conductor-ai-code-agent
Advanced tools
An AI coding harness with a 14-gate flow, 22 roles and 31 skills — Node.js/TypeScript reimplementation of conductor-ai-code-agent-main.
An AI coding harness with a 14-gate flow, 22 roles and 31 skills. This is the Node.js/TypeScript implementation of Conductor — the global CLI
cdt(aliasconductor) — a faithful port of the Python originalconductor-main.
Version 0.7.3 · Node.js ≥ 20 · TypeScript (strict) · CommonJS ·
conductor-ai-code-agent on npm
Conductor conducts an AI coding agent through a 14-gate flow — from domain discovery and specification through implementation, security, and penetration testing — using a crew of 22 roles (each paired 1:1 with a skill), 31 skills, and 6 turn-time rules. It works in two complementary modes:
cdt chat / cdt auto), and
loads roles/skills/flow natively. Works with API keys or keyless
local models (Ollama, llama.cpp, LM Studio, vLLM) — no key at all.Why both exist is economic and ethical: the only legitimate way to use a subscription (Claude Max / ChatGPT) is through the provider's own licensed CLI. Conductor never impersonates another application's OAuth client to reach a subscription from the native loop — subscriptions go through emission, API keys and local models run natively.
templates/flow.md) — discovery → spec (SDD) → security
by design → architecture/SLOs → test-first → implementation → CI &
supply-chain → validation → app pentest → release readiness →
observability → continuous learning → local pentest (Docker replica) →
VPS/cloud pentest. Each gate has a mandatory protocol, a depth calibration,
and an associated role/model.cdt init/cdt sync:
cdt gate guard (commit-msg hook) — the grounding gate: blocks a
substantive code commit that skipped the library (fail-open by design).cdt gate prepush (pre-push hook) — the landing guard: blocks a push
to develop/main that is missing a mandatory gate
{3, 5, 7, 8, 9}, returning a three-valued verdict
allow / deny / could-not-evaluate — tooling failures surface
loudly, never silently collapse into allow.cdt fs status|calibrate) plus a turn-time rule (no-unverified-completion) that
fires when the assistant claims "done"/"tests passing" without a recorded
verification run since the last write./cdt (interactive, stops for your approval at every
gate), /cdt-intake (the front door: triage + rich spec), /cdt-triage
(unattended loop over CI failures/issues/commits), /cdt-auto (autonomous
gate execution with auto-approve, context monitoring and resume).cdt worktree start [slug] branches a
fresh git worktree off develop for every task, in every harness; cdt worktree finish|prune clean up once merged.tech-lead,
software-engineer, software-architect, security-engineer,
qa-guardian, sdet, ux-designer, ...). The role ↔ skill relation is
1:1 (invariant R7), and the delegation graph (spawns) is a validated
DAG executed by the task tool.self-learning,
quality-baseline, choose-visual-direction, conductor — multi-agent
orchestration across model families, usable standalone) + 5 role
extra_skills (incident-response, supply-chain-security,
secure-coding-patterns, pentest-infrastructure, audit-visual-design).core, grounding-at-commit, no-secrets,
no-unverified-completion, schema-change, test-first. Rules carry
frontmatter (condition, scope, interruptMode, alwaysApply)
evaluated by a turn-time rule engine (TTSR) mid-stream, so a rule fires
while the model is producing prose or a tool call — not after the fact.anthropic, openai, openrouter,
deepseek, groq, mistral, google, xai, zai, moonshot,
together, fireworks, cerebras), 4 keyless local (ollama,
llamacpp, lmstudio, vllm), 1 custom OpenAI-compatible endpoint.agent/loop.ts) — engine that knows nothing of disk,
session or policy; every decision is a callback. One loop serves the main
session, subagents and the advisor.--advisor, read-only) and cross-provider model fallback when the
primary fails.id/parentId) with fork, branch,
undo and compaction (cdt session).src/budget.ts, .cdt/triage.json),
enforced even across subagent delegation.ask_user, and more.cdt init / cdt sync write .cdt/ (stack profile,
build/test/lint/run recipes, memory tree, triage policy) and emit the
adapter files into the chosen target harness.cdt up starts a native stack (an in-process ONNX
embedder + an embedded SQLite vector store, no Docker required) and
ingests a bundled reference corpus (library/) of engineering books. A
Docker path (cdt up --docker) is still available for GPU-accelerated
embedding of the full corpus.cdt journal, JSONL) backed
by a local, polyphonic memory index (vector + graph + fact + temporal
recall, no server to run), and project skills (cdt learn distill writes
to .cdt/skills/ and overrides the built-in of the same name).cdt graph), anonymized fleet insights (cdt fleet), plus
confidence, contradiction, effectiveness, patterns, prediction, risk and
project-similarity modules (src/intelligence/).cdt mcp); external MCP servers can be consumed inside
cdt chat (cdt mcp add ...).cdt doc renders any Markdown file to
docx/pdf; cdt export assembles a gate/session range into a redacted,
shareable deliverable.cdt learn distill distills a reusable skill
from a successful session (automatic on session end);
cdt feedback tells the scaffolder what misfired so it can learn across
projects.cdt doctor (health), cdt config, cdt stats
(token usage/cost by gate/role/model), cdt fs (false-success detection
status/calibration), cdt skill transform|skill-lab (Progressive
Disclosure skill-layout tooling), cdt completions, cdt update,
cdt cleanup-docker.Prerequisite: Node.js ≥ 20.
