coleam00

@mattpocockuk That's the way to go. Check this one as a base as well. coleam00/Archon

I built Ponder: a Claude Code skill for AI that knows when to speak — and when to shut up Right now, AI basically means pattern matching—and as soon as a model doesn't have a piece of information, or finishes finding the real bugs on Pass 1, it decides to make up or assume information just to fill the turn. Why? Because LLMs are trained to never stay silent. I built Ponder (bin/ponder + SKILL.md) by myself around a simple premise: AI that knows when to speak, and knows when to shut up. Sometimes a voice or a pass has nothing new to add, and silence should be a valid, mathematically verified output. And when it does speak, it should be able to act as someone else and view your software from another perspective—including the actual human emotions associated with using it. How it works 1. 4 Perspectives = 4 Delta Operations Instead of open-ended roleplay where agents talk over each other, Ponder runs 4 voices where each one owns only one mutation on an append-only JSONL ledger (findings.jsonl): - Dreamer (add): Enumerates every reviewable unit and discovers missing coverage. - Skeptic (delete): Falsifies and retracts claims that don't have concrete file:line proof. - Builder (edit): Grounds surviving findings in exact paths and verification steps. - Empath (change): Steps into the user's shoes—with the emotions associated with that state—and re-scores severity (must / should / could). 2. Silence is First-Class (voices vs. deltaVoices) Ponder separates who showed up to verify (voices) from who mutated the ledger (deltaVoices). A voice can inspect the entire ledger, agree nothing needs to change, and stay silent (0 deltas). When all 4 voices review 100% of the enumerated surface and emit 0 deltas across consecutive passes, the CLI outputs stop (converged). 3. Coverage Gate & 3-Way Ledger Verification Pass 1 is blocked from stopping until coverage == 1.00 of enumerated units are graded. Every finding is verified against disk and git history (Phantom Rule), and ponder verify reconciles session.json, passes/, and findings.jsonl. --- One-Shot Without Ponder vs. One-Shot With Ponder (K=5 Study + 3 Live Audits) Technically, typing "ponder this codebase" is still a single user prompt—the human sends one prompt while Ponder runs the multi-pass loop in the background. To factor out LLM temperature variance, I ran a K=5 repeated-measures study across a 12-module codebase comparing a standard one-shot prompt against a one-shot prompt with Ponder: - Precision: 56.8% (Standard) → 100.0% (Ponder) (Mann-Whitney U = 0, p = 0.0079) - Critical (must) Bug Recall: 56.0% → 100.0% (+44% more real bugs caught on Pass 2 via Dreamer's coverage gate) - False Positives: 3.8 / run → 0.0 / run (~43 mins of ghost-bug debugging saved per audit) I also ran 4-pass architecture audits today across 3 major open-source AI repos (72.3k+ combined stars): - steipete/CodexBar (22.9k★): Skeptic retracted a Pass-1 credential-file false alarm after verifying its 0700 + O_EXCL + atomic rename defense, while Builder verified a real POSIX_SPAWN_SETPGROUP race where kill(-pgid) can kill CodexBar.app's own process group (Issue #4829 — rated 🦞 diamond lobster by the repo's automated triage bot — + Fix PR #4830). - EveryInc/compound-engineering-plugin (25.7k★): Skeptic retracted a false path-traversal alarm, while catching codex.ts/pi.ts clobbering user symlinks and unbounded .bak.<ts> spam (Issue #1916 + Fix PR #1919). - coleam00/Archon (23.8k★): Skeptic retracted a false open-redirect alarm, while isolating a static signCookie("authenticated") token with no expiry/rotation binding and a double decodeURIComponent URIError crash (Issue #5256 + Fix PR #5257). --- How this relates to Caveman If you've seen the Caveman skill: Caveman makes speech very brief (syntax compression), which saves output tokens when the model talks, whereas Ponder silences forced speech altogether when a voice or pass has nothing true to add (epistemic compression). They actually complement each other really well. Repo & Install (MIT, zero dependencies, Node 18+) GitHub: **Quinnod345/ponder** git clone https://github.com/Quinnod345/ponder.git ~/.claude/skills/ponder ln -sf ~/.claude/skills/ponder/bin/ponder /usr/local/bin/ponder

どうしても見ちゃうんだよな第二弾。 gist.github.com coleam00/claude-memory-compiler

An open-source Excalidraw skill changed how my agents draw diagrams. I took 3 rules from it. A diagram has to argue a point. Under 30% of it sits in boxes. The agent renders the picture and looks at it before saying it's done. coleam00/excalidraw-diagram-skill

