
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
Aitri β Agent-agnostic SDLC CLI. Works with Claude Code, Codex, Gemini Code, Opencode.
Agent-agnostic CLI that turns any idea into a production-ready app through a 5-phase pipeline.
Works with: Claude Code Β· Codex Β· Gemini Code Β· Opencode Β· any bash-capable agent.
npm install -g aitri
You provide the idea. Aitri orchestrates agents through 5 phases. You approve each artifact before moving forward. Every decision is documented, every requirement traced.
YOUR IDEA (IDEA.md)
β
[optional] Phase Discovery β Facilitator β 00_DISCOVERY.md
β
[optional] Phase UX β UX/UI Designer β 01_UX_SPEC.md
β
Phase 1 β Product Manager β 01_REQUIREMENTS.json
β (you approve)
Phase 2 β Software Architect β 02_SYSTEM_DESIGN.md
β (you approve)
Phase 3 β QA Engineer β 03_TEST_CASES.json
β (you approve)
Phase 4 β Full-Stack Dev β src/ + tests/ + 04_IMPLEMENTATION_MANIFEST.json
β (you approve)
[optional] Phase review β Code Reviewer β 04_CODE_REVIEW.md
β
β¦ VERIFY β 04_TEST_RESULTS.json β gate: all tests must pass
β
Phase 5 β DevOps β Dockerfile + 05_PROOF_OF_COMPLIANCE.json
β
App running on localhost
aitri init Initialize project β creates IDEA.md
aitri run-phase <1-5|discovery|ux|review> Output phase briefing to stdout (agent reads this)
aitri run-phase <phase> --feedback "" Re-run with feedback after a rejection
aitri complete <phase> Validate artifact + record phase as complete
aitri approve <phase> Approve phase output, unlock next phase
aitri reject <phase> --feedback "" Reject with feedback (re-run with aitri run-phase)
aitri verify-run Run tests, auto-parse output, write 04_TEST_RESULTS.json
aitri verify-run --e2e Also run Playwright tests (requires playwright.config.js)
aitri verify-run --coverage-threshold <N> Enforce minimum line coverage % (node --test runners)
aitri verify-complete Gate: all TCs pass + FR coverage β unlocks Phase 5
aitri status Show pipeline status with ASCII UI
aitri validate Validate all artifacts present and approved
aitri --version Show version
# 1. Create a project directory and initialize
mkdir my-app && cd my-app
aitri init
# 2. Describe your project in IDEA.md
# (Edit the file β what does the app do? Who uses it? What are the key features?)
# 3. Run Phase 1 β agent generates structured requirements
aitri run-phase 1
# 4. Agent saves 01_REQUIREMENTS.json β you validate it
aitri complete 1
# 5. Review 01_REQUIREMENTS.json. Approve or reject.
aitri approve 1
# or
aitri reject 1 --feedback "Need more security requirements and a reporting module"
# 6. If rejected, re-run with feedback applied
aitri run-phase 1 --feedback "Need more security requirements and a reporting module"
# 7. Repeat complete β approve for phases 2, 3, 4
# 8. After Phase 4 is approved, run tests automatically
aitri verify-run # runs tests, parses output, writes 04_TEST_RESULTS.json
aitri verify-run --e2e # also run Playwright e2e tests
aitri verify-run --coverage-threshold 80 # enforce 80% line coverage
aitri verify-complete # gate: fails if any TC fails or any FR is uncovered
# 9. Phase 5 unlocked β deployment
aitri run-phase 5
aitri complete 5
aitri approve 5
# 10. Validate entire pipeline
aitri validate
| Phase | Persona | Artifact | Format |
|---|---|---|---|
| discovery (optional) | Discovery Facilitator | 00_DISCOVERY.md | Markdown |
| ux (optional) | UX/UI Designer | 01_UX_SPEC.md | Markdown |
| 1 | Product Manager | 01_REQUIREMENTS.json | JSON |
| 2 | Software Architect | 02_SYSTEM_DESIGN.md | Markdown |
| 3 | QA Engineer | 03_TEST_CASES.json | JSON |
| 4 | Full-Stack Developer | 04_IMPLEMENTATION_MANIFEST.json | JSON |
| review (optional) | Code Reviewer | 04_CODE_REVIEW.md | Markdown |
| β¦ verify-run | Aitri (auto) | 04_TEST_RESULTS.json | JSON |
| 5 | DevOps Engineer | 05_PROOF_OF_COMPLIANCE.json | JSON |
{
"project_name": "My App",
"project_summary": "...",
"functional_requirements": [
{
"id": "FR-001",
"title": "User Login",
"description": "...",
"priority": "MUST",
"type": "security",
"acceptance_criteria": ["returns 401 on invalid token"],
"implementation_level": "present|functional|complete|production_ready"
}
],
"user_personas": [
{ "role": "End User", "tech_level": "low|mid|high", "goal": "...", "pain_point": "..." }
],
"user_stories": [
{
"id": "US-001",
"requirement_id": "FR-001",
"as_a": "user", "i_want": "to login", "so_that": "I can access my data",
"acceptance_criteria": [
{ "id": "AC-001", "given": "user exists in DB", "when": "POST /login with valid credentials", "then": "status 200, JWT token returned" }
]
}
],
"non_functional_requirements": [
{ "id": "NFR-001", "category": "Performance|Security|Reliability|Scalability|Usability", "requirement": "p99 < 200ms", "acceptance_criteria": "..." }
],
"no_go_zone": ["No admin panel", "No OAuth β email/password only"],
"constraints": [],
"technology_preferences": []
}
Validation rules:
