New Research: Supply Chain Attack on Axios Pulls Malicious Dependency from npm.Details
Socket
Book a DemoSign in
Socket

sharkbait

Package Overview
Dependencies
Maintainers
1
Versions
31
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

sharkbait

AI-powered coding assistant for the command line. Uses OpenAI Responses API (not Chat). Autonomous agents, parallel code reviews, 36 tools.

latest
Source
npmnpm
Version
1.0.30
Version published
Maintainers
1
Created
Source

Sharkbait

Sharkbait OOH HA HA!

"Sharkbait, ooh ha ha!"
An AI coding assistant that won't leave you swimming in circles

FeaturesInstallationSkills & PluginsUsageArchitectureLicense

MIT License Bun TypeScript Experimental Fish are friends 36 Tools 7 Agents

~

Experimental: This project is under active development. APIs may change, features may break, and Dory might forget what she was doing. Use at your own risk!

"Just keep coding, just keep coding..." — Dory, probably

Sharkbait is a CLI-based AI coding assistant built with Bun and TypeScript. It uses the OpenAI Responses API (not Chat Completions) for enhanced tool calling and streaming. Like Nemo escaping the dentist's fish tank, it helps you break free from tedious coding tasks.

The development environment is powered by Anthropic skills and Claude Code plugins that provide specialized workflows across design, engineering, research, and operations.

~

The ASCII Shark

                              +.+++.
                            ## ....-### -
                           +  ###++++-#++-
                           - ##+-++--+-+--.
                             #++++-+-------..
                           - -#+-----++-.....
                           ##-.----+-.  ###########
                           #..-++--. +#####+.   .. .
                       ####..--+--..##. ...-+####++-.
                     #  . .-.--+-. ## .+++++++++++-++..
                    # ##+### -+--.## .--+++++++++++++-+
                   + .#+-###.--+.-# -+--------+++++-...
                     -#.-###.--- #+.+---... ...-+++-.###
                  ###.--+##-.++.## ---...####...-+++- .###
    #           .. ##- --## -#.-#.-+...##   ###.-++++   ##+
   #- ###+--+#---#- # +++-..#-.+# +-.-##.    ##-.-+++#####.
  ## ##---+##+--++#+.+-+-+--+-.+#.+-.####--.###+.-+++.###+.
  # .#+++----++-+-++.#..+-.---.#+---..########..-++++-....-+##-.
  #. #++##++--+----+--#.#-----.#+-----........-+++++++++++-----+#.
  #- #++-+++++++--+++.# -#..--.+#.--------....--+++++--.--.#++++#+
  +# ##---+++++++---+.+#.-#+---.#+..-------++--.....--++-.++--++#.
   # .##+++--++-++-+-....++- ....+#...----++--++####++..-##++++##
    #  ###+++-++-++..  .    +##..+.+#-......------....+#+++++##-
     #   #####+++.           ## ++--+.  ..      .-###########-
       #.    .+.                ..- +.               .###-
           #-.                +   #

~

Features

Nemo Swimming

  • Fast — Built on Bun. Swims through code faster than Marlin crossing the EAC
  • Responses API — Uses OpenAI's Responses API for better streaming and tool calling
  • Tool-equipped — File ops, shell commands, Git, GitHub. Everything but the Ring of Fire
  • Persistent Memory — Beads give your AI long-term memory that survives sessions (unlike Dory)
  • Git-backed Context — Your AI's memory lives in your repo. Clone it, branch it, merge it
  • Beautiful UI — Ink-based terminal interface. P. Sherman would approve
  • Safe — Confirms dangerous operations before executing. No surprise rm -rf moments

The Memory Problem

Most AI coding assistants have the memory of... well, Dory. They forget context between sessions, lose track of what you were working on, and make you repeat yourself constantly.

