
Security News
TeamPCP Is Systematically Targeting Security Tools Across the OSS Ecosystem
TeamPCP is targeting security tools across the OSS ecosystem, turning scanners and CI pipelines into infostealers to access enterprise secrets.
@versatly/workgraph
Advanced tools
Agent-first workgraph workspace for multi-agent coordination with dynamic primitives, append-only ledger, and markdown-native storage.
Agent-first workgraph workspace for multi-agent collaboration.
@versatly/workgraph is the standalone coordination core for multi-agent execution. It focuses only on:
thread, space, decision, lesson, fact, agent, plus custom types).workgraph/ledger.jsonl).workgraph/ledger-index.json) for fast ownership queries.workgraph/ledger-chain.json)--space)workgraph command-center)workgraph skill write/load/propose/promote).base filesworkgraph status/brief/checkpoint/intake)workgraph lens list/show) for real-time situational awarenessworkgraph query ...)workgraph search ...)workgraph board generate|sync)workgraph graph index|hygiene|neighborhood|impact|context|edges|export)workgraph dispatch ...) with explicit status transitions, lease heartbeats, and timeout-aware adapter cancellationNo memory-category scaffolding, no qmd dependency, no observational-memory pipeline.
npm install @versatly/workgraph
Or global CLI:
npm install -g @versatly/workgraph
# Initialize pure workgraph workspace
workgraph init ./wg-space --json
# Define custom primitive
workgraph primitive define command-center \
--description "Agent ops cockpit" \
--fields owner:string \
--fields panel_refs:list \
--json
# Create and route thread work
workgraph thread create "Ship command center" \
--goal "Production-ready multi-agent command center" \
--priority high \
--actor agent-lead \
--json
workgraph thread next --claim --actor agent-worker --json
workgraph status --json
workgraph brief --actor agent-worker --json
workgraph lens list --json
workgraph lens show my-work --actor agent-worker --json
workgraph query --type thread --status open --limit 10 --json
workgraph search "auth" --mode auto --json
workgraph checkpoint "Completed API layer" --next "implement tests" --actor agent-worker --json
workgraph board generate --output "ops/Workgraph Board.md" --json
workgraph graph hygiene --json
workgraph graph neighborhood ship-feature --depth 2 --json
workgraph graph impact ship-feature --json
workgraph graph context ship-feature --budget 2000 --json
workgraph graph edges ship-feature --json
workgraph graph export ship-feature --depth 2 --format md --json
workgraph dispatch create "Review blockers" --actor agent-lead --json
workgraph dispatch mark run_123 --status succeeded --output "Review complete" --actor agent-lead --json
workgraph dispatch create-execute "Close all ready threads in platform space" \
--actor agent-lead \
--agents agent-a,agent-b,agent-c \
--space spaces/platform \
--json
workgraph trigger fire triggers/escalate-blocked.md --event-key "thread-blocked-001" --actor agent-lead --json
workgraph onboarding update onboarding/onboarding-for-agent-architect.md --status paused --actor agent-lead --json
workgraph mcp serve -w /path/to/workspace --actor agent-ops --read-only
workgraph ledger show --count 20 --json
workgraph command-center --output "ops/Command Center.md" --json
workgraph bases generate --refresh-registry --json
All commands support --json and emit:
{ "ok": true, "data": ... }{ "ok": false, "error": "..." } (non-zero exit)This is intended for robust parsing by autonomous agents.
The repository is now fully organized as a pnpm workspaces monorepo while preserving
the published @versatly/workgraph package compatibility surface.
Legacy root src/ compatibility wrappers have been removed. Package-owned modules
under packages/* are the only implementation source of truth.
Key workspace packages:
packages/kernel — domain state machine and coordination corepackages/cli — command surface over kernel workflowspackages/sdk — curated public package surfacepackages/control-api — REST, SSE, webhook gateway, and HTTP MCP hostingpackages/runtime-adapter-core — reusable dispatch contracts and generic transportspackages/adapter-claude-code — Claude Code-specific execution adapterpackages/adapter-cursor-cloud — Cursor Cloud-style execution adapterpackages/mcp-server — stdio + HTTP MCP transport and tool registrationpackages/testkit — contract fixtures and schema validation helperspackages/search-qmd-adapter — search compatibility seampackages/obsidian-integration — editor-facing projections and exportspackages/skills — package-level skill distribution surfacePackage ownership and layering are documented in docs/PACKAGE_BOUNDARIES.md.
Migration notes: see docs/MIGRATION.md.
Live workspace repair runbook: see docs/INVARIANT_REPAIR_PLAYBOOK.md.
Realtime control-api SSE contract: see docs/SSE_EVENTS.md.
Current architecture execution roadmap: see docs/ARCHITECTURE_ROADMAP.md.