@cjemmyyy I used this from @cole_medin coleam00/second-brain-starter

Archon's Agent Control API Has No Login and Listens on Every Interface: The CVE-2026-111322 Lockdown Guide On October 15, 2026, VulnCheck published CVE-2026-111322 against Archon, the open-source workflow engine behind Claude Code, Codex, and Pi. The finding is brutally simple: in a default install, Archon's /api/* control API has no authentication, and the server binds to 0.0.0.0 — every network interface. That matters because this API is not a status page. It starts workflow runs, injects messages into agent conversations, and approves or rejects the actions your AI coding agent paused on for human review. Anyone on your network can do all of that with no credential. By the end of this guide you will have a locked-down Archon install — in about 10 minutes, with zero code changes. What Archon Is, in One Line Archon (23,700+ stars on GitHub) is an open-source engine that drives AI coding agents through YAML-defined development workflows. You run archon serve, and a web console lets you watch the agent work, talk to it, and approve the actions it pauses on. That console talks to the HTTP control API at the center of this CVE. The Finding, Precisely Security researcher hieuPenguinnn pinned the root cause to three facts in the Archon OS server package (reviewed at release tag v0.11.1, published 2026-09-25): 1. The server binds to all interfaces by default. packages/server/src/index.ts sets the bind host to process.env.HOST || '0.0.0.0', and the shipped .env.example confirms the default port is 3090. A default install is network-reachable on port 3090. 2. The API gate is disabled by default. The /api/* middleware only enforces authentication when isApiGateEnabled() is true — which requires both a Postgres DATABASE_URL and a BETTER_AUTH_SECRET. A default install uses SQLite and sets neither, so every request passes through with no identity check. 3. The mutating routes are the agent control plane. Behind that disabled gate: start workflow runs (POST /api/workflows/{name}/run), inject conversation messages, approve/reject paused agent actions, and connect/disconnect provider keys. The one-line version: anyone who can reach port 3090 on your machine can drive your AI coding agent. The CVE carries CWE-306 (missing authentication for critical function) plus CWE-862, CVSS 9.8 (v3.1) / 9.3 (v4.0). Affected: versions 0.2.13 through 0.11.1. As of October 16, 2026, the latest release is still v0.11.1 — there is no vendor patch and no published advisory. One honest caveat from the researcher's own writeup: he did not establish direct remote code execution on the host from source review alone — the provider-key list route returns metadata only, and the damage a driven run can do depends on the workflows and agent configured. VulnCheck scores it 9.8 because the agent plane is reachable and these agents run commands. Treat it as critical either way. !A programmer typing code on a laptop, representing the AI coding agent running on the developer's machine The agent runs on your machine with your permissions. Its control plane should not be network-open. Prerequisites - SSH or terminal access to the machine running archon serve - Your Archon .env file (or however you set its environment variables) - About 10 minutes Example terminology: <your-host> is the machine running Archon. Port 3090 is the default from the shipped .env.example — replace it if you changed it. Step 1 - Check Whether You Are Affected Check your Archon version first. If it falls between 0.2.13 and 0.11.1 inclusive, you are running affected code: # inside your Archon checkout or container git describe --tags 2>/dev/null || grep -m1 '"version"' package.json Then check your config. You are exposed when all three are true: no HOST set to 127.0.0.1, no Postgres DATABASE_URL, and no BETTER_AUTH_SECRET: grep -E '^(HOST|PORT|DATABASE_URL|BETTER_AUTH_SECRET)' .env Missing lines mean defaults apply: HOST=0.0.0.0, SQLite, no auth. That is the vulnerable posture — and it is the shipped default. (Note: this is a different defect from CVE-2025-69443, which concerned Archon's archived Python backend.) Step 2 - Check What the API Is Actually Bound To Do not trust the config file alone — check the listening socket: ss -tlnp | grep 3090 You should see one line. If it reads 0.0.0.0:3090, the control API is reachable from your entire network. If it reads 127.0.0.1:3090, the network reach is already gone and you can skip to Step 5. > Warning: localhost in a URL does not mean the server is loopback-only. Plenty of setups proxy through a tunnel while the underlying server still sits on 0.0.0.0. The ss output is the ground truth. Step 3 - Bind the Server to Loopback This is the single highest-leverage fix. The shipped .env.example documents it explicitly: # HOST=0.0.0.0 # Bind address (default: 0.0.0.0). Set to 127.0.0.1 to restrict to localhost only. # PORT=3090 # Default: 3090. Set it in your .env (create the file if you do not have one): HOST=127.0.0.1 Restart the server, then re-run