The simplest path — install the published npm package globally:
npm install -g conductor-ai-code-agent
# exposes both `cdt` and `conductor` on your PATH
cdt version
From source (for contributors, or to track main):
git clone https://github.com/eltonssouza/conductor-ai-code-agent.git
cd conductor-ai-code-agent
npm install
npm run build
npm link # exposes `cdt` and `conductor` on your PATH
Either way, the next step is the same:
cdt up # native RAG stack: no Docker; first run downloads the embedding model (cached after)
# 1. Install (see above), then bring up the reference library.
cdt up
# 2. Enrol a project and emit Conductor into your harness.
cd /path/to/your-project
cdt init # .cdt/ stack, recipes, memory tree + emit (default: claude)
cdt detect # see the project's languages/frameworks
cdt up # re-run FROM the project: ingests its stack books too
# 3. Reload your AI coding harness in that project, then drive a feature:
# /cdt implement <your feature> (interactive — stops at every gate)
Handy along the way:
cdt library "<question>" # ground an answer in the reference books (RAG)
cdt journal recall "<question>" # what this project already decided
cdt sync # after upgrading: refresh an enrolled project
cdt chat --gate 9 --role application-security-engineer # native talk, gate's model + role
In native mode cdt is the harness — it holds its own credentials (or
talks to a keyless local model server), runs its own agent loop, and reads
roles/skills/flow straight from templates/ without emitting anything.
Nothing else needs to be installed.
cdt auth # see which providers are configured
cdt auth login anthropic # or: point --provider at a local server (ollama, vllm, ...)
cdt chat # talk to the model; /login /models /effort inside
cdt chat --gate 9 --role application-security-engineer # gate's model + role, one-off
cdt auto "add rate limiting to the API" # drive the 14 gates autonomously,
# journaled, stops only for a
# required human sign-off
cdt session list|log|branch inspects and forks the append-only session
tree behind every cdt chat/cdt auto run. This is the mode to reach for
when you don't have (or don't want to spend) a Claude/ChatGPT subscription —
bring your own API key, or run fully offline against Ollama/llama.cpp/LM
Studio/vLLM. See
docs/features/en/native-harness.md
and
docs/features/en/auth-providers-models.md.
In emitter mode cdt writes Conductor's roles, skills and flow into
another CLI's own native layout, then gets out of the way — you keep
driving your subscription CLI exactly as you always have, just shaped by
Conductor's gates and roles. Four targets are supported:
| Target | Key | Emitted into |
|---|---|---|
| Claude Code | claude | .claude/ (agents, skills, commands) + CLAUDE.md + .mcp.json |
| Codex | codex | .agents/skills/ (roles + driver as skills) + AGENTS.md + .codex/config.toml |
| Gemini CLI | gemini | .gemini/commands/*.toml (roles + driver + skills) + GEMINI.md + .gemini/settings.json |
| GitHub Copilot | copilot | .github/skills/ (roles + driver as Agent Skills) + .github/copilot-instructions.md + .github/mcp.json |
cdt target list # see what's available
cdt init --target claude # or: codex, gemini, copilot, or a comma list, or "all"
cdt target update codex # switch/re-add a target later without re-enrolling
cdt init --target claude
# writes .claude/agents/<role>.md, .claude/skills/<skill>/SKILL.md,
# .claude/commands/cdt.md (+ cdt-auto.md, cdt-intake.md, cdt-triage.md),
# CLAUDE.md, .mcp.json
Reload Claude Code in the project, then drive work with the emitted slash
commands: /cdt <demand> (interactive), /cdt-intake <demand> (triage +
spec first), /cdt-auto <demand> (autonomous). Roles run as Claude Code
subagents (.claude/agents/); the delegation graph in src/roles.ts
decides who can spawn whom.
cdt init --target codex
# writes .agents/skills/<skill>/SKILL.md (one per role),
# .agents/skills/cdt/SKILL.md (+ cdt-intake/, cdt-auto/, cdt-triage/),
# AGENTS.md, .codex/config.toml
Codex has no native command surface and no per-skill model field, so each
role is delivered as an invokable skill ($cdt, $cdt-intake, ...) and
model/tier selection is carried by the conductor meta-skill instead of a
per-target setting.