functional_requirementsnon_functional_requirementstype (UX|persistence|security|reporting|logic)acceptance_criteria[] with at least 1 measurable entryno_go_zone must have β₯3 items{
"test_plan": { "strategy": "...", "coverage_goal": "80%", "test_types": ["unit","integration","e2e"] },
"test_cases": [
{
"id": "TC-001",
"requirement_id": "FR-001",
"user_story_id": "US-001",
"ac_id": "AC-001",
"title": "Login β valid credentials",
"type": "unit|integration|e2e",
"scenario": "happy_path|edge_case|negative",
"priority": "high|medium|low",
"given": "user exists with email=test@example.com",
"when": "POST /auth/login { email: 'test@example.com', password: 'Pass1!' }",
"then": "status 200, body contains { token: <JWT> }",
"steps": ["POST /auth/login with valid email+password"],
"expected_result": "Returns 200 + JWT token",
"test_data": {}
}
]
}
Validation rules:
e2e testsgiven/when/then must use concrete values β SPEC-SEALED rule{
"files_created": ["src/index.js", "src/db.js"],
"setup_commands": ["npm install", "npm test"],
"environment_variables": [{ "name": "DATABASE_URL", "default": "postgres://localhost/dev" }],
"technical_debt": [
{ "fr_id": "FR-003", "substitution": "HTML table instead of Chart.js", "reason": "library conflict", "effort_to_fix": "medium" }
],
"test_runner": "npm test",
"test_files": ["tests/unit.test.js", "tests/integration.test.js"]
}
Validation rules:
files_created must be non-emptytechnical_debt field is required (use [] if no substitutions made)test_runner is required β exact command to run all teststest_files is required β files containing @aitri-tc markers, used by verify-runWritten automatically by aitri verify-run β agent never writes this file.
{
"executed_at": "2026-03-11T12:00:00Z",
"test_runner": "npm test",
"results": [
{ "tc_id": "TC-001", "status": "pass|fail|skip", "notes": "" }
],
"fr_coverage": [
{ "fr_id": "FR-001", "tests_passing": 3, "tests_failing": 0, "status": "covered|partial|uncovered" }
],
"summary": { "total": 10, "passed": 10, "failed": 0, "skipped": 0 }
}
Gate rules (aitri verify-complete):
fr_coverage with β₯1 passing testfail results β any failure blocks Phase 5uncovered FRs{
"project": "My App",
"version": "1.0.0",
"phases_completed": [1, 2, 3, 4, 5],
"overall_status": "compliant|partial|draft",
"requirement_compliance": [
{ "id": "FR-001", "title": "User Login", "level": "complete", "evidence": "TC-001, TC-002, TC-003 pass" }
],
"technical_debt_inherited": []
}
Compliance levels: placeholder (blocks pipeline) Β· functionally_present Β· partial Β· complete Β· production_ready
aitri verify-run enforces quality beyond just pass/fail:
assert.*/expect() call as low-confidence warningsfr_coverage with β₯1 passing test; blocks verify-complete if gap detected--coverage-threshold N enforces minimum line coverage (Node 22+)--e2e runs Playwright as a second runner when playwright.config.js exists; TC results merged automaticallyTest naming convention (required for auto-detection):
it('TC-001: description of what is tested', () => {
// @aitri-tc TC-001
assert.equal(result, expected);
});
If an agent produces a phase that doesn't meet your standards:
# Reject with specific feedback
aitri reject 2 --feedback "The data model is missing the audit log table required by NFR-002"
# Re-run β the briefing includes your feedback
aitri run-phase 2 --feedback "The data model is missing the audit log table required by NFR-002"
# Validate the new artifact
aitri complete 2
# Approve when satisfied
aitri approve 2
Each phase receives only the fields it needs from previous artifacts. This reduces agent token consumption 40β60% per phase:
| Phase | Receives from Phase 1 | Receives from Phase 3 |
|---|---|---|
| 2 (Architect) | id, title, priority, type, acceptance_criteria | β |
| 3 (QA) | id, title, priority, type, acceptance_criteria | β |
| 4 (Dev) | id, title, priority, type, acceptance_criteria | id, title, type, priority |
| 5 (DevOps) | id, title, priority, type, acceptance_criteria | summary, fr_coverage, failed_tests |
Phase 4 also receives a Requirements Snapshot (compact FR list) directly in the briefing β independent of context truncation, resistant to drift.
.aitri config. Reproducible in CI/CD.fs, path, url, child_process). Works anywhere Node 18+ is installed.aitri run-phase prints the briefing. Any agent reads stdout. No agent-specific integration needed.aitri complete validates schema and compliance before recording a phase as done.verify-run runs real tests and parses β/β TC-XXX patterns from runner output. Agent never self-reports results.technical_debt field is absent or generic.aitri approve with an interactive checklist. No phase auto-advances.Any agent that can:
aitri complete <n> when doneTested with: Claude Code Β· Codex CLI Β· Gemini Code Β· Opencode
Apache 2.0 β Β© CΓ©sar Augusto Reyes Serrano
FAQs
Aitri β Agent-agnostic SDLC CLI. Works with Claude Code, Codex, Gemini Code, Opencode.
We found that aitri demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.Β It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.