
Security News
upm Launches as a Fast, Tiny Package Manager Written in TypeScript
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.
@smartergpt/lexrunner
Advanced tools
Fan-out tasks as multiple PRs in parallel, then build a merge pyramid from the blocks. Compute dependency order, run gates locally, and merge cleanly.
lexrunner)LexRunner turns a changing set of pull requests into a reviewable integration program: discover the work, freeze a dependency plan, run bounded gates, preserve evidence, and merge only with explicit authority.
It is useful when a repository has concurrent PRs, dependencies between changes, repeated local and CI checks, or agent-assisted implementation that needs a durable handoff. It is usually not a fit for a repository with one occasional PR and no integration-order problem.
Ask your agent: “Read
docs/agent-evaluation.md, evaluate this repository without installing or changing anything, and returnadopt,pilot,defer, ornot a fitwith the smallest reversible trial.”
That evaluation is deliberately read-only. Installing the package, writing a plan, creating a branch, pushing, opening a PR, or merging requires separate approval.
For your first trial, install LexRunner only in a GitHub repository with open PRs. Node.js 24+ and Git are required. npm installs LexRunner's dependencies; you do not need to install Lex, AXF, LexSona, a policy-host service, or an MCP server separately for this CLI workflow. These examples use the published 2.2.0 release.
npm install --save-dev @smartergpt/lexrunner@2.2.0
npx lexrunner --version
npx lexrunner weave discover --json
Installation changes your package manifest, lockfile and dependencies. Discovery
reads GitHub; private repositories need an authorized GITHUB_TOKEN supplied to
the process. See the merge-weave quickstart for setup,
authentication and the complete first-use journey:
Discover → freeze a plan → inspect dependencies → preview gates.
The first useful result is an inspected plan and gate preview. A dry run neither executes gates nor proves merge eligibility. The quickstart separates local writes, command execution, independent review and the explicit merge boundary. Single-repository GitHub plans bind explicit refs and commits for local integration. The walkthrough explains clean-checkout preparation, exact-input checks and separately authorized execution.
Start the walkthrough · Choose another SmarterGPT workflow
LexRunner’s supported workflow has grown in layers. A normal user can stop at any layer.
| Layer | Current capability | First surface |
|---|---|---|
| Deterministic plan | Freeze PRs and declared dependencies into schema-versioned plan.json | lexrunner weave plan |
| Merge-weave | Compute merge order, preview integration, run gates, and apply authorized merges | lexrunner weave *, lexrunner gate run |
| Run and evidence | Persist bounded receipts, independent verification, acceptance, and artifacts | lexrunner attempt * |
| Fanout | Harvest and analyze issue/PR evidence for parallel work planning | lexrunner fanout * |
| Assisted agent work | Prepare an immutable packet and workspace envelope, attach a foreground-owned worker, then verify its claims | CLI/MCP Attempt lifecycle |
The ADR-010 coordination model is accepted and its assisted Attempt lifecycle is implemented. LexRunner also has a tested headless reconciliation application boundary, but it is not a general production supervisor: there is no approved public headless launch surface, native host/reboot recovery remains release evidence, and Stage 5 fault-injection and authority expansion remain unproven. See ADR-010 and the headless proof boundary.
LexRunner has two contracts that must not be blurred:
plan.json is the sole authority for dependency order and merge intent.
The integration core never reads coordination state or .smartergpt/ as hidden truth.CoordinationStore and
workspace lifecycle adapters. That state coordinates implementation work; it does not authorize
the integration core or silently alter a frozen plan..smartergpt/ is a portable example profile, not a runtime dependency. User/work artifacts belong
in explicit stores, ignored local deliverables, CI artifacts, or PR comments—not in the package
source tree. Canonical terms live in docs/TERMS.md.
Ecosystem 3.1 requires Node.js 24 or newer. The npm package is publicly readable without an npm login. Current source uses Apache-2.0; 2.1.0 is the first public npm release under those terms. Earlier published versions retain their applicable licenses.
npm install --save-dev @smartergpt/lexrunner
npx lexrunner --version
Global installation is also supported:
npm install --global @smartergpt/lexrunner
lexrunner --version
Do not place npm tokens in the repository or a chat transcript. Windows/private-package validation is documented in the Node 24 migration guide.
lexrunner is the canonical CLI name. The existing lex-pr executable remains an additive
compatibility alias and invokes the same program, so existing automation does not need to change.
The checked-in package version is the single source for lexrunner --version and
lex-pr --version.
Current repository package version: 2.3.0. npm availability and dist-tags are separate release evidence; inspect the registry rather than inferring publication from source metadata.
See the 2.3.0 selected-work candidate, the 2.2.0 frozen-input release, the 2.1.0 open-source release, the 2.0.2 generated timeout correction, the 2.0.1 MCP identity correction, the 2.0.0 plan-bound evidence release, the 1.5.2 exact Lex alignment release, the 1.5.1 release correction, the 1.4.1 canonical CLI release, the 1.4.0 native-host boundary release, the 1.3.0 dogfood release, the 1.2.1 publication repair, and the underlying 1.2.0 compatibility decision for package disposition, semver rationale, supported assisted behavior, and deferred guarantees.
lexrunner-mcp; use it for plans, gates and
integration. No MCP setup is needed for the CLI trial. Tool calls can write
artifacts or run commands even when merge mutations are disabled. See the
compatibility and setup guide, plus
docs/AX.md and README.mcp.md.attempt preflight before packet construction. When it reports
broker_required, use attempt projection status|prepare to bind the exact committed base into
native WSL, then continue with attempt prepare, attempt start, worker
attachment/heartbeat, receipt submission, verification, and acceptance. The foreground host
still owns worker launch. Follow the
native Windows-to-WSL projection workflow for recovery
and cleanup.The normative CLI/MCP inventory is generated from live registrations and stored in
docs/architecture/cli-mcp-surface.json. Deprecated
top-level aliases remain migration aids, not recommended entry points.
Historical v2 design drafts are retained for provenance only. They do not describe a sibling package, active migration, or current runtime contract.
nvm use
npm ci
npm run lint
npm run build
For implementation work, use the touched/adjacent gate selector and let CI prove the full suite on high-risk changes:
lexrunner gate select --base <base-sha> --head <head-sha> --json
Release validation remains exhaustive. See AGENTS.md,
CONTRIBUTING.md, and the
implementation gate contract.
@smartergpt/lexrunnerlexrunner (lex-pr compatibility alias)lexrunner-mcp@smartergpt/lex (MIT)See LICENSE.md, NOTICE.md, and
ADR-008.
SmarterGPT was founded by Joseph Gustavson (Guffawaffle). See stewardship, contributing, and project identity. Commercial use and forks are permitted under the license; code licensing grants no credentials, tenant access or runtime authority.
FAQs
Fan-out tasks as multiple PRs in parallel, then build a merge pyramid from the blocks. Compute dependency order, run gates locally, and merge cleanly.
The npm package @smartergpt/lexrunner receives a total of 22 weekly downloads. As such, @smartergpt/lexrunner popularity was classified as not popular.
We found that @smartergpt/lexrunner demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
upm uses Node.js to deliver fast npm installs in about 250 KB, with a JavaScript API and security defaults.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.