@10et/cli 1.0.0

package/packages/pi/skills/content-creator/SKILL.md

@@ -0,0 +1,294 @@
+---
+name: content-creator
+description: Generate social content with brand voice - threads, posts, articles, announcements
+---
+
+# Content Creator Skill
+
+Generate on-brand content for social media and marketing.
+
+## Capabilities
+
+- Twitter threads with preview
+- Single posts/tweets
+- Launch announcements
+- Article drafts
+- One-pagers and briefs
+- Deck content
+- Print-ready exports (PDF)
+
+## Input Requirements
+
+Requires:
+- `knowledge/BRAND_BRIEF.md` - Brand identity
+- `knowledge/VOICE_AND_TONE.md` - How to speak (optional)
+- `knowledge/BRAND_DECISIONS.md` - Visual identity (for previews)
+
+## Commands
+
+```
+/content thread [topic]       # Generate Twitter thread
+/content post [topic]         # Generate single post
+/content announce [what]      # Launch announcement
+/content article [topic]      # Article draft
+/content one-pager [topic]    # One-page summary
+/content deck [topic]         # Presentation content
+/content preview              # Preview in context
+/content export pdf           # Export to PDF
+```
+
+## Workflows
+
+### Twitter Thread
+
+```
+/content thread [topic]
+
+Generating thread on: {topic}
+
+THREAD DRAFT (6 tweets):
+
+1/ {hook tweet - stops the scroll}
+
+2/ {context/problem}
+
+3/ {insight/solution}
+
+4/ {proof/example}
+
+5/ {implication/future}
+
+6/ {CTA}
+   {link}
+
+---
+
+Preview? (yes/no)
+```
+
+If yes, update `previews/content/twitter-thread.html` and open.
+
+### Launch Announcement
+
+```
+/content announce [product/feature]
+
+ANNOUNCEMENT DRAFT:
+
+SHORT (Twitter):
+"{short version - fits in one tweet}"
+
+MEDIUM (Newsletter):
+"{2-3 paragraph version}"
+
+LONG (Blog):
+"{full announcement with context}"
+
+---
+
+Which format to preview?
+```
+
+### One-Pager
+
+```
+/content one-pager [topic]
+
+ONE-PAGER: {topic}
+
+HEADLINE:
+{main headline}
+
+SUBHEAD:
+{supporting line}
+
+THE PROBLEM:
+{1-2 sentences}
+
+THE SOLUTION:
+{1-2 sentences}
+
+KEY BENEFITS:
+• {benefit 1}
+• {benefit 2}
+• {benefit 3}
+
+PROOF POINTS:
+• {proof 1}
+• {proof 2}
+
+CTA:
+{call to action}
+
+---
+
+Export to PDF? (yes/no)
+```
+
+### Article Draft
+
+```
+/content article [topic]
+
+ARTICLE DRAFT: {topic}
+
+HEADLINE OPTIONS:
+1. {option 1}
+2. {option 2}
+3. {option 3}
+
+SUBHEAD:
+{supporting line}
+
+INTRO (1 paragraph):
+{hook + thesis}
+
+SECTIONS:
+1. {section title}
+   {key points}
+
+2. {section title}
+   {key points}
+
+3. {section title}
+   {key points}
+
+CONCLUSION:
+{summary + CTA}
+
+---
+
+Expand which section?
+```
+
+## Preview System
+
+### Twitter Thread Preview
+`previews/content/twitter-thread.html`
+
+Shows thread in Twitter UI context:
+- Dark/light mode
+- Engagement metrics (mock)
+- Your profile info
+- Reply chains
+
+### Article Preview
+`previews/content/article-preview.html`
+
+Shows article in blog context:
+- Your brand styling
+- OG image preview
+- Reading time
+- Share buttons
+
+### One-Pager Preview
+`previews/content/one-pager.html`
+
+Shows formatted one-pager:
+- Print-ready layout
+- Brand colors/typography
+- Export to PDF button
+
+## Voice Application
+
+Read `knowledge/VOICE_AND_TONE.md` and apply:
+
+### Before Writing, Check:
+- Voice attributes (are we being {attribute}?)
+- Words to use / avoid
+- Formatting conventions
+- Tone for this context
+
+### During Writing:
+- Match established patterns
+- Use brand vocabulary
+- Maintain consistent tone
+- Follow punctuation rules
+
+### After Writing, Verify:
+- Does this sound like us?
+- Would we say this out loud?
+- Is it clear to our audience?
+
+## PDF Export
+
+For one-pagers and decks, generate print-ready PDF:
+
+```
+/content export pdf
+
+Exporting to PDF...
