cc-codeconductor 0.3.3 → 0.4.1

package/README.md

@@ -36,6 +36,10 @@ contracts, task cards, and risk-based routing.
 >   a sitemap.xml with rate limiting and SSRF prevention
 > - `npx cc-codeconductor seo llms --sitemap <url>` — generates a `llms.txt` file
 >   for AI-search readiness from sitemap content
+> - `npx cc-codeconductor help` (alias: `cc-help`) — shows preset inventory
+>   (skills, subagents, commands) for the active or specified target
+> - `npx cc-codeconductor debt-harvest` (alias: `harvest`) — scans source files
+>   for `// defer` comments and writes `.codeconductor/debt-ledger.md`
 > - `/cc-pagespeed --url <url>` — audits web performance using the PageSpeed
 >   Insights API; applies the 80/20 principle to produce a prioritized report of
 >   Core Web Vitals (LCP, TBT, CLS, FCP, TTFB) with framework-specific fixes;
@@ -123,12 +127,14 @@ Task Card → Risk Classification → Routing Policy → Conductor Agent → Del
 - Codex preset
 - Spring Boot / Kotlin workflow
 - Python / Django workflow guidance
-- 8 core Conductor Agents
-- Routing Policy v0.1.0
+- 10 core Conductor Agents
+- Routing Policy v0.2.0
 - Task Card template
 - Scorecard template
 - End-to-end example
 - YAML-driven model configuration
+- Provider-agnostic `AgentContract` abstraction with target renderers for Claude, OpenCode, Codex, and Agy
+- Council consensus engine (`councilConsensus()`) for multi-agent governance with majority/unanimous algorithms and security veto
 
 ---
 
@@ -266,6 +272,34 @@ npx cc-codeconductor update --global
 
 Smart updates all currently installed target presets, council configurations, and skills (from `skills-lock.json`), preserving user edits outside managed blocks. Also validates that `AGENTS.md` and `CLAUDE.md` do not exceed the 40KB size limit.
 
+#### `help` — show preset inventory
+
+```bash
+npx cc-codeconductor help                    # show inventory for active target
+npx cc-codeconductor help --target claude    # show inventory for specific target
+npx cc-codeconductor cc-help                 # alias
+npx cc-codeconductor help --output json      # machine-readable output
+```
+
+Lists the skills, subagents, commands, and workflows available in the active
+preset. Reads from `presets/<target>/` in the project root.
+
+#### `debt-harvest` — collect deferred debt items
+
+```bash
+npx cc-codeconductor debt-harvest            # scan src/ for // defer comments
+npx cc-codeconductor debt-harvest --dir lib  # scan a different directory
+npx cc-codeconductor harvest                 # alias
+npx cc-codeconductor debt-harvest --output json
+```
+
+Scans source files for `// defer - [reason]` comments and consolidates them
+into `.codeconductor/debt-ledger.md`, grouped by optional tag
+(`// defer - reason --tag`). Read-only on source files; only writes the ledger.
+
+Supported extensions: `.ts`, `.tsx`, `.js`, `.jsx`, `.go`, `.rs`, `.java`,
+`.kt`, `.swift`, `.cs`, `.php`, `.scala`, `.dart`, `.c`, `.cpp`, `.h`, `.hpp`.
+
 
 ### Global options
 

package/dist/index.js

@@ -36,14 +36,15 @@ function getExitCode(error) {
   }
   return ExitCode.VALIDATION_ERROR;
 }
-var ExitCode, CliError, ValidationError, UnsafeOperationError;
+var ExitCode, CliError, ValidationError, UnsafeOperationError, CredentialGuardError;
 var init_errors = __esm(() => {
   ExitCode = {
     SUCCESS: 0,
     VALIDATION_ERROR: 1,
     UNSAFE_OPERATION: 2,
     UNSUPPORTED_PROJECT: 3,
-    CONFIG_CONFLICT: 4
+    CONFIG_CONFLICT: 4,
+    CREDENTIAL_LEAK: 5
   };
   CliError = class CliError extends Error {
     code;
@@ -67,14 +68,24 @@ var init_errors = __esm(() => {
       this.name = "UnsafeOperationError";
     }
   };
+  CredentialGuardError = class CredentialGuardError extends CliError {
+    matches;
+    constructor(message, matches, details) {
+      super(message, ExitCode.CREDENTIAL_LEAK, details);
+      this.matches = matches;
+      this.name = "CredentialGuardError";
+    }
+  };
 });
 
