@kenkaiiii/ggcoder 5.22.5 → 5.22.6

package/dist/config.js

@@ -157,6 +157,44 @@ When given a task:
 - **Blocked/Notes**: anything unfinished, assumed, or left for follow-up
 
 Do the work, don't just describe it. Don't over-engineer.
+`,
+        "auditor.md": `---
+name: auditor
+description: "Defensive security analyst \u2014 finds exploitable weaknesses with concrete vulnerability scenarios"
+tools: read, grep, find, ls, source_path
+---
+
+You are Auditor, a defensive security analyst. You review code the owner asked to have reviewed so weaknesses can be patched before they ship. You are read-only: report findings, never modify anything. Never produce working exploit code or payloads \u2014 describe each risk at the data-flow level so it maps directly to a fix.
+
+For the vulnerability class you are assigned:
+1. **Trace data flow** from the provided Sources to Sinks \u2014 no pattern-matching without a traced path
+2. Apply the untrusted-vs-trusted decision: is the input actually reachable by an untrusted party, or is it a settings constant / build-time string / server-controlled value?
+3. Describe a concrete **risk scenario** \u2014 what kind of input reaches the source, how the system processes it, what exposure results. If you can't describe the steps, don't flag it
+4. Assign **confidence 0.0\u20131.0**; drop everything below 0.8 before returning
+5. Be framework-aware: ORM parameterization, auto-escaping, and memory-safe languages eliminate whole classes \u2014 don't flag what the framework already handles
+
+Never flag: DOS without an amplification primitive, theoretical races, log spoofing, env-var trust, client-side checks backed by server validation, findings in docs/tests/fixtures, dev-only tooling, or style preferences.
+
+Report each finding: location (file:line), source \u2192 sink path, risk scenario, impact, concrete code-level fix, confidence.
+`,
+        "skeptic.md": `---
+name: skeptic
+description: "Rigorous false-positive reviewer \u2014 disproves security findings and applies exclusion rules strictly"
+tools: read, grep, find, ls, source_path
+---
+
+You are Skeptic, a false-positive reviewer for security findings. Start from "this is a false positive" and try to disprove each finding you are given \u2014 only findings that survive your challenge are confirmed.
+
+For each finding:
+1. Re-read the actual code at the cited location \u2014 does the claimed source \u2192 sink path really exist as described?
+2. Hunt for sanitization, validation, framework protection, or unreachable preconditions between source and sink
+3. Check whether the "untrusted" input is truly attacker-reachable, or is server-controlled config / env / build-time data
+4. Apply exclusions strictly: DOS and rate-limit noise, theoretical races, log spoofing, env-var trust, client-side checks backed by server validation, docs/test/fixture code, dev-only tooling, style preferences \u2014 all DROP
+
+Verdict per finding, with one-line justification:
+- **CONFIRM** \u2014 the path is real and reachable; evidence held up
+- **DOWNGRADE** \u2014 real but overstated; state the correct severity and why
+- **DROP** \u2014 disproved; cite the disproving evidence (file:line)
 `,
     };
     for (const [filename, content] of Object.entries(defaults)) {

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAiB,MAAM,oBAAoB,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAG,SAAS,CAAC;AAClC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,iFAAiF;AACjF,8DAA8D;AAC9D,OAAO,EAAE,WAAW,EAAE,CAAC;AAGvB,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAwBD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAW;IACxC,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,UAAU;IACV,SAAS;IACT,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,KAAK;CACN,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,KAAiB,CAAC,CAAC;AAC7E,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAC,gBAAyB;IACzD,MAAM,QAAQ,GAAG,gBAAgB,IAAI,WAAW,EAAE,CAAC,YAAY,CAAC;IAChE,MAAM,MAAM,GAAkB;QAC5B,eAAe,EAAE,KAAK;QACtB,KAAK,EAAE,MAAM;QACb,kBAAkB,EAAE,IAAI;QACxB,cAAc,EAAE,IAAI;QACpB,2BAA2B,EAAE,KAAK;QAClC,oBAAoB,EAAE,EAAE;KACzB,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC;YACtC,mEAAmE;YACnE,kEAAkE;YAClE,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;gBAAE,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC;QAC5E,CAAC;QACD,IAAI,GAAG,CAAC,eAAe,KAAK,IAAI;YAAE,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;QAChE,IAAI,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC;YAAE,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;QACtF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QAC9F,IAAI,GAAG,CAAC,kBAAkB,KAAK,KAAK;YAAE,MAAM,CAAC,kBAAkB,GAAG,KAAK,CAAC;QACxE,IAAI,GAAG,CAAC,cAAc,KAAK,KAAK;YAAE,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAChE,IAAI,GAAG,CAAC,2BAA2B,KAAK,IAAI;YAAE,MAAM,CAAC,2BAA2B,GAAG,IAAI,CAAC;QACxF,IACE,OAAO,GAAG,CAAC,mBAAmB,KAAK,QAAQ;YAC3C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACzC,GAAG,CAAC,mBAAmB,IAAI,CAAC;YAC5B,GAAG,CAAC,mBAAmB,IAAI,CAAC,EAC5B,CAAC;YACD,MAAM,CAAC,mBAAmB,GAAG,GAAG,CAAC,mBAAmB,CAAC;QACvD,CAAC;QACD,IACE,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ;YAC5C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAC1C,GAAG,CAAC,oBAAoB,IAAI,CAAC,EAC7B,CAAC;YACD,MAAM,CAAC,oBAAoB,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACzD,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,KAAK,WAAW,IAAI,GAAG,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACxE,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;QACzC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAEhG,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAsB,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAS;IAC3C,MAAM;IACN,MAAM;IACN,OAAO;IACP,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;CACnB,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IAChD,MAAM,QAAQ,GAA2B;QACvC,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;;;;CAuBb;QACG,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;CAyBb;KACE,CAAC;IAEF,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,2CAA2C;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IAChD,MAAM,QAAQ,GAA2B;QACvC,gBAAgB,EAAE,cAAc;KACjC,CAAC;IAEF,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,2CAA2C;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmFtB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClC,OAAO,MAAM,MAAM,SAAS,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAiB,MAAM,oBAAoB,CAAC;AAGhE,MAAM,CAAC,MAAM,QAAQ,GAAG,SAAS,CAAC;AAClC,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC;AAE/B,iFAAiF;AACjF,8DAA8D;AAC9D,OAAO,EAAE,WAAW,EAAE,CAAC;AAGvB,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,iBAAiB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAwBD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAW;IACxC,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,UAAU;IACV,SAAS;IACT,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,KAAK;CACN,CAAC,CAAC;AAEH,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,KAAiB,CAAC,CAAC;AAC7E,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAC,gBAAyB;IACzD,MAAM,QAAQ,GAAG,gBAAgB,IAAI,WAAW,EAAE,CAAC,YAAY,CAAC;IAChE,MAAM,MAAM,GAAkB;QAC5B,eAAe,EAAE,KAAK;QACtB,KAAK,EAAE,MAAM;QACb,kBAAkB,EAAE,IAAI;QACxB,cAAc,EAAE,IAAI;QACpB,2BAA2B,EAAE,KAAK;QAClC,oBAAoB,EAAE,EAAE;KACzB,CAAC;IACF,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;QAC/D,qEAAqE;QACrE,wEAAwE;QACxE,uEAAuE;QACvE,IAAI,eAAe,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YACzC,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC,eAAe,CAAC;YACtC,mEAAmE;YACnE,kEAAkE;YAClE,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ;gBAAE,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC;QAC5E,CAAC;QACD,IAAI,GAAG,CAAC,eAAe,KAAK,IAAI;YAAE,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;QAChE,IAAI,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC;YAAE,MAAM,CAAC,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;QACtF,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;QAC9F,IAAI,GAAG,CAAC,kBAAkB,KAAK,KAAK;YAAE,MAAM,CAAC,kBAAkB,GAAG,KAAK,CAAC;QACxE,IAAI,GAAG,CAAC,cAAc,KAAK,KAAK;YAAE,MAAM,CAAC,cAAc,GAAG,KAAK,CAAC;QAChE,IAAI,GAAG,CAAC,2BAA2B,KAAK,IAAI;YAAE,MAAM,CAAC,2BAA2B,GAAG,IAAI,CAAC;QACxF,IACE,OAAO,GAAG,CAAC,mBAAmB,KAAK,QAAQ;YAC3C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC;YACzC,GAAG,CAAC,mBAAmB,IAAI,CAAC;YAC5B,GAAG,CAAC,mBAAmB,IAAI,CAAC,EAC5B,CAAC;YACD,MAAM,CAAC,mBAAmB,GAAG,GAAG,CAAC,mBAAmB,CAAC;QACvD,CAAC;QACD,IACE,OAAO,GAAG,CAAC,oBAAoB,KAAK,QAAQ;YAC5C,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAC1C,GAAG,CAAC,oBAAoB,IAAI,CAAC,EAC7B,CAAC;YACD,MAAM,CAAC,oBAAoB,GAAG,GAAG,CAAC,oBAAoB,CAAC;QACzD,CAAC;QACD,IAAI,GAAG,CAAC,YAAY,KAAK,WAAW,IAAI,GAAG,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACxE,MAAM,CAAC,YAAY,GAAG,GAAG,CAAC,YAAY,CAAC;QACzC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAEhG,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,qBAAqB,CAAC,GAAG,CAAC,KAAsB,CAAC,CAAC;AACxF,CAAC;AAED,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAS;IAC3C,MAAM;IACN,MAAM;IACN,OAAO;IACP,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,kBAAkB;CACnB,CAAC,CAAC;AAEH,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,oBAAoB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IAChD,MAAM,QAAQ,GAA2B;QACvC,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;;;;CAuBb;QACG,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;CAyBb;QACG,YAAY,EAAE;;;;;;;;;;;;;;;;;;CAkBjB;QACG,YAAY,EAAE;;;;;;;;;;;;;;;;;;CAkBjB;KACE,CAAC;IAEF,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,2CAA2C;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IAChD,MAAM,QAAQ,GAA2B;QACvC,gBAAgB,EAAE,cAAc;KACjC,CAAC;IAEF,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1B,2CAA2C;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmFtB,CAAC"}

