codo-ai 2.23.5

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 COdo
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,149 @@
+# COdo
+
+> The security-native AI coding agent. Six specialized security personas, scope-gated
+> pentesting, a durable findings store, and an orchestrated multi-agent workflow — all in
+> one terminal-first CLI.
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
+[![Platform](https://img.shields.io/badge/platform-macOS%20%7C%20Linux%20%7C%20Windows-blue)](#)
+[![npm](https://img.shields.io/npm/v/codo-ai)](https://www.npmjs.com/package/codo-ai)
+
+```text
+ ██████╗  ██████╗  ██████╗   ██████╗
+██╔════╝ ██╔═══██╗ ██╔══██╗ ██╔═══██╗
+██║      ██║   ██║ ██║  ██║ ██║   ██║
+██║      ██║   ██║ ██║  ██║ ██║   ██║
+╚██████╗ ╚██████╔╝ ██████╔╝ ╚██████╔╝
+ ╚═════╝  ╚═════╝  ╚═════╝   ╚═════╝
+```
+
+COdo is an AI coding agent for teams that treat security as part of the workflow, not a
+separate step. It writes code like any agent — and then it audits that code, threat-models
+the features you're about to build, scopes and executes authorized penetration tests, and
+remembers every finding across sessions. Stop losing vulnerabilities in markdown notes;
+every finding gets an ID, a severity, evidence, and a remediation path.
+
+---
+
+## Installation
+
+```bash
+npm install -g codo-ai
+```
+
+The npm package `codo-ai` installs a native binary for your platform (macOS, Linux, or
+Windows; Intel or Apple Silicon/ARM64; glibc or musl; baseline AVX2 fallbacks included) via
+a zero-dependency postinstall. No Node runtime required after install.
+
+```bash
+codo
+```
+
+You'll land in the COdo TUI. The default agent is `compose` for orchestrated multi-step
+work, and `@sec-test` handles everything security-related. Type `/help` to see the built-in
+commands.
+
+---
+
+## ✦ sec-test: security at the heart of the agent
+
+`@sec-test` is not a script or a lint rule — it's the full security lifecycle, built from
+**six specialized personas** and a **29-skill library**. You invoke it the same way you ask
+any other question; COdo routes to the right specialist.
+
+### The six personas
+
+| Persona | Phase | What it does |
+|---|---|---|
+| **`sec-architect`** | Design | Threat-model features before code exists (STRIDE/PASTA, ASVS mapping) |
+| **`sec-appsec`** | Code | Static audit of any diff or PR — injection, secrets, authz, OWASP Top 10 |
+| **`sec-devsecops`** | Build/ship | Pipeline hardening (NIST SSDF), SBOMs, container scans, supply-chain attestation |
+| **`sec-pentest`** | Validate | Scope-gated dynamic testing against running targets |
+| **`sec-qa`** | Verify | Test generation, coverage audits, mutation testing, regression guards |
+| **`sec-secops`** | Operate | Audits COdo itself, tracks posture trend over time |
+
+### What makes it different
+
+- **A durable findings store.** Every vulnerability is written to a SQLite
+  `security_finding` table — ID, severity, CVSS, evidence, remediation, status. Query it,
+  report on it, watch it age. Re-running a scan de-duplicates instead of duplicating.
+- **A real scope gate.** `sec-pentest` cannot send a single packet to a target unless
+  `.codo/security-scope.json` exists, is signed, unexpired, and names that target. The
+  network path is code-enforced — `curl`, `nmap`, and friends are denied for personas.
+- **29 ready-to-run skills.** From `threat-model` and `code-audit` to `secrets-scan`,
+  `dependency-audit`, `fuzz`, `exploit-verify`, `mutation-test`, `incident-runbook`,
+  `regression-guard`, and `posture-report`.
+- **Human-readable + machine-readable.** Every skill writes markdown under
+  `.planning/security/` *and* records findings in the store; `codo sec report` exports
+  markdown, JSON, or SARIF for your CI.
+- **Regression guards for every fix.** When a finding is fixed, `sec-qa` can convert it
+  into a permanent test so the bug can't come back unnoticed.
+
+### Example flows
+
+```text
+# Threat-model a feature before it's built
+@sec-test threat-model the new payment flow
+
+# Audit the current branch's changes
+@sec-test audit this branch for security issues
+
+# Authorize and pentest a running target (scope file required)
+@sec-test scope https://staging.example.com
+@sec-test pentest
+
+# Weekly posture digest
+@sec-test report
+```
+
+---
+
+## compose: orchestrated multi-agent work
+
+For everything that's not security — and the glue around it — COdo routes through the
+**`compose` agent**: an orchestrator that plans your request, dispatches specialized
+subagents (33 workflow agents), and produces structured artifacts as it goes:
+
+```text
+discuss → plan → execute → verify → review
+```
+
+Ask for a feature and get a roadmap, a numbered plan, parallel waves of implementation,
+and verification against acceptance criteria — with commit hygiene built in. `compose`
+also runs the GSD workflow system for milestone-driven development (`.planning/` project
+state, phases, cross-agent audits).
+
+---
+
+## And more
+
+- **Terminal-first TUI** — SolidJS + OpenTUI, with an embedded web workbench
+  (`codo web`) and an optional Electron desktop shell.
+- **Persistent sessions** — durable session inputs, crash-safe resume, and process-local
+  execution orchestration with EventV2 replay.
+- **Every major model provider** — OpenAI, Anthropic, Google, Bedrock, Azure, Groq,
+  Mistral, xAI, OpenRouter, and more via the AI SDK gateway, plus OAuth sign-in.
+- **Plugins** — a typed plugin API for extending the agent, tools, and skills.
+- **Generated SDK** — the HTTP API is spec-first, with a JS/TS SDK generated from the
+  OpenAPI schema.
+
+---
+
+## Requirements
+
+- macOS 12+, Linux (glibc or musl), or Windows 10+ (x64 with AVX2, or baseline fallback)
+- ARM64 (Apple Silicon / AArch64 Linux / Windows on ARM) supported natively
+
+## License
+
+MIT — see [`LICENSE`](LICENSE). COdo was initially derived from OpenCode (MIT); the
+OpenCode license text is preserved at [`LICENSES/OPENCODE-LICENSE.txt`](LICENSES/OPENCODE-LICENSE.txt).
+
+## Community
+
+- **Issues** → <https://github.com/Mosalah4351/COdo/issues>
+- **Discussions** → <https://github.com/Mosalah4351/COdo/discussions>
+- **Docs** → <https://codo.run/docs>
+
+If you find a vulnerability in COdo, please do **not** open a public issue — email
+`security@codo.run` with a proof-of-concept.

