@ekkos/cli 1.0.31 → 1.0.32

package/dist/commands/init.js

@@ -332,16 +332,28 @@ async function deployForCursor(apiKey, userId) {
     }
 }
 async function deployForWindsurf(apiKey, userId) {
-    const spinner = (0, ora_1.default)('Deploying Windsurf MCP configuration...').start();
+    let success = false;
+    // MCP configuration
+    let spinner = (0, ora_1.default)('Deploying Windsurf MCP configuration...').start();
     try {
         (0, mcp_1.deployWindsurfMcp)(apiKey, userId);
         spinner.succeed('Windsurf MCP configuration');
-        return true;
+        success = true;
     }
     catch (error) {
         spinner.fail('Windsurf MCP configuration failed');
-        return false;
     }
+    // Skills (Agent Skills spec — 6 Golden Loop skills)
+    spinner = (0, ora_1.default)('Deploying Windsurf skills...').start();
+    try {
+        const result = (0, skills_1.deployWindsurfSkills)();
+        spinner.succeed(`Windsurf skills (${result.count} skills: ${result.skills.join(', ')})`);
+        success = true;
+    }
+    catch (error) {
+        spinner.fail('Windsurf skills deployment failed');
+    }
+    return success;
 }
 // ═══════════════════════════════════════════════════════════════════════════
 // MAIN INIT COMMAND

package/dist/commands/run.js

@@ -392,8 +392,6 @@ function getEkkosEnv() {
         const projectPathEncoded = Buffer.from(projectPath).toString('base64url');
         const proxyUrl = `${EKKOS_PROXY_URL}/proxy/${encodeURIComponent(userId)}/${encodeURIComponent(cliSessionName)}?project=${projectPathEncoded}`;
         env.ANTHROPIC_BASE_URL = proxyUrl;
-        // Newer Claude Code internals also read this key for API/file routes.
-        env.CLAUDE_CODE_API_BASE_URL = proxyUrl;
         // Proxy URL contains userId + project path — don't leak to terminal
     }
     else {
@@ -452,7 +450,8 @@ function resolveNativeClaudeBin() {
  */
 function getClaudeVersion(claudePath) {
     try {
-        const version = (0, child_process_1.execSync)(`"${claudePath}" --version 2>/dev/null`, { encoding: 'utf-8' }).trim();
+        const suppressStderr = isWindows ? '2>NUL' : '2>/dev/null';
+        const version = (0, child_process_1.execSync)(`"${claudePath}" --version ${suppressStderr}`, { encoding: 'utf-8' }).trim();
         // Look for pattern like "2.1.6 (Claude Code)" or just "2.1.6" anywhere in output
         const match = version.match(/(\d+\.\d+\.\d+)\s*\(Claude Code\)/);
         if (match)
@@ -1335,7 +1334,7 @@ async function run(options) {
     // Claude creates the transcript file BEFORE outputting the session name
     // So we watch for new files rather than parsing TUI output (which is slower)
     // ════════════════════════════════════════════════════════════════════════════
-    const encodedCwd = process.cwd().replace(/\//g, '-');
+    const encodedCwd = process.cwd().replace(/[\\/]/g, '-');
     const projectDir = path.join(os.homedir(), '.claude', 'projects', encodedCwd);
     const launchTime = Date.now();
     // Track existing jsonl files at startup
@@ -1506,8 +1505,10 @@ async function run(options) {
             });
             return false;
         }
-        // Check it starts with / or ~ (absolute path)
-        if (!pathToCheck.startsWith('/') && !pathToCheck.startsWith('~')) {
+        // Check it's an absolute path (Unix: / or ~, Windows: C:\ or \\)
+        const isAbsolutePath = pathToCheck.startsWith('/') || pathToCheck.startsWith('~') ||
+            /^[A-Za-z]:[\\/]/.test(pathToCheck) || pathToCheck.startsWith('\\\\');
+        if (!isAbsolutePath) {
             evictionDebugLog('PATH_INVALID', 'Transcript path is not absolute - clearing', {
                 path: pathToCheck.slice(0, 100),
             });
@@ -2282,7 +2283,9 @@ async function run(options) {
         if (transcriptMatch) {
             const candidatePath = transcriptMatch[1];
             // Validate it's an actual path (not garbage from terminal output)
-            if (candidatePath.startsWith('/') || candidatePath.startsWith('~')) {
+            const isAbsCandidate = candidatePath.startsWith('/') || candidatePath.startsWith('~') ||
+                /^[A-Za-z]:[\\/]/.test(candidatePath);
+            if (isAbsCandidate) {
                 const resolvedPath = candidatePath.startsWith('~')
                     ? path.join(os.homedir(), candidatePath.slice(1))
                     : candidatePath;

package/dist/commands/setup.js

@@ -1,4 +1,37 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
@@ -351,6 +384,20 @@ async function setupWindsurf(apiKey) {
         (0, fs_1.mkdirSync)(windsurfDir, { recursive: true });
     }
     (0, fs_1.writeFileSync)((0, path_1.join)(windsurfDir, 'ekkos.json'), JSON.stringify({ apiKey }, null, 2));
+    // Deploy Windsurf skills (Agent Skills spec — 6 Golden Loop skills)
+    const skillsDir = (0, path_1.join)(codeiumDir, 'skills');
+    if (!(0, fs_1.existsSync)(skillsDir)) {
+        (0, fs_1.mkdirSync)(skillsDir, { recursive: true });
+    }
+    try {
+        const { deployWindsurfSkills } = await Promise.resolve().then(() => __importStar(require('../deploy/skills.js')));
+        const result = deployWindsurfSkills();
+        console.log(chalk_1.default.green(`  ✓ Deployed ${result.count} skills: ${result.skills.join(', ')}`));
+    }
+    catch {
+        // Fallback: templates might not be available in setup path
+        console.log(chalk_1.default.yellow('  Note: Skills templates not found. Run `ekkos init --ide windsurf` to deploy skills.'));
+    }
     // Create project rules template
     const cascadeRules = generateCascadeRules();
     const cascadeRulesPath = (0, path_1.join)(process.cwd(), '.windsurfrules');