package/dist/core/prompt-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-commands.d.ts","sourceRoot":"","sources":["../../src/core/prompt-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAmBD,eAAO,MAAM,eAAe,EAAE,aAAa,EAsmB1C,CAAC;AAEF,gDAAgD;AAChD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAExE"}
+{"version":3,"file":"prompt-commands.d.ts","sourceRoot":"","sources":["../../src/core/prompt-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AA0BD,eAAO,MAAM,eAAe,EAAE,aAAa,EA+gB1C,CAAC;AAEF,gDAAgD;AAChD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAExE"}

package/dist/core/prompt-commands.js

@@ -16,6 +16,11 @@ const TASKS_ADDED_NOTICE = IS_GG_APP
 const CLAUDE_MD_RESTART_NOTICE = IS_GG_APP
     ? '> ⚠️ CLAUDE.md was created/updated. GG App loads it fresh per session, so start a **New Session** (click "+ New") before continuing. Without a new session, I won\'t see the new context.'
     : "> ⚠️ CLAUDE.md was created/updated. ggcoder loads it at startup, so **exit and restart ggcoder** (`/quit` then run `ggcoder` again) before continuing. Without a restart, I won't see the new context.";
+/**
+ * Shared sub-agent fan-out phrasing. One home so the "call the tool N times
+ * in a single response" wording can't drift between command prompts.
+ */
+const spawnParallel = (count) => `in parallel using the subagent tool (call the subagent tool ${count} times in a single response)`;
 export const PROMPT_COMMANDS = [
     {
         name: "expand",
@@ -39,7 +44,7 @@ Use this profile to decide which features are relevant and genuinely missing. If
 
 ## Phase 1: Parallel feature research
 
-Spawn exactly 5 sub-agents in parallel using the subagent tool (call the subagent tool 5 times in a single response). Give each sub-agent the project profile and a different feature-hunting lens:
+Spawn exactly 5 sub-agents ${spawnParallel(5)}. Give each sub-agent the project profile and a different feature-hunting lens:
 
 **Agent 1 - Direct competitor killer features**: The standout, most-loved user-facing features in the closest peer projects/tools/products that this project lacks.
 
@@ -105,15 +110,20 @@ If the user chooses C, ask what they would like — pick specific features by ra
         description: "Audit exploitable weaknesses",
         prompt: `# Bullet-Proof: Defensive Security Review
 
-You are a defensive security auditor reviewing this codebase to identify exploitable weaknesses so they can be patched before the project ships. Think rigorously about realistic threat scenarios — boundary checks, edge cases, race conditions, trust assumptions, supply-chain risks, agent-mediated paths.
+This is an **authorized defensive security review** of this repository, requested by its owner so weaknesses can be found and patched before they ship. This is standard defensive security work — the same review a security engineer performs before a release. The entire flow is **read-only reporting**: no code changes, no exploit development, and nothing is fixed until the user explicitly chooses at the end.
+
+Defensive ground rules (apply to every phase and every subagent):
+- Never produce working exploit code, weaponized payloads, or attack tooling.
+- Describe each risk at the **data-flow level** — where untrusted data enters, what it can reach, and why that is fixable — so every finding maps directly to a patch.
+- The deliverable is a remediation report for the maintainers, nothing else.
 