 // src/core/filesystem/safety.ts
 var exports_safety = {};
 __export(exports_safety, {
   validateWritePath: () => validateWritePath,
+  scanForCredentials: () => scanForCredentials,
   isWritable: () => isWritable,
   isProtectedPath: () => isProtectedPath,
+  isCredentialContent: () => isCredentialContent,
   fileExists: () => fileExists
 });
 import { constants } from "node:fs";
@@ -103,6 +114,42 @@ async function isWritable(dir) {
     return false;
   }
 }
+function buildCredentialRegexes(patterns) {
+  return patterns.map((keyword) => new RegExp(`(?:${keyword})\\s*[:=]\\s*[^\\s]{8,}`, "i"));
+}
+function scanForCredentials(filePath, content, secretPatterns) {
+  const regexes = buildCredentialRegexes(secretPatterns);
+  const lines = content.split(`
+`);
+  const matches = [];
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    for (const regex of regexes) {
+      const m = regex.exec(line);
+      if (m) {
+        matches.push({
+          filePath,
+          line: i + 1,
+          pattern: regex.source,
+          matched: m[0]
+        });
+      }
+    }
+  }
+  return matches;
+}
+function isCredentialContent(content, secretPatterns) {
+  const regexes = buildCredentialRegexes(secretPatterns);
+  const lines = content.split(`
+`);
+  for (const line of lines) {
+    for (const regex of regexes) {
+      if (regex.test(line))
+        return true;
+    }
+  }
+  return false;
+}
 var PROTECTED_PATHS;
 var init_safety = __esm(() => {
   PROTECTED_PATHS = [".git", ".env", ".env.local", ".env.production", "secrets", "credentials"];
@@ -11079,7 +11126,7 @@ function validateCouncilSpec(data) {
 function validateConfig(data) {
   return CodeConductorConfigSchema.parse(data);
 }
-var CouncilAgentSpecSchema, CouncilSpecSchema, ProjectProfileSchema, CodeConductorConfigSchema, RunnerTargetSchema, InstallStrategySchema, ManifestEntrySchema, InstallManifestSchema, ToolProviderNamesSchema, PermissionProviderNamesSchema, ModelConfigSchema;
+var CouncilAgentSpecSchema, CouncilSpecSchema, ProjectProfileSchema, CompileCheckConfigSchema, LoopConfigSchema, CodeConductorConfigSchema, RunnerTargetSchema, InstallStrategySchema, ManifestEntrySchema, InstallManifestSchema, ToolProviderNamesSchema, PermissionProviderNamesSchema, ModelConfigSchema, ContractTargetSchema, ContractFormatSchema, AgentContractSchema, CouncilFindingSchema, CouncilVerdictInputSchema, ConsensusConfigSchema, CouncilVerdictSchema, ClaudeAgentFileSchema, OpenCodeAgentFileSchema, SentryStackFrameSchema, SentryWebhookSchema;
 var init_schemas = __esm(() => {
   init_zod();
   CouncilAgentSpecSchema = exports_external.object({
@@ -11112,6 +11159,16 @@ var init_schemas = __esm(() => {
     signals: exports_external.array(exports_external.string()),
     confidence: exports_external.enum(["low", "medium", "high"])
   });
+  CompileCheckConfigSchema = exports_external.object({
+    enabled: exports_external.boolean(),
+    command: exports_external.string().optional(),
+    timeoutMs: exports_external.number().positive().optional()
+  });
+  LoopConfigSchema = exports_external.object({
+    enabled: exports_external.boolean().optional().default(true),
+    maxIterations: exports_external.number().int().positive().optional().default(3),
+    maxTokenBudget: exports_external.number().nonnegative().optional().default(0)
+  });
   CodeConductorConfigSchema = exports_external.object({
     version: exports_external.string(),
     project: exports_external.object({
@@ -11131,8 +11188,10 @@ var init_schemas = __esm(() => {
     }),
     safety: exports_external.object({
       destructiveCommands: exports_external.array(exports_external.string()),
-      secretPatterns: exports_external.array(exports_external.string())
-    })
+      secretPatterns: exports_external.array(exports_external.string()),
+      compileCheck: CompileCheckConfigSchema.optional()
+    }),
+    loop: LoopConfigSchema.optional()
   });
   RunnerTargetSchema = exports_external.enum([
     "opencode",
@@ -11176,6 +11235,80 @@ var init_schemas = __esm(() => {
     tools: exports_external.record(exports_external.string(), ToolProviderNamesSchema).optional(),
     permissions: PermissionProviderNamesSchema.optional()
   });
+  ContractTargetSchema = exports_external.enum([
+    "claude",
+    "opencode",
+    "codex",
+    "gemini",
+    "cursor",
+    "agy"
+  ]);
+  ContractFormatSchema = exports_external.object({
+    target: ContractTargetSchema,
+    options: exports_external.record(exports_external.unknown()).optional()
+  });
+  AgentContractSchema = exports_external.object({
+    council: CouncilSpecSchema,
+    targets: exports_external.array(ContractFormatSchema),
+    contractVersion: exports_external.string(),
+    renderHints: exports_external.record(ContractTargetSchema, exports_external.record(exports_external.unknown())).optional()
+  });
+  CouncilFindingSchema = exports_external.object({
+    category: exports_external.string(),
+    severity: exports_external.enum(["info", "warning", "critical"]),
+    message: exports_external.string(),
+    agentId: exports_external.string()
+  });
+  CouncilVerdictInputSchema = exports_external.object({
+    agentId: exports_external.string(),
+    agentRole: exports_external.string(),
+    status: exports_external.enum(["APPROVED", "REJECTED", "ABSTAIN"]),
+    securityVeto: exports_external.boolean(),
+    findings: exports_external.array(CouncilFindingSchema),
+    summary: exports_external.string()
+  });
+  ConsensusConfigSchema = exports_external.object({
+    algorithm: exports_external.enum(["majority", "unanimous"]),
+    allowSecurityVeto: exports_external.boolean()
+  });
+  CouncilVerdictSchema = exports_external.object({
+    status: exports_external.enum(["APPROVED", "REJECTED", "ESCALATED"]),
+    totalAgents: exports_external.number(),
+    approvedCount: exports_external.number(),
+    rejectedCount: exports_external.number(),
+    abstainedCount: exports_external.number(),
+    vetoApplied: exports_external.boolean(),
+    vetoByAgentId: exports_external.string().optional(),
+    findings: exports_external.array(CouncilFindingSchema),
+    summary: exports_external.string(),
+    individualVerdicts: exports_external.array(CouncilVerdictInputSchema)
+  });
+  ClaudeAgentFileSchema = exports_external.object({
+    path: exports_external.string().startsWith(".claude/"),
+    content: exports_external.string(),
+    overwrite: exports_external.boolean()
+  });
+  OpenCodeAgentFileSchema = exports_external.object({
+    path: exports_external.string().startsWith(".opencode/"),
+    content: exports_external.string(),
+    overwrite: exports_external.boolean()
+  });
+  SentryStackFrameSchema = exports_external.object({
+    filename: exports_external.string(),
+    function: exports_external.string(),
+    lineNo: exports_external.number(),
+    colNo: exports_external.number().optional(),
+    context: exports_external.array(exports_external.string())
+  });
+  SentryWebhookSchema = exports_external.object({
+    issueId: exports_external.string(),
+    title: exports_external.string(),
+    culprit: exports_external.string(),
+    filename: exports_external.string().optional(),
+    stackTrace: exports_external.array(SentryStackFrameSchema),
+    environment: exports_external.string().optional(),
+    release: exports_external.string().optional()
+  });
 });
 
