
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
@every-env/cli
Advanced tools
Tools for AI-powered development that get smarter with every use. Make each unit of engineering work easier than the last.
Compounding engineering: Each unit of engineering work should make subsequent units of work easier—not harder.
Every-Env embodies this principle through a simple, repeatable process that ensures your development workflow continuously improves. Every-env is how we build software at Every.
graph LR
A[Plan<br/>Plan it out<br/>in detail] --> B[Delegate<br/>Do the work]
B --> C[Assess<br/>Make sure<br/>it works]
C --> D[Codify<br/>Record<br/>learnings]
D --> A
style A fill:#f9f,stroke:#333,stroke-width:2px
style B fill:#bbf,stroke:#333,stroke-width:2px
style C fill:#bfb,stroke:#333,stroke-width:2px
style D fill:#ffb,stroke:#333,stroke-width:2px
Plan → Plan out a feature or bug fix in detail
Delegate → Do the work
Assess → Make sure it works as expected
Codify → Record learnings for next time
Every-Env is opinionated about the process (Plan → Delegate → Assess → Codify) but works with whatever tools you already use:
The four-step process works regardless of your toolchain. Every-Env provides the structure; you bring the tools.
npm install -g @anthropic-ai/claude-codeclaude --version# Global (recommended)
npm install -g @every-env/cli
# Project-specific
npm install --save-dev @every-env/cli
# Core initialization
every init # Initialize every in your project
# The Four Steps of Compounding Engineering
every plan <task|patterns...> # Step 1: PLAN - Create detailed implementation plans
every work [target] # Step 2: DELEGATE - Execute with AI assistance on a target
every review [target] # Step 3: ASSESS - Verify work meets requirements
every codify [target] # Step 4: CODIFY - Record learnings permanently
# Supporting commands
every research <task> # Research implementations across GitHub repos
every copy-commands # Copy Claude Code workflow templates to your project
every request-review [target] --from <@u> # Get team feedback during assessment
every revise [target] [feedback] # Iterate on plans based on feedback
# Documentation workflow
every docs update # Update documentation
every docs run <pattern> # Run specific documentation patterns
every docs list # List available patterns
every docs status # Check documentation status
-c, --config <path> - Config file (default: .docs-config.json)--dry-run - Preview without executing-v, --verbose - Verbose output--debug - Debug output-a, --agent-cli <name> - Override agent: claude, copy-clipboard, amp, codex, or custom--copy-clipboard - Shorthand for --agent-cli copy-clipboardplans/2025-07-24-auth-plan.md.every-env/state.json--github <number>every plan "add user authentication" # Default (Claude)
every plan "add user authentication" --copy-clipboard
every work plans/auth.md --agent-cli codex
init CommandInitialize every in your project:
every init # Interactive setup
every init --yes # Non-interactive defaults
every init --default-agent amp # Set default agent
every init --project-type node # Override detected type
Creates:
.every-env/config.json - Runtime configurationevery docs update # Update all documentation
every docs update --pattern api # Update specific pattern
every docs run api-docs # Run single pattern
every docs list # List available patterns
every docs status # Check generation status
every plan [patterns...]Generate AI-powered implementation plans:
every plan --list # List patterns
every plan implementation-plan # Single plan
every plan implementation-plan work-breakdown technical-design
Built-in patterns:
implementation-plan - Full implementation plan with phaseswork-breakdown - Task decomposition with estimatestechnical-design - Architecture and specificationsOptions:
-o, --output <path> - Output directory (default: "plans")--timeline - Include timeline (default: true)--resources - Include estimates (default: true)every review [target]Review plans and PRs:
every review # Latest plan
every review plans/auth.md # Specific plan
every review --github 1234 # GitHub PR/issue
every research <task>Analyze GitHub repos for implementation patterns:
every research "modal in react"
every research "auth flow" --depth deep
every research "webpack optimization" --output ./research
Options:
--depth - quick, standard, or deep-o, --output - Output directory (default: research/)Output: Timestamped markdown reports with best practices, code examples, and recommendations.
every request-review & every revise# Request review
every request-review plans/auth.md --from @teammate
every request-review --github 444 --from @alice,@bob
# Revise based on feedback
every revise # Use embedded comments
every revise plans/auth.md "make it simpler"
every revise --github 444 # From PR comments
every work [target]Start development with AI assistance:
every work # Latest plan
every work plans/auth.md # Specific plan
every work --github 1234 # From GitHub issue
every work plans/auth.md --context docs/API.md
Launches AI with plan context and project information.
every codify [target]Capture learnings and update project knowledge:
every codify # From recent work
every codify plans/auth.md # Specific plan
every codify --insight "always validate client-side"
Updates CLAUDE.md and creates migration records in .every-env/migrations/.
every copy-commandsevery copy-commands # Copy Claude workflow templates
Tracks workflow in .every-env/state.json:
JSON-based configuration in .docs-config.json:
{
"defaultCommand": "claude",
"parallelism": { "maxAgents": 5 },
"patterns": [
{
"name": "api",
"match": {
"files": ["app/controllers/**/*.rb"],
"exclude": ["**/*_test.rb"]
},
"agents": [
{
"id": "api-docs",
"promptFile": "prompts/api.md",
"output": "docs/api.md"
}
]
}
]
}
Essential tools are automatically included:
Read, Write, Edit, MultiEditGlob, Grep, LSAdd extra tools as needed:
{
"defaultAllowedTools": ["WebSearch", "Bash(git log:*)", "Bash(npm list:*)"]
}
{
"patterns": [
{
"name": "dependencies",
"match": {
"files": ["package.json"],
"content": {
"regex": "\"([^\"]+)\": \"[^\"]+\"",
"captureGroup": 1
}
},
"agents": [
{
"outputPattern": "docs/deps/{name}.md",
"forEach": "match"
}
]
}
]
}
Built-in: projectName, timestamp, date, gitBranch, gitCommit, output, name, index, total
Custom:
{
"variables": {
"company": "Acme Corp",
"framework": "Rails"
}
}
Use in prompts: {{ company }} - {{ framework }}
# Step 1: PLAN
every plan "add user authentication"
# Step 2: DELEGATE
every work
# Step 3: ASSESS
every review
every request-review --from @teammate
# Step 4: CODIFY
every codify
# Rails
every init --template rails
every docs update
every plan "add admin dashboard"
# Node.js
every init --template node
every docs run dependencies
every plan "add rate limiting"
EVERY_ENV_STATE_DIR - State directoryEVERY_ENV_CONFIG - Config file path# Setup
git clone https://github.com/every-env/every-env.git
npm install
# Development
npm run dev # Watch mode
npm test # Run tests
npm run build # Build
# Local testing
node dist/cli.js [command]
# Or
npm link
every [command]
Contributions are welcome! Please read our Contributing Guide for details.
MIT © Every Env
FAQs
Multi-agent orchestrator for AI-powered development workflows
The npm package @every-env/cli receives a total of 1 weekly downloads. As such, @every-env/cli popularity was classified as not popular.
We found that @every-env/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.