package/dist/deploy/skills.d.ts

@@ -5,6 +5,14 @@ export declare function deploySkills(): {
     count: number;
     skills: string[];
 };
+/**
+ * Deploy Windsurf skills to ~/.codeium/windsurf/skills/
+ * Uses Agent Skills spec format (lowercase-hyphenated names, SKILL.md)
+ */
+export declare function deployWindsurfSkills(): {
+    count: number;
+    skills: string[];
+};
 /**
  * Check if skills are deployed
  */

package/dist/deploy/skills.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.deploySkills = deploySkills;
+exports.deployWindsurfSkills = deployWindsurfSkills;
 exports.areSkillsDeployed = areSkillsDeployed;
 exports.countDeployedSkills = countDeployedSkills;
 exports.listExpectedSkills = listExpectedSkills;
@@ -32,6 +33,31 @@ function deploySkills() {
         skills: deployedSkills
     };
 }
+/**
+ * Deploy Windsurf skills to ~/.codeium/windsurf/skills/
+ * Uses Agent Skills spec format (lowercase-hyphenated names, SKILL.md)
+ */
+function deployWindsurfSkills() {
+    if (!(0, fs_1.existsSync)(platform_1.WINDSURF_SKILLS_DIR)) {
+        (0, fs_1.mkdirSync)(platform_1.WINDSURF_SKILLS_DIR, { recursive: true });
+    }
+    const skillNames = (0, templates_1.listTemplateDirs)('windsurf-skills');
+    const deployedSkills = [];
+    for (const skillName of skillNames) {
+        try {
+            const destPath = `${platform_1.WINDSURF_SKILLS_DIR}/${skillName}`;
+            (0, templates_1.copyTemplateDir)(`windsurf-skills/${skillName}`, destPath);
+            deployedSkills.push(skillName);
+        }
+        catch (error) {
+            console.warn(`Warning: Could not deploy Windsurf skill ${skillName}`);
+        }
+    }
+    return {
+        count: deployedSkills.length,
+        skills: deployedSkills
+    };
+}
 /**
  * Check if skills are deployed
  */

package/dist/utils/platform.d.ts

@@ -21,6 +21,7 @@ export declare const CURSOR_DIR: string;
 export declare const CURSOR_MCP: string;
 export declare const WINDSURF_DIR: string;
 export declare const WINDSURF_MCP: string;
+export declare const WINDSURF_SKILLS_DIR: string;
 /**
  * Detect which IDEs are installed on this system
  */

package/dist/utils/platform.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WINDSURF_MCP = exports.WINDSURF_DIR = exports.CURSOR_MCP = exports.CURSOR_DIR = exports.CLAUDE_EKKOS_RULES = exports.CLAUDE_RULES_DIR = exports.CLAUDE_MD = exports.CLAUDE_STATE_DIR = exports.CLAUDE_PLUGINS_DIR = exports.CLAUDE_AGENTS_DIR = exports.CLAUDE_SKILLS_DIR = exports.CLAUDE_HOOKS_DIR = exports.CLAUDE_SETTINGS = exports.CLAUDE_CONFIG = exports.CLAUDE_DIR = exports.EKKOS_CONFIG = exports.EKKOS_DIR = exports.HOME_DIR = exports.MCP_API_URL = exports.PLATFORM_URL = exports.isLinux = exports.isMac = exports.isWindows = void 0;
+exports.WINDSURF_SKILLS_DIR = exports.WINDSURF_MCP = exports.WINDSURF_DIR = exports.CURSOR_MCP = exports.CURSOR_DIR = exports.CLAUDE_EKKOS_RULES = exports.CLAUDE_RULES_DIR = exports.CLAUDE_MD = exports.CLAUDE_STATE_DIR = exports.CLAUDE_PLUGINS_DIR = exports.CLAUDE_AGENTS_DIR = exports.CLAUDE_SKILLS_DIR = exports.CLAUDE_HOOKS_DIR = exports.CLAUDE_SETTINGS = exports.CLAUDE_CONFIG = exports.CLAUDE_DIR = exports.EKKOS_CONFIG = exports.EKKOS_DIR = exports.HOME_DIR = exports.MCP_API_URL = exports.PLATFORM_URL = exports.isLinux = exports.isMac = exports.isWindows = void 0;
 exports.detectInstalledIDEs = detectInstalledIDEs;
 exports.detectCurrentIDE = detectCurrentIDE;
 const os_1 = require("os");
@@ -30,6 +30,7 @@ exports.CURSOR_DIR = (0, path_1.join)(exports.HOME_DIR, '.cursor');
 exports.CURSOR_MCP = (0, path_1.join)(exports.CURSOR_DIR, 'mcp.json');
 exports.WINDSURF_DIR = (0, path_1.join)(exports.HOME_DIR, '.codeium', 'windsurf');
 exports.WINDSURF_MCP = (0, path_1.join)(exports.WINDSURF_DIR, 'mcp_config.json');
+exports.WINDSURF_SKILLS_DIR = (0, path_1.join)(exports.WINDSURF_DIR, 'skills');
 /**
  * Detect which IDEs are installed on this system
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ekkos/cli",
-  "version": "1.0.31",
+  "version": "1.0.32",
   "description": "Setup ekkOS memory for AI coding assistants (Claude Code, Cursor, Windsurf)",
   "main": "dist/index.js",
   "bin": {