 // src/core/presets/package-paths.ts
@@ -11865,6 +11998,58 @@ var init_agy_installer = __esm(() => {
   init_agy_council_generator();
 });
 
+// src/core/filesystem/credential-guard.ts
+import { readFile as readFile7 } from "node:fs/promises";
+async function loadPolicyPatterns() {
+  try {
+    const content = await readFile7(POLICY_PATH, "utf-8");
+    const parsed = $parse(content);
+    if (Array.isArray(parsed.secretPatterns) && parsed.secretPatterns.length > 0) {
+      return parsed.secretPatterns;
+    }
+  } catch {}
+  return [];
+}
+function mergePatterns(...arrays) {
+  const seen = new Set;
+  const result = [];
+  for (const arr of arrays) {
+    for (const p of arr) {
+      if (!seen.has(p)) {
+        seen.add(p);
+        result.push(p);
+      }
+    }
+  }
+  return result;
+}
+async function loadCredentialPatterns(config) {
+  const policyPatterns = await loadPolicyPatterns();
+  const configPatterns = config?.safety?.secretPatterns;
+  if (configPatterns && configPatterns.length > 0) {
+    return mergePatterns(configPatterns, policyPatterns, DEFAULT_SECRET_PATTERNS);
+  }
+  if (policyPatterns.length > 0) {
+    return mergePatterns(policyPatterns, DEFAULT_SECRET_PATTERNS);
+  }
+  return DEFAULT_SECRET_PATTERNS;
+}
+var DEFAULT_SECRET_PATTERNS;
+var init_credential_guard = __esm(() => {
+  init_dist();
+  init_package_paths();
+  DEFAULT_SECRET_PATTERNS = [
+    "password",
+    "secret",
+    "api_key",
+    "token",
+    "api[_-]?key",
+    "access[_-]?token",
+    "auth[_-]?token",
+    "private[_-]?key"
+  ];
+});
+
 // src/core/filesystem/file-writer.ts
 var exports_file_writer = {};
 __export(exports_file_writer, {
@@ -11875,6 +12060,13 @@ import { access as access4, mkdir as mkdir4, writeFile as writeFile4 } from "nod
 import { dirname as dirname3 } from "node:path";
 async function writeGeneratedFiles(files, options) {
   const results = [];
+  const secretPatterns = await loadCredentialPatterns(options.config);
+  const allMatches = files.flatMap((file) => {
+    return scanForCredentials(file.path, file.content, secretPatterns);
+  });
+  if (allMatches.length > 0) {
+    throw new CredentialGuardError(`Credential leak detected in ${allMatches.length} file(s). No files written.`, allMatches);
+  }
   for (const file of files) {
     if (!validateWritePath(file.path)) {
       results.push({
@@ -11933,6 +12125,7 @@ async function writeSingleFile(path, content, options) {
 }
 var init_file_writer = __esm(() => {
   init_errors();
+  init_credential_guard();
   init_safety();
 });
 
@@ -11941,7 +12134,7 @@ init_errors();
 // package.json
 var package_default = {
   name: "cc-codeconductor",
-  version: "0.3.3",
+  version: "0.4.1",
   description: "A multi-agent orchestration framework for AI-assisted software engineering workflows.",
   keywords: [
     "ai",
@@ -13604,7 +13797,7 @@ async function doctorCommand(options) {
 }
 
 // src/commands/init.command.ts
-import { access as access3, mkdir as mkdir3, readFile as readFile7, writeFile as writeFile3 } from "node:fs/promises";
+import { access as access3, mkdir as mkdir3, readFile as readFile8, writeFile as writeFile3 } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import { basename, resolve as resolve7 } from "node:path";
 
@@ -13615,6 +13808,7 @@ import { access as access2, mkdir as mkdir2, writeFile as writeFile2 } from "nod
 import { resolve as resolve6 } from "node:path";
 
 // src/core/config/codeconductor-config.ts
+init_credential_guard();
 var DEFAULT_CONFIG = {
   version: "0.2.0",
   project: {
@@ -13633,7 +13827,17 @@ var DEFAULT_CONFIG = {
   },
   safety: {
     destructiveCommands: ["rm -rf", "drop table", "delete from"],
-    secretPatterns: ["password", "secret", "api_key", "token"]
+    secretPatterns: DEFAULT_SECRET_PATTERNS,
+    compileCheck: {
+      enabled: true,
+      command: "tsc --noEmit",
+      timeoutMs: 120000
+    }
+  },
+  loop: {
+    enabled: true,
+    maxIterations: 3,
+    maxTokenBudget: 0
   }
 };
 
@@ -13890,7 +14094,7 @@ async function copyPresets(baseDir, presets, force) {
       continue;
     }
     try {
-      const content = await readFile7(preset.sourcePath, "utf-8");
+      const content = await readFile8(preset.sourcePath, "utf-8");
       await writeFile3(destPath, content, "utf-8");
       copied.push(`.codeconductor/presets/${preset.name}`);
     } catch (err2) {
@@ -13959,8 +14163,10 @@ async function installCommand(options) {
         }
       };
     }
+    const configResult = await loadConfig(projectRoot);
+    const config = configResult.success ? configResult.data : undefined;
     const spec = presetResult.data;
-    const writeOptions = { dryRun, force };
+    const writeOptions = { dryRun, force, config };
     const allFiles = [];
     for (const t of targets) {
       let installer;
@@ -14627,7 +14833,9 @@ async function installLspCommand(options) {
     }
     const installer = createLspInstaller();
     const installReport = await installer.installAll(lsps, { dryRun });
-    const writeOptions = { dryRun, force };
+    const configResult = await loadConfig(projectRoot);
+    const config = configResult.success ? configResult.data : undefined;
+    const writeOptions = { dryRun, force, config };
     const allConfigResults = [];
     for (const t of targets) {
       const generator = getLspConfigGenerator(t);
@@ -14729,8 +14937,277 @@ function getLspConfigGenerator(target) {
   }
 }
 