+
+Options:
+├─ Size: Letter / A4
+├─ Orientation: Portrait / Landscape
+├─ Include: Header / Footer
+└─ Brand: Apply brand colors
+
+Output: outputs/pdf/{filename}.pdf
+```
+
+Uses browser print-to-PDF or headless Chrome.
+
+## Output Files
+
+```
+outputs/
+├── content/
+│   ├── threads/
+│   │   └── thread-{date}-{topic}.md
+│   ├── posts/
+│   │   └── post-{date}-{topic}.md
+│   ├── articles/
+│   │   └── article-{date}-{topic}.md
+│   └── one-pagers/
+│       └── one-pager-{topic}.md
+└── pdf/
+    └── one-pager-{topic}.pdf
+```
+
+## Content Patterns
+
+### Thread Structures
+
+**The Hook-Proof-CTA:**
+1. Hook (stop scroll)
+2. Problem
+3. Solution
+4. Proof
+5. Implication
+6. CTA
+
+**The List Thread:**
+1. "X things about Y:"
+2-N. List items
+Last. Summary + CTA
+
+**The Story Thread:**
+1. Opening scene
+2-5. Story progression
+6. Lesson/insight
+7. CTA
+
+### Post Formulas
+
+**Problem-Solution:**
+"{Problem statement}
+
+{Solution in your words}
+
+{CTA}"
+
+**Contrarian:**
+"Unpopular opinion: {take}
+
+Here's why: {reasoning}
+
+{CTA if relevant}"
+
+**Announcement:**
+"{What's new}
+
+{Why it matters}
+
+{Link/CTA}"

package/packages/pi/skills/context/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: context
+description: JFL context system — query project memory, journal, and knowledge base
+triggers:
+  - context
+  - search context
+  - what happened
+  - find context
+  - /context
+---
+
+# /context - Project Context
+
+Query the JFL context system — journal entries, memory, knowledge docs, and decisions.
+
+## Usage
+
+```
+/context                        # Show recent context
+/context search <query>         # Semantic search
+/context synopsis               # What happened in last 24h
+/context synopsis 48            # What happened in last 48h
+/context memory <query>         # Search persistent memory
+```
+
+## Tools Available in Pi Sessions
+
+When running in Pi, these tools are auto-registered:
+
+- **`jfl_context`** — Search all project context (journal, knowledge, memory)
+- **`jfl_memory_search`** — Semantic search across session memories
+- **`jfl_synopsis`** — Aggregated work summary across sessions
+
+## Context Sources
+
+1. **Journal** (`.jfl/journal/<branch>.jsonl`) — Session-level work log
+2. **Knowledge docs** (`knowledge/*.md`) — Vision, narrative, thesis, roadmap
+3. **SQLite memory** — Indexed journal entries via Context Hub
+4. **Code headers** (`@purpose` tags) — File-level intent
+
+## How Context is Injected
+
+At session start, the `context` extension:
+1. Ensures Context Hub is running (`jfl context-hub ensure`)
+2. Before each agent turn, fetches recent context (`GET /api/context?limit=10`)
+3. Injects into system prompt as a `## JFL Project Context` section
+
+This means agents always have recent session context without manual prompting.
+
+## Querying Context
+
+```typescript
+// In extension code:
+const result = await ctx.tools.jfl_context({ query: "what did we decide about pricing?", limit: 5 })
+```
+
+## Context Hub
+
+The Context Hub daemon (`:4242`) aggregates all sources:
+- MAP event bus (ring buffer)
+- Memory SQLite DB
+- Journal files (file watcher)
+- Knowledge docs (file watcher)
+
+Run `jfl context-hub status` to check health.

package/packages/pi/skills/debug/MULTI_AGENT.md

@@ -0,0 +1,360 @@
+# Multi-Agent Debug Workflow
+
+Coordinate multiple agents to debug complex binaries with cross-verification.
