Workflow & Core Tools · wanshuiyin/Auto-claude-code-research-in-sleep
auto-research-in-sleep
Full end-to-end research pipeline: from a broad research direction through idea discovery, experiments, and review all the way to a polished paper PDF. Use when user says "全流程", "full pipeline", "从找idea到投稿", "end-to-end research", or wants the complete autonomous research lifecycle.
L5 Restricted · Isolated sandbox & strict auditV2 Human-AuditedCredential / SessionExecute CommandNetwork AccessWrite FileDual-pass Audit
Control levels describe skill capabilities and suggested control measures; they do not represent quality or safety certifications, nor do they dictate usability. Usage decisions rest entirely with users and administrators. Different agent hosts apply varying constraints; do not assume hosts provide automatic protection. Third-party skill copyrights belong to their original authors. Use at your own risk.
1How It Works & Mechanism
The entire product is not a monolithic executable but 82 Markdown 'skills' (SKILL.md): installation simply symlinks each skill directory to the project's .claude/skills/<name>, loaded via the host CLI's slash-command discovery mechanism, with behaviors fully orchestrated by prompts and backed by a few deterministic scripts.
README.md
bash Auto-claude-code-research-in-sleep/tools/install_aris.sh ~/your-project # symlinks ARIS skills into <project>/.claude/skills/
What is happening here: decoupling 'skills' into host-agnostic plain-text assets (the same set of SKILL.md serves Claude Code, Cursor, Trae, Antigravity, and Copilot CLI simultaneously, while Codex has a separate skills/skills-codex/ mirror). Installation and uninstallation run via tools/install_aris.sh + the .aris/installed-skills.txt manifest, modifying only the entries it installed.
The flagship entrypoint /research-pipeline chains five stages together (idea-discovery → experiment-bridge → auto-review-loop → summary → paper-writing), with each stage's execution status and 'acceptance status' separately persisted to .aris/runs/<run_id>.json, allowing interrupted runs to resume rather than restart.
skills/research-pipeline/SKILL.md
- **RESUMABLE = true** — When `true` (default), the pipeline records per-stage state to `.aris/runs/<run_id>.json` so a crashed/interrupted run can resume via `/research-pipeline — resume <run_id>` instead of restarting. Stage status splits `done` (executor finished writing) from `accepted` (the stage's cross-model gate / deterministic verifier passed); resume re-validates any `done`-but-unaccepted stage. See `shared-references/resumable-runs.md`.
Resumption semantics are the core design here: done means the executor self-reports completion (allows same-model self-evaluation), while accepted must be issued by a cross-model review or a deterministic validator. Resumption starts from the first non-terminal stage, ensuring that 'completed but not yet accepted' stages are re-audited rather than skipped.
The 'sleep-and-run' pattern operates as: Stage 1 handles topic selection during the day/evening, while Stages 2-3 (experiment implementation + autonomous review loop) run unattended; Stage 3 is the internal multi-round loop within /auto-review-loop (defaulting to 4 rounds, stopping only when score ≥ 6 and verdict ∈ {ready, almost}), requiring no external timers.
skills/research-pipeline/SKILL.md
**Sweet spot**: Run Stage 1 in the evening, launch Stage 2-3 before bed, wake up to a reviewed paper.
The Key Rules in the same document state: '- **Stages 2-3 can run autonomously** once the idea is selected. This is the "sleep and wake up to results" part.'; stop conditions are codified in skills/auto-review-loop/SKILL.md constants (a dual AND condition of MAX_ROUNDS = 4 and POSITIVE_THRESHOLD).
Strict, constitutional-grade constraints govern 'external timers': cron/heartbeats can only govern when to wake up and push tasks forward, and must never evaluate work quality; if a heartbeat detects stagnation, it may only pivot structural direction or escalate to a human, never declare work 'good enough'.
skills/shared-references/external-cadence.md
One-liner: **a heartbeat may say "keep going," never "good enough."**
The same document uses a table to contrast 'waiting on external facts (additive, safe for /loop)' against 'wrapping internal semantic loops (harmful, forbidden)', explicitly noting that /auto-review-loop and /experiment-queue must not be wrapped by external loops (which would drop reviewer thread memory and clash with internal 60s schedulers). This provides a self-constraint layer often missing in comparable 'autonomous agent' projects.