+// src/commands/debt-harvest.command.ts
+import { readdir as readdir2, readFile as readFile9, writeFile as writeFile5, mkdir as mkdir6 } from "node:fs/promises";
+import { join as join7, relative as relative2, extname } from "node:path";
+var DEFER_REGEX = /\/\/\s*defer\s*[-:]\s*(.+?)(?:\s*--(\w+))?\s*$/gm;
+var SOURCE_EXTENSIONS = new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".go",
+  ".rs",
+  ".java",
+  ".kt",
+  ".swift",
+  ".cs",
+  ".php",
+  ".scala",
+  ".dart",
+  ".c",
+  ".cpp",
+  ".h",
+  ".hpp"
+]);
+async function walkDir(dir, extensions) {
+  const results = [];
+  try {
+    const entries = await readdir2(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const fullPath = join7(dir, entry.name);
+      if (entry.isDirectory()) {
+        if (entry.name.startsWith(".") || entry.name === "node_modules")
+          continue;
+        results.push(...await walkDir(fullPath, extensions));
+      } else if (extensions.has(extname(entry.name))) {
+        results.push(fullPath);
+      }
+    }
+  } catch {}
+  return results;
+}
+function extractDefers(content, filePath) {
+  const entries = [];
+  const lines = content.split(`
+`);
+  for (let i = 0;i < lines.length; i++) {
+    const line = lines[i];
+    DEFER_REGEX.lastIndex = 0;
+    const match = DEFER_REGEX.exec(line);
+    if (match) {
+      entries.push({
+        file: filePath,
+        line: i + 1,
+        reason: match[1].trim(),
+        tag: match[2]
+      });
+    }
+  }
+  return entries;
+}
+function renderLedger(entries) {
+  const grouped = new Map;
+  for (const entry of entries) {
+    const tag = entry.tag ?? "unclassified";
+    const group = grouped.get(tag) ?? [];
+    group.push(entry);
+    grouped.set(tag, group);
+  }
+  const lines = [
+    "<!-- CODECONDUCTOR:BEGIN managed -->",
+    "",
+    "# Debt Ledger",
+    "",
+    "> Auto-generated by `codeconductor debt-harvest`. Do not edit manually.",
+    ""
+  ];
+  const sortedTags = [...grouped.keys()].sort();
+  for (const tag of sortedTags) {
+    const tagEntries = grouped.get(tag);
+    lines.push(`## ${tag}`);
+    lines.push("");
+    lines.push("| File | Line | Reason |");
+    lines.push("| ---- | ---- | ------ |");
+    for (const entry of tagEntries) {
+      lines.push(`| ${entry.file} | ${entry.line} | ${entry.reason} |`);
+    }
+    lines.push("");
+  }
+  lines.push("<!-- CODECONDUCTOR:END managed -->");
+  lines.push("");
+  return lines.join(`
+`);
+}
+async function debtHarvestCommand(options) {
+  const { projectRoot, dir = "src", output } = options;
+  try {
+    const targetDir = join7(projectRoot, dir);
+    const files = await walkDir(targetDir, SOURCE_EXTENSIONS);
+    const allEntries = [];
+    for (const file of files) {
+      const content = await readFile9(file, "utf-8");
+      const entries = extractDefers(content, relative2(projectRoot, file));
+      allEntries.push(...entries);
+    }
+    const ledgerDir = join7(projectRoot, ".codeconductor");
+    await mkdir6(ledgerDir, { recursive: true });
+    const ledgerPath = join7(ledgerDir, "debt-ledger.md");
+    const ledgerContent = renderLedger(allEntries);
+    await writeFile5(ledgerPath, ledgerContent, "utf-8");
+    if (output === "json") {
+      return {
+        code: 0,
+        data: {
+          success: true,
+          command: "debt-harvest",
+          entries: allEntries,
+          entryCount: allEntries.length,
+          ledger: ledgerPath
+        }
+      };
+    }
+    return {
+      code: 0,
+      data: {
+        success: true,
+        command: "debt-harvest",
+        message: `Found ${allEntries.length} deferred item(s) across ${files.length} file(s). Ledger written to ${ledgerPath}`,
+        entries: allEntries
+      }
+    };
+  } catch (error) {
+    return {
+      code: 1,
+      data: {
+        success: false,
+        command: "debt-harvest",
+        errors: [String(error)]
+      }
+    };
+  }
+}
+
+// src/commands/help.command.ts
+import { readdir as readdir3 } from "node:fs/promises";
+import { join as join8 } from "node:path";
+async function scanPresetDir(projectRoot, target) {
+  const inventory = {
+    target,
+    skills: [],
+    commands: [],
+    agents: [],
+    workflows: []
+  };
+  const presetDir = join8(projectRoot, "presets", target);
+  try {
+    const entries = await readdir3(presetDir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (entry.isDirectory()) {
+        const subDir = join8(presetDir, entry.name);
+        const subEntries = await readdir3(subDir, { withFileTypes: true });
+        for (const sub of subEntries) {
+          if (sub.isFile()) {
+            const itemName = sub.name.replace(/\.[^.]+$/, "");
+            if (entry.name === "skills")
+              inventory.skills.push(itemName);
+            else if (entry.name === "commands")
+              inventory.commands.push(itemName);
+            else if (entry.name === "agents")
+              inventory.agents.push(itemName);
+            else if (entry.name === "workflows")
+              inventory.workflows.push(itemName);
+          } else if (sub.isDirectory()) {
+            if (entry.name === "skills")
+              inventory.skills.push(sub.name);
+            else if (entry.name === "agents")
+              inventory.agents.push(sub.name);
+          }
+        }
+      }
+    }
+  } catch {}
+  return inventory;
+}
+function renderHuman(inventory, defaultTarget) {
+  const lines = [
+    `CodeConductor Help — ${inventory.target}${inventory.target === defaultTarget ? " (active)" : ""}`,
+    ""
+  ];
+  lines.push(`Skills (${inventory.skills.length}):`);
+  if (inventory.skills.length === 0) {
+    lines.push("  (none)");
+  } else {
+    for (const skill of inventory.skills.sort()) {
+      lines.push(`  - ${skill}`);
+    }
+  }
+  lines.push("");
+  lines.push(`Subagents (${inventory.agents.length}):`);
+  if (inventory.agents.length === 0) {
+    lines.push("  (none)");
+  } else {
+    for (const agent of inventory.agents.sort()) {
+      lines.push(`  - ${agent}`);
+    }
+  }
+  lines.push("");
+  lines.push(`Commands (${inventory.commands.length}):`);
+  if (inventory.commands.length === 0) {
+    lines.push("  (none)");
+  } else {
+    for (const cmd of inventory.commands.sort()) {
+      lines.push(`  - ${cmd}`);
+    }
+  }
+  if (inventory.workflows.length > 0) {
+    lines.push("");
+    lines.push(`Workflows (${inventory.workflows.length}):`);
+    for (const wf of inventory.workflows.sort()) {
+      lines.push(`  - ${wf}`);
+    }
+  }
+  return lines.join(`
+`);
+}
+async function helpCommand(options) {
+  const { projectRoot, target: overrideTarget, output } = options;
+  try {
+    let defaultTarget = "opencode";
+    try {
+      const configResult = await loadConfig(projectRoot);
+      if (configResult.success) {
+        defaultTarget = configResult.data.defaults.target;
+      }
+    } catch {}
+    const target = overrideTarget ?? defaultTarget;
+    const inventory = await scanPresetDir(projectRoot, target);
+    if (output === "json") {
+      return {
+        code: 0,
+        data: {
+          success: true,
+          command: "help",
+          inventory,
+          defaultTarget
+        }
+      };
+    }
+    return {
+      code: 0,
+      data: {
+        success: true,
+        command: "help",
+        message: renderHuman(inventory, defaultTarget),
+        inventory
+      }
+    };
+  } catch (error) {
+    return {
+      code: 1,
+      data: {
+        success: false,
+        command: "help",
+        errors: [String(error)]
+      }
+    };
+  }
+}
+
 // src/commands/seo-audit.command.ts
-import { writeFile as writeFile5, mkdir as mkdir6 } from "node:fs/promises";
+import { writeFile as writeFile6, mkdir as mkdir7 } from "node:fs/promises";
 import { dirname as dirname4, resolve as resolve10 } from "node:path";
 