Every target follows the same shape: roles/skills/flow land in that
harness's own directories, AGENTS.md or CLAUDE.md becomes the project
guide the harness reads on load, and the driver commands are adapted to
that harness's command dialect (frontmatter format, $name vs /name
invocation, subagents vs skills). Full detail per target:
docs/features/en/dual-mode-emission.md.
| # | Gate | Model role |
|---|---|---|
| 1 | Domain discovery and modeling | plan |
| 2 | Specification as the source of truth (SDD) | plan |
| 3 | Security and privacy by design (shift-left) | slow |
| 4 | Architecture, defensive design, and SLOs | plan |
| 5 | Test-first / executable specification | default |
| 6 | Implementation with clean code | default |
| 7 | Continuous integration, supply chain + quality gate | smol |
| 8 | Validation against the spec (feedback loop) | slow |
| 9 | Application penetration testing | slow |
| 10 | Release readiness & progressive delivery | default |
| 11 | Observability and operation | default |
| 12 | Continuous learning | smol |
| 13 | Local penetration testing (Docker replica) | slow |
| 14 | VPS/cloud penetration testing and hardening | slow |
The model roles (slow / plan / default / smol) decide which model
runs each gate and how hard it works. In the native harness this is an
executed decision; in emission it is delegated to the licensed CLI that
honours the hint. Gates 3, 5, 7, 8 and 9 are mandatory — the landing
guard enforces them at push time.
| Command | What it does |
|---|---|
/cdt-intake <demand> | The front door. Triages the demand — greenfield / feature / bugfix — by risk × complexity × criticality, optionally writes a layman-friendly client-questions document, then a rich spec, and hands off to /cdt. Stops before generating client documents and before handing off. |
/cdt <demand> | The interactive driver. Conducts the demand through the 14 gates, stopping for your approval at every gate — it refuses to run unattended. Calibrates depth, never skips the checkpoint, never collapses gates 3, 5, 7, 8, 9. Gate roles run as subagents. Native equivalent: cdt chat / cdt auto. |
/cdt-triage | The unattended loop (templates/automations/triage.md). Runs on a schedule (e.g. each morning): scans recent CI failures, open issues and commits, records findings to the journal, hands actionable work to maker/checker subagents. Reads .cdt/triage.json (token budget, stop conditions) and runs headless. |
/cdt-auto | Autonomous 14-gate execution with auto-approve, context monitoring and resume. Native equivalent: cdt auto <demand>. |
src/roles.ts — each an agent template under
templates/agents/, each paired 1:1 with a skill. The delegation graph
(spawns) is a validated DAG of known roles (invariant R23).templates/skills/*/SKILL.md — each with a "When to
use" section and numbered steps (invariant R6).templates/rules/ — core.md,
grounding-at-commit.md, no-secrets.md, no-unverified-completion.md,
schema-change.md, test-first.md — always-on/conditional rules that
fire at turn-time via the TTSR engine.Deeper technical documentation of every template, skill and reference-book
category lives under docs/about/.
cdt chat [message] [--gate N] [--role R] [--advisor] # /login, /logout, /models, /effort inside
cdt auto <demand> # drive the 14-gate flow autonomously (native)
cdt session list|log <id> [--all]|branch <id> [--at ENTRY_ID] [--label X]
cdt auth [--all] # providers Conductor knows / which are set
cdt stats [--session <id>] | cdt stats --skills [--by gate|role|skill] [--eru]
cdt skill transform <slug> --to pd|flat [--write]
cdt skill-lab <skill> --trials N --conditions none,flat,pd
cdt fs status|calibrate # false-success detection (CA4)
cdt init [path] [--target spec] | cdt sync [path] | cdt detect [path] | cdt list
cdt worktree start [slug] | list | finish <ref> [--force] | prune
cdt target list|show [path]|update <spec> [path] # emit targets (dual-mode)
cdt library "<question>" | status|stacks|reindex|update|add|export|import|compact
cdt journal add|recall|log # project diary
cdt journal edit <id> [text] --mode update|forget|invalidate
cdt learn distill # distill a skill (auto: SessionEnd)
cdt gate guard|status # grounding hard gate (auto: commit-msg)
cdt gate prepush|land-status # landing guard (auto: pre-push)
cdt rules remind # print this project's turn-time rules
cdt up [--docker] | down [--docker] | ingest # native RAG stack
cdt mcp [status|add|remove|enable|disable|reconnect ...] # MCP server / client config
cdt doc <file.md> [--format docx|pdf|both] # render docx/pdf from markdown
cdt export [--gates N-M] [--kind k1,k2] [--format docx|pdf|html]
cdt graph <entity>|build|stats # knowledge graph
cdt fleet [--save|--json] # cross-project insights
cdt feedback "<...>"|report|list|consent # feedback to the scaffolder
cdt config get|set|validate
cdt sandbox status [--path P] # effective secret guard / sandbox backend
cdt doctor [path] | cdt completions <shell>
cdt dashboard # local web dashboard
cdt update [--reinstall] | cdt cleanup-docker [--yes]
cdt quickstart | version | help
Every command takes cdt <command> --help for options; unknown commands get
a "did you mean ...?" suggestion. Full reference:
docs/features/en/cli-reference.md.