Liveness and monitoring during unattended runs rely on deterministic daemons: on GPU servers, a watchdog using only the Python standard library + nvidia-smi monitors workloads, emits DEAD/IDLE/STALLED/STALE alerts by task type, and aggregates them into summary.txt for low-frequency polling.
docs/WATCHDOG_GUIDE.md
A lightweight Python daemon that runs on each GPU server, continuously monitoring all registered tasks. Zero dependencies beyond Python 3 standard library + `nvidia-smi`.
On the local side, a built-in aris-monitor (pure stdlib Tkinter floating window) reads ~/.claude/sessions/<pid>.json with status=="waiting" to identify which session is blocked on permission confirmation. The README states: '**No network calls, ever.**' (its only non-read action is raise-only window activation upon clicking a row).
The mechanism making reviews authoritative is a cross-model jury: the executor (Claude / Codex / Cursor / Antigravity / Copilot CLI) writes code and drafts the paper, while the reviewer must belong to a different model family (Codex MCP's GPT-6-Astra, claude-review / gemini-review MCP, or Copilot's native rubber-duck), with thread/trace IDs archived for every review call.
AGENT_GUIDE.md
Executor (Claude / Codex / Cursor / Antigravity / Copilot CLI) writes code & papers; reviewer (GPT-6-Astra via Codex MCP, Claude / Gemini via `claude-review` / `gemini-review` MCP, or Copilot's evidence-gated native complementary reviewer for `/auto-review-loop`) critiques independently.
Default routing and effort levels are defined in skills/shared-references/reviewer-routing.md: standard invocations use gpt-6-astra + xhigh, while deep auditing skills (/proof-checker, /kill-argument, /paper-claim-audit, /experiment-audit, etc.) require ultra, mandating that the initial invocation explicitly pin model and model_reasoning_effort.
The 'model mashup layer' is dual-layered: the executor utilizes the host's native ANTHROPIC_* / vendor-compatible endpoint environment variables, while the reviewer operates via repo-shipped MCP bridges (llm-chat / minimax-chat / gemini-review / claude-review), allowing execution and review to use entirely different providers and API keys.
docs/LLM_API_MIX_MATCH_GUIDE.md
本指南说明如何自由搭配 Claude Code 执行器和外部审查器的 API。
The document provides copy-pasteable mcpServers configuration snippets (e.g., llm-chat env containing LLM_API_KEY + LLM_BASE_URL=https://api.deepseek.com/v1 + LLM_MODEL=deepseek-chat) and outlines executor-side combinations like Z.ai/Kimi/LongCat/custom endpoints; /auto-review-loop-llm and /auto-review-loop-minimax serve as ready-to-use entrypoints for these reviewer backends.
Actual experiment execution orchestrates remote/rented compute directly via Bash: deployment through ssh + rsync + screen, rented vast.ai instances (with auto-destroy and budget guardrails), or Modal serverless GPUs; decisions are driven by gpu: local|remote|vast|modal in the project's CLAUDE.md.
skills/run-experiment/SKILL.md
- **Vast.ai** (`gpu: vast`): Check for `vast-instances.json` at project root — if a running instance exists, use it. Also check `CLAUDE.md` for a `## Vast.ai` section.
The vast-gpu skill handles discovery and lifecycle (vastai search offers / create instance / destroy instance, logging instances in vast-instances.json); serverless-modal manages Modal (modal run initiated locally, per-second billing, scale-to-zero). monitor-experiment reads back screen hardcopies, result JSONs, and W&B curves.
The agent entrypoint to the repository is AGENT_GUIDE.md (a structured routing index for LLMs), explicitly declaring that 'SKILL.md is the ground truth; when the guide conflicts with SKILL.md, SKILL.md prevails'—mitigating narrative drift across a large repository.