 // src/infrastructure/http/safe-fetch.ts
@@ -16023,13 +16500,13 @@ async function seoAuditCommand(options) {
     }
     if (output) {
       const outputPath = resolve10(options.projectRoot, output);
-      await mkdir6(dirname4(outputPath), { recursive: true });
-      await writeFile5(outputPath, formattedOutput, "utf-8");
+      await mkdir7(dirname4(outputPath), { recursive: true });
+      await writeFile6(outputPath, formattedOutput, "utf-8");
     } else if (format === "markdown") {
       const timestamp = new Date().toISOString().replace(/[:.]/g, "-").slice(0, 19);
       const defaultPath = resolve10(options.projectRoot, "seo-reports", `audit-report-${timestamp}.md`);
-      await mkdir6(dirname4(defaultPath), { recursive: true });
-      await writeFile5(defaultPath, formattedOutput, "utf-8");
+      await mkdir7(dirname4(defaultPath), { recursive: true });
+      await writeFile6(defaultPath, formattedOutput, "utf-8");
       process.stderr.write(`Report saved to: ${defaultPath}
 `);
     }
@@ -16057,7 +16534,7 @@ async function seoAuditCommand(options) {
 }
 
 // src/commands/seo-llms.command.ts
-import { writeFile as writeFile6, mkdir as mkdir7 } from "node:fs/promises";
+import { writeFile as writeFile7, mkdir as mkdir8 } from "node:fs/promises";
 import { dirname as dirname5, resolve as resolve11 } from "node:path";
 
 // src/domain/seo/llms-generator.ts
@@ -16202,8 +16679,8 @@ async function seoLlmsCommand(options) {
     }) : await generateLlmsTxtFromUrl(url);
     process.stderr.write("\r" + " ".repeat(80) + "\r");
     const outputPath = output ? resolve11(options.projectRoot, output) : resolve11(options.projectRoot, "llms.txt");
-    await mkdir7(dirname5(outputPath), { recursive: true });
-    await writeFile6(outputPath, result.content, "utf-8");
+    await mkdir8(dirname5(outputPath), { recursive: true });
+    await writeFile7(outputPath, result.content, "utf-8");
     process.stderr.write(`Generated: ${outputPath} (${result.entries.length} entries)
 `);
     return {
@@ -16231,7 +16708,7 @@ async function seoLlmsCommand(options) {
 // src/commands/update.command.ts
 import { homedir as homedir9 } from "node:os";
 import { resolve as resolve12, dirname as dirname6 } from "node:path";
-import { mkdir as mkdir8, readFile as readFile8, writeFile as writeFile7, stat as stat3 } from "node:fs/promises";
+import { mkdir as mkdir9, readFile as readFile10, writeFile as writeFile8, stat as stat3 } from "node:fs/promises";
 init_package_paths();
 async function updateCommand(options) {
   const { dryRun, force, global: isGlobal, output, projectRoot } = options;
@@ -16300,9 +16777,9 @@ async function updateCommand(options) {
       const localCouncil = resolve12(basePath, ".codeconductor", "presets", "council.yml");
       const bundledCouncil = resolve12(SRC_PRESETS_DIR, "council", "council.yml");
       try {
-        const content = await readFile8(bundledCouncil, "utf-8");
-        await mkdir8(dirname6(localCouncil), { recursive: true });
-        await writeFile7(localCouncil, content, "utf-8");
+        const content = await readFile10(bundledCouncil, "utf-8");
+        await mkdir9(dirname6(localCouncil), { recursive: true });
+        await writeFile8(localCouncil, content, "utf-8");
         updated.push(localCouncil);
       } catch (e) {
         throw new Error(`Failed to update council.yml: ${e}`);
@@ -16311,9 +16788,9 @@ async function updateCommand(options) {
     if (updateResults.policy) {
       const localPolicy = resolve12(basePath, ".codeconductor", "presets", "policy.yml");
       try {
-        const content = await readFile8(POLICY_PATH, "utf-8");
-        await mkdir8(dirname6(localPolicy), { recursive: true });
-        await writeFile7(localPolicy, content, "utf-8");
+        const content = await readFile10(POLICY_PATH, "utf-8");
+        await mkdir9(dirname6(localPolicy), { recursive: true });
+        await writeFile8(localPolicy, content, "utf-8");
         updated.push(localPolicy);
       } catch (e) {
         throw new Error(`Failed to update policy.yml: ${e}`);
@@ -16375,7 +16852,7 @@ async function updateCommand(options) {
               });
               const filesToWrite = resolvedFiles.filter((f) => t.files.includes(f.path));
               if (filesToWrite.length > 0) {
-                const writeResults = await writeGeneratedFiles2(filesToWrite, { dryRun: false, force: true });
+                const writeResults = await writeGeneratedFiles2(filesToWrite, { dryRun: false, force: true, config });
                 for (const wr of writeResults) {
                   if (wr.success) {
                     updated.push(wr.path);
@@ -16409,8 +16886,8 @@ async function updateCommand(options) {
         }
       } catch {}
       try {
-        await mkdir8(dirname6(lockDest), { recursive: true });
-        await writeFile7(lockDest, JSON.stringify(newSkillsLock, null, 2), "utf-8");
+        await mkdir9(dirname6(lockDest), { recursive: true });
+        await writeFile8(lockDest, JSON.stringify(newSkillsLock, null, 2), "utf-8");
         updated.push(lockDest);
       } catch (e) {
         throw new Error(`Failed to write skills-lock.json: ${e}`);
@@ -16519,6 +16996,8 @@ Commands:
   seo llms               Generate llms.txt from a URL or sitemap
   doctor                 Validate configuration and generated files
   update                 Update installed presets
+  help / cc-help         Show preset inventory (skills, subagents, commands)
+  debt-harvest / harvest Scan source files for deferred debt items
 
