
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
dev-workflows
Advanced tools
Define rules once. Compile them everywhere.
A local-first CLI to define AI coding rules, slash commands, templates, and hooks — compiled for every editor and agent.
npx dev-workflows init
devw add typescript/strict
devw compile
Or bootstrap a full spec-driven workflow:
devw init --preset spec-driven -y
.dwf/rules/*.yml → devw compile → CLAUDE.md
.cursor/rules/devworkflows.mdc
GEMINI.md
.windsurf/rules/devworkflows.md
.github/copilot-instructions.md
.dwf/assets/commands/* → devw compile → .claude/commands/*.md
.dwf/assets/templates/* → devw compile → docs/specs/*.md
.dwf/assets/hooks/* → devw compile → .claude/settings.local.json
You define rules in YAML and assets in Markdown/JSON. The compiler generates each editor's native format. Change a rule, recompile — every editor stays in sync.
| Command | Description |
|---|---|
devw init | Initialize a .dwf/ ruleset in your project |
devw init --preset <name> | Initialize with a preset (e.g., spec-driven) |
devw add <category>/<name> | Install a rule from the registry |
devw add command/<name> | Install a slash command |
devw add template/<name> | Install a spec template |
devw add hook/<name> | Install an editor hook |
devw add preset/<name> | Install a preset (bundle of rules + assets) |
devw remove <category>/<name> | Remove a rule or asset |
devw compile | Generate editor configs and deploy assets |
devw watch | Watch .dwf/ and recompile on changes |
devw doctor | Validate config and detect drift |
devw list rules | List all active rules |
devw list assets | List installed assets |
devw list tools | List configured editors |
Install rules from the registry with devw add <category>/<rule>.
| Rule | Description |
|---|---|
typescript/strict | Strict TypeScript patterns |
javascript/react | React component and hook conventions |
javascript/nextjs | Next.js App Router best practices |
css/tailwind | Utility-first styling conventions |
testing/vitest | Test naming and structure rules |
security/supabase-rls | Database security and RLS rules |
security/auth-patterns | Authentication best practices |
frontend/design-guidelines | UI/UX design conventions |
frontend/accessibility | Accessibility (a11y) rules |
frontend/performance | Frontend performance patterns |
workflow/git-conventions | Git commit and branch conventions |
workflow/debugging | Systematic debugging methodology |
workflow/spec-driven | Spec-driven development workflow |
Beyond rules, dev-workflows manages assets — slash commands, templates, and hooks that power AI workflows.
| Asset | Type | Description |
|---|---|---|
command/spec | Command | Generate a feature spec through guided questions |
command/plan | Command | Create an implementation plan from a spec |
command/build | Command | Execute a plan step by step with verification |
command/learn | Command | Capture a lesson learned as a project rule |
template/feature-spec | Template | Markdown template for feature specifications |
hook/auto-format | Hook | Auto-format files after AI edits |
Presets bundle rules and assets into a single install.
| Preset | Includes |
|---|---|
preset/spec-driven | workflow/spec-driven rule + all 4 commands + feature-spec template + auto-format hook |
Bridges generate editor-compatible rule files. One adapter per tool.
| Tool | Output |
|---|---|
| Claude Code | CLAUDE.md |
| Cursor | .cursor/rules/devworkflows.mdc |
| Gemini CLI | GEMINI.md |
| Windsurf | .windsurf/rules/devworkflows.md |
| VS Code Copilot | .github/copilot-instructions.md |
Issues and PRs welcome. If you find a bug or have an idea, open an issue.
MIT
FAQs
CLI that compiles developer rules into editor-specific config files
We found that dev-workflows demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.