
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
commit-story
Advanced tools
Automatically capture not just what you built, but why it mattered and how you solved it.
Commit Story transforms your git commits into rich journal entries by combining:
Every commit triggers a background process that creates a narrative record of your development work - no workflow interruption, just automatic documentation that captures the real story.
For yourself:
For your career:
For your team:
Important: Run all commands from your git repository root directory.
All commands below work the same on macOS, Windows, and Linux. Run them from your project root directory.
npm install --save-dev commit-story
Note: This will overwrite any existing .git/hooks/post-commit file in this repository. If you have other post-commit hooks in this repo, you'll need to merge them manually.
npx commit-story-init
This command:
.env file with a placeholder for your OpenAI API key (if one doesn't exist).env, node_modules/, and journal/ to your .gitignore (if not already present)Edit the .env file in your project root and uncomment/add your API key:
OPENAI_API_KEY=your-api-key-here
That's it! Your next git commit will automatically generate a journal entry in the journal/entries/ directory.
Here's what a journal entry looks like after you commit some development work:
journal/entries/2025-09/2025-09-05.md## 9:46:42 AM CDT - Commit: 1502704e
### Summary - 1502704e
The developer created a new PRD for restructuring the prompts used in the system. They analyzed successful prompt patterns from existing commands and proposed applying the same step-based principles to avoid format-first antipatterns that could lead to lower quality outputs.
### Development Dialogue - 1502704e
**Human:** "Look at prompts that consistently work well for me like /prd-create and /prd-next. I'm considering whether the Technical Decisions section prompt needs to be updated to follow steps to prevent AI from skipping ahead."
**Human:** "I like this except I want two additional things: an analysis step to make sure no critical bit gets lost, and before/after tests on multiple commits with human approval."
### Technical Decisions - 1502704e
- **DECISION: Step-Based Prompt Architecture PRD Creation** (Discussed)
- Restructuring prompts to follow successful patterns
- Emphasis on preventing AI from skipping critical analysis steps
- Inclusion of mandatory human approval testing
### Commit Details - 1502704e
**Files Changed**: prds/1-automated-git-journal-system.md, prds/4-step-based-prompt-architecture.md
**Lines Changed**: ~213 lines
**Message**: "feat(prd-4): create step-based prompt architecture PRD"
Each entry captures what you built, why it mattered, and the key conversations that led to your decisions.
Commit Story creates a commit-story.config.json file automatically during installation. You can modify it to change the behavior:
Edit commit-story.config.json in your project root:
debug: Set to true to see journal generation output during commits. Set to false (default) to run silently in background.For any issue, start by enabling debug mode to see exactly what's happening:
commit-story.config.json and set "debug": trueThe debug output will show you:
🪝 Git Hook: Commit Story starting)⚙️ Config loaded, 🚀 Main app started)🔍 Collecting context..., 💬 Claude: Found X messages)✅ OpenAI connectivity confirmed)🤖 Generating journal sections...)Hook not running at all:
commit-story.config.json file.git/hooks/post-commit)Hook runs but no journal created:
.env fileCan't find journal entries:
journal/entries/YYYY-MM/YYYY-MM-DD.md.gitignore by default (private)To fully remove Commit Story:
npx commit-story-remove
This removes the post-commit hook from .git/hooks/post-commit and optionally deletes the commit-story.config.json file.
npm uninstall commit-story
Your journal entries in the journal/ directory are preserved.
Important: Remove the hook BEFORE uninstalling the package. If you already ran npm uninstall, you'll need to manually delete .git/hooks/post-commit.
Commit Story includes a Model Context Protocol (MCP) server that lets Claude Code add reflections to your journal during development sessions.
The MCP server provides a journal_add_reflection tool that Claude Code can use to capture your thoughts, decisions, and insights in real-time. These reflections are automatically included in your commit journal entries.
Create a .mcp.json file in your project root:
{
"mcpServers": {
"commit-story": {
"type": "stdio",
"command": "node",
"args": [
"node_modules/commit-story/src/mcp/server.js"
]
}
}
}
Once configured, you can ask Claude Code to add reflections during your development:
"Add a reflection: I thought of this idea and I want to jot it down
so I don't forget! What if we bypass the orchestration layer altogether
and call the service directly? Could reduce latency by 50%."
Reflections are saved with timestamps to journal/entries/YYYY-MM/YYYY-MM-DD.md for easy access, and are automatically included in your commit journal entries when you commit. This captures those "aha!" moments and design ideas as they happen, creating a continuous development narrative.
Tip: Your journal entries are perfect for catching up. Try asking Claude Code: "Read my journal and summarize what I worked on yesterday"
FAQs
Automated Git Journal System with AI Assistant Context Integration
We found that commit-story demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.