
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
claude-yes
Advanced tools
A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.
A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses. Originally designed for Claude CLI, now supports multiple AI coding assistants. Rewritten in Rust for improved performance and reliability.
⚠️ Important Security Warning: Only run this on trusted repositories. This tool automatically responds to prompts and can execute commands without user confirmation. Be aware of potential prompt injection attacks where malicious code or instructions could be embedded in files or user inputs to manipulate the automated responses.
ESC or Ctrl+C/tmp/agent-yes-YYYYMMDDHHMMSSXXX.stdin for additional input streamsInstall the AI CLI tool(s) you want to use:
npm install -g @anthropic-ai/claude-code
Learn more: https://www.anthropic.com/claude-code
# Install Gemini CLI (if available)
# Check Google's documentation for installation instructions
# Install Codex CLI (if available)
# Check Microsoft's documentation for installation instructions
# Install GitHub Copilot CLI
# Check GitHub's documentation for installation instructions
# Install Cursor agent CLI
# Check Cursor's documentation for installation instructions
npm install -g @vibe-kit/grok-cli
Learn more: https://github.com/vibe-kit/grok-cli
npm install -g @augmentcode-inc/auggie-cli
Learn more: https://www.augmentcode.com/
Then install this project:
npm install agent-yes -g
claude-yes [--exit-on-idle=60s] [tool-command] [prompts]
Claude (default):
claude-yes -- run all tests and commit current changes
bunx claude-yes "Solve TODO.md"
Other AI tools:
# Use Codex directly
codex-yes -- refactor this function
# Use Grok directly
grok-yes -- help me with this code
# Use Copilot directly
copilot-yes -- generate unit tests
# Use Cursor directly
cursor-yes -- optimize performance
# Use Gemini directly
gemini-yes -- debug this code
# Use Auggie directly
auggie-yes -- analyze code patterns
claude-yes "help me with this code"
claude-yes "optimize performance"
Auto-exit when idle (useful for automation):
claude-yes --exit-on-idle=60s "run all tests and commit current changes"
Alternative with claude-code-execute:
claude-code-execute claude-yes "your task here"
You can run agent-yes in a Docker container with all AI CLI tools pre-installed.
Pull the image:
# From GitHub Container Registry (recommended)
docker pull ghcr.io/snomiao/agent-yes:latest
# Or from Docker Hub
docker pull snomiao/agent-yes:latest
Basic usage:
# Run with Claude (default)
docker run --rm -v $(pwd):/workspace -w /workspace \
ghcr.io/snomiao/agent-yes:latest \
-- run all tests
# Run with other AI tools
docker run --rm -v $(pwd):/workspace -w /workspace \
ghcr.io/snomiao/agent-yes:latest \
--cli=gemini -- debug this code
Persisting credentials:
To persist API keys and configuration across container runs, mount the config directories:
# For Claude
docker run --rm \
-v $(pwd):/workspace \
-v ~/.config/claude:/root/.config/claude \
-v ~/.anthropic:/root/.anthropic \
-w /workspace \
ghcr.io/snomiao/agent-yes:latest \
-- help me with this code
# For multiple AI tools (mount all config directories)
docker run --rm \
-v $(pwd):/workspace \
-v ~/.config:/root/.config \
-v ~/.anthropic:/root/.anthropic \
-v ~/.openai:/root/.openai \
-v ~/.cursor:/root/.cursor \
-w /workspace \
ghcr.io/snomiao/agent-yes:latest \
--cli=claude -- optimize performance
Complete example with environment variables:
# Pass API keys via environment variables
docker run --rm \
-v $(pwd):/workspace \
-e ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY \
-e OPENAI_API_KEY=$OPENAI_API_KEY \
-e GOOGLE_API_KEY=$GOOGLE_API_KEY \
-w /workspace \
ghcr.io/snomiao/agent-yes:latest \
-- refactor this module
# Or use an env file
docker run --rm \
-v $(pwd):/workspace \
--env-file .env \
-w /workspace \
ghcr.io/snomiao/agent-yes:latest \
--exit-on-idle=60s -- run all tests and commit
Docker Compose example:
version: "3.8"
services:
agent-yes:
image: ghcr.io/snomiao/agent-yes:latest
volumes:
- .:/workspace
- ~/.config/claude:/root/.config/claude
- ~/.anthropic:/root/.anthropic
working_dir: /workspace
environment:
- ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
command: ["--", "help me solve all todos"]
Available platforms:
linux/amd64 (x86_64)linux/arm64 (aarch64)Cloud deployment:
For deploying to cloud platforms like Google Cloud Run, AWS, Azure, see Cloud Deployment Guide.