Step 2. You should now see 127.0.0.1:3090 — other hosts on your network can no longer reach the API at all, even though the auth gate is still disabled. The researcher confirms this removes the network reach entirely. Step 4 - Block the Port at the Firewall Bind config is one layer; the firewall is the second. Deny inbound traffic to 3090 from anywhere except the local machine: # Ubuntu/Debian with ufw sudo ufw deny 3090 ufw deny 3090 blocks inbound connections to that port from all interfaces. Loopback traffic from your own machine still reaches 127.0.0.1:3090, so the web console keeps working locally. If you run Archon in Docker with published ports, remove the -p 3090:3090 mapping and use --network host or container-to-container networking instead — a published port re-opens the door the bind config just closed. Step 5 - If You Need Network Access, Enable Web Auth Only do this step if you genuinely need to reach Archon from other machines. The supported way to arm the auth gate is to set both a Postgres database URL and a secret: DATABASE_URL=postgresql://<user>:<password>@<host>:5432/archon BETTER_AUTH_SECRET=<generate-a-long-random-string> Generate the secret with openssl rand -hex 32 — never reuse one from another service. With both set, isApiGateEnabled() returns true and the middleware enforces a 401 on non-allowlisted /api/* routes. If that migration is too heavy right now, keep Step 3 and 4 and put a reverse proxy with basic auth in front of Archon instead. Never expose port 3090 directly to the internet or an untrusted network. Step 6 - Verify Everything Works Three checks, in order: # 1. Loopback still answers curl -s http://127.0.0.1:3090/api/health # 2. Nothing listens on the external interface ss -tlnp | grep 3090 # expect 127.0.0.1:3090 only # 3. The web console loads locally # open http://127.0.0.1:3090 in your browser If check 1 succeeds and check 2 shows only the loopback line, the lockdown holds: the agent control plane is reachable from your machine and nowhere else. !Code on a dark screen, representing the control API that should stay off the network The fix is three lines of config and one firewall rule — not a patch, because none exists yet. FAQ Am I safe if I only use Archon on my laptop? Probably — if nothing else on your network can reach it. "Probably" is not a control, though: run Step 2 and confirm 127.0.0.1:3090. Coffee-shop Wi-Fi and office LANs are exactly the networks where an open 0.0.0.0 bind hurts. Is this the same as the old Archon Python CVE? No. CVE-2025-69443 concerned the archived Python backend. CVE-2026-111322 is in the TypeScript Archon OS server line — a separate defect in a separate codebase. Has Archon patched it? Not yet. As of October 16, 2026 there is no public advisory for this defect and the latest release (v0.11.1, from September 25) is still affected. Watch the coleam00/Archon releases page for a version that changes the default bind host or adds auth — keep the lockdown until then. Does this affect n8n too? No — this is Archon-specific. But the pattern is worth auditing everywhere: any agent tool you run (archon serve, local LLM servers, MCP servers) that binds 0.0.0.0 by default is the same class of mistake. Grep your running services with ss -tlnp and question every 0.0.0.0. Limits and What I Did Not Test I did not spin up Archon and execute requests against a live instance here — the findings above come from VulnCheck's advisory (October 15, 2026) and the researcher's pinned source review at v0.11.1, both of which agree on the three root-cause facts. The mitigation steps are config-level and low-risk, but back up your .env before editing. And this lockdown fixes the network reach — it does nothing about prompt injection, malicious plugins, or supply-chain attacks on the agent itself, which are separate problems with their own fixes. Key Takeaways 1. CVE-2026-111322 is a missing-authentication flaw (CVSS 9.8) in Archon 0.2.13–0.11.1: the /api/* control API has no login and binds to 0.0.0.0:3090 by default. 2. The shipped default is the vulnerable posture — the auth gate only arms with both a Postgres DATABASE_URL and a BETTER_AUTH_SECRET, which a default SQLite install never sets. 3. Set HOST=127.0.0.1 and firewall port 3090 — two changes that remove the network reach entirely, verified with ss -tlnp. 4. No vendor patch exists as of October 16, 2026 — keep the lockdown until a release notes an auth fix. 5. Audit your other agent tools for the same pattern — any local server binding 0.0.0.0 by default is this bug waiting for a CVE number. Next step: if you run AI coding agents, read our [Plugin4Shell breakdown](/blog/plugin4shell-zero-click-rce-ai-coding-agents/) — a separate zero-click flaw where a pinned plugin commit turned out to be a lie. And if you self-host n8n, our [exposed-instances hardening checklist](/blog/censys-114000-exposed-n8n-hardening-checklist/) covers the same bind-and-expose pattern for automation infrastructure. --- Images: Pexels --- *Originally published on CortexFlow. Free n8n templates: cortexflow.tech

