
Security News
Ruby's Bundler 4.0.18 Extends Cooldown to bundle lock and bundle cache
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.
tabstax-cli
Advanced tools
Log what you're doing. See what the team is doing. Stay in flow. The terminal interface for TabStax.
Log what you're doing. See what the team is doing. Stay in flow.
hey is the terminal interface for TabStax — a lightweight command for individuals and teams to track next actions, breadcrumb decisions, and coordinate work without leaving the tools where the work actually happens: your shell, your editor, Claude Code, or a CI pipeline.
npm install -g tabstax-cli
Requires Node.js 18+ and a TabStax account.
Most task tools pull you out of flow. You stop, switch to a browser, navigate, type something, switch back. Two minutes gone, context broken.
hey is one command. You're already in the terminal. Log the next thing, see the team board, mark something done — and you're back. Every action is synced to the TabStax web app and the browser extension, with your @handle attached, so the team always sees who's doing what without a standup.
Works wherever you work:
| Where | How |
|---|---|
| Terminal | hey "message" — one command, no context switch |
| Claude Code | Ask Claude to read hey ls --all and act on it |
| Web app | dash.tabstax.app — attention board with handle pills and filters |
| Browser extension | Start Here page per project, actions synced live |
| CI / scripts | Pipe failures, deploys, or events directly into a shared stax |
hey login
hey use "my-project"
hey "Fix the token refresh race condition"
hey ls
hey done 1
| Command | Description |
|---|---|
hey "message" | Add a next action to your current project |
hey -x "message" | Log a breadcrumb — something you already did |
hey done [n] | Mark action #n as done (default: first action) |
hey rm <n> | Remove action #n |
hey edit <n> "text" | Edit action #n |
hey mv <from> <to> | Reorder: move action to a different position |
| Command | Description |
|---|---|
hey ls | List actions for the current project |
hey ls stax | All your projects with priorities |
hey ls --all | Expanded: top 3 actions per project |
hey ls --done | Breadcrumbs — what's been completed |
hey ls -c 20 | Show up to 20 items |
| Command | Description |
|---|---|
hey use <project> | Switch default project (fuzzy matched) |
hey which | Show current project and logged-in user |
hey pri <project> <level> | Set priority: must should good meh |
| Command | Description |
|---|---|
hey login | Log in (interactive, password masked) |
hey logout | Log out |
hey whoami | Show current user and handle |
hey status | Session and config summary |
# Morning: pick up exactly where you left off
hey use "backend-api"
hey ls
# Log as you go — one line, stay in the terminal
hey "Investigate N+1 query in /dashboard endpoint"
hey "Write test for edge case in token refresh"
hey -x "Fixed auth middleware — sessions now persist across restarts"
# End of day
hey ls --done
The -x flag is for breadcrumbs: things you already did, decisions made, or context you want to preserve. They appear in the Start Here page on the extension so future-you (or a teammate) can see why the project is in its current state.
hey -x "Decided against Redis for session cache — latency was fine without it"
hey -x "Upgraded to Postgres 16 — no breaking changes, pooler config updated"
hey -x "Deprioritised dark mode until v2 — product call on 2026-03-03"
Add collaborators to a stax and now all work is together in flow. No Jira board, no Notion page, no standup doc — just a shared list of what's next, updated in real time from wherever each person works. Excellent for high-velocity work where you're just building rapidly.
@handle — they get access instantlyhey use <stax-name> once# Join a team stax
hey use "sprint-47"
# Add your actions — they'll show up under your @handle
hey "Implement OAuth handshake"
hey "Write migration for invites table"
# Log what you shipped
hey -x "Deployed API gateway — load balanced across 3 nodes"
# See the full team board
hey ls
# Check all projects
hey ls stax
Every action is visible in real time on dash.tabstax.app — no standup needed to answer "what's everyone working on?"
Every action added via hey is tagged with your @handle (set when you create your TabStax account). In the web app and the extension Start Here page:
Check your handle:
hey whoami
# Sprint kickoff: team lead creates the stax, everyone joins once
hey use "sprint-47"
# During the sprint: add as you pick up work
hey "Implement dark mode toggle"
hey "Write unit tests for payment service"
# Mark done as you go — updates the board for everyone
hey done 1
# Sprint review: full breadcrumb trail of what shipped
hey ls --done
When something breaks, hey gives every responder a shared log so nothing gets lost between shifts or calls.