Sharkbait is different. Built-in Beads provide persistent, git-backed memory that survives across sessions:

  • Task Memory: Create a bead for a feature, and Sharkbait remembers the context, decisions, and progress — even after you close the terminal
  • Git-Native: Beads are stored alongside your code in git, so your AI's memory travels with your repo
  • No External Services: Your context stays local. No cloud sync, no API calls for memory — just git

Sharkbait Terminal

~

Skills & Plugins

Just Keep Swimming

Sharkbait's development environment ships with the full Anthropic Skills catalog and a curated set of Claude Code plugins. These are used during development with Claude Code — they are not runtime features of the Sharkbait application itself.

Installed Anthropic Skills

CategorySkillsWhat They Do
Designcanvas-design, frontend-design, brand-guidelines, theme-factoryVisual art, production-grade UI, brand colors, themed styling
Art & Mediaalgorithmic-art, slack-gif-creatorGenerative art with p5.js, animated GIF creation
Documentsdocx, pdf, pptx, xlsx, doc-coauthoringCreate/edit Office docs, PDFs, spreadsheets, co-author documents
Engineeringweb-artifacts-builder, mcp-builder, webapp-testingMulti-component web apps, MCP servers, browser testing
Metaskill-creator, internal-commsCreate new skills, write internal communications

Active Plugins

Core Engineering (14 plugins)
PluginPurpose
compound-engineeringMulti-agent workflows: plan, brainstorm, review, work
feature-devGuided feature development with codebase understanding
code-reviewPR review with specialized analysis agents
pr-review-toolkitSilent failure hunting, type design, test coverage
code-simplifierPost-implementation code clarity pass
coderabbitAI code review on changes
hookifyCreate hooks to prevent unwanted behaviors
plugin-devBuild and validate Claude Code plugins
agent-sdk-devVerify Agent SDK applications
claude-code-setupAutomation recommendations
claude-md-managementCLAUDE.md auditing and improvement
playgroundInteractive HTML playground creation
commit-commandsCommit, push, PR workflows
githubGitHub integration
Language Servers (11 LSPs)
PluginLanguage
typescript-lspTypeScript/JavaScript
pyright-lspPython
gopls-lspGo
clangd-lspC/C++
csharp-lspC#
jdtls-lspJava
kotlin-lspKotlin
lua-lspLua
php-lspPHP
rust-analyzer-lspRust
swift-lspSwift
Knowledge Work (10 plugins)
PluginDomain
dataSQL, dashboards, visualizations, statistical analysis
marketingCampaigns, brand voice, SEO, content, competitive analysis
financeJournal entries, reconciliation, SOX, variance analysis
legalContract review, NDA triage, compliance checks
product-managementSpecs, roadmaps, sprint planning, user research
salesPipeline, forecasting, outreach, competitive intel
customer-supportTriage, research, escalation, KB articles
enterprise-searchCross-source search, knowledge synthesis
productivityTask management, memory systems
bio-researchPubMed, ChEMBL, clinical trials, bioRxiv, scRNA-seq
Utilities & AI (5 plugins)
PluginPurpose
ralph-loopAutonomous agent loop
huggingface-skillsHF Hub: models, datasets, training, evaluation
context7Up-to-date library documentation
playwrightBrowser automation and testing
frontend-designProduction-grade frontend components

Compound Engineering Workflows

The compound-engineering plugin provides multi-agent orchestration:

WorkflowCommandDescription
Plan/planTransform feature descriptions into structured plans
Brainstorm/brainstormExplore requirements through collaborative ideation
Work/workExecute plans efficiently with quality gates
Review/reviewExhaustive multi-agent code review
Compound/compoundDocument solved problems for future reference

~

Installation

# From source
git clone https://github.com/shyamsridhar123/sharkbait.git
cd sharkbait
bun install
bun run build:binary

Prerequisites

  • Bun >= 1.0.0
  • Git >= 2.30
  • gh (GitHub CLI) >= 2.40 (optional, for GitHub features)
  • Azure OpenAI API access

Configuration

  • Set up your Azure OpenAI credentials:
export AZURE_OPENAI_ENDPOINT="https://your-resource.openai.azure.com"
export AZURE_OPENAI_API_KEY="your-api-key"
export AZURE_OPENAI_DEPLOYMENT="gpt-codex-5.2"
  • Or create a .env file:
cp .env.example .env
# Edit .env with your credentials

~

Usage

Interactive Chat

sharkbait chat

One-off Question

sharkbait ask "How do I refactor this function?"