Archon's Agent Control API Has No Login by Default and Listens on 0.0.0.0. No Patch Yet - Book: Ship It — the pragmatic startup tech stack - Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go - My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools - Me: xgabriel.com | GitHub --- You run archon serve on a dev box so you can watch your coding-agent workflows in a browser. Anyone else on that network can now start those workflows too, send your agent messages, and click Approve on the actions it paused to ask you about. No password is involved, because in a default install there isn't one. That is the finding behind CVE-2026-111322, published by VulnCheck on October 15, 2026 against Archon, the open-source workflow engine that drives Claude Code, Codex and Pi through YAML-defined development workflows. The repo has 23.7k stars. As of October 16, its latest release is still v0.11.1, the last affected version, and the repo's security page lists no published advisory. What the advisory says VulnCheck's advisory covers Archon >= 0.2.13, <= 0.11.1, classes it as CWE-306, "Missing Authentication for Critical Function", and scores it 9.3 under CVSS 4.0. The CVE record mirrored by Strix carries a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N), with NVD's own analysis still pending. In VulnCheck's words, the /api/* control API binds to "0.0.0.0 by default", and an attacker with network access can send messages to the coding agent, "which runs with bypassPermissions", to run commands on the host as the Archon user. The finding is credited to the researcher who published it as hieuPenguinnn. !An unlocked control panel with glowing approve and run buttons, its cable running out through an open door onto a wide network of nodes The agent's control plane, reachable by anything on the network. Why the default install is open The researcher's writeup points at three files at tag v0.11.1, and you can read them yourself. The server picks its bind address in index.ts: const hostname = process.env.HOST || '0.0.0.0'; The project's own .env.example documents that default and its escape hatch: "Set to 127.0.0.1 to restrict to localhost only." The default port is 3090. Authentication is opt-in. The header of auth/config.ts says web auth is off by default and is enabled only when "BOTH a Postgres DATABASE_URL and a BETTER_AUTH_SECRET are present." The gate itself is one line: return isWebAuthEnabled(env) && env.ARCHON_WEB_AUTH_REQUIRED !== 'false'; And the middleware in routes/api.ts waves the request through when that returns false: if (!isApiGateEnabled()) return next(); The researcher describes the out-of-the-box install as SQLite with no secret, and that takes the open path. So a stock install answers /api/* from any machine that can reach port 3090, with no credentials. What an attacker can do, and the part that's disputed The writeup lists what any client that reaches port 3090 can do on a default install, with no credentials: start workflow runs, create conversations and inject messages the agent treats as operator input, approve or reject the agent's paused actions, and, where per-user provider keys apply, connect or disconnect them. The named routes include POST /api/workflows/<name>/run, POST /api/conversations/<id>/message and POST /api/workflows/runs/<runId>/approve. Read the writeup before you repeat the "RCE" headline, though. The researcher states: "This is not remote code execution on the host." They also say "Runtime validation was NOT performed" and that the example requests "were not executed against a live instance." Their own badge reads high, not critical. VulnCheck's advisory goes further and ties the flaw to command execution through the agent's bypassPermissions mode. Both readings can be true at once. The HTTP request doesn't hand anyone a shell by itself. What they get is the steering wheel of an agent that may already be allowed to run shell commands. Claude Code's permission-modes docs describe bypassPermissions as the mode where "Everything" runs without asking, recommended for "Isolated containers and VMs only", and warn that it "offers no protection against prompt injection or unintended actions." How bad a hijacked run is depends on what your workflows and your agent are allowed to do. There's no public exploit yet: as of October 16, The Hacker Wire lists no public proof of concept and says the CVE is not in CISA KEV. The route list in a public writeup is most of a recipe, so don't wait for one. Lock it down until a fix ships Start by checking whether Archon is listening on every interface. On macOS or Linux: lsof -nP -iTCP:3090 -sTCP:LISTEN # Linux alternative: ss -ltnp 'sport = :3090' An address of *:3090 or 0.0.0.0:3090 means every interface. 