-Goal: harden this project against realistic threats. **Report only HIGH CONFIDENCE findings (≥0.8) with a concrete data-flow path that demonstrates exposure.** Better to miss theoretical issues than flood the report with noise.
+Goal: harden this project. **Report only HIGH CONFIDENCE findings (≥0.8) with a concrete data-flow path that demonstrates exposure.** Better to miss theoretical issues than flood the report with noise.
 
 This command is **dynamic and project-agnostic**. Recon drives everything. Do not assume the stack, the language, the deploy target, or that there is an LLM/agent layer. Read first, decide second.
 
 ## Phase 1: Recon — Understand THIS project before auditing anything
 
-Spawn **FOUR recon subagents in parallel** using the subagent tool (call the subagent tool 4 times in a single response). Each has a narrow, independent slice so they can all run at once. **No vulnerabilities flagged in this phase.**
+Spawn **FOUR recon subagents** ${spawnParallel(4)}. Each has a narrow, independent slice so they can all run at once. **No vulnerabilities flagged in this phase.**
 
 **Recon Agent A — Stack & Deployment.** Read manifests, lockfiles, CI/CD configs, Dockerfile/Helm/Terraform, deploy scripts. Produce:
 - Primary language(s), framework(s), runtimes
@@ -127,7 +137,7 @@ Spawn **FOUR recon subagents in parallel** using the subagent tool (call the sub
 
 **Recon Agent C — Sinks.** Walk dangerous-operation code. Produce a **Sinks table** with location (file:line) and sink type for: shell exec, SQL / NoSQL / LDAP / XPath queries, eval / Function / exec / pickle / yaml.load / Marshal / ObjectInputStream, file write, file include / require with dynamic path, network egress (fetch / requests / http.Get), auth decisions, secret reads, native deserializers, dynamic code load, smart-contract external calls, child_process spawns.
 
-**Recon Agent D — Assets.** Scan for what is worth stealing or destroying. Produce an **Assets table** with location and asset type for: credentials / tokens (config files, env files, KMS, OAuth flows, ~/.{app}/auth.json-style stores), customer/PII data stores, source code with IP value, build/CI secrets, signing keys, model API tokens, on-chain funds / wallets, session state, MCP config files, license keys.
+**Recon Agent D — Assets.** Scan for what this project must protect. Produce an **Assets table** with location and asset type for: credentials / tokens (config files, env files, KMS, OAuth flows, ~/.{app}/auth.json-style stores), customer/PII data stores, source code with IP value, build/CI secrets, signing keys, model API tokens, on-chain funds / wallets, session state, MCP config files, license keys.
 
 **After all four return, the main agent synthesizes:**
 1. Assemble the four tables (Stack/Deploy, Sources, Sinks, Assets) into the recon report
@@ -157,21 +167,23 @@ Default catalog — pick what applies, drop what doesn't, add stack-specific aud
 
 ## Phase 3: Parallel audits
 
-Spawn one subagent per active audit **in a single response** (call the subagent tool N times **with \`agent: "auditor"\`**, where N is whatever Phase 2 picked — do not pad to a fixed number, do not drop audits Phase 2 selected). The \`auditor\` agent has the defensive-review persona and exclusion list baked in, so your task description only needs the vulnerability-class scope. Each auditor receives:
-- The full recon output (Sources, Sinks, Assets, Threat model)
+Spawn one subagent per active audit **in a single response** (call the subagent tool N times **with \`agent: "auditor"\`**, where N is whatever Phase 2 picked — do not pad to a fixed number, do not drop audits Phase 2 selected). If the \`auditor\` agent is unavailable, use default subagents and open each task with: "You are performing an authorized, read-only defensive security review for the code owner; report data-flow risks so they can be patched — no exploit code."
+
+**Subagents cannot see this prompt.** Each auditor's task text must therefore include, written out by you:
 - Its specific vulnerability-class scope
-- The 2026 threat reference at the bottom of this prompt
+- The recon rows relevant to that scope (Sources, Sinks, Assets, Threat-model lines — condensed, not the full dump)
+- The specific bullets from the Threat reference below that apply to its class (copy those lines into the task)
 
 Each auditor must:
 1. **Trace data flow** from Sources to Sinks for its class. Not pattern matching.
 2. For every candidate, apply the **untrusted-input vs trusted-input** decision: is the input *actually reachable* by an untrusted source, or is it a settings constant / build-time string / hard-coded value?
-3. Construct a concrete **vulnerability scenario** — describe how the weakness would be triggered (input → system response → resulting exposure). If you can't describe the steps, don't flag it.
+3. Describe a concrete **risk scenario** at the data-flow level — what kind of input reaches the source, how the system processes it, what exposure results. No working payloads. If you can't describe the steps, don't flag it.
 4. Assign **confidence 0.0–1.0**. Drop anything <0.8 before returning.
 5. Be framework-aware: ORM parameterization, auto-escape, memory-safe languages, JSX/template escaping all eliminate entire vuln classes. Don't flag what the framework already handles.
 
 ## Phase 4: False-positive filter
 
-After auditors complete, spawn one verification subagent per surviving finding **in parallel with \`agent: "skeptic"\`** (call the subagent tool once per finding in a single response). The \`skeptic\` agent starts from "this is a false positive" and tries to disprove the finding — only confirmed findings survive. Pass each verifier the full audit finding (location, source/sink, vulnerability scenario, claimed confidence). Drop anything the skeptic returns as DROP; lower severity for DOWNGRADE.
+After auditors complete, spawn verification subagents **in parallel with \`agent: "skeptic"\`**, batching 3–5 surviving findings per skeptic (cap at 4 skeptics total — batching keeps cost sane). The \`skeptic\` agent starts from "this is a false positive" and tries to disprove each finding — only confirmed findings survive. Pass each skeptic the full text of its findings (location, source/sink, risk scenario, claimed confidence); skeptics cannot see this prompt or the auditors' context. Drop anything returned as DROP; lower severity for DOWNGRADE.
 
 **Hard exclusions — do NOT report these, even if real:**
 - DOS / rate-limiting / memory exhaustion without a clear amplification primitive
@@ -216,9 +228,9 @@ Threat model: [from recon]
 - Category: <slug>   CWE: CWE-XXX   Confidence: 0.95
 - Exposure surface: <entry point from Sources>
 - Source → Sink: <e.g. \`POST /api/foo body.userId\` → \`subprocess.run(..., shell=True)\`>
-- Vulnerability scenario:
-  1. Untrusted input <specific payload> reaches <source>
-  2. Server processes it as <what>
+- Risk scenario (data-flow level, no payloads):
+  1. Untrusted input of <shape/kind> reaches <source>
+  2. The system processes it as <what>
   3. Result: <RCE / data exposure / auth bypass>
 - Impact: <blast radius — what is exposed, how far it spreads>
 - Fix: <concrete remediation, code-level>
@@ -245,7 +257,7 @@ If the user chooses A, B, or C, do not fix directly. Instead, add one task per s
 
 ## Threat reference (May 2026)
 
-Cite these as needed per audit. Do not dump them into the report — use them to verify whether a candidate is actually reachable.
+Defensive reference material from public incident reports and OWASP — patterns to check for, not techniques to reproduce. Copy the relevant bullets into each auditor's task (Phase 3); do not dump them into the report.
 
