
Security News
Socket Releases Free Certified Patches for Critical vm2 Sandbox Escape
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.
@herbcaudill/ralph
Advanced tools
Autonomous AI session engine that wraps the Claude CLI to run iterative development workflows. Spawns Claude CLI processes with a custom prompt, captures streaming JSON output, displays it in a formatted terminal UI using Ink, and orchestrates multiple sessions.
npm install -g @herbcaudill/ralph
# Initialize ralph in your project
ralph init
# Run autonomous sessions
ralph
ralph [sessions] Run N autonomous sessions (default: auto-calculated)
ralph init Set up .ralph/ directory with workflow config
ralph --replay Replay events from the most recent log file
ralph --replay <f> Replay events from a specific file
| Flag | Description |
|---|---|
--watch, -w | After completing all tasks, watch for new beads issues |
--json, -j | Output events as JSON (machine-readable mode) |
--agent <name>, -a | Agent to use: claude (default) or codex |
--replay [file] | Replay events from a log file |
By default, Ralph runs ceil(openIssues * 1.2) sessions, bounded between 10 and 100. Pass a number to override: ralph 5.
.ralph/workflow.prompt.md to build the session instructions--output-format stream-jsonbd ready, claims one, completes it, and closes it.ralph/events-*.jsonl| Key | Action |
|---|---|
Escape | Send a message to the agent |
Ctrl+T | Add a todo item |
Ctrl+S | Stop after current session |
Ctrl+P | Pause/resume |
{ "type": "message", "text": "your message" }
{ "type": "stop" }
{ "type": "pause" }
{ "type": "resume" }
After ralph init, customize .ralph/workflow.prompt.md with your repo's build commands, test commands, and task prioritization rules.
.ralph/workflow.prompt.md) - Repo-specific build/test commands and workflow rules| Variable | Description |
|---|---|
ANTHROPIC_API_KEY | Required for the Claude agent |
OPENAI_API_KEY | Optional for the Codex agent |
RALPH_DEBUG | Enable debug logging (1, or namespace like messagequeue,session) |
RALPH_CWD | Override base path for relative path rendering |
RALPH_DEBUG=1 ralph # all debug output
RALPH_DEBUG=messagequeue ralph # specific namespace
RALPH_DEBUG=messagequeue,session ralph # multiple namespaces
FAQs
Autonomous AI session engine for Claude CLI
The npm package @herbcaudill/ralph receives a total of 6 weekly downloads. As such, @herbcaudill/ralph popularity was classified as not popular.
We found that @herbcaudill/ralph demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A critical vm2 sandbox escape can allow untrusted JavaScript to break isolation and execute commands on the host Node.js process.

Research
Five malicious NuGet packages impersonate Chinese .NET libraries to deploy a stealer targeting browser credentials, crypto wallets, SSH keys, and local files.

Security News
pnpm 11 turns on a 1-day Minimum Release Age and blocks exotic subdeps by default, adding safeguards against fast-moving supply chain attacks.