127.0.0.1:3090 means loopback only. 1. Bind to loopback. Set the variable the project already documents in your .env, then restart archon serve: HOST=127.0.0.1 The writeup notes this removes network reach even though the gate stays disabled. With the gate off, any process on the same machine can still drive the API, so treat loopback as a stopgap. If you run Archon in Docker, the container has to listen on all of its own interfaces, so do the restriction at publish time instead. Assuming the container serves on 3090: docker run -p 127.0.0.1:3090:3090 <your-archon-image> 2. Turn the gate on. Per auth/config.ts, the /api/* gate needs both a Postgres URL and a signing secret of at least 32 characters, and .env.example suggests generating it with openssl rand -base64 32: DATABASE_URL=postgresql://archon:CHANGE_ME@localhost:5432/archon BETTER_AUTH_SECRET=<output of: openssl rand -base64 32> Do not set ARCHON_WEB_AUTH_REQUIRED=false unless an authenticating proxy really does sit in front. The writeup says a deployment with both variables set is not affected. !A short cable looping back into the same laptop, closed with a burnt-orange padlock, while the network outside stays dark Loopback first, then a real gate in front of the API. 3. Put a proxy with auth in front of anything shared. Archon's SECURITY.md already says: "When deploying the server publicly, use the Caddy reverse proxy with authentication (see deploy/docker-compose.yml)". A team server is a public deployment for this purpose, even if "public" means the office Wi-Fi. Then check from a second machine, with ARCHON_HOST set to the dev box's LAN address. /api/health is on the gate's public allowlist in routes/api.ts, so it's a pure reachability test: curl -sS -m 3 "http://$ARCHON_HOST:3090/api/health" If that answers from another machine after step 1, your bind didn't take. Agent harnesses are servers now The researcher's suggested fix is small: default to 127.0.0.1, require a local token on mutating routes even when web auth is off, and warn at startup on a non-loopback bind without auth. It's the same advice you'd give any dashboard, except this dashboard fronts an agent with a shell, your provider keys and an Approve button. This isn't the first unauthenticated-backend finding against Archon either. In May, OX Security wrote up CVE-2025-69443 in the earlier Archon OS line (0.1.0 through 0.3.11), where a backend port with "no CORS protection and no authentication" could be reached from a malicious web page. Per OX, the maintainer's position then was that the app is meant to run locally. So, a question for you: how many agent tools on your machine run a local HTTP server right now, and do you know which address each one binds to? --- If this was useful Most of this post is about the gap between "it runs on my laptop" and "it's safe on a network": bind addresses, auth that defaults to off, a proxy in front. Ship It is my book about that whole stretch for a small team, from hosting and auth to CI/CD and monitoring, so that the next self-hosted tool you stand up starts closed. I also build Hermes IDE, so weigh this with that in mind: it's free, source-available (BSL 1.1), runs on macOS, Windows and Linux, and gives each agent task its own branch and worktree. It's on GitHub, and it isn't affiliated with Archon, Anthropic, OpenAI or any agent vendor. 

coleam00/Archon これめっちゃ良さそう yamlでdagを定義して、決定論的な作業とエージェント呼び出しを組み合わせてワークフローにできる

github.com/coleam00/Archon/blob/dev/AGENTS.md 👆 the engineering principles in this are pragmatic. hard to find something like this #engineering #software #softwareengineering #agents #aitools #claude #codex #opensource

🚀 [Fastest Growing GitHub Repos] Archon: The Free Tool Taking Over GitHub! #shorts Discover coleam00/Archon: The first open-source harness builder for AI coding. Make AI coding deterministic and repeatable. 💬 Comment "ARCHON" below for the direct link, or grab it from the links below: 👉 Interactive Star History & Live Analysis: githubrepo.cloud ⭐ Embed Live Verified Badges in your README: githubrepo.cloud 🔗 Direct GitHub Repository: coleam00/Archon 📊 Repository Specs: ⭐ Stars: 23,630 🍴 Forks: 3,495 💻 Language: TypeScript 📜 License: MIT #shorts #archon #ai #automation #bun #claude #artificialintelligence #machinelearning #deeplearning