
Security News
Rust 1.100 Will Add Dependency Cooldowns to Cargo
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.
Vibe coding toolkit for Claude Code and Codex. Enforces a structured workflow: interview → plan → build → ship.
npx esperkit
| Command | What it does |
|---|---|
/esper:init <prompt> | Interview → write constitution → define phase → create backlog → install hooks |
/esper:backlog | Show pending and active plans sorted by priority |
/esper:plan <prompt> | Interview → add a feature plan to the current phase backlog |
/esper:fix <prompt> | Interview → add a bug fix plan with its own branch and PR |
/esper:apply [item] | Select a plan, get todo list approved, then implement with milestone commits |
/esper:continue | Resume an interrupted build from where it left off |
/esper:finish | Verify → commit remaining changes → archive plan to done/ |
/esper:ship | Push → open PR → archive phase when all plans are done |
/esper:phase | Archive current phase, bump phase number, interview for next phase scope |
/esper:yolo | Implement all pending phase plans automatically, committing at milestones |
npx esperkit # install skills globally
/esper:init "I want to build X"
Interviews you, writes a constitution, defines Phase 1 with acceptance criteria, creates a backlog of plans, and installs hooks.
Next phase — when Phase N is done:
/esper:phase
Archives completed plans, bumps the phase number, interviews you about the new scope, and populates the backlog.
Bug fix — any time:
/esper:fix "login button broken"
Scoped interview → fix plan on its own branch. Ships its own standalone PR.
/esper:plan "add rate limiting"
Interviews you, explores the codebase, and writes a detailed plan file in pending/. All feature plans share the phase branch and are batched into one phase PR.
/esper:backlog # review the queue
Option A — one at a time:
/esper:apply [item] # select plan, approve todo list, then implement
/esper:continue # resume if the session was interrupted
Option B — autopilot:
/esper:yolo # implement all pending phase plans automatically
/esper:finish
Runs verification, commits remaining changes, and archives the plan to done/. Repeat Steps 3–5 for each plan in the phase.
/esper:ship
Pushes the branch and opens a PR. When all phase plans are done, opens the phase PR and archives the phase — then go back to Step 2.
| Type | Branch | PR |
|---|---|---|
feature | feature/<phase> — shared by all phase features | One phase PR when all plans are done |
fix | fix/<slug> — own branch | Standalone PR on /esper:ship |
Use /esper:plan to add features and /esper:fix to log bugs. The type is set automatically.
.esper/
├── esper.json # config: backlog mode, commands, current phase
├── CONSTITUTION.md # vision, tech decisions, testing strategy
├── phases/
│ └── phase-1.md # MVP scope and acceptance criteria
├── plans/
│ ├── pending/ # queued backlog items
│ ├── active/ # currently being built (max 1)
│ ├── done/ # finished items (current phase, not yet shipped)
│ └── archived/ # shipped items from completed phases
└── hooks/
├── verify-quick.sh # runs lint + typecheck after every file edit
└── session-reminder.sh # reminds about uncommitted changes on stop
.claude/
└── settings.json # Claude Code hooks config (merged, not overwritten)
During /esper:init you choose how to manage the backlog:
.esper/plans/. Works offline, no dependencies.gh issues. Requires gh CLI and a remote repo./esper:finish and /esper:ship run full verification before proceeding. Failures block progress.FAQs
Vibe coding workflow & toolkit for Claude Code and Codex
The npm package esperkit receives a total of 1 weekly downloads. As such, esperkit popularity was classified as not popular.
We found that esperkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.