
Research
/Security News
11 Malicious NuGet Tools Pose as Game Cheats to Drop a Windows Host-Surveillance Payload
11 malicious NuGet tools pose as game cheats to deploy Windows payloads, track hosts, and use Google Sheets for telemetry and control.
cc-codeconductor
Advanced tools
A multi-agent orchestration framework for AI-assisted software engineering workflows.
Stop prompting. Start orchestrating.
CodeConductor is an open-source framework for building structured, reproducible AI-assisted software engineering workflows.
It helps developers and teams coordinate specialized agents for planning, implementation, testing, documentation, and review — using versioned agent contracts, task cards, and risk-based routing.
[!IMPORTANT]
Current Scope
What works today:
npx cc-codeconductor init— detects project stack, writes.codeconductor/config.yml, copiescouncil.ymlandpolicy.ymlinto.codeconductor/presets/npx cc-codeconductor install council --target <opencode|claude|codex|agy|all>— generates and writes preset files; supports--globalto install to~/.opencode/,~/.claude/,~/.codex/,~/.agents/npx cc-codeconductor install lsp --target <opencode|claude|codex|gemini|cursor|agy|all>— installs LSP servers and configures AI coding tools; auto-detects project languages or use--langto overridenpx cc-codeconductor detect— detects project stack and recommends presetsnpx cc-codeconductor doctor— validates configuration and installed runner directoriesnpx cc-codeconductor update— re-applies the council preset for the configured targetnpx cc-codeconductor seo audit --url <url>— runs a comprehensive SEO audit on a single page (meta tags, schema.org, GEO readiness) and generates a markdown reportnpx cc-codeconductor seo audit --sitemap <url>— batch audits all URLs from a sitemap.xml with rate limiting and SSRF preventionnpx cc-codeconductor seo llms --sitemap <url>— generates allms.txtfile for AI-search readiness from sitemap contentnpx cc-codeconductor help(alias:cc-help) — shows preset inventory (skills, subagents, commands) for the active or specified targetnpx cc-codeconductor debt-harvest(alias:harvest) — scans source files for// defercomments and writes.codeconductor/debt-ledger.mdnpx cc-codeconductor goal "<objective>"(alias:cc-goal) — decomposes an objective into a dependency-ordered task graph, writes.codeconductor/current-goal.yml/cc-pagespeed --url <url>— audits web performance using the PageSpeed Insights API; applies the 80/20 principle to produce a prioritized report of Core Web Vitals (LCP, TBT, CLS, FCP, TTFB) with framework-specific fixes; requiresPAGESPEED_API_KEYenv var for full CrUX field data (optional but recommended)npx cc-codeconductor install preset --target <opencode|claude|codex|agy|all>— installs the full preset (agents, prompts, skills, commands, settings) for the chosen runner; use--locale=esto inject Spanish-aware instructions into agent files, or rely on the locale saved duringinit- Stack-specific presets (v0.4.0):
ts-next-drizzle,spring-kotlin-jpa,laravel-tall,python-data-api— bundlearchitect+implementercontracts tuned to a single framework soinstall presetdrops in the right defaults for that stack.- 9 specialized skills (v0.4.0):
drizzle-schema-architect,tailwind-responsive-auditor,seo-analytics-injector,jpa-nplusone-detector,spring-auth-auditor,livewire-alpine-bridge,fastapi-pydantic-strict,tdd-mutation-tester,auth-token-inspector— loaded automatically by the matching preset.- Workflow Loop Core (v0.4.0) — 8-phase pipeline (
intake → structure → design → test → implement → validate → council → compact) with operational guardrails (wall-clock timeout, max files modified, max lines changed) and human-in-the-loop STOP gates after Design and Council Verdict.- Council consensus v0.4.0 — agent confidence thresholds (
< 0.6per-agent or< 0.7average escalates) and acomplianceVetochannel that overrides majority the same waysecurityVetodoes.- Goal orchestration (v0.4.0) —
goalplanner writes.codeconductor/current-goal.yml; the orchestrator delegates tasks in dependency order and blocks dependents when a prerequisite isblocked.- Memory compression + escalation emitter (v0.4.0) — Phase 5 memory index
- token budget hook keeps inter-agent context below the configured budget; the loop controller emits escalation reports when guardrails fire.
- Parallel subagents (v0.4.0) — risk-based routing policy v0.4.0 enables parallel execution for eligible agent sequences (architect + implementer pattern, council verdict fan-out).
- Manual presets for OpenCode, Claude Code, and Codex
- Versioned Agent Contracts
- Routing Policy documentation
- Task Card, Scorecard, and workflow templates
- Spring Boot/Kotlin and Python/Django workflow guidance
See docs/v0.4.0-release-notes.md for the full v0.4.0 feature breakdown.
