
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A full-stack web application for orchestrating AI-powered code workflows with a unified interface for multiple AI agents (Claude Code, Codex, Cursor, Gemini).
A full-stack web application for orchestrating AI-powered code workflows with a unified interface for multiple AI agents (Claude Code, Codex, Cursor, Gemini).
Agent Workflows Web UI is a React 19 + Vite frontend with a Fastify backend and SQLite database, providing:
apps/app/
├── src/
│ ├── client/ # React frontend
│ │ ├── pages/ # Page components (Projects, Sessions, Files, Shell, Git)
│ │ ├── components/ # Reusable UI components
│ │ ├── hooks/ # Custom React hooks
│ │ ├── lib/ # Client utilities
│ │ └── store/ # Zustand state management
│ ├── server/ # Fastify backend
│ │ ├── routes/ # API endpoints (auth, projects, sessions, git)
│ │ ├── services/ # Business logic
│ │ ├── websocket/ # WebSocket handlers
│ │ └── middleware/ # Auth, logging, error handling
│ ├── shared/ # Shared types and utilities
│ └── cli/ # Node CLI tool for setup
├── prisma/
│ └── schema.prisma # Database schema
├── tests/ # Vitest unit tests
└── e2e/ # Playwright E2E tests
Clone the repository (if not already done)
git clone <repository-url>
cd agentcmd-monorepo-v2
Install dependencies
pnpm install
Set up the development environment
cd apps/app
pnpm dev:setup
This will:
.env file from .env.example with a secure JWT secretprisma/dev.dbAfter setup, edit .env to add optional configuration:
# Optional
ANTHROPIC_API_KEY=your-anthropic-api-key # For AI-powered session naming
LOG_LEVEL=info
PORT=4100
VITE_PORT=4101
Start the development server (runs both Vite dev server and Fastify backend):
pnpm dev
This starts:
Individual dev servers:
pnpm dev:client # Vite dev server only
pnpm dev:server # Fastify server only
Kill dev servers:
pnpm dev:kill # Kill processes on ports 4100 and 4101
Build for production:
pnpm build
This compiles:
dist/cli.js)dist/prisma/)# 1. Build the application
pnpm build
# 2. Set production environment variables
export NODE_ENV=production
export JWT_SECRET=$(openssl rand -base64 32)
export DATABASE_URL="file:/path/to/production/database.db"
# 3. Run Prisma migrations
pnpm prisma:migrate
# 4. Start the server
node dist/server/index.js
The server will serve both the API and the built frontend from dist/client/.
# 1. Build the application
pnpm build
# 2. Create a tarball for distribution
pnpm pack
# 3. Install globally from the tarball
npm install -g ./repo-web-*.tgz
# 4. Run the install command to set up database and config
agentcmd-ui install
# 5. (Optional) Edit configuration
vim ~/.agents/agentcmd-ui-config.json
# 6. Start the application
agentcmd-ui start
This creates:
~/.agent/database.db~/.agents/agentcmd-ui-config.jsonFor production deployment, ensure these are set:
# Required
export JWT_SECRET="your-secure-random-secret" # Generate with: openssl rand -base64 32
export NODE_ENV="production"
# Optional overrides
export PORT=4100
export HOST=0.0.0.0 # To allow external connections
export DATABASE_URL="file:/var/lib/agentcmd/database.db"
export LOG_LEVEL=warn
export ALLOWED_ORIGINS="https://your-domain.com"
# Run all tests
pnpm test
# Run tests in watch mode
pnpm test:watch
# Run tests with UI
pnpm test:ui
# Run all checks (lint + type-check + tests)
pnpm check
# Generate Prisma client (after schema changes)
pnpm prisma:generate
# Create and apply migrations
pnpm prisma:migrate
# Open Prisma Studio (database GUI)
pnpm prisma:studio
The package includes a CLI tool (agentcmd-ui) for easy installation and management.
# Install globally from npm
npm install -g @repo/web
agentcmd-ui install
# Or run directly from dist without installing
pnpm build
node apps/app/dist/cli.js install
~/.agent/database.db~/.agents/agentcmd-ui-config.json📖 For complete CLI documentation, see CLI.md
claude - Claude Codecodex - OpenAI Codexcursor - Cursor (planned)gemini - Google Gemini (planned)POST /api/auth/register - Register new userPOST /api/auth/login - Login and get JWT tokenGET /api/auth/me - Get current userGET /api/projects - List all projectsPOST /api/projects - Create new projectGET /api/projects/:id - Get project detailsPATCH /api/projects/:id - Update project (star, hide)DELETE /api/projects/:id - Delete projectGET /api/sessions - List sessions (filterable by project)POST /api/sessions - Create new sessionGET /api/sessions/:id - Get session detailsDELETE /api/sessions/:id - Delete sessionGET /api/git/status - Git status for projectPOST /api/git/commit - Create commitGET /api/git/branches - List branchesPOST /api/git/pr - Create pull requestws://localhost:4100/ws/chat - Real-time chat streaming{
type: 'message',
sessionId: string,
content: string,
agentType: 'claude' | 'codex' | 'cursor' | 'gemini'
}
// Streaming events
{ type: 'turn.started', sessionId: string, turnId: string }
{ type: 'text', sessionId: string, text: string }
{ type: 'tool.started', sessionId: string, tool: string }
{ type: 'tool.completed', sessionId: string, tool: string, result: any }
{ type: 'turn.completed', sessionId: string }
// Error events
{ type: 'error', message: string }
| Variable | Required | Default | Description |
|---|---|---|---|
JWT_SECRET | Yes | - | Secret key for signing JWT tokens (use openssl rand -base64 32) |
ANTHROPIC_API_KEY | No | - | Anthropic API key for AI session naming |
LOG_LEVEL | No | info | Logging level: trace, debug, info, warn, error, fatal |
LOG_FILE | No | ./logs/app.log | Path to log file |
PORT | No | 4100 | Fastify server port |
HOST | No | 127.0.0.1 | Fastify server host |
VITE_PORT | No | 4101 | Vite dev server port |
ALLOWED_ORIGINS | No | http://localhost:4101 | CORS allowed origins (comma-separated) |
NODE_ENV | No | development | Environment: development, production, test |
DATABASE_URL | No | file:./prisma/dev.db | SQLite database path |
import { useEffect, useState } from 'react')CLAUDE.mdpnpm prisma:generatepnpm prisma:migratesrc/shared/types.tsWhen adding response fields, update both:
200: projectResponseSchema)pnpm dev:kill # Kill processes on ports 4100 and 4101
# Reset and recreate database
rm prisma/dev.db
pnpm dev:setup
# Or manually run migrations only
pnpm prisma:migrate
# View database in Prisma Studio
pnpm prisma:studio
# Clean and rebuild
rm -rf dist/
pnpm build
pnpm check before committing[Your License Here]
FAQs
A full-stack web application for orchestrating AI-powered code workflows with a unified interface for multiple AI agents (Claude Code, Codex, Cursor, Gemini).
We found that agentcmd demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.