
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
__ _______ ____ ___ ____ ___ _______ __
\ \ / / ____| _ \|_ _/ ___|_ _| ___\ \ / /
\ \ / /| _| | |_) || | | | || |_ \ V /
\ V / | |___| _ < | | |___ | || _| | |
\_/ |_____|_| \_\___\____|___|_| |_|
Vericify is a local-first run intelligence hub for multi-agent workflows and AI agent state.
It gives a workspace durable run records, checkpointed handoffs, and a four-layer compare engine instead of making you reconstruct intent from chat scrollback, shell history, and raw logs.
It works on its own, and it also plugs neatly into ACE / ace-swarm workspaces that already emit agent-state/*.
Vericify is for engineers building with AI agents who want run-level observability and clear answers to questions like:
The package installs one CLI:
vericify
Default behavior is simple:
.vericify/agent-state/* when presentvericify or vericify hubVericify gives you:
.vericify/published/.vericify/sync-outbox/npm install -g vericify
Node 18+ is required.
cd /path/to/repo
vericify context
vericify adapters
vericify hub
If Vericify already sees .vericify/ or agent-state/*, the hub can immediately project runs from that workspace.
This is the easiest path.
If your workspace already contains agent-state/*, Vericify reads it automatically:
cd /path/to/ace-workspace
vericify context
vericify adapters
vericify hub
No extra conversion step is required.
Attach the adapter to the current workspace:
vericify attach --adapter codex --label "Primary Codex session"
vericify adapters
That creates or updates .vericify/adapters.json for the current repo and marks the adapter as attached.
For Claude Code, vericify attach --adapter claude-code also writes compact-bootstrap guidance into CLAUDE.md and, when .claude/ exists, installs the Vericify hook block into .claude/settings.json.
Use the compact packet when you want session bootstrap or resume without rereading the full projected state. This is the primary path for workflow continuity across context resets:
vericify context
vericify delta --since vcx_...
vericify snapshot --format compact
vericify context returns one minified JSON packet with:
live_signal subsetUse --pretty if you want the compact packet formatted for humans.
--session-id?No. --session-id is optional.
Use no session ID when:
Add a session ID when:
claude-main and claude-reviewGood session IDs look like:
claude-maincodex-bugfixcursor-review-01This is valid:
vericify attach --adapter codex --label "Primary Codex session"
Simplified output:
{
"path": ".vericify/adapters.json",
"attachment": {
"adapter_id": "codex",
"capture_mode": "manual",
"label": "Primary Codex session"
}
}
Notes:
capture_mode defaults to manual if you do not set oneUse this when you want a named session:
vericify attach --adapter claude-code --session-id claude-main --capture-mode attachment --label "Claude main"
Simplified output:
{
"path": ".vericify/adapters.json",
"attachment": {
"adapter_id": "claude-code",
"capture_mode": "attachment",
"session_id": "claude-main",
"label": "Claude main"
}
}
After that, verify status:
vericify adapters
Look for:
detection_status: "attached"session_id when you supplied onelabel_override with your human-friendly namecd /path/to/ace-workspace
vericify adapters
vericify hub
Best when you already have agent-state/* and want a cockpit, history, and compare surface.
vericify attach --adapter codex --label "Primary Codex"
vericify attach --adapter claude-code --session-id claude-main --capture-mode attachment
vericify context
vericify hub
Best when you want durable workspace metadata now. Claude Code attach also writes the startup guidance for vericify context, the vericify delta --since=<id> resume path, and the PreCompact reinjection hook when .claude/ is available.
vericify handoff --id h1 --from capability-ops --to capability-build --title "Implement compare engine" --status open
vericify post --run-id handoff:h1 --agent-id capability-build --kind progress --summary "Builder started compare engine"
vericify snapshot
vericify hub
Best when you want to model agent work directly in Vericify.
vericify compare --run-id handoff:run-a --compare-run-id workspace:current
The comparison runs four layers simultaneously — exact diff, structural graph delta, semantic MinHash similarity, and operational timing analysis — and returns:
vericify publish --run-id handoff:run-a --compare-run-id workspace:current --title "Run A artifact"
vericify sync --run-id handoff:run-a --compare-run-id workspace:current --endpoint https://sync.example.test
This writes:
.vericify/published/<artifact-id>/run-artifact.json.vericify/published/<artifact-id>/SUMMARY.md.vericify/sync-outbox/<item>.jsonRun: one coordinated attempt to complete an objectiveBranch: an alternate path inside a runLane: one concurrent execution streamHandoff: transfer of responsibilityCheckpoint: durable snapshot at a meaningful transitionDelta: change between checkpoints, measured across four layers: exact diff, structural graph, semantic MinHash, and operational timingVericify writes native state here:
.vericify/
|-- adapters.json
|-- handoffs.json
|-- todo-state.json
|-- run-ledger.json
|-- status-events.ndjson
|-- process-posts.json
|-- published/
`-- sync-outbox/
Vericify also reads partner state here when available:
agent-state/
`-- ...
This is why it works naturally with ACE / ace-swarm workspaces.
Current adapter registry:
local-stateacecodexclaude-codecursorvscode-copilot-chatantigravityCurrent truth:
local-state is fully implementedace is the partner path for ACE / ace-swarm style workspacesCheckpoint triggers currently include:
handoffstatus_transitionprocess_milestoneledger_updateoperator_savebranch_forkCapture modes currently include:
semanticgithybridToday the package is semantic-first. Git-backed provenance can be attached when available.
vericify help
vericify context
vericify delta --since vcx_...
vericify adapters
vericify attach --adapter codex --label "Primary Codex session"
vericify attach --adapter claude-code --session-id claude-main --capture-mode attachment --label "Claude main"
vericify hub
vericify snapshot
vericify snapshot --format compact
vericify compare --run-id handoff:run-a --compare-run-id workspace:current
vericify publish --run-id handoff:run-a
vericify sync --run-id handoff:run-a --endpoint https://sync.example.test
vericify handoff --id h1 --from capability-ops --to capability-build --title "Review" --status open
vericify todo --id todo-1 --title "Write store" --status in_progress
vericify ledger --tool vericify --category major_update --message "Writer landed"
vericify event --source-module capability-build --event-type STORE_WRITE --status started --payload-json '{"summary":"native write"}'
vericify post --run-id handoff:h1 --agent-id capability-build --kind progress --summary "Checkpoint emitted"
--workspace-rootvericify with no command opens hub--session-id is optional--compare-run-id is optional for publish and syncStart the cockpit:
vericify hub
The cockpit has four views. Each answers a different operational question.
Keys:
q quitj / k move between runsEnter inspect selected run — lane activity, blockers, checkpoint timelinec compare selected run — four-layer diff across exact, structural, semantic, and operational dimensionsy history view — prior runs indexed, recovery patterns ranked by similarity to the current statea adapters view — attached tools and detection statush back to hub — all active runs, what is moving, what is blockedr refresh/ command paletteCtrl+R command history searchThe package exports functions for workspace state projection, run comparison, and artifact publishing:
loadWorkspaceStateprojectWorkspaceStatebuildCompactPacketbuildCompactPacketDetailsbuildCompactDeltadetectAdapterslistAvailableAdapterslistDefaultWorkspacePathsattachAdapterbuildRunComparisonpublishRunArtifactenqueueSyncOutboxItemFAQs
Local-first run intelligence and operations hub for agent systems.
We found that vericify demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.