 **OWASP Top 10:2025** — A01 Broken Access Control (now includes SSRF), A02 Misconfig, **A03 Supply Chain Failures (new)**, A05 Injection (now includes prompt injection), **A10 Mishandling Exceptional Conditions (new — fail-open patterns)**.
 
@@ -255,7 +267,7 @@ Cite these as needed per audit. Do not dump them into the report — use them to
 
 **OWASP Top 10 for Agents 2026 (ASI01–10)** — Goal hijack, tool misuse, identity/privilege abuse, agentic supply chain, unexpected code exec, memory/context poisoning, inter-agent comms, cascading failures, human-trust exploit, rogue agents.
 
-**Real 2024-2026 incidents — use as grep templates:**
+**Real 2024-2026 public incidents — patterns to grep for defensively:**
 - tj-actions/changed-files (Mar 14-15 2025, CVE-2025-30066, 23k repos) → unpinned GH Actions, \`uses: foo/bar@main\` / mutable tags, runner-memory secret dumps
 - TanStack Mini Shai-Hulud (May 11 2026, CVE-2026-45321, CVSS 9.6 — 84 versions across 42 \`@tanstack/*\` + UiPath/Mistral/Guardrails/OpenSearch, 169+ packages total, "TeamPCP") → self-spreading npm worm, \`pull_request_target\` + cache poisoning + OIDC token extraction from \`/proc/<pid>/mem\`, persistent \`gh-token-monitor\` daemon
 - Slopsquatting (ongoing 2025-2026, \`react-codeshift\` Jan 2026) → AI coding assistants hallucinate ~20% non-existent package names (open-source models ~21.7%, GPT-4 ~5.2%); malicious parties register the hallucinated names on npm/PyPI. **Verify every package actually existed BEFORE the agent suggested it** — check registry age, download history, author identity
@@ -310,7 +322,7 @@ If CLAUDE.md does NOT exist:
 
 Derive every fact from the actual project — source code, entry points, manifests, and config. Treat README, docs, and code comments as unverified hints that are frequently stale: never copy claims from them, and only state things you can confirm from the code and config themselves.
 
-Spawn 3 sub-agents in parallel using the subagent tool (call the subagent tool 3 times in a single response):
+Spawn 3 sub-agents ${spawnParallel(3)}:
 
 1. **Project Purpose Agent**: Determine what the project actually does from its real code — entry points, main modules, exported/public APIs, CLI commands, routes, and manifests. Do not rely on the README's description.
 2. **Directory Structure Agent**: Map out the folder structure and what each folder contains
@@ -478,7 +490,7 @@ Illustrative only (not prescriptive):
 
 ## Phase 3: Parallel sweep
 
-Spawn one sub-agent per domain you chose, in parallel using the subagent tool (call it N times in a single response, one task per domain). Each explores its assigned domain and returns skill-worthy opportunities.
+Spawn one sub-agent per domain you chose, ${spawnParallel("N")} — one task per domain. Each explores its assigned domain and returns skill-worthy opportunities.
 
 **Skill-worthy means**: a recurring activity someone will do on THIS project — shipping, reviewing, migrating, debugging, onboarding, whatever applies — where a reusable instruction set would make it **faster** (efficient), **lower-effort** (easier), or **less likely to break something** (safer). The test is: will this skill save real time, reduce real cognitive load, or prevent real mistakes, repeatedly, on this project? If no, drop it. A domain returning zero candidates is a valid outcome.
 
@@ -536,100 +548,6 @@ If strong candidates had no ecosystem match, list them at the bottom:
 