AGENT_GUIDE.md
> **Source of Truth.** This file is a *routing index*, not a specification.
The same guide provides a platform-to-skill root mapping table (Claude/Cursor/Trae/Antigravity/Copilot use skills/<name>/SKILL.md, Codex uses skills/skills-codex/<name>/SKILL.md), implementing multi-host support via mirrored directories rather than forked codebases.
2Core Capabilities
01End-to-end autonomous research pipeline (topic selection → experiments → review → drafting), chaining 5 stages via a single /research-pipeline command
02Resumable unattended review loop: defaults to 4 rounds, halts upon reaching criteria, recovers via status files after crashes
03Cross-model adversarial review: routeable across Codex/GPT-6-Astra, Claude, Gemini, arbitrary OpenAI-compatible models, MiniMax, Copilot native rubber-duck, or manual human backends
04Remote/rented GPU experiment execution and monitoring (SSH servers, on-demand vast.ai rentals with auto-destruction, Modal serverless, multi-job queue + watchdog daemon)
05Multi-source literature and novelty validation (cross-deduplication across arXiv / Semantic Scholar / OpenAlex / DeepXiv / Exa / Gemini / local PDFs / Zotero / Obsidian)
06Hallucination-resistant citation pipeline: replaces memory-based BibTeX authoring with verified DBLP/CrossRef lookups, flagging failures with [VERIFY]
07Persistent Research Wiki: papers, hypotheses, experiments, and claims mapped into a graph across research lifecycles (failed ideas have highest retention priority, never pruned)
08Mobile notifications and human-in-the-loop approvals: Feishu webhook alerts + interactive approve/reject, plus a zero-API-cost manual review backend
3External Dependencies
| Kind | Dependency / Endpoint |
|---|---|
| cli | codex（OpenAI Codex CLI，`codex exec` 子进程） |
| cli | vastai（vast.ai 租机 CLI） |
| cli | modal（Modal 无服务器 GPU） |
| cli | ssh / rsync / screen / nvidia-smi（远程 GPU 服务器部署与巡检） |
| cli | rsync 代码同步（远端部署路径之一） |
| cli | LaTeX 工具链（latexmk / pdfinfo / pdffonts，论文编译与体检） |
| api | Anthropic 兼容端点（执行器侧，可用官方或第三方兼容网关） |
| api | OpenAI 兼容 LLM API（llm-chat MCP，可指向 OpenAI/DeepSeek/Kimi/MiniMax/自建兼容端点） |
| api | DeepSeek（经 llm-chat 作为审查器后端） |
| api | Moonshot / Kimi（经 llm-chat 作为审查器后端） |
| api | MiniMax Chat（minimax-chat MCP，/auto-review-loop-minimax 的专用后端） |
| api | Google Gemini（gemini-review MCP，直接 API 生成端点） |
| api | Feishu / Lark 机器人 webhook（推送通知） |
| api | Exa 搜索 API（exa-py SDK；/exa-search 与 /research-lit 的 sources: exa） |
| api | Semantic Scholar Graph API（论文检索） |
| api | OpenAlex API（引用图谱检索） |
| api | arXiv（元数据 API + PDF 下载） |
| api | CrossRef / DBLP（真实 BibTeX 校验，反幻觉引用） |
| api | Weights & Biases（训练曲线回读；由 monitor-experiment / training-check 调用） |
| api | Overleaf Git 桥（论文双向同步，凭 keychain/token） |
| network | 本地 HTTP 服务（人工审查 MCP 在 127.0.0.1 开浏览器审批页；飞书桥默认 5000 端口） |
| package | lark-oapi（Python 飞书 SDK，feishu-bridge 依赖） |
| package | httpx（llm-chat / minimax-chat 的 HTTP 客户端） |
| package | deepxiv-sdk（可选：渐进式论文阅读技能 /deepxiv） |
4Recommended Governance & Evidence
Suggested Controls for Safe Operation
For Agent Runtime
Isolated environment, per-use explicit authorization
For Administrators
Strict authorization, full audit, compliance signoff
Evidence & Triggers (File Paths & Excerpts)
