
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
AI agents that build and run companies with you.
Termlings turns your terminal into a live AI startup: a full agent team building and marketing products around the clock, coordinating work in real time, running browser workflows, and shipping outcomes end to end from one shared command center.
The core model is agent-native file-based apps: local workspace apps exposed consistently through CLI, TUI, and injected agent context.
Every agent gets access to these core apps (via termlings CLI):
Apps can be disabled globally per workspace or per agent.
messaging is required and always stays enabled.
# Instant start
npx termlings@latest --spawn
# Instant start with a specific template
npx termlings@latest --spawn --template personal-assistant
# Docker (most secure — fully sandboxed)
npx termlings@latest --spawn --docker
# Manual
bun add -g termlings@latest
# or
npm install -g termlings@latest
The --docker flag runs each agent in an isolated Docker container with no access to your host filesystem or network. This is the most secure way to run autonomous agents.
Runtime requirement: Bun must be installed because the termlings executable runs via Bun.
This repository is now the monorepo for the OSS Termlings stack:
. — core termlings CLI, TUI, server, docs, templates, and npm packageapps/web — termlings.com website and docs workerapps/desktop — Tauri desktop shell that runs Termlings in sidecar PTY/API modeUseful monorepo commands:
bun test
bun run web:build
npm --prefix apps/desktop run check
Prerequisite: install and log in to at least one runtime CLI (claude or codex).
# Fastest path
termlings --spawn
# First run with a specific template
termlings --spawn --template personal-assistant
# Or initialize first, then start manually
termlings init
# Separate workspace and spawning
termlings
# in another terminal:
termlings spawn
# Optional: spawn agents inside Docker-isolated workers
termlings --spawn --docker
Default spawn presets run in dangerous/autonomous/yolo mode for supported runtimes.
Termlings adds an agent coordination layer in .termlings/ on top of your existing coding-agent runtime.
termlings spawn launches an agent using .termlings/spawn.json routing:
default sets workspace-wide runtime/presetagents.<slug> can override runtime/preset per agentruntimes defines runtime preset commandstermlings auto-starts the scheduler daemon before opening the workspace UItermlings --spawn opens the workspace UI immediately and starts scheduler + background spawn startuptermlings claude) via --append-system-prompt "<termlings context>"termlings codex) via a trailing prompt argumenttermlings commands (message, task, calendar, request, etc.), while shared state in .termlings/store/* keeps TUI + CLI in sync across terminals.Each Termling agent gets role-specific context derived from its SOUL.md plus shared workspace context.
There are many ways to orchestrate AI agents — but Termlings makes it feel like running a real company. Agents have roles, personalities, and report to each other through a natural org chart.
The built-in terminal UI is like an AI-native Slack: chat with your agents, track tasks, manage scheduled events, and create one-time or recurring DMs with /schedule — all from your terminal.
| Command | What it does | Docs |
|---|---|---|
termlings | Start workspace UI + auto-start scheduler daemon | README |
termlings --spawn | Open workspace UI immediately + start scheduler daemon + background spawn startup | README |
termlings spawn | Pick an agent + launch preset | docs/SPAWN.md |
termlings create | Create a new agent in .termlings/agents | docs/TERMLINGS.md |
termlings agents <cmd> | Browse/install predefined teams and agent presets | docs/TERMLINGS.md |
termlings init | Initialize .termlings/ in current project | README |
termlings machine <cmd> | SSH into a shared remote workspace | docs/MACHINES.md |
| `termlings avatar <dna | name>` | Render avatar identity |
termlings --help | Full command reference | CLI help |
termlings --server | Run secure HTTP API server [WIP] | docs/SERVER.md |
termlings scheduler --daemon | Run scheduler daemon (calendar/messages/tasks) | docs/SCHEDULER.md |
These are primarily for agents running inside sessions. You can run them manually when needed. You should not run these commands since they mostly work inside a agent session.