 After presenting the list, ask which (if any) to install. Install nothing without explicit confirmation. Once confirmed, hand off to find-skills to perform the actual install.`,
     },
-    {
-        name: "setup",
-        aliases: ["setup-project"],
-        description: "Audit project setup",
-        prompt: `Audit this project across six categories and report gaps. **Do not fix anything yet.** Wait for me to choose what to address after the report.
-
-Language-agnostic and project-agnostic — adapt findings to the languages and stack actually present. Ignore categories that don't apply (e.g. skip CI for a local-only scratchpad).
-
-## Categories
-
-### 1. Project hygiene
-
-- \`.gitignore\` present and covers the active language(s)?
-- \`README.md\` present with at least install + run instructions?
-- License file present (if this looks like a public/shareable project)?
-- \`.editorconfig\` present?
-- Git initialized? (\`.git\` directory exists)
-
-### 2. Toolchain version pinning
-
-- Language version pinned in a canonical file: \`.nvmrc\` / \`package.json#engines\` (Node), \`.python-version\` / \`pyproject.toml#requires-python\` (Python), \`rust-toolchain.toml\` (Rust), the \`go\` line in \`go.mod\`, \`.ruby-version\` (Ruby), etc.
-- Lockfile present and committed? (\`package-lock.json\`, \`pnpm-lock.yaml\`, \`yarn.lock\`, \`bun.lockb\`, \`uv.lock\`, \`poetry.lock\`, \`Cargo.lock\`, \`go.sum\`, \`Gemfile.lock\`, \`composer.lock\`)
-
-### 3. Code quality tooling
-
-For each active language, check that a formatter, linter, and (where applicable) type checker are configured:
-- **Formatter**: Prettier / ruff format / gofmt (built-in) / rustfmt (built-in) / clang-format / etc.
-- **Linter**: ESLint / Ruff / golangci-lint / Clippy / etc. — with a reasonable strictness preset
-- **Type checker** (statically-typed langs only): tsc strict, Pyright strict, mypy strict
-- **Test framework**: vitest / jest / pytest / go test / cargo test / rspec / etc.
-
-Report which are present, missing, or configured below the pack's strictness recommendation.
-
-### 4. Verify pipeline
-
-- Are \`lint\` / \`typecheck\` / \`format:check\` / \`test\` (or language-equivalent) wired as runnable commands? (scripts in \`package.json\`, \`pyproject.toml\`, a \`Makefile\`, or \`justfile\`)
-- Pre-commit hook configured? (\`.husky/\`, \`pre-commit\` framework, \`lefthook\`, etc.) — nice-to-have, not required.
-- CI config present? (\`.github/workflows/\`, \`.gitlab-ci.yml\`, \`.circleci/\`, etc.)
-
-### 5. Style pack alignment
-
-"Active style packs" refers specifically to the per-language sub-sections inside the **Language Style Packs** section in your system prompt (e.g. \`### TypeScript\`, \`### Python\`, \`### Go\`). It does **NOT** include the cross-cutting \`### Agent-Written Code\` preamble that sits above them — those are guidelines for how code is *written*, not project-scaffolding to audit. It also does **NOT** include Skills (\`.gg/skills/\`) or any other extension category. If the Language Style Packs section is absent or empty, **skip this entire section entirely** — do not substitute Skills or any other concept.
-
-When per-language packs are present, compare the project against each pack's **Tooling** bullet and the system prompt's **Verification** commands. For tool recommendations or config semantics, verify against official docs when local files are ambiguous:
-- Tooling: which strict-mode flags or lint-rule presets does the pack recommend that the project is missing? (e.g. \`tsconfig\` missing \`noUncheckedIndexedAccess\`, \`pyproject\` missing \`[tool.ruff]\`, Go project missing \`golangci-lint\` config).
-- Dependencies: list which pack-mentioned libs (Zod, Pydantic, thiserror, anyhow, etc.) the project uses, has an equivalent for, or lacks. **Observation only — no recommendation to install.**
-
-### 6. Documentation hygiene
-
-- \`CLAUDE.md\` or \`AGENTS.md\` present?
-- Public API documented? (top-level docstrings, type signatures, or README examples)
-- Architecture doc for non-trivial projects? (\`ARCHITECTURE.md\`, \`docs/architecture/\`, ADRs)
-
-## How to investigate
-
-- Read the project root + obvious config locations (\`./\`, \`.github/\`, \`.husky/\`, \`docs/\`).
-- Don't recurse into \`node_modules\`, \`dist\`, \`build\`, \`target\`, vendored folders.
-- Use \`ls\`, \`read\`, \`find\` (with name patterns) — do not \`grep\` source code for this audit; it's about scaffolding, not code review.
-- Cap at ~20 file reads total. If a file is huge (e.g. \`pnpm-lock.yaml\`), don't read its body — presence is what matters.
-
-## Output format
-
-A single Markdown report, organized by category. Within each category, mark each item as one of:
-- \`[OK]\` — present and reasonable
-- \`[GAP]\` — missing or misconfigured; safe to add/fix
-- \`[INFO]\` — observation only, no action implied
-- \`[N/A]\` — doesn't apply to this project (omit from output if obvious)
-
-Keep each line to one sentence. No prose paragraphs.
-
-At the end:
-
-\`\`\`
-## Summary
-
-<N> gaps in hygiene, <N> in tooling, <N> in verify pipeline, <N> in style-pack alignment.
-
-Which (if any) would you like me to fix? Options:
-- A) Add tasks for all [GAP] items that are safe + additive (no overwrites)
-- B) Add tasks for a category: hygiene / tooling / verify / style-pack alignment
-- C) Add tasks for specific items — tell me which
-- D) None — just the report
-\`\`\`
-
-## Rules
-
-- **Report only.** No edits, no installs, no commits without explicit user confirmation after the report.
-- **Task handoff for fixes.** If the user chooses A, B, or C, do not fix directly. Add one task per selected gap or tightly coupled gap group using the \`tasks\` tool (action=add). Each task needs a short title and a standalone prompt that includes the gap, affected files/configs, safe-additive constraints, implementation instructions, project verification commands, and instructions to verify relevant tool/config semantics against official docs before completing the task. Use kencode search only for code-level examples, not as proof of scaffolding requirements. After adding the tasks, tell the user exactly: "${TASKS_ADDED_NOTICE}" Do not begin executing them unless the user explicitly says so.
-- **No code refactors recommended.** This audit is about scaffolding/tooling, not code review. Use \`/scan\` or \`/verify\` for code-level findings.
-- **No dependency installations in the report.** Listing them as observations is fine; recommending installation is not — that's the user's call.
-- **Skip empty categories.** If a category has no findings, omit it.
-- **Adapt to scale.** A 50-line script doesn't need CI, a license, or an ARCHITECTURE.md. Use judgment.
-- **Brand-new empty project**: report "Empty project — nothing to audit. To bootstrap, tell me the stack you want and I'll scaffold from scratch." and stop.`,
-    },
 ];
 /** Look up a prompt command by name or alias */
 export function getPromptCommand(name) {

package/dist/core/prompt-commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-commands.js","sourceRoot":"","sources":["../../src/core/prompt-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC;AAExD,MAAM,kBAAkB,GAAG,SAAS;IAClC,CAAC,CAAC,2EAA2E;IAC7E,CAAC,CAAC,+DAA+D,CAAC;AAEpE,MAAM,wBAAwB,GAAG,SAAS;IACxC,CAAC,CAAC,2LAA2L;IAC7L,CAAC,CAAC,wMAAwM,CAAC;AAE7M,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,mCAAmC;QAChD,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0KA4E8J;KACvK;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,WAAW,EAAE,8BAA8B;QAC3C,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gsBA0IorB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qEA4C7oB;KAClE;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,+CAA+C;QAC5D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2DV,wBAAwB,EAAE;KACzB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,4BAA4B;QACzC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mLA0DuK;KAChL;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,yBAAyB;QACtC,MAAM,EAAE;;;;;;;;;;;;;;;iFAeqE;KAC9E;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,yBAAyB;QACtC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gLA6FoK;KAC7K;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,CAAC,eAAe,CAAC;QAC1B,WAAW,EAAE,qBAAqB;QAClC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0mBAmF8lB,kBAAkB;;;;;6JAK/d;KAC1J;CACF,CAAC;AAEF,gDAAgD;AAChD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACxF,CAAC"}
+{"version":3,"file":"prompt-commands.js","sourceRoot":"","sources":["../../src/core/prompt-commands.ts"],"names":[],"mappings":"AAAA;;;GAGG;AASH;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC;AAExD,MAAM,kBAAkB,GAAG,SAAS;IAClC,CAAC,CAAC,2EAA2E;IAC7E,CAAC,CAAC,+DAA+D,CAAC;AAEpE,MAAM,wBAAwB,GAAG,SAAS;IACxC,CAAC,CAAC,2LAA2L;IAC7L,CAAC,CAAC,wMAAwM,CAAC;AAE7M;;;GAGG;AACH,MAAM,aAAa,GAAG,CAAC,KAAsB,EAAU,EAAE,CACvD,+DAA+D,KAAK,8BAA8B,CAAC;AAErG,MAAM,CAAC,MAAM,eAAe,GAAoB;IAC9C;QACE,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,mCAAmC;QAChD,MAAM,EAAE;;;;;;;;;;;;;;;;;;6BAkBiB,aAAa,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0KA0D6H;KACvK;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,CAAC,IAAI,CAAC;QACf,WAAW,EAAE,8BAA8B;QAC3C,MAAM,EAAE;;;;;;;;;;;;;;;iCAeqB,aAAa,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gsBAkI+oB,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;qEA4C7oB;KAClE;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,+CAA+C;QAC5D,MAAM,EAAE;;;;;;;;;;;;;;;;;;;qBAmBS,aAAa,CAAC,CAAC,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAwCnC,wBAAwB,EAAE;KACzB;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,4BAA4B;QACzC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mLA0DuK;KAChL;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,yBAAyB;QACtC,MAAM,EAAE;;;;;;;;;;;;;;;iFAeqE;KAC9E;IACD;QACE,IAAI,EAAE,cAAc;QACpB,OAAO,EAAE,EAAE;QACX,WAAW,EAAE,yBAAyB;QACtC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CAqCgC,aAAa,CAAC,GAAG,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;gLAwDkH;KAC7K;CACF,CAAC;AAEF,gDAAgD;AAChD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACxF,CAAC"}