 Options:
   --help, -h             Show this help message
@@ -16562,8 +17041,6 @@ Examples:
 async function routeCommand(args, projectRoot) {
   const { command, subcommand, options, flags } = args;
   switch (command) {
-    case "help":
-      return { code: 0, data: { help: getHelp() } };
     case "init":
       return initCommand({
         projectRoot,
@@ -16632,6 +17109,20 @@ async function routeCommand(args, projectRoot) {
         global: options.global === true || options.global === "true",
         output: flags.output
       });
+    case "help":
+    case "cc-help":
+      return helpCommand({
+        projectRoot,
+        target: options.target,
+        output: flags.output
+      });
+    case "debt-harvest":
+    case "harvest":
+      return debtHarvestCommand({
+        projectRoot,
+        dir: options.dir,
+        output: flags.output
+      });
     case "seo": {
       if (subcommand === "audit") {
         return seoAuditCommand({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cc-codeconductor",
-  "version": "0.3.3",
+  "version": "0.4.1",
   "description": "A multi-agent orchestration framework for AI-assisted software engineering workflows.",
   "keywords": [
     "ai",

package/policy.yml

@@ -48,6 +48,18 @@ denyWrite:
   - "/var/**"
   - "~/**"
 
+# Credential patterns for secret detection.
+# These are merged with CodeConductorConfig.safety.secretPatterns at runtime.
+secretPatterns:
+  - password
+  - secret
+  - api_key
+  - token
+  - api[_-]?key
+  - access[_-]?token
+  - auth[_-]?token
+  - private[_-]?key
+
 targets:
   opencode:
     unsupportedRules: []

package/presets/agy/AGENTS.md

@@ -24,6 +24,21 @@ LLM coding mistakes and bias toward caution over speed.
    success criteria. For multi-step tasks, state a plan with verification
    checks. Loop until verified.
 
+### YAGNI (You Aren't Gonna Need It)
+
+Do not build features, abstractions, or "flexibility" that is not explicitly
+requested. If the user asks for a function, write a function — not a class
+hierarchy. If they ask for a string, return a string — not a Result type
+with 15 error codes. Every line you write must solve a problem that exists
+**now**.
+
+### Stdlib-First
+
+Prefer the language's standard library over third-party packages. Before
+adding a dependency, ask: "Does `node:fs`, `node:path`, `node:crypto`, or
+a built-in module solve this?" If yes, use it. Every external dependency
+introduces maintenance burden, supply-chain risk, and version conflicts.
+
 ---
 
 ## Workflow Contract
@@ -95,6 +110,7 @@ When multiple signals apply, take the highest risk level. Do not average.
 | Documentation update | any         | `docs`                                              |
 | Codebase exploration | any         | `repo-explorer`                                     |
 | Code review          | any         | `reviewer`                                          |
+| Security review      | high        | `security-reviewer` → `reviewer`                    |
 
 ---
 
@@ -371,6 +387,32 @@ High-risk checkpoint: [yes | no — if yes, describe what triggers a stop]
 
 ---
 
+### security-reviewer
+
+**Role:** Dedicated security review. Provider-agnostic sub-agent that performs deep security analysis on code changes. Can apply a security veto that overrides majority consensus.
+
+**Use when:** High-risk tasks touching auth, payment, credentials, injection vectors, or supply-chain dependencies. Mandatory for security-sensitive changes.
+
+**Permissions:**
+- read: `allow`
+- edit: `deny`
+- bash: `allow` (git diff, git status)
+- network: `deny`
+
+**Does not:** Write code. Edit files. Bypass security veto mechanism.
+
+**Provider-agnostic constraints:**
+- No vendor-specific prompts, APIs, or model identifiers in role definition
+- All security analysis must be expressed through the council consensus interface (`securityVeto` flag on `REJECTED` verdict)
+- Focus areas: vulnerabilities, credentials, injection, auth, supply-chain, OWASP Top 10
+
+**Veto behavior:**
+- When `securityVeto: true` and `status: 'REJECTED'`, the veto overrides majority consensus → final status becomes `REJECTED`
+- The veto agent is recorded in `vetoByAgentId` for traceability
+- Composable: can be added alongside existing council agents without replacing the general `security` agent
+
+---
+
 ### docs
 
 **Role:** Updates README, OpenAPI specs, ADRs, and changelogs.

package/presets/agy/skills/cc-review/SKILL.md

@@ -43,13 +43,37 @@ reviewer.
 
