
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Filesystem-backed local Symphifony orchestrator with a TypeScript CLI, MCP mode, and multi-agent Codex or Claude workflows.
Symphifony is a filesystem-backed local orchestrator with a TypeScript runtime, codex and claude agent support, and durable state stored under the current workspace by default.
claude, codex) with sensible defaults.pino with file + console output.s3db.js.s3db.js ApiPlugin.codex and claude.Install dependencies and run from the package root:
pnpm install --ignore-workspace
Runtime requirement:
Run the standard local runtime:
npx -y symphifony
Run the MCP server over stdio:
npx -y symphifony mcp
Start the API and dashboard:
npx -y symphifony --port 4040
Override the persistence root:
npx -y symphifony --persistence /path/to/root
By default:
./.symphifony/When --port is set, open:
http://localhost:4040http://localhost:4040/docsRun the local UI:
npx -y symphifony --port 4040
Default local flow:
http://localhost:4040POST /issues/createlabels and paths when you want stronger automatic routingView Sessions on an issue to inspect the current pipeline, turns, directives, and latest outputMinimal issue payload:
{
"title": "Build release workflow",
"description": "Prepare the first stable npm release",
"labels": ["devops", "release"],
"paths": [".github/workflows/ci.yml", "package.json"]
}
Useful app routes:
/ — dashboard/docs — OpenAPI docs from ApiPlugin/state — runtime snapshot with capability counts/issues/:id/pipeline — pipeline snapshot for one issue/issues/:id/sessions — session history for one issue/issues/create — create issue/issues/:id/state — transition issue state/issues/:id/retry — retry issue/issues/:id/cancel — cancel issue/events/feed — filtered event feed with ?since=&kind=&issueId=Useful API examples:
curl -X POST http://localhost:4040/issues/create \
-H 'content-type: application/json' \
-d '{
"title":"Prepare release notes",
"labels":["documentation","release"],
"paths":["README.md","RELEASE.md"]
}'
curl 'http://localhost:4040/events/feed?kind=info&issueId=LOCAL-1'
bin/symphifony.js — published CLI entrypointsrc/cli.ts — command router built on cli-args-parsersrc/mcp/server.ts — stdio MCP serversrc/runtime/run-local.ts — thin main entrypointsrc/runtime/types.ts — shared type definitionssrc/runtime/logger.ts — pino-based structured loggingsrc/runtime/constants.ts — paths, env vars, state constantssrc/runtime/helpers.ts — pure utility functionssrc/runtime/store.ts — s3db state persistencesrc/runtime/providers.ts — provider detection, profile resolution, capability routingsrc/runtime/workflow.ts — WORKFLOW.md loading and source bootstrappingsrc/runtime/issues.ts — issue CRUD, config, metrics, eventssrc/runtime/agent.ts — agent session/pipeline executionsrc/runtime/scheduler.ts — issue scheduling, parallelism analysis, graceful shutdownsrc/runtime/api-server.ts — HTTP API and dashboard servingsrc/runtime/skills.ts — skill discovery and hydrationsrc/routing/capability-resolver.ts — task classification enginesrc/integrations/catalog.ts — agent/skill integration discoverysrc/dashboard/{index.html,app-react.js,styles.css,manifest.webmanifest,service-worker.js,icon.svg} — web UIsrc/fixtures/local-issues.json — optional seed issue catalogIf the target workspace contains WORKFLOW.md, Symphifony reads its YAML front matter and Markdown body.
Supported fields:
tracker.kindhooks.after_createhooks.before_runhooks.after_runpoll.interval_msagent.provideragent.providers[]agent.profileagent.max_concurrent_agentsagent.max_attemptsagent.max_turnscodex.commandclaude.commandcodex.timeout_msserver.portrouting.enabledrouting.prioritiesrouting.overrides[]routing.overrides[].match.pathsThe Markdown body is rendered as the issue prompt and exported through:
SYMPHIFONY_PROMPTSYMPHIFONY_PROMPT_FILEIf no command is configured, Symphifony auto-detects available providers (claude, codex) and uses sensible defaults.
Each agent turn receives:
SYMPHIFONY_AGENT_PROVIDERSYMPHIFONY_AGENT_ROLESYMPHIFONY_AGENT_PROFILESYMPHIFONY_AGENT_PROFILE_FILESYMPHIFONY_AGENT_PROFILE_INSTRUCTIONSSYMPHIFONY_SESSION_IDSYMPHIFONY_SESSION_KEYSYMPHIFONY_TURN_INDEXSYMPHIFONY_MAX_TURNSSYMPHIFONY_TURN_PROMPTSYMPHIFONY_TURN_PROMPT_FILESYMPHIFONY_PREVIOUS_OUTPUTSYMPHIFONY_RESULT_FILEThe agent can advance the session by:
SYMPHIFONY_STATUS=continue|done|blocked|failedsymphifony-result.json with status, summary, and optional nextPromptSession and pipeline state are persisted in the local s3db store.
