
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
@versatly/workgraph
Advanced tools
Agent-first workgraph workspace for multi-agent coordination with dynamic primitives, append-only ledger, and markdown-native storage.
Agent-first workgraph workspace for multi-agent collaboration.
@versatly/workgraph is the standalone coordination core for multi-agent execution. It focuses only on:
thread, space, decision, lesson, fact, agent, plus custom types).workgraph/ledger.jsonl).workgraph/ledger-index.json) for fast ownership queries.workgraph/ledger-chain.json)--space)workgraph command-center)workgraph skill write/load/propose/promote).base filesworkgraph status/brief/checkpoint/intake)workgraph lens list/show) for real-time situational awarenessworkgraph query ...)workgraph search ...)workgraph board generate|sync)workgraph graph index|hygiene|neighborhood|impact|context|edges|export)workgraph dispatch ...) with explicit status transitionsworkgraph trigger fire ...) with idempotency keyingNo memory-category scaffolding, no qmd dependency, no observational-memory pipeline.
npm install @versatly/workgraph
Or global CLI:
npm install -g @versatly/workgraph
# Initialize pure workgraph workspace
workgraph init ./wg-space --json
# Define custom primitive
workgraph primitive define command-center \
--description "Agent ops cockpit" \
--fields owner:string \
--fields panel_refs:list \
--json
# Create and route thread work
workgraph thread create "Ship command center" \
--goal "Production-ready multi-agent command center" \
--priority high \
--actor agent-lead \
--json
workgraph thread next --claim --actor agent-worker --json
workgraph status --json
workgraph brief --actor agent-worker --json
workgraph lens list --json
workgraph lens show my-work --actor agent-worker --json
workgraph query --type thread --status open --limit 10 --json
workgraph search "auth" --mode auto --json
workgraph checkpoint "Completed API layer" --next "implement tests" --actor agent-worker --json
workgraph board generate --output "ops/Workgraph Board.md" --json
workgraph graph hygiene --json
workgraph graph neighborhood ship-feature --depth 2 --json
workgraph graph impact ship-feature --json
workgraph graph context ship-feature --budget 2000 --json
workgraph graph edges ship-feature --json
workgraph graph export ship-feature --depth 2 --format md --json
workgraph dispatch create "Review blockers" --actor agent-lead --json
workgraph dispatch mark run_123 --status succeeded --output "Review complete" --actor agent-lead --json
workgraph dispatch create-execute "Close all ready threads in platform space" \
--actor agent-lead \
--agents agent-a,agent-b,agent-c \
--space spaces/platform \
--json
workgraph trigger fire triggers/escalate-blocked.md --event-key "thread-blocked-001" --actor agent-lead --json
workgraph onboarding update onboarding/onboarding-for-agent-architect.md --status paused --actor agent-lead --json
workgraph mcp serve -w /path/to/workspace --actor agent-ops --read-only
workgraph ledger show --count 20 --json
workgraph command-center --output "ops/Command Center.md" --json
workgraph bases generate --refresh-registry --json
All commands support --json and emit:
{ "ok": true, "data": ... }{ "ok": false, "error": "..." } (non-zero exit)This is intended for robust parsing by autonomous agents.
The repository is now organized as a workspaces monorepo while preserving the
published @versatly/workgraph package compatibility surface.
Key workspace packages:
packages/kernelpackages/clipackages/sdkpackages/control-apipackages/runtime-adapter-corepackages/adapter-cursor-cloudpackages/policypackages/testkitpackages/search-qmd-adapterpackages/obsidian-integrationpackages/skillsMigration notes: see docs/MIGRATION.md.
Generate the large Obsidian demo workspace used for stress-testing:
npm run demo:workspace
npm run demo:obsidian-setup
Runbook: docs/OBSIDIAN_DEMO.md.
workgraph thread create "Implement auth middleware" \
--goal "Protect private routes" \
--space spaces/backend.md \
--actor agent-api \
--json
workgraph thread list --space spaces/backend --ready --json
workgraph thread next --space spaces/backend --claim --actor agent-api --json
.base files from primitive registry# Sync .workgraph/primitive-registry.yaml
workgraph bases sync-registry --json
# Generate canonical primitive .base files
workgraph bases generate --json
# Include non-canonical (agent-defined) primitives
workgraph bases generate --all --refresh-registry --json
# Build/refresh graph index first (optional but useful)
workgraph graph index --json
# Multi-hop neighborhood around a primitive slug/path
workgraph graph neighborhood ship-feature --depth 2 --json
# Reverse-link blast radius (what references this primitive)
workgraph graph impact ship-feature --json
# Auto-assemble markdown context bundle within token budget (chars/4)
workgraph graph context ship-feature --budget 2000 --json
# Inspect typed relationship edges for one primitive
workgraph graph edges ship-feature --json
# Export a markdown subgraph for handoff/sharing
workgraph graph export ship-feature --depth 2 --format md --json
workgraph ledger query --actor agent-worker --op claim --json
workgraph ledger blame threads/auth.md --json
workgraph ledger verify --strict --json
# with shared vault env (e.g. tailscale-mounted path)
export WORKGRAPH_SHARED_VAULT=/mnt/tailscale/company-workgraph
workgraph skill write "workgraph-manual" \
--body-file ./skills/workgraph-manual.md \
--owner agent-architect \
--actor agent-architect \
--json
workgraph skill propose workgraph-manual --actor agent-reviewer --space spaces/platform --json
workgraph skill promote workgraph-manual --actor agent-lead --json
workgraph skill load workgraph-manual --json
workgraph skill list --updated-since 2026-02-27T00:00:00.000Z --json
workgraph skill history workgraph-manual --limit 10 --json
workgraph skill diff workgraph-manual --json
List supported optional integrations:
workgraph integration list --json
Install by integration ID (extensible pattern for future integrations):
workgraph integration install clawdapus \
--actor agent-architect \
--json
Refresh from upstream later (or use the integration clawdapus alias):
workgraph integration install clawdapus --force --actor agent-architect --json
@versatly/workgraph is execution coordination only.
decisions/, people/, projects/ memory workflows), qmd semantic retrieval pipelines, observer/reflector memory compression.This split keeps the workgraph package focused, portable, and shell-agent-native.
workgraph init ./coordination-space --json
thread, space, custom types).workgraph command-center --output "ops/Command Center.md" --json
import { registry, thread, store, ledger, workspace } from '@versatly/workgraph';
workspace.initWorkspace('/tmp/wg');
registry.defineType('/tmp/wg', 'milestone', 'Release checkpoint', {
thread_refs: { type: 'list', default: [] },
target_date: { type: 'date' },
}, 'agent-architect');
const t = thread.createThread('/tmp/wg', 'Build Auth', 'JWT and refresh flow', 'agent-lead');
thread.claim('/tmp/wg', t.path, 'agent-worker');
thread.done('/tmp/wg', t.path, 'agent-worker', 'Shipped');
From this directory:
npm run ci
npm publish --access public
See SKILL.md for the full operational playbook optimized for autonomous agents (including pi-mono compatibility guidance).
FAQs
Agent-first workgraph workspace for multi-agent coordination with dynamic primitives, append-only ledger, and markdown-native storage.
The npm package @versatly/workgraph receives a total of 111 weekly downloads. As such, @versatly/workgraph popularity was classified as not popular.
We found that @versatly/workgraph demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.