query fix applied · secret moved to env with startup validation
|
|
57
|
+
```
|
|
58
|
+
|
|
59
|
+
### Workflow Engines
|
|
60
|
+
Switch methodology per project scale:
|
|
61
|
+
|
|
62
|
+
- `/workflow gsd` — autonomous milestone planning, persistent `.planning/` state, survives context resets
|
|
63
|
+
- `/workflow gstack` — Garry Tan's 23-role virtual engineering team
|
|
64
|
+
- `/workflow speckit` — GitHub SDD spec-first pipeline
|
|
65
|
+
- `/workflow vibemode` — pure flow, zero overhead
|
|
66
|
+
|
|
67
|
+
### Multi-Agent Compose
|
|
68
|
+
Complex tasks decompose into DAGs routed to specialist agents executing in parallel waves:
|
|
69
|
+
|
|
70
|
+
```
|
|
71
|
+
/compose "Build auth service with JWT, rate limiting & Sec-Test"
|
|
72
|
+
[A] Security Architect → threat model ┐ parallel
|
|
73
|
+
[B] Builder → implementation ├ wave
|
|
74
|
+
[C] AppSec Engineer → real-time SAST audit │
|
|
75
|
+
[D] Quality Engineer → mutation tests ┘
|
|
76
|
+
```
|
|
77
|
+
|
|
78
|
+
### Goal Judge
|
|
79
|
+
Declare outcomes, not tasks. An independent judge model verifies stop-conditions — the builder never self-approves.
|
|
80
|
+
|
|
81
|
+
```
|
|
82
|
+
/goal "All tests pass with >80% coverage and zero HIGH/CVEs"
|
|
83
|
+
```
|
|
84
|
+
|
|
85
|
+
### Business Suite
|
|
86
|
+
Production-grade office tooling as skills: `xlsx-official`, `docx-official`, `pptx-official`, `pdf-official`, `deep-research`, `super-research`, `research-paper-writing`, `html-to-video-pipeline`, `sales`.
|
|
87
|
+
|
|
88
|
+
### Compliance-First Scraper
|
|
89
|
+
`/scraper <url> <what to extract>` — robots.txt honored, ToS checked, crawl-delays enforced, escalation ladder from static fetch to authenticated sessions.
|
|
90
|
+
|
|
91
|
+
## Install
|
|
92
|
+
|
|
93
|
+
```bash
|
|
94
|
+
# Recommended
|
|
95
|
+
npm install -g codo-ai
|
|
96
|
+
|
|
97
|
+
# One-time run
|
|
98
|
+
npx codo-ai
|
|
99
|
+
```
|
|
100
|
+
|
|
101
|
+
Requirements: Node 18+ or Bun · macOS / Linux / Windows · any provider API key (Anthropic, OpenAI, NVIDIA free tier, Google, or OpenAI-compatible).
|
|
102
|
+
|
|
103
|
+
> No extra flags needed: the install works out of the box even when install scripts are blocked (`allowScripts` policies, `--ignore-scripts`), because the launcher resolves the prebuilt platform binary automatically on first run.
|
|
104
|
+
|
|
105
|
+
> Migrating from `@codo-ai/cli`? That package is deprecated — `codo-ai` replaces it.
|
|
106
|
+
|
|
107
|
+
## Documentation
|
|
108
|
+
|
|
109
|
+
Full developer docs — every persona, skill, workflow, permission mode, and best practice — live at **[codo-ai.vercel.app](https://codo-ai.vercel.app/)**.
|
|
110
|
+
|
|
111
|
+
## Contributing
|
|
112
|
+
|
|
113
|
+
PRs welcome on [GitHub](https://github.com/Mosalah4351/COdo). Default branch: `dev`. Conventional commits.
|
|
114
|
+
|
|
115
|
+
## License
|
|
116
|
+
|
|
117
|
+
MIT © [Mohamed Salah](https://www.linkedin.com/in/mohamed-salah-59bb41300/)
|
|
118
|
+
|
|
119
|
+
Built on [OpenCode](https://github.com/anomalyco/opencode).