package/templates/ekkos-manifest.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://ekkos.dev/schemas/manifest-v1.json",
   "manifestVersion": "1.0.0",
-  "generatedAt": "2026-02-19T23:06:44.502Z",
+  "generatedAt": "2026-02-20T07:39:17.071Z",
   "platforms": {
     "darwin": {
       "configDir": "~/.ekkos",
@@ -98,25 +98,25 @@
           "source": "hooks/user-prompt-submit.ps1",
           "destination": "user-prompt-submit.ps1",
           "description": "User prompt submit hook (Windows)",
-          "checksum": "6a00a23bc3865e63b1bca2702b769473cce11530adbffa4531b21bb6bbe7cc3b"
+          "checksum": "ba1090ed7a4e7deef1267b52474225669a9c966b9adf596b31865c2dca1dc749"
         },
         {
           "source": "hooks/stop.ps1",
           "destination": "stop.ps1",
           "description": "Session stop hook (Windows)",
-          "checksum": "2defabb31d51e482990f0fce762a5cc12beb08eb1ac1fb4a1afd7c5375d5e0f0"
+          "checksum": "c4f0191ac28ced0410ea560197ab3b0a7e2de83363a789731d64620bc605564d"
         },
         {
           "source": "hooks/session-start.ps1",
           "destination": "session-start.ps1",
           "description": "Session start hook (Windows)",
-          "checksum": "7b700bb98072efe4bd84b84b0754d0b64dc85a718f4484c6d42594d790e4cce5"
+          "checksum": "1930bda7c517054531ff3ad78e8cce7e60d57f5b3884728da0d7cf1cc5c54ac4"
         },
         {
           "source": "hooks/assistant-response.ps1",
           "destination": "assistant-response.ps1",
           "description": "Assistant response hook (Windows)",
-          "checksum": "554e978190100d506a3a0c32a59013628d44d00c5e7e21dc28346ad367da60ea"
+          "checksum": "680e6d7c597f90fb54bc86d173f4c145093eb21352b30c7d6afbe19d1d5fdce4"
         }
       ],
       "lib": [

package/templates/windsurf-skills/README.md

@@ -0,0 +1,58 @@
+# ekkOS Windsurf Skills
+
+6 skills following the [Agent Skills specification](https://agentskills.io/specification) for Windsurf Cascade.
+
+## Skills
+
+| # | Skill | Golden Loop Step | Description |
+|---|-------|-----------------|-------------|
+| 1 | `ekkos-golden-loop` | All 5 steps | Core loop — Search, Apply, Forge, Outcome, Reflect |
+| 2 | `ekkos-recall` | Search (deep) | Time-based and semantic recall across sessions |
+| 3 | `ekkos-safety` | Guard | Conflict checks before destructive operations |
+| 4 | `ekkos-vault` | Utility | AES-256-GCM encrypted credential storage |
+| 5 | `ekkos-continue` | Utility | Session resumption after clear/compaction |
+| 6 | `ekkos-insights` | Reflect (system) | Prometheus metrics, delta scores, system health |
+
+## Installation
+
+### Workspace Skills (per-project)
+
+```bash
+cp -r templates/windsurf-skills/* .windsurf/skills/
+```
+
+### Global Skills (all projects)
+
+```bash
+cp -r templates/windsurf-skills/* ~/.codeium/windsurf/skills/
+```
+
+### Via CLI
+
+```bash
+ekkos init --windsurf
+```
+
+## The Golden Loop (5 Steps)
+
+```
+SEARCH → APPLY → FORGE → OUTCOME → REFLECT
+  │        │        │        │          │
+  │        │        │        │          └─ Quality analysis
+  │        │        │        └─ Success/failure → Prometheus
+  │        │        └─ Save solution as pattern
+  │        └─ Use pattern + track usage
+  └─ Query memory before answering
+```
+
+Every step generates metrics consumed by the Prometheus Feedback Loop Worker (runs every 15 min):
+- **Auto-demotion**: Patterns >50% skip rate → quarantined
+- **Auto-promotion**: Patterns >85% success + 10 uses → collective layer (L6)
+- **Delta evaluation**: Δ_prometheus improvement score per interaction
+
+## Naming Convention
+
+All skills use lowercase-hyphenated names per the Agent Skills spec:
+- Directory name MUST match the `name` field in SKILL.md frontmatter
+- Names are 1-64 characters, lowercase alphanumeric + hyphens only
+- No consecutive hyphens (`--`), no leading/trailing hyphens

package/templates/windsurf-skills/ekkos-continue/SKILL.md

@@ -0,0 +1,81 @@
+---
+name: ekkos-continue
+description: Resume session after clear or context compaction. Activate when the user types /continue or /clear, after context compaction occurs, or when you see an ekkos-context-preserved tag. Restores working memory from local cache (1ms) with Redis/Supabase fallback.
+allowed-tools:
+  - mcp__ekkos-memory__ekkOS_RestoreContext
+  - mcp__ekkos-memory__ekkOS_Recall
+  - mcp__ekkos-memory__ekkOS_Search
+---
+
+# ekkOS Continue
+
+Resume sessions seamlessly after `/clear` or context compaction.
+
+## When To Activate
+
+| Trigger | What Happened |
+|---------|--------------|
+| User types `/continue` | Manual resume request |
+| After `/clear` | Context was cleared, need to restore |
+| `<ekkos-context-preserved>` tag appears | Auto-compaction occurred |
+| Restored turns in `<system-reminder>` | Session was restored by hook |
+
+## Instructions
+
+### After `/clear` (Manual)
+
+If you see restored turns in a `<system-reminder>` tag (pattern: `**Turn XX**: ...`), respond with:
+
+```
+✓ **Session continued (Turn N)** - X turns preserved, context restored
+```
+
+Then resume the conversation naturally.
+
+### After Compaction (Automatic)
+
+When you see `<ekkos-context-preserved>` with a restoration token:
+
+```
+ekkOS_RestoreContext({
+  restoration_token: "<token from the tag>"
+})
+```
+
+Then respond with:
+```
+✓ **Context restored** - ekkOS preserved X turns before compaction
+```
+
+### Fallback: Semantic Recall
+
+If no restoration token is available:
+
+```
+ekkOS_Recall({
+  days_ago: 1,
+  semantic_query: "<topic from the conversation>",
+  include_full_content: true,
+  group_by_sessions: true,
+  limit: 5
+})
+```
+
+## How It Works
+
+1. **Local cache** (fastest, 1ms) — hooks save turns to local JSON
+2. **Redis** (fast, 10ms) — working memory backed up to Redis
+3. **Supabase** (reliable, 100ms) — episodic memory (L2) persists everything
+4. **Semantic search** (last resort) — find relevant context by meaning
+
+## Integration with Golden Loop
+
+Continue is a specialized SEARCH — it queries working memory (L1) and episodic memory (L2) to restore session state. After successful restoration, record it:
+
+```
+ekkOS_Outcome({ success: true })  // Restoration worked
+```
+
+---
+
+**Mantra**: No context is ever lost. Every session can be resumed.