| Command | What it does | Docs |
|---|---|---|
termlings brief | Session startup snapshot | docs/BRIEF.md |
termlings org-chart | Show org + online status | docs/ORG-CHART.md |
termlings skills <cmd> | List/install/update agent skills (skills.sh wrapper) | docs/SKILLS.md |
termlings brand <cmd> | Manage brand profiles | docs/BRAND.md |
termlings message <target> <text> | Send DM to session/agent/human | docs/MESSAGING.md |
termlings conversation <target> | Read recent channel/DM history | docs/MESSAGING.md |
termlings workflow <cmd> | Workflow checklist commands | docs/WORKFLOWS.md |
termlings task <cmd> | Task workflow commands | docs/TASK.md |
termlings calendar <cmd> | Calendar/event workflow | docs/CALENDAR.md |
termlings social <cmd> | Social drafts, queue, scheduling, and publishing | docs/SOCIAL.md |
termlings ads <cmd> | Ad sync, campaigns, creatives, and reports | docs/ADS.md |
termlings memory <cmd> | File-based project and agent memory | docs/MEMORY.md |
termlings cms <cmd> | File-based collections, entries, and scheduled publishing | docs/CMS.md |
termlings crm <cmd> | File-based CRM records + timelines | docs/CRM.md |
termlings image <cmd> | Generate and manage images | docs/MEDIA.md |
termlings video <cmd> | Generate and manage videos | docs/MEDIA.md |
termlings analytics <cmd> | File-based website analytics sync | docs/ANALYTICS.md |
termlings finance <cmd> | File-based revenue and subscription sync | docs/FINANCE.md |
termlings request <type> | Ask operator for decisions/credentials | docs/REQUESTS.md |
termlings browser <cmd> | Browser automation commands | docs/browser.md |
.termlings Structure.termlings/
GOAL.md
.env
workspace.json
agents/
<slug>/
SOUL.md
brand/
brand.json
profiles/
<id>.json
store/
sessions/
tl-*.json
message-queue/
tl-*.msg.json
*.queue.jsonl
messages/
channels/*.jsonl
dms/*.jsonl
system.jsonl
index.json
message-schedules/
schedules.json
presence/
tl-*.typing.json
crm/
records/<type>/*.json
activity/<type>/*.jsonl
social/
posts/*.json
history.jsonl
ads/
campaigns/*.json
creatives/*.json
metrics/*.jsonl
reports/*.json
memory/
records/<collection>/*.json
qmd/<collection>/*.md
history.jsonl
cms/
entries/<collection>/*.json
publish/<collection>/*
history.jsonl
media/
jobs/*.json
outputs/*
analytics/
traffic/daily.jsonl
channels/daily.jsonl
pages/daily.jsonl
conversions/daily.jsonl
reports/*.json
finance/
customers/*.json
subscriptions/*.json
invoices/*.json
refunds/*.json
metrics/*.jsonl
reports/*.json
app-schedules/
schedules.json
evals/
tasks/*.json
runs/*.json
reports/*.json
tasks/tasks.json
calendar/calendar.json
workflows/
<slug>/*.json
requests/*.json
workflows/
org/*.json
agents/
<slug>/*.json
browser/
config.json
process.json
profile.json
history/
all.jsonl
agent/*.jsonl
What each file/folder is for:
.termlings/GOAL.md - simple project goal injected into every agent context..termlings/.env - Termlings-internal environment values resolved from scoped requests..termlings/workspace.json - workspace metadata, TUI settings, and app availability..termlings/agents/<slug>/SOUL.md - saved agent identity, title, role, DNA, and optional sort_order for TUI ordering..termlings/brand/brand.json - default brand profile..termlings/brand/profiles/<id>.json - additional named brand profiles..termlings/store/sessions/tl-*.json - live session presence and metadata..termlings/store/message-queue/ - transient live inboxes (tl-*.msg.json) and offline agent queues (*.queue.jsonl)..termlings/store/messages/ - append-only channel/DM/system history..termlings/store/message-schedules/schedules.json - one-time, hourly, daily, and weekly DM definitions..termlings/store/presence/ - session typing/activity state..termlings/store/crm/records/<type>/*.json - one file per CRM record..termlings/store/crm/activity/<type>/*.jsonl - append-only activity timelines per CRM record..termlings/store/social/ - local social drafts, queue, and publish history..termlings/store/ads/ - ad accounts, campaigns, creatives, metrics, and reports..termlings/store/memory/ - project and agent memory records plus optional qmd exports..termlings/store/cms/ - file-based collections, entries, publish outputs, and history..termlings/store/media/ - image and video jobs plus generated outputs..termlings/store/analytics/ - normalized analytics snapshots and reports..termlings/store/finance/ - normalized customers, subscriptions, invoices, refunds, metrics, and reports..termlings/store/app-schedules/schedules.json - recurring app sync schedules for ads, analytics, and finance..termlings/store/evals/ - operator eval tasks, runs, and comparison reports..termlings/store/tasks/tasks.json - task list and task state..termlings/store/calendar/calendar.json - events and recurrence..termlings/store/workflows/<slug>/*.json - running workflow copies with step completion state..termlings/store/requests/*.json - operator request records..termlings/workflows/org/*.json - org-wide workflow checklists..termlings/workflows/agents/<slug>/*.json - agent-specific workflow checklists..termlings/browser/config.json - browser runtime settings (CDP port, binary, profile path)..termlings/browser/process.json - active browser process/CDP state..termlings/browser/profile.json - workspace profile metadata..termlings/browser/history/all.jsonl - global browser action stream..termlings/browser/history/agent/*.jsonl - per-agent browser action streams..termlings/machines.json - saved SSH machine definitions for remote shared workspaces.For runtime internals (env vars, context injection, session lifecycle), see:
This is intentionally separated so operator docs stay short.
termlings --server command, API, architecture, and securityMIT
FAQs
Framework for building autonomous AI agents & teams in the terminal
We found that termlings demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.