What does not exist yet:
- Runtime sandbox enforcement
- Policy compiler
- Automated agent evaluation
- Safe Merger
Security note:
CodeConductor currently provides declarative policies and documented guardrails. It does not yet enforce OS-level isolation, shell sandboxing, or runtime permission boundaries by itself. Treat all agent execution as dependent on the capabilities and limitations of the target tool.
Most AI coding workflows fail because they treat the model as a developer.
CodeConductor treats models as specialized workers inside a controlled engineering system. It defines:
This is not a prompt collection. It is a workflow framework.
| Concept | Name in CodeConductor |
|---|---|
| Structured request | Task Card |
| Flow decision | Route |
| Specialized agent | Conductor Agent |
| Decision rules | Routing Policy |
| Versioned prompts | Agent Contracts |
| Reusable knowledge | Skills |
| Evaluable output | Deliverable |
| Agent metrics | Scorecard |
Task Card → Risk Classification → Routing Policy → Conductor Agent → Deliverable → Scorecard
AgentContract abstraction with target renderers for Claude, OpenCode, Codex, and AgycouncilConsensus()) for multi-agent governance with majority/unanimous algorithms, security veto, compliance veto, and agent confidence thresholds (v0.4.0)runWorkflowPipeline) with wall-clock / files-modified / lines-changed guardrails and STOP gates at Design and Council Verdictts-next-drizzle, spring-kotlin-jpa, laravel-tall, python-data-apigoal planner + goal-state writer feed the orchestrator's dependency-order delegation loop# Requires Bun ≥1.0 or Node ≥20.11
bun run src/cli/main.ts --help
# or after build:
# node dist/index.js --help
init — initialize CodeConductor in a projectnpx cc-codeconductor init # detect stack, write .codeconductor/config.yml
npx cc-codeconductor init --force # overwrite existing config
npx cc-codeconductor init --global # write to ~/.codeconductor/
npx cc-codeconductor init --dry-run # preview without writing
npx cc-codeconductor init --locale=es # set Spanish as the instruction language
npx cc-codeconductor init --locale=en # set English (default)
On first run, init copies council.yml and policy.yml into
.codeconductor/presets/ so you can customize them without touching framework
files. install reads from there first.
[!IMPORTANT]
--localeis remembered. Once you runinit --locale=es, the value is saved to.codeconductor/config.yml. Every subsequentinstall presetwill automatically use that locale — no need to repeat the flag. To change it, runinit --locale=en --forceor editdefaults.localein your config.
detect — detect project stacknpx cc-codeconductor detect
npx cc-codeconductor detect --output json
Output:
Detected:
- languages: javascript, typescript
- runtimes: node, bun
- frameworks: ...
install preset — install full agent presetnpx cc-codeconductor install preset --target opencode # project-level
npx cc-codeconductor install preset --target claude
npx cc-codeconductor install preset --target codex
npx cc-codeconductor install preset --target agy # antigravity cli
npx cc-codeconductor install preset --target all # all targets
npx cc-codeconductor install preset --target claude --global # write to ~/.claude/
npx cc-codeconductor install preset --target all --global
npx cc-codeconductor install preset --target claude --locale=es # override locale once
npx cc-codeconductor install preset --target all --dry-run # preview
npx cc-codeconductor install preset --target claude --force # overwrite
Locale resolution order (first match wins):
--locale flag on the command linedefaults.locale in .codeconductor/config.yml (set by init --locale)en (built-in default)Files installed per target:
| Target | Notable files |
|---|---|
claude | .claude/CLAUDE.md, .claude/settings.json, .claude/agents/ |
opencode | .opencode/agents/, .opencode/commands/, .opencode/skills/ |
codex | .codex/AGENTS.md, .codex/skills/, .codex/prompts/ |
With --global, files are written under ~/ instead of ./.
Four stack-specific presets now ship in presets/ and are registered in
src/core/presets/preset-registry.ts. Each one bundles a tuned
architect.md and implementer.md for a single stack, plus the matching
specialized skills (see below).
| Preset | Stack | Contracts included |
|---|---|---|
ts-next-drizzle | Next.js / Astro, Tailwind, Drizzle ORM, Bun, Postgres | architect, implementer |
spring-kotlin-jpa | Spring Boot, Kotlin/Java, Gradle, JPA, Hibernate | architect, implementer |
laravel-tall | Laravel, Blade, Livewire, Alpine.js | architect, implementer |
python-data-api | Python, FastAPI, Django, uv | architect, implementer |
// Programmatic access via the registry
import { listPresets, getPreset } from 'cc-codeconductor/core/presets/preset-registry';
listPresets();
// [
// { name: 'council', version: '0.1.0', ... },
// { name: 'seo-hotel', version: '0.3.0', ... },
// { name: 'ts-next-drizzle', version: '0.4.0', ... },
// { name: 'spring-kotlin-jpa', version: '0.4.0', ... },
// { name: 'laravel-tall', version: '0.4.0', ... },
// { name: 'python-data-api', version: '0.4.0', ... },
// ]
const next = getPreset('ts-next-drizzle');
init / detect identifies the stack from the project and wires the
matching specialized skills automatically when you run install preset.
