
Security News
Nx npm Packages Compromised in Supply Chain Attack Weaponizing AI CLI Tools
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
An open-source, CLI-based programming agent for Rubyists.
airb is an open‑source, CLI‑based programming agent for Rubyists. We built it to explore a clean, composable agent architecture grounded in cybernetics—specifically Stafford Beer's Viable System Model (VSM)—and to make a practical tool you can run in your terminal to read, list, and edit files with the help of modern LLMs.
In short:
If you like small objects, clear seams, and UNIXy ergonomics, airb is for you.
A CLI programming agent that:
Streams assistant output to your terminal as it thinks.
Uses native, structured tool calling across providers:
Ships with core programming tools (as capsules):
list_files(path?)
— directory listing (dirs end with /)read_file(path)
— read UTF‑8 text filesedit_file(path, old_str, new_str)
— replace/create with confirmationRuns on a VSM engine (via the vsm gem):
Provides observability from day one:
.vsm.log.jsonl
)airb (top capsule)
├─ Identity – name, invariants
├─ Governance – sandbox, confirms, budgets
├─ Coordination – floor control, turn end
├─ Intelligence – driver(OpenAI/Anthropic/Gemini), streaming, tool loop
├─ Operations – dispatch tools as child capsules (parallel)
│ ├─ list_files (tool capsule)
│ ├─ read_file (tool capsule)
│ └─ edit_file (tool capsule)
└─ Ports – ChatTTY (CLI), Lens (web)
Requires Ruby 3.4+.
Add to your app or install globally:
# Using Bundler in a project
bundle add airb
# Or install gem globally
gem install airb
airb depends on the vsm gem (the agent runtime & drivers).
Pick one provider and set env vars:
# OpenAI (streaming + tools)
export AIRB_PROVIDER=openai
export OPENAI_API_KEY=sk-...
export AIRB_MODEL=gpt-5-nano # default if unset
# Anthropic (streaming + tool_use)
# export AIRB_PROVIDER=anthropic
# export ANTHROPIC_API_KEY=...
# export AIRB_MODEL=claude-sonnet-4-0 # default if unset
# Gemini (MVP: non-streaming tool calls)
# export AIRB_PROVIDER=gemini
# export GEMINI_API_KEY=...
# export AIRB_MODEL=gemini-2.5-flash # default if unset
From the root of a Git repo:
airb
Sample session:
airb — chat (Ctrl-C to exit)
You: what's in this directory?
<streams…>
airb: README.md
lib/
spec/
tmp/
You: open README.md
<streams…>
airb: (prints file contents)
You: replace the title with "Airb Demo"
<streams…>
confirm? Write to README.md? [y/N] y
<streams…>
airb: OK. Title updated.
Start the local Lens web app (SSE):
VSM_LENS=1 airb
# Lens: http://127.0.0.1:9292
See live timeline & sessions: user messages, assistant deltas, tool calls/results, confirms, audits.
Variable | Meaning | Default |
---|---|---|
AIRB_PROVIDER | openai | anthropic | gemini | openai |
AIRB_MODEL | Model name for chosen provider | see examples above |
OPENAI_API_KEY | OpenAI auth | — |
ANTHROPIC_API_KEY | Anthropic auth | — |
GEMINI_API_KEY | Gemini auth | — |
VSM_LENS | 1 to enable web Lens | off |
VSM_LENS_PORT | Lens port | 9292 |
VSM_LENS_TOKEN | Optional access token (append ?token=...) | none |
Workspace: airb auto‑detects repo root (git rev-parse). If not a repo, it uses Dir.pwd
.
Capability | OpenAI | Anthropic | Gemini (MVP) |
---|---|---|---|
Streaming text | ✅ SSE | ✅ SSE (text_delta) | ➖ (planned) |
Structured tool calls | ✅ tools/tool_calls | ✅ tool_use/tool_result | ✅ functionCall/Response |
Parallel tool calls | ✅ supported | ✅ supported | ✅ supported |
System prompt handling | in messages | header param (system) | in content / safety opts |
airb normalizes these differences so your CLI experience is the same.
Create a class that inherits VSM::ToolCapsule
, describe its schema, implement #run
.
# lib/airb/tools/search_repo.rb
class SearchRepo < VSM::ToolCapsule
tool_name "search_repo"
tool_description "Search files for a regex under optional path"
tool_schema({
type: "object",
properties: { path: {type:"string"}, pattern:{type:"string"} },
required: ["pattern"]
})
# Optional: choose how it executes (fiber/thread/ractor/subprocess)
def execution_mode = :thread
def run(args)
root = governance.send(:safe_path, args["path"] || ".")
rx = Regexp.new(args["pattern"])
matches = Dir.glob("#{root}/**/*", File::FNM_DOTMATCH).
select { |p| File.file?(p) }.
filter_map do |file|
lines = File.readlines(file, chomp:true, encoding:"UTF-8") rescue []
hits = lines.each_with_index.filter_map { |line,i| "#{file}:#{i+1}:#{line}" if rx.match?(line) }
hits unless hits.empty?
end
matches.flatten.join("\n")
end
end
Register it in your organism under Operations:
operations do
capsule :search_repo, klass: SearchRepo
end
The Intelligence system automatically advertises it to the model as a structured tool (OpenAI/Anthropic/Gemini shapes).
When a "tool" needs multiple steps (plan → read → patch → verify), make it a full capsule with its own 5 systems (Operations/Coordination/Intelligence/Governance/Identity). Expose it as a tool by including VSM::ActsAsTool
and implementing #run(args)
that orchestrates internally, then returns a summary.
This keeps the parent simple while the sub‑agent stays cohesive and testable.
execution_mode
to :thread
for CPU‑heavier work.edit_file
prompts for confirmation before writing.VSM_LENS=1
, then open http://127.0.0.1:9292.edit_file
airb -e "…"
) for one‑shot automationBug reports, ideas, and PRs welcome!
MIT (same as vsm), unless noted otherwise in subdirectories.
FAQs
Unknown package
We found that airb demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.