package/dist/core/prompt-commands.test.js

@@ -5,29 +5,32 @@ describe("prompt commands", () => {
         expect(PROMPT_COMMANDS.find((command) => command.name === "goal")).toBeUndefined();
         expect(PROMPT_COMMANDS.find((command) => command.aliases.includes("g"))).toBeUndefined();
     });
-    it("hands setup/bullet-proof fixes off to the tasks tool, not a Goal", () => {
-        const setup = PROMPT_COMMANDS.find((command) => command.name === "setup");
+    it("hands bullet-proof fixes off to the tasks tool, not a Goal", () => {
         const bulletProof = PROMPT_COMMANDS.find((command) => command.name === "bullet-proof");
-        expect(setup?.prompt).toContain("`tasks` tool");
-        expect(setup?.prompt).toContain("Press Ctrl+T to open the task list");
-        expect(setup?.prompt).not.toContain("Create a Goal");
-        expect(setup?.prompt).not.toContain("Press CTRL + G");
         expect(bulletProof?.prompt).toContain("`tasks` tool");
         expect(bulletProof?.prompt).toContain("Press Ctrl+T to open the task list");
         expect(bulletProof?.prompt).not.toContain("Create a Goal");
         expect(bulletProof?.prompt).not.toContain("Press CTRL + G");
     });
+    it("frames bullet-proof as an authorized defensive review with no exploit output", () => {
+        const bulletProof = PROMPT_COMMANDS.find((command) => command.name === "bullet-proof");
+        expect(bulletProof?.prompt).toContain("authorized defensive security review");
+        expect(bulletProof?.prompt).toContain("Never produce working exploit code");
+        expect(bulletProof?.prompt).toContain("data-flow level");
+        // Subagents never see the command prompt — the handoff must say so.
+        expect(bulletProof?.prompt).toContain("Subagents cannot see this prompt.");
+        // Skeptic verification is batched to keep fan-out cost bounded.
+        expect(bulletProof?.prompt).toContain("batching 3–5 surviving findings per skeptic");
+        expect(bulletProof?.prompt).not.toContain("<specific payload>");
+    });
     it("points at the app's Tasks button / New Session instead of CLI keybinds when run under gg-app", async () => {
         const previous = process.env.GG_APP_PORT;
         process.env.GG_APP_PORT = "0";
         vi.resetModules();
         try {
             const { PROMPT_COMMANDS: appPromptCommands } = await import("./prompt-commands.js");
-            const setup = appPromptCommands.find((command) => command.name === "setup");
             const bulletProof = appPromptCommands.find((command) => command.name === "bullet-proof");
             const init = appPromptCommands.find((command) => command.name === "init");
-            expect(setup?.prompt).toContain('Click the "Tasks" button');
-            expect(setup?.prompt).not.toContain("Ctrl+T");
             expect(bulletProof?.prompt).toContain('Click the "Tasks" button');
             expect(bulletProof?.prompt).not.toContain("Ctrl+T");
             expect(init?.prompt).toContain("New Session");
@@ -51,11 +54,12 @@ describe("prompt commands", () => {
             "simplify",
             "batch",
             "research",
+            "setup",
             "setup-lint",
             `setup-${"tests"}`,
             "setup-update",
         ];
-        const removedAliases = ["depcheck", "depsource"];
+        const removedAliases = ["depcheck", "depsource", "setup-project"];
         for (const name of removedCommandNames) {
             expect(PROMPT_COMMANDS.find((command) => command.name === name)).toBeUndefined();
         }

package/dist/core/prompt-commands.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-commands.test.js","sourceRoot":"","sources":["../../src/core/prompt-commands.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACnF,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QAC1E,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;QAEvF,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QACtE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACrD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACtD,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAC5E,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC;QAC9B,EAAE,CAAC,YAAY,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YACpF,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;YAC5E,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;YACzF,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAE1E,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YAC5D,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YAC9C,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YAClE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACtD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;gBAAS,CAAC;YACT,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;;gBACtD,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,QAAQ,CAAC;YACxC,EAAE,CAAC,YAAY,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,mBAAmB,GAAG;YAC1B,MAAM;YACN,QAAQ;YACR,QAAQ;YACR,UAAU;YACV,OAAO;YACP,UAAU;YACV,YAAY;YACZ,SAAS,OAAO,EAAE;YAClB,cAAc;SACf,CAAC;QACF,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAEjD,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACvC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACnF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAE5E,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,wCAAwC,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,kDAAkD,CAAC,CAAC;QACrF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,6CAA6C,CAAC,CAAC;QAChF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,kDAAkD,CAAC,CAAC;QACrF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;QACtE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QAExE,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAC5B,mEAAmE,CACpE,CAAC;QACF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,8DAA8D,CAAC,CAAC;QAC/F,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"prompt-commands.test.js","sourceRoot":"","sources":["../../src/core/prompt-commands.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACnF,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;QAEvF,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC;QACtD,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAC5E,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,GAAG,EAAE;QACtF,MAAM,WAAW,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;QAEvF,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,sCAAsC,CAAC,CAAC;QAC9E,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QAC5E,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACzD,oEAAoE;QACpE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;QAC3E,gEAAgE;QAChE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,6CAA6C,CAAC,CAAC;QACrF,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8FAA8F,EAAE,KAAK,IAAI,EAAE;QAC5G,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,GAAG,CAAC;QAC9B,EAAE,CAAC,YAAY,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YACpF,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,cAAc,CAAC,CAAC;YACzF,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YAE1E,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;YAClE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;YAChD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;YACtD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC;gBAAS,CAAC;YACT,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;;gBACtD,OAAO,CAAC,GAAG,CAAC,WAAW,GAAG,QAAQ,CAAC;YACxC,EAAE,CAAC,YAAY,EAAE,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,mBAAmB,GAAG;YAC1B,MAAM;YACN,QAAQ;YACR,QAAQ;YACR,UAAU;YACV,OAAO;YACP,UAAU;YACV,OAAO;YACP,YAAY;YACZ,SAAS,OAAO,EAAE;YAClB,cAAc;SACf,CAAC;QACF,MAAM,cAAc,GAAG,CAAC,UAAU,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QAElE,KAAK,MAAM,IAAI,IAAI,mBAAmB,EAAE,CAAC;YACvC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACnF,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QAC7F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6EAA6E,EAAE,GAAG,EAAE;QACrF,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAE5E,MAAM,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC7B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,wCAAwC,CAAC,CAAC;QAC3E,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,kCAAkC,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,uCAAuC,CAAC,CAAC;QAC1E,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,kDAAkD,CAAC,CAAC;QACrF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,6CAA6C,CAAC,CAAC;QAChF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,kDAAkD,CAAC,CAAC;QACrF,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;QAC7D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;QACtE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;QACtD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;QAExE,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAC3B,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,+BAA+B,CAAC,CAAC;QAChE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,yBAAyB,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,iDAAiD,CAAC,CAAC;QAClF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;QAC1E,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAC5B,mEAAmE,CACpE,CAAC;QACF,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QACrE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,8DAA8D,CAAC,CAAC;QAC/F,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;QAC7D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,oCAAoC,CAAC,CAAC;QACzE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,yCAAyC,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/core/setup-history.d.ts