The full set of assets for a stack-specific preset is in
presets/<preset-name>/agents/ — copy them manually if you need to apply a
preset by name.
install council — install council specnpx cc-codeconductor install council --target opencode # project-level
npx cc-codeconductor install council --target claude
npx cc-codeconductor install council --target codex
npx cc-codeconductor install council --target agy # antigravity cli
npx cc-codeconductor install council --target all # all targets
npx cc-codeconductor install council --target claude --global # write to ~/.claude/
npx cc-codeconductor install council --target opencode --global
npx cc-codeconductor install council --target all --global
npx cc-codeconductor install council --target opencode --dry-run # preview
npx cc-codeconductor install council --target opencode --force # overwrite
install lsp — install and configure LSP serversnpx cc-codeconductor install lsp --target opencode # auto-detect languages
npx cc-codeconductor install lsp --target all # all AI tools
npx cc-codeconductor install lsp --target claude --lang typescript,python # explicit languages
npx cc-codeconductor install lsp --target all --global # global install + global configs
npx cc-codeconductor install lsp --target cursor --dry-run # preview
npx cc-codeconductor install lsp --target all --force # overwrite existing configs
Supported languages: TypeScript, PHP, Python via Pyright, Kotlin. Supported targets: opencode, claude, codex, gemini, cursor, agy.
doctor — validate configurationnpx cc-codeconductor doctor
Checks config exists and is valid, reports runner directory status, validates that AGENTS.md and CLAUDE.md do not exceed the 40KB size limit, and checks if updates are available for installed presets, target runner configurations, or skills.
update — smart update presetnpx cc-codeconductor update
npx cc-codeconductor update --force
npx cc-codeconductor update --dry-run
npx cc-codeconductor update --global
Smart updates all currently installed target presets, council configurations, and skills (from skills-lock.json), preserving user edits outside managed blocks. Also validates that AGENTS.md and CLAUDE.md do not exceed the 40KB size limit.
help — show preset inventorynpx cc-codeconductor help # show inventory for active target
npx cc-codeconductor help --target claude # show inventory for specific target
npx cc-codeconductor cc-help # alias
npx cc-codeconductor help --output json # machine-readable output
Lists the skills, subagents, commands, and workflows available in the active
preset. Reads from presets/<target>/ in the project root.
debt-harvest — collect deferred debt itemsnpx cc-codeconductor debt-harvest # scan src/ for // defer comments
npx cc-codeconductor debt-harvest --dir lib # scan a different directory
npx cc-codeconductor harvest # alias
npx cc-codeconductor debt-harvest --output json
Scans source files for // defer - [reason] comments and consolidates them
into .codeconductor/debt-ledger.md, grouped by optional tag
(// defer - reason --tag). Read-only on source files; only writes the ledger.
Supported extensions: .ts, .tsx, .js, .jsx, .go, .rs, .java,
.kt, .swift, .cs, .php, .scala, .dart, .c, .cpp, .h, .hpp.
goal — decompose objective into task graphnpx cc-codeconductor goal "Add user authentication"
npx cc-codeconductor goal "Implement CRUD for invoices"
npx cc-codeconductor cc-goal "Add search with filters" # alias
npx cc-codeconductor goal "Add user authentication" --output json
Matches the objective against built-in templates (auth, crud, search,
notification, migration) or falls back to a generic 4-task chain. Writes the
resulting task graph to .codeconductor/current-goal.yml with dependency
ordering. The orchestrator uses this file to delegate tasks in dependency order.
| Flag | Description |
|---|---|
--force | Overwrite existing files |
--dry-run | Preview actions without writing |
--global | Target home directory instead of project |
--output json | Machine-readable JSON output |
--locale=en | Agent instruction language: en (default) or es |
init creates .codeconductor/:
.codeconductor/
├── config.yml # project settings, target, locale, preset versions
└── presets/
├── council.yml # customizable copy of the council preset
└── policy.yml # customizable copy of policy rules
Key fields in config.yml:
defaults:
target: opencode # default runner for install/update
locale: es # instruction language injected into agent files
Edit .codeconductor/presets/council.yml to add, remove, or reconfigure agents
before running install.