- 本地凭据 / 浏览器配置: Read user login cookies/sessions/keyrings: Overleaf token: retrieved via system keychain (tools/overleaf_setup.sh fetches from macOS keychain, overle
- scripts/: Execute local scripts or commands: mcp-servers/codex-exec/server.py: repeatedly spawns subprocesses running `codex exec` (argv = [CODEX_BIN,
- 网络端点: Declare external network access: api.anthropic.com / api.z.ai / api.moonshot.cn / api.longcat.chat (executor-side ANTH
- 本地工作目录: File read/write & artifact generation: .aris/runs/<run_id>.json (stage status and acceptance records) and .aris/runs/<run_id>.iterations.jsonl (halting criteria)
Audit Notes: This is not a pure prompt pack, but an end-to-end execution environment that interacts directly with real systems: (1) Directly reads/uses numerous API credentials and local configuration files (ANTHROPIC_*, LLM_*, MiniMax, Gemini, Exa, W&B, ~/.codex/config.toml, ~/.gemini/.env, ~/.claude/feishu.json, ~/.modal.toml, vastai key, Overleaf keychain); (2) Installs dependencies and provisions remote services (pip install vastai/modal/exa-py/deepxiv-sdk, lark-oapi, httpx; SSHs into user servers to rsync and install packages; rents vast.ai/Modal resources billed hourly); (3) Executes arbitrary experiment scripts, ssh/rsync/screen, git, and curl across a broad Bash(*) tool surface, configurable under README guidance for unattended overnight execution; (4) Ingests untrusted third-party content (papers, web pages, review outputs, community skills) along rendering/execution pipelines with prompt injection risks. It avoids a critical safety downgrade because it does not disable TLS, bypass anti-scraping protections, or scrape bulk targets—it runs user-defined research code. Furthermore, it embeds rare self-governance controls (acceptance gates prohibiting self-validation, reviewer family separation, external cadence rules barring timers from assessing quality, threat_scan injection auditing, vast.ai auto-destroy/budget caps, clear warnings against entering billing info in CLI, manual review backends, and default human checkpointing). Conclusion: Risks stem from the inherent operational surface and credential concentration of an autonomous research infrastructure, not malicious intent; Orange tier = configure intentionally before execution (paying close attention to automated allowlists and remote host data boundaries).
5Second-Pass Verification
- [ok] skill.path 定位（旗舰入口选择） — 候选与判据：① 仓库根——glob 确认无 SKILL.md、无 plugin.json/.claude-plugin 清单，且 skills/ 下是 82 个平级技能目录（多入口多技能插件），按共享路径规则不取根；② skills/research-pipeline——README 快速开始的单命令总入口写的是 `/research-pipeline "your research direction" # Full pipeline: Workflow 1 → 1.5 → 2 → 3 end-to-end`，docs/SKILLS_CATALOG.md 的『🏗️ Workflow Orchestrators』一节以 '**Most users start here.**' 开头并把 /research-pipeline 列为第一条（'**Full chain** — Workflow 1 → 1.5 → 2 → 3, from research direction to submission-ready paper'），AGENT_GUIDE.md 亦写 'Main chain: /research-pipeline = W1 → W1.5 → W2 → W3'——三处独立证据一致指向它；③ skills/idea-discovery（W1）与 skills/auto-review-loop（W2，『睡觉跑』本体）——都是它的下游子技能，按『never a sibling sub-skill』规则不取。结论：取 skills/research-pipeline 作为旗舰条目。
- [ok] pin commit 与本地工作副本一致 — git rev-parse HEAD 输出 15b9b27de6e265a058e875bbf15b09bf8a522aa3，与任务给定 pin 逐字符相同；未执行任何写操作。
