
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
@rpamis/comet
Advanced tools
██████╗ ██████╗ ███╗ ███╗███████╗████████╗
██╔════╝██╔═══██╗████╗ ████║██╔════╝╚══██╔══╝
██║ ██║ ██║██╔████╔██║█████╗ ██║
██║ ██║ ██║██║╚██╔╝██║██╔══╝ ██║
╚██████╗╚██████╔╝██║ ╚═╝ ██║███████╗ ██║
╚═════╝ ╚═════╝ ╚═╝ ╚═╝╚══════╝ ╚═╝
Comet is a resumable long-running task workflow and Skill platform for coding.
It provides two independent requirements workflows: Native for strong models, powered only by Comet's own runtime, and Classic, which preserves the full OpenSpec + Superpowers phase-governance model. Comet also covers Skill creation, evaluation, and release.
It allows you to use a toolchain to handle everything from requirements to archiving, combine any skill to make it like Comet, evolving your skills based on scientific Rubric, Pass@k, and Pass^k scoring.
[!IMPORTANT] 0.4.0-rc.1 — Native Supervisor Changes can decompose a complex requirement into dependency-aware child changes, let independent Codex sessions or a Claude Code Agent Team implement and verify them in isolated worktrees, and then have the Runtime integrate them in dependency order before the parent change's final acceptance.
RC.1 also adds manageable Personal Memory, Project Knowledge, and progressive context, plus a three-pane Dashboard for workflows, Git worktrees, memory, knowledge, and plugin settings. Native Portable State, recovery paths, and the Windows Hook experience are hardened throughout.
0.4.0-beta.7 — Added a native, recoverable workflow for strong models. Native and Classic operate independently through shared configuration, status, Guard, Dashboard, and Eval entry points. Aligned evaluation (16 tasks × 48 runs, using the 41 paired samples where both treatments passed) showed 76.8% fewer total tokens, 57.4% fewer Agent rounds, 47.4% less time, 87.5% pass^3 (+12.5pp), and 100% pass@3.
0.4.0-beta.1 — Upgraded Comet to a pure Node runtime without Bash/WSL and added three core capabilities: compose any Skill through
/comet-any, evaluate any Skill throughcomet evalwith LangSmith integration, and inspect every change throughcomet dashboard.0.3.9 — Review mode (
off|standard|thorough) controls Build/Verify code review with project defaults; init/update gained optional dependency prompts, broader CLI i18n, stronger phase guards, and macOS executable bits.See the website Changelog for details and the Native vs. 0.4.0 Classic baseline for the evaluation results.
Native and Classic are not lightweight and heavyweight tiers, and neither upgrades into the other. Native is for strong models that can plan and verify autonomously; Classic is for scenarios that benefit from a complete phased methodology and stronger constraints.
/comet-native uses a detailed brief, complete target specifications, phase checks, and recoverable archive to constrain outcomes while leaving planning, implementation, testing, and review methods to the model. User-readable artifacts live under docs/comet/ by default, fully separate from Classic. See the Native workflow guide./comet-classic./comet reads only the project's .comet/config.yaml and deterministically forwards to /comet-native or /comet-classic. It does not guess from task size or mix changes, state, or directories across workflows. comet resume-probe uses the same configuration to resume through the correct permanent entry point./comet-any to organize them into distributable
Bundles, so Skills you create can be distributed to coding platforms with one command, much like comet init.When a requirement contains multiple deliverables that can be implemented and verified independently, a Supervisor Change confirms the child changes and their dependencies before coordinating independent Codex sessions or Claude Code Agent Teams. The Runtime remains responsible for worktrees, task identity, verification, ordered integration, and the parent change's final Verify.
Complex goal → child-change DAG → isolated worktrees → independent implementation and verification → ordered integration → final parent Verify
Codex multi-session execution
▶ Play the full demo
Claude Code Agent Teams execution
▶ Play the full demo
With Comet, you only need to remember two skills and one command, covering coding, creation, and evaluation with an extremely low barrier to entry:
/comet to enter the project's configured Native or Classic workflow/comet-any to compose any Skillscomet eval to evaluate any SkillThe following charts are from 16 Comet workflow tasks, with 5 samples per treatment, comparing no Comet, Comet 0.3.9, and Comet 0.4.0.
The core observations were the differences in Pass@5, Pass^5, and Rubric scores. The baseline without Comet Skills only validated business behavior.
Many Comet capabilities have parallels in current industry practice.
To compare Comet with those patterns, see Comet Docs.
