
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
A /goal operating system for Codex and Claude Code: Scout/Judge/Worker boards with visual board surfaces, receipts, and verification.
A simple operating loop for long /goal runs.
GoalBuddy helps Codex and Claude Code stay oriented during long coding tasks.
It gives /goal a small local workspace: a charter, a board, notes, receipts, and a clear next task. The work stays in your repo, so a run can pause, resume, verify, and keep going without re-inventing the plan every turn.
Run one command:
npx goalbuddy
Restart Codex or Claude Code.
Then prepare a goal:
$goal-prep
In Claude Code, use:
/goal-prep
Goal Prep creates the board and prints the exact /goal command to run next. That is the whole path.
docs/goals/<your-goal>/
goal.md
state.yaml
notes/
goal.md says what you want.
state.yaml tracks the board.
notes/ keeps longer findings out of the main thread.
rough idea -> goal prep -> /goal -> scout -> judge -> worker -> receipt -> verify
Scout maps the repo.
Judge chooses the next bounded slice.
Worker changes code and leaves a receipt.
/goal keeps the loop honest until the original goal is actually done.
When a new GoalBuddy version ships:
npx goalbuddy update
That updates both Codex and Claude Code.
GoalBuddy can open a local board while the work is running, so you can see the plan, active task, receipts, and verification status without digging through the chat.
GoalBuddy is MIT licensed and published on npm.
The implementation lives in this repo, but the happy path is intentionally tiny: install it, run Goal Prep, then let /goal work from the generated files.
For release process details, see RELEASE.md.
MIT
FAQs
A goal operating loop for Codex and Claude Code: goal oracles, local boards, receipts, and verification.
The npm package goalbuddy receives a total of 66 weekly downloads. As such, goalbuddy popularity was classified as not popular.
We found that goalbuddy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.