 ---
 
-## Step 2 — Code review (reviewer)
+## Step 2 — Security and code review
+
+### Security review (security-reviewer)
+
+Invoke `security-reviewer` **before** `reviewer` when the change touches:
+
+- Authentication or authorization logic
+- Payment or financial processing
+- Credentials, tokens, secrets, or API keys
+- SQL injection, XSS, or other injection vectors
+- Supply-chain dependencies (new packages, lockfile changes)
+- OWASP Top 10 categories
+
+`security-reviewer` performs deep security analysis and can apply a **security
+veto** that overrides majority consensus:
+
+- When `securityVeto: true` and verdict is `REJECTED`, the veto forces the
+  final status to `REJECTED` regardless of other reviewers' opinions
+- The veto agent ID is recorded in `vetoByAgentId` for traceability
+
+If `security-reviewer` applies a veto, the review is **BLOCKED** — all CRITICAL
+findings must be resolved before proceeding.
+
+### Code review (reviewer)
 
 Invoke `reviewer` with:
 
 - The full diff
 - The Task Card or PR description (if available)
 - The target specification from $ARGUMENTS
+- The security-reviewer report (if one was generated)
 
 reviewer must evaluate the diff against the following checklist:
 

package/presets/claude/CLAUDE.md

@@ -26,6 +26,21 @@ LLM coding mistakes and bias toward caution over speed.
    success criteria. For multi-step tasks, state a plan with verification
    checks. Loop until verified.
 
+### YAGNI (You Aren't Gonna Need It)
+
+Do not build features, abstractions, or "flexibility" that is not explicitly
+requested. If the user asks for a function, write a function — not a class
+hierarchy. If they ask for a string, return a string — not a Result type
+with 15 error codes. Every line you write must solve a problem that exists
+**now**.
+
+### Stdlib-First
+
+Prefer the language's standard library over third-party packages. Before
+adding a dependency, ask: "Does `node:fs`, `node:path`, `node:crypto`, or
+a built-in module solve this?" If yes, use it. Every external dependency
+introduces maintenance burden, supply-chain risk, and version conflicts.
+
 ---
 
 ## Core Terminology
@@ -481,6 +496,55 @@ _(none)_ if no suggestions
 
 ---
 
+### Complexity Auditor
+
+Analyzes the implementation diff for bloat, unnecessary abstractions, and
+non-native solutions. Produces a Complexity Audit Report that feeds the
+scorecard's cc-gain criterion. Does not edit code.
+
+**Does not:** propose new dependencies, suggest new abstractions, recommend
+external libraries, edit any file.
+
+**Analysis axes:**
+
+| Axis                    | What to detect                                                   |
+| ----------------------- | ---------------------------------------------------------------- |
+| LOC delta               | Lines added vs removed — net simplification                     |
+| Dependency delta        | External deps added vs removed — prefer stdlib                  |
+| Cyclomatic complexity   | Conditional complexity changes — fewer branches = better        |
+| Bloat patterns          | Trivial wrappers, one-method classes, unused imports, etc.      |
+
+**Complexity Audit Report format:**
+
+```markdown
+## Complexity Audit Report
+
+**Task**: [objective from Task Card] **Auditor**: Complexity Auditor
+
+### Metrics
+
+| Metric               | Added | Removed | Delta |
+| -------------------- | ----- | ------- | ----- |
+| LOC                  |       |         |       |
+| Dependencies         |       |         |       |
+| Cyclomatic complexity|       |         |       |
+
+### Findings
+
+- [ ] [F1] [file:line] — [description] Pattern: [bloat-pattern] Action: [delete|replace-native]
+
+_(none)_ if no bloat patterns detected
+
+### Summary
+
+- LOC delta: [+/-N]
+- Deps delta: [+/-N]
+- Cyclomatic delta: [+/-N]
+- Findings: [count]
+```
+
+---
+
 ### Docs
 
 Updates README, OpenAPI specs, ADRs, and CHANGELOG to reflect what was actually
@@ -530,11 +594,11 @@ behavior that was not implemented. Omit CHANGELOG entries.
 
 ## Routing Policy
 
-| Risk Level | Route                                                                                            |
-| ---------- | ------------------------------------------------------------------------------------------------ |
-| low        | Repo Explorer → Implementer → Tester                                                             |
-| medium     | Repo Explorer → Architect → Implementer → Tester → Reviewer                                      |
-| high       | Task Coach → Repo Explorer → Architect → [human review] → Implementer → Tester → Reviewer → Docs |
+| Risk Level | Route                                                                                                 |
+| ---------- | ----------------------------------------------------------------------------------------------------- |
+| low        | Repo Explorer → Implementer → Tester                                                                  |
+| medium     | Repo Explorer → Architect → Implementer → Complexity Auditor → Tester → Reviewer                      |
+| high       | Task Coach → Repo Explorer → Architect → [human review] → Implementer → Complexity Auditor → Tester → Reviewer → Docs |
 
 **Classification heuristics:**
 

package/presets/codex/AGENTS.md

@@ -26,6 +26,21 @@ LLM coding mistakes and bias toward caution over speed.
    success criteria. For multi-step tasks, state a plan with verification
    checks. Loop until verified.
 
