codo-ai 2.23.8 → 2.23.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +87 -119
- package/package.json +53 -34
- package/codo-ai-2.23.5.tgz +0 -0
package/README.md
CHANGED
|
@@ -1,149 +1,117 @@
|
|
|
1
|
-
|
|
2
|
-
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
[](#)
|
|
9
|
-
[](https://www.npmjs.com/package/codo-ai)
|
|
10
|
-
|
|
11
|
-
```text
|
|
12
|
-
██████╗ ██████╗ ██████╗ ██████╗
|
|
13
|
-
██╔════╝ ██╔═══██╗ ██╔══██╗ ██╔═══██╗
|
|
14
|
-
██║ ██║ ██║ ██║ ██║ ██║ ██║
|
|
15
|
-
██║ ██║ ██║ ██║ ██║ ██║ ██║
|
|
16
|
-
╚██████╗ ╚██████╔╝ ██████╔╝ ╚██████╔╝
|
|
17
|
-
╚═════╝ ╚═════╝ ╚═════╝ ╚═════╝
|
|
18
|
-
```
|
|
1
|
+
<div align="center">
|
|
2
|
+
|
|
3
|
+
# \>_ COdo
|
|
4
|
+
|
|
5
|
+
**The security-native AI coding agent.**
|
|
6
|
+
|
|
7
|
+
Spec it. Code it. Ship it. **Secure it.**
|
|
19
8
|
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
|
|
9
|
+
[Website](https://codo-ai.vercel.app/) · [Documentation](https://codo-ai.vercel.app/) · [GitHub](https://github.com/Mosalah4351/COdo) · [Report Issue](https://github.com/Mosalah4351/COdo/issues)
|
|
10
|
+
|
|
11
|
+
`npm install -g codo-ai`
|
|
12
|
+
|
|
13
|
+
</div>
|
|
25
14
|
|
|
26
15
|
---
|
|
27
16
|
|
|
28
|
-
##
|
|
17
|
+
## What is COdo?
|
|
18
|
+
|
|
19
|
+
COdo is a **terminal-native, spec-driven AI coding agent** — a fork of [OpenCode](https://github.com/anomalyco/opencode) with structured workflow orchestration, an autonomous multi-agent compose engine, and the all-new **Sec-Test** red security engine.
|
|
20
|
+
|
|
21
|
+
No browser tab. No separate app. No context-switching. Just you, your terminal, and an AI that knows what phase of the project you're in.
|
|
29
22
|
|
|
30
|
-
```bash
|
|
31
|
-
npm install -g codo-ai
|
|
32
23
|
```
|
|
24
|
+
$ npm install -g codo-ai
|
|
25
|
+
$ cd my-project
|
|
26
|
+
$ codo
|
|
27
|
+
```
|
|
28
|
+
|
|
29
|
+
## Why COdo?
|
|
30
|
+
|
|
31
|
+
| | Static linters | CI scanners | **COdo Sec-Test** |
|
|
32
|
+
|---|---|---|---|
|
|
33
|
+
| Finds design flaws pre-code | ✗ | ✗ | ✓ STRIDE threat modeling |
|
|
34
|
+
| Noise level | False-positive flood | Late-stage flood | Evidence-first findings w/ PoC |
|
|
35
|
+
| Runs where you work | ✗ | CI only | ✓ Your terminal |
|
|
36
|
+
| Fixes vulnerabilities | Warnings only | Warnings only | ✓ Remediation diffs + mutation-backed tests |
|
|
37
|
+
|
|
38
|
+
## Highlights
|
|
39
|
+
|
|
40
|
+
### Sec-Test — Autonomous Security Orchestrator
|
|
41
|
+
Six specialist personas guarding the full lifecycle:
|
|
33
42
|
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
43
|
+
| Persona | Role |
|
|
44
|
+
|---|---|
|
|
45
|
+
| **Security Architect** | Pre-code STRIDE/DREAD threat modeling (OWASP ASVS mapped) |
|
|
46
|
+
| **AppSec Engineer** | Real-time SAST on diffs — OWASP Top 10:2025 / CWE Top 25, secrets, CVEs |
|
|
47
|
+
| **DevSecOps Engineer** | Pipeline hardening (NIST SSDF), SBOM (CycloneDX/SPDX), SLSA + Sigstore |
|
|
48
|
+
| **Penetration Tester** | Scope-gated live probing (PTES/WSTG) — refuses targets outside `.codo/security-scope.json` |
|
|
49
|
+
| **Quality Engineer** | Adversarial tests verified by mutation kill-rate |
|
|
50
|
+
| **Security Engineer** | Audits the agent itself; posture drift tracking |
|
|
37
51
|
|
|
38
52
|
```bash
|
|
39
|
-
|
|
53
|
+
$ /sec-test "Audit git diff for SQL injection and hardcoded secrets"
|
|
54
|
+
[1] Raw string concatenation in query builder
|
|
55
|
+
[2] Hardcoded fallback JWT secret ("dev-secret-key-12345")
|
|
56
|
+
→ Parameterized query fix applied · secret moved to env with startup validation
|
|
40
57
|
```
|
|
41
58
|
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
commands.
