
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@handsupmin/shift-ax
Advanced tools
Agentic software delivery platform for teams that are not AX experts yet
Agentic software delivery for teams that want guardrails, not prompt rituals.
Default language: English
한국어 문서: README.ko.md
Shift AX turns a raw development request into a document-aware, review-gated workflow that ends at a meaningful local git commit.
It also supports a platform-specific conversational shell:
ax --codexax --claude-codeshift-ax --codexshift-ax --claude-codeOn first run, if onboarding artifacts are missing, Shift AX asks for language first and then runs guided onboarding automatically before opening the platform session.
Shift AX adds a control plane on top of existing coding-agent runtimes so teams can:
Implemented in v1: request-to-commit.
That means Shift AX currently covers:
Out of v1: GitHub push / PR automation in the core flow.
core/: shared Shift AX workflow logicplatform/: platform-specific runtime codeadapters/: bridges from core to platform surfacesscripts/: operator-facing CLI entrypointsdocs/vision.md: product directiondocs/architecture/shift-ax-architecture.md: architecture goals, differentiators, and adopted concepts by layerdocs/setup/llm-install-and-bootstrap.md: machine-oriented install and bootstrap guide for LLM agentsdocs/architecture/initial-repo-structure.md: structure and ownership boundariesGlobal install from npm:
npm install -g @handsupmin/shift-ax
One-command install:
curl -fsSL https://raw.githubusercontent.com/handsupmin/shift-ax/main/scripts/install-global.sh | bash
After install:
ax --codex
# or
ax --claude-code
From a source checkout:
npm install
npm test
npm run build
npm run ax -- doctor
Conversational shell mode:
ax --codex
# or
ax --claude-code
On first run, Shift AX asks for language first and then runs guided onboarding automatically if the repo is not yet onboarded.
Inside the shell, the agent should accept product-shell commands such as:
/onboard or $onboard/doctor or $doctor/request <text> or $request <text>/status/topics/resume <topic>/review <topic>Interactive mode:
npm run ax -- onboard-context
File-driven mode:
npm run ax -- onboard-context --input ./onboarding.json
Discovery-assisted mode:
npm run ax -- onboard-context --discover
This writes or discovers tracked docs under docs/base-context/, regenerates docs/base-context/index.md, creates docs/base-context/domain-glossary.md, and stores shared engineering defaults in .ax/project-profile.json.
npm run ax -- run-request --request "Build safer auth refresh flow"
This creates:
.ax/topics/<topic-slug>/.ax/worktrees/<topic-slug>/execution-handoff.json, workflow-state, review, and finalization artifactsBy default, Shift AX now interviews for planning details before it writes the planning artifacts. The pipeline then pauses at the human plan-review gate.
npm run ax -- approve-plan \
--topic .ax/topics/<topic-slug> \
--reviewer "Alex" \
--decision approve
If the approved plan says shared domain or policy docs must be updated first, record that before implementation resumes:
npm run ax -- sync-policy-context \
--topic .ax/topics/<topic-slug> \
--summary "Updated shared auth policy docs before implementation" \
--path docs/base-context/auth-policy.md
Then resume:
npm run ax -- run-request \
--topic .ax/topics/<topic-slug> \
--resume \
--verify-command "npm test" \
--verify-command "npm run build"
When the review gates pass, Shift AX now auto-generates a Lore-compatible commit message and creates the local commit automatically by default.
Artifacts include:
.ax/topics/<topic-slug>/final/commit-message.md.ax/topics/<topic-slug>/execution-handoff.jsonUse --no-auto-commit only if a human explicitly wants to hold the final commit step:
npm run ax -- run-request \
--topic .ax/topics/<topic-slug> \
--resume \
--no-auto-commit
npm run ax -- launch-execution \
--platform codex \
--topic .ax/topics/<topic-slug> \
--dry-run
This reads execution-handoff.json, writes per-task execution prompts, and returns the concrete Codex / Claude / tmux launch commands for the planned slices.
npm run ax -- topic-status --topic .ax/topics/<topic-slug>
Even after plan approval, Shift AX must stop and request human review if any of these appear:
Persist that stop in workflow state with:
npm run ax -- run-request \
--topic .ax/topics/<topic-slug> \
--resume \
--escalation policy-conflict:"Auth policy conflicts with the proposed flow"
Resume only after human review clears the stop:
npm run ax -- run-request \
--topic .ax/topics/<topic-slug> \
--resume \
--clear-escalations \
--escalation-resolution "Reviewer approved the updated approach"
Supported escalation kinds:
new-user-flowpolicy-conflictrisky-data-or-permission-changeShift AX currently ships five required review lanes:
The aggregate review gate is written to:
.ax/topics/<topic-slug>/review/aggregate.json.ax/topics/<topic-slug>/review/summary.mdShift AX is intentionally opinionated:
The goal is simple: a team that is new to AX should still be able to use the system safely.
FAQs
Agentic software delivery platform for teams that are not AX experts yet
The npm package @handsupmin/shift-ax receives a total of 0 weekly downloads. As such, @handsupmin/shift-ax popularity was classified as not popular.
We found that @handsupmin/shift-ax demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.