
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@smartergpt/lexrunner
Advanced tools
Fan-out tasks as multiple PRs in parallel, then build a merge pyramid from the blocks. Compute dependency order, run gates locally, and merge cleanly.
lexrunner)LexRunner turns a changing set of pull requests into a reviewable integration program: discover the work, freeze a dependency plan, run bounded gates, preserve evidence, and merge only with explicit authority.
It is useful when a repository has concurrent PRs, dependencies between changes, repeated local and CI checks, or agent-assisted implementation that needs a durable handoff. It is usually not a fit for a repository with one occasional PR and no integration-order problem.
Ask your agent: “Read
docs/agent-evaluation.md, evaluate this repository without installing or changing anything, and returnadopt,pilot,defer, ornot a fitwith the smallest reversible trial.”
That evaluation is deliberately read-only. Installing the package, writing a plan, creating a branch, pushing, opening a PR, or merging requires separate approval.
LexRunner’s supported workflow has grown in layers. A normal user can stop at any layer.
| Layer | Current capability | First surface |
|---|---|---|
| Deterministic plan | Freeze PRs and declared dependencies into schema-versioned plan.json | lexrunner weave plan |
| Merge-weave | Compute merge order, preview integration, run gates, and apply authorized merges | lexrunner weave *, lexrunner gate run |
| Run and evidence | Persist bounded receipts, independent verification, acceptance, and artifacts | lexrunner attempt * |
| Fanout | Harvest and analyze issue/PR evidence for parallel work planning | lexrunner fanout * |
| Assisted agent work | Prepare an immutable packet and workspace envelope, attach a foreground-owned worker, then verify its claims | CLI/MCP Attempt lifecycle |
The ADR-010 coordination model is accepted and its assisted Attempt lifecycle is implemented. LexRunner also has a tested headless reconciliation application boundary, but it is not a general production supervisor: there is no approved public headless launch surface, native host/reboot recovery remains release evidence, and Stage 5 fault-injection and authority expansion remain unproven. See ADR-010 and the headless proof boundary.
First inspect without mutation:
lexrunner --version
lexrunner workspace doctor --json
lexrunner weave discover --json
After approving a local, reversible artifact, freeze and inspect a plan:
lexrunner weave plan --from-github --output plan.json --json
lexrunner schema validate plan.json --json
lexrunner weave merge-order plan.json --json
lexrunner gate run plan.json --dry-run --json
These commands do not merge. lexrunner weave apply --execute is a separate mutation and should be
run only after reviewing the frozen plan, authority, gates, and target branch.
For a guided merge-weave walkthrough, use MERGE_WEAVE_QUICKSTART.md.
LexRunner has two contracts that must not be blurred:
plan.json is the sole authority for dependency order and merge intent.
The integration core never reads coordination state or .smartergpt/ as hidden truth.CoordinationStore and
workspace lifecycle adapters. That state coordinates implementation work; it does not authorize
the integration core or silently alter a frozen plan..smartergpt/ is a portable example profile, not a runtime dependency. User/work artifacts belong
in explicit stores, ignored local deliverables, CI artifacts, or PR comments—not in the package
source tree. Canonical terms live in docs/TERMS.md.
Ecosystem 3.1 requires Node.js 24 or newer. The npm package is publicly readable without an npm login. Current source uses Apache-2.0; the first package under those terms is the 2.1.0 release candidate. Earlier published versions retain their applicable licenses.
npm install --save-dev @smartergpt/lexrunner
npx lexrunner --version
Global installation is also supported:
npm install --global @smartergpt/lexrunner
lexrunner --version
Do not place npm tokens in the repository or a chat transcript. Windows/private-package validation is documented in the Node 24 migration guide.
lexrunner is the canonical CLI name. The existing lex-pr executable remains an additive
compatibility alias and invokes the same program, so existing automation does not need to change.
The checked-in package version is the single source for lexrunner --version and
lex-pr --version.
Current repository package version: 2.1.0. npm availability and dist-tags are separate release evidence; inspect the registry rather than inferring publication from source metadata.
See the 2.1.0 open-source release, the 2.0.2 generated timeout correction, the 2.0.1 MCP identity correction, the 2.0.0 plan-bound evidence release, the 1.5.2 exact Lex alignment release, the 1.5.1 release correction, the 1.4.1 canonical CLI release, the 1.4.0 native-host boundary release, the 1.3.0 dogfood release, the 1.2.1 publication repair, and the underlying 1.2.0 compatibility decision for package disposition, semver rationale, supported assisted behavior, and deferred guarantees.
workspace doctor, weave discover, weave plan,
weave merge-order, and gate run.docs/AX.md and README.mcp.md.attempt preflight before packet construction. When it reports
broker_required, use attempt projection status|prepare to bind the exact committed base into
native WSL, then continue with attempt prepare, attempt start, worker
attachment/heartbeat, receipt submission, verification, and acceptance. The foreground host
still owns worker launch. Follow the
native Windows-to-WSL projection workflow for recovery
and cleanup.The normative CLI/MCP inventory is generated from live registrations and stored in
docs/architecture/cli-mcp-surface.json. Deprecated
top-level aliases remain migration aids, not recommended entry points.
Historical v2 design drafts are retained for provenance only. They do not describe a sibling package, active migration, or current runtime contract.
nvm use
npm ci
npm run lint
npm run build
For implementation work, use the touched/adjacent gate selector and let CI prove the full suite on high-risk changes:
lexrunner gate select --base <base-sha> --head <head-sha> --json
Release validation remains exhaustive. See AGENTS.md,
CONTRIBUTING.md, and the
implementation gate contract.
@smartergpt/lexrunnerlexrunner (lex-pr compatibility alias)lexrunner-mcp@smartergpt/lex (MIT)See LICENSE.md, NOTICE.md, and
ADR-008.
SmarterGPT was founded by Joseph Gustavson (Guffawaffle). See stewardship, contributing, and project identity. Commercial use and forks are permitted under the license; code licensing grants no credentials, tenant access or runtime authority.
FAQs
Fan-out tasks as multiple PRs in parallel, then build a merge pyramid from the blocks. Compute dependency order, run gates locally, and merge cleanly.
The npm package @smartergpt/lexrunner receives a total of 37 weekly downloads. As such, @smartergpt/lexrunner popularity was classified as not popular.
We found that @smartergpt/lexrunner demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.