Each preset includes a YAML configuration file in src/presets/models/ that
defines which models are used for each agent role:
src/presets/models/
├── opencode.yml # model defaults for OpenCode target
├── claude.yml # model defaults for Claude target
└── codex.yml # model defaults for Codex target
Agent template files contain placeholders replaced during install:
| Placeholder | Description |
|---|---|
{{MODEL_CLAUDE}} | Model for the Claude provider |
{{MODEL_OPENCODE}} | Model for the OpenCode provider |
{{MODEL_CODEX}} | Model for the Codex provider |
{{LANGUAGE_INSTRUCTIONS}} | Locale-aware instruction injected by locale |
To customize models, edit the YAML file for your target before running
install. Each file maps agent roles to provider-specific model names.
--locale)Agent markdown files (CLAUDE.md, AGENTS.md, README.md) include a
{{LANGUAGE_INSTRUCTIONS}} placeholder that is replaced at install time based
on the active locale:
| Locale | Injected instruction |
|---|---|
en | Prose/docs/code comments: be terse and direct. Prefer concrete nouns over abstract ones. Omit filler phrases. One idea per sentence. |
es | Spanish prose/docs/reports/Markdown: preserve natural Spanish orthography, including accents, ñ, ¿, ¡, and normal Unicode. The ASCII-only editing preference does not apply to these artifacts. |
The locale is sticky: set it once with init --locale=es and every
subsequent install preset will use it automatically. Override per-run with
install preset --locale=en.
# One-time setup
npx cc-codeconductor init --locale=es
# All future installs use Spanish automatically
npx cc-codeconductor install preset --target=claude
npx cc-codeconductor install preset --target=all --global
# Override just this run
npx cc-codeconductor install preset --target=claude --locale=en
# Change the saved locale
npx cc-codeconductor init --locale=en --force
codeconductor/
├── README.md
├── LICENSE
├── CHANGELOG.md
├── ROADMAP.md
├── SECURITY.md
├── policy.yml ← declarative policy model
│
├── src/ ← CLI source (TypeScript + Bun)
│ ├── cli/ ← entry point, router, error codes
│ ├── commands/ ← init, detect, install, doctor, update
│ ├── core/ ← config, detection, filesystem, presets, goal
│ │ ├── context/ ← scoped context injection (Phase 5)
│ │ ├── compaction/ ← TDD history compaction hook (Phase 5)
│ │ ├── messages/ ← concise inter-agent formatter (Phase 5)
│ │ └── loop/ ← compile-fix loop controller (Phase 5)
│ ├── adapters/ ← opencode, claude, codex generators
│ ├── domain/council/ ← council spec, agent, contract
│ ├── domain/loop/ ← loop state machine
│ ├── validation/ ← Zod schemas
│ ├── utils/ ← Result type, logger, invariant
│ └── presets/council/ ← bundled council.yml preset
│
├── test/
│ ├── cli.test.ts ← integration tests (32 tests)
│ └── fixtures/ ← bun, node, django, spring projects
│
├── docs/
│ ├── architecture.md
│ ├── security-model.md
│ ├── cli-contract.md
│ ├── policy-schema.md
│ ├── routing-policy.md
│ ├── task-card-template.md
│ ├── agent-scorecard.md
│ └── guides/
│
├── presets/ ← manual preset files (pre-CLI)
│ ├── opencode/
│ └── claude/
│
└── examples/
└── spring-boot-kotlin/
| Version | Focus |
|---|---|
| v0.2.0 | CLI: init, detect, install, doctor, update — shipped ✅ |
| v0.3.0 | Next.js, FastAPI, generic presets, monorepo support |
| v0.4.0 | Workflow Loop Core, stack-specific presets, 9 specialized skills, confidence thresholds + compliance veto in council consensus, goal orchestration, memory compression — shipped ✅ |
| v0.5.0 | Scorecard CLI, task outcome tracking, prompt regression |
| v1.0.0 | Stable contracts, stable routing, documented evaluation |
See ROADMAP.md for details.
See CONTRIBUTING.md.
MIT — see LICENSE.
FAQs
A multi-agent orchestration framework for AI-assisted software engineering workflows.
The npm package cc-codeconductor receives a total of 825 weekly downloads. As such, cc-codeconductor popularity was classified as not popular.
We found that cc-codeconductor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
11 malicious NuGet tools pose as game cheats to deploy Windows payloads, track hosts, and use Google Sheets for telemetry and control.

Research
/Security News
4 compromised asyncapi packages deliver miasma botnet loader on macOS, Linux and Windows.

Research
/Security News
A compromised jscrambler npm release added a malicious preinstall hook that runs hidden native binaries on Linux, macOS, and Windows.