+
+---
+
+## Architecture
+
+```
+┌─────────────────────────────────────────────────────────────────┐
+│                       Orchestrator                               │
+│  Coordinates agents, merges findings, resolves conflicts         │
+└─────────────────────────────────────────────────────────────────┘
+        │           │            │            │
+        ▼           ▼            ▼            ▼
+┌──────────┐ ┌──────────┐ ┌──────────┐ ┌──────────┐
+│  Static  │ │ Dynamic  │ │ Verifier │ │  Solver  │
+│  Analyst │ │  Tracer  │ │          │ │          │
+│          │ │          │ │          │ │          │
+│ Ghidra   │ │ Frida    │ │ Compare  │ │ Exploit  │
+│ Binja    │ │ WinDbg   │ │ Validate │ │ Fix      │
+└──────────┘ └──────────┘ └──────────┘ └──────────┘
+```
+
+---
+
+## Agent Definitions
+
+### Static Analyst
+**Tools:** Ghidra, Binary Ninja
+**Role:** Map program structure without execution
+
+**Tasks:**
+1. Identify binary type and architecture
+2. Find entry point and main functions
+3. Map call graph
+4. Identify interesting functions (crypto, auth, network)
+5. Document string references
+6. Note anti-analysis techniques
+
+**Output format:**
+```json
+{
+  "target": "binary_name",
+  "type": "ELF64/PE32+/Mach-O",
+  "arch": "x86_64/ARM64",
+  "functions": [
+    {
+      "name": "check_license",
+      "address": "0x401234",
+      "args": ["char* key"],
+      "returns": "int",
+      "calls": ["strcmp", "decrypt"],
+      "called_by": ["main"],
+      "notes": "Checks license key against hardcoded value"
+    }
+  ],
+  "strings": [
+    {"address": "0x402000", "value": "Invalid license", "xrefs": ["0x401250"]}
+  ],
+  "imports": ["strcmp", "malloc", "free"],
+  "suspicious": ["anti-debug detected at 0x401000"]
+}
+```
+
+---
+
+### Dynamic Tracer
+**Tools:** Frida, WinDbg, GDB
+**Role:** Observe runtime behavior
+
+**Tasks:**
+1. Hook functions identified by Static Analyst
+2. Trace argument values
+3. Capture return values
+4. Monitor memory operations
+5. Track control flow
+6. Identify runtime-decrypted values
+
+**Output format:**
+```json
+{
+  "target": "binary_name",
+  "traces": [
+    {
+      "function": "check_license",
+      "address": "0x401234",
+      "calls": [
+        {
+          "timestamp": "00:00:01.234",
+          "args": ["AAAA-BBBB-CCCC"],
+          "return": 0,
+          "notes": "Returns 0 for invalid key"
+        },
+        {
+          "timestamp": "00:00:02.567",
+          "args": ["VALID-LICENSE-KEY"],
+          "return": 1,
+          "notes": "Returns 1 for this specific key"
+        }
+      ]
+    }
+  ],
+  "memory": [
+    {"address": "0x603000", "before": "encrypted", "after": "decrypted config"}
+  ],
+  "network": [
+    {"timestamp": "00:00:03.000", "type": "DNS", "query": "license.example.com"}
+  ]
+}
+```
+
+---
+
+### Verifier
+**Role:** Cross-check findings, resolve conflicts
+
+**Tasks:**
+1. Compare static vs dynamic analysis
+2. Identify discrepancies
+3. Request clarification from other agents
+4. Validate hypotheses
+5. Build confidence scores
+
+**Verification checks:**
+```markdown
+## Verification Report
+
+### Function: check_license (0x401234)
+
+| Property | Static | Dynamic | Match | Confidence |
+|----------|--------|---------|-------|------------|
+| Arg count | 1 | 1 | ✓ | 100% |
+| Return type | int | int | ✓ | 100% |
+| Calls strcmp | yes | yes | ✓ | 100% |
+| Key format | unknown | XXXX-XXXX-XXXX | partial | 80% |
+| Validation logic | XOR + compare | confirmed | ✓ | 95% |
+
+### Discrepancies
+- Static showed 2 code paths, dynamic only triggered 1
+- ACTION: Tracer to test edge case with empty input
+
+### Confidence: 92%
+```
+
+---
+
+### Solver
+**Role:** Develop solution based on verified findings
+
+**Tasks:**
+1. Use verified findings to develop exploit/patch/keygen
+2. Test solution
+3. Document approach
+4. Handle edge cases
+
+**Output:**
+```markdown
+## Solution: check_license bypass
+
+### Approach
+Based on verified analysis:
+- Function at 0x401234 compares input against XOR-decoded key
+- Key stored at 0x402000, XOR key is 0x42
+- Valid key: "DECODED-LICENSE-KEY"
+
+### Implementation
+[Frida hook / patch / keygen code]
+
+### Testing
+- Test case 1: ✓ Passes with decoded key
+- Test case 2: ✓ Bypass hook works
+- Edge case: ✓ Empty input handled
+
+### Confidence: 95%
+```
+
+---
+
+## Orchestration Protocol
+
+### Phase 1: Initial Analysis
+
+```
+Orchestrator → Static Analyst:
+  "Analyze target binary. Identify:
+   - Entry point and main flow
+   - Authentication/validation functions
+   - Interesting strings
+   - Anti-analysis techniques"
+
+Static Analyst → Orchestrator:
+  [Static analysis output]
+
+Orchestrator → Dynamic Tracer:
+  "Here are functions from static analysis.