package/templates/windsurf-skills/ekkos-golden-loop/SKILL.md

@@ -0,0 +1,225 @@
+---
+name: ekkos-golden-loop
+description: The 5-step cognitive learning loop that makes AI smarter over time. Activate on every technical question, bug fix, architecture decision, debugging session, user correction, or when solving any non-trivial problem. Steps — Search, Apply, Forge, Outcome, Reflect. This is the core skill that drives all ekkOS memory operations.
+allowed-tools:
+  - mcp__ekkos-memory__ekkOS_Search
+  - mcp__ekkos-memory__ekkOS_Context
+  - mcp__ekkos-memory__ekkOS_Codebase
+  - mcp__ekkos-memory__ekkOS_Track
+  - mcp__ekkos-memory__ekkOS_Forge
+  - mcp__ekkos-memory__ekkOS_Outcome
+  - mcp__ekkos-memory__ekkOS_Reflect
+  - Read
+  - Glob
+---
+
+# ekkOS Golden Loop
+
+You are augmented with **ekkOS_ memory** — an 11-layer cognitive memory system. This skill defines the **5-step Golden Loop** that makes you smarter over time.
+
+## The 5 Steps
+
+```
+┌─────────────────────────────────────────────────────────────┐
+│  1. SEARCH  →  Query memory before answering               │
+│  2. APPLY   →  Use retrieved patterns, track usage          │
+│  3. FORGE   →  Save new solutions as patterns               │
+│  4. OUTCOME →  Record success or failure                    │
+│  5. REFLECT →  Analyze quality, forge improvements          │
+│       ↓                                                     │
+│  Prometheus collects metrics → demotion / promotion         │
+└─────────────────────────────────────────────────────────────┘
+```
+
+**Every step feeds metrics to Prometheus** — skip rates, success rates, and delta scores that determine which patterns get promoted to collective wisdom and which get quarantined.
+
+## Step 1: SEARCH (Before Answering)
+
+Before answering ANY technical question, search memory first.
+
+```
+ekkOS_Search({
+  query: "<specific problem description>",
+  sources: ["patterns", "collective", "codebase"],
+  limit: 5
+})
+```
+
+**When to search:**
+- User asks a technical question
+- Debugging an error
+- Architecture or design discussion
+- "How do I..." questions
+- Configuration or deployment
+- Mid-response when you realize past context would help
+
+**For project-specific code:**
+```
+ekkOS_Codebase({
+  query: "<what you need from this project>",
+  limit: 5
+})
+```
+
+**For combined context (patterns + episodes):**
+```
+ekkOS_Context({
+  task: "<what you're trying to accomplish>"
+})
+```
+
+## Step 2: APPLY (Use Patterns, Track Usage)
+
+When patterns are retrieved, you MUST acknowledge every single one.
+
+**For patterns you USE:**
+```
+[ekkOS_SELECT]
+- id: <pattern_id>
+  reason: <why using>
+  confidence: <0.0-1.0>
+[/ekkOS_SELECT]
+```
+
+**For patterns NOT relevant:**
+```
+[ekkOS_SKIP]
+- id: <pattern_id>
+  reason: <why not relevant>
+[/ekkOS_SKIP]
+```
+
+Track is called automatically during search when patterns are found. The Track call creates an `application_id` that links your search to the outcome — this is how Prometheus knows which patterns are actually being used vs skipped.
+
+**Why this matters:** Every SKIP increments the pattern's skip rate. Patterns with >50% skip rate get auto-demoted by the Prometheus worker. Every SELECT reinforces the pattern.
+
+## Step 3: FORGE (Save Solutions)
+
+When you solve something non-trivial, save it immediately.
+
+```
+ekkOS_Forge({
+  title: "Descriptive, searchable title",
+  problem: "What went wrong or what was needed",
+  solution: "What worked and WHY it works",
+  tags: ["relevant", "tags"],
+  works_when: ["specific conditions"],
+  anti_patterns: ["what NOT to do"]
+})
+```
+
+**FORGE triggers — ask yourself after every solution:**
+- Was this non-trivial? → FORGE
+- Did the user correct me? → FORGE
+- Did something NOT work? → FORGE as anti-pattern
+- Would I want to remember this? → FORGE
+- Is this a gotcha or pitfall? → FORGE
+- Was an architecture decision made? → FORGE
+
+**Anti-patterns are equally valuable.** When something DOESN'T work:
+```
+ekkOS_Forge({
+  title: "Don't use setTimeout for rate limiting",
+  problem: "Tried setTimeout to throttle API calls — doesn't work",
+  solution: "Use proper debounce/throttle library instead",
+  anti_patterns: ["setTimeout for throttling", "manual timer-based rate limiting"]
+})
+```
+
+**Good titles:** Specific, searchable, actionable
+- "Fix CORS by setting Access-Control-Allow-Origin header"
+- "Use cursor pagination for tables over 100K rows"
+
+**Bad titles:** Vague, unsearchable
+- "Fixed the bug"
+- "Solution"
+
+## Step 4: OUTCOME (Record Success/Failure)
+
+After applying a pattern and seeing the result, record the outcome.
+
+```
+ekkOS_Outcome({
+  success: true,    // or false
+  model_used: "claude-sonnet-4-6"
+})
+```
+
+**When to record outcomes:**
+- User confirms solution works → `success: true`
+- User says "that's not right" → `success: false`
+- Applied pattern solved the problem → `success: true`
+- Pattern didn't apply well → `success: false`
+- After completing a complex task → record overall outcome
+
+**Why this matters:** Outcome feeds directly into Prometheus:
+- Success rates determine pattern quality scores
+- Patterns with >85% success + 10 uses → promoted to collective (L6)
+- Patterns with <30% success after 10 uses → quarantined
+- Delta scores (Δ_prometheus) track improvement over time
+
+## Step 5: REFLECT (Analyze and Improve)
+
+After complex tasks or when receiving feedback, analyze your response.
+
+```
+ekkOS_Reflect({
+  user_query: "Original question",
+  response: "Your response summary",
+  context: {
+    patterns_used: 3,
+    model: "claude-sonnet-4-6"
+  }
+})
+```
+
+**Reflection feeds back into the loop:**
+- Identify missed patterns → better future searches
+- Spot over-engineering → forge simplicity preferences
+- Record what worked → reinforce good patterns
+- Find gaps → forge new patterns to fill them
+
+## Metric Collection Summary
+
+Every step generates metrics that Prometheus uses:
+
+| Step | Metric Generated | Prometheus Impact |
+|------|-----------------|-------------------|
+| Search | retrieval count, latency | retrieval_precision |
+| Apply (SELECT) | application count | Reinforces pattern |
+| Apply (SKIP) | skip count | skip_rate → demotion risk |
+| Forge | new patterns | capability growth |
+| Outcome | success/failure | success_rate → promotion/demotion |
+| Reflect | quality scores | pattern_quality delta |
+
+The **Prometheus Feedback Loop Worker** (runs every 15 min) processes:
+1. **Auto-demotion**: Patterns >50% skip rate → quarantined
+2. **Auto-promotion**: Patterns >85% success + 10 uses → collective layer
+3. **Delta evaluation**: Δ_prometheus score per interaction
+
+## Response Format
+
+Every response MUST end with:
+```
+---
+🧠 **ekkOS_™**
+```
+
+## Fallback Behavior
+
+If the MCP server is unavailable:
+1. Proceed without memory
+2. Note: "Memory unavailable — solving from first principles"
+3. Solutions can still be forged when connection restores
+
+## What NOT To Do
+
+- **Don't skip Search** — always query memory first
+- **Don't skip Outcome** — this is how Prometheus learns
+- **Don't fabricate patterns** — only reference patterns actually retrieved
+- **Don't over-search** — one focused search beats many broad ones
+- **Don't forge trivial things** — "changed a variable name" isn't worth forging
+
+---
+
+**Mantra**: Search first. Apply what you find. Forge what you learn. Record what happened. Reflect and improve.