Recent hardening focused on making unattended operation safer rather than just adding more commands:
all / any
/ not) and route risky shell / update-primitive actions through safety
railspnpm install
pnpm run ci
The default pnpm run test script now uses scripts/run-tests.mjs, a hardened
Vitest wrapper that enforces deterministic process exit in CI (especially on
Windows where lingering esbuild children can keep vitest run alive after
all test files report complete).
pnpm run test: hardened runner (recommended for CI/local reliability)pnpm run test:vitest: raw Vitest invocation (useful for debugging Vitest itself)Optional tuning knobs:
WORKGRAPH_TEST_EXIT_GRACE_MS: grace period after all file results are
observed before forced process-tree cleanup (default 15000)WORKGRAPH_TEST_MAX_RUNTIME_MS: hard timeout for the full run (default
1200000)Generate the large Obsidian demo workspace used for stress-testing:
pnpm run demo:workspace
pnpm run demo:obsidian-setup
Runbook: docs/OBSIDIAN_DEMO.md.
workgraph thread create "Implement auth middleware" \
--goal "Protect private routes" \
--space spaces/backend.md \
--actor agent-api \
--json
workgraph thread list --space spaces/backend --ready --json
workgraph thread next --space spaces/backend --claim --actor agent-api --json
.base files from primitive registry# Sync .workgraph/primitive-registry.yaml
workgraph bases sync-registry --json
# Generate canonical primitive .base files
workgraph bases generate --json
# Include non-canonical (agent-defined) primitives
workgraph bases generate --all --refresh-registry --json
# Build/refresh graph index first (optional but useful)
workgraph graph index --json
# Multi-hop neighborhood around a primitive slug/path
workgraph graph neighborhood ship-feature --depth 2 --json
# Reverse-link blast radius (what references this primitive)
workgraph graph impact ship-feature --json
# Auto-assemble markdown context bundle within token budget (chars/4)
workgraph graph context ship-feature --budget 2000 --json
# Inspect typed relationship edges for one primitive
workgraph graph edges ship-feature --json
# Export a markdown subgraph for handoff/sharing
workgraph graph export ship-feature --depth 2 --format md --json
workgraph ledger query --actor agent-worker --op claim --json
workgraph ledger blame threads/auth.md --json
workgraph ledger verify --strict --json
# with shared vault env (e.g. tailscale-mounted path)
export WORKGRAPH_SHARED_VAULT=/mnt/tailscale/company-workgraph
workgraph skill write "workgraph-manual" \
--body-file ./skills/workgraph-manual.md \
--owner agent-architect \
--actor agent-architect \
--json
workgraph skill propose workgraph-manual --actor agent-reviewer --space spaces/platform --json
workgraph skill promote workgraph-manual --actor agent-lead --json
workgraph skill load workgraph-manual --json
workgraph skill list --updated-since 2026-02-27T00:00:00.000Z --json
workgraph skill history workgraph-manual --limit 10 --json
workgraph skill diff workgraph-manual --json
List supported optional integrations:
workgraph integration list --json
Install by integration ID (extensible pattern for future integrations):
workgraph integration install clawdapus \
--actor agent-architect \
--json
Refresh from upstream later (or use the integration clawdapus alias):
workgraph integration install clawdapus --force --actor agent-architect --json
@versatly/workgraph is execution coordination only.
decisions/, people/, projects/ memory workflows), qmd semantic retrieval pipelines, observer/reflector memory compression.This split keeps the workgraph package focused, portable, and shell-agent-native.
workgraph init ./coordination-space --json
thread, space, custom types).workgraph command-center --output "ops/Command Center.md" --json
import { registry, thread, store, ledger, workspace } from '@versatly/workgraph';
workspace.initWorkspace('/tmp/wg');
registry.defineType('/tmp/wg', 'milestone', 'Release checkpoint', {
thread_refs: { type: 'list', default: [] },
target_date: { type: 'date' },
}, 'agent-architect');
const t = thread.createThread('/tmp/wg', 'Build Auth', 'JWT and refresh flow', 'agent-lead');
thread.claim('/tmp/wg', t.path, 'agent-worker');
thread.done('/tmp/wg', t.path, 'agent-worker', 'Shipped');
From this directory:
pnpm run ci
pnpm publish --access public
See SKILL.md for the full operational playbook optimized for autonomous agents (including pi-mono compatibility guidance).
FAQs
Agent-first workgraph workspace for multi-agent coordination with dynamic primitives, append-only ledger, and markdown-native storage.
The npm package @versatly/workgraph receives a total of 94 weekly downloads. As such, @versatly/workgraph popularity was classified as not popular.
We found that @versatly/workgraph demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
TeamPCP is targeting security tools across the OSS ecosystem, turning scanners and CI pipelines into infostealers to access enterprise secrets.

Security News
TypeScript 6.0 introduces new standard APIs, modern default settings, and deprecations as it prepares projects for the upcoming TypeScript 7.0 release.

Security News
/Research
Newly published Trivy Docker images (0.69.4, 0.69.5, and 0.69.6) were found to contain infostealer IOCs and were pushed to Docker Hub without corresponding GitHub releases.