
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
@realtimex/collab
Advanced tools
A revolutionary multi-agent orchestration framework for autonomous code review and continuous improvement.
Collab is a new kind of coding agent that orchestrates multiple AI agents to review and improve your code. Unlike single-agent tools, Collab runs specialized agents in parallel, each finding different types of issues:
npm install -g @realtimex/collab
Or run directly:
npx @realtimex/collab init
cd my-project
collab init
collab init now runs in smart mode by default:
attach (existing repo) vs bootstrap (empty repo).collaboration/docs/*.md guides from discovered project contextbootstrap lane, runs a wizard and creates starter project boilerplateIt also creates .collaboration/ with config and logging defaults.
collab review
# Disable live per-agent stdout/stderr threads:
collab review --no-threads
This runs all enabled agents on your uncommitted changes.
# Attach to latest running/recorded agent stream:
collab attach coder
# Attach to a specific session + agent:
collab attach 20260213212940_loop contractor
collab analytics
Contributor and agent standards are documented in:
AGENTS.md (cross-agent engineering guardrails)CLAUDE.md (Claude execution contract under Collab)docs-dev/ENGINEERING_GUARDRAILS.md (developer notes and definition of done)| Command | Description |
|---|---|
collab init | Smart-initialize collaboration in current Git repo (default) |
collab review [feature] | Run multi-agent code review |
collab gen contracts --all | Alias for full contract generation (contracts sync --all) |
collab contracts sync | Generate/update executable test contracts from changed files |
collab contracts enrich | Fill missing executable contract fields using hints + heuristics |
collab contracts run | Execute generated contracts (Playwright runtime) |
collab contracts doctor | Diagnose unresolved/non-executable contracts |
collab agents list | List available agents |
collab skills init playwright-cli | Install/sync Playwright CLI skill into managed paths |
collab skills doctor | Validate skill setup and detect drift between managed/agent copies |
collab config show | View current configuration |
collab config get <path> | Read a config value (supports dotted paths) |
collab config set <path> <value> | Update a config value (supports dotted paths) |
collab config edit | Edit configuration in $EDITOR |
collab analytics | View collaboration metrics |
collab doctor | Run preflight health checks |
collab loop | Start autonomous improvement |
collab loop roles <action> | Scaffold/edit loop multi-role workflow |
collab loop workflows <list|show> | List and inspect workflow templates |
collab attach [session] [agent] | Attach to a live per-agent stream from session logs |
After collab init, edit .collaboration/config.json:
{
"project": {
"name": "my-app",
"language": "TypeScript",
"testCommand": "npm test"
},
"agents": [
{
"name": "codex",
"enabled": true,
"tier": "primary"
},
{
"name": "gemini",
"enabled": true,
"tier": "primary"
}
]
}
collab init # smart mode (default)
collab init --template # legacy template-only initialization
collab init --yes # non-interactive (accept detected defaults)
collab init --mode auto # lane selection: auto|attach|bootstrap
collab init --attach # force existing-repo onboarding lane
collab init --bootstrap # force starter-boilerplate lane
collab init --no-probe # skip command probes
collab init --force # reinitialize existing .collaboration/
Smart init generates:
.collaboration/docs/PROJECT.md.collaboration/docs/DEV.md.collaboration/docs/TEST.md.collaboration/docs/API.md.collaboration/docs/GUARDRAILS.mdYou can route each agent to different commands per action:
{
"agents": [
{
"name": "codex",
"commands": {
"review": {
"command": "codex review --uncommitted",
"inputMethod": "args",
"nonInteractive": true,
"interactionMode": "non-interactive"
},
"implement": {
"command": "codex exec --full-auto --sandbox workspace-write",
"inputMethod": "args",
"nonInteractive": true,
"interactionMode": "non-interactive"
}
}
}
]
}
collab review uses review; loop/codegen paths use implement and fix.
For loop reliability, commands should explicitly declare interaction behavior:
nonInteractive: true for commands safe to run without prompts.requiresTTY: true / interactionMode: "interactive" for prompt-driven commands.Loop defaults to non-interactive execution and skips interactive commands with a needs-tty status.
Use collab loop "<task>" --allow-interactive to run interactive commands in pseudo-TTY mode and answer agent prompts inline.
