
Security News
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.
@master0071/loop-md-cli
Advanced tools
从单一源生成多平台 AI 编码 agent/command 配置的脚手架(Code-Loop / Test-Loop / Writing-Loop / Ralph-Loop)。
Scaffold multi-platform AI coding agent/command configs from a single source. Write templates once, deploy everywhere.
中文 | English
npx @master0071/loop-md-cli --list # sanity check — you should see 7 platforms
npx @master0071/loop-md-cli --all # default ralph paradigm, emits .claude/ .opencode/ etc.
npx @master0071/loop-md-cli --validate --all # exit code 0 means every platform matches its templates
Requires Node.js >= 18, zero runtime dependencies.
loop-md-cli --all # all platforms
loop-md-cli --claude --opencode # specific platforms
loop-md-cli --claude --domain coding # specific domain
loop-md-cli --all --dry-run # dry run, writes nothing
loop-md-cli --validate --all # validate consistency
loop-md-cli --watch --claude # watch for file changes
loop-md-cli --incremental --all # only rewrite changed files
loop-md-cli --archive configs.zip --all # export as ZIP
loop-md-cli --trae --domain coding \ # per-role sub-agent models
--model-orchestrator "DeepSeek-V4-Pro" \
--model-executor "DeepSeek-V4-Flash" \
--model-reviewer "Doubao_1_6"
The 7 AI coding platforms each use a different agent config format; maintaining them by hand is repetitive and error-prone:
| Platform | Output dir | frontmatter signature | tool name format |
|---|---|---|---|
| Claude Code | .claude/ | name + description + tools | PascalCase |
| OpenCode | .opencode/ | description + mode + steps + permission | snake_case |
| Kilo Code | .kilo/ | same as OpenCode | snake_case |
| Trae IDE | .trae/ | name + description + tools | lower + camelCase |
| CodeBuddy | .codebuddy/ | name + description + model:inherit + tools + permissionMode | PascalCase |
| Qwen Code | .qwen/ | name + description + model + tools + disallowedTools + approvalMode | PascalCase |
| Qoder | .qoder/ | same as Claude | PascalCase |
Every platform supports per-role sub-agent models via
--model-orchestrator/executor/reviewer. When omitted, sub-agents inherit the main session model.
loop-md-cli solves this with a three-layer abstraction: templates + domains + renderers.
Four built-in domains, each with dedicated templates enforcing its own engineering discipline:
| Domain | Agent names | Command | Discipline |
|---|---|---|---|
ralph | ralph-orchestrator / worker / reviewer | ralph-loop | Kernel paradigm: TaskList-driven + backpressure breaker (most general; fallback for custom domains without dedicated templates) |
coding | coding-orchestrator / builder / reviewer | coding-loop | scope discipline + root-cause grouped fixes + zero tolerance for scope drift |
testing | test-orchestrator / writer / coverage-reviewer | test-loop | source freeze + three signals (coverage ≥ 80% / mutation ≥ 60% / empty-assertion = 0) |
writing | writing-orchestrator / author / reviewer | writing-loop | writing boundary + three signals (terminology drift / dead links / code examples) |
loop-md-cli --opencode --domain coding
loop-md-cli --opencode --domain testing --dry-run
ralphis the kernel paradigm;coding/testing/writingare domain specializations built on ralph. Backpressure is a general kernel capability:coding/testinguse a strong gate (npm test),writinguses a weak gate (npm run lint).
Pass custom JSON via --domain-file, or drop it in .opencode/domains/<id>.json for auto-discovery:
loop-md-cli --opencode --domain-file ./my-domain.json
loop-md-cli --claude --domain my-domain # auto-scans .opencode/domains/
The JSON requires engine: { type: "loop" }, and each command must specify kind: "entry" and agent.
Templates load from two locations (same name overrides): built-in src/templates/ and user-defined .opencode/templates/.
When rendering <domain>-<role>, lookup proceeds in order:
<domain>-<role>.md (e.g. my-domain-orchestrator.md) — domain-specificralph-<role>.md — the most general kernel paradigmA custom domain always runs (falling back to ralph); domain specialization requires dedicated templates.
