
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@colmbyrne/specflow
Advanced tools
Specs that enforce themselves. Contract tests, journey hooks, and agent orchestration for LLM-driven development.
Specs that enforce themselves.
LLMs drift. You write a rule; three iterations later the model "helpfully" ignores it. Specflow turns your specs into contract tests that break the build when violated — so drift can't ship.
// Your spec: "Service workers MUST NOT use localStorage"
// LLM adds this anyway after iteration 3:
const token = localStorage.getItem('auth') // No crash. Just drift.
LLMs don't read. They attend. Your spec competes with millions of training examples. You can't fix this with better prompts. You need a gate.
Contract tests scan your source code for forbidden patterns. Break a rule → build fails. Journey tests run Playwright against your critical flows. If a journey doesn't pass, the feature isn't done.
npx @colmbyrne/specflow init .
Creates CLAUDE.md, contracts, hooks, agents, and tests. Then fill in the Project Context section in CLAUDE.md (Repository, Board, CLI, Tech Stack).
npx @colmbyrne/specflow init . # Set up Specflow (safe to re-run)
npx @colmbyrne/specflow verify # Check installation (13 sections)
npx @colmbyrne/specflow update . --ci # Update hooks + install CI workflows
npx @colmbyrne/specflow audit 500 # Audit issue #500 for compliance
npx @colmbyrne/specflow graph # Validate contract cross-references
| Layer | What it does |
|---|---|
| Contract tests | YAML rules scan source for forbidden patterns — break a rule, build fails |
| Journey tests | Playwright tests for critical user flows — if a journey doesn't pass, the feature isn't done |
| Hooks | Auto-trigger tests on build/commit, catch violations on Write/Edit, reject commits without issue numbers |
| CI workflows | PR compliance gate + post-merge audit — no contract violations merge to main |
| 30+ agents | Orchestrate wave execution, write contracts, audit boards, simulate specs |
Isn't this just more testing? No. Tests verify behaviour. Contracts verify architecture. "No localStorage in service workers" survives any refactor.
What if I don't have a perfect spec? Start with "document what works today." Your first contract can be: whatever we're doing now, don't break it.
Can LLMs actually follow contracts? Even if they don't, tests catch it. You don't need the LLM to behave. You need it to be checkable.
| Detailed Setup | Manual paths, updating, SKILL.md |
| Agent Library | 30+ agents for wave execution |
| Contract Schema | YAML format for contracts |
| CI Integration | GitHub Actions setup |
| npm | @colmbyrne/specflow |
| Issues | Bugs and ideas |
FAQs
Specs that enforce themselves. Contract tests, journey hooks, and agent orchestration for LLM-driven development.
The npm package @colmbyrne/specflow receives a total of 11 weekly downloads. As such, @colmbyrne/specflow popularity was classified as not popular.
We found that @colmbyrne/specflow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.