package/templates/windsurf-skills/ekkos-insights/SKILL.md

@@ -0,0 +1,138 @@
+---
+name: ekkos-insights
+description: System introspection and improvement metrics powered by Prometheus. Activate when the user asks "how am I improving", "show my stats", "what does the system know", "ekkOS status", "memory summary", "pattern quality", "delta score", or wants to understand memory health, pattern effectiveness, or system performance.
+allowed-tools:
+  - mcp__ekkos-memory__ekkOS_Stats
+  - mcp__ekkos-memory__ekkOS_Summary
+  - mcp__ekkos-memory__ekkOS_Search
+  - mcp__ekkos-memory__ekkOS_Health
+---
+
+# ekkOS Insights (Prometheus)
+
+System introspection — see how ekkOS is improving over time.
+
+## When To Activate
+
+| Trigger | What To Show |
+|---------|-------------|
+| "How am I improving?" | Delta score and trends |
+| "Show my stats" | Layer statistics |
+| "What does ekkOS know?" | MetaState overview |
+| "ekkOS status" / "memory summary" | Activity summary |
+| "Pattern quality" | Success rates, skip rates |
+| "Is ekkOS healthy?" | System health check |
+| "What patterns are being used?" | Applied/skipped breakdown |
+| "Show me what you learned" | Recent forges and outcomes |
+
+## Instructions
+
+### Memory Statistics (All Layers)
+
+```
+ekkOS_Stats({
+  scope: "both"    // "personal", "collective", or "both"
+})
+```
+
+Shows counts across all 11 layers:
+- L1 Working — current session turns
+- L2 Episodic — past conversations
+- L3 Semantic — embedded knowledge
+- L4 Patterns — proven solutions
+- L5 Procedural — step-by-step guides
+- L6 Collective — cross-project wisdom
+- L7 Meta — pattern effectiveness
+- L8 Codebase — project-specific code
+- L9 Directives — user rules (MUST/NEVER/PREFER/AVOID)
+- L10 Conflict — auto-resolution
+- L11 Secrets — encrypted credentials
+
+### Activity Summary
+
+```
+ekkOS_Summary({
+  time_window_seconds: 3600    // last hour (default: 5 min)
+})
+```
+
+Shows recent activity: searches, forges, outcomes, tracks.
+
+### System Health
+
+```
+ekkOS_Health({
+  include_stats: true
+})
+```
+
+Checks connectivity to all services: Supabase, Redis, embeddings, etc.
+
+## Prometheus Metrics (What Gets Tracked)
+
+The Prometheus system quantifies improvement using:
+
+```
+Δ_prometheus = γ × Δ_performance + (1-γ) × Δ_ekkOS
+```
+
+### Performance Metrics (Δ_performance)
+| Metric | Weight | What It Measures |
+|--------|--------|-----------------|
+| Task Success | 0.4 | Are solutions working? (outcome success rate) |
+| Efficiency | 0.3 | Are we solving faster? (turns to solution) |
+| Stability | 0.2 | System reliability (1 - error_rate) |
+| Capability | 0.1 | New patterns forged / total patterns |
+
+### ekkOS Metrics (Δ_ekkOS)
+| Metric | Weight | What It Measures |
+|--------|--------|-----------------|
+| Pattern Quality | 0.4 | Avg success rate improvement |
+| Retrieval Precision | 0.3 | 1 - (skip_rate / total_retrievals) |
+| Directive Compliance | 0.2 | Compliant actions / total actions |
+| Collective Contribution | 0.1 | Patterns promoted to collective / forged |
+
+### Prometheus Worker Actions (Every 15 min)
+| Action | Threshold | Result |
+|--------|-----------|--------|
+| **Auto-demotion** | >50% skip rate, 5+ uses | Pattern quarantined |
+| **Auto-promotion** | >85% success, 10+ uses | Pattern → collective (L6) |
+| **Delta evaluation** | Per-interaction | Δ score stored for trending |
+
+## Presenting Insights
+
+When the user asks for insights, present them clearly:
+
+```
+📊 **ekkOS Memory Status**
+
+**Patterns:** 142 active, 8 quarantined, 12 promoted to collective
+**Success Rate:** 87% (↑ 3% this week)
+**Retrieval Precision:** 92% (low skip rate = patterns are relevant)
+**Most Used Pattern:** "Handle Supabase RLS errors" (23 applications, 96% success)
+**Recent Forges:** 4 new patterns this session
+
+**Prometheus Δ Score:** +0.12 (improving)
+  - Task success: +0.08
+  - Pattern quality: +0.15
+  - Retrieval precision: +0.11
+  - Collective contribution: +0.04
+
+**Health:** All systems operational ✓
+```
+
+## Integration with Golden Loop
+
+Insights is Step 5 (REFLECT) at the system level — instead of reflecting on a single response, it reflects on the entire memory system's health and improvement trajectory.
+
+The metrics displayed here are collected by Steps 1-4:
+1. **Search** → retrieval counts, latency
+2. **Apply** → skip rates, application counts
+3. **Forge** → new pattern counts, capability growth
+4. **Outcome** → success rates, delta scores
+
+Without proper Outcome tracking, these metrics are incomplete. This is why the Golden Loop skill emphasizes recording outcomes — it's what feeds Prometheus.
+
+---
+
+**Mantra**: What gets measured gets improved. Prometheus sees everything.

