
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@opentag/cli
Advanced tools
OpenTag CLI for setting up and running a local source-thread agent work loop.
OpenTag turns an existing work thread into a governed agent work loop. The CLI configures the local dispatcher, platform listener, runner, executor capability checks, context packet snapshots, action receipts, artifacts, and local audit/status surfaces that keep that loop source-thread-native and local-first.
npm install -g @opentag/cli@latest
Then run:
opentag setup
opentag service status
opentag doctor
opentag setup walks through the local governed-loop configuration:
cancel=no until its Gateway can prove tool-process termination.The recommended setup option keeps OpenTag running after the terminal closes. It installs and starts a background service on macOS and Linux. If background service mode is unsupported or you choose terminal mode, use opentag start and keep that terminal open.
For GitHub, GitLab, Linear, or Discord webhook deployments that use an already configured relay, opentag setup --relay https://<relay-host> writes relay mode directly and pairs the local checkout with that relay.
opentag status --run <run_id> shows the local context packet, agent work ledger, produced artifacts, callback delivery, and safe next actions without turning the source thread into an agent log stream.
External local runtimes can report lifecycle hooks through the public Hook Ingest Contract: opentag ingest-template --format manifest prints the manifest, and opentag ingest records audit-visible progress or terminal state through runner-scoped auth.
opentag setup
opentag start
opentag service start
opentag service stop
opentag service status
opentag service logs
opentag status
opentag doctor
opentag config path
opentag config show
opentag platforms
opentag executors
OpenTag stores local configuration at:
~/.config/opentag/config.json
The config contains local secrets, so the CLI writes it with private file permissions.
The setup wizard links to the matching guide for each platform:
docs/platforms/lark.en.mddocs/platforms/slack.en.mddocs/platforms/github.en.mddocs/platforms/gitlab.en.mddocs/platforms/linear.en.mddocs/platforms/telegram.en.mddocs/platforms/discord.en.mdThe scoped CLI package supports one-off runs without a global install:
npx @opentag/cli doctor
npx @opentag/cli setup
npx @opentag/cli start
For background service mode, install the CLI globally first so the generated service definition points at a stable CLI path instead of an npx temporary location.
Inside the OpenTag monorepo, install the development command:
corepack pnpm opentag-dev
Then run:
opentag-dev setup
opentag-dev start
FAQs
OpenTag command line interface.
The npm package @opentag/cli receives a total of 11 weekly downloads. As such, @opentag/cli popularity was classified as not popular.
We found that @opentag/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.