bin/cdt.js CLI entry point (require dist/cli.js)
src/
cli.ts command dispatch, usage, quickstart
agent/ native harness: loop, host, advisor, tui, plain
llm/ providers (anthropic, openai-compatible), catalog,
schema compat, tool-call dialect, JSON streaming
rag/ RAG core, ingestion, stack (native + Docker), portable
export/import
tools/ agent tools: files, shell, search, skills, task,
eval kernels, artifacts, ask_user, ...
targets/ harness emitters: claude, codex, gemini, copilot
intelligence/ knowledge graph, fleet, code-aware RAG, confidence,
contradiction, effectiveness, patterns, predict, risk
session.ts append-only session tree (fork/branch/undo)
journal.ts per-project diary (JSONL)
ttsr.ts turn-time rule engine
gate.ts grounding hard gate (commit-msg hook)
gate_land.ts landing guard (pre-push hook, three-valued verdict)
redact.ts secret redaction layer
budget.ts token/currency budget
project.ts enrolment, .cdt/ config, home/profile resolution
+ auth, credentials (DPAPI), oauth, detect, docgen, export, learn,
feedback, doctor, mcp client/server, update, worktree, ...
templates/ harness-neutral surfaces: agents, skills, rules,
commands, automations, flow.md, e2e/api test starters
library/ bundled reference corpus — core, language-agnostic
categories only (02–09). Language/framework books are
fetched on demand from a separate repo (see rag/remote.ts)
docs/ feature docs (en + pt-BR), technical docs (about/),
ADRs, specs, security threat models, QA reports
tests/ vitest suites (ports of the Python original's tests)
tools/ repo dev-tooling: template validator, benchmarks
infra/ Docker compose: conductor (legacy --docker RAG path)
Technical documentation for tools/, infra/, library/ and templates/
lives under docs/about/.
Requires Node.js ≥ 20.
npm install # install dependencies
npm run build # tsc -> dist/
npm run dev # run the CLI from source via tsx (src/cli.ts)
npm test # vitest run (tests/surfaces, e2e_init, budget, ...)
npm run test:watch # vitest watch
npm run lint # eslint src tests
npm run typecheck # tsc --noEmit
The test suite is hermetic: it redirects CONDUCTOR_HOME to a temp dir and
needs no Docker or network to pass.
All dependency versions are pinned exact (no ^/~ ranges; .npmrc sets
save-exact=true) — see CHANGELOG.md for version-bump
notes and known/accepted deprecation warnings from transitive dependencies.
This is a deliberate, line-by-line port of the Python conductor-main, and
most of its behaviour is verified by ported tests and a full parity audit
(kept alongside the workspace). MCP tools invocable mid-turn in interactive
cdt chat, isolated-worktree subagents, and HNSW indexing in the RAG core —
once the audit's headline gaps — are now implemented and covered by tests
(tests/chat_cmd_mcp_wiring.test.ts, src/agent/host.ts's spawn({isolated: true}), tests/rag_hnsw.test.ts). Remaining gaps live in the parity audit
itself; contributions to close them are welcome.
docs/about/) — what's
actually in tools/, infra/, library/ and templates/, file by file.conductor-main — the
Python original this project ports.conductor-library / conductor-viewer — the reference corpus and its
viewer, part of the Conductor ecosystem.Portuguese: um guia em português dos recursos está em docs/features/pt-BR.
FAQs
An AI coding harness with a 14-gate flow, 22 roles and 31 skills — Node.js/TypeScript reimplementation of conductor-ai-code-agent-main.
The npm package conductor-ai-code-agent receives a total of 128 weekly downloads. As such, conductor-ai-code-agent popularity was classified as not popular.
We found that conductor-ai-code-agent demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.
Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.
Security News
pnpm 12 rewrites the package manager in Rust, cutting install times by up to 90% while preserving pnpm 11 workflows and lockfiles.