package/templates/windsurf-skills/ekkos-recall/SKILL.md

@@ -0,0 +1,96 @@
+---
+name: ekkos-recall
+description: Deep memory retrieval across sessions and projects. Activate when the user says "yesterday", "last week", "remember when", "what did we discuss", "we worked on X before", "bring context from", or asks about past decisions, fixes, or discussions. Combines time-based recall with semantic search.
+allowed-tools:
+  - mcp__ekkos-memory__ekkOS_Recall
+  - mcp__ekkos-memory__ekkOS_Search
+  - mcp__ekkos-memory__ekkOS_Context
+  - mcp__ekkos-memory__ekkOS_RestoreContext
+---
+
+# ekkOS Deep Recall
+
+You can recall past conversations, decisions, and context from previous sessions.
+
+## When To Activate
+
+| Trigger | Example |
+|---------|---------|
+| Time reference | "yesterday", "last week", "last month" |
+| Past work | "remember when we...", "we worked on X before" |
+| Decision recall | "what did we decide about...", "why did we choose..." |
+| Context transfer | "bring context from the other project" |
+| Session continuity | "where did we leave off", "continue from last time" |
+
+## Instructions
+
+### Time-Based Recall
+
+```
+ekkOS_Recall({
+  days_ago: 1,                    // 1, 2, 7, 30...
+  semantic_query: "what we discussed about auth",
+  include_file_changes: true,     // show files modified
+  include_patterns: true,         // show patterns used
+  extract_decisions: true,        // pull out decisions made
+  group_by_sessions: true         // organize by session
+})
+```
+
+### Semantic Recall (By Topic)
+
+```
+ekkOS_Recall({
+  semantic_query: "database migration strategy",
+  limit: 10,
+  include_full_content: true
+})
+```
+
+### Session-Based Recall
+
+```
+ekkOS_Recall({
+  session_id: "<session-id>",
+  from_turn: 1,
+  to_turn: 50,
+  include_full_content: true
+})
+```
+
+### Context Restoration (After Compaction)
+
+When you see `<ekkos-context-preserved>` with a restoration token:
+
+```
+ekkOS_RestoreContext({
+  restoration_token: "<token from tag>"
+})
+```
+
+## Response Format
+
+Present recalled information clearly:
+
+```
+🧠 From [date/session]:
+
+**Topic:** [what was discussed]
+**Decision:** [what was decided]
+**Files changed:** [list]
+**Patterns used:** [list]
+**Key insight:** [the important takeaway]
+```
+
+## Integration with Golden Loop
+
+Recall is an extended SEARCH — it queries episodic memory (L2) instead of pattern memory (L4). Results should still be acknowledged and tracked like any retrieval.
+
+After recalling useful context, record the outcome:
+```
+ekkOS_Outcome({ success: true })
+```
+
+---
+
+**Mantra**: Nothing is forgotten. Every session is searchable. Context persists.

