
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
@cjhyy/code-shell-capability-coding
Advanced tools
Coding capability pack for the generic code-shell agent core.
Optional coding capability pack for @cjhyy/code-shell-core. It owns
CodeShell's coding policy and implementations: the terminal-coding preset,
coding prompt, Git/worktree behavior, LSP, ApplyPatch, NotebookEdit,
review/quota helpers, and external coding-agent adapters.
The package is deliberately separate from core. A service building a customer support, data, or media agent can install core without pulling a coding preset into its default runtime. The TUI and Desktop applications install this pack at their composition roots.
import { Engine } from "@cjhyy/code-shell-core";
import { CODING_CAPABILITY } from "@cjhyy/code-shell-capability-coding/capability";
const engine = new Engine({
llm: {
provider: "anthropic",
model: "claude-sonnet-4-6",
apiKey: process.env.ANTHROPIC_API_KEY!,
},
capabilities: [CODING_CAPABILITY],
});
// No preset is required: this capability contributes terminal-coding as its
// product default. Passing preset: "general" remains supported.
const result = await engine.run("Inspect this repository and fix the failing test.");
console.log(result.text);
For a process composition root, registerCapability(CODING_CAPABILITY) installs
the same pack for subsequently created Engines and RunManagers. Prefer the
per-Engine capabilities field in reusable libraries and tests.
The package root remains compatible with existing consumers. New hosts should prefer the smallest stable entry that matches their responsibility:
| Entry | Responsibility |
|---|---|
/capability | CODING_CAPABILITY, contributed tools, and coding presets |
/git | Git, worktree, project-root, and review-prompt helpers |
/orchestration | Claude Code/Codex discovery, transcripts, drivers, quota, and external-agent config |
import { createWorktree, resolveProjectRoot } from "@cjhyy/code-shell-capability-coding/git";
import { probeClaudeCli } from "@cjhyy/code-shell-capability-coding/orchestration";
These are subpaths of the same npm package, not independently versioned
packages. LSP, ApplyPatch, NotebookEdit, and other compatibility exports remain
available from the root. The legacy briefTool formatter is also retained as a
root compatibility export, but it is no longer registered with the default
coding preset: user-facing Markdown should be returned as normal assistant text.
MIT. ApplyPatch carries its upstream Apache-2.0 notice in
src/tools/apply-patch/NOTICE.md and LICENSE-codex.
FAQs
Coding capability pack for the generic code-shell agent core.
We found that @cjhyy/code-shell-capability-coding demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.