package/bin/codo.exe

@@ -0,0 +1,10 @@
+echo "Error: codo-ai's postinstall script was not run." >&2
+echo "" >&2
+echo "This occurs when using --ignore-scripts during installation, or when using a" >&2
+echo "package manager like pnpm that does not run postinstall scripts by default." >&2
+echo "" >&2
+echo "To fix this, run the postinstall script manually:" >&2
+echo "  cd node_modules/codo-ai && node postinstall.mjs" >&2
+echo "" >&2
+echo "Or reinstall codo-ai without the --ignore-scripts flag." >&2
+exit 1

package/package.json

@@ -0,0 +1,34 @@
+{
+  "os": [
+    "darwin",
+    "linux",
+    "win32"
+  ],
+  "name": "codo-ai",
+  "scripts": {
+    "postinstall": "node ./postinstall.mjs"
+  },
+  "cpu": [
+    "arm64",
+    "x64"
+  ],
+  "bin": {
+    "codo": "./bin/codo.exe"
+  },
+  "license": "MIT",
+  "version": "2.23.5",
+  "optionalDependencies": {
+    "@codo-ai/codo-linux-x64": "2.23.5",
+    "@codo-ai/codo-darwin-x64-baseline": "2.23.5",
+    "@codo-ai/codo-darwin-x64": "2.23.5",
+    "@codo-ai/codo-linux-x64-baseline": "2.23.5",
+    "@codo-ai/codo-linux-arm64-musl": "2.23.5",
+    "@codo-ai/codo-linux-x64-baseline-musl": "2.23.5",
+    "@codo-ai/codo-windows-x64": "2.23.5",
+    "@codo-ai/codo-linux-x64-musl": "2.23.5",
+    "@codo-ai/codo-windows-x64-baseline": "2.23.5",
+    "@codo-ai/codo-windows-arm64": "2.23.5",
+    "@codo-ai/codo-darwin-arm64": "2.23.5",
+    "@codo-ai/codo-linux-arm64": "2.23.5"
+  }
+}

