
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@codeledger/cli
Advanced tools
Official ContextECF CodeLedger CLI wrapper. Installs the hardened binary from GitHub Releases; zero engine code ships in this package.
Deterministic, bounded context selection for AI coding agents. Published by Intelligent Context AI, Inc..
@codeledger/cliInstalling ContextECF CodeLedger? Make sure you use the scope:
npm install -g @codeledger/cli. There is an unrelated unscopedcodeledgerpackage on npm by a different author. The real ContextECF CodeLedger package is published under the@codeledgerscope.
npm install -g @codeledger/cli@latest
cd your-repo
codeledger ready
This package is a thin npm wrapper. When you install it, the
postinstall step downloads the platform-specific hardened binary from
the matching GitHub Release, verifies its SHA256 against
SHA256SUMS-v<version>.txt, and caches it under
~/.cache/codeledger/bin/.
Installation downloads and verifies the binary only. It does not rewrite repo
hooks, vendored runtimes, or ambient setup by default. After install, run
cd your-repo && codeledger ready. Existing repos can opt into the ambient
refresh step with codeledger upgrade, or by setting CODELEDGER_RUN_UPGRADE=1
during installation.
No engine code, scoring logic, or formulas ship to npm. The wrapper is ~30 KB of plain JavaScript that fetches, verifies, and launches the real CodeLedger binary.
darwin-arm64 (Apple Silicon macOS)linux-x64Intel Mac (darwin-x64): deferred in v0.10.6 — no working Intel Mac runner was available on the release CI plan at the time of the release. Intel Mac users can build from source or wait for the runner situation to stabilize in a later release.
Other platforms fall through postinstall softly — npm install
succeeds, but running codeledger will either use a repo-local vendored
runtime if the current repo has .codeledger/bin/, or print a clear
recovery message pointing at the manual download page.
After installing, start inside a repo with codeledger ready. It initializes
CodeLedger if needed, scans the repo, vendors the browser/cloud runtime, and
prints the ambient task-context status.
codeledger ready
codeledger ready --task "your task here"
codeledger scan
codeledger help
If you installed an earlier CodeLedger version and codeledger vendor
cannot find the standalone runtime, upgrade first and rerun the command:
npm install -g @codeledger/cli@latest
codeledger ready
codeledger vendor
All arguments, environment variables, stdin, and exit codes pass straight through to the hardened binary.
If the global hardened binary is missing but the repo already has a vendored runtime, the npm shim automatically falls back to:
./.codeledger/bin/codeledger <command>
This keeps existing repos usable after a skipped postinstall, air-gapped install, or unsupported global platform.
When you run a globally installed codeledger inside a repo that has a
repo-local CodeLedger (.codeledger/bin/), the CLI detects whether the
running version differs from the repo-local version. If it does:
This prevents a stale global install from silently producing different results than the repo-local CLI. To avoid the delegation overhead, invoke the repo-local wrapper directly:
./.codeledger/bin/codeledger <command>
| Variable | Purpose |
|---|---|
CODELEDGER_SKIP_POSTINSTALL=1 | Skip the binary download during npm install. Useful for air-gapped environments. You are responsible for placing the binary at the expected cache path afterwards. |
CODELEDGER_RUN_UPGRADE=1 | After a successful binary download, also run codeledger upgrade. This is opt-in because upgrade may refresh repo-local wrappers, hooks, and ambient setup. |
CODELEDGER_BINARY_URL=<url> | Override the download base URL. Use this to fetch the binary from a corporate mirror or internal CDN. The URL must serve the same filenames as the GitHub Release, plus a SHA256SUMS-v<version>.txt sibling. |
CODELEDGER_CACHE_DIR=<path> | Override the cache directory (default ~/.cache/codeledger/bin). |
CODELEDGER_SKIP_POSTINSTALL=1 npm install -g @codeledger/cli@latest
# then place the hardened binary at:
# ~/.cache/codeledger/bin/codeledger-hardened-v<version>
# and chmod +x it.
# If this repo is already initialized, use the committed vendored runtime:
./.codeledger/bin/codeledger ready
Download the binary + SHA256SUMS from the GitHub Release matching the
installed version:
https://github.com/codeledgerECF/codeledger/releases
If postinstall was skipped (e.g. npm install --ignore-scripts),
recover with any of:
npm install -g @codeledger/cli@latest
# or retry the current install
npm rebuild @codeledger/cli
# or
node $(npm root -g)/@codeledger/cli/scripts/postinstall.js
# or download the binary manually from the release page and chmod +x it
The npm wrapper is MIT licensed; see LICENSE.
The downloaded CodeLedger hardened binary is governed by the CodeLedger Core
Engine License; see LICENSE-CORE. NOTICE describes the wrapper/binary split.
Source code lives at https://github.com/codeledgerECF/codeledger. The hardened binary shipped with this wrapper is published through the same public GitHub Releases channel used by the installer.
FAQs
Official ContextECF CodeLedger CLI wrapper. Installs the hardened binary from GitHub Releases; zero engine code ships in this package.
We found that @codeledger/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.