---
name: { { name } }
description: { { description } }
mode: subagent
temperature: 0.2
steps: 30
permission:
edit: allow
bash:
"*": allow
---
## Role
You are **{{name}}**, the Loop executor agent.
| Placeholder | Source | Applies to |
|---|---|---|
{{name}} | agent/command name from the domain definition | agent |
{{description}} | description from the domain definition | agent + command |
{{agent}} | orchestrator name the loop binds to | command |
{{backpressure}} | the domain's backpressure breaker config | orchestrator |
| Domain | Template files | Discipline |
|---|---|---|
ralph | ralph-orchestrator.md / ralph-worker.md / ralph-reviewer.md / ralph-loop.md | TaskList + backpressure |
coding | coding-orchestrator.md / coding-executor.md / coding-reviewer.md / coding-loop.md | scope + root-cause |
testing | testing-orchestrator.md / testing-executor.md / testing-reviewer.md / testing-loop.md | source freeze + signals |
writing | writing-orchestrator.md / writing-executor.md / writing-reviewer.md / writing-loop.md | writing boundary |
| Platform | CLI flag | Output dir | Renderer family |
|---|---|---|---|
| Claude Code | --claude | .claude/ | named |
| Qoder | --qoder | .qoder/ | named |
| Qwen Code | --qwen | .qwen/ | qwen |
| OpenCode | --opencode | .opencode/ | mode |
| Kilo Code | --kilo | .kilo/ | mode |
| CodeBuddy | --codebuddy | .codebuddy/ | codebuddy |
| Trae IDE | --trae | .trae/ | trae |
The same ralph domain template produces different frontmatter per renderer family. The following are real outputs of loop-md-cli --all (lightly trimmed for brevity).
named family (Claude Code / Qoder) — .claude/agents/ralph-reviewer.md:
---
name: ralph-reviewer
description: Ralph Loop reviewer. Read-only quality gate emitting machine-routable verdict/issues.
tools: Read, Grep, Glob, Bash
---
mode family (OpenCode / Kilo) — .opencode/agents/ralph-orchestrator.md (trimmed):
---
description: Ralph Loop orchestrator. Maintains the task list, delegates to executor/reviewer, stops on gate decisions.
mode: subagent
temperature: 0.3
steps: 30
permission:
edit: deny
bash:
"*": deny
"test *": allow
read: allow
---
codebuddy family — .codebuddy/agents/ralph-orchestrator.md:
---
name: ralph-orchestrator
description: Ralph Loop orchestrator. Maintains the task list, delegates to executor/reviewer.
model: inherit
permissionMode: default
---
trae family — .trae/agents/ralph-reviewer.md:
---
name: ralph-reviewer
description: Ralph Loop reviewer. Read-only quality gate emitting machine-routable verdict/issues.
tools: Read, Grep, Glob
---
qwen family — .qwen/agents/ralph-reviewer.md:
---
name: ralph-reviewer
description: Ralph Loop reviewer. Read-only quality gate emitting machine-routable verdict/issues.
tools: Read, Grep, Glob, Bash
disallowedTools: [Write, Edit]
approvalMode: plan
---
Note the qwen family's
disallowedTools: [Write, Edit]is a YAML flow sequence (array) and must not be quoted on render, or it would parse as a string. Only free-text fields (name/description/model) containing dangerous characters like:or#are automatically quoted/escaped.
| Option | Short | Description |
|---|---|---|
--help | -h | Show help |
--version | -V / -v | Show version |
--validate | — | Validate platform config against templates |
--watch | -w | Watch for changes, regenerate automatically |
--incremental | -i | Incremental generation (only rewrite changed files) |
--archive | -o | Export as a ZIP archive |
--all | -a | Generate/validate/export all platforms |
--list | -l | List supported platforms |
--dry-run | -n | Dry run, write nothing |
--domain | -d | Use the given domain |
--domain-file | -D | Path to a custom domain file |
--model-orchestrator | — | Orchestrator sub-agent model (e.g. --model-orchestrator "DeepSeek-V4-Pro") |
--model-executor | — | Executor sub-agent model |
--model-reviewer | — | Reviewer sub-agent model |
See CONTRIBUTING.md. For change history see CHANGELOG.md; for architecture see docs/architecture.md.
MIT
FAQs
从单一源生成多平台 AI 编码 agent/command 配置的脚手架(Code-Loop / Test-Loop / Writing-Loop / Ralph-Loop)。
The npm package @master0071/loop-md-cli receives a total of 0 weekly downloads. As such, @master0071/loop-md-cli popularity was classified as not popular.
We found that @master0071/loop-md-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.