Autonomous Task Execution

sharkbait run "Add input validation to the login endpoint"

Initialize in Project

cd your-project
sharkbait init

Slash Commands

During an interactive chat session, use slash commands for quick actions:

Navigation

CommandDescription
/cd <path>Change working directory (creates if needed)
/pwdShow current working directory

Session

CommandDescription
/clearClear message history
/exitExit Sharkbait (aliases: /quit, /q)

Configuration

CommandDescription
/beads [on|off]Toggle or check Beads task tracking
/model [name]Show or switch the LLM model
/tasksShow Beads task status
/context [add|remove|list]Manage context files

Actions

CommandDescription
/setupLaunch interactive setup wizard
/initInitialize Sharkbait in current directory
/ask <question>Ask a one-off question
/run <task>Execute a task autonomously
/review <file>Run parallel code review (bugs, security, style, performance)

Information

CommandDescription
/versionShow Sharkbait version
/help [command]Show available commands or help for a specific command

Example: Run a parallel code review:

> /review src/auth.ts
Starting parallel review: bugs, security, style, performance on src/auth.ts
[Progress bars for each reviewer mode]
Parallel Review Complete (12.3s)

Full Slash Commands Reference

~

Available Tools

Sharkbait has access to 36 tools across different categories:

CategoryTools
File Operationsread_file, write_file, edit_file, list_directory, search_files, grep_search, create_directory
Shellrun_command, open_file
Beadsbeads_status, beads_init, beads_ready, beads_create, beads_show, beads_done, beads_add_dependency, beads_list
Gitgit_status, git_diff, git_commit, git_push, git_branch, git_log
GitHubgithub_create_pr, github_list_prs, github_merge_pr, github_create_issue, github_workflow_status, github_pr_view, github_issue_list
Codebaseanalyze_codebase, find_dependencies, map_architecture
Web/Fetchfetch_webpage, fetch_json, web_search

Specialized Agents

Sharkbait uses a multi-agent architecture with specialized agents for different tasks:

AgentPurpose
OrchestratorRoutes requests to the appropriate specialized agent based on intent
CoderWrites, modifies, and refactors code with tool access
ReviewerReviews code for bugs, security, style, and performance issues
ExplorerMaps codebase architecture and finds relevant files
PlannerBreaks down complex tasks into actionable steps
DebuggerTraces issues and diagnoses bugs
Parallel ExecutorRuns multiple agent tasks concurrently (e.g., parallel code reviews)

~

Architecture

Sharkbait Architecture Diagram

Sharkbait implements a sophisticated agentic loop with:

  • Dual-ledger progress tracking: Inspired by Microsoft's Magentic-One research
  • Intelligent context compaction: Preserves critical context while managing token limits
  • Action reversibility classification: Classifies commands as easy/effort/irreversible
  • Stall detection & recovery: Automatic re-planning when stuck

Tech Stack

ComponentTechnologyReason
RuntimeBunFast startup, native TS
LanguageTypeScriptType safety
LLMAzure OpenAI GPT Codex 5.2Enterprise
MemoryBeads (built-in)Git-backed persistence
GitHubgit + gh CLINo Octokit needed
CLI UIinkReact for terminals
CLI FrameworkcommanderArgument parsing