- [ok] license 元数据 — 仓库根 LICENSE 首行 'MIT License'、'Copyright (c) 2026 wanshuiyin'，与任务给定 MIT 一致。
- [ok] 『82 skills』声明的真实性 — skills/ 下 86 个目录 − 4 个非技能目录（shared-references 与三个 skills-codex* 镜像/叠加层）= 82，与 README:612 与 docs/SKILLS_CATALOG.md 的 82 完全对齐；README 顶部另一处提到 '81 bundled skills' 指的是 ARIS-Code CLI 二进制内置包，与本仓库 main 树的 82 个目录不是同一口径，已在结论中按 main 树口径采信。
- [ok] 外部依赖：codex 审查器确实是本地子进程而非文档承诺 — mcp-servers/codex-exec/server.py 源码含 `argv = [CODEX_BIN, "exec"]`、`subprocess.Popen(argv, ...)`、`shutil.which(CODEX_BIN)`，且 CODEX_BIN 默认为 'codex'；README/AGENT_GUIDE 关于『codex-cli 0.154 删除 codex mcp-server 后由本仓库自带桥接管』的叙述与代码一致。
- [ok] 外部依赖：审查器端点逐个可定位 — LLM(llm-chat)、MiniMax、Gemini 三处端点均来自各自 server.py 的 os.environ 默认值或请求构造行；Exa 走 SDK（仅 EXA_API_KEY + exa-py 可见，无硬编码域名，已在 endpoint 字段标明 exa.ai 而非杜撰 API 路径）；arXiv/CrossRef/S2/OpenAlex 均命中 tools/*.py 的常量。
- [discrepancy] 凭证读取：是否存在未披露的密钥读取 — 第一遍只列了环境变量与 ~/.gemini/.env、~/.claude/feishu.json。第二遍补到三处未在首轮列出的读取面：① ~/.codex/config.toml（README 明确 reviewer 模型来源，属读取用户 LLM 凭证/配置）；② ~/.modal.toml 与 vastai 的 API key 文件（serverless-modal / vast-gpu 技能要求）；③ 全局指针 ~/.aris/repo 与项目 .aris/installed-skills.txt（被技能 bash 块读取以解析 helper 路径）。三者均为『本地配置/凭证文件读取』，已并入 security.credential_reads，结论档位不变（橙色本就因凭证接触面）。
- [ok] 注入面：是否真的做了防御而非只在文档里写 — tools/threat_scan.py 实现存在（regex、scope all/context/strict、quarantine 返回占位符 + findings），且 skills/idea-creator/SKILL.md 的 'ARIS_QUERY_PACK_SCAN_START … END' bash 块真的解析并调用它、扫描失败时跳过 wiki 上下文；skills/shared-references/injection-hygiene.md 给出『干净扫描≠安全』与分档 warn/block 规则。防御是落地的，不是宣言。
6Verdict & Scenarios
Best for: Ideal for ML, systems, and robotics researchers with defined research directions who want to offload literature survey, idea verification, experiment deployment, iterative refinement, and drafting to overnight or background runs. Also suited for individual researchers and labs using Claude Code or Codex CLI with access to local/remote GPUs or rented compute, looking to replace single-model self-evaluation with cross-model adversarial review. Highly valuable for engineers studying autonomous workflow governance—the repository codifies acceptance gates, reviewer independence, cadence boundaries, and prompt-injection hygiene into executable contracts.
Not for: Not suitable for: beginners expecting turnkey zero-config operation unwilling to manage multiple API keys and MCP configurations (initial setup requires Claude Code + Codex login + MCP registration + GPU specs in CLAUDE.md); cautious users unwilling to grant autonomous shell/file-writing permissions (who must either keep human checkpoints or accept interactive approval pauses during overnight runs); strictly air-gapped environments prohibiting data egress to commercial model providers (executors and reviewers rely on external APIs); users with one-off tasks not requiring long-horizon pipeline orchestration; and anyone treating AI review scores as publication guarantees—the pipeline optimizes AI review heuristics, not human peer-review or conference acceptance.
Install Agent-Ready
① Verified Mirror 2026-09-15
Option A · Direct DownloadDownload auto-research-in-sleep.tar.gz
sha256:
Option B · Copy Guide for Agentbbe5d4e4e1f79f79…Agents automatically download and verify mirrors from this JSON guide.
② Upstream GitHub
GitHub Repo ↗
Pinned to commit 15b9b27de6.