
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@opentag/cli
Advanced tools
OpenTag CLI for setting up and running a local source-thread agent work loop.
OpenTag turns an existing work thread into a governed agent work loop. The CLI configures the local dispatcher, platform listener, runner, executor capability checks, context packet snapshots, action receipts, artifacts, and local audit/status surfaces that keep that loop source-thread-native and local-first.
npm install -g @opentag/cli@latest
Then run:
opentag setup
opentag service status
opentag doctor
opentag setup walks through the local governed-loop configuration:
cancel=no until its Gateway can prove tool-process termination.The recommended setup option keeps OpenTag running after the terminal closes. It installs and starts a background service on macOS and Linux. If background service mode is unsupported or you choose terminal mode, use opentag start and keep that terminal open.
For GitHub, GitLab, Linear, or Discord webhook deployments that use an already configured relay, opentag setup --relay https://<relay-host> writes relay mode directly and pairs the local checkout with that relay.
opentag status --run <run_id> shows the local context packet, agent work ledger, produced artifacts, queued delivery intents or activation blocks, and safe next actions without turning the source thread into an agent log stream. Provider outcomes are reported only when backed by the delivery journal or signed provider observations.
opentag status --workstream <workstream_id> shows the workstream state and next action first, followed by recipe budgets, accepted outcomes, and bounded exception detail. Healthy workstreams stay quiet. Add --json to receive structured workstream, recipe, metrics, and evaluation objects for automation.
The factory commands operate the recipe, workstream, and restart-safe admission-batch lifecycle through the configured dispatcher. Create and submit commands accept a complete JSON document from a file or from stdin with --input -. Every command supports --json for automation:
opentag factory recipe create --input recipe.json --json
opentag factory recipe get --id recipe_release --version 1 --json
opentag factory workstream create --input workstream.json --json
opentag factory workstream get --id workstream_release --json
opentag factory batch submit --input batch.json --json
opentag factory batch get --id batch_release --json
# The same create/submit input can be piped through stdin.
cat batch.json | opentag factory batch submit --input - --json
The JSON documents use the public FactoryRecipeSnapshotInput, WorkstreamInput, and WorkstreamAdmissionBatchInput contracts. A workstream contains an explicit bounded set of existing WorkThread members; a batch contains ordered admission items for those members. These commands do not define a task graph or move project-management ownership into OpenTag.
External local runtimes can report lifecycle hooks through the public Hook Ingest Contract: opentag ingest-template --format manifest prints the manifest, and opentag ingest records audit-visible progress or terminal state through runner-scoped auth.
opentag setup
opentag start
opentag service start
opentag service stop
opentag service status
opentag service logs
opentag status
opentag factory recipe get --id <recipe_id> --version <version>
opentag factory workstream get --id <workstream_id>
opentag factory batch get --id <batch_id>
opentag doctor
opentag config path
opentag config show
opentag platforms
opentag executors
OpenTag stores local configuration at:
~/.config/opentag/config.json
The config contains local secrets, so the CLI writes it with private file permissions.
The setup wizard links to the matching guide for each platform:
docs/platforms/lark.en.mddocs/platforms/slack.en.mddocs/platforms/github.en.mddocs/platforms/gitlab.en.mddocs/platforms/linear.en.mddocs/platforms/telegram.en.mddocs/platforms/discord.en.mdThe scoped CLI package supports one-off runs without a global install:
npx @opentag/cli doctor
npx @opentag/cli setup
npx @opentag/cli start
For background service mode, install the CLI globally first so the generated service definition points at a stable CLI path instead of an npx temporary location.
Inside the OpenTag monorepo, install the development command:
corepack pnpm opentag-dev
Then run:
opentag-dev setup
opentag-dev start
FAQs
OpenTag command line interface.
The npm package @opentag/cli receives a total of 26 weekly downloads. As such, @opentag/cli popularity was classified as not popular.
We found that @opentag/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.