|
package/bin/codo
CHANGED
|
File without changes
|
package/package.json
CHANGED
|
@@ -1,60 +1,60 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "codo-ai",
|
|
3
|
-
"
|
|
4
|
-
"
|
|
5
|
-
|
|
6
|
-
"
|
|
7
|
-
"
|
|
8
|
-
"
|
|
9
|
-
"
|
|
10
|
-
"
|
|
11
|
-
"
|
|
12
|
-
"
|
|
13
|
-
"
|
|
14
|
-
"
|
|
15
|
-
"
|
|
16
|
-
"
|
|
17
|
-
"
|
|
18
|
-
"
|
|
19
|
-
"
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
"
|
|
23
|
-
|
|
24
|
-
"
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
"
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
"
|
|
37
|
-
|
|
38
|
-
"
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
"
|
|
45
|
-
|
|
46
|
-
"optionalDependencies": {
|
|
47
|
-
"@codo-ai/codo-windows-x64": "2.23.
|
|
48
|
-
"@codo-ai/codo-windows-x64
|
|
49
|
-
"@codo-ai/codo-windows-arm64": "2.23.
|
|
50
|
-
"@codo-ai/codo-linux-x64": "2.23.
|
|
51
|
-
"@codo-ai/codo-linux-x64-baseline": "2.23.
|
|
52
|
-
"@codo-ai/codo-linux-
|
|
53
|
-
"@codo-ai/codo-linux-x64
|
|
54
|
-
"@codo-ai/codo-linux-
|
|
55
|
-
"@codo-ai/codo-linux-arm64
|
|
56
|
-
"@codo-ai/codo-darwin-x64": "2.23.
|
|
57
|
-
"@codo-ai/codo-darwin-x64
|
|
58
|
-
"@codo-ai/codo-darwin-arm64": "2.23.
|
|
59
|
-
}
|
|
60
|
-
}
|
|
1
|
+
{
|
|
2
|
+
"name": "codo-ai",
|
|
3
|
+
"description": "The security-native AI coding agent. Six Sec-Test security personas, compliance-first /scraper, a business documents & research suite, and multi-agent Compose orchestration - spec-driven workflow engines in one terminal-first CLI.",
|
|
4
|
+
"keywords": [
|
|
5
|
+
"ai",
|
|
6
|
+
"coding-agent",
|
|
7
|
+
"cli",
|
|
8
|
+
"terminal",
|
|
9
|
+
"tui",
|
|
10
|
+
"llm",
|
|
11
|
+
"security",
|
|
12
|
+
"sast",
|
|
13
|
+
"appsec",
|
|
14
|
+
"devsecops",
|
|
15
|
+
"threat-modeling",
|
|
16
|
+
"pentest",
|
|
17
|
+
"spec-driven",
|
|
18
|
+
"multi-agent",
|
|
19
|
+
"opencode"
|
|
20
|
+
],
|
|
21
|
+
"homepage": "https://codo-ai.vercel.app/",
|
|
22
|
+
"repository": {
|
|
23
|
+
"type": "git",
|
|
24
|
+
"url": "git+https://github.com/Mosalah4351/COdo.git"
|
|
25
|
+
},
|
|
26
|
+
"bugs": {
|
|
27
|
+
"url": "https://github.com/Mosalah4351/COdo/issues"
|
|
28
|
+
},
|
|
29
|
+
"bin": {
|
|
30
|
+
"codo": "./bin/codo"
|
|
31
|
+
},
|
|
32
|
+
"scripts": {
|
|
33
|
+
"postinstall": "node ./postinstall.mjs"
|
|
34
|
+
},
|
|
35
|
+
"version": "2.23.13",
|
|
36
|
+
"license": "MIT",
|
|
37
|
+
"os": [
|
|
38
|
+
"darwin",
|
|
39
|
+
"linux",
|
|
40
|
+
"win32"
|
|
41
|
+
],
|
|
42
|
+
"cpu": [
|
|
43
|
+