package/templates/windsurf-skills/ekkos-safety/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: ekkos-safety
+description: Check for conflicts before dangerous operations. Activate before deleting files, dropping tables, deploying to production, pushing to main, running destructive commands, modifying configuration files, force-pushing, or any irreversible action. Prevents accidents by checking user directives and patterns.
+allowed-tools:
+  - mcp__ekkos-memory__ekkOS_Conflict
+  - mcp__ekkos-memory__ekkOS_Search
+---
+
+# ekkOS Safety Guard
+
+Check for conflicts with user directives and patterns before destructive operations.
+
+## When To Activate
+
+**MUST fire before:**
+- `rm -rf`, `rm -r`, deleting files or directories
+- `DROP TABLE`, `DELETE FROM`, `TRUNCATE`
+- `git push --force`, `git reset --hard`
+- Deploying to production
+- Modifying CI/CD pipelines
+- Changing environment variables
+- Overwriting configuration files
+- Killing processes
+- Any command that is hard to reverse
+
+## Instructions
+
+### Step 1: Check for Conflicts
+
+```
+ekkOS_Conflict({
+  proposed_action: "delete all migration files in /db/migrations",
+  scope: "deployment"   // optional: deployment, auth, security, database
+})
+```
+
+### Step 2: Review Response
+
+The conflict check returns:
+- **Matching directives** — user rules that may prohibit the action
+- **Matching patterns** — past experiences relevant to this action
+- **Risk level** — safe, caution, or blocked
+
+### Step 3: Act Based on Result
+
+**If BLOCKED:** Do NOT proceed. Inform the user why.
+
+**If CAUTION:** Present the conflict to the user and ask for confirmation before proceeding.
+
+**If SAFE:** Proceed normally.
+
+## Example
+
+```
+User: "Drop the users table and recreate it"
+
+You: Let me check for conflicts first...
+
+ekkOS_Conflict({
+  proposed_action: "DROP TABLE users and recreate",
+  scope: "database"
+})
+
+Result: CAUTION — Directive found: "NEVER drop tables in production without backup"
+
+"⚠️ I found a directive: 'NEVER drop tables in production without backup.'
+Should I create a backup first, or is this a development database?"
+```
+
+## Integration with Golden Loop
+
+Safety checks are part of Step 1 (SEARCH) — they query the directive layer (L9) specifically. If a safety check prevents an accident, forge it:
+
+```
+ekkOS_Forge({
+  title: "Always backup before DROP TABLE",
+  problem: "Nearly dropped production table without backup",
+  solution: "ekkOS_Conflict caught the directive — always check first"
+})
+```
+
+Record the outcome:
+```
+ekkOS_Outcome({ success: true })  // Safety check prevented accident
+```
+
+---
+
+**Mantra**: Measure twice, cut once. Check before destroying.

package/templates/windsurf-skills/ekkos-vault/SKILL.md

@@ -0,0 +1,86 @@
+---
+name: ekkos-vault
+description: Securely store and retrieve credentials with AES-256-GCM encryption. Activate when the user shares an API key, password, token, secret, or any sensitive credential. Also activate when you need to use a stored credential or when the user asks about their stored secrets.
+allowed-tools:
+  - mcp__ekkos-memory__ekkOS_StoreSecret
+  - mcp__ekkos-memory__ekkOS_GetSecret
+  - mcp__ekkos-memory__ekkOS_ListSecrets
+  - mcp__ekkos-memory__ekkOS_DeleteSecret
+  - mcp__ekkos-memory__ekkOS_RotateSecret
+---
+
+# ekkOS Secrets Vault
+
+Securely store and retrieve credentials encrypted with AES-256-GCM.
+
+## When To Activate
+
+| Trigger | Action |
+|---------|--------|
+| User shares API key, token, password | Store it |
+| User asks "do you have my X key?" | Retrieve it |
+| Need a credential for an API call | Retrieve it |
+| User asks "what secrets do I have?" | List them |
+| User wants to update a credential | Rotate it |
+| User asks to remove a credential | Delete it |
+
+## Instructions
+
+### Store a Secret
+
+```
+ekkOS_StoreSecret({
+  service: "openai",
+  value: "sk-...",
+  type: "api_key",
+  description: "OpenAI API key for embeddings"
+})
+```
+
+**NEVER echo the secret value back to the user.** Confirm storage without revealing it.
+
+### Retrieve a Secret
+
+```
+ekkOS_GetSecret({
+  service: "openai",
+  masked: false    // true = shows first/last 4 chars only
+})
+```
+
+### List Secrets (Metadata Only)
+
+```
+ekkOS_ListSecrets()
+```
+
+Returns service names, types, and descriptions — never values.
+
+### Rotate a Secret
+
+```
+ekkOS_RotateSecret({
+  service: "openai",
+  newValue: "sk-new-..."
+})
+```
+
+### Delete a Secret
+
+```
+ekkOS_DeleteSecret({
+  secretId: "<id from list>"
+})
+```
+
+## Security Rules
+
+1. **NEVER** display raw secret values in responses unless the user explicitly asks
+2. **NEVER** log secret values
+3. Use `masked: true` when you just need to confirm a secret exists
+4. When storing, confirm success WITHOUT echoing the value
+5. Secrets are encrypted at rest with AES-256-GCM — even ekkOS cannot read them without the user's key
+
+---
+
+**Mantra**: Secrets go in the vault. Never in the chat.