+   Hook and trace:
+   - check_license at 0x401234
+   - decrypt_config at 0x401500
+   Capture args, returns, and any decrypted values."
+
+Dynamic Tracer → Orchestrator:
+  [Dynamic trace output]
+```
+
+### Phase 2: Cross-Verification
+
+```
+Orchestrator → Verifier:
+  "Compare these findings:
+   - Static: [summary]
+   - Dynamic: [summary]
+   Identify discrepancies and confidence level."
+
+Verifier → Orchestrator:
+  [Verification report]
+
+If discrepancies:
+  Orchestrator → [appropriate agent]:
+    "Clarify: [specific question]"
+```
+
+### Phase 3: Solution Development
+
+```
+Orchestrator → Solver:
+  "Based on verified findings:
+   - Function does X
+   - Key is Y
+   - Validation is Z
+   Develop solution."
+
+Solver → Orchestrator:
+  [Solution + test results]
+
+Orchestrator → Verifier:
+  "Validate solution works as expected."
+```
+
+---
+
+## Conflict Resolution
+
+When agents disagree:
+
+1. **Data conflict**: Re-run analysis with more detail
+2. **Interpretation conflict**: Request both to explain reasoning
+3. **Tool limitation**: Try different tool
+4. **Anti-analysis**: Note as finding, work around
+
+```
+Example:
+Static: "Function has 2 branches"
+Dynamic: "Only saw 1 branch execute"
+
+Resolution:
+1. Ask Dynamic to test condition that triggers branch 2
+2. If unreachable, note as dead code
+3. If anti-debug, note as evasion technique
+```
+
+---
+
+## Communication Format
+
+All agents communicate via structured messages:
+
+```json
+{
+  "from": "static_analyst",
+  "to": "orchestrator",
+  "type": "finding|question|answer|error",
+  "confidence": 0.95,
+  "content": {
+    "summary": "Brief description",
+    "details": { ... },
+    "evidence": ["screenshot", "code", "trace"],
+    "questions": ["Any open questions"],
+    "next_steps": ["Suggested follow-ups"]
+  }
+}
+```
+
+---
+
+## Example Session
+
+```
+USER: Debug this crackme binary
+
+ORCHESTRATOR: Starting multi-agent debug session.
+
+[Spawns Static Analyst]
+STATIC: Analyzing... Found check_serial at 0x401234.
+        Takes 1 arg (serial), returns int.
+        Calls custom decrypt function, then strcmp.
+        Confidence: 85%
+
+[Spawns Dynamic Tracer]
+DYNAMIC: Hooking check_serial...
+         Input "TEST" → return 0
+         Input "AAAA" → return 0
+         Captured decrypted string: "CRACKME-2024"
+         Confidence: 95%
+
+[Spawns Verifier]
+VERIFIER: Cross-checking...
+          ✓ Function signature matches
+          ✓ Decryption confirmed
+          ✓ Valid serial identified
+          Confidence: 93%
+
+[Spawns Solver]
+SOLVER: Serial is "CRACKME-2024"
+        Verified: ✓
+        Keygen possible: Yes (XOR with 0x42)
+
+ORCHESTRATOR: Debug complete.
+              Valid serial: CRACKME-2024
+              Confidence: 93%
+              Full report in outputs/debug/findings/
+```
+
+---
+
+## Parallel Execution
+
+For speed, run compatible analyses in parallel:
+
+```
+Phase 1 (parallel):
+├── Static Analyst: Ghidra analysis
+├── Static Analyst: Binary Ninja analysis (cross-check)
+└── Dynamic Tracer: Initial trace (known functions)
+
+Phase 2 (after Phase 1):
+├── Verifier: Cross-check all findings
+└── Dynamic Tracer: Additional hooks (newly identified)
+
+Phase 3 (after Phase 2):
+└── Solver: Develop solution
+```
+
+---
+
+## Anti-Pattern Detection
+
+Agents should flag suspicious patterns:
+
+| Pattern | Indicator | Response |
+|---------|-----------|----------|
+| Anti-debug | IsDebuggerPresent, ptrace | Bypass before continuing |
+| VM detection | CPUID checks, registry | Note, may need bare metal |
+| Timing checks | rdtsc, GetTickCount | Freeze time in hooks |
+| Integrity checks | CRC, hash validation | Patch or emulate |
+| Obfuscation | Control flow flat, opaque predicates | Note, may need deobfuscation |
+
+---
+
+*"Multiple perspectives reveal the truth."*