# Everyone joins the incident stax
hey use "incident-2026-03-03"
# Log what you're trying in real time
hey "Check database connection pool — seeing timeouts"
hey "Rolling restart of API pods"
hey -x "Confirmed: root cause was stale connection pool config"
hey done 1
# Hand off cleanly — full timeline is in the web app
hey ls --done -c 50
When multiple AI agents are running in parallel (Claude Code subagents, CI bots, automated pipelines), hey gives you a shared log of what each agent did. Point each agent at a shared stax and every action and decision is recorded with attribution.
# Each agent logs to the shared stax before and after major steps
hey -x "Agent:researcher — analysed 47 files, found 3 auth patterns"
hey -x "Agent:coder — implemented OAuth flow, 312 lines changed"
hey "Agent:tester — run contract tests before merge"
The web app shows the full timeline, colour-coded by agent, so a human reviewer can see exactly what happened and what still needs sign-off.
hey use "oss-backlog"
hey "Review PR #412 — new auth provider"
hey "Triage issues labelled good-first-issue"
hey -x "Merged PR #389 — storage quota fix"
Set up sharing from the dashboard at dash.tabstax.app — click the share icon on any stax, switch to Collaborative, and add team members by @handle. That's it. No invite links, no permissions matrix. The mental model is simple:
hey in terminal = the fastest way to add to itWhen you add a collaborator, they immediately see the stax on their attention board and can hey use it from the CLI. Actions flow in from all directions — one person in VS Code, another in Claude Code, a third on mobile — and everything merges into the same timeline with @handle attribution.
This is built for teams that ship fast and communicate through the work itself, not through status updates about the work.
Track weekly hours from the terminal. Timesheets live at time.tabstax.app and are also accessible via CLI.
| Command | Description |
|---|---|
hey ts | View current week's timesheet |
hey ts 8 | Set Mon–Fri to 8h each |
hey ts wed 7.5 | Set single day hours |
hey ts mon=8 tue=7 fri=6 | Matrix input — multiple days at once |
hey ts submit | Submit current week for approval |
hey ts reopen | Reopen a submitted timesheet |
hey ts ls | List past 8 weeks |
hey ts ls --all | Full timesheet history |
# Friday afternoon: log your week
hey ts 8 # 8h Mon-Fri
hey ts fri 6 # actually left early Friday
hey ts submit # done — shows up for admin approval
# Oops, forgot Thursday was a half day
hey ts reopen
hey ts thu 4
hey ts submit
Timesheets show evidence counts (actions logged per day) alongside hours — so approvers can see what was actually done, not just what was claimed.
hey + Claude Code turns your stax into a programmable task queue. Because hey ls outputs plain text, Claude can read, reason about, and act on it directly.
Read my current stax using `hey ls --all` and write a short standup update
I can paste into Slack. Group by project, highlight the top action per project,
and flag anything that's been sitting for more than 3 days.
Run `hey ls stax` to see all my projects. For any project at 6+ actions out of 7
(near the limit), suggest which actions could be combined, deferred, or done first.
Output a prioritised plan.
The shared stax "incident-2026-03-03" has a full breadcrumb trail.
Run `hey ls --done -c 50` to get all completed actions.
Draft a post-mortem with timeline, root cause, and action items.
# In your CI script — on test failure:
hey "CI failed: $(git log -1 --pretty='%s') — $(git rev-parse --short HEAD)"
Watch `hey ls` for actions containing "CI failed". For each one, look up
the commit, fetch the test output, and suggest a fix.
Run `hey ls --done -c 100` across my top 3 stax. Summarise what shipped
this week, what's still in flight, and suggest 3 focus areas for next week
based on what's been sitting longest.
--force to bypass)hey use tab matches "TabStax Backend"-x) — log decisions and completed work, not just what's nextSessions use a long-lived refresh token and auto-refresh 5 minutes before expiry. You won't be interrupted mid-session. If your refresh token expires (7+ days of no use), you'll get a clear prompt to re-login.
hey login # interactive, password masked
hey whoami # check session state
hey status # full config + auth info
MIT
FAQs
Log what you're doing. See what the team is doing. Stay in flow. The terminal interface for HeyStax.
The npm package tabstax-cli receives a total of 1 weekly downloads. As such, tabstax-cli popularity was classified as not popular.
We found that tabstax-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.

Security News
During a UK cyber test, a Mythos 5 agent used sockpuppets, social engineering, and prompt injection to try to get a maintainer to merge malware.

Company News
Socket is now in the AWS Security Hub Extended plan. Adopt it through AWS, apply committed spend, and block malicious open source packages.