|
|
59
|
+
### Workflow Engines
|
|
60
|
+
Switch methodology per project scale:
|
|
45
61
|
|
|
46
|
-
|
|
62
|
+
- `/workflow gsd` — autonomous milestone planning, persistent `.planning/` state, survives context resets
|
|
63
|
+
- `/workflow gstack` — Garry Tan's 23-role virtual engineering team
|
|
64
|
+
- `/workflow speckit` — GitHub SDD spec-first pipeline
|
|
65
|
+
- `/workflow vibemode` — pure flow, zero overhead
|
|
66
|
+
|
|
67
|
+
### Multi-Agent Compose
|
|
68
|
+
Complex tasks decompose into DAGs routed to specialist agents executing in parallel waves:
|
|
47
69
|
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
### The six personas
|
|
55
|
-
|
|
56
|
-
| Persona | Phase | What it does |
|
|
57
|
-
|---|---|---|
|
|
58
|
-
| **`sec-architect`** | Design | Threat-model features before code exists (STRIDE/PASTA, ASVS mapping) |
|
|
59
|
-
| **`sec-appsec`** | Code | Static audit of any diff or PR — injection, secrets, authz, OWASP Top 10 |
|
|
60
|
-
| **`sec-devsecops`** | Build/ship | Pipeline hardening (NIST SSDF), SBOMs, container scans, supply-chain attestation |
|
|
61
|
-
| **`sec-pentest`** | Validate | Scope-gated dynamic testing against running targets |
|
|
62
|
-
| **`sec-qa`** | Verify | Test generation, coverage audits, mutation testing, regression guards |
|
|
63
|
-
| **`sec-secops`** | Operate | Audits COdo itself, tracks posture trend over time |
|
|
64
|
-
|
|
65
|
-
### What makes it different
|
|
66
|
-
|
|
67
|
-
- **A durable findings store.** Every vulnerability is written to a SQLite
|
|
68
|
-
`security_finding` table — ID, severity, CVSS, evidence, remediation, status. Query it,
|
|
69
|
-
report on it, watch it age. Re-running a scan de-duplicates instead of duplicating.
|
|
70
|
-
- **A real scope gate.** `sec-pentest` cannot send a single packet to a target unless
|
|
71
|
-
`.codo/security-scope.json` exists, is signed, unexpired, and names that target. The
|
|
72
|
-
network path is code-enforced — `curl`, `nmap`, and friends are denied for personas.
|
|
73
|
-
- **29 ready-to-run skills.** From `threat-model` and `code-audit` to `secrets-scan`,
|
|
74
|
-
`dependency-audit`, `fuzz`, `exploit-verify`, `mutation-test`, `incident-runbook`,
|
|
75
|
-
`regression-guard`, and `posture-report`.
|
|
76
|
-
- **Human-readable + machine-readable.** Every skill writes markdown under
|
|
77
|
-
`.planning/security/` *and* records findings in the store; `codo sec report` exports
|
|
78
|
-
markdown, JSON, or SARIF for your CI.
|
|
79
|
-
- **Regression guards for every fix.** When a finding is fixed, `sec-qa` can convert it
|
|
80
|
-
into a permanent test so the bug can't come back unnoticed.
|
|
81
|
-
|
|
82
|
-
### Example flows
|
|
83
|
-
|
|
84
|
-
```text
|
|
85
|
-
# Threat-model a feature before it's built
|
|
86
|
-
@sec-test threat-model the new payment flow
|
|
87
|
-
|
|
88
|
-
# Audit the current branch's changes
|
|
89
|
-
@sec-test audit this branch for security issues
|
|
90
|
-
|
|
91
|
-
# Authorize and pentest a running target (scope file required)
|
|
92
|
-
@sec-test scope https://staging.example.com
|
|
93
|
-
@sec-test pentest
|
|
94
|
-
|
|
95
|
-
# Weekly posture digest
|
|
96
|
-
@sec-test report
|
|
70
|
+
```
|
|
71
|
+
/compose "Build auth service with JWT, rate limiting & Sec-Test"
|
|
72
|
+
[A] Security Architect → threat model ┐ parallel
|
|
73
|
+
[B] Builder → implementation ├ wave
|
|
74
|
+
[C] AppSec Engineer → real-time SAST audit │
|
|
75
|
+
[D] Quality Engineer → mutation tests ┘
|
|
97
76
|
```
|
|
98
77
|
|
|
99
|
-
|
|
78
|
+
### Goal Judge
|
|
79
|
+
Declare outcomes, not tasks. An independent judge model verifies stop-conditions — the builder never self-approves.