@@ -1,9 +1,3 @@
-/** Returns true if this cwd has never been audited by /setup before. */
-export declare function isFirstTimeSetup(cwd: string): boolean;
-/** Mark this cwd as audited. Called immediately after the auto-run fires
- *  (whether or not the agent actually completes the audit) so we never
- *  double-trigger across sessions. */
-export declare function markSetupAudited(cwd: string): void;
 /** Returns the language ids that have already been announced via the
  *  "STYLE PACK ACTIVE" badge for this cwd. */
 export declare function getAnnouncedLanguages(cwd: string): string[];

package/dist/core/setup-history.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-history.d.ts","sourceRoot":"","sources":["../../src/core/setup-history.ts"],"names":[],"mappings":"AAiDA,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGrD;AAED;;sCAEsC;AACtC,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAKlD;AAED;8CAC8C;AAC9C,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAG3D;AAED;oCACoC;AACpC,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CASlF"}
+{"version":3,"file":"setup-history.d.ts","sourceRoot":"","sources":["../../src/core/setup-history.ts"],"names":[],"mappings":"AAgDA;8CAC8C;AAC9C,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAG3D;AAED;oCACoC;AACpC,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CASlF"}

package/dist/core/setup-history.js

@@ -3,13 +3,11 @@ import path from "node:path";
 import os from "node:os";
 const HISTORY_PATH = path.join(os.homedir(), ".gg", "setup-history.json");
 /**
- * Persisted record of which project directories have been auto-audited by
- * `/setup`. Used to gate the first-time auto-run: we want the audit to fire
- * exactly once per project, not once per session.
+ * Persisted per-project UI-notification history (style-pack badge announcements).
  *
  * Stored at `~/.gg/setup-history.json`. Keys are absolute cwd paths. The file
  * is small (one line per project the user has ever opened with ggcoder) and
- * read/written on session start only \u2014 not in any hot path.
+ * read/written on session start only — not in any hot path.
  */
 function readHistory() {
     try {
@@ -34,20 +32,6 @@ function writeHistory(history) {
            next session, which is annoying but not broken. */
     }
 }
-/** Returns true if this cwd has never been audited by /setup before. */
-export function isFirstTimeSetup(cwd) {
-    const history = readHistory();
-    return history[cwd]?.lastAuditedAt === undefined;
-}
-/** Mark this cwd as audited. Called immediately after the auto-run fires
- *  (whether or not the agent actually completes the audit) so we never
- *  double-trigger across sessions. */
-export function markSetupAudited(cwd) {
-    const history = readHistory();
-    const existing = history[cwd] ?? {};
-    history[cwd] = { ...existing, lastAuditedAt: new Date().toISOString() };
-    writeHistory(history);
-}
 /** Returns the language ids that have already been announced via the
  *  "STYLE PACK ACTIVE" badge for this cwd. */
 export function getAnnouncedLanguages(cwd) {

package/dist/core/setup-history.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-history.js","sourceRoot":"","sources":["../../src/core/setup-history.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;AAa1E;;;;;;;;GAQG;AACH,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAsB,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,OAAqB;IACzC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP;6DACqD;IACvD,CAAC;AACH,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,aAAa,KAAK,SAAS,CAAC;AACnD,CAAC;AAED;;sCAEsC;AACtC,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACxE,YAAY,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC;AAED;8CAC8C;AAC9C,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,kBAAkB,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;oCACoC;AACpC,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,KAAwB;IAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO;IAC1C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC3D,YAAY,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC"}
+{"version":3,"file":"setup-history.js","sourceRoot":"","sources":["../../src/core/setup-history.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAEzB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;AAc1E;;;;;;GAMG;AACH,SAAS,WAAW;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;QAC1C,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACnE,OAAO,MAAsB,CAAC;QAChC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,YAAY,CAAC,OAAqB;IACzC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,EAAE,CAAC,aAAa,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP;6DACqD;IACvD,CAAC;AACH,CAAC;AAED;8CAC8C;AAC9C,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,kBAAkB,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;oCACoC;AACpC,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,KAAwB;IAC1E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC/B,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,QAAQ,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO;IAC1C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC3D,YAAY,CAAC,OAAO,CAAC,CAAC;AACxB,CAAC"}

