
Product
Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
A PRD in. Reviewed pull requests out — or a production release with the evidence to prove it shipped.
A charrette is an intense, deadline-bound work session that has to end in a reviewed deliverable. That is what this does: it staffs a fleet of Claude agents against your assignment, holds them to acceptance criteria, and stops at exactly two decision points that are yours — approve the plan, and merge the pull request. It never merges for you.
This package is the CLI, and it is the supported way to use Charrette. The
@charrette/* packages it depends on are published so the CLI can install, not
as a stable API.
npm install -g charrette # or: npx charrette run
cd ~/code/my-app # the repo you want built
charrette run
Requires Node ≥ 22.13 — node:sqlite backs the run store, and it is only
available unflagged from 22.13 (and 23.4) on.
charrette run doesThat is the whole command — no assignment, no flags. The target repo, the deterministic checks, the budget caps and the dashboard all resolve to safe defaults, and the banner prints what each resolved to, and why, before anything is spent:
repo /Users/you/code/my-app
checks pnpm run typecheck · pnpm run lint · pnpm run test (auto-detected from package.json scripts via pnpm)
budget run $30 · task $10 (defaults)
intake conversation before planning (default)
dashboard http://127.0.0.1:4777/#a1b2… (the fragment is your auth token)
Then it asks what to build — and keeps asking until the answer is buildable. Intake and specification agents turn the brief into executable requirements; a planner builds a task DAG; you approve the plan; workers implement tasks in isolated git worktrees and adversarial QA checks them. Review mode stops at reviewed PRs. Explicit production mode follows the release through merge, named deployment jobs, deployed-revision verification and production acceptance.
Merging remains manual unless you explicitly authorize --auto-merge; GitHub
protections still apply.
Solo builders and small teams already living in Claude Code, who want to hand off whole features rather than functions, and would rather supervise a board than babysit a terminal.
Do not use it if you need a framework for building agents — that is LangGraph, CrewAI or the Agent SDK directly. Also skip it if you cannot run repositories you trust: until OS sandboxing lands, agents run with broad local permissions. See SECURITY.md.
Cost, measured: ~$2 per merged task on a small greenfield repo, ~$21 on a large brownfield service. A hard run budget cap means it cannot run away with your money.
Pre-release (v0.0 walking skeleton + v0.1 dashboard). Usable; not yet 1.0.
Built on the Claude Agent SDK.
MIT © Yoni Ryabinski
FAQs
Charrette CLI: a PRD in, reviewed pull requests out
We found that charrette demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.

Security News
Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.

Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.