"arm64",
|
|
44
|
+
"x64"
|
|
45
|
+
],
|
|
46
|
+
"optionalDependencies": {
|
|
47
|
+
"@codo-ai/codo-windows-x64-baseline": "2.23.13",
|
|
48
|
+
"@codo-ai/codo-windows-x64": "2.23.13",
|
|
49
|
+
"@codo-ai/codo-windows-arm64": "2.23.13",
|
|
50
|
+
"@codo-ai/codo-linux-x64-musl": "2.23.13",
|
|
51
|
+
"@codo-ai/codo-linux-x64-baseline-musl": "2.23.13",
|
|
52
|
+
"@codo-ai/codo-linux-x64-baseline": "2.23.13",
|
|
53
|
+
"@codo-ai/codo-linux-x64": "2.23.13",
|
|
54
|
+
"@codo-ai/codo-linux-arm64-musl": "2.23.13",
|
|
55
|
+
"@codo-ai/codo-linux-arm64": "2.23.13",
|
|
56
|
+
"@codo-ai/codo-darwin-x64-baseline": "2.23.13",
|
|
57
|
+
"@codo-ai/codo-darwin-x64": "2.23.13",
|
|
58
|
+
"@codo-ai/codo-darwin-arm64": "2.23.13"
|
|
59
|
+
}
|
|
60
|
+
}
|
package/postinstall.mjs
CHANGED
|
@@ -171,22 +171,39 @@ function copyBinary(source, target) {
|
|
|
171
171
|
fs.chmodSync(target, 0o755)
|
|
172
172
|
}
|
|
173
173
|
|
|
174
|
-
function verifyBinary() {
|
|
175
|
-
|
|
176
|
-
|
|
177
|
-
|
|
178
|
-
|
|
179
|
-
|
|
180
|
-
|
|
174
|
+
function verifyBinary(target = targetBinary) {
|
|
175
|
+
try {
|
|
176
|
+
const result = childProcess.spawnSync(target, ["--version"], {
|
|
177
|
+
encoding: "utf8",
|
|
178
|
+
stdio: "ignore",
|
|
179
|
+
windowsHide: true,
|
|
180
|
+
})
|
|
181
|
+
return result.status === 0
|
|
182
|
+
} catch {
|
|
183
|
+
return false
|
|
184
|
+
}
|
|
181
185
|
}
|
|
182
186
|
|
|
183
187
|
function main() {
|
|
188
|
+
// Fast path: npm installs optionalDependencies by default, so the platform
|
|
189
|
+
// binary is usually already on disk. The launcher resolves it at runtime,
|
|
190
|
+
// so there is nothing to copy — just validate it actually runs.
|
|
184
191
|
for (const name of packageNames()) {
|
|
185
192
|
try {
|
|
186
|
-
|
|
187
|
-
if (verifyBinary()) return
|
|
193
|
+
if (verifyBinary(resolveBinary(name))) return
|
|
188
194
|
} catch {
|
|
195
|
+
// Package not installed; try the next candidate, then the fallback below.
|
|
196
|
+
}
|
|
197
|
+
}
|
|
198
|
+
|
|
199
|
+
// Fallback: the platform package is missing (isolated pnpm layouts,
|
|
200
|
+
// --no-optional installs). Fetch it into a temp dir and stage the binary
|
|
201
|
+
// next to the launcher, where the launcher looks for it.
|
|
202
|
+
for (const name of packageNames()) {
|
|
203
|
+
try {
|
|
189
204
|
if (installPackage(name) && verifyBinary()) return
|
|
205
|
+
} catch {
|
|
206
|
+
// Try the next candidate.
|
|
190
207
|
}
|
|
191
208
|
}
|
|
192
209
|
|