
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
@mindfoldhq/trellis
Advanced tools
AI capabilities grow like ivy — Trellis provides the structure to guide them along a disciplined path
All-in-one AI framework & toolkit for Claude Code, Cursor, Gemini CLI, iFlow, Codex, Kilo, Kiro & Antigravity
Wild AI ships nothing.
Quick Start • Why Trellis • Use Cases • How It Works • FAQ
| Feature | Problem Solved |
|---|---|
| Auto-Injection | Required specs and workflows auto-inject into every conversation. Write once, apply forever |
| Auto-updated Spec Library | Best practices live in auto-updated spec files. The more you use it, the better it gets |
| Parallel Sessions | Run multiple agents in tandem - each in its own worktree |
| Team Sync | Share specs across your team. One person's best practice benefits everyone |
| Session Persistence | Work traces persist in your repo. AI remembers project context across sessions |
# 1. Install globally
npm install -g @mindfoldhq/trellis@latest
# 2. Initialize in your project directory
trellis init -u your-name
# Or include iFlow CLI support
trellis init --iflow -u your-name
# Or include Codex skills support
trellis init --codex -u your-name
# Or include Kilo CLI support
trellis init --kilo -u your-name
# Or include Kiro Code skills support
trellis init --kiro -u your-name
# Or include Gemini CLI support
trellis init --gemini -u your-name
# Or include Antigravity workflow support
trellis init --antigravity -u your-name
# 3. Start Claude Code and begin working
your-namebecomes your identifier and creates a personal workspace at.trellis/workspace/your-name/
Write your specs in Markdown. Trellis injects them into every AI session — no more repeating yourself.
Define your component guidelines, file structure rules, and patterns once. AI automatically applies them when creating new code — using TypeScript with Props interface, following PascalCase naming, building functional components with hooks.
Spawn multiple Claude sessions in isolated worktrees with /trellis:parallel. Work on several features at once, merge when ready.
While coding, each worker runs in its own worktree (physically isolated directory), no blocking, no interference. Review and merge completed features while others are still in progress.
Define custom skills & commands that prepare Claude for specific tasks and contexts.
Create commands like /trellis:before-frontend-dev that load component guidelines, check recent changes, pull in test patterns, and review shared hooks—all with a single slash.
.trellis/
├── workflow.md # Workflow guide (auto-injected on start)
├── worktree.yaml # Multi-agent config (for /trellis:parallel)
├── spec/ # Spec library
│ ├── frontend/ # Frontend specs
│ ├── backend/ # Backend specs
│ └── guides/ # Decision & analysis frameworks
├── workspace/{name}/ # Personal journal
├── tasks/ # Task management (progress tracking & more)
└── scripts/ # Utilities
.claude/
├── settings.json # Hook configuration
├── agents/ # Agent definitions
│ ├── dispatch.md # Dispatch Agent (pure routing, doesn't read specs)
│ ├── implement.md # Implement Agent
│ ├── check.md # Check Agent
│ └── research.md # Research Agent
├── commands/ # Slash commands
└── hooks/ # Hook scripts
├── session-start.py # Inject context on startup
├── inject-subagent-context.py # Inject specs to subagents
└── ralph-loop.py # Quality control loop
Skills are optional — AI may skip them, leading to inconsistent quality. Trellis enforces specs via Hook injection: not "can use" but "always applied". This turns randomness into determinism, so quality doesn't degrade over time.
Most of the time, AI handles it — just say "We use Zustand, no Redux" and it creates the spec file automatically. But when you have architectural insights AI can't figure out on its own, that's where you step in. Teaching AI your team's hard-won lessons — that's why you won't lose your job to AI.
CLAUDE.md / AGENTS.md / .cursorrules?Those are all-in-one files — AI reads everything every time. Trellis uses layered architecture with context compression: only loads relevant specs for current task. Engineering standards should be elegantly layered, not monolithic.
No. Each person has their own space at .trellis/workspace/{name}/.
Use /trellis:record-session at the end of each conversation. AI writes a session summary to .trellis/workspace/{name}/journal-N.md and indexes it in index.md. Next time you /trellis:start, AI automatically reads recent journals and git info to restore context. In theory, you could just submit your daily journal files as your work report 🤣.
AGPL-3.0 License • Made with care by Mindfold
Found Trellis useful? Please consider giving it a ⭐
FAQs
AI capabilities grow like ivy — Trellis provides the structure to guide them along a disciplined path
The npm package @mindfoldhq/trellis receives a total of 947 weekly downloads. As such, @mindfoldhq/trellis popularity was classified as not popular.
We found that @mindfoldhq/trellis demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.