Workspace JSON files are temporary CLI handoff artifacts only.
Agent profiles can be resolved from:
./.codex/agents/<name>.md./agents/<name>.md~/.codex/agents/<name>.md~/.claude/agents/<name>.mdCommand resolution order:
SYMPHIFONY_AGENT_COMMANDcodex.command or claude.commandcodex or claudeExample mixed pipeline:
agent:
max_turns: 4
providers:
- provider: claude
role: planner
- provider: codex
role: executor
- provider: claude
role: reviewer
Example routing override:
routing:
priorities:
security: 0
bugfix: 1
backend: 2
overrides:
- match:
labels: ["frontend", "marketing"]
paths: ["src/web", "src/dashboard"]
overlays: ["impeccable", "frontend-design"]
providers:
- provider: claude
role: planner
profile: agency-ui-designer
reason: Marketing frontend needs stronger design planning.
- provider: codex
role: executor
profile: agency-frontend-developer
reason: Frontend implementation.
- provider: claude
role: reviewer
profile: agency-accessibility-auditor
reason: Review with stronger UX and accessibility standards.
Issue payloads can include paths so the resolver can classify by target files and directories, not only title and labels:
{
"title": "Harden websocket reconnect flow",
"labels": ["backend", "protocol"],
"paths": ["src/protocol/session.ts", "src/api/ws-handler.ts"]
}
If paths is omitted, Symphifony still tries to infer routing signals from:
Symphifony also derives queue labels such as capability:<category> and overlay:<name> from the resolver output.
The scheduler uses capability priority as a tie-breaker after issue priority, and routing.priorities can override the default category order.
./.symphifony/WORKFLOW.local.md./.symphifony/s3db/./.symphifony/symphifony-local.logPrimary REST endpoints:
GET /runtime_state — runtime state mirror resourceGET /issues — issue list resourceGET /events — event records resourceGET /agent_sessions — agent sessions resourceGET /agent_pipelines — agent pipelines resourceCustom endpoints:
GET /state — runtime snapshot with capability countsGET /status — health checkGET /events/feed?since=&kind=&issueId= — filtered event feedGET /issues/:id/pipeline — pipeline snapshot for one issueGET /issues/:id/sessions — session history for one issuePOST /issues/:id/state — transition issue statePOST /issues/:id/retry — retry issuePOST /issues/:id/cancel — cancel issueGET /providers — detected providers with availabilityGET /parallelism — parallelizability analysisPOST /config/concurrency — update worker concurrencyPOST /refresh — request immediate state persistenceThe built-in dashboard filters issues by both runtime state and capability category, and mirrors the scheduler's capability-aware ordering.
GET /state and the MCP status summary also expose aggregated capability counts.
The live events panel filters by kind and issueId, backed by the partitioned /events/feed route.
Native ApiPlugin resources:
runtime_stateissueseventsagent_sessionsagent_pipelinesThese resources also define s3db partitions for the main operational access patterns:
byState, byCapabilityCategory, byStateAndCapabilitybyIssueId, byKind, byIssueIdAndKindbyIssueId, byIssueAttempt, byProviderRolebyIssueId, byIssueAttemptThe issue inspection routes use these partitions directly, including pipeline/session lookups by issueId + attempt.
npx -y symphifony mcp starts a stdio MCP server backed by the same s3db filesystem store as the runtime.
Resources:
symphifony://guide/overviewsymphifony://guide/runtimesymphifony://guide/integrationsymphifony://state/summarysymphifony://issuessymphifony://workspace/workflowsymphifony://issue/<id>Tools:
symphifony.statussymphifony.list_issues with optional state, capabilityCategory, or categorysymphifony.create_issuesymphifony.update_issue_statesymphifony.integration_configsymphifony.resolve_capabilitiesPrompts:
symphifony-integrate-clientsymphifony-plan-issuesymphifony-review-workflowMinimal MCP client configuration:
{
"mcpServers": {
"symphifony": {
"command": "npx",
"args": ["-y", "symphifony", "mcp", "--workspace", "/path/to/workspace", "--persistence", "/path/to/workspace"]
}
}
}
pull_request: runs the quality gatepush to main: runs quality and publishes symphifony@nextv*: runs quality, publishes stable, and creates a GitHub ReleaseRequired repository secret:
NPM_TOKEN for pnpm publishNPM_TOKEN is configured in GitHub Actionspackage.json has the version you want to releasemain@next publish to passCommands:
git push origin main
git tag v0.1.0
git push origin v0.1.0
After publish:
npx -y symphifony@latest --port 4040
npx -y symphifony@latest mcp
Release checklist:
FAQs
Filesystem-backed local Symphifony orchestrator with a TypeScript CLI, MCP mode, and multi-agent Codex or Claude workflows.
We found that symphifony demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.