.comet.yaml, so an agent can continue after interruption instead of rereading documents and guessing progress.comet-guard.mjs, comet-yaml-validate.mjs, and comet-state.mjs check tasks, state fields, verification
evidence, and archive conditions before the workflow advances./comet-any composes arbitrary Skills. You describe your Skill
preferences, and the agent handles stability-related hooks, rules, scripts, and referenced Skill files for you.Requirements:
npm install -g @rpamis/comet
Initialize Comet in the project where you want to use it:
cd your-project
comet init
# Invoke /comet in the host
Interactive setup explains and offers Native, Classic, or both. Native is for strong models that can implement and verify autonomously; Classic is for tasks that need full Spec/TDD phase constraints; Both installs two independent entries while keeping /comet on Native by default. Non-interactive new projects default to Native, and project configuration is unified at .comet/config.yaml:
comet init --workflow classic
comet init --workflow both
comet init generates .comet/config.yaml with field-level comments in the selected language. comet update fills new managed defaults while preserving user values and unknown extensions.
schema: comet.project.v1
default_workflow: native
workflows: [native, classic]
ambient_resume: true
memory:
learning: true
retrieval: true
knowledge:
provider: local
hook:
allow_paths: []
native:
artifact_root: docs
language: en
clarification_mode: batch
archive_confirmation: automatic
max_verify_failures: 5
classic:
artifact_layout: docs
language: en
context_compression: off
review_mode: standard
auto_transition: true
default_workflow selects the default /comet entry and must be present in workflows. ambient_resume, memory, knowledge, and hook are shared by both workflows.memory.learning / retrieval control personal-memory learning and injection. knowledge.local.include can append project-relative Markdown globs. hook.allow_paths is empty by default; add project-relative directories only when guarded phases must write shared files. It cannot bypass protection for .comet or workflow artifacts.docs/comet/ and machine Runtime under .comet/runtime/native/. Use comet init --workflow native --root artifacts for artifacts/comet/. Classic-only defaults stay under classic:; comet init / comet update migrate legacy top-level fields.Cloud Knowledge and self-hosted PR providers remain advanced settings; see Native configuration and Classic configuration. Native v4 no longer persists the legacy snapshot budgets in user configuration.
For platforms that use the generic skills CLI directly, you can install the Comet skill package with:
npx skills add rpamis/comet
Auto-install OpenSpec & Superpowers, one-click dev environment setup
Multi-phase Skill entry, auto-detects current Spec stage, auto-triggers core flow, manual review at key nodes
Comet Eval's automated dual-agent architecture can integrate online with LangSmith/LangFuse environments, making experiments traceable and skills evolvable.
Manage your Skill baseline in LangSmith and view detailed performance metrics, latency, and token consumption
Trace your Claude Code in LangSmith
Trace custom Rubric metrics with Pytest in LangSmith
comet init supports 37 AI coding platforms:
| Platform | Skills Dir | Platform | Skills Dir |
|---|---|---|---|
| Claude Code | .claude/ | Cursor | .cursor/ |
| Codex | .codex/ | OpenCode | .opencode/ |
| Devin Desktop (formerly Windsurf) | .devin/ | Cline | .cline/ |
| RooCode | .roo/ | Continue | .continue/ |
| GitHub Copilot | .github/ | Gemini CLI | .gemini/ |
| Amazon Q Developer | .amazonq/ | Qwen Code | .qwen/ |
| Kilo Code | .kilocode/ | Auggie | .augment/ |
| Kimi Code | .kimi-code/ | Kiro | .kiro/ |
| Lingma | .lingma/ | Junie | .junie/ |
| CodeBuddy | .codebuddy/ | WorkBuddy | .workbuddy/ |
| Crush | .crush/ | Factory Droid | .factory/ |
| iFlow | .iflow/ | Pi | .pi/ |
| Qoder | .qoder/ | Antigravity | .agents/ |
| Antigravity 2.0 | .agents/ | Bob Shell | .bob/ |
| ForgeCode | .forge/ | Trae | .trae/ |
| Trae CN | .trae-cn/ | ZCode | .zcode/ |
| MimoCode | .mimocode/ | CoStrict | .cospec/ |
| Grok | .grok/ |
See CONTRIBUTING.md | 中文版 for development setup, commit conventions, PR process, branch workflow, and guidance for adding platforms, skills, scripts, or changelog entries.
See CHANGELOG.md for version history and updates.
Track our development progress and upcoming features on the Comet Roadmap.
![]() DouYin (Recommended) |
![]() |
![]() |
FAQs
Agent Skill Harness For Turning Ideas Into Evaluated Workflows
The npm package @rpamis/comet receives a total of 1,785 weekly downloads. As such, @rpamis/comet popularity was classified as popular.
We found that @rpamis/comet demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.