
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
toh-framework
Advanced tools
"Type Once, Have it all!" - AI-Orchestration Driven Development
🌐 Official Website: tohframework.dev
| IDE | Status | Notes |
|---|---|---|
| 🧠 Claude Code | ✅ Full Support | Native Sub-Agents, Slash commands |
| 📝 Cursor | ✅ Full Support | @ file references |
| 🌌 Google Antigravity | ✅ Full Support | Gemini integration |
| 💎 Gemini CLI | ✅ Full Support | Context files auto-loaded |
| 🤖 Codex CLI | ✅ Supported | OpenAI agents |
Toh = Type Once, Have it all!
We believe Solo Developers and Solopreneurs should be able to build SaaS systems single-handedly without being an expert in every field.
Toh Framework enables you to:
Full support for Google Antigravity IDE! Commands now appear when pressing /:
.agent/workflows//toh-vibe) in Antigravity/toh:vibe)Enhanced memory tracking with 2 new files:
| Memory File | Purpose |
|---|---|
active.md | Current task |
summary.md | Project overview |
decisions.md | Key decisions |
changelog.md | NEW! Session changes |
agents-log.md | NEW! Agent activity log |
architecture.md | Project structure |
components.md | Component registry |
All agents now announce themselves when working:
[🎨 UI Builder] Starting: Create Dashboard Page
[🎨 UI Builder] ✅ Complete: Dashboard with 3 components
Agents can now work simultaneously when there are no dependencies:
Phase 1: [🎨 UI] + [⚙️ Dev] ← PARALLEL
Phase 2: [🔌 Backend] ← SEQUENTIAL
Phase 3: [✨ Design] + [🧪 Test] ← PARALLEL
Before executing, see why AI chose specific agents:
🔍 Analysis:
| Need | Agent | Confidence |
|------|-------|------------|
| Create pages | 🎨 UI | 95% |
| Add logic | ⚙️ Dev | 90% |
| Connect DB | 🔌 Connect | 95% |
| Agent | Specialty |
|---|---|
| 🎨 ui-builder | Pages, Components, Layouts |
| ⚙️ dev-builder | Logic, State, API |
| 🔌 backend-connector | Supabase, Auth, RLS |
| ✨ design-reviewer | Polish, Animation |
| 🧪 test-runner | Auto test & fix |
| 🧠 plan-orchestrator | Analyze, Plan |
| 📱 platform-adapter | LINE, Mobile, Desktop |
See CHANGELOG.md for complete version history.
Recent highlights:
| Version | Date | Key Feature |
|---|---|---|
| v1.8.0 | 2026-01-11 | 7-File Memory System, Agent Announcements |
| v1.7.1 | 2026-01-11 | Gemini CLI Native Commands (TOML) |
| v1.7.0 | 2025-12-26 | Security Engineer, /toh-protect command |
| v1.6.0 | 2025-12-18 | Claude Code Sub-Agents, Multi-Agent Orchestration |
| v1.5.0 | 2025-12-05 | Google Antigravity/Gemini Support |
| v1.4.0 | 2025-12-04 | /toh Smart Command, Premium Experience |
| Feature | Description |
|---|---|
/toh Smart Command | Type anything, AI picks the right agent |
| Sub-Agents | 7 specialized agents for different tasks |
| Multi-Agent Orchestration | Complex workflows with full visibility |
| Premium Experience | 5+ pages with animations in one prompt |
| Design Mastery | 13 business profiles for smart design |
| Auto Memory | Context persists across sessions and IDEs |
| Auto Testing | Test & fix loop until all pass |
# Interactive install (choose IDEs and language)
npx toh-framework install
# Quick install (Claude Code + Cursor, English)
npx toh-framework install --quick
# Specific IDE only
npx toh-framework install --ide claude
npx toh-framework install --ide cursor
npx toh-framework install --ide gemini
npx toh-framework install --ide codex
# Multiple IDEs
npx toh-framework install --ide "claude,cursor,gemini,codex"
# Method 1: Use npx (recommended - always gets latest)
npx toh-framework@latest install
# Method 2: If installed globally
npm update -g toh-framework
toh install
💡 Tip: Reinstalling updates skills, agents, and commands without deleting your existing memory!
# Open project with Claude Code
claude .
# Show all commands
/toh-help
# Smart command - AI picks the right agent
/toh create a landing page with pricing section
# Create complete project
/toh-vibe coffee shop management system
# Add UI
/toh-ui Add a dashboard with sales charts
# Add Logic
/toh-dev Add form validation and API calls
# Improve Design
/toh-design Make it look professional
# Test system
/toh-test
# Security audit
/toh-protect
# Deploy
/toh-ship
# Call Toh agent
@toh Create a meeting room booking system
# Or use specific command
@toh:ui Create a calendar page for room booking
# Start Gemini CLI
gemini
# Use commands
/toh-vibe Inventory management system
| Command | Shortcut | Description |
|---|---|---|
/toh | - | 🧠 Smart Command - Type anything, AI picks agent |
/toh-plan | /toh-p | 📋 Plan - Analyze, plan, orchestrate |
/toh-vibe | /toh-v | 🎨 Create Project - Complete app in one command |
/toh-ui | /toh-u | 🖼️ Create UI - Pages, Components, Layouts |
/toh-dev | /toh-d | ⚙️ Add Logic - TypeScript, Zustand, Forms |
/toh-design | /toh-ds | ✨ Polish Design - Professional, not AI-looking |
/toh-test | /toh-t | 🧪 Test - Auto test & fix until pass |
/toh-protect | /toh-pt | 🔐 Security Audit - Full security check [NEW] |
/toh-connect | /toh-c | 🔌 Connect Backend - Supabase, Auth, RLS |
/toh-line | /toh-l | 💚 LINE Mini App - LIFF integration |
/toh-mobile | /toh-m | 📱 Mobile App - Expo / React Native |
/toh-fix | /toh-f | 🔧 Fix Bugs - Systematic debugging |
/toh-ship | /toh-s | 🚀 Deploy - Vercel, Production ready |
/toh-help | /toh-h | ❓ Help - Show all commands |
No decisions needed - optimized stack ready to go:
| Category | Technology |
|---|---|
| Framework | Next.js 14 (App Router) |
| Styling | Tailwind CSS + shadcn/ui |
| State | Zustand |
| Forms | React Hook Form + Zod |
| Backend | Supabase |
| Testing | Playwright |
| Language | TypeScript (strict) |
AI-Orchestration Driven Development:
User: "Create a coffee shop management system"
Orchestrator:
├── 📐 plan-orchestrator → Analyze & plan
├── 🎨 ui-builder → Create all UI
├── ⚙️ dev-builder → Add logic
├── ✨ design-reviewer → Polish design
├── 🧪 test-runner → Test & fix
├── 🔐 security-check → Audit code [NEW]
└── ✅ Deliver working system!
/toh-vibe Online store with products, cart, and checkout
/toh-vibe Analytics dashboard with charts and date filters
/toh-vibe Project management tool with teams and tasks
[NEW: /toh-protect][NEW: Security Engineer]Contributions are welcome! Please feel free to submit a Pull Request.
MIT License - see LICENSE for details.
Wasin Treesinthuros (Innovation Vantage)
Made with ❤️ for Solo Developers everywhere.
"Type Once, Have it all!"
FAQs
AI-Orchestration Driven Development Framework - Type Once, Have it all!
The npm package toh-framework receives a total of 6 weekly downloads. As such, toh-framework popularity was classified as not popular.
We found that toh-framework demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.