|
|
100
80
|
|
|
101
|
-
|
|
81
|
+
```
|
|
82
|
+
/goal "All tests pass with >80% coverage and zero HIGH/CVEs"
|
|
83
|
+
```
|
|
102
84
|
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
subagents (33 workflow agents), and produces structured artifacts as it goes:
|
|
85
|
+
### Business Suite
|
|
86
|
+
Production-grade office tooling as skills: `xlsx-official`, `docx-official`, `pptx-official`, `pdf-official`, `deep-research`, `super-research`, `research-paper-writing`, `html-to-video-pipeline`, `sales`.
|
|
106
87
|
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
```
|
|
88
|
+
### Compliance-First Scraper
|
|
89
|
+
`/scraper <url> <what to extract>` — robots.txt honored, ToS checked, crawl-delays enforced, escalation ladder from static fetch to authenticated sessions.
|
|
110
90
|
|
|
111
|
-
|
|
112
|
-
and verification against acceptance criteria — with commit hygiene built in. `compose`
|
|
113
|
-
also runs the GSD workflow system for milestone-driven development (`.planning/` project
|
|
114
|
-
state, phases, cross-agent audits).
|
|
91
|
+
## Install
|
|
115
92
|
|
|
116
|
-
|
|
93
|
+
```bash
|
|
94
|
+
# Recommended
|
|
95
|
+
npm install -g codo-ai
|
|
117
96
|
|
|
118
|
-
|
|
97
|
+
# One-time run
|
|
98
|
+
npx codo-ai
|
|
99
|
+
```
|
|
119
100
|
|
|
120
|
-
|
|
121
|
-
(`codo web`) and an optional Electron desktop shell.
|
|
122
|
-
- **Persistent sessions** — durable session inputs, crash-safe resume, and process-local
|
|
123
|
-
execution orchestration with EventV2 replay.
|
|
124
|
-
- **Every major model provider** — OpenAI, Anthropic, Google, Bedrock, Azure, Groq,
|
|
125
|
-
Mistral, xAI, OpenRouter, and more via the AI SDK gateway, plus OAuth sign-in.
|
|
126
|
-
- **Plugins** — a typed plugin API for extending the agent, tools, and skills.
|
|
127
|
-
- **Generated SDK** — the HTTP API is spec-first, with a JS/TS SDK generated from the
|
|
128
|
-
OpenAPI schema.
|
|
101
|
+
Requirements: Node 18+ or Bun · macOS / Linux / Windows · any provider API key (Anthropic, OpenAI, NVIDIA free tier, Google, or OpenAI-compatible).
|
|
129
102
|
|
|
130
|
-
|
|
103
|
+
> Migrating from `@codo-ai/cli`? That package is deprecated — `codo-ai` replaces it.
|
|
131
104
|
|
|
132
|
-
##
|
|
105
|
+
## Documentation
|
|
133
106
|
|
|
134
|
-
|
|
135
|
-
- ARM64 (Apple Silicon / AArch64 Linux / Windows on ARM) supported natively
|
|
107
|
+
Full developer docs — every persona, skill, workflow, permission mode, and best practice — live at **[codo-ai.vercel.app](https://codo-ai.vercel.app/)**.
|
|
136
108
|
|
|
137
|
-
##
|
|
109
|
+
## Contributing
|
|
138
110
|
|
|
139
|
-
|
|
140
|
-
OpenCode license text is preserved at [`LICENSES/OPENCODE-LICENSE.txt`](LICENSES/OPENCODE-LICENSE.txt).
|
|
111
|
+
PRs welcome on [GitHub](https://github.com/Mosalah4351/COdo). Default branch: `dev`. Conventional commits.