package/postinstall.mjs

@@ -0,0 +1,189 @@
+#!/usr/bin/env node
+
+import childProcess from "child_process"
+import fs from "fs"
+import os from "os"
+import path from "path"
+import { createRequire } from "module"
+import { fileURLToPath } from "url"
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url))
+const require = createRequire(import.meta.url)
+const packageJson = JSON.parse(fs.readFileSync(path.join(__dirname, "package.json"), "utf8"))
+
+const platformMap = {
+  darwin: "darwin",
+  linux: "linux",
+  win32: "windows",
+}
+const archMap = {
+  x64: "x64",
+  arm64: "arm64",
+  arm: "arm",
+}
+
+const platform = platformMap[os.platform()] ?? os.platform()
+const arch = archMap[os.arch()] ?? os.arch()
+const base = `codo-${platform}-${arch}`
+const sourceBinary = platform === "windows" ? "codo.exe" : "codo"
+const targetBinary = path.join(__dirname, "bin", "codo.exe")
+
+function supportsAvx2() {
+  if (arch !== "x64") return false
+
+  if (platform === "linux") {
+    try {
+      return /(^|\s)avx2(\s|$)/i.test(fs.readFileSync("/proc/cpuinfo", "utf8"))
+    } catch {
+      return false
+    }
+  }
+
+  if (platform === "darwin") {
+    try {
+      const result = childProcess.spawnSync("sysctl", ["-n", "hw.optional.avx2_0"], {
+        encoding: "utf8",
+        timeout: 1500,
+      })
+      if (result.status !== 0) return false
+      return (result.stdout || "").trim() === "1"
+    } catch {
+      return false
+    }
+  }
+
+  if (platform === "windows") {
+    const command =
+      '(Add-Type -MemberDefinition "[DllImport(""kernel32.dll"")] public static extern bool IsProcessorFeaturePresent(int ProcessorFeature);" -Name Kernel32 -Namespace Win32 -PassThru)::IsProcessorFeaturePresent(40)'
+
+    for (const executable of ["powershell.exe", "pwsh.exe", "pwsh", "powershell"]) {
+      try {
+        const result = childProcess.spawnSync(executable, ["-NoProfile", "-NonInteractive", "-Command", command], {
+          encoding: "utf8",
+          timeout: 3000,
+          windowsHide: true,
+        })
+        if (result.status !== 0) continue
+        const output = (result.stdout || "").trim().toLowerCase()
+        if (output === "true" || output === "1") return true
+        if (output === "false" || output === "0") return false
+      } catch {
+        continue
+      }
+    }
+  }
+
+  return false
+}
+
+function isMusl() {
+  if (platform !== "linux") return false
+
+  try {
+    if (fs.existsSync("/etc/alpine-release")) return true
+  } catch {
+    // Ignore filesystem probes that are blocked by the host.
+  }
+
+  try {
+    const result = childProcess.spawnSync("ldd", ["--version"], { encoding: "utf8" })
+    return `${result.stdout || ""}${result.stderr || ""}`.toLowerCase().includes("musl")
+  } catch {
+    return false
+  }
+}
+
+function packageNames() {
+  const baseline = arch === "x64" && !supportsAvx2()
+
+  if (platform === "linux") {
+    if (isMusl()) {
+      if (arch === "x64")
+        return baseline
+          ? [`${base}-baseline-musl`, `${base}-musl`, `${base}-baseline`, base]
+          : [`${base}-musl`, `${base}-baseline-musl`, base, `${base}-baseline`]
+      return [`${base}-musl`, base]
+    }
+
+    if (arch === "x64")
+      return baseline
+        ? [`${base}-baseline`, base, `${base}-baseline-musl`, `${base}-musl`]
+        : [base, `${base}-baseline`, `${base}-musl`, `${base}-baseline-musl`]
+    return [base, `${base}-musl`]
+  }
+
+  if (arch === "x64") return baseline ? [`${base}-baseline`, base] : [base, `${base}-baseline`]
+  return [base]
+}
+
+function resolveBinary(name) {
+  const packageJsonPath = require.resolve(`${name}/package.json`)
+  const binaryPath = path.join(path.dirname(packageJsonPath), "bin", sourceBinary)
+  if (!fs.existsSync(binaryPath)) throw new Error(`Binary not found at ${binaryPath}`)
+  return binaryPath
+}
+
+function installPackage(name) {
+  const version = packageJson.optionalDependencies?.[name]
+  if (!version) return
+
+  const temp = fs.mkdtempSync(path.join(os.tmpdir(), "codo-install-"))
+  try {
+    const result = childProcess.spawnSync(
+      "npm",
+      ["install", "--ignore-scripts", "--no-save", "--loglevel=error", "--prefix", temp, `${name}@${version}`],
+      { stdio: "inherit", windowsHide: true },
+    )
+    if (result.status !== 0) return
+    const packageDir = path.join(temp, "node_modules", name)
+    copyBinary(path.join(packageDir, "bin", sourceBinary), targetBinary)
+    return true
+  } finally {
+    fs.rmSync(temp, { recursive: true, force: true })
+  }
+}
+
+function copyBinary(source, target) {
+  if (!fs.existsSync(source)) throw new Error(`Binary not found at ${source}`)
+  fs.mkdirSync(path.dirname(target), { recursive: true })
+  if (fs.existsSync(target)) fs.unlinkSync(target)
+  try {
+    fs.linkSync(source, target)
+  } catch {
+    fs.copyFileSync(source, target)
+  }
+  fs.chmodSync(target, 0o755)
+}
+
+function verifyBinary() {
+  const result = childProcess.spawnSync(targetBinary, ["--version"], {
+    encoding: "utf8",
+    stdio: "ignore",
+    windowsHide: true,
+  })
+  return result.status === 0
+}
+
+function main() {
+  for (const name of packageNames()) {
+    try {
+      copyBinary(resolveBinary(name), targetBinary)
+      if (verifyBinary()) return
+    } catch {
+      if (installPackage(name) && verifyBinary()) return
+    }
+  }
+
+  throw new Error(
+    `It seems your package manager failed to install the right codo CLI package. Try manually installing ${packageNames()
+      .map((name) => JSON.stringify(name))
+      .join(" or ")}.`,
+  )
+}
+
+try {
+  main()
+} catch (error) {
+  console.error(error.message)
+  process.exit(1)
+}