Development

# Install dependencies
bun install

# Run in development mode
bun run dev

# Run tests
bun test

# Type check
bun run typecheck

# Build for distribution
bun run build:binary

# Build for all platforms
bun run build:all

Configuration Options

Environment VariableDescriptionDefault
AZURE_OPENAI_ENDPOINTAzure OpenAI endpoint URL(required)
AZURE_OPENAI_API_KEYAzure OpenAI API key (falls back to Azure Identity if unset)(optional)
AZURE_OPENAI_DEPLOYMENTModel deployment namegpt-codex-5.2
AZURE_OPENAI_API_VERSIONAPI version (Responses API requires 2025-03-01-preview+)2025-03-01-preview
SHARKBAIT_LOG_LEVELLog level (debug/info/warn/error)info
SHARKBAIT_LOG_FILEEnable file logging to ~/.sharkbait/logsfalse
SHARKBAIT_LOG_JSONUse JSON format for console outputfalse
SHARKBAIT_LOG_DIRCustom log file directory~/.sharkbait/logs
SHARKBAIT_TELEMETRYEnable opt-in anonymous telemetryfalse
SHARKBAIT_MAX_CONTEXT_TOKENSMax context window tokens100000
SHARKBAIT_CONFIRM_DESTRUCTIVERequire confirmation for destructive commandstrue
SHARKBAIT_WORKING_DIRDefault working directory(current directory)

~

Logging & Monitoring

Structured Logging

# Enable debug logging
export SHARKBAIT_LOG_LEVEL=debug

# Enable file logging (writes to ~/.sharkbait/logs/sharkbait.log)
export SHARKBAIT_LOG_FILE=true

# Use JSON format for machine-readable logs
export SHARKBAIT_LOG_JSON=true

Log output includes timestamps, levels, and contextual information:

[18:55:21.545] [INFO ] [coder] Agent started processing
[18:55:21.560] [INFO ] config.load (8ms)

File Logging

When enabled, logs are written as newline-delimited JSON:

{"timestamp":"2026-01-29T18:55:21.545Z","level":"info","message":"Agent started","context":{"agent":"coder","correlationId":"abc123"}}

Features:

  • Automatic rotation at 10MB (keeps 5 files)
  • Structured JSON for easy parsing
  • Context propagation (agent, tool, correlationId)

Performance Monitoring

Built-in metrics track:

  • LLM call latencies (avg, p50, p90, p99)
  • Tool execution times
  • Memory usage
  • Token consumption

Distributed Tracing

Trace agent execution with OpenTelemetry-inspired spans:

agent: coder (1250ms)
  llm: gpt-codex-5.2 (800ms)
  tool: file_read (45ms)
  tool: file_write (120ms)

Telemetry (Opt-in)

Anonymous usage analytics can be enabled to help improve Sharkbait:

export SHARKBAIT_TELEMETRY=true

What's collected: Event counts (sessions, tool usage), latency metrics What's NOT collected: File paths, code content, prompts, personal info

Configuration File

Sharkbait stores configuration in ~/.sharkbait/config.json. Example:

{
  "azure": {
    "deployment": "gpt-codex-5.2"
  },
  "features": {
    "beads": true,
    "confirmDestructive": true
  },
  "paths": {
    "defaultWorkingDir": "/path/to/your/project"
  }
}

~

Created with the algorithmic-art and canvas-design skills:

Ocean Flow Field
Ocean Flow Field — 4,000 particles tracing noise-driven current vectors

Coral Reef Pattern
Coral Reef — Circle-packed generative polyp colonies

Depth Gradient
Depth Gradient — Five ocean zones from sunlit to hadal with bioluminescence

~

Security

Sharkbait includes multiple layers of security:

  • Blocked commands: Dangerous patterns like rm -rf / are blocked
  • Reversibility classification: Commands are classified by how easy they are to undo
  • Confirmation prompts: Destructive operations require confirmation
  • Secret redaction: API keys and passwords are not logged

License

This project is licensed under the MIT License - see the LICENSE file for details.

Contributing

Contributions welcome! Please see the backlog in backlog/tasks/ for open items.

EAC Current - Righteous!
"You so totally rock, Squirt!" — Crush

Keywords

ai

FAQs

Package last updated on 03 Mar 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts