
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
Make codex, gemini-cli, or any other coding agent into an RLM.
# npm / bun
bunx coderlm@latest
npx coderlm@latest
# pypi
uvx coderlm
pipx run coderlm
Or install globally:
npm i -g coderlm # npm
uv tool install coderlm # pypi
coderlm <agent> --prompt "<task>" [--max-depth N] [--allowedTools TOOLS]
# Codex
coderlm codex --prompt "Find all TODO comments in src/"
coderlm codex --prompt "Find dead code in src/, lib/, and test/"
coderlm codex --prompt "Summarize the codebase" --max-depth 2
# Gemini
coderlm "bunx --bun @google/gemini-cli" --prompt "Review **/*.py for security issues"
coderlm "bunx --bun @google/gemini-cli" --prompt "Architecture overview of src/"
# Claude (non-recursive only — Claude cannot spawn nested Claude sessions)
coderlm claude --prompt "Fix type errors in src/" --allowedTools "Bash,Edit"
BASH_ENV so every bash subshell the agent spawns has output truncation activeThe agent starts with no file contents in context. It uses shell tools (fd, rg, cat, head, jq, etc.) to discover and inspect files as needed. For large file sets (>20 files), it spawns recursive sub-agents on subsets.
bashrlm.sh is bundled and auto-activates for every agent run. It wraps high-output commands (cat, grep, rg, jq, find, ls, curl, etc.) with automatic truncation, preventing the agent from flooding its own context window with oversized output.
Truncation uses head+tail mode — the agent sees the start and end of any large output, with the middle omitted:
[TRUNCATED — showing 2000 of 15000 chars, first and last 1000]
Guards are redirect-aware: piping to a file (> /tmp/out.txt) bypasses truncation, so multi-step processing works naturally. The agent's system prompt includes instructions for this pattern.
| Agent | Command | Notes |
|---|---|---|
| OpenAI Codex | codex | Recommended — supports recursive sub-agents |
| Google Gemini | bunx --bun @google/gemini-cli | Supports recursive sub-agents |
| Claude Code | claude | Non-recursive only — cannot spawn nested Claude sessions |
| Any CLI | my-agent | Combined prompt passed as single argument |
FAQs
Make codex, gemini-cli, or any other coding agent into an RLM.
We found that coderlm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.