| Tool | CLI Name | Description | Installation/Update |
|---|---|---|---|
| Claude | claude | Anthropic's Claude Code (default) | npm install -g @anthropic-ai/claude-code@latest |
| Gemini | gemini | Google's Gemini CLI | npm install -g @google/gemini-cli@latest |
| Codex | codex | OpenAI's Codex CLI | npm install -g @openai/codex-cli@latest |
| Copilot | copilot | GitHub Copilot CLI | npm install -g @github/copilot@latest |
| Cursor | cursor | Cursor agent CLI | See https://cursor.com/ja/docs/cli/installation |
| Grok | grok | Vibe Kit's Grok CLI | npm install -g @vibe-kit/grok-cli@latest |
| Qwen | qwen | Alibaba's Qwen Code CLI | npm install -g @qwen-code/qwen-code@latest |
| Auggie | auggie | Augment Code's Auggie CLI | npm install -g @augmentcode-inc/auggie-cli@latest |
The tool will:
--exit-on-idle flag, automatically exit when the tool becomes idlePros:
Cons:
Pros:
Cons:
Pros:
Cons:
Pros:
Cons:
Pros:
Cons:
Pros:
Cons:
Pros:
Cons:
Pros:
Cons:
--cli=<tool>: Specify which AI CLI tool to use (claude, gemini, codex, copilot, cursor, grok, qwen, auggie). Defaults to claude.--exit-on-idle=<seconds>: Automatically exit when the AI tool becomes idle for the specified duration. Useful for automation scripts.--use-skills: Automatically discover and prepend SKILL.md headers from the directory hierarchy (walks from current directory up to git root). Multiple SKILL.md files are merged with most specific first. Particularly useful to bring Claude Skills-like context to non-Claude agents such as Codex or Gemini. Supports nested skills for monorepos.On Linux systems, agent-yes automatically creates a named pipe (FIFO) for additional input streams. This allows you to send input to the CLI from multiple sources simultaneously.
How it works:
/tmp/agent-yes-YYYYMMDDHHMMSSXXX.stdinExample usage:
# Terminal 1: Start the CLI
claude-yes "help me with my code"
# Output will show: [claude-yes] Created FIFO at /tmp/agent-yes-20260109123456abc.stdin
# Terminal 2: Send additional input via the FIFO
echo "also check the tests" > /tmp/agent-yes-20260109123456abc.stdin
This feature is useful for:
You can also use this as a library in your Node.js projects:
import claudeYes from "claude-yes";
// Use Claude
await claudeYes({
prompt: "help me solve all todos in my codebase",
cli: "claude",
cliArgs: ["--verbose"],
exitOnIdle: 30000, // exit after 30 seconds of idle
continueOnCrash: true,
logFile: "claude.log",
});
// Use other tools
await claudeYes({
prompt: "debug this function",
cli: "gemini",
exitOnIdle: 60000,
});
// Use Auggie
await claudeYes({
prompt: "analyze code patterns",
cli: "auggie",
exitOnIdle: 60000,
});
The tool uses node-pty to spawn and manage AI CLI processes, with a sophisticated pattern-matching system that:
Each supported CLI has its own configuration defining:
--search to Codex)node-pty or bun-pty - For spawning and managing AI CLI processesfrom-node-stream - Stream processing utilitiessflow - Functional stream processingterminal-render - Terminal rendering and text processingphpdie - Error handling utilitiesThis project was inspired by: Claude Code full auto while I sleep : r/ClaudeAI
MIT
FAQs
A wrapper tool that automates interactions with various AI CLI tools by automatically handling common prompts and responses.
The npm package claude-yes receives a total of 2,219 weekly downloads. As such, claude-yes popularity was classified as popular.
We found that claude-yes demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.