collab loop "<task>" now runs with autonomous defaults:
--require-approval to enable)--no-auto-fix to disable)--manual to enable step-by-step intervention)--no-contracts-sync to disable)--no-contracts-run to disable)--no-contracts-enrich to disable).collaboration/skills ↔ agent skill dirs)collab loop (--contracts-allow-unresolved for best-effort mode)--no-manual runs continue to the next iteration when remediation returns no edits (bounded by loop.maxIterations); use --fail-fast to abort immediatelycollab init (smart/TDD) now scaffolds contract-aware default roles: spec, coder, contractor, reviewer, qacollab attach <session> <role> terminal stream (--no-agent-terminals to disable)--workflow <id>) with dynamic mapping to enabled local agents; run collab loop workflows list to discover templatesproject.targetedTestCommand with {files} for project-specific targetingTerminal mirror controls:
--agent-terminals / --open-agent-terminals--no-agent-terminals / --no-open-agent-terminals--agent-terminal-mode auto|terminal|tmux|off--agent-terminals-max 4.collaboration/config.json):
ui.agentTerminals.autoOpenui.agentTerminals.modeui.agentTerminals.maxOpenGenerate/update contract files that describe expected behavior for changed surfaces:
collab gen contracts --all
collab contracts sync
collab contracts enrich
collab contracts sync --all
collab contracts sync --base HEAD~1 --json
# run changed contracts
collab contracts run --base-url http://localhost:5173
# run only selected contracts
collab contracts run --only src-views-accounts,src-components-forms-leadform --base-url http://localhost:5173
# run all contracts, strict mode
collab contracts run --all --base-url http://localhost:5173 --strict
# run with orchestration hooks and reliability controls
collab contracts run --base-url http://localhost:5173 \
--seed-command "npm run seed:test -- --run-id={runId}" \
--cleanup-command "npm run seed:cleanup -- --run-id={runId}" \
--max-wall-clock-ms 300000 --step-timeout-ms 15000 --flake-retries 1
# diagnose unresolved contracts
collab contracts doctor --json
Contracts are written to:
.collaboration/contracts/*.contract.json.collaboration/contracts/index.json.collaboration/collab.db (SQLite tracking of contracts now, plus room for memory/lessons/analytics tables)Optional hints file:
.collaboration/contracts/hints.jsonHints can define:
routes.byFile / routes.bySurfaceNameselectors.byFile / selectors.bySurfaceName / selectors.byTypenetwork.byFile expected request patterns for load-datacollab contracts run executes contracts deterministically with Playwright and reports:
passed: contract assertions passedfailed: runtime/assertion failuresunresolved: contract missing required execution hints (for example entry.url)skipped: runtime unavailable (for example Playwright not installed)Flow contracts can execute step types:
visit, click, fill, submit, expectText, expectResponse, expectNoConsoleErrorContract runtime orchestration can:
project.devCommandhealthUrl readinessseedCommand / cleanupCommand hooks with {runId} and {baseUrl} placeholders.collaboration/logs/contracts/You can configure loop to run dedicated roles with different agents (including multiple instances of the same base CLI):
{
"loop": {
"enabled": true,
"roles": [
{
"role": "spec",
"phase": "planning",
"agent": "codex",
"action": "review",
"instruction": "Create acceptance criteria and executable contract expectations."
},
{
"role": "coder",
"phase": "implementation",
"agent": "claude",
"action": "implement",
"instruction": "Implement scoped changes and add/update tests."
},
{
"role": "contractor",
"phase": "implementation",
"agent": "gemini",
"action": "implement",
"instruction": "Enrich executable contracts and fix browser/runtime contract failures."
},
{
"role": "reviewer",
"phase": "review",
"agent": "codex",
"action": "review"
},
{
"role": "qa",
"phase": "review",
"agent": "qwen",
"action": "test"
}
]
}
}
Role-scoped execution controls are supported via loop.roles[].execution:
modelmaxTurns (attempt budget for that role)retries (attempts = retries + 1 when maxTurns is unset)timeoutMsmaxWallClockMstemperatureextraArgsTimeout precedence in loop execution is deterministic:
participant.executionOverrides (if present)loop.roles[].executionagents[].executionloop.phaseTimeoutMs, loop.phaseMaxWallClockMs)loop.transportTimeoutMs, loop.transportMaxWallClockMs, then built-in defaults)Agent defaults can be set once in agents[].execution and are overridden by loop.roles[].execution.
Example:
{
"agents": [
{
"name": "claude",
"execution": {
"model": "sonnet",
"timeoutMs": 300000
}
}
],
"loop": {
"roles": [
{
"role": "coder",
"phase": "implementation",
"agent": "claude",
"action": "implement",
"execution": {
"model": "opus",
"maxTurns": 4,
"maxWallClockMs": 1200000
}
}
]
}
}
Supported phases: planning, implementation, review.
Human → collab review
├─ AgentManager loads config
├─ Runs agents in parallel
│ ├─ Codex reviews code quality
│ └─ Gemini reviews logic
├─ Aggregates findings
└─ Logs results
collab loop
├─ Agents review code
├─ Claude fixes issues
├─ Tests validate fixes
├─ Changes committed
└─ Repeat until no issues
$ collab review
🤖🤝👨💻 Collab - Multi-Agent Collaboration Framework
============================================================
🤖 Multi-Agent Review: uncommitted-changes
============================================================
📝 Running 2 agents: codex, gemini
✅ Review completed in 45s
Agents: 2/2 succeeded
Findings: 3 issues found
────────────────────────────────────────────────────────────
📊 Review Summary
────────────────────────────────────────────────────────────
Total Issues: 3
🔴 High Priority: 1
🟡 Medium Priority: 2
🟢 Low Priority: 0
🔴 High Priority Issues:
1. [codex] Schema migration compatibility issue
💡 Add forward migration for unique constraint
🟡 Medium Priority Issues:
1. [gemini] Timeout misalignment (35s vs 30s)
💡 Sync frontend and backend timeouts to 45s
2. [codex] Missing CLI scripts
💡 Remove references to non-existent files
# Clone and install
git clone https://github.com/realtimex/collab.git
cd collab
npm install
npm run build
# Link for local testing
npm link
# Test
cd /path/to/your/project
collab init
collab review
We welcome contributions! Areas to help:
MIT
Built by the RealTimeX team. Inspired by the belief that AI agents should collaborate, not compete.
"If collaboration succeeds, we can 100x development. Maybe even 1000x." 🚀
FAQs
Multi-agent code review and autonomous improvement framework
The npm package @realtimex/collab receives a total of 3 weekly downloads. As such, @realtimex/collab popularity was classified as not popular.
We found that @realtimex/collab demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.