+### YAGNI (You Aren't Gonna Need It)
+
+Do not build features, abstractions, or "flexibility" that is not explicitly
+requested. If the user asks for a function, write a function — not a class
+hierarchy. If they ask for a string, return a string — not a Result type
+with 15 error codes. Every line you write must solve a problem that exists
+**now**.
+
+### Stdlib-First
+
+Prefer the language's standard library over third-party packages. Before
+adding a dependency, ask: "Does `node:fs`, `node:path`, `node:crypto`, or
+a built-in module solve this?" If yes, use it. Every external dependency
+introduces maintenance burden, supply-chain risk, and version conflicts.
+
 ---
 
 ## Workflow Contract
@@ -98,6 +113,7 @@ When multiple signals apply, take the highest risk level. Do not average.
 | Documentation update | any         | `docs`                                              |
 | Codebase exploration | any         | `repo-explorer`                                     |
 | Code review          | any         | `reviewer`                                          |
+| Security review      | high        | `security-reviewer` → `reviewer`                    |
 
 ---
 
@@ -604,6 +620,42 @@ _(none)_ if no suggestions
 
 ---
 
+### security-reviewer
+
+**Role:** Dedicated security review. Provider-agnostic sub-agent that performs
+deep security analysis on code changes. Can apply a security veto that overrides
+majority consensus.
+
+**Use when:** High-risk tasks touching auth, payment, credentials, injection
+vectors, or supply-chain dependencies. Mandatory for security-sensitive changes.
+
+**Permissions:**
+
+- read: `allow`
+- edit: `deny`
+- bash: `allow` (`git diff`, `git status`)
+- network: `deny`
+
+**Does not:** Write code. Edit files. Bypass security veto mechanism.
+
+**Provider-agnostic constraints:**
+
+- No vendor-specific prompts, APIs, or model identifiers in role definition
+- All security analysis must be expressed through the council consensus
+  interface (`securityVeto` flag on `REJECTED` verdict)
+- Focus areas: vulnerabilities, credentials, injection, auth, supply-chain,
+  OWASP Top 10
+
+**Veto behavior:**
+
+- When `securityVeto: true` and `status: 'REJECTED'`, the veto overrides
+  majority consensus → final status becomes `REJECTED`
+- The veto agent is recorded in `vetoByAgentId` for traceability
+- Composable: can be added alongside existing council agents without replacing
+  the general `security` agent
+
+---
+
 ### docs
 
 **Role:** Updates README, OpenAPI specs, ADRs, and CHANGELOG to reflect what was

package/presets/opencode/README.md

@@ -185,6 +185,21 @@ export KIMI_API_KEY="your-key"
 - When using tools, be precise and minimal with context.
 {{LANGUAGE_INSTRUCTIONS}}
 
+### YAGNI (You Aren't Gonna Need It)
+
+Do not build features, abstractions, or "flexibility" that is not explicitly
+requested. If the user asks for a function, write a function — not a class
+hierarchy. If they ask for a string, return a string — not a Result type
+with 15 error codes. Every line you write must solve a problem that exists
+**now**.
+
+### Stdlib-First
+
+Prefer the language's standard library over third-party packages. Before
+adding a dependency, ask: "Does `node:fs`, `node:path`, `node:crypto`, or
+a built-in module solve this?" If yes, use it. Every external dependency
+introduces maintenance burden, supply-chain risk, and version conflicts.
+
 ## Context Budget
 
 - If the task type differs from the previous one, execute "/clear" before

package/presets/opencode/agents/complexity-auditor.md

@@ -0,0 +1,89 @@
+---
+name: complexity-auditor
+description:
+  Analyzes code for bloat, unnecessary abstractions, and non-native solutions —
+  produces a Complexity Audit Report with LOC deltas, dependency changes,
+  cyclomatic complexity metrics, and bloat pattern findings.
+mode: subagent
+model: "{{MODEL}}"
+temperature: 0.1
+tools: Read, Glob, Grep
+permission:
+  read: allow
+  edit: deny
+  bash:
+    "*": deny
+  glob: allow
+  grep: allow
+  webfetch: deny
+  websearch: deny
+  skill: deny
+---
+
+You are the Complexity Auditor — the code quality gate in the CodeConductor
+framework. You analyze diffs for bloat, unnecessary abstractions, and non-native
+solutions. You do not edit code. You do not propose new dependencies.
+
+## Your Contract
+
+You may only propose **deletions** or **native replacements**. You never propose
+new dependencies, new abstractions, or external libraries. Every finding must
+map to a concrete action: `delete` (remove code) or `replace-native` (swap
+external dep for stdlib equivalent).
+
+## Analysis Axes
+
+| Axis                    | What to detect                                                   |
+| ----------------------- | ---------------------------------------------------------------- |
+| LOC delta               | Lines added vs removed — net simplification                     |
+| Dependency delta        | External deps added vs removed — prefer stdlib                  |
+| Cyclomatic complexity   | Conditional complexity changes — fewer branches = better        |
+| Bloat patterns          | Trivial wrappers, one-method classes, unused imports, etc.      |
+
+## Bloat Patterns to Detect
+
+- **single-implementation-interface** — Interface with only one implementation
+- **trivial-wrapper** — Function that only delegates to another function
+- **one-method-class** — Class with only one method (a function may suffice)
+- **unused-import** — Imported name not used in added code
+- **external-dep-for-native** — External dep replaceable with stdlib
+- **excessive-abstraction** — Deep class hierarchy or unnecessary indirection
+- **dead-code** — Code added but never referenced
+
+## Complexity Audit Report Format
+
+```markdown
+## Complexity Audit Report
+
+**Task**: [objective from Task Card] **Auditor**: Complexity Auditor
+
+### Metrics
+
+| Metric               | Added | Removed | Delta |
+| -------------------- | ----- | ------- | ----- |
+| LOC                  |       |         |       |
+| Dependencies         |       |         |       |
+| Cyclomatic complexity|       |         |       |
+
+### Findings
+
+- [ ] [F1] [file:line] — [description] Pattern: [bloat-pattern] Action: [delete|replace-native]
+
+_(none)_ if no bloat patterns detected
+
+### Summary
+
+- LOC delta: [+/-N]
+- Deps delta: [+/-N]
+- Cyclomatic delta: [+/-N]
+- Findings: [count]
+```
+
+## What You Never Do
+
+- Edit any file — source, test, documentation, or configuration
+- Propose new dependencies or external libraries
+- Suggest new abstractions or design patterns
+- Override the Orchestrator's routing decision
+- Issue findings without a concrete action (delete or replace-native)
+- Analyze a diff you have not fully read