package/dist/core/setup-history.test.js

@@ -20,33 +20,16 @@ async function loadModule() {
     return await import("./setup-history.js");
 }
 describe("setup-history", () => {
-    it("isFirstTimeSetup returns true when history file is absent", async () => {
-        const { isFirstTimeSetup } = await loadModule();
-        expect(isFirstTimeSetup("/tmp/never-seen")).toBe(true);
-    });
-    it("markSetupAudited persists the cwd entry", async () => {
-        const { isFirstTimeSetup, markSetupAudited } = await loadModule();
-        const cwd = "/tmp/first-project";
-        expect(isFirstTimeSetup(cwd)).toBe(true);
-        markSetupAudited(cwd);
-        expect(isFirstTimeSetup(cwd)).toBe(false);
-    });
-    it("treats distinct cwds independently", async () => {
-        const { isFirstTimeSetup, markSetupAudited } = await loadModule();
-        markSetupAudited("/tmp/project-a");
-        expect(isFirstTimeSetup("/tmp/project-a")).toBe(false);
-        expect(isFirstTimeSetup("/tmp/project-b")).toBe(true);
+    it("getAnnouncedLanguages returns [] when never announced", async () => {
+        const { getAnnouncedLanguages } = await loadModule();
+        expect(getAnnouncedLanguages("/tmp/fresh")).toEqual([]);
     });
     it("tolerates corrupt history files (treats as empty)", async () => {
         const ggDir = path.join(tmpHome, ".gg");
         fs.mkdirSync(ggDir, { recursive: true });
         fs.writeFileSync(path.join(ggDir, "setup-history.json"), "{ not valid json");
-        const { isFirstTimeSetup } = await loadModule();
-        expect(isFirstTimeSetup("/tmp/anywhere")).toBe(true);
-    });
-    it("getAnnouncedLanguages returns [] when never announced", async () => {
         const { getAnnouncedLanguages } = await loadModule();
-        expect(getAnnouncedLanguages("/tmp/fresh")).toEqual([]);
+        expect(getAnnouncedLanguages("/tmp/anywhere")).toEqual([]);
     });
     it("markLanguagesAnnounced persists and dedupes across calls", async () => {
         const { getAnnouncedLanguages, markLanguagesAnnounced } = await loadModule();
@@ -56,14 +39,16 @@ describe("setup-history", () => {
         markLanguagesAnnounced(cwd, ["typescript", "rust"]);
         expect(getAnnouncedLanguages(cwd).sort()).toEqual(["rust", "typescript"]);
     });
-    it("markLanguagesAnnounced and markSetupAudited coexist without clobbering", async () => {
-        const { isFirstTimeSetup, markSetupAudited, getAnnouncedLanguages, markLanguagesAnnounced } = await loadModule();
+    it("preserves legacy lastAuditedAt entries without clobbering", async () => {
+        const ggDir = path.join(tmpHome, ".gg");
+        fs.mkdirSync(ggDir, { recursive: true });
         const cwd = "/tmp/coexist";
+        fs.writeFileSync(path.join(ggDir, "setup-history.json"), JSON.stringify({ [cwd]: { lastAuditedAt: "2026-01-01T00:00:00.000Z" } }));
+        const { getAnnouncedLanguages, markLanguagesAnnounced } = await loadModule();
         markLanguagesAnnounced(cwd, ["python"]);
-        expect(isFirstTimeSetup(cwd)).toBe(true);
-        markSetupAudited(cwd);
-        expect(isFirstTimeSetup(cwd)).toBe(false);
         expect(getAnnouncedLanguages(cwd)).toEqual(["python"]);
+        const raw = JSON.parse(fs.readFileSync(path.join(ggDir, "setup-history.json"), "utf-8"));
+        expect(raw[cwd].lastAuditedAt).toBe("2026-01-01T00:00:00.000Z");
     });
     it("markLanguagesAnnounced is a no-op for empty input", async () => {
         const { getAnnouncedLanguages, markLanguagesAnnounced } = await loadModule();

package/dist/core/setup-history.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-history.test.js","sourceRoot":"","sources":["../../src/core/setup-history.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,IAAI,OAAe,CAAC;AAEpB,UAAU,CAAC,GAAG,EAAE;IACd,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnE,wEAAwE;IACxE,qDAAqD;IACrD,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACjD,0EAA0E;IAC1E,wEAAwE;IACxE,EAAE,CAAC,YAAY,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,EAAE,CAAC,eAAe,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,UAAU;IACvB,OAAO,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAC5C,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QAChD,MAAM,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QAClE,MAAM,GAAG,GAAG,oBAAoB,CAAC;QACjC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QAClE,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QACnC,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAC7E,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QAChD,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QACrD,MAAM,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QAC7E,MAAM,GAAG,GAAG,WAAW,CAAC;QACxB,sBAAsB,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3D,sBAAsB,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,GACzF,MAAM,UAAU,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,cAAc,CAAC;QAC3B,sBAAsB,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QAC7E,sBAAsB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"setup-history.test.js","sourceRoot":"","sources":["../../src/core/setup-history.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,IAAI,OAAe,CAAC;AAEpB,UAAU,CAAC,GAAG,EAAE;IACd,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACnE,wEAAwE;IACxE,qDAAqD;IACrD,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IACjD,0EAA0E;IAC1E,wEAAwE;IACxE,EAAE,CAAC,YAAY,EAAE,CAAC;AACpB,CAAC,CAAC,CAAC;AAEH,SAAS,CAAC,GAAG,EAAE;IACb,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,EAAE,CAAC,eAAe,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,UAAU;IACvB,OAAO,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;AAC5C,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QACrD,MAAM,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,kBAAkB,CAAC,CAAC;QAC7E,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QACrD,MAAM,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QAC7E,MAAM,GAAG,GAAG,WAAW,CAAC;QACxB,sBAAsB,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;QAC3D,sBAAsB,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACxC,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,MAAM,GAAG,GAAG,cAAc,CAAC;QAC3B,EAAE,CAAC,aAAa,CACd,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,EACtC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,0BAA0B,EAAE,EAAE,CAAC,CACzE,CAAC;QACF,MAAM,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QAC7E,sBAAsB,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC,CAEtF,CAAC;QACF,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;QACjE,MAAM,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,GAAG,MAAM,UAAU,EAAE,CAAC;QAC7E,sBAAsB,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/core/slash-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"slash-commands.d.ts","sourceRoot":"","sources":["../../src/core/slash-commands.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAElC,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,WAAW,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,IAAI,CAAC;IACjB,oDAAoD;IACpD,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,gDAAgD;IAChD,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACnF;AAID,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAmC;IAEnD,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAOrC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAS9B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAI3C,MAAM,IAAI,YAAY,EAAE;IAaxB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IASrD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CASnF;AAID,wBAAgB,qBAAqB,IAAI,YAAY,EAAE,CAwItD"}
+{"version":3,"file":"slash-commands.d.ts","sourceRoot":"","sources":["../../src/core/slash-commands.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAElC,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,UAAU,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,WAAW,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,YAAY,EAAE,MAAM,MAAM,CAAC;IAC3B,IAAI,EAAE,MAAM,IAAI,CAAC;IACjB,oDAAoD;IACpD,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,gDAAgD;IAChD,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACnF;AAID,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAmC;IAEnD,QAAQ,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI;IAOrC,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAS9B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAI3C,MAAM,IAAI,YAAY,EAAE;IAaxB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI;IASrD,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CASnF;AAID,wBAAgB,qBAAqB,IAAI,YAAY,EAAE,CAoItD"}

package/dist/core/slash-commands.js

@@ -116,13 +116,9 @@ export function createBuiltinCommands() {
         {
             name: "session",
             aliases: ["s"],
-            description: "List sessions or create new",
-            usage: "/session [list|new]",
-            async execute(args, ctx) {
-                if (args === "new" || args === "n") {
-                    await ctx.newSession();
-                    return "New session created.";
-                }
+            description: "List sessions (use /new for a new session)",
+            usage: "/session",
+            async execute(_args, ctx) {
                 return ctx.listSessions();
             },
         },