|
|
141
112
|
|
|
142
|
-
##
|
|
113
|
+
## License
|
|
143
114
|
|
|
144
|
-
|
|
145
|
-
- **Discussions** → <https://github.com/Mosalah4351/COdo/discussions>
|
|
146
|
-
- **Docs** → <https://codo.run/docs>
|
|
115
|
+
MIT © [Mohamed Salah](https://www.linkedin.com/in/mohamed-salah-59bb41300/)
|
|
147
116
|
|
|
148
|
-
|
|
149
|
-
`security@codo.run` with a proof-of-concept.
|
|
117
|
+
Built on [OpenCode](https://github.com/anomalyco/opencode).
|
package/package.json
CHANGED
|
@@ -1,34 +1,53 @@
|
|
|
1
|
-
{
|
|
2
|
-
"
|
|
3
|
-
|
|
4
|
-
|
|
5
|
-
|
|
6
|
-
|
|
7
|
-
|
|
8
|
-
|
|
9
|
-
"
|
|
10
|
-
|
|
11
|
-
|
|
12
|
-
"
|
|
13
|
-
"
|
|
14
|
-
|
|
15
|
-
|
|
16
|
-
"
|
|
17
|
-
|
|
18
|
-
|
|
19
|
-
|
|
20
|
-
|
|
21
|
-
|
|
22
|
-
|
|
23
|
-
|
|
24
|
-
"
|
|
25
|
-
"
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
"
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
1
|
+
{
|
|
2
|
+
"name": "codo-ai",
|
|
3
|
+
"version": "2.23.10",
|
|
4
|
+
"description": "The security-native AI coding agent. Six Sec-Test security personas, compliance-first /scraper, a business documents & research suite, and multi-agent Compose orchestration — spec-driven workflow engines in one terminal-first CLI.",
|
|
5
|
+
"keywords": [
|
|
6
|
+
"ai",
|
|
7
|
+
"coding-agent",
|
|
8
|
+
"cli",
|
|
9
|
+
"terminal",
|
|
10
|
+
"tui",
|
|
11
|
+
"llm",
|
|
12
|
+
"security",
|
|
13
|
+
"sast",
|
|
14
|
+
"appsec",
|
|
15
|
+
"devsecops",
|
|
16
|
+
"threat-modeling",
|
|
17
|
+
"pentest",
|
|
18
|
+
"spec-driven",
|
|
19
|
+
"multi-agent",
|
|
20
|
+
"opencode"
|
|
21
|
+
],
|
|
22
|
+
"homepage": "https://codo-ai.vercel.app/",
|
|
23
|
+
"repository": {
|
|
24
|
+
"type": "git",
|
|
25
|
+
"url": "git+https://github.com/Mosalah4351/COdo.git"
|
|
26
|
+
},
|
|
27
|
+
"bugs": {
|
|
28
|
+
"url": "https://github.com/Mosalah4351/COdo/issues"
|
|
29
|
+
},
|
|
30
|
+
"license": "MIT",
|
|
31
|
+
"os": ["darwin", "linux", "win32"],
|
|
32
|
+
"cpu": ["arm64", "x64"],
|
|
33
|
+
"bin": {
|
|
34
|
+
"codo": "./bin/codo.exe"
|
|
35
|
+
},
|
|
36
|
+
"scripts": {
|
|
37
|
+
"postinstall": "node ./postinstall.mjs"
|
|
38
|
+
},
|
|
39
|
+
"optionalDependencies": {
|
|
40
|
+
"@codo-ai/codo-windows-x64": "2.23.7",
|
|
41
|
+
"@codo-ai/codo-windows-x64-baseline": "2.23.7",
|
|
42
|
+
"@codo-ai/codo-windows-arm64": "2.23.7",
|
|
43
|
+
"@codo-ai/codo-linux-x64": "2.23.7",
|
|
44
|
+
"@codo-ai/codo-linux-x64-baseline": "2.23.7",
|
|
45
|
+
"@codo-ai/codo-linux-arm64": "2.23.7",
|
|
46
|
+
"@codo-ai/codo-linux-x64-musl": "2.23.7",
|
|
47
|
+
"@codo-ai/codo-linux-x64-baseline-musl": "2.23.7",
|
|
48
|
+
"@codo-ai/codo-linux-arm64-musl": "2.23.7",
|
|
49
|
+
"@codo-ai/codo-darwin-x64": "2.23.7",
|
|
50
|
+
"@codo-ai/codo-darwin-x64-baseline": "2.23.7",
|
|
51
|
+
"@codo-ai/codo-darwin-arm64": "2.23.7"
|
|
52
|
+
}
|
|
53
|
+
}
|
package/codo-ai-2.23.5.tgz
DELETED
|
Binary file
|