package/templates/windsurf-skills/ekkos-memory/SKILL.md

@@ -1,219 +0,0 @@
----
-title: ekkOS Memory System
-description: AI-native cognitive memory with 31 MCP tools for persistent learning and context continuity
-trigger: always_on
-author: ekkOS Technologies
-tags: [memory, patterns, learning, context]
----
-
-# ekkOS Memory System Skill
-
-This skill enables Cascade to leverage the full ekkOS 11-layer cognitive memory system for persistent learning, pattern recognition, and context continuity across sessions.
-
-## When to Use This Skill
-
-**ALWAYS USE** for:
-- Technical questions (before answering, search memory)
-- Bug fixes (forge patterns after solving)
-- Architecture decisions (check for existing patterns)
-- Code reviews (retrieve relevant patterns)
-- Refactoring (find proven approaches)
-
-## Core Workflow
-
-### 1. Search Before Answering (MANDATORY)
-
-```
-Before answering ANY technical question:
-
-1. Call ekkOS_Search with the query
-2. Review retrieved patterns
-3. Acknowledge ALL patterns with [ekkOS_SELECT] or [ekkOS_SKIP]
-4. THEN provide your answer
-```
-
-### 2. PatternGuard Acknowledgment
-
-For every pattern retrieved, you MUST acknowledge it:
-
-```
-[ekkOS_SELECT]
-- id: <pattern-uuid>
-  reason: Using this because...
-  confidence: 0.95
-[/ekkOS_SELECT]
-
-[ekkOS_SKIP]
-- id: <pattern-uuid>
-  reason: Not relevant because...
-[/ekkOS_SKIP]
-```
-
-**Coverage must be 100%** - every pattern ID must be acknowledged.
-
-### 3. Forge What You Learn
-
-After fixing bugs, solving problems, or discovering gotchas:
-
-```
-Call ekkOS_Forge with:
-- Problem: What was broken
-- Solution: How you fixed it
-- Tags: [language, framework, error-type]
-```
-
-## MCP Tools Reference
-
-### Core Memory (8 tools)
-
-| Tool | Purpose | When to Use |
-|------|---------|-------------|
-| `ekkOS_Search` | Search all 11 memory layers | **Before EVERY technical answer** |
-| `ekkOS_Context` | Get relevant task context | When starting multi-step tasks |
-| `ekkOS_Capture` | Capture memory events | Log significant actions |
-| `ekkOS_Forge` | Create patterns from solutions | After fixing bugs/discoveries |
-| `ekkOS_Directive` | Create MUST/NEVER/PREFER/AVOID rules | When user states preferences |
-| `ekkOS_Outcome` | Track success/failure | After applying patterns |
-| `ekkOS_Detect` | Auto-detect pattern usage | In responses |
-| `ekkOS_Recall` | Recall past conversations | When user asks "what did we" |
-
-### Schema Awareness (2 tools)
-
-| Tool | Purpose | When to Use |
-|------|---------|-------------|
-| `ekkOS_IndexSchema` | Index database schemas | With Supabase/Prisma projects |
-| `ekkOS_GetSchema` | Get specific table schema | When writing queries |
-
-### Plan Management (9 tools)
-
-| Tool | Purpose | When to Use |
-|------|---------|-------------|
-| `ekkOS_Plan` | Create structured plans | Multi-step features |
-| `ekkOS_Generate` | AI-generate plans | Complex tasks |
-| `ekkOS_PlanStatus` | Update plan status | Marking steps complete |
-| `ekkOS_PlanStep` | Mark step done | Step completion |
-| `ekkOS_SaveTemplate` | Save as template | Reusable workflows |
-| `ekkOS_Templates` | List templates | Finding existing plans |
-| `ekkOS_FromTemplate` | Create from template | Starting from template |
-
-### Portability & Secrets (8 tools)
-
-| Tool | Purpose | When to Use |
-|------|---------|-------------|
-| `ekkOS_Export` | Export as backup | Before major changes |
-| `ekkOS_Import` | Import from backup | Restoring context |
-| `ekkOS_StoreSecret` | Encrypt credentials | Storing API keys |
-| `ekkOS_GetSecret` | Retrieve secrets | Using stored credentials |
-| `ekkOS_ListSecrets` | List secret metadata | Checking what's stored |
-| `ekkOS_RotateSecret` | Rotate secret values | Key rotation |
-
-### System Health (4 tools)
-
-| Tool | Purpose | When to Use |
-|------|---------|-------------|
-| `ekkOS_Stats` | Get layer statistics | Health checks |
-| `ekkOS_Summary` | Get activity summary | Progress updates |
-| `ekkOS_Conflict` | Check for conflicts | Before dangerous ops |
-| `ekkOS_Reflect` | Analyze for improvements | Post-task review |
-
-## 11-Layer Architecture
-
-| Layer | Purpose | Example Content |
-|-------|---------|-----------------|
-| 1 | Working | Current session context |
-| 2 | Episodic | Past conversation turns |
-| 3 | Semantic | Embeddings/vectors |
-| 4 | Patterns | Proven solutions |
-| 5 | Procedural | Step-by-step guides |
-| 6 | Collective | Community patterns |
-| 7 | Meta | Pattern effectiveness |
-| 8 | Codebase | Project code context |
-| 9 | Directives | User rules (MUST/NEVER) |
-| 10 | Conflict | Auto-resolution rules |
-| 11 | Secrets | Encrypted credentials |
-
-## Forge Triggers
-
-**Always forge when you:**
-- Fix a bug (create anti-pattern from the bug)
-- Find a better approach (update existing pattern)
-- Discover a gotcha (create warning pattern)
-- Get corrected by user (learn from correction)
-- Solve auth/config issues (create setup pattern)
-- Make architecture decisions (document rationale)
-- Debug non-trivially (capture the journey)
-
-## Response Format
-
-End EVERY response with:
-
-```
-🧠 **ekkOS_™** · 📅 YYYY-MM-DD H:MM AM/PM TZ
-```
-
-## Examples
-
-### Example 1: Technical Question
-
-User: "How do I fix CORS in Next.js?"
-
-Your workflow:
-1. Call `ekkOS_Search` with query: "Next.js CORS fix"
-2. Review retrieved patterns
-3. Acknowledge all patterns with SELECT/SKIP
-4. Provide answer based on patterns + your knowledge
-5. End with footer
-
-### Example 2: Bug Fix
-
-User: "The build is failing with this error..."
-
-Your workflow:
-1. Call `ekkOS_Search` with error message
-2. Apply relevant patterns
-3. Acknowledge with SELECT
-4. Fix the bug
-5. Call `ekkOS_Forge` with the solution
-6. Call `ekkOS_Outcome` to track success
-
-### Example 3: User Preference
-
-User: "I always want TypeScript strict mode"
-
-Your workflow:
-1. Call `ekkOS_Directive`:
-   - type: PREFER
-   - rule: "Use TypeScript strict mode"
-   - scope: project
-2. Acknowledge in future responses
-
-## Best Practices
-
-1. **Search first** - Never answer without searching
-2. **Acknowledge all** - 100% PatternGuard coverage required
-3. **Forge immediately** - Don't wait to capture learnings
-4. **Track outcomes** - Success/failure feedback improves patterns
-5. **Use directives** - Convert user preferences to rules
-6. **Export regularly** - Backup before major changes
-7. **End with footer** - Every response needs the ekkOS footer
-
-## Troubleshooting
-
-**"No patterns found"**
-→ You're in new territory. Forge what you discover.
-
-**"Pattern retrieval failed"**
-→ Check auth: `~/.ekkos/config.json` should have hookApiKey
-
-**"How do I continue from last session?"**
-→ Ask: "recall our last conversation" or "where were we"
-
-## Resources
-
-- Website: https://ekkos.dev
-- Docs: https://docs.ekkos.dev
-- Support: support@ekkos.dev
-
----
-
-🧠 **ekkOS_™** · Built for infinite context